Chapter 4 GSM

Mobile Communications
Chapter 4: Wireless
Telecommunication Systems
Market
GSM
Overview
Services
Sub-systems
Components
GPRS
DECT
Not a part if this course!
TETRA Not a part if this course!
w-cdma (rel 99), IMT2000
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/
MC SS02
4.1
It all started like this

The first car mounted radio telephone 1921
1946 First commercial mobile radio-telephone service by Bell and AT&T

in Saint Louis, USA. Half duplex
1973 First handheld cellular phone
Motorola.
1978 First cellular net in Bahrein
1979 NMT at 450MHz (Scandinavian countries)
1992 Start of GSM
MC SS02
4.2
Basic Definitions
Forward Link, Downlink, Downstream

The path from the network or base station to the mobile
GSM terminology uses Downlink
CDMA, AMPS and TDMA use Forward Link
Most wireline technologies use Downstream
Reverse Link, Uplink, Upstream

The path from the mobile to the network or base station
GSM terminology uses Uplink
CDMA, AMPS and TDMA use Reverse Link

Most wireline technologies use Upstream
MC SS02
4.3
Duplex Techniques
Frequency Division Duplex (FDD), Time Division Duplex (TDD)
time
Reverse Link
GSM
UMTS
FDD
Forward Link
Reverse Link
time
Forward Link
TDD
Reverse Link
Forward Link
Frequency channels
MC SS02
4.4
GSM
1982 The GSM group was formed

1986 Field trials in France
1987 TDMA was chosen as access method
1988 Memorandum of understanding -18 countries
1991 Phase I specifications published
1990 GSM specifications ported to DCS 1800
1992 Official commercial launch of GSM in Europe
1995 GSM specifications ported to PCS 1900
2000 Responsibility for GSM Standard transferred to 3GPP (3rd
Generation Partnership Project)
MC SS02
4.5
GSM frequency bands

900 MHz
2*25 MHz Bands

45 MHz Duplex Spacing
890-915 MHz Uplink
125 carriers
935-960 MHz Downlink
1800 MHz
2*75 MHz Bands
1710-1785 MHz Uplink
375 carriers
1900 MHz
2*60 MHz Bands

1850-1910 MHz Uplink

300 carriers
MC SS02
4.6
North America
SYSTEM ARCHITECTURE
GSM is a PLMN (Public Land Mobile Network)
AUC
PSTN
EIR
GMSC
HLR
ISDN
MSC
VLR
MSC
VLR
PLMN
BSC
BSC
OMC
BTS
BTS
MS
AUC:
OMC:
BTS:
BSC:
EIR:
GMSC:
HLR:
MS:
MSC:
VLR:
MC SS02
AUthentication Center
Operation and Managing Center
Base Tranciver Staition
Base Station Controller
Equipment Identity Register
Gateway MSC
Home Location Register
Mobile Station
Mobile Switching Center
Visiting Location Register
4.7
GSM: elements and interfaces

The Radio Station Subsystem (RSS) The Wireless Part
radio cell
MS
Base Transceiver Station (BTS),

cell coverage, comprises radio specific
functions
MS
Um
radio cell
MS
BTS
RSS
Base Station Controller (BSC)

controls several BTSs, the switching
center for radio channels
BTS
Abis
BSC
BSC
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
O
OSS
EIR
AUC
OMC
ISDN, PSTN
PDN
Functions
Management of radio channels
Frequency hopping (FH)
Management of terrestrial channels
Mapping of terrestrial onto radio channels
Channel coding and decoding
Rate adaptation
Encryption and decryption
Paging
Uplink signal measurements
Traffic measurement
Authentication
Location registry, location update
Handover management
MC SS02
4.8
BTS
X
X
X
X
X
X
BSC
X
X
X
X
X
X
X
X
X
X
radio cell
MS
BSS
MS
Um
radio cell
MS
BTS
RSS
BTS
Network Switching SubSystem
Abis
BSC
BSC
NSS is the main component of the public

mobile network GSM
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
ISDN, PSTN
switching, mobility management,

interconnection to other networks,
system control
PDN
O
OSS
EIR
AUC
OMC
MC SS02
4.9

