gsm theory.pdf

DOCUMENTTYPE 1 (21)

TypeUnitOrDepartmentHereTypeYourNameHere TypeDateHere

GSM 900 uses two 25 MHz bands. MS transmits at 890-915 MHz (uplink) and BTS transmits at935-960 MHz (downlink). Each band is divided into 125 channels of 200 kHz each. Each channelhas a unique number known as ARFCN (Absolute Radio Frequencie Channel Number) rangingfrom 0 to 124. ARFCN 0 is left and serves as a guard band for other services. Duplex is 45 MHz:

o Fup = 890 + 0.2*n (1

DOCUMENTTYPE 2 (21)


Coherence bandwidth isdt

CB*

=5

1. If Channel bandwidth > coherence bandwidth

frequency selective channel. GSM is a frequency selective channel. (GSM bit rate is

BR =270.856 kbps dt = BR1

=3.692 ?s kHzt

CBd

17.545

1=

*= ).

Doppler spread is a broadning of power spectrum of signal due to velocity induced Dopplerfrequency shift (bandwidth fadding). If channel bandwidth > Doppler spread slow fading, ifchannel bandwidth < Doppler spread fast fading.

o GSM is slow fading: around 900 MHz and velocity of aroud 120 MHz, Doppler spread isaround 100 kHz.

Equalization: use of an adaptative filter (receiver side) facilitated by the use of special trainingsequence knows by the BTS and the MS. By comparing the received and transmitted trainingsequences, it is possible to calculate the channel impulse function. By applying the inversefunction, using an adaptative filter, it is possible to counter the fast fading effect.

o In GSM, 8 training sequences of 26 bits each, have been defined. The equqlizer used inGSM, can compensate up to 16 ?.

5 classes of power have been defined for MS for GSM 900, GSM 1800 and GSM 1900.

I 20 W (43 dBm) VehicularII 8 W (39 dBm) Vehicular (Most typical)III 5 W (37 dBm) HandledIV 2 W (33 dBm) HandledV 0.2 W (29 dBm) Handled (Most typical)

Transmit power of MS is dynamically controlled in steps of 2 dB down from max level to minimumlevel of 20 mW. This is done, atleast, each 60 ms.

o BTS determines the power level (RXLEV) and quality level (RXQUAL) of received signalfrom each MS. The RXLEV is mapped to a value between 0 and 63 (0P

DOCUMENTTYPE 3 (21)


In BTS, power control is optional. The output power is controlled in 2 dB steps. This leads to abetter QoS and greater frequency reuse whitin its cell (co-channel interference performance).

A TDMA frame is made of 8 time slots (TSL). Each one of them is 0.577 ms. So the TDMA frameis 4.615 ms.

The Air interface of GSM (Um) uses TDMA technique (access is based on the 8 TSL) overlaid ona FDMA structure (dividing into different channels of 200 kHz width).

Each time slot of the TDMA frame is distinguished by a TSL Number (TN) ranging from 0 to 7.The same TN is used for UL and DL. UL numbring of TSL is delayed by 3 TSL with respect to DLto facilitate TDD.

For conversation, voice is active for less than 40% of speaking time. To take advantage of thisparticularity, GSM uses DTX (Discontinous TX) in order to reduce interference and to improvebatteries lifetime. DTX is implemented by VAD (Voice Activity Detection). In order to improveintelligibility of the speech, a 'Confort Noise' is introduced. After VAD detects an end of speech, itwaits $ frames of 20 ms each (DTX hangover) before stopping radio transmission. During DTXhangover, various background parameters are determined and transmitted in a SID (SIlenceDescriptor) frame of 480 ms. At the receiving end, SID is used to generate confort noise.

The paging channel used by BTS to indicate an incoming call is structured into sub-channelscorresponding to different MS. Each MS monitors its own sub-channel only and can go into sleepmode while other sub-channels of the Paging Channel are being transmitted: DRX (DiscontinousRX).

