1

Cellular Communications

• First telephone (photophone) – Alexander Bell, 1880

• The first car mounted radio

telephone – 1921

Old days

• 1946 – First commercial mobile radio-telephone service by Bell and AT&T in Saint Louis, USA. Half duplex (PTT)

• 1973 – First handheld cellular phone – Motorola.

• First cellular net Bahrein 1978

Going further

But what’s cellular?

HLR, VLR, AC, EIR

MSC

PSTN

BS

• Frequency reuse – same frequency in

many cell sites

• Cellular expansion – easy to add new cells

• Handover – moving between cells

• Roaming between networks

Cellular principles

6

possible radio coverage of the cell

idealized shape of the cellcell

segmentation of the area into cells

Cell of Cellular network

• Use of several carrier frequencies• Not the same frequency in adjoining cells• Cell sizes vary from some 100 m up to 35 km depending on user

density, geography, transceiver power etc.• Hexagonal shape of cells is idealized (cells overlap, shapes

depend on geography)• If a mobile user changes cells, handover of the connection to the

neighbor cell

Evolution of Mobile Network

Fourth Generation

Third Generation

Second Generation (Digital)

First Generation (Analog)

Future Network

• 1G: Analog [routines for sending voice]

• All systems are incompatible

• No international roaming

• Little capacity – cannot accommodate masses of subscribers

First Generation (1G)

• 2G – digital [voice encoding]

• Increased capacity

• More security

• Compatibility

• Can use TDMA or CDMA for increasing capacity

Second Generation (2G)

• Time Division Multiple Access• Each channel is divided into timeslots, each

conversation uses one timeslot.• Many conversations are multiplexed into a

single channel. • Used in GSM

TDMA

• Code Division Multiple Access• All users share the same frequency all the

time!• To pick out the signal of specific user, this

signal is modulated with a unique code sequence.

CDMA

• 2.5 G – packet-switching• Connection to the internet is paid by packets

and not by connection time.• Connection to internet is cheaper and faster

[up to 56KBps]• The service name is GPRS – General Packet

Radio Services• Enhanced Data rates for GSM Evolution

(EDGE): 2.75G

2.5 G

• Permanent web connection at 2Mbps • Internet, phone and media: 3 in 1• The standard based on GSM is called UMTS.• The EDGE standard is the development of

GSM towards 3G.

Third Generation (3G)

• High Speed Packet Access (HSPA) extends and improves the performance of existing 3G

• Most common deployment– HSPA: upgrades to the original W-CDMA standard

and offers speeds of 14.4 Mbit/s (down) and 5.76 MBit/s up.

– HSPA+: further upgrade of HSPA, can provide theoretical peak data rates up to 168 Mbit/s (downlink) and 22 Mbit/s (uplink)

Use of Wideband CDMA: 3G

• 4G system provides mobile ultra-broadband Internet access

• Through USB wireless modems, to laptops or smartphones, etc.

• 4G applications include amended mobile web access, IP telephony, gaming services, HD mobile TV, video conferencing

• Two 4G systems are commercially deployed: • Mobile WiMAX • Long Term Evolution (LTE)

Fourth Generation (4G)

GSM

16

GSM Overview• GSM stand for Global System for Mobile Communication

• The GSM makes use of narrowband Time Division Multiple Access(TDMA) technique for transmitting signals.

• Ability to carry 64 kbps to 120 kbps of data rates.

• Presently GSM supports more than one billion mobile subscribers in more than 210 countries throughout the world.

• The GSM provides basic to advanced voice and data services including Roaming service. 

17

Why GSM?

• Improved spectrum efficiency.

• International roaming.

• Low-cost mobile sets and base stations.

• High-quality speech.

• Compatibility with Integrated Services Digital Network (ISDN) and other telephone company services.

• Support for new services.

