2 GSM Introduction

GSM ArchitectureGSM Architecture

Lesson 2Lesson 2

22interWAVE COMMUNICATIONS

TopicsTopics

Geographical Network StructuresGeographical Network Structures The Mobile Station The Mobile Station The Base Station SubsystemThe Base Station Subsystem

Base Transceiver StationBase Transceiver Station Base Station ControllerBase Station Controller

The Network SubsystemThe Network Subsystem Mobile Switching CenterMobile Switching Center Data BasesData Bases Security FunctionsSecurity Functions Non-voice FunctionsNon-voice Functions

Operation and Maintenance CentersOperation and Maintenance Centers


GSM StructureGSM Structure Every telephone network needs a structure to be able to Every telephone network needs a structure to be able to

route calls to the right MSC and to the right subscriber. In route calls to the right MSC and to the right subscriber. In a GSM/DCS network, a GSM/DCS network, structurestructure is even more essential as the is even more essential as the subscribers are mobile, and could be virtually anywhere in subscribers are mobile, and could be virtually anywhere in the world.the world.

PLMNPLMN

MSC/VLRMSC/VLR LALA

LALALALA

CellCellMSCMSC VLRVLR

BSCBSC

BSCBSC

MSCMSCMSCMSC


Pubilc Land Mobile Network(Pubilc Land Mobile Network(PLMNPLMN))

GMSCGMSC

other PLMNother PLMN

PSTNPSTN

GSM/PLMNGSM/PLMNGMSCGMSC

ISDNISDN

First, a GSM PLMN is a complete GSM network belonging to one operator. First, a GSM PLMN is a complete GSM network belonging to one operator. Some countries have several GSM PLMNs (compare PSTN)Some countries have several GSM PLMNs (compare PSTN)

The GSM PLMN is the complete GSM network belonging to one operator. The GSM PLMN is the complete GSM network belonging to one operator. Some countries have several GSM PLMNs.Some countries have several GSM PLMNs.

A PLMN is uniquely identified by its A PLMN is uniquely identified by its mobile country codemobile country code(MCC) and (MCC) and mobile mobile network codenetwork code(MNC). The MCC identifies the country and the MNC identifies (MNC). The MCC identifies the country and the MNC identifies a PLMN within the country.a PLMN within the country.


Gateway MSCGateway MSC

A gateway between the GSM/DCS and other A gateway between the GSM/DCS and other networks is necessary. A call to a subscriber in the networks is necessary. A call to a subscriber in the GSM/DCS network, will first be routed to the GMSC. GSM/DCS network, will first be routed to the GMSC.

The GMSC is responsible for finding out in what The GMSC is responsible for finding out in what part of the GSM/DCS network the MS is by part of the GSM/DCS network the MS is by questioning HLR and also for routing of the call.questioning HLR and also for routing of the call.

GMSCGMSC

MSCMSC

MSCMSC

MSCMSC

MSCMSC

MSCMSC

HLRHLR


MSC/VLR Service AreaMSC/VLR Service Area First, a GSM PLMN network is divided into one or more MSC/VLR service First, a GSM PLMN network is divided into one or more MSC/VLR service

areas.areas. An MSC service area represents the part of the network that is covered by one An MSC service area represents the part of the network that is covered by one

MSC.MSC. The service area is the part of the network that is defined as an area in which a The service area is the part of the network that is defined as an area in which a

MS is reachable, due to the fact that the MS is MS is reachable, due to the fact that the MS is registeredregistered in a VLR. in a VLR. Usually the MSC /VLR are implemented in the same nodeUsually the MSC /VLR are implemented in the same node

GMSCGMSC

aa

bb

cc

dd

MSCMSCVLRVLR

MSCMSCVLRVLR

MSCMSCVLRVLR

MSCMSCVLRVLR

GSM PLMNGSM PLMN


Location Area Identity(LAI)Location Area Identity(LAI) This uniquely identifies a GSM location area.This uniquely identifies a GSM location area. Each MSC/VLR Service Area is divided into a number of location areas, which helps the Each MSC/VLR Service Area is divided into a number of location areas, which helps the

MSC/VLR to track the location of the MS. A location area is the area where a paging message MSC/VLR to track the location of the MS. A location area is the area where a paging message is broadcasted in order to locate a MS. is broadcasted in order to locate a MS.

The location area format is: LAI = MCC + MNC + LAC (The location area format is: LAI = MCC + MNC + LAC (the location area code(LAC) the location area code(LAC) identifies a location area within a PLMN)identifies a location area within a PLMN)

The location area can have several cells, and one or more BSC, But it belongs to only one The location area can have several cells, and one or more BSC, But it belongs to only one MSC/VLRMSC/VLR

A BSC can also have several LACsA BSC can also have several LACs

MSCMSCVLRVLR

LA 1LA 1LA 4LA 4

LA 3LA 3

MSCMSC VLRVLR

MSCMSC

VLRVLR

GMSCGMSC

LA 2 LA 2


CellCell Each location area is divided into a number of cells. A cell is the Each location area is divided into a number of cells. A cell is the

geographical area covered by one Base Transceiver Station (BTS). geographical area covered by one Base Transceiver Station (BTS). There are different types of cells, depending on size: Macrocells, There are different types of cells, depending on size: Macrocells, microcells, and picocells. There also could be several BSCs serving microcells, and picocells. There also could be several BSCs serving the cells, but all connected to the same MSC/VLR.the cells, but all connected to the same MSC/VLR.