BTS needs to receive the TSL in there correct time to avoid collision. Since MS within a cell willbe at different distances from the BTS, delays are different. This leads to a probable overlapping.To compensate delay, BTS instructs to MS whose transmission arrive too late to advance theirTX in time (MS far from the BTS are given a head start). This technique is known as timingadvance. Timing advanceis computed by the BTS and is signaled to the MS using a 6 bitsnumber which advances the TX time in range from 0 to 63 bits where 1 bit has duration of 3.7 ?s.This gives a maximum advance of 63 * 3.7 = 233 ?s that is equivqlent to 35 km.

GSM radio channel is a frequency selective channel. This implies that propagation conditionsvary over the range of available frequencies. To average the propagation conditions over allfrequencies, SFH (Slow Frequency Hopping) is introduced. In SFH, carrier frequency is changedslowly (once every TDMA frame = 4.615 ?s). This gives a hopping rate of 216.7 hops/s.

PCM (Pulse Code Modulation) used to convert analog speech into digital signal (8000 samples/s)each sample is 13 bits.

Speech coding (MS):

Speechcoding

Speechcoding

Speechcoding

Speechcoding

Speechcoding

Speechcoding

Analogsignal

Airinterface

Digitallize RPE-LTP

Analogsignal

104 kbps 13 kbps

DOCUMENTTYPE 4 (21)


Channel coding: the purpose of channel coding is to add redundancy bits to improve resistanceto radio propagation conditions. The input is 13 kbps and the output is 22.8 kbps. The added 9.8kbps are for redundancy.

o For channel coding, the output of the RPE-LTP (260 bits for 20 ms) is divided into threeclasses: Class Ia: 50 bits. Those are very important bits and represent coefficients of the

filter. Class Ib: 132 bits. Those are less important bits and represent RPE parameters

and LTP parameters. Class II: 78 bits. Those represent the least important bits and represent RPE pulse

and filter parameters.o

Convolutional coders are best suited to randomly distributed errors and do not perform well if aburst error occurs. That's why, GSM uses interleaving before transmission on air interface.

104 kbps: output of digitillizing is 8000 samples (voice band is about 4000 Hz). Each sample is 13 bits. 13 kbps: every 20 ms of the 104 kbps is coded separately by the RPE-LTP (20 ms160 samples).

So the input of the RPE-LTP is 160*13 = 2080 bits. The output is a 260 bits coding the 20 ms period. RPE-LTP: Regular Pulse Excited Long Term Prediction

Block codingConvolutionalcoding

13 kbps 22.8 kbps

Tail 4 bits

456 bits for20 ms22.8 kbps160 samples

for 20 ms

78 bitsClass II

132 bitsClass Ib

50 bitsClass Ia

53 bitsClass Ia

RPE-LTP

Codec

Cycliccodes

ConvolutionalcoderR=1/2K=5 +

378 bits

Tail bits are used to reset the convolutional decoder K=5 means that 5 consecutive bits are used to calculate redundancy bit and for each data bit,

an additional bit is added.

DOCUMENTTYPE 5 (21)


Data require more protection than voice due to that SFS can not be used, if data is dropped.Error correction control within the terminal equipment may implement ARQ scheme to cater thelost of data.

Data rate 2.4 kbps:

Signaling is the most important data on the air interface. Signalling information contain 184 bits.Channel coding is in 2 stages.

114 bits114 bits 114 bits 114 bits 114 bits114 bits114 bits114 bits

456 bits

57 bits

57 bits

57 bits

1

2

8

456 bits

57 bits

57 bits

57 bits

1

2

8

TDMA Frame (8 TSL)

Data (9.6kbps)

Channelcoder

Convolutionalcoder

Ponctuate32 bits.