19

Architecture of the GSM system• GSM is a PLMN (Public Land Mobile Network)

– several providers setup mobile networks following the GSM standard within each country

• GSM subsystems• RSS (radio subsystem): covers all radio aspects• NSS (network and switching subsystem): call forwarding,

handover, switching• OSS (operation subsystem): management of the network

Interfaces in GSM Network

The interfaces defined sub-systems include:

’A’ interface between NSS and BSS

‘Abis’ interface between BSC and BTS (within the BSS)

‘Um’ air interface between the BSS and the MS

TRX – Transceiver AuC – Authentication Center

MS – Mobile Station EIR – Equipment Identity Register

OMC – Operations and Maintenance Center

PSTN – Public Switched Telephone Network

BSS – Base Station Sub-system

BSC – Base Station Controller

HLR – Home Location Register BTS – Base Transceiver Station

MSC – Mobile Switching Center VLR – Visitor Location Register

GSM Network Component Terminology

23

Ingredients 1: Mobile Phones, PDAs...

The visible but smallest part of the network!

Consists of

Mobile Equipment (ME) Subscriber Identity Module (SIM)

24

Ingredients 2: Antennas

Still visible – cause many discussions…

25

Ingredients 3: Infrastructure 1Base Stations

Cabling

Microwave links

Base Station Subsystem (BSS)Consist of

Base Transceiver Station (BTS):

- Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna.

- Communicates with Mobile station and BSC- Consists of Transceivers (TRX) units

Base Station Controller (BSC):

- Manages Radio resources for BTS

- Assigns Frequency and time slots for all MS’s in its area

- Handles call set up

- Handover for each MS

- It communicates with MSC and BTS

27

Ingredients 3: Infrastructure 2

Switching units

Data bases

Management

Monitoring

Not visible, but comprise the major part of the network (also from an investment point of view…)

Network Switching Subsystem(NSS)

Consist Of

- Mobile Switching Center (MSC):

Heart of the network which manages communication between GSM and other networks

- Home Location Register (HLR):

Stores information about each subscriber and update the information in HLR as soon as the subscriber leaves its current local area.

- Visitor Location Register (VLR):

Controls mobiles roaming by updating VLR Database.

- Authentication Center (AUC)

Contains the algorithms for authentication and prevent fraud operation.

- Equipment Identity Register (EIR) Stores all devices identifications registered for this network

Call from Mobile Phone to PSTN

• The MSC/VLR receives the message of a call request.

• The MSC/VLR checks if the mobile station is authorized to access the network. If so, the mobile station is activated. If the mobile station is not authorized, service will be denied.

• MSC/VLR analyzes the number and initiates a call setup with the PSTN.

• MSC/VLR asks the corresponding BSC to allocate a traffic channel (a radio channel and a time slot).

• The BSC allocates the traffic channel and passes the information to the mobile station.

• The called party answers the call and the conversation takes place.

• The mobile station keeps on taking measurements of the radio channels in the present cell and neighboring cells and passes the information to the BSC. The BSC decides if handover is required, if so, a new traffic channel is allocated to the mobile station and the handover is performed. If handover is not required, the mobile station continues to transmit in the same frequency.

30

GSM Architecture

fixed network

BSC

BSC

MSC MSC

GMSC

OMC, EIR, AUC

VLR

HLR

NSSwith OSS

RSS

VLR

Call from PSTN to Mobile Phone

• The Gateway MSC receives the call and queries the HLR for the information needed to route the call to the serving MSC/VLR.

• The GMSC routes the call to the MSC/VLR.

• The MSC checks the VLR for the location area of the MS.

• The MSC contacts the MS via the BSC through a broadcast message, that is, through a paging request.

• The MS responds to the page request.

• The BSC allocates a traffic channel and sends a message to the MS to tune to the channel. The MS generates a ringing signal and, after the subscriber answers, the speech connection is established.

• Handover, if required, takes place, as discussed in the earlier case.

• GSM comes in three flavors(frequency bands): 900, 1800, 1900 MHz.

• Voice is digitized using Full-Rate coding.