The Network Switching Subsystem (NSS) radio cell
MS
BSS
MS
Um
The Mobile Switching Centre (MSC) manages a

large number of BSCs
radio cell
MS
BTS
RSS
Gateway Mobile Switching Centre (GMSC) is

the gateway to other networks
BTS
Various Registers (data bases)
Abis
BSC
BSC
Signalling messages and data base accesses

are transported by the Signalling System Nr. 7
(SS7) using the Mobile Application Part (MAP)
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
ISDN, PSTN
PDN
O
OSS
EIR
AUC
OMC
MC SS02
4.10

The MSC plays a central role in GSM
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC
can belong to a MSC
radio cell
MS
BSS
MS
Um
radio cell
MS
BTS
RSS
switching functions
additional functions for mobility support
management of network resources
interworking functions via Gateway MSC (GMSC)
integration of several databases
BTS
Abis
BSC
BSC
A
MSC
NSS
VLR
signaling
VLR
GMSC
HLR
IWF
O
OSS
EIR
AUC
Functions of a MSC
MSC
OMC
ISDN, PSTN
PDN
specific functions for paging and call forwarding

mobility specific signaling
location registration and forwarding of location information
support of short message service (SMS)
generation and forwarding of accounting and billing
information
MC SS02
4.11

Home Location Register (HLR)
Central master database containing user data,
permanent and semi-permanent data of all
subscribers assigned to the HLR
radio cell
MS
BSS
MS
Um
* usually one HLR per provider

* primarilly a data base for subscriber data.
* Subscriber identifiers service profiles, etc.
* Localization information (current VLR, MSC)
* Is a platform for all kinds of services
radio cell
MS
BTS
RSS
BTS
Abis
BSC
BSC
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
O
OSS
EIR
AUC
Visitor Location Register (VLR)

local database for a subset of user data, including
data about all user currently in the domain of the
VLR
ISDN, PSTN
PDN
* usually one VLR per MSC

* stores all relevant data of visiting MS
OMC
MC SS02
4.12
radio cell
MS
BSS
MS
Um
The OSS (Operation Subsystem) enables

centralized operation, management, and
maintenance of all GSM subsystems
radio cell
MS
BTS
RSS
Components
BTS
Authentication Center (AUC)
Abis
BSC
Equipment Identity Register (EIR)
BSC
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
Operation and Maintenance Center (OMC)

different control capabilities for the radio
subsystem and the network subsystem
ISDN, PSTN
PDN
O
OSS
EIR
AUC
OMC
MC SS02
4.13

Equipment Identification Register (EIR)
registers GSM mobile stations and user rights
stolen or malfunctioning mobile stations can be
locked and sometimes even localized
radio cell
MS
BSS
MS
Um
radio cell
stores serial numbers (IMEI) of MS equipment

(models, software versions, black list)
MS
BTS
RSS
BTS
Abis
BSC
BSC
A
MSC
NSS
MSC
VLR
signaling
VLR
GMSC
HLR
IWF
Authentication Centre (AUC)

generates user specific authentication parameters
on request of a VLR authentication parameters
used for authentication of mobile terminals and
encryption of user data on the air interface within
the GSM system
ISDN, PSTN
PDN
* stores cryptographic data (keys)
O
OSS
EIR
AUC
OMC
MC SS02
4.14
GSM: Mobile Services

GSM offers
several types of connections
voice connections, data connections, short message service
multi-service options (combination of basic services)
Three service domains
Bearer Services: to transfer data between access points

Telematic Services: mobile telephony, SMS, MMS
Supplementary Services: conferencing, suppression of number forwarding,
etc.
bearer services
MS
TE
MT
R, S
GSM-PLMN
Um
transit
network
(PSTN, ISDN)
source/
destination
network
TE
(U, S, R)
tele services
MC SS02
4.15
Bearer Services
Bearer services to transfer data between access points