Interleavingover 22 TSL

240 bits /20 ms =12 kbps

488 bits /20 ms =24.4 kbps

456 bits /20 ms =22.8 kbps

456 bits /20 ms =22.8 kbps

Data (2.4kbps)

Channelcoder

Convolutionalcoder r=1/6, k=5


4 blocksof 72 bits/ 20 ms =3.6 kbps

456 bits /20 ms =22.8 kbps

456 bits /20 ms =22.8 kbps

4 all zerotail bits.

DOCUMENTTYPE 6 (21)


This is coding scheme for signaling except SCH, RACH and FACCH. Logical channels are mapped onto physical channels. A TDMA frame contains 8 TSL of 0.577 ms each. Each TSL is termed as physical channel and is

allocated to individual user to carry speech and signaling. Each TSL has a unique TSL Number(TN) which ranges from 0 to 7. Each physical channel is identified by its ARFCN and TN.

Each TSL contains 156.25 bits. So a TDMA frame contains 1250 bits. TDMA frames are grouped together into high order frames known as multiframe:

o 26-frame multiframe (duration 4.615*26 =120 ms) used for traffic and associated controlchannels.

o 51-frame multiframe (duration 4.615*51 = 235.4 ms) used exclusively for controlchannels.

Multiframes are further built up to produce superframes of 26*51 frame multiframe (1326 frames)of duration of 1326 * 4.615 = 6.12 s.

Hypertrames are made of 2048 frames for a duration of 2048 * 6.12 = 3 hours 28 min 53 s and760 ms and contains 2048 * 1326 = 2 715 648 frames. Each frame in a hyperframe is identifiedby a FN ranging from 0 to 2 715 647.

5 types of burst have been defined in GSM:

DirectionMS BTS

Type Constitution Usage

Normalburst

Traffic and controlCH except SCH,RACH, FCCH.

Synchroburst

Synchro of MS. 64bits for synchro. 39bits for FN and BSIC.

Frequencycorrectionburst

Frequency correctionof MS. 142 bits forma serie of fixed zeros.

Accessburst

For accessing themobile network. The36 bits for access.

Dummyburst

Filler in unused TSL.

Index. Training sequence is used by the equalizer for multipath correction. GP: Guard Period S: Stealing flag (FACCH)

Security management uses four principle mechanisms:- ID of each subscriber is authenticated using a cryptographic security mechanism.- Ciphering is used to scramble user speech and data.- Subscriber security information are stored in the secured SIM.- GSM network operators keep secrecy of cryptographic algorithm and encryption keys.

184 bits 184 bits Convolutionalcodes R=1/2 K=5


40 parity bits(Fire codes)

4bits

1st stage 2nd stage

456 bits /20 ms =22.8 kbps

3T

57encrypted

1S

26training

1S

57encrypted

3T

8.25GP

3T

39encrypted

64 extentedtraining sequence

39encrypted

3T

8.25GP

3T

142 fixed bits 3T

8.25GP

8T

41encrypted

53.25 GP36 encrypted

3T

58 encrypted 26training

58 encrypted 3T

8.25GP

DOCUMENTTYPE 7 (21)


In GSM, 3 cryptographic algorithms are used:o A3: used for authentification. It generates SRES (Signed RESponse) to a RAND

(RANDom) number transmitted by the network, and a secret key Ki stored in the SIM.o A5: used for ciphering and deciphering. It uses Kc, generated during authentification, and

frame number (FN) to encrypt user info.o A8: used to generate Ki and Kc. It is stored on SIM.

