Gsm Grps Training

GSM/GRPS TrainingBasic GSM/GPRS Training
Mobile Communication (GSM)
Outline
Packet Data for the GSM World
GPRS Overview
The GPRS Protocol Stack
High Speed Circuit Switched Data (HSCSD)
Enhanced Data Rates for Global Evolution (EDGE)
* Nokia Mobile Phones July 9, 2002 Sascha Meyer CONFIDENTIAL
An Introduction to GSM
GSM Overview
The Past…
The standardization of GSM (Global System for Mobile Communication) was carried out by ETSI in the late 1980’s to provide an all digital mobile communication system in the 900 MHz range to the European market.
…and The Present
for different applications and frequency
ranges (R-GSM, E-GSM, PCS1900, …).
alternative solutions. The idea is to
achieve a high reuse factor of
the available frequencies.
GSM Overview
BSS
NSS
MS
Mobile Station and SIM
A Mobile Station (MS) consists of Mobile Equipment (ME) and SIM card
Every MS performs the following tasks:
Mobile Equipment
Mobile Station and SIM
The Subscriber Identity Module (SIM) is a typical Smart Card
SIM cards are available as ID-1 and Plug-In SIM
SIM performs algorithms and stores data (see table for some exambles).
Administrative Data
Security Related Data
A3 and A8 algorithms for authentication and Kc calculation Keys Ki (subscriber‘s individual secret key) and Kc (session key)
Subscriber Data
Roaming Data
TMSI, Location updating status, LAI NCCs of restricted PLMNs and NCCs of preferred PLMNs
PLMN Data
Home PLMN‘s NCC, MCC, MNC ARFCNs (Absolute Radio Freq. Channel Numbers) of home PLMN (frequencies for which the home PLMN is licensed)
The Basestation Subsystem
Base Station Controller (BSC)
BSC was invented to relieve the MSC from radio related tasks like access control or handover scenarios (-> do not require contribution of MSC).
Base Transceiver Station (BTS)
The BTS connects the GSM network to the air interface and has multiple radio related functions like interleaving, channel coding and ciphering. Important: BTS broadcasts BCCH with constant output power to supply surrounding mobile stations with cell specific information and to serve as a beacon for handover decisions.
Transcoding Rate and Adaption Unit
The TRAU is used for speech compression and is transparent for data connections. Since human speech is quite redundant, compression rates of 1/4 (fullrate channel (FR)) and even 1/8 (halfrate channel (HR)) are achieved.
The Network Subsystem
Mobile services Switching Center (MSC)
The MSC is a digital switch that has been upgraded to suit the requirements of a mobile network environment. In GSM, the MSC takes care of resource management towards the BSC and is responsible for call processing in MO Calls and MT Calls. The MSC can process handover procedures between two and even three MSCs. Special function: Gateway-MSC (G-MSC) provides access to external networks. Other MSCs with more special functions for the processing of short messages: SMS-IW-MSC, SMS-G-MSC.
Visitor Location Register (VLR)
Initially, the VLR was considered a different network element from the MSC. Then the VLR became part of what is now called MSC/VLR. Still, from the protocol perspective, the VLR takes care of different tasks
(=> Mobility Management (MM)) than the MSC (=> Call Control (CC)).
The Network Subsystem
Home Location Register & Authentication Center (HLR/AuC)
The HLR is a huge database for permanent storage of subscriber data. The different VLRs and MSCs within a PLMN will retrieve subscriber and routing information and store it on an intermediate bases. Integrated in the HLR is the AuC which holds every PLMN subscriber‘s secret key (Ki) and the (also secret) algorithms of GSM (A3, A8). The AuC supports the VLR during subscriber authentication by computing the authentication triplet (Kc, RAND, SRES).
Equipment Identity Register (EIR)
EIR was intended to track and so block stolen mobile terminals from being used any further. Almost no operator has implemented the EIR as the cost-value ratio is uninteresting for most operators. (And because it‘s so rarely in use its even more pointless to implement it in future).
The GSM Air I/F
The GSM Burst (Power vs. Time Template)
GSM uses the Gaussian Minimum Shift Keying (GMSK) modulation scheme. Each GSM carrier requires 200 kHz bandwidth and is divided into 8 timeslots (each with a duration of 577 us).