Specification of services up to the terminal interface (OSI layers 1-3)
Different data rates for voice and data (original standard)
data service (circuit switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 1200 bit/s
data service (packet switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 9600 bit/s
Today: data rates of approx. 50 kbit/s possible will be covered later!
MC SS02
4.16
Tele Services I
Telecommunication services that enable voice communication

via mobile phones
All these basic services have to obey cellular functions, security
measurements etc.
Offered services
mobile telephony
primary goal of GSM was to enable mobile telephony offering the
traditional bandwidth of 3.1 kHz
Emergency number
common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the highest
priority (preemption of other connections possible)
Multinumbering
several ISDN phone numbers per user possible
MC SS02
4.17
Tele Services II
Additional services
Non-Voice-Teleservices
group 3 fax
voice mailbox (implemented in the fixed network supporting the mobile
terminals)
electronic mail (MHS, Message Handling System, implemented in the fixed
network)
...
Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the
signaling channel, thus allowing simultaneous use of basic services and
SMS
MC SS02
4.18
Supplementary services
Services in addition to the basic services, cannot be offered

stand-alone
Similar to ISDN services besides lower bandwidth due to the
radio link
May differ between different service providers, countries and
protocol versions
Important services
identification: forwarding of caller number

suppression of number forwarding
automatic call-back
conferencing with up to 7 participants
locking of the mobile terminal (incoming or outgoing calls)
...
MC SS02
4.19
GSM Mobile Communications

The GSM 900 MHz Frequency Band
*)
25 MHz
P-GSM
10
E-GSM
R-GSM
860
870
25 MHz
10
4
880
4
890
900
910
920
930
Uplink
*) several other Systems:
940
950
Downlink
Duplex Distance 45 MHz
- Cordless Telephone CT1, CT1+, CT2

- Telemetry / Telecommand
- Terrestrial Trunked Radio (TETRA)
- Digital Satellite System Receiver (DSSR)
MC SS02
4.20
960
970

The GSM 1800, DECT and UMTS Bands
1: Time Division Duplex (TDD)
2: Frequency Division Duplex (FDD)
3: Mobile Satellite System (MSS)
DECT
3 1
UMTS
GSM 1800
75 MHz
1700
1750
Uplink
75 MHz
1800
1850
1900
1950
200
2050
2100
2150
Downlink
Duplex Distance
95 MHz
MC SS02
4.21
2200
2250

Spatial Frequency Re-use in Cell Clusters
5
6
4
1
5
12
5
7
6
4
3
K=7
6
4
2
1
11
1
8
7
10
3
9
7
5
3
5
2
5
2
6
4
5
6
4
6
4
1
12
6
4
1
12
1
7
3
1
7
3
7
3
2
11
7
2
3
11
2
8
10
2
8
10
9
9
5
R cell radius
6
4
1
1
1
12
K cluster size
3
3
7
3
2
2
D repeating
2
11
D
1
1
distance
8
10
3
3
K = 12
9
K=3 2
D R 3K
2
R
MC SS02
4.22
GSM: cellular network

segmentation of the area into cells
possible radio coverage of the cell
cell
idealized shape of the cell
use of several carrier frequencies

not the same frequency in adjacent cells
cell sizes vary from some 100 m up to 35 km depending on user
density, geography, transceiver power etc.
hexagonal shape of cells is idealized (cells overlap, shapes depend on
geography)
if a mobile user changes cells
handover of the connection to the neighbor cell
MC SS02
4.23
MACRO, MICRO AND PICO CELLS
By using small macro

cells in combination with
Tighter Frequency Reuse
and a micro cellular
overlay, the capacity of a
standard 4/12 reuse
cellular network with 7.5
MHz available spectrum
can be increased eightfold. The micro cellular
network operates in a
segmented frequency and
from the nearby macro
cells and provides the
additional benefit of
coverage redundancy.
MC SS02
4.24

Combined FDMA / TDMA Scheme
f
fU
Guard Band
fN
...
...
fk
f2
...
...
...
...
Frame
Frequency
Band
Time Slots
...
B = 200 kHz
f1
Radio
Frequency
Channels
...
Guard Band
T 577 s
fL
0
...
t
MC SS02
4.25
TDMA: FRAME
4.613 ms
156.25 bit/s
0.579 ms
A slot lasts for a duration of 156.25 bit times

The slot lasts 15/26 ms=579.9 micro s
so a frame takes 4.613 ms
MC SS02
4.26
GSM Radio Interface Um

Bursts
Tail Bits:
Power p(t)
Set to zero
Can be used to
Enhance the receiver
t performance
useful part
f2
f1
0 1 2 ... 7 0 1 ...
0 1 2 ... 7 0 1 ...
3 Tail Bits
156.25 Bits in 576.923 s