LAC are split into cells by the LAC are split into cells by the compromisecompromise of paging load and of paging load and location update loadlocation update load

The MS distinguishes between cells using the same carrier frequencies The MS distinguishes between cells using the same carrier frequencies by the use of BSICs.by the use of BSICs.

BTSBTS

BSC

Cell 11

Cell 12

LAI 1

MSCMSCVLRVLR


Cell / Location AreasCell / Location Areas

BTSBTS BTS BTS BTS BTS

BSC BSC BSC

MSCVLR

A-Interface

LAC # 1 LAC # 2 LAC # 3

Cell 11

Cell 12

Cell 21

Cell 31

Cell 32

Cell 33

Abis Interface


GSM Service AreasGSM Service Areas

PLMNPLMN • Complete GSM/DCS/PCS network of one operator in one countryComplete GSM/DCS/PCS network of one operator in one country• possible for 2 or 3 PLMNs per countrypossible for 2 or 3 PLMNs per country•1 HLR database per PLMN1 HLR database per PLMN

MSC Serving AreaMSC Serving Area • Area controlled by one MSCArea controlled by one MSC•VLR assigned per/MSCVLR assigned per/MSC• Exchange for one large area (metro / suburban)Exchange for one large area (metro / suburban)• possible multiple MSC per PLMNpossible multiple MSC per PLMN

Location AreaLocation Area • Several LA per metropolitan areaSeveral LA per metropolitan area• MS location updates if moves out of LAMS location updates if moves out of LA• Possible of several cells per LAPossible of several cells per LA

BTS (cell)BTS (cell)

• Smallest geographical entitySmallest geographical entity• One or more cells within a BTSOne or more cells within a BTS• 10’s of meters to tens of km10’s of meters to tens of km

GSM Service AreaGSM Service Area • all member countriesall member countries


TopicsTopics

Geographical Network Structures The Mobile Station The Mobile Station The Base Station SubsystemThe Base Station Subsystem





GSM Main ComponentsGSM Main Components


MS - Mobile StationMS - Mobile Station

Mobile Equipment - Mobile Equipment - The MS is made up ofThe MS is made up of

SIM SIM and the "Mobile Equipment" (ME). and the "Mobile Equipment" (ME).

The SIM, "Subscriber Identity Module", a separate The SIM, "Subscriber Identity Module", a separate physical entity that contains all information regarding physical entity that contains all information regarding the subscriber. The SIM is an IC Card, or a "Smart the subscriber. The SIM is an IC Card, or a "Smart Card". Without the SIM, the Mobile Equipment cannot Card". Without the SIM, the Mobile Equipment cannot be used in the GSM/DCS network, except for emergency be used in the GSM/DCS network, except for emergency calls. The SIM can be put into a different "Mobile calls. The SIM can be put into a different "Mobile Equipment", whereby all calls are routed to that "Mobile Equipment", whereby all calls are routed to that "Mobile Equipment".Equipment".

The "Mobile Equipment" is a physical piece of hardware The "Mobile Equipment" is a physical piece of hardware enabling radio communication with the system. enabling radio communication with the system.



MEME Mobile EquipmentMobile Equipment Portable radio that can be used in any Portable radio that can be used in any

GSM system.GSM system. vehicle mountedvehicle mounted portableportable handheldhandheld



MEME Mobile Equipment Portable radio that can be used in any GSM

system. Power Classes Power Classes (up to 15 power control levels)(up to 15 power control levels)

+ / - 2db (nominal) + / - 2db (nominal)

ClassClass1122334455

GSM900GSM900

8W(39dBm)8W(39dBm)5W (37 dBm)5W (37 dBm)2W (33 dBm)2W (33 dBm)

0.8W 5W (37 dBm)0.8W 5W (37 dBm)

DCS1800DCS18001W(30dBm)1W(30dBm)

.25W (24 dBm).25W (24 dBm)4W (36 dBm)4W (36 dBm)

PCS1900PCS19001W(30dBm)1W(30dBm)

.25W (24 dBm).25W (24 dBm)2W (33 dBm)2W (33 dBm)



MEME Mobile Equipment Portable radio that can be used in any

GSM system. Power Classes Radio interfaceRadio interface

Frequency(MHz)Frequency(MHz)Uplink(TX)Uplink(TX)

Downlink(RX)Downlink(RX)

GSMGSM890 - 915935 - 960

EGSMEGSM880 - 915925 - 960

DCS1800DCS18001710 - 1785 1805 -1880

PCS1900PCS19001850 - 1910 1930 - 1990




GSM system. Power Classes Radio interface Encryption module for securityEncryption module for security

A5/1A5/1 A5/2A5/2 up to 7 algorithmsup to 7 algorithms




GSM system. Power Classes Radio interface Encryption module for security Full rate & Enhanced Full rate Full rate & Enhanced Full rate

ServicesServices voice and datavoice and data




GSM system. Power Classes Radio interface Encryption module for security Full Rate Services Mobile TerminationMobile Termination

MT0 : speech/dataMT0 : speech/data MT1 : 2B+D interface to ISDN MT1 : 2B+D interface to ISDN

terminalterminal MT3 : CCITT X & V interfaceMT3 : CCITT X & V interface




GSM system. Power Classes Radio interface Encryption module for security Full/Half Rate Services Mobile Termination Unique IMEI - International Mobile Unique IMEI - International Mobile