The GSM Air I/F
GSM features Time Division Multiple Access (TDMA) together with Frequency Division Multiple Access (FDMA). TDMA timeslots are organized in TDMA frames.
The GSM Air I/F
A Hierarchy of Frames:
The GSM Air I/F
Starting from the basic TDMA frame, the frame hierarchy comprises Multiframes, Superframes, and Hyperframes. Each TDMA frame carries a frame number (FN) uniquely identifying this frame in the structure. The BTS needs an internal clocking system to establish the frame hierarchy. This clocking system is also needed to enable
Logical channel configuration
Physical Channels vs. Logical Channels
A GSM physical channel basically is one timeslot. In turn, a logical channel is an application specific bearer channel defined to carry GSM data traffic or signaling, and is mapped on one or more physical channels. The multiframe structure is used to identify, at which moment in time which logical channel is using a physical channel
The GSM Air I/F
This Example shows one possible allocation of logical channels in downlink direction on TS 0 of the BCCH carrier (uses 51-multiframe!):
The GSM Air I/F
Frequency Correction Channel (FCCH)
„Lighthouse“ of the BTS
Broadcast Common Control Channel (BCCH)
Carries cell specific information to the mobile stations that are currently camping on that BTS.
Common Control Channel (CCCH)
Mainly used to establish a dedicated channel (AGCH) or for paging a mobile station (PCH)
Slow Associated Control Channels (SACCH)
Transmits signaling and information like timing advance, power control information etc. Assigned to TCH (during call) with one SACCH every 120 ms (26-multiframe) or to SDCCH with one SACCH every 235.38 ms (51-multiframe).
Fast Associated Control Channels (FACCH)
The FACCH transmits signaling during a connection but is only used when no delay is acceptable.
Standalone Dedicated Control Channel (SDCCH)
Exchange of signaling information between MS and BTS for connection setup, location update etc. (bidirectional PTP channels)
The GSM Air I/F
Different Burst Types of GSM:
Since GSM is a TDMA system, transmission and reception is not continuous but performed in so called bursts. Dependent on the usage, five different types bursts have been defined:
Frequency Correction Burst (FB): consists of 142 bits, all coded with ‚0‘ (plus head and tail), only used on the FCCH (the BTS beacon).
Synchronization Burst (SB): is used on the Synchronization Channel (SCH) and provides frame number and initial identification of the cell.
The GSM Air I/F
Different Burst Types of GSM:
Normal Burst (AB): carries almost every kind of information, signaling and payload in uplink and downlink direction. Consists of Payload (114 bit!), Training Sequence, and Stealing Flags (to indicate if and which part of a burst has been stolen for FACCH)
Access Burst (AB): used by the mobile station to determine the current propagation delay (-> Timing Advance (TA)) in this cell. The AB is shortened to ensure that it fits into the respective receive window of the BTS (this method allows for a max. Distance of 35 km between mobile station and BTS.
Dummy Burst (DB): serves a special function on the BCCH carrier where all timeslots need to transmit permanently (because BCCH carrier serves as reference for handover and cell selection decisions), even without being in use. All not-used timeslots of the BCCH therefore transmit dummy bursts whereas a dummy burst consists of a pre-defined and fixed bit sequence.
The GSM Air I/F
The Timing Advance Control:
The propagation delay varies with distance and is a critical issue for a TDMA system on the uplink path. Accordingly, the network needs to constantly tell the mobile station how to offset its burst transmissions during a connection (-> SACCH). Otherwise, the signals from different mobile stations would collide in the receive window of the BTS.
The GSM Air I/F
Channel Coding:
Transmission over the air interface is vulnerable against interference. Adding redundancy to the data to be sent allows the receiver to recover the original signal in case of errors. (Below figure shows channel coding for the FR speech TCH)
The GSM Air I/F
Interleaving:
Interleaving is another method to protect data during transmissions over the air interface. By distributing a single block over multiple bursts the hazard of a complete loss of one packet is reduced.