• 20 ms sample => 260 bits . 13 Kbps bitrate

GSM frequency bands

33

GSM frequency bands (examples)Type Channels Uplink [MHz] Downlink [MHz]

GSM 850 128-251 824-849 869-894

GSM 900classical

Extended

0-124, 955-1023124 channels

+49 channels

876-915890-915

880-915

921-960935-960

925-960

GSM 1800 512-885 1710-1785 1805-1880

GSM 1900 512-810 1850-1910 1930-1990

GSM-Rexclusive

955-1024, 0-12469 channels

876-915876-880

921-960921-925

- Additionally: GSM 400 (also named GSM 450 or GSM 480 at 450-458/460-468 or 479-486/489-496 MHz)- Please note: frequency ranges may vary depending on the country!- Channels at the lower/upper edge of a frequency band are typically not used

34

1 2 3 4 5 6 7 8

higher GSM frame structures

935-960 MHz124 channels (200 kHz)downlink

890-915 MHz124 channels (200 kHz)uplink

frequ

ency

time

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3

GSM - TDMA/FDMA

• GSM uses TDMA and FDMA to let everybody talk.

• FDMA: 25MHz freq. is divided into 124 carrier frequencies. Each base station gets few of those.

• TDMA: Each carrier frequency is divided into bursts [0.577 ms]. 8 bursts are a frame.

Sharing

• The physical channel in GSM is the timeslot.

• The logical channel is the information which goes through the physical channel

• Both user data and signaling are logical channels.

Channels

• User data is carried on the traffic channel (TCH) , which is defined as 26 TDMA frames.

• There are lots of control channels for signaling, base station to mobile, mobile to base station (“aloha” to request network access)

Traffic Channel

• Signaling protocol for networks

• Packet switching [like IP]• For communication between HLR and VLR

(allowing roaming) and other advanced capabilities.

• GSM’s protocol which sits on top of SS7 is MAP – mobile application part

SS7

39

To locate an MS and to address it, several numbers are needed:•Mobile station international ISDN number (MSISDN)•International mobile subscriber identity (IMSI)•Temporary mobile subscriber identity (TMSI)•Mobile station roaming number (MSRN)

Localizing and Calling

40

• Mobile Subscriber Integrated Services Digital Network-Number

• MSISDN is a number uniquely identifying a subscription in a GSM or a UMTS mobile network.

• It is the telephone number to the SIM card in a mobile/cellular phone.

• For a GSM user, Phone number is not associated with a certain device but with the SIM, which is personalized for a user

• MSISDN number (e.g., +49 179 1234567) consists of• country code (CC): 49 for Germany • national destination code (NDC): network provider 179• subscriber number (SN): 1234567

Mobile station international ISDN number

41

GSM uses the IMSI for internal unique identification of a subscriber. IMSI consists of a •Mobile country Code (MCC) (e.g., 240 for Sweden)•Mobile Network Code (MNC) •Mobile Subscriber Identification Number (MSIN).

International Mobile Subscriber Identity (IMSI)

42

43

To hide IMSI (which gives away the exact identity), GSM uses 4-byte TMSI for local subscriber identification.•TMSI is selected by the current VLR and is only valid temporarily and within the location area of the VLR•TMSI and LAI are sufficient to identify a user for an ongoing communication; the IMSI is not needed). •A VLR may change the TMSI periodically.

Temporary Mobile Subscriber Identity (TMSI)

44

Another temporary address that hides the identity and location of a subscriber is MSRN. •The VLR generates this address on request from the MSC, and the address is also stored in the HLR. •MSRN contains the current visitor country code (VCC), the visitor national destination code (VNDC), the identification of the current MSC together with the subscriber number. •The MSRN helps the HLR to find a subscriber for an incoming call.