Equipment Identity number - identifies Equipment Identity number - identifies the MEthe ME



ME SIMSIM

Subscriber Identity Subscriber Identity ModuleModule



ME SIMSIM

Subscriber Identity ModuleSubscriber Identity Module ID -1 SIM (credit card)ID -1 SIM (credit card) Plug-in SIM (cut-out)Plug-in SIM (cut-out) ProcessorProcessor Fixed (permenant) storageFixed (permenant) storage User (temporary) storageUser (temporary) storage



ME SIMSIM

Subscriber Identity Module Personal identity for making and receiving

calls

Stores subscriber personal identity, Stores subscriber personal identity, security information, short security information, short messages, and dialing listsmessages, and dialing lists IMSI, TMSIIMSI, TMSI cipher key & sequence no.cipher key & sequence no. admin. & location infoadmin. & location info language preferencelanguage preference PINs, phone listsPINs, phone lists dialled, missed #dialled, missed #



ME SIMSIM

Subscriber Identity Module Personal identity for making and

receiving calls Stores subscriber personal identity,

security information, short messages, and dialing lists

Authentication & encryption Authentication & encryption algorithmsalgorithms authenticate algorithm (A3)authenticate algorithm (A3) session key algorithm (A8)session key algorithm (A8) Ki, Kc - KeysKi, Kc - Keys



ME SIMSIM

Subscriber Identity Module Personal identity for making and

receiving calls Stores subscriber personal identity,

security information, short messages, and dialing lists

Authentication & encryption algorithms

Other Features:Other Features: Protected by user PIN codesProtected by user PIN codes Terminal / device independentTerminal / device independent Single point of billingSingle point of billing Global roamingGlobal roaming


MS Identification NumbersMS Identification Numbers

Mobile Station ISDN Number (MSISDN)Mobile Station ISDN Number (MSISDN) The MSISDN is a number which uniquely identifies a mobile telephone The MSISDN is a number which uniquely identifies a mobile telephone

subscriber in the PSTN numbering plan. It is composed of the following subscriber in the PSTN numbering plan. It is composed of the following numbers:numbers:

MSISDN = CC + NDC + SNMSISDN = CC + NDC + SN CC = Country CodeCC = Country Code NDC = National Destination codeNDC = National Destination code SN = Subscriber NumberSN = Subscriber Number

A National Destination code is allocated to each GSM PLMN. In some A National Destination code is allocated to each GSM PLMN. In some countries more than one NDC may be requiredcountries more than one NDC may be required



International Mobile Subscriber Identity (IMSI)International Mobile Subscriber Identity (IMSI) This uniquely identifies a mobile station in an GSM network. It will be stored in the MS This uniquely identifies a mobile station in an GSM network. It will be stored in the MS

SIM(permanent memory), HLR and in the VLR. The user does not need to keep track of this SIM(permanent memory), HLR and in the VLR. The user does not need to keep track of this number as it is used by the system itself. The IMSI format is:number as it is used by the system itself. The IMSI format is:

IMSI = MCC + MNC + MSINIMSI = MCC + MNC + MSIN MCC = Mobile Country CodeMCC = Mobile Country Code MNC = Mobile Network CodeMNC = Mobile Network Code MSIN = Mobile Station Identification NumberMSIN = Mobile Station Identification Number

Temporary Mobile Subscriber Identity Temporary Mobile Subscriber Identity ((TMSITMSI)) - - This 32 bit binary number is used instead of the IMSI which identifes the MS within one location This 32 bit binary number is used instead of the IMSI which identifes the MS within one location

area. For subscriber confidentiality, the TMSI can be changed an infinite number of times by area. For subscriber confidentiality, the TMSI can be changed an infinite number of times by command of the MSC/VLR.command of the MSC/VLR.

TMSI is temporary identification, and is usually changed by the network when the MS enters a TMSI is temporary identification, and is usually changed by the network when the MS enters a new location area. new location area.

LAI and TMSI are stored in temporary SIM memoryLAI and TMSI are stored in temporary SIM memory



International Mobile Equipment Identity (IMEI)International Mobile Equipment Identity (IMEI) Used to identify the mobile equipment. Each mobile equipment Used to identify the mobile equipment. Each mobile equipment

unit has its unique IMEI. The IMEI consists of the following:unit has its unique IMEI. The IMEI consists of the following: TAC = Type Approval CodeTAC = Type Approval Code FAC = Final Assembly CodeFAC = Final Assembly Code SNR = Serial NumberSNR = Serial Number sp = future usesp = future use

Mobile Station Roaming Number (MSRN)Mobile Station Roaming Number (MSRN) This is a number temporarily used for routing to the MSC/VLR at This is a number temporarily used for routing to the MSC/VLR at

which the MS is registered. It is allocated by that MSC /VLR and which the MS is registered. It is allocated by that MSC /VLR and sent via the HLR to the GMSC to route the incoming call to that sent via the HLR to the GMSC to route the incoming call to that MSC/VLRMSC/VLR


The Mobile Station and NumberingMobile Station + NumberingMobile Station + Numbering=

Subscriber SIM Card

IMSI = International Mobile Subscriber IdentityIMSI = International Mobile Subscriber Identity

Unique identification of the Unique identification of the subscribersubscriber(Stored in HLR and SIM, used by the system)(Stored in HLR and SIM, used by the system)

ki = Secret Authentication Keyki = Secret Authentication Key(Stored in AuC and SIM)(Stored in AuC and SIM)

TMSI = Temporary Mobile Subscriber identityTMSI = Temporary Mobile Subscriber identityAllocated by the VLR and sent to the HLR. Allocated by the VLR and sent to the HLR. Used on the air interface for security purposes.Used on the air interface for security purposes.