(3.6923 s/Bit)
26 Training Bits
3 Tail Bits
2 x 58 Encrypted Bits
MC SS02
8.25 Bits Guard Period

4.27

Types of Burst
Structure of Normal Burst
2 x 3 Tail Bits (TB)

2 x 58 Encrypted Bits (Payload for Traffic and Control Channels)
2 x 1 Stealing Flag (Switch between Traffic / Control Payload)

2 x 57 Payload Bits
26 Bits Training Sequence (Midamble)
Fixed bit sequence used for channel estimation allowing optimum channel
equalization
Five Different Types of Burst
Normal Burst - Traffic and Control Payload

Frequency Correction Burst - All Zeroes Sequence
Synchronization Burst - Special Fixed Sequence
Access Burst - Extended Guard Period of 68.25 Bits (252 s)
Dummy Burst
MC SS02
4.28

Adaptive Frame Alignment
BTS
0 1 2 3 4 5 6 7 TX
MS
t = s / c
0 1 2 3 4 5 6 7 RX
0 1 2 3 4 5 6 7 TX
0 1 2 3 4 5 6 7 RX
0
TA = 2t
Thanks to the time shift of 3 time slots between the BTS TX and RX
TDMA frames, the MS is not required to receive and transmit
simultaneously. This simplifies the MS hardware.
The MS continuously aligns its TX frame start based on the Timing
Advance (TA) measurements received from the BTS
The extended guard period of the access burst (252 s) allows a
maximum range between MS and BTS of 35 km.
MC SS02
4.29

Logical Channels
Control
Channels
(CCH)
Broadcast
Channels
Common
Control
Channels
Traffic
Channels
(TCH)
Dedicated
Control
Channels
Full Rate
(TCH/F)
Half Rate
(TCH/H)
Slow Associated Control Channel (SACCH)

Fast Associated Control Channel (FACCH)
Stand Alone Dedicated Control Channel (SDCCH)
Random Access Channel (RACH)
Access Grant Channel (AGCH)
Paging Channel (PCH)
Notification Channel (PCH)
Downlink (DL)
Synchronization Channel (SCH)
Frequency Control Channel (FCCH)
Broadcast Control Channel (BCCH)
Uplink (UL)
MC SS02
4.30

Broadcast Channels
Broadcast Channels are used for
synchronisation purposes and
broadcasting of cell-specific
information in the downlink from
BTS to MS
Control
Channels
(CCH)
Broadcast
Channels
Common
Control
Channels
Frequency Correction Channel (FCCH)

carries information for frequency correction of the MS
Synchronization Channel (SCH)
carries information for frame synchronization of the MS (e.g.
TDMA frame number FN) and for identification of the BTS (e.g
Base Station Identity Code BSIC)
Broadcast Control Channel (BCCH)
broadcasts general information on the BTS as well as cellspecific information like control channel organisation, frequency
hopping sequences, cell identification, etc.
MC SS02
4.31
Dedicated
Control
Channels

Common Control Channels
Common Control Channels
are point-to-multipoint
channels used mainly for
access control
Control
Channels
(CCH)
Broadcast
Channels
Common
Control
Channels
Paging Channel (PCH) - downlink only

used by the BTS for paging and localizing the MS
Random Access Channel (RACH) - uplink only
used by any MS to request allocation of a signalling channel
(SDCCH). A slotted Aloha protocol is used, so collisions among
concurring MS are quite possible.
Access Grant Channel (AGCH) - downlink only
used to allocate a SDCCH or directly a TCH
Notification Channel (NCH) - downlink only
used to notify MS of voice group and voice broadcast calls (ASCI
feature)
MC SS02
4.32
Dedicated
Control
Channels

Dedicated Control Channels
Dedicated Control Channels are
bidirectional point-to-point
channels, that allow authentication,
signalling, handover and the
exchange of measurement values.
Control
Channels
(CCH)
Broadcast
Channels
Common
Control
Channels
Stand Alone Dedicated Control Channel (SDCCH)

used for call setup (authentication, signalling, assignment
of actual TCH), localisation updates and SMS
Slow Associated Control Channel (SACCH)
is always coupled with a SDCCH or TCH and is used for the
exchange of measurement values and control parameters
Downlink : Control of MS Power Level and MS Timing Advance