Mobile Station Roaming Number (MSRN)

45

Mobile Terminated Call

PSTNcallingstation

GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

• 1: calling a GSM subscriber• 2: forwarding call to GMSC• 3: signal call setup to HLR• 4, 5: request MSRN from VLR• 6: forward responsible

MSC to GMSC

• 7: forward call to current MSC• 8, 9: get current status of MS• 10, 11: paging of MS• 12, 13: MS answers• 14, 15: security checks• 16, 17: set up connection

46

Mobile Originated Call• 1, 2: connection

request• 3, 4: security check• 5-8: check resources

(free circuit)• 9-10: set up call

PSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

47

4 types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4

1. Intra-cell

2. Inter-cell, intra-BSC

3. Inter-BSC, Intra-MSC

4. Inter-MSC

48

Handover decision

receive levelBTSold

receive levelBTSnew

MS MS

HO_MARGIN

BTSold BTSnew

49

Handover procedure

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decision

HO required

BTSnew

HO request

resource allocation

ch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete

50

Security in GSM• Security services

– access control/authentication• user - SIM (Subscriber Identity Module): secret PIN (personal identification

number)

• SIM-network: challenge response method

– confidentiality• voice and signaling encrypted on the wireless link (after successful

authentication)

– anonymity• temporary identity TMSI

• newly assigned at each new location update (LUP)

• encrypted transmission

• Three algorithms specified in GSM– A3 for authentication (“secret”, open interface)– A5 for encryption (standardized)– A8 for key generation (“secret”, open interface)

“secret”:• A3 and A8 available via the Internet• network providers can use stronger mechanisms

51

GSM - authentication

A3

RANDKi

128 bit 128 bit

SRES* 32 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

SRES32 bit

mobile network SIM

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response

52

GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc

64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS) MS with SIM

AC

BSS

SIM

A5

Kc

64 bit

A5

MSdata data

cipherkey

GSM Network Architecture For 2.5G

SGSN: Service GPRS Support NodeGGSN: Gateway GPRS Support Node

54

GPSR: Data services in GSM• GPRS (General Packet Radio Service)

– packet switching– using free slots only if data packets ready to send

(e.g., 50 kbit/s using 4 slots temporarily)– standardization 1998, introduction 2001– advantage: one step towards UMTS, more flexible– disadvantage: more investment was needed (new hardware)

• GPRS network elements– GSN (GPRS Support Nodes): GGSN and SGSN– GGSN (Gateway GSN)

• interworking unit between GPRS and PDN (Packet Data Network)

– SGSN (Serving GSN)• supports the MS (location, billing, security)

– GR (GPRS Register)• user addresses

Enhanced Data rates in GSM Environment (EDGE)

• EDGE is enhancement of GPRS• Improved data transmission rate as a backward

compatible extension to GSM• Also considered as pre-3G technology• EDGE delivers higher bit-rate per radio channel resulting

increased capacity and performance than GPRS• Pick bit-rates up to 1Mbps• Typical bit-rates 400 kbps• Use high-order PSK or 8-phase shift keying

3G

Third Generation Mobile Communications

Technology (IMT-2000)

IMT-2000 standard developed by Third-Generation

Partnership Project (3GPP).

In Europe, 3G is called UMTS (Universal Mobile

Telecommunications System)

56

Why 3G? In EDGE, Packet transfer air interface behaves like a

circuit switch call. Thus, Packet connection efficiency was lost.

Same Network Standard for world wide.

Need a Faster Mobile Technology

3G increased bandwidth, up to 384 Kbps when a device is moving, 128 Kbps in a car & 2 Mbps in fixed applications

57

History of 3G• Oct 2001: NTT DoCoMo in Japan branded FOMA, based on W-

CDMA

• January 2002, SK Telecom in South Korea on the CDMA2000 1xEV-DO based on CDMA

• March 2003, Europe(UK & Italy) 3 (Part of Hutchison Whampoa) based on W-CDMA

• In USA, 1st 3G network was by Monet Mobile Networks & 2nd was Oct 2003 Verizon Wireless both on CDMA2000 1x EV-DO

• In South Asia, August 2006, Dialog in Sri Lanka based on W-CDMA

• In Oct 2012, Teletalk in Bangladesh based on W-CDMA

58

3G Features

• Wireless voice call and SMS

• Video calls

• Video-conferencing

• Enhanced audio and video streaming

• Location-based services (GPS)

• Mobile TV

• HSPA(High Speed Packet Access)data transmission

• 14.4 Mbps on the downlink

• 5.8 Mbps on the uplink

59

Technologies of 3G

• W-CDMA :Wideband Code Division Multiple Access.