+ Other information+ Other information(e.g. Authentication Algorithms, Cipher Key,(e.g. Authentication Algorithms, Cipher Key,PIN Number etc….)PIN Number etc….)

+Mobile Equipment

IMEI =IMEI =International Mobile Equipment IdentityInternational Mobile Equipment IdentityUniquely identifies the handsetUniquely identifies the handset(stored in ME and EIR)(stored in ME and EIR)

Mobile Station MSISDN = MSISDN = Mobile Station ISDN Number. Mobile Station ISDN Number. Subscribers mobile phone number (Stored in HLR and related to the IMSI)Subscribers mobile phone number (Stored in HLR and related to the IMSI)



ME SIM Other equipmentOther equipment

Data/FAX cardData/FAX card data interfacedata interface Battery packBattery pack Car adaptorCar adaptor Hands FreeHands Free


TopicsTopics

Geographical Network Structures The Mobile Station The Base Station SubsystemThe Base Station Subsystem





BSS Main ComponentsBSS Main Components


The BSSThe BSS The Base Station System is the function used to give radio The Base Station System is the function used to give radio

coverage for one particular or a number of cells. Radio coverage for one particular or a number of cells. Radio traffic passes between the BSS and the Mobile Stations, traffic passes between the BSS and the Mobile Stations, the radio uplink (mobile station to PLMN) and downlink the radio uplink (mobile station to PLMN) and downlink (vice versa), to provide communication.(vice versa), to provide communication.

The BSS is broken down into two functional units a Base The BSS is broken down into two functional units a Base Station controller (BSC) and a Base Station transceiver Station controller (BSC) and a Base Station transceiver (BTS). A third part, Operations & Maintenance Center for (BTS). A third part, Operations & Maintenance Center for the radio (OMC-R) configures, monitors, and maintains all the radio (OMC-R) configures, monitors, and maintains all BSS operations. BSS operations.

the Transcoder (TRAU) is also associated with the BSS. the Transcoder (TRAU) is also associated with the BSS.


Um Interface

BTS

BTS

TRX

TRX

BSC Transcoder MSC

BSS

Abis InterfaceA Interface

Base Station Subsystem (BSS)Base Station Subsystem (BSS)

Establish radio link to MSEstablish radio link to MSpagingpagingchannel allocationchannel allocationchannel assignmentchannel assignment

Maintain radio link to MSMaintain radio link to MSmeasurement of RF measurement of RF linklinkperforms handoverperforms handover

Channel ManagementChannel Management Configuration of radio channelsConfiguration of radio channels Channel selection, allocation, releaseChannel selection, allocation, release Blocking indicationBlocking indication Monitoring of idle channelsMonitoring of idle channels Radio Interface EncryptionRadio Interface Encryption

Power allocationPower allocation Digital Signal ProcessingDigital Signal Processing

Transcoding and rate Transcoding and rate adaptionadaption

Channel coding and decodingChannel coding and decoding

16Kb/s

16Kb/s 64Kb/s

E1/T1


Transmission Network TopologyTransmission Network Topology

BSCBSC

BTSBTS BTSBTS

BTSBTS BTSBTS

BSCBSCBTSBTS BTSBTS

BTSBTS

Daisy Chain/TreeDaisy Chain/Tree

StarStar


BTS - Base BTS - Base Transceiver StationTransceiver Station

Contains radio transmission Contains radio transmission and receiving devices (TRX) and receiving devices (TRX) to stay in touch with the MSto stay in touch with the MS

Control(BCF)Control(BCF)

SignalSignalProcessingProcessing

TransmitTransmit

ReceiveReceive

SynchronizationSynchronization

BSCBSC

Ant.Ant.

PowerPower

TRXTRX

BSS - Base Station SubsystemBSS - Base Station Subsystem




Contains radio transmission and receiving devices (TRX) to stay in touch with the MS

Defines cell boundaries and Defines cell boundaries and coveragecoverage





Defines cell boundaries and coverage

Channel coding & interleavingChannel coding & interleaving Protection against channel Protection against channel

impairmentsimpairments DSP intensiveDSP intensive






Channel coding & interleaving Controls other key GSM Controls other key GSM

features:features: EncryptionEncryption Frequency hoppingFrequency hopping Dynamic power controlDynamic power control






Channel coding & interleaving Controls other key GSM

features BTS Types:BTS Types:

Macro, Micro, PicoMacro, Micro, Pico Indoor/OutdoorIndoor/Outdoor


BTS - Base Transceiver StationBTS - Base Transceiver Station The BTS maximum output power , measured at the antenna The BTS maximum output power , measured at the antenna

connector(after all stages of combining), shall be, according to its connector(after all stages of combining), shall be, according to its class, as defined in the following tables (per GSM spec 05.08):class, as defined in the following tables (per GSM spec 05.08):

TRX PowerTRX Power

ClassClass1122334455667788

Max OutputMax Output

PowerPower((WattsWatts))320320160160808040402020101055

2.52.5

TRX PowerTRX Power

ClassClass11223344

Max OutputMax OutputPower (Watts)Power (Watts)