Uplink
: Measurement reports (MS reception levels) used
by the BTS for its handover-decisions
Fast Associated Control Channel (FACCH)

is activated in case of increased signalling demand e.g. during
handover. Bandwidth is stolen from associated TCH
MC SS02
4.33
Dedicated
Control
Channels

Traffic Channels (TCH)
Traffic
Channels
(TCH)
Traffic Channels are used for

bidirectional transmission of
circuit switched voice or data.
Full Rate Traffic Channel
Speech @ 13 kbps
Speech @ 12.2 kbps
Data @ 14.4 kbps
Data @ 9.6 kbps
Data @ 4.8 kbps
Data @ 2.4 kbps
Half Rate Traffic Channel
Speech @ 6.5 kbps

Data @ 4.8 kbps
Data @ 2.4 kbps
Full Rate
(TCH/F)
Half Rate
(TCH/H)
(TCH / F)
Speech Codec
(TCH / FS)
(TCH / EFS)
(TCH / F14.4)
(TCH / F9.6)
(TCH / F4.8)
(TCH / F2.4)
Full Rate
Enhanced Full Rate
(TCH / H)
Speech Codec
(TCH / HS)
(TCH / H4.8)
(TCH / H2.4)
MC SS02
Half Rate
4.34

Call Setup (MS terminating)
MS
Paging Request
Channel Request
Channel Assignment
PCH
RACH
Paging Channel
RACH Random Access Ch.
Authentication / Cipher Mode

Call Confirmation
PCH
AGCH
Paging Response
Setup
BTS
AGCH Access Grant Ch.

SDCCH
SDCCH Stand-alone
Dedicated Control
Channel
Assign Command
Assign Completion
Alert
Connect
FACCH
Connect Acknowledge
Voice or Data
PCH
FACCH Fast Associated

Control Channel
TCH
MC SS02
Traffic Channel
4.35

Enhanced Full Rate Voice Channel Coding
160 Samples
RPE-LPC
Codec
260 bits
267 bits
every
20 ms
78
182
Block
Coding
78
sensitive (class I)
insensitive (class II)
3 bit CRC
4 tail bits
182
Convolutional
Coding
456 bits
4 blocks
@ 114 Bits
456 bits spread
over 8 bursts
78
189
189
Interleaving
1
Encryption
MC SS02
4.36
GSM - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink
890-915 MHz
124 channels (200 kHz)
uplink
higher GSM frame structures

time
GSM TDMA frame

1
8
4.615 ms
GSM time-slot (normal burst)

guard
space
tail
3 bits
user data
S Training S
user data
57 bits
1 26 bits 1
57 bits
guard
tail space
MC SS02
546.5 s
577 s
4.37
GSM hierarchy of frames
12 frames
hyperframe
0
...
one frame for

slow signalling
for all the 8 slots
SACCH
2045 2046 2047
superframe
0
...
48
...
49
24
12 frames
50
1 empty frame
25
multiframe
0
...
0
24
2
120 ms
25
...
48
49
50
235.4 ms
frame
0
...
4.615 ms
slot
577 s
burst
MC SS02
4.38
GSM hierarchy of frames

hyperframe
0
2045 2046 2047 3 h 28 min 53.76 s
...
Larger frames
for encryption
superframe
0
...
48
...
49
24
50
6.12 s
25
multiframe
0
...
0
24
2
120 ms
25
...
48
49
50
235.4 ms
frame
0
...
4.615 ms
slot
577 s
burst
MC SS02
4.39
GSM protocol layers for signaling
Um
Abis
MS
BTS
BSC
MSC
CM
CM
MM
MM
RR
RR
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
BSSAP
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2.048 Mbit/s
CM: Call management, MM: Mobility management, RR: Radio Resource management
MC SS02
4.40
Protocol Architecture of GSM

with signalling protocol intefaces
Interfaces:
Um
Abis
Um is here of main interests

Abis
are intefaces from the fixed network

Um
MS
Layer 3
Abis
BTS
BSC
MSC
CM
CM
MM
MM
BSSAP
RR
RR
Layer 2
Layer 1
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2.048 Mbit/s
Layer 1 (physical) : radio