• CDMA 2000: Code Division Multiple Access.

• TD-SCDMA: Time-division Synchronous CDMA

• 3.5G/3.5G+ is enhancement to 3G.

• High-Speed Downlink Packet Access (HSDPA)

•  High-Speed Packet Access(HSPA)

• Evolved High-Speed Packet Access (HSPA+)

60

W-CDMA Network Architecture

Radio Network

Controller

RAN(Radio Access

Network)

CN(Core Network)

RNC

Node B

Node B

Packet switch domain

Circuit switch domain

SGSN GGSN

MSC GMSC

IMS IP Network

Circuit Switched Network

Mobile Station

Mobile Station

MSC: Mobile Switching CenterGMSC: Gateway Mobile Switching Center

SGSN: Service GPRS Support NodeGGSN: Gateway GPRS Support Node

IMS: IP Multimedia Subsystem

W-CDMA Network ArchitectureThere are 2 major parts to a W-CDMA mobile network:Radio Access Network (RAN): This is a hierarchical arrangement of cell towers and base stations.

Radio Network Controllers (RNC) : Controls the Node B Data encryption / decryption Radio resource management and some of the mobility

management Node B : Base station transceiver (transmitter and receiver)

Core Network (CN): The core network consists of all the switches, routers, and other network components.

Circuit-switched networks: are used for phone calls Packet-switched networks: handles data

CDMA2000 1xEV-DO (3G)

63

BSC: Base Station Controller MSC: Mobile Switching Center

PSTN: Public Switched Telephone Network PDSN: Packet Data Serving Node

3.5G (HSDPA) High Speed Downlink Packet Access (HSDPA) is a 3.5 G

upgrade for existing WCDMA Maximum downlink data rates to 14.4 Mbps Reduces latency to 100ms from 180-200 ms HSDPA introduces a new transport channel

High-Speed Downlink Shared channel (HS-DSC) HSDPA other key features

Adaptive Modulation and Coding (AMC) Hybrid Automatic Repeat Request (H-ARQ)

64

Comparison Technology/Features

2.5 G/2.5G+ 3G/3.5G

Start 1985 1992

Deployment 1999/2003 2001/2008

Data Bandwidth 40-500kbps 2Mbps/14.4 Mbps

Bandwidth per Carrier 200kHz 5MHz

Standard GPRS/EDGE WCDMA/CDMA2000 1xEVDO

Technology Digital Cellular Technology Board Bandwidth CDMA, IP Technology

Service Higher Capacity packet data Integrated high quality audio, video and data

Multiplexing TDMA/CDMA CDMA

Switching Circuit for Network and air interface ; Packet for Core Network

Circuit for air Interface;Packet for all others.

Core Network PSTN and Packet Network Packet Network

Handoff Horizontal Horizontal

Security A5/1 KASUMI

Data rate Comparison

66

Evolution towards 4G

67

4G• 4G is also referred to as LTE (Long Term Evolution)

• Not a single technology or standard, rather a collection of technologies and protocols– aimed at creating fully packet-switched networks

• 4G networks are projected to provide speeds of 100 Mbps while moving and 1 Gbps while stationary.

68

Evolution in Network Structure

• 1G/2G: Circuit switching only

• 2.5G/3G: Both circuit switching and packet switching

• 4G: Circuit switching eliminated; packet switch only (All-IP)

69

Source: LTE Network Evolution and Technology Overview, White Paper by Tektronix Communications, USA

LTE Architecture

Two networks:•Evolved UTRAN (E-UTRAN)•Evolved Packet Core (EPC)

No circuit switching element

70

Source: LTE Network Evolution and Technology Overview, White Paper by Tektronix Communications, USA

Evolution in Data Rate

71

1 Peak data rate for GSM/GPRS; 2 Peak data rate for HSPA+; 3 Peak data rate for LTE Advanced

Thank you

72