20 - 4020 - 4010 - 2010 - 205 - 105 - 102.5 - 52.5 - 5

GSM900GSM900 DCS1800/ PCS1900DCS1800/ PCS1900

TRX PowerTRX Power

ClassClassM1M1M2M2M3M3


PowerPower((WattsWatts))> .08 - .25> .08 - .25> .03 - .08> .03 - .08> . 01 - .03> . 01 - .03

GSM900 micro BTSGSM900 micro BTSTRX PowerTRX Power

ClassClassM1M1M2M2M3M3


PowerPower((WattsWatts))> .5 - 1.6> .5 - 1.6> .16 - .5> .16 - .5

> .05 - .16> .05 - .16

DCS1800/PCS1900DCS1800/PCS1900 micro BTSmicro BTS


BSS IdentificationBSS Identification Cell Group Identity (CGI) Cell Group Identity (CGI) - - is used for cell identification within a location is used for cell identification within a location

area. This is done by adding a Cell Identity (CI) to the location area identityarea. This is done by adding a Cell Identity (CI) to the location area identity CGI = MCC + MNC + LAC + CICGI = MCC + MNC + LAC + CI CI = Cell Identity, identifies a cell within a location areaCI = Cell Identity, identifies a cell within a location area

Base Station Identity Code (BSIC) Base Station Identity Code (BSIC) - - BSIC allows a mobile station to BSIC allows a mobile station to distinguish between different neighboring base stationsdistinguish between different neighboring base stations

BSIC = NCC + BCCBSIC = NCC + BCC NCC = Network Color Code, identifies the GSM PLMN. NCC is used to distinguish NCC = Network Color Code, identifies the GSM PLMN. NCC is used to distinguish

between operators on each side of the border.between operators on each side of the border. NCC = Operator ID + Country ID ( a definition of NCC for all member countries is NCC = Operator ID + Country ID ( a definition of NCC for all member countries is

given in the GSM recommendations)given in the GSM recommendations) BCC = Base Color Code, identifies the base stationBCC = Base Color Code, identifies the base station

Location Area Identity (LAI)Location Area Identity (LAI) - - is used for location updating of mobile is used for location updating of mobile suubscriberssuubscribers

LAI consists of the following:LAI consists of the following: MCC = Mobile Country codeMCC = Mobile Country code MNC = Mobile Network code, identifies the GSM PLMN in that countryMNC = Mobile Network code, identifies the GSM PLMN in that country LAC = Location Area Code, identifies a location area within a PLMN (group of LAC = Location Area Code, identifies a location area within a PLMN (group of

cells)cells)



BTS - Base Transceiver Station

BSC - Base Station BSC - Base Station ControllerController

The The brainsbrains of the BSS of the BSS Responsible for:Responsible for:

Transmission network Transmission network managementmanagement

Radio channel managementRadio channel management Radio network managementRadio network management BTS controlBTS control

TransmissionNetwork

RadioChannel

RadioNetwork

BTSControl





Transmission Network managementTransmission Network management switches 64kbps & 16kbps timeslotsswitches 64kbps & 16kbps timeslots PCM managementPCM management Can provide: Transcoder & Rate Can provide: Transcoder & Rate

Adaptation (TRAU)Adaptation (TRAU)

TransmissionNetwork

RadioChannel

RadioNetwork

BTSControl


TRAUTRAU Transcodes the speech bit rate from 64kbps (the speech form in normal Transcodes the speech bit rate from 64kbps (the speech form in normal

telecommunications) to 13 kbps ( the speech form in the GSM system)telecommunications) to 13 kbps ( the speech form in the GSM system) Data Rate Adaptation. Data Rate Adaptation.

takes synchronous/asynchronous data (300 to 9600 bps) rates and produce an takes synchronous/asynchronous data (300 to 9600 bps) rates and produce an intermediate data rate of 16kbps to be sent over the airintermediate data rate of 16kbps to be sent over the air

The intermediate data rate is adapted to 64kbps in the BSCThe intermediate data rate is adapted to 64kbps in the BSC The signaling information transferred between the BSC and BTS, together with The signaling information transferred between the BSC and BTS, together with

the speech is called in-band signaling. Types of inband signaling:the speech is called in-band signaling. Types of inband signaling: channel mode type (speech, data, OAM frames)channel mode type (speech, data, OAM frames) SID - Silence Discriptor indiction (speech mode, DTX)SID - Silence Discriptor indiction (speech mode, DTX) BFI - Bad Frame Indicator (speech mode)BFI - Bad Frame Indicator (speech mode)

Full Rate SpeechCompression

&Encoding 16Kbps

Formatting

DataRate

Adaptation

A-LawA-Law64Kbps64KbpsPCM fromPCM fromnetworknetwork

13.2Kbps13.2Kbps 16Kbps16Kbps

2.8 Kbps2.8 KbpsIn-band signalingIn-band signaling

multiplemultiple16Kbps16Kbps

channels to BTSchannels to BTS

VoiceVoice

DataData


TRAU at BSCTRAU at BSC TRAU at MSCTRAU at MSC

MSCMSC

BSCBSC TRAUTRAU

64 kbps64 kbps

BTSBTS BTSBTS

16 kbps16 kbps

MSCMSC

BSCBSC

TRAUTRAU

64 kbps64 kbps

BTSBTS BTSBTS

16 kbps16 kbps

16 kbps16 kbps

compressed speechcompressed speech compressed speechcompressed speech

BSCBSC

BTSBTS

16 kbps16 kbps

Transmission Network ManagementTransmission Network Management





Radio channel management:Radio channel management: channel allocationchannel allocation channel assignmentchannel assignment channel supervisionchannel supervision channel releasechannel release handover controlhandover control paging requestspaging requests SMS transmissionSMS transmission administrate the transmission of:administrate the transmission of:

system informationsystem information frequency hopping sequencefrequency hopping sequence MS/ BTS power controlMS/ BTS power control

