Embed Size (px)
Citation preview
Telecommunication SystemsTelecommunication Systems
IT351: Mobile & Wireless ComputingIT351: Mobile & Wireless Computing
Objectives:– To provide a detailed study of the GSM system architecture and operation– To introduce the Universal Mobile Telecommunications System (UMTS) and discuss
its particulars
OutlineOutline
• Introduction to telecommunication systems• The cellular concept (Recap)• The cellular architecture
– Design issues
• The GSM system– Overview
– Services
– Architecture
– Protocols
• UMTS system
Overview of the main chaptersOverview of the main chapters
Chapter 2: Wireless Transmission
Chapter 3: Medium Access Control
Chapter 4: Telecommunication Systems
Chapter 5: Satellite Systems
Chapter 6: Broadcast Systems
Chapter 7: Wireless LAN
Chapter 8: Mobile Network Layer
Chapter 9: Mobile Transport Layer
Chapter 10: Support for Mobility
Mobile phone subscribers worldwideMobile phone subscribers worldwide
year
Su
bsc
rib
ers
[mill
ion
]
0
200
400
600
800
1000
1200
1400
1600
1996 1997 1998 1999 2000 2001 2002 2003 2004
approx. 1.7 bn
GSM total
TDMA total
CDMA total
PDC total
Analogue total
W-CDMA
Total wireless
Prediction (1998)
2009:>4 bn!
Introduction to Mobile TelecommunicationsIntroduction to Mobile Telecommunications
• Telecommunications– Wide area (global) communications– Collection of 'internetworked' local networks– Centralised infrastructure / backbone
• Mobile telecommunications– Mobile phones– Wireless edge is 'cellular'– Interoperable with fixed telecommunications
Cellular Networks: RecapCellular Networks: Recap
• Radio Spectrum– Spectrum = media used by wireless, a.k.a ‘Air Interface’– Each network is assigned radio spectrum– Spectrum assigned to users for data channels– Spectrum may be licensed by international agreement
• Cellular Concept– Divide the spectrum by physical area, i.e. ‘cell’– Spectrum Reuse through non-interfering cells– Can be split on many levels
• Picocells, Microcells, Macrocells, Satellite cells
The cellular system: cell structure (Recap)The cellular system: cell structure (Recap)• Channel allocation: Implements space division multiplexing
(SDM) – frequency reuse– base station covers a certain transmission area (cell)
– Cellular concept: channel reuse across the network prevents interference, improves the likelihood of a good signal in each cell
• Mobile stations communicate only via the base station• Advantages of cell structures
– higher capacity, higher number of users
– less transmission power needed
– more robust, decentralized
– base station deals with interference, transmission area etc. locally
• Problems– Expensive
– fixed network needed for the base stations
– handover (changing from one cell to another) necessary
– interference with other cells
f4
f5
f1
f3
f2
f6
f7
f3
f2
f4
f5
f1
Cellular System OverviewCellular System Overview
Cellular ArchitectureCellular Architecture
M/S
Internetwork
M/S
Cellular NetworksCellular Networks
• Operation– Initialisation: when handset is turned on it selects a
channel and connects to the switch– Paging: switch must locate a mobile by broadcasting
requests from base stations– Handoff: switches must be able to move calls between
cells when mobile moves– Blocking/Dropping: calls may be blocked or dropped if
conditions in a cell change– Interworking: calls may be placed to other networks or
may allow users to roam into other networks
Development of mobile telecommunication systemsDevelopment of mobile telecommunication systems
1G 2G 3G2.5G
IS-95cdmaOne
IS-136TDMAD-AMPS
GSM
PDC
GPRS
IMT-DSUTRA FDD / W-CDMA
EDGE
IMT-TCUTRA TDD / TD-CDMA
cdma2000 1X
1X EV-DV(3X)
AMPSNMT
IMT-SCIS-136HSUWC-136
IMT-TCTD-SCDMA
CT0/1
CT2IMT-FTDECT
CD
MA
TD
MA
FD
MA
IMT-MCcdma2000 1X EV-DO
HSPA
Mobile Telecommunication SystemsMobile Telecommunication Systems
• First Generation (analog)– Advanced Mobile Phone Service (AMPS)
– Developed by AT&T in late 1970’s
– Still (just about!) in use in some countries
– Spectrum use and signal quality are poor
– Security is non-existent– Calls could be overheard using cheap scanners
• Second Generation (digital)– GSM is best known example (covers all of Europe and
much of Asia)
– Developed by ETSI (, European Telecommunications Standardisation Institute)
– Advantages:– Digital traffic channels: allows data applications– Encryption: scanners can’t hear your calls– Error detection: better voice quality– Channel access: more users per cell
Mobile Telecommunication SystemsMobile Telecommunication Systems
Mobile Telecommunication SystemsMobile Telecommunication Systems
• Third Generation (3G)– Intended capabilities
– Voice quality as good as landline– 144kbps (vehicles), 384kbps (pedestrians), and 2.048Mbps to
offices– Symmetric/Asymmetric data rates– Packet and Circuit-Switched Data– Interface to the Internet– Efficient use of spectrum– Wider variety of terminal equipment– Flexibility to allow new services to flourish
• ‘Any Service, Anywhere, Anytime’ – Martini Principle
GSMGSM
Global System for Mobile (GSM) is a second generation cellular standard developed to cater voice services and data delivery using digital modulation
Some press news…Some press news…
• 16th April 2008: The GSMA, the global trade group for the mobile industry, today announced that total connections to GSM mobile communications networks have now passed the 3 Billion mark globally. The third billion landmark has been reached just four years after the GSM industry surpassed its first billion, and just two years from the second billionth connection. The 3 Billion landmark has been surpassed just 17 years after the first GSM network launch in 1991. Today more than 700 mobile operators across 218 countries and territories of the world are adding new connections at the rate of 15 per second, or 1.3 million per day.