Handles all radio specific functions
creation of bursts 5 different formats

multiplexing of bursts into TDMA frames
synchronisation with the BTS (see next slide)
detection of idle channels
measurements of channel quality at downlink
Um
MS
Abis
BTS
CM
the physical layer at Um uses GMSK modulation
MM
performs enchryption/decryption of data

RR
RR
BTSM
LAPDm
LAPDm
LAPD
radio
radio
PCM
Layer 1: Synchronization:
The distance between the MS and the BTS
An MS 35 km from the BTS has a round trip time (RTT) of 0.23 ms!!!
The BTS sends the current RTT to the MS, which then adjusts its access time!!!
Adjusting the access is controlled by the variable timing advance, where a burst
can be shifted up to 63 bit times ealier => 0.23 ms. (each bit is 3.69 micro
seconds long).
Max 35 km between a BTS and a MS!!
BTS
0 1 2 3 4 5 6 7
TX
t = s / c
0 1 2 3 4 5 6 7
0
MS
0 1 2 3 4 5 6 7
RX
RX
0 1 2 3 4 5 6 7
0
TA = 2t
TX
Layer 1 (physical) : radio

Handles all radio specific functions
Channel coding and error detection/correction!

78
78
182
182
sensitive (class I)
insensitive (class II)
3 bit CRC
4 tail bits
Um
MS
78
189
189
BTS
CM
MM
The physical layer tries to correct errors, but it does

not deliver erroneous data to the higher layers.
The error correction introduses a delay of about 60 ms!
RR
RR
BTSM
LAPDm
LAPDm
LAPD
radio
radio
PCM
Layer 2 (data link) - LAPDm

It is said to be a lightweight LAPD protocol as it does not
handle error correction/detection.
It handles:
segmentation and reassembly of data and
acknowledges/unacknowledged data transfer
re-sequencing of data frames and flow control!
MS
Um
BTS
CM
Layer 3
MM
RR
RR
Layer 2
Layer 1
BTSM
LAPDm
LAPDm
LAPD
radio
radio
PCM
The network layer in GSM comprises several sublayers!
The lowest sublayer is the Radio Resource Management (RR)!

Just a part of it is implemented in the BTS, the remainder in the BSC!
Setup,
maintenence and
release
of radio channels
Um
MS
Abis
BTS
A
BSC
MSC
CM
CM
MM
MM
BSSAP
RR
RR
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2.048 Mbit/s

registration
authentification
location update
Mobility Management (MM) contains functions for

It also provides a temporary mobile subscriber identity (TMSI)
that replaces the international mobile subscriber identity (IMSI)
which hides the real identity of an MS user over the air interface.
Um
MS
Abis
BTS
A
BSC
MSC
CM
CM
MM
MM
BSSAP
RR
RR
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2.048 Mbit/s

Call Management (CM) contains functions for:
call control (CC): point-to point connection between two terminals
call establishment, call clearing, etc.
short message service (SMS): using control channels SDCCH and SACCH
supplementary services (SS): user identification, forwarding, etc.
Um
MS
Abis
BTS
A
BSC
MSC
CM
CM
MM
MM
BSSAP
RR
RR
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2.048 Mbit/s

Numbers and Identifiers I
International Mobile Equipment Identifier (IMEI)
Unique serial number assigned by equipment manufacturer
International Mobile Subscriber Identifier (IMSI)
Unique subscriber identification number, stored on SIM-card
Mobile Subscriber ISDN Number (MSISDN)
Actual phone number structured according to ITU-T E.164
Country Code (CC) up to 3 digits

National Destination Code (NDC) 2 to 3 digits
Subscriber Number (SN) with a maximum of 10 digits
Strict separation of subscriber identification (IMSI)

and phone number (MSISDN)
Several MSISDN numbers can be assigned to a single IMSI
(used for service selection)
The mapping between MSISDN and IMSI is not public
MC SS02
4.49
HSCSD: High Speed Circuit Switched Data

Chapter: 4.1.8.1
Read yourselves!
Mobile Terminated Call

1: calling a GSM subscriber
2: forwarding call to GMSC
3: signal call setup to HLR
4, 5: request MSRN (Mobile Station
Roaming Number) from VLR
6: forward responsible
calling
MSC to GMSC
station 1
7: forward call to
current MSC
8, 9: get current status of MS
10, 11: paging of MS
12, 13: MS answers
14, 15: security checks
16, 17: set up connection
HLR
3 6
PSTN
GMSC
10
VLR
8 9
14 15
MSC
10 13
16
BSS
BSS
BSS
11
11
11
11 12
17
MS
MC SS02
10
4.51
Mobile Originated Call