The GSM Air I/F
Authentication
Authentication is used to prevent fraudulent subscribers from accessing the GSM network. The Authentication process is invoked by the MSC/VLR which requests precalculated authentication triplets from the HLR/AuC. Authentication consists of challenging the mobile station by providing the RAND. As the next slide shows RAND an Ki are the input parameters for the algorithm A3. The respective output is SRES. The VLR will compare both values, the stored SRES and the SRES coming from the mobile station to decide whether the authentication process was successful.
Ciphering
Ciphering ensures data confidentiality during the transmission over the air interface. Ciphering cannot be initiated without prior authentication! Comparably to authentication, ciphering is based on the calculation of RAND and Ki, but this time applying algorithm A8. The respective output parameter Kc together with the current frame number is used in algorithm A5 to determine the ciphering sequence that is used for “XORing” the 114 bits of the output burst.
The GSM Air I/F
A3/8 computations during Authentication
The GSM Air I/F
Ciphering with the A5
Packet Data for the GSM World
GPRS Overview
GPRS Overview
GPRS is… Packet Switched High Speed Mobile Data
An Efficient Approach to Upgrade Existing GSM to a Packet Switched System on the way to 3G
An Important Trial for 3G Mobile Networks
Being Online Permanently!!!
Mobile Bandwidth without Limits…
GPRS Overview
Packet Switched vs. Circuit Switched:
Packet Switched transmission requires that every packet comes with an individual header to provide address and routing information. No allocation of dedicated resources is required.
Circuit switched transactions establish a permanent dedicated connection that for the duration of a transaction is exclusively used by only one user.
Inherently, GSM is a packet-switched system, considering that transmission and channel coding is performed in bursts and blocks. Of course, this applies only for the air interface.
GPRS Overview
Cost Efficiency:
Reuse as much HW of the existing GSM infrastructure as possible
Support of Multiple Packet Data Protocols:
GPRS Rel99 supports IP, PPP and IHOSS (Internet Hosted Opted Stream Service)
Support Short Message Services (SMS)
Provide for Different Charging Options:
e.g.: charge per duration, volume, content
Ensure a Long Term Investment:
Ensure later network migrations to EDGE, IMT-2000
Compatibility to Alternative Air Interface Technologies:
Support IS-136+ and UWC
GPRS Overview
GPRS Transmission Rates:
This table is taken from GSM 03.64. It considers RLC headers as being part of the input for the encoder.
1 Timeslot
2 Timeslots
8 Timeslots
The GPRS Network
Implications for the GSM network:
The GSM Base Station Subsystem (BSS) should be left (almost) unchanged
A Packet-Switched Core Network needs to be added to the GSM Network Switching Subsystem (NSS)
The GPRS Network
One Extension is needed in the BSS:
The Packet Control Unit (PCU) is added to interface data packets to the unchanged GSM-BSS and to control and manage most of the radio related functions of GPRS
Most vendors locate the PCU at the BSC. Other possible locations are BTS or SGSN
The GPRS Network
SGSNs, GGSN, BGs, etc.
The GPRS Network
The SGSN is a Packet Switch:
The SGSN needs to route incoming data to the right destination
Data Compression:
SGSN applies data compression according to RFC 1144 (TCP/IP header compression) and V.42 bis (for data compression).
Ciphering:
In GPRS the SGSN is responsible for data encryption, not the BTS like in GSM.
Being the Ultimate Peer for the Mobile Station:
Within the GPRS core network, the SGSN is the main partner for the mobile station
The GPRS Network
Mobility Management:
The SGSN keeps track of a subscriber’s location down to the routing area and, in ready state, even down to the BTS level.
Charging:
The SGSN needs to collect charging information related to the usage of the own network and in particular related to the usage of the air interface.
Handover/Cell Change:
In case of a cell change during an ongoing packet data transfer, the SGSN needs to take care that not-acknowledged packets are routed to the new cell and, in case of a change of the SGSN, that the new SGSN receives the unacknowledged packets and all new packets.
The GPRS Network
Gateway to External Packet Data Networks:
As its name suggests, the GGSN interconnects a PLMN to external packet data networks
Anchor Function During Packet Data Transactions:
Note that the GGSN will remain the anchor point for external packet data networks even after the SGSN has changed due to a cell change.