• 11 February 2009: The GSMA today announced that the mobile world has celebrated its four billionth connection, according to Wireless Intelligence, the GSMA’s market intelligence unit. This milestone underscores the continued strong growth of the mobile industry and puts the global market on the path to reach a staggering six billion connections by 2013.
• Check out www.gsmworld.com for more!
GSM StatisticsGSM Statistics
• Summary GSM statistics (Sep 2009)• Total mobile subscriptions → 4.3bn
• Total GSM subscriptions → 3.45bn (>80% market)
• Operates in 220+ countries
• Original market was Europe-centric (1990s)
• Usage rates approach 100% in some countries
• Expanding rapidly in South America, Asia, Africa
GSM: OverviewGSM: Overview
• GSM– formerly: Groupe Spéciale Mobile (founded 1982)
– now: Global System for Mobile Communication
– Pan-European standard (ETSI, European Telecommunications Standardisation Institute)
– Aim : to replace the incompatible analog system
– simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations seamless roaming within Europe possible
• Today many providers all over the world use GSM(219 countries in Asia, Africa, Europe, Australia, America)
– more than 4,2 billion subscribers in more than 700 networks
– more than 75% of all digital mobile phones use GSM
– over 29 billion SMS in Germany in 2008, (> 10% of the revenues for many operators) [be aware: these are only rough numbers…]
– See e.g. www.gsmworld.com/newsroom/market-data/index.htm
Characteristics of GSM StandardCharacteristics of GSM Standard
• Fully digital system using 900,1800 MHz frequency band (in US 1900 MHz).
• TDMA over radio carriers(200 KHz carrier spacing.• User/terminal authentication for fraud control.• Encryption of speech and data transmission over the
radio path.• Full international roaming capability.• Low speed data services (upto 9.6 Kb/s).• Compatibility with ISDN.• Support of Short Message Service (SMS).
Advantages of GSM over Analog systemAdvantages of GSM over Analog system
• Capacity increases• Reduced RF transmission power and longer battery
life.• International roaming capability.• Better security against fraud (through terminal
validation and user authentication).• Encryption capability for information security and
privacy.• Compatibility with ISDN, leading to wider range of
services
Performance characteristics of GSM (wrt. analog sys.)Performance characteristics of GSM (wrt. analog sys.)
• Communication – mobile, wireless communication; support for voice and data
services• Total mobility
– international access, chip-card enables use of access points of different providers
• Worldwide connectivity– one number, the network handles localization
• High capacity – better frequency efficiency, smaller cells, more customers per cell
• High transmission quality– high audio quality and reliability for wireless, uninterrupted phone
calls at higher speeds (e.g., from cars, trains)• Security functions
– access control, authentication via chip-card and PIN
Disadvantages of GSMDisadvantages of GSM
• There is no perfect system!!– no end-to-end encryption of user data
– no full ISDN bandwidth of 64 kbit/s to the user
• reduced concentration while driving• electromagnetic radiation• abuse of private data possible• roaming profiles accessible• high complexity of the system• several incompatibilities within the GSM standards
GSM Specifications-1GSM Specifications-1
• RF SpectrumGSM 900 Mobile to BTS (uplink): 890-915 Mhz BTS to Mobile(downlink):935-960 Mhz Bandwidth : 2* 25 Mhz
GSM 1800 Mobile to BTS (uplink): 1710-1785 Mhz BTS to Mobile(downlink) 1805-1880 Mhz Bandwidth : 2* 75 Mhz
GSM Specification-IIGSM Specification-II
• Carrier Separation : 200 Khz• Duplex Distance : 45 Mhz• No. of RF carriers : 124• Access Method : TDMA/FDMA• Modulation Method : GMSK (Gaussian Minimum Shift
Keying – PSK)• Modulation data rate : 270.833 Kbps
GSM 900- FDD/FDMA GSM (Recap)GSM 900- FDD/FDMA GSM (Recap)
• Frequency division duplex: Simultaneous access to the medium in both directions, uplink and down link ( from mobile station to base station and vice versa
• Ex (GSM): Fu = 890 + n*0.2
Fd = Fu + 45 = 935 + n*0.2
f
t
124
1
124
1
20 MHz
200 kHz
890.2 MHz
935.2 MHz
915 MHz
960 MHz
GSM: Mobile ServicesGSM: Mobile Services
• GSM offers– several types of connections
• voice connections, data connections, short message service
– multi-service options (combination of basic services)
• Three service domains– Bearer Services
– Tele Services
– Supplementary Services
Bearer ServicesBearer Services• Telecommunication services to transfer data between access points• Specification of services up to the terminal interface (OSI layers 1-
3) • Different data rates for voice and data (original standard)
– Transparent bearer service (use only physical layer to transmit data – Forward error correction (FEC) only
circuit switched – constant delay and throughput
• synchronous: 2.4, 4.8 or 9.6 kbit/s
• asynchronous: 300 - 1200 bit/s
– Non transparent bearer service (use protocols of layer 2 and 3 to implement error correction and flow control)
data service (packet switched)
• synchronous: 2.4, 4.8 or 9.6 kbit/s
• asynchronous: 300 - 9600 bit/s
• Today: data rates of approx. 50 kbit/s possible – (even more with new modulation)
Tele Services ITele Services I• Telecommunication services that enable voice
communication via mobile phones• All these basic services have to obey cellular
functions, security measurements etc.• Offered services
– mobile telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz
– Emergency numbercommon number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible)
Tele Services IITele Services II• Additional services
– Non-Voice-Teleservices• group 3 fax• voice mailbox (implemented in the fixed network
supporting the mobile terminals)• electronic mail (MHS, Message Handling System,
implemented in the fixed network)• ...• Short Message Service (SMS)
alphanumeric data transmission to/from the mobile terminal (160 characters) using the signaling channel, thus allowing simultaneous use of basic services and SMS (almost ignored in the beginning now the most successful add-on!)
