GSM Continued

GSM Burst Format

• Each time slot is 577us. They are (in this order) 1. Trailing bits (3 bits)2. Data (57 bits)3. Flag (1 bit)4. Training sequence (26 bits)5. Data (57 bits)6. Flag (1 bit)7. Trailing bits (3 bits)8. Guard Period (8.25bit)

GSM Bursts

• In addition,– Frequency Correction Burst– Synchronization Burst– Random Access burst

GSM Channels• Traffic Channels (TCH)• Control Channels (CCH)

– Common Control Channels (CCCH)• Paging Channel (PCH): Used by the BTS to inform the MS about an

incoming call. Broadcast channel.• Random Access Channel (RACH): Used by the MS for call

establishment. Shared by all MS in cell. Slotted-ALOHA random access.

• Access Grant Channel (AGCH): Used to indicate the slot assignment.

GSM Channels• Control Channels (CCH)

– Dedicated Control Channels (DCCH): Used to control individual MS• Standalone Dedicated Control Channel (SDCCH) : Two-way

channel assigned to each MS for keeping track of movement and call establishment. Certain slots periodically. About 2Kbps per MS.

• Slow Associated Control Channel (SACCH): Two-way channel assigned to a TCH or SDCCH. Used to report parameters, such as signal power, to maintain the link.

• Fast Associated Control Channel (FACCH) : Two-way channel used to support fast transitions when SACCH is not adequate. FACCH steals the TCH.

GSM Channels• Control Channels (CCH)

– Broadcast Channels (BCH). Used to broadcast information to the MSs in the cell• Frequency Correction Channel (FCCH) and Synchronization

Channel (SCH): Keep the MS synchronized • Broadcast Control Channel (BCCH): provides information such as

cell ID, available services, … Can also be used to keep track of signal strength for handoff

http://elm.eeng.dcu.ie/~kaszubow/Biography/Lecture5.pdf

Management of GSM• Mobile System (MS)

– Mobile Equipment (ME)– Subscriber Identity Module (SIM)

• Base Station Subsystem– Base Transceiver Station (BTS)

• In charge of physical communication in the air. Has 1 to 16 transceivers– Base Station Controller (BSC)

• Controls hundreds of BTS• Network Switching Subsystem

– Mobile Switching Center (MSC)• Typical MSC supports up to 100,000 mobiles and 5000 simultaneous calls• MSC are connected with each other. • Gateway MSC connects the GSM system to external networks, e.g. PSTN. • Each MSC controls at least one Base Station System (BSS)

– Visitor’s Location Register (VLR)– Home Location Register (HLR). – Authentication Center (AuC). Holds different algorithms for authentication and encryption.– Operations and maintenance center (OMC)

HLR and VLR• HLR: database of all cellphones permanently registered in the system.

Stores– The address of the VLR currently associated with the phone– Encryption keys for data transmission and user authentication – Service type– …

• VLR: Each MSC connects to a VLR. The VLR is a data base with the information about cellphones temporarily located in the area served by particular MSC.

ME and SIM• ME, has the IMEI (International Mobile Equipment Identity)• SIM card, has

– Ki: Subscriber Authentication Key. 128 bit key shared by the subscriber and the operator. Stored in the SIM card and the HLR

– PIN: to protect the SIM card– IMSI: International Mobile Subscriber Identity– TMSI: Temporary Mobile Subscriber Identity. To prevent

eavesdropping, TMSI is used instead of IMSI. IMSI is used as rarely as possible. TMSI is randomly generated by the VLR.

– MSISDN: Mobile Station International Service Digital Network– LAI: Location Area Identification

GSM Security• When a mobile station needs to be authenticated,

1. The operator generates a random number, RAND (128 bit), and sends to the MS.

2. The MS and the operator both runs an algorithm, called the A3 algorithm, with Ki as the key, to produce SRES (32 bit) from RAND

3. The MS sends the SRES to the operator, and if SRES matches the operator’s SRES, consider passed authentication

4. RAND is passed to an algorithm called A8 as input with Ki as the key, to produce Kc (64 bit). Done by both the MS and the operator

5. Kc becomes the key for the A5 algorithm. A5 is a stream cipher for encrypting the data.

GSM Registration (simplified)• When an MS needs registration (first turned on, found the current cell has a

different ID)1. MS sends Channel Request to BSC2. BSC replies with Activation Response3. MS sends Activation ACK4. BSC assigns a channel to process registration5. MS sends Location Update Request to MSC6. MSC replies with Authentication Request7. MS replies with Authentication Response8. MSC checks the authentication9. MSC assigns TMSI to MS10. MS sends ACK for TMSI11. MSC updates VLR and HLR12. BSC informs the MS to release the channel for registration

GSM Call Flow (Simplified)• When the MS wishes to make a phone call

1. User enters the phone number and presses the “send” button.2. To set up the phone call, the MS needs to send information to the MSC. The MS sends

“Radio Resource Channel Request” to the associated BSS on the Random Access Channel (RACH) according to ALOHA The phone then waits to hear from the BSS at the Access Grant Channel (AGCH).

3. The BSS allocates a Traffic Channel (TCH), including the frequency and time slot, and broadcast it in the AGCH. It also contains information about time and frequency corrections.

4. The MS applies the corrections and tune to the assigned TCH.5. MSC checks whether the MS is authenticated.6. The BSS enables ciphering with the phone. At this step the connection has been set up

between the MS and MSC. The BSS just forwards the message.7. The MS sends a connection set up request to the MSC with the called phone number. The

MSC connects to the PSTN and allocates the voice communication channel between the BSS.