Encryptionalgorithm

Plaintext

Ciphertext

keyAlgorithm Algorithm

Random number

Computed result

key

= Yes/No

Encryptionalgorithm

Plaintext

Ciphertext

Encryptionalgorithm

Plaintext

Ciphertext

Key

DOCUMENTTYPE 8 (21)


Ciphering process:

Modulation: Base Band signals, resulting from ciphering process, are low frequency signals(within few kHz). These signals are unsuitable for direct transmission over Air interface (Um)because the frequencies are far tow low and different channels have the same frequencies(interface and high attenuation).Modulation scheme used in GSM is GMSK (Gaussien Minimum Shift Keying).

o GMSK features are: high spectral efficiency, good error performance, low powerconsumption and ease of implementation.

o For GSM spectral efficiency required is HzbpskHz

kbps /35.1200

833.270= .

o GSM BER level required is 310- for speech (compatible with GMSK).o GMSK is a form of PSK (Phase Shift Keying) and particularily QPSK (Qudrature PSK)

QPSK:

A5 algorithm A5 algorithm

114 bits 114 bits

Modulo 2(Exclusive OR)

Plain text Cipher text Plain text

Even bits aI

Odd bits aQInput data Serial to

parallelconverter

6T4T2T

QPSK

aI

aQ

cos(w.t)

sin(w.t)

Input date is at a rate of T1

pbs. It is separated into twostreams at a rate of T2

1 .

DOCUMENTTYPE 9 (21)


OQPSK (Offset QPSK): it is induced from QPSK by introducing a delay for odd symbols. Thismakes phase change every T (in QPSK phase change occurs every T) and maximum phasechange is 90 degre.

GMSK is based on OQPSK, but instead of using sine filter, we use gaussien based filters. InGSM, the gaussien filter has 3.0=TB with B the filter band and T is the symbol duration. Bythis method, we reduce low side lobes and we sharpen central lobe.

GSM logical channels:

Downlink (NB, DB)

TCH/F

GSM Channels

TCH(Traffic CHannel)

CCH(Control CHannel)

TCH/H

Fullrate

Halfrate

BCH(Broadcast CHannel)

CCCH(Common ControlCHannel) (NB, AB)

DCCH(Dedicated Control

CHannel) (NB)

FCCH SCH BCCHRACH

Uplink Downlink

PCH AGCH

Fast Slow

SACCHFACCH SDCCH

Broadcast cell specificinformation

Connectionestablishment

Once connection isestablished

FCCH: Frequency Correction CHannel: provides the MS with system frequencyreference.

SCH: Synchronization CHannel: used for synchronization of the MS and ID of the BTS. BCCH: Broadcast CHannel: provides the MS qith cell specific information. It is usually

transmitted during TSL 0. PCH: Paging CHannel: informs the MS of an incoming call. RACH: Random Access CHannel: used by the MS to request a DCH. AGCH: Access Grant CHannel: used to carry the response of the network to the RACH

request. SDCCH: Standalone Dedicated Control CHannel: exchange signaling information in the

downlink and uplink direction before TCH is allocated (registration, authentication ). SACCH: Slow Associated Control CHannel: used in association with a TCH os SDCCH

for channel maintenance and control. FACCH: Fast Associated Control CHannel: replaces part of a TCH when urgent

signaling is needed. It carries the same information than SACCH.

DOCUMENTTYPE 10 (21)


A 26 frame multiframe can accommodate 24 TCH/F (frame 12 is reserved for the SACCH andframe 25 is left idle). For HR, two channels are transmitted in alternate frames (frame 12 isreserved for SACCH of the first TCH and frame 25 for SACCH of second TCH).

FACCH has higher priority than TCH (presence of TCH is indicated by the status of the stealingflag).

A 51 frame multiframe is used for ordering combination of signaling channels:o FCCH + SCH + CCCH + BCCHo FCCH + SCH + BCCH + SDCCH/4 + SACCH/4o CCCH + BCCHo SDCCH/8 + SACCH/8

Initializing an MSo Synchronizing itself in frequency (acquire FCCH): scans all available frequencies, obtain

average signal strength for each channel. Starting with highest signal strength, MSsearches for the FCCH burst within that channel. If the FCCH is found, then MS locksonto the frequency. If not, it scans for the next strength signal.