TransmissionNetwork

RadioChannel

RadioNetwork

BTSControl





Radio Network management - Radio Network management - The The BSC administrates the cell description BSC administrates the cell description data, such as;data, such as;

identities and type of cell, identities and type of cell, the configuration of frequencies and output the configuration of frequencies and output

power of the TRXs in the BTSs.power of the TRXs in the BTSs. As part of radio management the BSC As part of radio management the BSC

sends lists to the MSs, containing sends lists to the MSs, containing information of what neighboring cells information of what neighboring cells that the MSs should perform that the MSs should perform measurements onmeasurements on. .

TransmissionNetwork

RadioChannel

RadioNetwork

BTSControl





BTS Control - BTS Control - BTS supervisionBTS supervision BTS maintenanceBTS maintenance alarms & statisticsalarms & statistics software loadingsoftware loading

The messages concerning the The messages concerning the control are sent on the signalling control are sent on the signalling links between the BSC and the links between the BSC and the BTSsBTSs

TransmissionNetwork

RadioChannel

RadioNetwork

BTSControl




BSC - Base Station Controller

OMC-R - Operations OMC-R - Operations Management Center Management Center - Radio- Radio

Network Management of the BSSNetwork Management of the BSS Graphical User InterfaceGraphical User Interface System initializationSystem initialization System (re)-configurationSystem (re)-configuration Fault detection and notificationFault detection and notification Performance managementPerformance management Security managementSecurity management Administration and user servicesAdministration and user services Software download for upgradesSoftware download for upgrades OMC-R can be on the same OMC-R can be on the same

platform as the OMC-S (OSS)platform as the OMC-S (OSS)


TopicsTopics

Geograhical Network Structures The Mobile Station The Base Station Subsystem

Base Transceiver Station Base Station Controller




NSS Main ComponentsNSS Main Components


NSS - Network SubsystemNSS - Network Subsystem

MSC - Mobile MSC - Mobile Services Switching Services Switching CenterCenter

Switches calls between wireless Switches calls between wireless users and PSTNusers and PSTN paging, call setup, supervisionpaging, call setup, supervision authentication, identificationauthentication, identification

Manages subscriber mobilityManages subscriber mobility establish, maintain communications linkestablish, maintain communications link privacy over the airprivacy over the air

Connected to databases in order to Connected to databases in order to maintain contact with network maintain contact with network subscriberssubscribers subscriber datasubscriber data updating registersupdating registers


Mobile Switching CenterMobile Switching Center

PSTN, ISDN, PLMNPSTN, ISDN, PLMN

Services (v-mail)Services (v-mail)

BillingFunctions

GSMGSMApplicationsApplications

BSSBSS

GatewayGatewayFunctionFunction

Other GSM nodesOther GSM nodes• HLRHLR• AUCAUC• EIREIR• IWFIWF• SMSSMS

Three functional management groups within the MSC:Three functional management groups within the MSC: Connection ManagementConnection Management Mobility ManagementMobility Management BSS ControlBSS Control


MS-Management in MSCMS-Management in MSC

Connection Connection ManagementManagement

Call Control and signallingCall Control and signalling Trunk signalingTrunk signaling Short Message ServiceShort Message Service Supplementary ServiceSupplementary Service Echo cancelationEcho cancelation DTMF Tone GenerationDTMF Tone Generation Billing InformationBilling Information



Connection Management

Mobility Mobility ManagementManagement

authenticationauthentication cipheringciphering location updatelocation update HLR/VLRHLR/VLR



Connection Management

Mobility Management BSS ControlBSS Control

initiates paginginitiates paging initiates traffic channel initiates traffic channel

assignmentassignment responds to handover responds to handover

requests from BSSrequests from BSS Manages connections to Manages connections to

BSSBSS PCM trunks to BSSPCM trunks to BSS lookup location area (from lookup location area (from

VLR) to serving BSCVLR) to serving BSC



MSC - Mobile Services Switching Center

DatabasesDatabases HLR - Home Location HLR - Home Location RegisterRegister

VLR - Visitor Location VLR - Visitor Location RegisterRegister


HLR - Home Location RegisterHLR - Home Location RegisterContains data for every mobile subscriber registered in the HLRContains data for every mobile subscriber registered in the HLR

Permanent (i.e. subscription options - only changed by service provider)Permanent (i.e. subscription options - only changed by service provider) Temporary (i.e. VLR number the MS is currently registered)Temporary (i.e. VLR number the MS is currently registered)

Data is accessed by using the IMSI or the MSISDN.Data is accessed by using the IMSI or the MSISDN. Stores all mobility dataStores all mobility data

VLR #, MSC # continually updated as subscriber moves around the VLR #, MSC # continually updated as subscriber moves around the network.network.

Roaming restrictions indicator (roaming allowed/not allowed) is set in Roaming restrictions indicator (roaming allowed/not allowed) is set in the HLR depending on location updating info.the HLR depending on location updating info.