Charging:
Opposed to the SGSN, the GGSN collects charging information based on the usage of external network resources.
Function of the Border Gateway (BG):
Message Screening / Security:
All transactions that involve the usage of external PLMNs are screened by the BG to provide a maximum level of security for a network operator.
The GPRS Network
The Complete Picture:
The GPRS Network
Class A:
The Mobile Station can simultaneously perform GSM circuit-switched and GPRS packet switched transactions. (Currently NMP does not have any such product on its roadmap).
Class B:
The Mobile Station can monitor circuit-switched and packet switched services, but cannot operate them simultaneously. (8310, 6310, 6510, etc.)
Class C:
The Mobile Station can either monitor and operate circuit switched services or GPRS. (see Nokia M2M platform)
The GPRS Air I/F
The GPRS Air I/F
12 Radio Blocks for the different Packet Data Channels (PDCHs)
Each Radio Block consists of 4 consecutive appearances of the same timeslot within 4 consecutive TDMA frames.
Resource Allocation in Uplink and Downlink is done on Block level
2 TDMA frames are reserved for Timing Advance Control (Propagation Delay)
2 idle TDMA frames for interference measurements
The GPRS Air I/F
One 52-multiframe represents 52 times the repetition of one timeslot.
This figure represents the usage of TS 0
The GPRS Air I/F
PDCHs are only used in 52-multiframe
PDCHs can be allocated dynamically by the system
PCCCH, PBCCCH are usually introduced in high load situations
The GPRS Air I/F
PBCCH (Packet Broadcast Channel):
The PBCCH broadcasts GPRS related information about a cell to all GPRS enabled mobile stations that are currently camping on that cell. Opposed to the BCCH, the PBCCH can be configured on each timeslot of each ARFCN.
PCCCH (Packet Common Control Channel):
PCCCH actually stands for the PRACH, PAGCH, PPCH and PNCH. Note that packet-related control information can also be transmitted on CCCH if there is no PCCCH allocated in a cell.
PRACH (Packet Random Access Channel):
Similar to the RACH in GSM, the PRACH is used to convey the initial network access message from the mobile station to the network (PCU). The PRACH is the only uplink PCCCH.
The GPRS Air I/F
PAGCH (Packet Access Grand Channel):
Like the circuit-switched AGCH, the PAGCH is used to convey the assignment of dedicated uplink or downlink resources to a mobile station. The PAGCH belongs to the group of PCCCHs.
PPCH (Packet Paging Channel):
As its name suggests, the PPCH is used to transmit a paging message for GPRS or circuit-switched services to the mobile station. Additionally, the PPCH can be used in GMM state READY to send a downlink resource allocation to the mobile station.
PNCH (Packet Notification Channel):
The PNCH is used to notify a mobile station about an upcoming Point-to-Multipoint (PTM) transaction.
The GPRS Air I/F
PDTCH (Packet Data Traffic Channel):
The PDTCH is the bearer for all packet data being transferred in uplink and downlink direction. The GPRS mobile station may transmit and receive simultaneously on one or more PDTCHs. Opposed to the circuit-switched TCH, the PDTCH is unidirectional!
PACCH (Packet Associated Control Channel):
The PACCH is the only PDCH being available in both directions during a unidirectional GPRS transaction. The PACCH is used to transmit RLC/MAC control information between the PCU and the mobile station.
PTCCH (Packet Timing Advance Control Channel):
Distinction needs to be made for the PTCCH/U (-> uplink) and the PTCCH/D (-> downlink). The PTCCH is only applicable in the 52-multiframe positions 12 and 38 in uplink and downlink direction. The PTCCH/U is divided into 16 subchannels within eight 52-multiframes serving 16 different MS. (Another possibility for TA Control is to use control messages on PACCH when polled by the network)
Network Access and Packet Transmission
The Initial Access in GPRS:
The initial access is used to convey the reason for accessing the network and to determine the distance between MS and network.
The initial access is done on the PRACH if a PCCCH is provided in a cell or on the RACH if only the CCCH is available.
On the RACH, the regular CHAN_REQ message is used to convey the reason for access.
On the PRACH, the PACK_CHAN_REQ message is used.