1, 2: connection request
3, 4: security check
5-8: check resources (free circuit)
9-10: set up call
VLR
3 4
6
PSTN
5
GMSC
MSC
8
2 9
MS
MC SS02
1
10
4.52
BSS
4 types of handover
MS
BTS
MS
MS
MS
BTS
BTS
BTS
BSC
BSC
BSC
MSC
MSC
MC SS02
4.53
Handover decision
receive level
BTSold
receive level
BTSold
HO_MARGIN
MS
MS
BTSold
BTSnew
MC SS02
4.54
Handover procedure
MS
BTSold
BSCold
measurement
measurement
report
result
MSC
HO decision
HO required
BSCnew
BTSnew
HO request
resource allocation
ch. activation
HO command
HO command
HO command
HO request ack ch. activation ack
HO access
Link establishment
clear command clear command
clear complete
HO complete
HO complete
clear complete
MC SS02
4.55
Security in GSM
Security services
access control/authentication
user SIM (Subscriber Identity Module): secret PIN (personal
identification number)
SIM network: challenge response method
confidentiality
voice and signaling encrypted on the wireless link (after successful

authentication)
anonymity
temporary identity TMSI

(Temporary Mobile Subscriber Identity)
newly assigned at each new location update (LUP)
encrypted transmission
3 algorithms specified in GSM
secret:
A3 and A8
available via the
Internet
network providers
can use stronger
mechanisms
A3 for authentication (secret, open interface)

A5 for encryption (standardized)
A8 for key generation (secret, open interface)
MC SS02
4.56
GSM - authentication
SIM
mobile network
Ki
RAND
128 bit
AC
RAND
128 bit
RAND
Ki
128 bit
128 bit
A3
A3
SIM
SRES* 32 bit
MSC
SRES* =? SRES
SRES
SRES
32 bit
Ki: individual subscriber authentication key
32 bit
SRES
SRES: signed response
MC SS02
4.57
GSM - key generation and encryption
MS with SIM
mobile network (BTS)

Ki
AC
RAND
128 bit
RAND
128 bit
RAND
128 bit
A8
cipher
key
BSS
Ki
128 bit
SIM
A8
Kc
64 bit
Kc
64 bit
data
SRES
data
encrypted
data
MS
A5
A5
MC SS02
4.58
End
MC SS02
4.59

Chapter 4 GSM

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Chapter 4 GSM

Загружено:

Авторское право:

Доступные форматы

Mobile Communications

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

It all started like this

1946 First commercial mobile radio-telephone service by Bell and AT&T

Forward Link, Downlink, Downstream

Reverse Link, Uplink, Upstream

CDMA, AMPS and TDMA use Reverse Link

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

1982 The GSM group was formed

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM frequency bands

2*25 MHz Bands

890-915 MHz Uplink

935-960 MHz Downlink

2*75 MHz Bands

1710-1785 MHz Uplink

95 MHz Duplex Spacing

1805-1880 MHz Downlink

2*60 MHz Bands

1850-1910 MHz Uplink

GSM: elements and interfaces

Base Transceiver Station (BTS),

Base Station Controller (BSC)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

Network Switching SubSystem

NSS is the main component of the public

switching, mobility management,

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

The Mobile Switching Centre (MSC) manages a

Gateway Mobile Switching Centre (GMSC) is

Various Registers (data bases)

Signalling messages and data base accesses

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

specific functions for paging and call forwarding

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

* usually one HLR per provider

Visitor Location Register (VLR)

* usually one VLR per MSC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

The OSS (Operation Subsystem) enables

Authentication Center (AUC)

Equipment Identity Register (EIR)

Operation and Maintenance Center (OMC)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: elements and interfaces

stores serial numbers (IMEI) of MS equipment

Authentication Centre (AUC)

* stores cryptographic data (keys)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

GSM: Mobile Services

several types of connections

voice connections, data connections, short message service

multi-service options (combination of basic services)

Three service domains

Bearer Services: to transfer data between access points

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

Bearer services to transfer data between access points