Subscriber restrictions defines the area(s) the subscriber has access to Subscriber restrictions defines the area(s) the subscriber has access to (i.e. all GSM PLMNs, regional restricted).(i.e. all GSM PLMNs, regional restricted).

NSS Data Bases : HLRNSS Data Bases : HLR


VLR - Visitor Location RegisterVLR - Visitor Location Register

• This is a regional database that is usually placed with an This is a regional database that is usually placed with an MSC. This data base stores information about all the MSC. This data base stores information about all the subscribers that are registered (visiting) in that MSC service subscribers that are registered (visiting) in that MSC service area at the moment. The information includes a more area at the moment. The information includes a more detailed description of which Location area the MS is detailed description of which Location area the MS is located.located.

NSS Data Bases : VLRNSS Data Bases : VLR


VLR

Home Location Register (HLR)(semi-permanent)

• Logically one per Mobile Network

• Contains Permanent Subscriber Data: – International mobile station identity– Service subscription information– Service restrictions– Supplementary services

• Location information: which MSC is the subscriber at right now. Allows routing of calls to the subscriber.

Administration of subscriber configuration

Visiting Location Register (VLR) (transient)

• Usually one per Mobile Switch Center

• Contains temporary Subscriber Data for mobile stations currently within the VLR service area:

– Features currently activated

– Temporary mobile Subscriber Identity (TMSI)

• Location information (which location area the subscriber is in)

• Allocates MSRNs for Incoming call setup

HLRHLR




Databases Security FunctionsSecurity Functions

AuC - Authentication CenterAuC - Authentication Center EIR - Equipment Identity RegisterEIR - Equipment Identity Register


Authentication Center - AuCAuthentication Center - AuC Database that protects against unauthorized access and protects the Database that protects against unauthorized access and protects the

privacy of the usersprivacy of the users It maintains the algorithms used for authentication and encryption It maintains the algorithms used for authentication and encryption

keyskeys Stores the authentication key (Ki) of each subscriber(only changed Stores the authentication key (Ki) of each subscriber(only changed

by the service provider)by the service provider) May be integrated with the HLR or standaloneMay be integrated with the HLR or standalone All MS’s can be asked to go through an authentication procedure All MS’s can be asked to go through an authentication procedure

before they are allowed to do anything in the system. All necessary before they are allowed to do anything in the system. All necessary means for authentication are found in the SIM-cardmeans for authentication are found in the SIM-card

Access to this data base is usually restrictedAccess to this data base is usually restricted!!


MSMS

NSS Security : Authentication ParametersNSS Security : Authentication Parameters

DatabaseDatabase

IMSI Ki

Random number Random number generationgeneration

RAND

Algorithm A3Algorithm A3Auth. ResponseAuth. Response

GenerationGenerationSRESSRES

Ki = Mobile Authentication Key (128 bits)Ki = Mobile Authentication Key (128 bits) SRES = Signed Response (32 bits long)SRES = Signed Response (32 bits long)RAND = Random Number (128 bits long)RAND = Random Number (128 bits long)

KiKi

RANDRAND

NetworkNetwork

Algorithm A3Algorithm A3Auth. ResponseAuth. Response

GenerationGeneration

Ki= = ??

GSM authentication algorithm has two inputs: a random number (RAND) and an individual GSM authentication algorithm has two inputs: a random number (RAND) and an individual subscriber authentiction Ki. The Ki is stored in the SIM of the MS and network and never subscriber authentiction Ki. The Ki is stored in the SIM of the MS and network and never transmitted.transmitted.

The results of the algorithm is the The results of the algorithm is the SRES SRES and the cipher and the cipher KcKc (for (for EncryptionEncryption)) . The network starts the . The network starts the authentication process by sending an Auth. request which includes a RAND value. The MS will authentication process by sending an Auth. request which includes a RAND value. The MS will return with an Auth. Response which includes SRES, If the return with an Auth. Response which includes SRES, If the SRESSRESs match the network considers the s match the network considers the MS authenticated.MS authenticated.


NSS Security: EncryptionNSS Security: Encryption

One of the feature of GSM is protection of the user information One of the feature of GSM is protection of the user information against “eavesdropping”. This is accomplished by ciphering the against “eavesdropping”. This is accomplished by ciphering the information before transmitting itinformation before transmitting it..

The MSC is in control of this process, first by performing The MSC is in control of this process, first by performing authentication and then selecting encrypted operation which will then authentication and then selecting encrypted operation which will then select the cipher mode (A5/1 or A5/0) and starts the ciphering process select the cipher mode (A5/1 or A5/0) and starts the ciphering process to the Mobile Station and BTS through call messaging. to the Mobile Station and BTS through call messaging.