Independent of the number of information bits, each PACK_CHAN_REQ needs to fit in the shortened access burst which may carry 36 information bits (-> puncturing).
One-Phase Packet Access
Requested and selected by the mobile station.
Initial access message is responded to by suitable resource allocation in uplink direction (on one TS only if initiated on RACH).
Even if MS requests One-Phase access, network may enforce Two-Phase access by allocating only a single block to requesting MS (to further specify its request).
Problem: initial access message cannot uniquely identify sending MS
=> different MSs may try to start using same resource allocation
=> Contention resolution required!
Two-Phase Packet Access
Selected by the MS by asking only for a single block allocation (on RACH) or by explicitly requesting Two-Phase Packet Access (on PRACH).
Two-Phase Packet Access is mandatory in case of Unack. RLC/MAC transmission mode.
No Contention resolution required,
but Two-Phase Packet Access takes twice the time of One-Phase Packet Access
=> Preferred procedure for high load situations
Example of Two-Phase Packet Access:
The Temporary Block Flow (TBF):
TBF is introduced to distinguish between ongoing packet transactions
May involve more than one TS
TBF is uniquely identified by a Temporary Flow Identity (TFI)
TFI is part of each block sent up- or downlink
The TFI is unformatted and has a length of 5 bits.
The Trouble with Resource Allocation:
Packet Switched mobile networks do not deploy dedicated resources but rather resources on demand. One PDCH or PDTCH is shared among many users.
Downlink direction is not critical as the network may identify addressed MSs in each downlink block.
Uplink direction is very critical -> With several MSs collisions are probable.
=> Uplink Transmissions Need to be Scheduled and
Controlled by the Network!!!
Fixed Allocation of Uplink Resources
Network sends bitmap to MS identifiying all blocks within several consecutive 52-multiframes where the mobile station may transmit.
There may be more than one bitmap in case of more than one TS used.
More resources can be requested freely when the MS is in a fixed allocation.
Dynamic Allocation of Uplink Resources
The Uplink State Flag (USF) regulates the resource allocation.
The USF is part of every downlink data or control block sent by the network.
USF of downlink block k identifies user of uplink block (k+1).
(This is the preferred Resource Allocation method by operators)
Extended Dynamic Allocation of Uplink Resources
Only optional for network and MS.
Only usable in multislot assignments.
Also utilizes USF for uplink transmission scheduling.
Complete Picture of Network Access and Resource Allocation
And what about Downlink Resource Allocation???
Downlink transmission scheduling is no issue as it is automatically controlled by the network.
Downlink reception -> a mobile station cannot determine in advance when packets will be sent by the network.
=> A mobile station needs to receive and decode all downlink data blocks on all assigned timeslots while involved in a downlink TBF!!!
A mobile station will identify its downlink data packets by checking the TFI, which is part of each downlink block.
Some Facts about the GPRS Protocol Stack
Note: The BSC and BTS are (almost) transparent -> most packet rel. tasks in BSS are handled by the PCU
Note: LLC is the lowest GPRS protocol independent from the underlying air interface standard
RLC/MAC (Radio Link Control/Medium Access Control):
The MAC sublayer controls the access to the transmission medium (access, sharing, release of the physical medium). RLC deals with segmentation and de-segmentation of data units from higher layers (-> LLC). RLC also ensures data protection by applying ARQ measures. RLC/MAC best match with OSI layer 2 .
LLC (Logical Link Control):
LLC is the lowest GPRS protocol, independent from the used air interface protocols (makes GPRS core network as independent as possible from air I/F). LLC is an OSI layer 2 protocol and offers encapsulation of higher layer PDUs, acknowledged and unacknowledged operation, and GPRS ciphering. LLC is based on HDLC.
SNDCP (Subnetwork Dependent Convergence Protocol):
SNDCP is responsible for in-sequence delivery of SNDCP PDUs and for the actual transmission between MS and SGSN. It interfaces to the supported packet data protocols (IP, PPP, IHOSS). SNDCP does compression/decompression of data and packet headers (in case of TCP/IP).
FR (Frame Relay):
-> simple packet-switched networking protocol (no error correction!) used on the Gb interface. Together with the Network Service Control, FR forms the Network Service (NS). NS administrates the virtual connections between SGSNs and PCUs.