• Multimedia Message Service (MMS)
Supplementary ServicesSupplementary Services
• Services in addition to the basic services, cannot be offered stand-alone
• Similar to ISDN services besides lower bandwidth due to the radio link
• May differ between different service providers, countries and protocol versions
• Important services– identification: forwarding of caller number
– suppression of number forwarding
– call redirection
– automatic call-back
– Closer user groups, multi-party communication
– …
Architecture of The GSM SystemArchitecture of The GSM System
• GSM is a PLMN (Public Land Mobile Network)– several providers setup mobile networks following the
GSM standard within each country– components
• MS (mobile station)• BS (base station)• MSC (mobile switching center)• LR (location register)
– subsystems• RSS (radio subsystem): covers all radio aspects• NSS (network and switching subsystem): call forwarding,
handover, switching• OSS (operation subsystem): management of the network
GSM System ArchitectureGSM System Architecture
• Radio Subsystem (RSS)– Mobile Station (MS)
• Mobile Equipment (ME)
• Subscriber Identity Module (SIM)
– Base Station Subsystem (BSS)• Base Transceiver Station (BTS)
• Base Station Controller (BSC)
• Network Switching Subsystem(NSS)– Mobile Switching Center (MSC)– Home Location Register (HLR)– Visitor Location Register (VLR)
• Operation Subsystem (OSS)– Operation and Maintenance Center (OMC)– Authentication Center (AUC)– Equipment Identity Register (EIR)
Ingredients 1: Mobile Phones, PDAs & Co.Ingredients 1: Mobile Phones, PDAs & Co.
The visible but smallestpart of the network!
Ingredients 2: AntennasIngredients 2: Antennas
Still visible – cause many discussions…
Ingredients 3: Infrastructure 1Ingredients 3: Infrastructure 1
Base Stations
Cabling
Microwave links
Ingredients 3: Infrastructure 2Ingredients 3: Infrastructure 2
Switching units
Data bases
Management
Monitoring
Not „visible“, but comprise the major part of the network (also from an investment point of view…)
GSM ArchitectureGSM Architecture
MS: Mobile StationBSS: Base Station SubsystemBSC: Base Station ControllerBTS: Base Transceiver StationTRX: TransceiverMSC: Mobile Switching Centre
VLR: Visitor Location RegisterHLR: Home Location RegisterAuC: Authentication CentreEIR: Equipment Identity RegisterOMC: Operations and Maintenance CentrePSTN: Public Switched Telephone Network
• Three Subsystems:– The Radio Subsystem– The Network and Switching Sub-system (NSS) – comprising an MSC and associated
registers– The Operation Subsystem
GSM: elements and interfacesGSM: elements and interfaces
NSS
MS MS
BTS
BSC
GMSC
IWF
OMC
BTS
BSC
MSC MSC
Abis
Um
EIR
HLR
VLR VLR
A
BSS
PDN
ISDN, PSTN
RSS
radio cell
radio cell
MS
AUCOSS
signaling
O
System Architecture: Radio SubsystemSystem Architecture: Radio Subsystem
• Components– MS (Mobile Station)– BSS (Base Station Subsystem):
consisting of• BTS (Base Transceiver Station):
sender and receiver• BSC (Base Station Controller):
controlling several transceivers
• Interfaces– Um : radio interface– Abis : standardized, open interface
with 16 kbit/s user channels– A: standardized, open interface
with 64 kbit/s user channels
Um
Abis
A
BSS
radiosubsystem
network and switchingsubsystem
MS MS
BTSBSC MSC
BTS
BTSBSC
BTSMSC
Radio SubsystemRadio Subsystem
• The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers
• Components– Mobile Stations (MS)
– Base Station Subsystem (BSS):• Base Transceiver Station (BTS): radio components
including sender, receiver, antenna - if directed antennas are used one BTS can cover several cells
• Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels
• BSS = BSC + sum(BTS) + interconnection
RSS: The Mobile Station (MS)RSS: The Mobile Station (MS)• The mobile station consists of:
– Mobile Equipment (ME)
– Subscriber Identity Module (SIM)
• The SIM stores all specific data that is relevant to GSM - permanent and temporary data about the mobile, the subscriber and the network, including:– The International Mobile Subscriber Identity (IMSI)
– MS ISDN number of subscriber (phone number)
– Authentication key and algorithms for authentication check
– Charging information, list of subscribed services
– Personal identity number (PIN), and PIN unblocking key (PUK)
– Temporary location information while logged onto GSM system
• Temporary mobile subscriber identity (TMSI)• Location area identification (LAI)
RSS: The Mobile Station (MS)RSS: The Mobile Station (MS)
• The mobile equipment has a unique International Mobile Equipment Identity (IMEI), which is used for theft protection
• Without the SIM, only emergency calls are possible• For GSM 900, MS transmits power of up to 2W, for
GSM 1800 1W due to smaller cell-size • MS can also have other components and services for
the user (display, loudspeaker, Bluetooth interface, IrDA,...etc). These are non GSM features.