8. Make the conversation.9. User presses the “end” button. The MSC releases the voice channel with the BSS. The MSC

informs the PTSN about the call release and the PTSN will inform the call has been released on its end. MSC informs the MS then releases the TCH.

14

Public switched telephonenetwork

mobileuser

homeMobile

Switching Center

HLR home network

visitednetwork

correspondent

Mobile Switching

Center

VLR

GSM: indirect routing to mobile

1 call routed to home network

2

home MSC consults HLR,gets roaming number ofmobile in visited network

3

home MSC sets up 2nd leg of callto MSC in visited network

4

MSC in visited network completescall through base station to mobile

15

Mobile Switching

Center

VLR

old BSSnew BSS

old routing

newrouting

GSM: handoff with common MSC

• Handoff goal: route call via new base station (without interruption)

• reasons for handoff:– stronger signal to/from new BSS

(continuing connectivity, less battery drain)

– load balance: free up channel in current BSS

– GSM doesn’t mandate why to perform handoff (policy), only how (mechanism)

• handoff initiated by old BSS

16

Mobile Switching

Center

VLR

old BSS

1

3

24

5 6

78

GSM: handoff with common MSC

new BSS

1. old BSS informs MSC of impending handoff, provides list of 1+ new BSSs

2. MSC sets up path (allocates resources) to new BSS

3. new BSS allocates radio channel for use by mobile

4. new BSS signals MSC, old BSS: ready 5. old BSS tells mobile: perform handoff to

new BSS6. mobile, new BSS signal to activate new

channel7. mobile signals via new BSS to MSC: handoff

complete. MSC reroutes call8 MSC-old-BSS resources released

General Packet Radio Service (GPRS)

• General Packet Radio Service– Supports data service.– Use the same physical link between the network and the MS

• An MS maybe assigned with 1 or multiple time slots in a channel• The number of time slot in uplink and downlink may be different

– Special network infrastructure added to support data traffic• Serving GRPS Supporting Node (SGSN): a router serves a group of

BSCs. Send and receive packets from the MS.• Gateway GRPS Supporting Node (GGSN): interface to the Internet.

Maintains routing information related to the MS, such that given an IP packet, it knows which SGSN to forward to.

GRPS

• Multiple Access– Users are assigned frequency channels and time

slots.– Packets are constant length, determined by the

GSM slot.– Downlink: first come first served– Uplink: Slotted ALOHA for reserving, dynamic

TDMA for data transmission

Reading• http://liny.csie.nctu.edu.tw/ch09A4.pdf• http://www.hackcanada.com/blackcrawl/cell/gsm/gsm-secur/gsm-secur.html • http://www.eventhelix.com/realtimemantra/Telecom/GSM_Originating_Call_Flow.pdf

3G Overview

• Use CDMA.• Generally, 3G will have a much better support for data

services. The numbers are different depending on the versions, but it will be about at least one order of magnitude higher than GRPS.

• Defines an air interface and maybe combined with the GSM/GRPS core network

• There are competing standards:– W-CDMA– CDMA2000– …

CDMA Review

• Users assigned different code, also called chip sequence

• A data bit is multiplied with the chip sequence, to spread the baseband bandwidth to a much larger bandwidth

• The codes for different users are orthogonal

Power Control in CDMA Schemes

• The signal received at the base station are from multiple users at the same frequency

• If one user is transmitting at a high power, other users signal will be overshadowed

• CDMA schemes has to limit the transmitting power of the MS

• The BS may measure the signal strength and send instructions to the MS about increasing or decreasing the transmitting power.

W-CDMA

• Key features include– Radio channels 5MHz wide, both uplink and

downlink– Chip rate 3.84Mcps– Frame length 10ms– Adaptive power control updated 1500 times per

second– Cells not synchronized (synchronized in

CDMA2000)

Orthogonal variable spreading factor (OVSF)

• W-CDMA uses Orthogonal variable spreading factor (OVSF) to provide different data rates to different users

• The idea is that users may be assigned with codes of different lengths, but still orthogonal to each other.

• Because code length are different, a user assigned a shorter code will have a higher data rate

OVSF• Generation of OVSF code based on a simple binary tree

– Start with the root node {1}.– A node has two children. The upper and lower. If the node as code C,

the upper child is assigned code CC, and the lower child is assigned CC’ (C’ means inverting every bit in C).

– Repeat. • Two codes are orthogonal as long as no one is the prefix of the other• A major issue is how to assign codes

HSDPA

• Adaptive modulation and coding (AMC)– Depending on the channel state, send at different

data rates.– Use lower data rate if channel is weak– In wireless LAN, the rate adaptation

High-Speed Downlink Packet Access (HSDPA)

• Hybrid automatic repeat-request (HARQ) – When a data packet is received and found to be

corrupted, the receiver does not simply discard it, but saves it and combines it with the retransmissions

– When a packet is corrupted, the sender does not send the packet again, it sends some parity checking bits

– AMC is coarse grained, HARQ is fine grained

HSDPA

• Fast packet scheduling – Each user transmits to the base station the signal

quality – The base station determines which user to send to

for the next 2ms• Send to users with stronger channels • May send to multiple users simultaneously with the

channelization code• Must also ensure fairness

Readings• http://www.ericsson.com/technology/whitepapers/innovations_in_wcdma.pdf