EncryptionEncryption

DatabaseDatabase

IMSI Ki

Random number Random number generationgeneration

RAND

Algorithm A8Algorithm A8Session KeySession KeyGenerationGeneration

KcKc

Ki = Mobile Authentication Key (Ki = Mobile Authentication Key (128 bits128 bits))RAND = Random Number (RAND = Random Number (128 bits128 bits))Kc = Session Key (Kc = Session Key (64 bits64 bits))

KiKi

RANDRAND

A/5A/5algorithmalgorithm

TDMATDMAframe numberframe number

114 bits114 bitscipher blockcipher block114 bits plain text114 bits plain text

data blockdata blockciphertextciphertext


NSS Security : EIRNSS Security : EIREIR - Equipment Identity RegisterEIR - Equipment Identity Register

This data base stores information about the pieces of This data base stores information about the pieces of mobile equipment (i.e. the hardware). It can keep track mobile equipment (i.e. the hardware). It can keep track of information such as stolen equipment, non-type of information such as stolen equipment, non-type approved equipment, etc. While the AUC is concerned approved equipment, etc. While the AUC is concerned with the SIM, the EIR is concerned with the mobile with the SIM, the EIR is concerned with the mobile equipmentequipment

White List Black ListWhite List Black List

IMEI IMEI Barred IMEIBarred IMEI




Databases Security Functions Non-voice FunctionsNon-voice Functions SMS CenterSMS Center

Inter Working FunctionInter Working Function


NSS Non-voice FunctionsNSS Non-voice Functions

Short Message ServiceShort Message Service SMS Center available to deliver alpha/numeric messagesSMS Center available to deliver alpha/numeric messages point to point messages, up to 160 characters/messagepoint to point messages, up to 160 characters/message mobile terminated and originated (two-way messaging)mobile terminated and originated (two-way messaging) mobile idle or activemobile idle or active Cell Broadcast capabilityCell Broadcast capability

InterWorking FunctionsInterWorking Functions Rate Adaptation and Access protocol for data servicesRate Adaptation and Access protocol for data services


InterWorking FunctionInterWorking Function

synchronous/asynchronous data (300 to 9600 bps)synchronous/asynchronous data (300 to 9600 bps) The BTS will produce data rate of 16kbpsThe BTS will produce data rate of 16kbps The intermediate data rate is adapted to 64kbps in the Transcoder Rate The intermediate data rate is adapted to 64kbps in the Transcoder Rate

Adaption Unit (TRAU)Adaption Unit (TRAU) After switching the 64kbps data rate is adapted (RA) in the IWF to the After switching the 64kbps data rate is adapted (RA) in the IWF to the

rate required by the selected modemrate required by the selected modem The modem will produce the correct data format for interworking with the The modem will produce the correct data format for interworking with the

PSTNPSTN The Radio Link Protocol (RLP) is used between the IWF and the MS The Radio Link Protocol (RLP) is used between the IWF and the MS

when Non transparent services are selectedwhen Non transparent services are selected

TRAUTRAUTo BSSTo BSS 16kbps16kbps 64kbps64kbpsMSCMSC

64kbps64kbpsRARA RLPRLP

ModemsModems

IWFIWF

PSTNPSTN




Databases Security Functions Non-voice Functions OMC-SOMC-S

NSS configurationNSS configuration Fault managementFault management Software version Software version

managementmanagement Performance managementPerformance management Subscriber managementSubscriber management


OSS - Operations SubsystemOSS - Operations Subsystem

MOM - Manager Of MOM - Manager Of ManagersManagers

Operations and Operations and Maintenance Center Maintenance Center managementmanagement

Subsystem configuration Subsystem configuration and managementand management

Performance managementPerformance management Fault managementFault management Security managementSecurity management


MOMMOM

BTSBTSBTSBTS

BTSBTS

BSCBSC

MSC

OMC-SOMC-S

WAN/LAN

OMC-ROMC-R OMC-SOMC-S

BSC

BTS

BTS

BTS

MSC

BSC

BTS

BTS

Q3 Q3 Q3 Q3

BillingSystem

BSSBSS

OMC-ROMC-R


Functions SupportedFunctions SupportedUsing the system components described previously it is Using the system components described previously it is possible to carry out the following functions:possible to carry out the following functions:

Location Registration. Location Registration. The Mobile Stations is capable of monitoring surrounding BTS The Mobile Stations is capable of monitoring surrounding BTS

broadcasts. When registering the supporting MSC forwards the new location of the Mobile broadcasts. When registering the supporting MSC forwards the new location of the Mobile Station to the HLR. The HLR can then delete the old location information from the previous Station to the HLR. The HLR can then delete the old location information from the previous VLR/MSC. The Mobile subscription data is downloaded to the new VLRVLR/MSC. The Mobile subscription data is downloaded to the new VLR

Mobile Terminated calls. Mobile Terminated calls. The HLR is used to determine the location of the subscriber. The The HLR is used to determine the location of the subscriber. The call is then routed to the MSC supporting the subscribers. This MSC then pages the MS using call is then routed to the MSC supporting the subscribers. This MSC then pages the MS using the BSS networkthe BSS network

Mobile Originated calls. Mobile Originated calls. The supporting MSC is used to route the calls into the fixed The supporting MSC is used to route the calls into the fixed network, after validating the user with the VLR datanetwork, after validating the user with the VLR data

Handover of the Mobile station to maintain the connection.Handover of the Mobile station to maintain the connection. When established in a call the When established in a call the Mobile Station reports signal strength measurements to the BSS. The BSS then determines Mobile Station reports signal strength measurements to the BSS. The BSS then determines when the mobile should be handed over to a new cell. The handover can be performed by the when the mobile should be handed over to a new cell. The handover can be performed by the BSS or MSCBSS or MSC


GSM Nodes : SummaryGSM Nodes : Summary Mobile StationMobile Station Base Station SubsystemBase Station Subsystem


Network SubsystemNetwork Subsystem Mobile Switching CenterMobile Switching Center Data BasesData Bases Security FunctionsSecurity Functions OMC-SOMC-S Non-voice FunctionsNon-voice Functions


2 GSM Introduction

Documents

Transcript of 2 GSM Introduction