RSS: The Base Station Sub-System (BSS)RSS: The Base Station Sub-System (BSS)• A GSM network comprises many BSSs. • The BSS performs all the functions necessary to
maintain radio connection to an MS
(coding/decoding of voice, rate adaptation,…)• Base Station Subsystem is composed of two parts
that communicate across the standardized Abis
interface allowing operation between components
made by different suppliers:– Base Station Controller (BSC)
– One or more Base Transceiver Stations (BTSs)
• BTS contains:– Radio Transmitter/Receiver (TRX)
– Signal processing and control equipment
– Antennas and feeder cables
RSS: The Base Station Sub-System (BSS)RSS: The Base Station Sub-System (BSS)
• The purpose of the BTS is to:– Provide radio access to the mobile stations
– Manage the radio access aspects of the system
– Encode, encrypt, multiplex, modulate and feed the RF signals to the antenna.
– Frequency hopping
– Communicates with Mobile station and BSC
• The BSC:– Allocates a channel for the duration of a call
– Maintains the call:• Monitoring quality • Controlling the power transmitted by the BTS or MS• Generating a handover to another cell when required
• BTSs can be linked to parent BSC by microwave, optical fiber or cable
Network and switching subsystem (NSS)Network and switching subsystem (NSS)
• NSS is the main component and the heart of the GSM system– Connects the wireless network with standard public
networks (manages communication between GSM and other networks)
– Performs handover between different BSSs– Supports roaming of users between different providers in
different countries – Performs functions for worldwide localization of users– Charging and billing information, accounting information
In summary switching, mobility management, interconnection to other networks, system control are the main functions of NSS
NSS- componentsNSS- components• Components
– Mobile Services Switching Center (MSC)• Gateway Mobile Switching Center
– Databases (important: scalability, high capacity, low delay)• Home Location Register (HLR)• Visitor Location Register (VLR)
• All components connect using the SS7 signaling system
fixed network
BSC
BSC
MSC MSC
GMSC
VLR
HLR
NSS
VLR
NSS - Mobile Services Switching CenterNSS - Mobile Services Switching Center
• MSCs are high-performance digital ISDN switches• They set-up and control connections to other MSCs
and to BSCs via the A-interface• They form the backbone network of a GSM system• Typically, an MSC manages several BSCs in a
geographical region• Controls all connections via a separated network
to/from a mobile terminal within the domain of the MSC
NSS - Mobile Switching Centre (MSC)NSS - Mobile Switching Centre (MSC)
• Functions of the MSC:– Switching calls, controlling calls and logging calls
– specific functions for paging and call forwarding
– termination of SS7 (signaling system no. 7)
– mobility specific signaling
– Mobility management over the radio network and other networks.
– Radio Resource management – handovers between BSCs
– Billing Information
– location registration and forwarding of location information
– provision of new services (fax, data calls)
– support of short message service (SMS)
– generation and forwarding of accounting and billing information
– Interface with PSTN, ISDN, PSPDN - interworking functions via Gateway MSC (GMSC)
NSS - MSC- Gateway Mobile Switching NSS - MSC- Gateway Mobile Switching Centre (GMSC)Centre (GMSC)
• A particular MSC can be assigned to act as a GMSC (Gateway Mobile Switching Centre)
• • A GMSC is a device which routes traffic entering a mobile
network to the correct destination
• The GMSC accesses the network’s HLR to find the location of the required mobile subscriber
• The operator may decide to assign more than one GMSC
NSS- Home Location Register (HLR) NSS- Home Location Register (HLR)
• Most important database in GSM system, stores all user-relevant information permanent and semi-permanent– Static information such as mobile subscriber ISDN number,
subscribed services (e.g call forwarding, roaming restrictions), and the International mobile subscriber identity (IMSI))
– Dynamic information such as the current location area (LA) of the MS, the temporary mobile subscriber identity (TMSI) the mobile subscriber roaming number (MSRN), the current VLR and MSC.
As soon as an MS leaves its current LA, the information in the HLR is updated. This information is necessary to localize a user in the worldwide GSM network
• All these user-specific information elements only exist once for each user in a single HLR which also supports charging and accounting.
HLR ImplementationHLR Implementation
• There is logically one HLR in a Network, although it may consist of several separate computers
• May be split regionally• HLRs can manage data for several million customers • Contain highly specialised databases to fulfill real-
time requirements and answer requests within certain time bounds.