BSSGP (Basestation Subsystem GPRS Protocol):
Takes care of transmission of radio related control information between PCU and SGSN (like BSSMAP between BSC and MSC). It also transparently transfers LLC frames between mobile station and SGSN.
GTP (GPRS Tunneling Protocol):
Carries information between all GSNs (and the Charging Gateway Function (GCF)): GTP signaling and application data transfer
Outlook
Enhanced Data Rates for Global Evolution (EDGE) Overview
High Speed Mobile Data
HSCSD Overview
HSCSD is circuit switched:
Resources are allocated permanently and cannot be used for another transaction.
HSCSD combines TCHs:
HSCSD combines up to 4 fullrate TCHs to provide data rates up to 57.6 kbit/s. Operators usually offer not more than 38.4 kbit/s (to limit HSCSD complexity)
HSCSD Overview
HSCSD offers symmetric and asymmetric connections:
Symmetric connections use same data rates up- and downlink. On asymmetric connections, the data rate in downlink direction is (always!) higher than in uplink.
HSCSD offers transparent and non-transparent connections:
No error recognition and correction but higher data rates on transparent connections. RLP (Radio Link Protocol) on non-transparent connections for error recognition and correction.
HSCSD Performance:
This table shows the HSCSD throuput rates depending on the allocated number of fullrate traffic channels.
1 TCH
2 TCHs
3 TCHs
4 TCHs
9.6 kb/s
19.2 kb/s
28.8 kb/s
38.4 kb/s
14.4 kb/s
28.8 kb/s
43.2 kb/s
57.6 kb/s
EDGE Overview
EDGE migrates GPRS to EGPRS:
EDGE largely builds on the established GPRS network. The protocol stack is left almost unchanged, but extensive adaptations in the RLC/MAC layers are required. 8PSK and GSMK are deployed simultaneously.
EDGE Overview
EGPRS introduces nine new coding schemes:
Nine new Modulation and Coding Schemes (MCS) to enable data rates of up to 59.2 kbit/s per timeslot.
Coding Scheme
EDGE Overview
EDGE deploys a new modulation scheme: 3/8 Offset 8-PSK
EDGE Overview
EGPRS and 8PSK Modulation:
EDGE/EGPRS deploys 3/8 Offset 8-PSK modulation to limit spectrum requirements to a minimum
Opposed to GMSK which (theoretically) contains no amplitude modulation (AM),
8-PSK contains phase (PM) and amplitude modulation (AM).
Thus, 8-PSK modulated signals in EGPRS need to be transmitted with smaller output power than GMSK to avoid that the power amplifier becomes nonlinear (-> garbled signal).
Therefore, the coverage area of a BTS that deploys 8-PSK modulation shrinks.
This effect increases with higher interference level.
Thanks for Your Attention!
Nice-To-Know
Basestation Identity Code: BSIC = NCC (3 bit) + BCC (3 bit)
(Network and Basestation Color Codes)
Normal Burst:
Nice-To-Know
Carries only signaling
Carries many control channels and serves many subscribers on one TS
26er multiframe:
Pos 12 -> SACCH (TA, Power Control), needs 4 consecutive 26-multiframes
Pos 25 -> IDLE to allow measurement of neighboring SCHs => main reason for 26-multiframe structure: measurement in idle position varies against 51-multiframes (that carry the SCH)
52er multiframe:
Network dynamically allocates 52-multiframes on TSs depending on GPRS load
Never 26-multiframe and 52-multiframe on same TS
Hyperframe only because of ciphering, FN is input in ciphering algorithm A5, repeats every 3.5 h
Nice-To-Know
detect errors by adding checksum, repeat requests of erroneous blocks
FEC Forward Error Correction:
Channel Coding:
TRAU Frame: Class 1a (highly protected), 1b (protected), 2 (no protection)
Interleaving:
GPRS mixes 4 bursts of a radio block but does not mix bursts of multiple radio blocks (-> signaling, time to react, etc.)
GSM data spreads 4 bursts over 22 bursts
½ Rate Convolution Coder:

Documents

Gsm Grps Training