o Synchronize itself in time: after FCCH is found, MS attempt to synchronize itself with SCHburst (SCH occurs in same TSL than FCCH but in next frame). SCH contains a trainingsequence to permit redefine slot timing. SCH also contains FN and BSIC.

o Obtain system and cell data from the Base channel by reading the BCH (2-5 s): once MShas been synchronized in frequency and time, it can read the info on the BCCH (redssystem parameters identify the network and gain access to the network).

o Once initialized, the MS monitors passively the PCH for incoming calls. BSC BTS: a 2 Mbps link composed of 32 TSL of 64 kpbs each. It's named Abis interface. BSC - MSC: a 2 Mbps link composed of 32 TSL of 64 kpbs each. It's named A interface.

o BSC TCSM (transcoder): the transcoder is part of the BSC but it's placed in MSC sideto preserve transmission resources. Each 64 kbps TSL multiplexes from 1 to 4 users. It'snamed Ater interface. It can be considered as a continuation of the Abis interface.

o TCSM (transcoder) MSC: each user is granted a 64 kbps TSL.o Transcoder role is to convert the sub rates on Ater interface (8, 16, 32 or 64 kbps) to the

64 kbps of the A interface.

Transcoder working:

Bits

2 Mbps

A interface Abis interface

2 MbpsTSL

B1 B2 B3 B4 B5 B6 B7 B8 b1 b2 b'1 b'2 b''1 b''2 b'''1 b'''2

8 bits for the same user 4 multiplexed users (2 bits each)

313210 313210



o How to:

A interface

01 158159 01 159 1582 Mbpsframe

2 Mbpsframe

2 Mbpsframe

2 Mbpsframe

2 Mbpsframe

2 Mbpsframe

2 Mbpsframe

2 Mbpsframe

160 * 2 Mbps frames = 20 ms

158159 01

313210 3132102 MbpsTSL 2 Mbps

Bits B1 B2 B3 B4 B5 B6 B7 B8

Frame 159 Frame 0

(TSL 0)159

B1 B2 B3 B4 B5 B6 B7 B8

(TSL 31)0

B1 B2 B3 B4 B5 B6 B7 B8 DSP 0

(TSL 0)ix x b1 b2 x x x x

(TSL 0)I,out

B1 B2 B3 B4 B5 B6 B7 B8 DSP 31

(TSL 31)i

x x b1 b2 x x x x

(TSL 31)I,out

Input rate: 8 bits/TSL * 8000 frames/s = 64 kbps Output rate: 2 bits/TSL * 8000 frames/s = 16kbps

For each TSL, the input is 160 * 8 bits = 1280 bits. The output is 160 * 2 bits = 320bits. Among them, 260 are for speech coding and 60 are used for inband signaling.



TRAU frame is the output of the DSP for (TSL i) for 160 samples. Than means that for full ratecase, it is 320 bits big.

b1 b2 x x x x x x

x x x x x x b'''1 b'''2

..

Ater interface

b1 b2 b'1 b'2 b''1 b''2 b'''1 b'''2

(TSL i)j,out,1

(TSL i)j,out,4

4 TSL i (0



TRAU frame in HR configuration is 160 bits big (1 bit per TSL) among which 112 are for speechcoding and the 48 bits are for in band signaling.

0 0 000000

0 0 000000

1 C1 C7C6C5C4C3C2

C8 C9 C15C14C13C12C11C10

1 D1 D7D6D5D4D3D2

D8 D9 D15D14D13D12D11D10

1 D256 C17C16D269D259D258D257

C18 C19 T4T3T2T1C21C20

0 1 765432

1

4

5

6

.

.

39

40

2

3

x x b1 b2 x x x x

x x b1 b2 x x x x

Trnsmission2 * 160 bits(160 TSL ofwhich 2 bitsare used)

0

159



In band signaling is intended for signaling between DSP of BTS and DSP of transcoder for:o Shifting between data and speecho Shifting between HR and FRo Control data rate adaptation for data callso Transferring DTX

LAPD in the 2.048 Mbps frame structure on the Abis interface has 5 fonctions:o 4 fonctions for ET2A/ET2E control.o 1 for communication with the BSC.