• Stand alone computer – no switching capabilities• May be located anywhere on the SS7 network• Combine with AuC
NSS- Visitor Location Register (VLR)NSS- Visitor Location Register (VLR)
• Each MSC has a VLR
• VLR is a dynamic local database which stores all important information needed for MS users currently in the LA (location area) associated to the MSC (the domain of the VLR)
• If a new MS comes into the LA of the VLR, it copies all relevant information for this user from the HLR, and stores this data temporarily.
• Information stored includes:– International Mobile Subscriber Identity (IMSI)– Mobile Station ISDN Number (MSISDN)– Mobile Station Roaming Number (MSRN)– Temporary Mobile Station Identity (TMSI)
• Local Mobile Station Identity– The location area where the mobile station has been registered– Supplementary service parameters
Operation Subsystem (OSS)Operation Subsystem (OSS)
• The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems. It accesses other components via SS7 signaling. It consists of the following three components:– Operation and Maintenance Center (OMC)– Authentication Center (AuC)– Equipment Identity Register (EIR)
• Operation and Maintenance Center (OMC)– different control capabilities for the radio subsystem and the
network subsystem via the O-interface (SS7)• Traffic monitoring, status reports of network entities, subscriber and
security management, or accounting and billing
OSS – Authentication Center (AuC)OSS – Authentication Center (AuC)
• Authentication Center (AuC)– A separate AuC is defined to protect
user identity and data transmission (wireless part)
– authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system
– generates user specific authentication parameters on request of a VLR
– Situated in a special protected part of the HLR
OSS – Equipment Identity Register (EIR)OSS – Equipment Identity Register (EIR)
• EIR is a database for all IMEI (International Mobile Equipment Identity). It stores all device identifications registered for this network
• The EIR controls access to the network by returning the status of a mobile in response to an IMEI query
• Possible status levels are:
– White-listed - The terminal is allowed to connect to the network
– Grey-listed - The terminal is under observation by the network for possible problems
– Black-listed - The terminal has either been reported stolen, or is not a type approved for a GSM network. The terminal is not allowed to connect to the network.
GSM Operation: Localization & CallingGSM Operation: Localization & Calling
• One fundamental feature of GSM is the automatic worldwide localization of users
• The system always know where a user currently is, and the same phone number is valid worldwide.
• To provide this service, GSM performs periodic location updates even if a user doesn’t use the MS (still logged in GSM and not switched off).
• The HLR always contain information about the current location (the LA, not the precise geographical location)
• The VLR responsible for the MS informs the HLR about location changes.
• As soon as an MS moves into the range of a new VLR, the HLR sends all user data needed to the new VLR
• Changing VLRs with uninterrupted availability of all services is called handover - roaming
Localization & Calling (cont)Localization & Calling (cont)
• To locate the MS and to address it several numbers are needed:– Mobile station international ISDN number (MSISDN). This number
consists of the country code, the address of network provider and the subscriber number
– International mobile subscriber identity (IMSI). This number is used for internal unique identification of a subscriber
– Temporary mobile subscriber identity (TMSI): to hide the IMSI which would give away the exact identity of the user. TMSI is a four byte number selected by the current VLR and is only valid temporarily within the location area of the VLR.
– Mobile station roaming number (MSRN). This is another temporary address that hides the identity and location of a subscriber. The VLR generates this address on request from the MSC. This address contains the current visitor country code, the visitor network provider, identification of current MSC with the subscriber number. This number is also saved in the HLR and helps the HLR to find a subscriber for an incoming call.
Localization & Calling (cont)Localization & Calling (cont)
• All these numbers are needed to find a subscriber and to maintain the connection with a mobile station
• To describe how the calling process works we will consider two main cases for a call:– Outgoing call – Mobile Originated Call (MOC)
• A GSM Mobile station calls a station outside the GSM network
– Incoming Call - Mobile Terminating Call (MTC)• A station outside the GSM network calls a GSM mobile
station.
Mobile Originated Call (MOC) - outgoing callMobile Originated Call (MOC) - outgoing call
• 1, 2: connection request– MS sends dialled number to BSS
– BSS sends dialled number to MSC
• 3, 4: security check– MSC checks VLR if MS is allowed
the requested service. If so, MSC asks
BSS to allocate resources for call.
• 5-8: check resources (free circuit)– MSC routes the call to GMSC
– GMSC routes the call to local exchange of called user
• 9-10: set up call– Answer back(ring back) tone is routed from called user to MS via
GMSC,MSC,BSS
PSTN GMSC
VLR
BSS
MSC
MS1
2
6 5
3 4
9
10
7 8
Mobile Terminated Call (MTC) – incoming callMobile Terminated Call (MTC) – incoming call
• 1: calling a GSM subscriber• 2: forwarding call to GMSC• 3: signal call setup to HLR• 4, 5: request MSRN from VLR• 6: forward responsible
MSC to GMSC• 7: forward call to current MSC who
will be responsible from now• 8, 9: get current status of MS• 10, 11: paging of MS (too much
signaling but searching for the correct cell is time consuming)
• 12, 13: MS answers• 14, 15: security checks• 16, 17: set up connection
PSTNcallingstation
GMSC
HLR VLR
BSSBSSBSS
MSC
MS
1 2
3
4
5
6
7
8 9
10
11 12
1316
10 10
11 11 11
14 15
17
MOC/MTCMOC/MTC
BTSMS
paging request
channel request
immediate assignment
paging response
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
MTCBTSMS
channel request
immediate assignment
service request
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
MOC
GSM- Logical channelsGSM- Logical channels
• GSM specifies two basic groups of logical channels: – Traffic channels (TCH): to transmit user data (e.g., voice, fax,
SMS,..)
– Control Channel (CCH): many different CCHs are used in GSM system to control medium access, allocation of traffic channels, or mobility management. The following three groups of CCH have been defined:
• Broadcast control channel (BCCH) : A BTS used this channel to signal information to all MSs within a cell (e.g. Cell identifier)
• Common control channel (CCCH): All information regarding connection setup between MS and BS is exchanged via the CCCH (e.g. paging request) – random access scheme (ALOHA)
• Dedicated control channel (DCCH): Before establishing a TCH, an MS and BTS uses this bidirectional channel for signalling (e.g. authentication)
Security in GSMSecurity in GSM• Security services
– access control/authentication• user SIM (Subscriber Identity Module): secret PIN (personal identification
number)• SIM network: challenge response method
– confidentiality• voice and signaling encrypted on the wireless link (after successful
authentication)
– anonymity• temporary identity TMSI (Temporary Mobile Subscriber Identity)• newly assigned at each new location update • encrypted transmission
• 3 algorithms specified in GSM– A3 for authentication (“secret”, open interface)– A5 for encryption (standardized)– A8 for cipher key generation used in A5(“secret”,
open interface)
• Algorithms A3, A8 are located on the SIM and the AuC and can be proprietary. A5 is implemented in device and should be identical for all providers.
“secret”:• A3 and A8 available via the Internet• network providers can use stronger mechanisms
GSM - authenticationGSM - authentication
A3
RANDKi
128 bit 128 bit
SRES* 32 bit
A3
RAND Ki
128 bit 128 bit
SRES 32 bit
SRES* =? SRES SRES
RAND
SRES32 bit
mobile network SIM
AuC
MSC
SIM
Ki: individual subscriber authentication key SRES: signed response
GSM - key generation and encryptionGSM - key generation and encryption
A8
RANDKi
128 bit 128 bit
Kc
64 bit
A8
RAND Ki
128 bit 128 bit
SRES
RAND
encrypteddata
mobile network (BTS) MS with SIM
AuC
BSS
SIM
A5
Kc
64 bit
A5
MSdata data
cipherkey
Authentication & Encryption Authentication & Encryption
1
2
3
4
5
7
7
5 4
6
HandoverHandover
• Cellular systems require handover procedure as single cells do not cover the whole service area– Only up to 35 Km around each antenna on the
countryside and some hundred meters in cities
• The smaller the cell-size and the faster the movement of a MS (up to 250 Km/h for GSM), the more handovers are required
• A handover should not cause a cut-off (call-drop)
• GSM aims at maximum handover duration of 60ms
Handover CausesHandover Causes
• Handover can be initiated by either MS or MSC• Two basic reasons for a handover:
– Mobile initiated handover: the MS moves out of the range of a BTS or a certain antenna of a BTS.
• The received signal decreases continuously until it falls below the minimal requirements for communication
• The error rate grow due to interference• The quality of the radio link is not suitable for the near
future
– Network Initiated handover: the wired infrastructure (MSC, BSC) may decide that the traffic in one cell is too high and shift some MS to other cells with a lower load; i.e.; for load balancing
Handover TypesHandover Types
• There are four different types of handover in the GSM system, which involve transferring a call between:
– Internal:• Channels (time slots) in the same cell• Cells within the same BSS (same BSC)
– External:• Cells in different BSSs (different BSCs) but
under the control of the same MSC• Cells under the control of different MSCs
4 types of handover4 types of handover
1. Intra-cell handover (channels, time-slots within the same cell – e.g. because of narrow band interference with some frequencies)
2. Inter-cell, intra-BSC handover (cells within the same BSS, BSC)
3. Inter-BSC, intra-MSC handover (cells in different BSS but under control of same MSC)
4. Inter MSC handover (cells under control of different MSCs)
MSC MSC
BSC BSCBSC
BTS BTS BTSBTS
MS MS MS MS
12 3 4
Handover DecisionHandover Decision
• Handover decision is based on the following parameters (in priority order):– Received signal quality (signal level + bit-error rate)– Received signal strength– Distance of MS from BTS– Drops below power budget margin
• Each operator has a operator-defined threshold and handover decisions can be based on one or a combination of the parameters
• Handover metrics:– Call blocking/dropping/completion probability– Probability of successful handoff– Handoff rate/delay– Interruption duration
Handover decisionHandover decision
receive levelBTSold
receive levelBTSnew
MS MS
HO_MARGIN
BTSold BTSnew
Too high HO_Margin cause a cut-off, too low cause too many handover
Handover procedureHandover procedure
HO access
BTSold BSCnew
measurementresult
BSCold
Link establishment
MSCMSmeasurementreport
HO decision
HO required
BTSnew
HO request
resource allocation
ch. activation
ch. activation ackHO request ackHO commandHO commandHO command
HO completeHO completeclear commandclear command
clear complete clear complete
RoamingRoaming
• Allows subscriber to travel to different network areas, different operator’s networks, different countries – keeping the services and features they use at home
• Billing is done through home network operator, who pays any other serving operator involved
• Requires agreements between operators on charge rates, methods of payment, etc
• Clearing house companies carry out data validation on roamer data records, billing of home network operations and allocation of payments
Roaming processRoaming process
• Each mobile network has its own HLR and VLRs. When an MSC detects a mobile user’s presence in the area covered by its network, it first checks the HLR database to determine if the user is in his/her home area or is roaming, i.e., the user is a visitor. – User in Home Area: HLR has the necessary information for initiating,
terminating, or receiving a call.
– User is Roaming: VLR contacts the user’s HLR to get the necessary information to set up a temporary user profile.
• When a user receives a call while roaming within another network MSC– Home GMSC contacts the HLR to determine the appropriate switch
in the roaming area to handle the arriving call and then transfers the call to the roaming area MSC.
The Radio InterfaceThe Radio Interface
• The most interesting interface in GSM is Um the radio interface.
• GSM implements SDMA using cells with BTS and assigns an MS to a BTS
• FDD is used to separate uplink and downlink
• TDM is also used and media access combines TDMA & FDMA
• In GSM 900, 124 channels uplink + 124 channels downlink, each 200KHz wide, are used for FDMA
• Each of the 248 channels is further divided into frames that are repeated continuously. The duration of the frame is 4.615 ms
• Each frame is subdivided into 8 GSM timeslots, where each slot represents a physical channel and lasts for 577 µsec. Each TDM channel occupies the 200 KHz carrier for 577 µsec every 4.615 ms
• Data is transmitted in small portions called bursts, the burst is only 546.5 µsec long and contains 148 bits. The remaining 30.5 µsec are used as guard space to avoid overlapping with other bursts.
1 2 3 4 5 6 7 8
higher GSM frame structures
935-960 MHz124 channels (200 kHz)downlink
890-915 MHz124 channels (200 kHz)uplink
frequ
ency
time
GSM TDMA frame
GSM time-slot (normal burst)
4.615 ms
546.5 µs577 µs
tail user data TrainingSguardspace S user data tail
guardspace
3 bits 57 bits 26 bits 57 bits1 1 3
GSM - TDMA/FDMAGSM - TDMA/FDMA
=
GSM protocol layers for signalingGSM protocol layers for signaling
CM
MM
RR
MM
LAPDm
radio
LAPDm
radio
LAPD
PCM
RR’ BTSM
CM
LAPD
PCM
RR’BTSM
16/64 kbit/s
Um Abis A
SS7
PCM
SS7
PCM
64 kbit/s /2.048 Mbit/s
MS BTS BSC MSC
BSSAP BSSAP
CM = Connection ManagementMM = Mobility ManagementRR = Radio Resource ManagementLAPD = Link Access Procedure
BTSM = BTS ManagementBSSAP = BSS applicationPCM = Pulse Code Modulation
Functions Provided by ProtocolsFunctions Provided by Protocols
• Protocols above the link layer of the GSM signaling protocol architecture provide specific functions:– Radio resource management– Mobility management– Connection management– Mobile application part (MAP)– BTS management
Evolution Of GSMEvolution Of GSM• 2nd Generation
– GSM -9.6 Kbps (data rate)
• 2.5 Generation
– HSCSD (High Speed Circuit Switched Data)• Data rate : 76.8 Kbps (9.6 x 8 kbps)
– GPRS (General Packet Radio Service)• Data rate: 14.4 - 115.2 Kbps
– EDGE (Enhanced Data rate for GSM Evolution)• Data rate: 547.2 Kbps (max)
• 3rd Generation
– UMTS - WCDMA(Wide band CDMA)• Data rate : 0.348 – 2.0 Mbps
Data services in GSM Data services in GSM
• Data transmission standardized with only 9.6 kbit/s. Advanced coding allows 14.4 kbit/s– not enough for Internet and multimedia applications
• GSM is circuit switching connected-oriented mechanism. This is not suitable for data transmission which is bursty in nature and requires higher bandwidth– Web-browsing leaves the channel idle most of the time,
so allocation of channel permanently waste too much resources
– Billing is based upon time allocation of channels which is not suitable for data services
• Two basic approaches have been proposed:– HSCSD (High-Speed Circuit Switched Data)
– GPRS (General Packet Radio Service)
HSCSD (High-Speed Circuit Switched Data) HSCSD (High-Speed Circuit Switched Data) – 2.5 Generation– 2.5 Generation
• Higher data are achieved by bundling several TCHs• An MS requests one or more TCHs from the GSM
network, i.e., it allocates several TDMA slots within a TDMA frame– the allocation could be asymmetrical (more slots on downlink than in uplink)
• Mainly software update in MS and MSC• An MS can use up to 8 slots within the frame to
achieve up to115.2 Kbit/s• advantage: ready to use, constant quality, simple• disadvantage: Still circuit switching same problems,
high price and wasting of resources- channels blocked for voice transmission
General Packet Radio Service- GPRS (2.5 G)General Packet Radio Service- GPRS (2.5 G)
• General Packet Radio Service (GPRS) is a new bearer service for GSM that greatly improves and simplifies wireless access to packet data networks,
• It uses the existing GSM network to transmit and receive TCP/IP based data to and from GPRS mobile devices.
• GPRS is a non-voice service added to existing TDMA time division multiple
• access networks, one of the 2.5G technology upgrades. TDMA is the underlying transport mechanism used by GSM networks.
General Packet Radio Service- GPRS (2.5 G)General Packet Radio Service- GPRS (2.5 G)
• Fully packet-oriented switching• Standardization 1998, introduction 2001• Using free slots only if data packets ready to send
(e.g., 50 kbit/s using 4 slots temporarily)• Users are always ON – Charging on volume not on connection
time• Advantage: one step towards UMTS, more flexible• Disadvantage: more investment needed (new hardware)• GPRS network elements
– GSN (GPRS Support Nodes): GGSN and SGSN (routers)– GGSN (Gateway GSN)
• interworking unit between GPRS and PDN (Packet Data Network)
– SGSN (Serving GSN)• supports the MS (location, billing, security)
– GR (GPRS Register)• user addresses
General Packet Radio Service- GPRS (2.5 G)General Packet Radio Service- GPRS (2.5 G)
• High Speed (Data Rate 14.4 – 115 kbps)• Efficient use of radio bandwidth (Statistical Multiplexing)• Circuit switching & Packet Switching can be used in parallel• Constant connectivity
GPRS Architecture and InterfacesGPRS Architecture and Interfaces
MS BSS GGSNSGSN
MSC
Um
EIR
HLR/GR
VLR
PDN
Gb Gn Gi
SGSN
Gn
Towards 3G: EDGE TechnologyTowards 3G: EDGE Technology
• EDGE improves the GPRS architecture by employing a new modulation method and link quality control. 8-PSK is a high-level linear modulation method that carries three times more information through an extended signal constellation.
• The link quality control dynamically selects the modulation and coding scheme for transmission of data over the air interface. Thus the EDGE user bit-rates increase with better quality.
Towards 3G: CDMATowards 3G: CDMA• Capacity is CDMA's biggest asset. It can accommodate more users per
MHz of bandwidth than any other technology ( 3 to 5 times more than GSM)
• CDMA has no built-in limit to the number of concurrent users.• CDMA do not limit the distance a tower can cover.• CDMA consumes less power and covers large areas so cell size in CDMA
is larger.• CDMA is able to produce a reasonable call with lower signal (cell phone
reception) levels.• CDMA uses Soft Handoff, reducing the likelihood of dropped calls.• CDMA's variable rate voice coders reduce the rate being transmitted
when speaker is not talking, which allows the channel to be packed more efficiently.
• Has a well-defined path to higher data rates.
ITU’s View of Third-Generation CapabilitiesITU’s View of Third-Generation Capabilities
• Voice quality comparable to the public switched telephone network
• 144 kbps data rate available to users in high-speed motor vehicles over large areas
• 384 kbps available to pedestrians standing or moving slowly over small areas
• Support for 2.048 Mbps for office use• Symmetrical / asymmetrical data transmission rates• Support for both packet switched and circuit switched
data services
ITU’s View of Third-Generation CapabilitiesITU’s View of Third-Generation Capabilities
• An adaptive interface to the Internet to reflect efficiently the common asymmetry between inbound and outbound traffic
• More efficient use of the available spectrum in general
• Support for a wide variety of mobile equipment• Flexibility to allow the introduction of new
services and technologies
UMTSUMTS
• UMTS – Universal Mobile Telephone System• Most popular 3G wireless standard.• Combines the infrastructure of the GSM network
with superior technology of the CDMA air interface.• UMTS was originally a European standard.• Not just an improvement of 2G networks.• Requires new equipment and new frequency
bandwidths
UMTS AimsUMTS Aims
• Broadband access around 2Mbit/s• Mobile or fixed access• Service transparency• Mass market provision at low (?) cost
– Variety of tariffs in 2011
• Convergence of network types• Global (getting easier!)
UMTS EvolutionUMTS Evolution
• Evolution of GSM towards 3G systems• Main requirement is for increased data rates• Mobile access to: Internet, E-mail, Corporate networks
HSCSD: High-Speed Circuit-Switched DataGPRS: General Packet Radio ServiceEDGE: Enhanced Data rates for GSM Evolution
UMTS EvolutionUMTS Evolution
• Service Domains (in addition to location areas)
• Separate mobility and service (for convergence)
– Common call processing by switching layer
– Common service processing by both layers
– Generic support for mobility access
– Reduction in switch processing (increase utilisation)
– Service interaction minimised and simplified
• Stronger security for mutual authentication
– Needed for increasing value of services
UMTS EvolutionUMTS Evolution
• How?– GSM won’t completely evolve into UMTS
– Additional capabilities in GSM
– Introduce gradually in cities
– Dual UMTS/GSM terminals
– Cordless roaming
UMTS MultimediaUMTS Multimedia
• Applications– Web browsing
– Push techniques (news etc.)
– Messaging & email
– Real-time audio & video
– E-commerce applications (banking, shopping)
– Office applications
UMTS InternetUMTS Internet
• Decouple infrastructure from applications• Layer IPv6 over UMTS
– Fully integrated into the system
– Gateways to existing Internet
– ATM/IP Core backbone
– Media Gateways• Quality of Service (e.g. MPLS)
IP over 3G/UMTSIP over 3G/UMTS
• Key services in 3G– Voice (of high quality)– Non-Internet Multimedia, e.g. photo/video messaging– Location-based Services (LBS)– Internet Access – Internet Multimedia Subsystem (IMS)
• IP will be a ‘service’ of 3G– This means IP runs on top of existing layers in parallel to
other protocols for other services– Some providers will specialize in IP access to customers,
possibly separately to existing providers
Internet Multimedia SubsystemInternet Multimedia Subsystem
© www.ericsson.com