0 0 000000

1 C1 C7C6C5C4C3C2

1 D1 D7D6D5D4D3D2

1 D8 D14D13D12D11D10D9

1 D15 D21D20D19D18D17D16

1 D106 D112D111D110D109D108D107

1 C8 C14C13C12C11C10C9

1 C15 T2T1C19C18C17C16

0 1 765432

1

4

5

.

18

19

20

2

3

x x b x x x x x

x x b x x x x x

Trnsmission2 * 160 bits(160 TSL ofwhich 2 bitsare used)

0

159

BSC

TCSM

MSC



Different classes have been defined for coding rates:o Class A: FR, EFR (14.5, 12, 6, 3.6 kbps) speech (RPE-LTP). (120 users on Abis

interface).o Class B: HR (6, 3.6 kbps) speech (RPE-LTP). (210 users on Abis interface).o Class C: FR, EFR, HR (14.5, 12, 6, 3.6 kbps) speech and data. (number of users on Abis

interface depends on configuration and its range is 120-210 users).o Class D: HSCSD2, FR, EFR, HR. (120 users on Abis interface).o Class E: HSCSD2, FR, EFR, HR. (30 users on Abis interface).o Class F: AMR. (120 users on Abis interface).

For FR, EFR, on TRAU frame, 320 bits are allocated and 2 bits on each TSL for transmission. For HR, on TRAU frame, 160 bits are allocated and 1 bits on each TSL for transmission. For HSCSD2, on TRAU frame, 4 bits on each TSL for transmission (equivalent to 2 FR). For HSCSD4, on TRAU frame, 8 bits on each TSL for transmission (equivalent to 4 FR). Examples of configuration on Abis interface:

o FR case

o HR case

0 1 765432

TSL1

TSL4

TSL5

TSL6

TSL7

TSL8

TSL9

.

TSL2

TSL3

TSL32

TSL30 User 20 User 23User 22User 21

User 24 User 27User 26User 25








User 3User 2User 1

LAPD User 3User 2User 1

Link 1TSL 1 to 831 users


Total number of link: 31*2+27=120 links



Three basic network elements:o SSP (Service Switching Point): where SS7 messages originate.o STP (Service Transfert Point): routes messages through the signaling network.o SCP (Service Control Point): DB used to support call processing.

SS7 protocol stack (out of band signaling)

0 1 765432

TSL1

TSL4

TSL5

TSL6

..

TSL27

TSL28

TSL29

TSL2

TSL3

TSL32

TSL30



Total number of link: 30*7=210 links

LAPD Usr5Usr3Usr1 Usr2 Usr4 Usr6

Usr7 Usr13Usr11Usr9 Usr10 Usr12 Usr14Usr8



Usr5Usr3Usr1 Usr2 Usr4 Usr6

Usr7 Usr13Usr11Usr9 Usr10 Usr12 Usr14Usr8 Link 2TSL 5 to 830 users



MTP1

MTP3MTP2

ISUPOMAP

TCAP

SCCPMTP(MessageTransfertPart)

o MTP1: physical, electrical and functionalcaracteristics. 2 data channels operating together indifferent direction at the same data rate (56 kbps forANSI and 64 kbps for ETSI).

o MTP2: accurate end-to-end transmission of thesignaling messages. Use a 16-bit CRC.

o MTP3: defines transport proceduresand fonctions(using DPC)

o SCCP: uses SSN and GT. Combination of MTP3 andSCCP are known as NSP (Network Service Part).

o ISUP (ISDN User Part): supports the basic bearerservices and supplementary services for voice andnon voice applications (call forward, calling ID ). Itcomprises TUP. (PLMN-Fixed operation).

o TCAP (Transaction Capability Part): it provides INcapability and DB exchange. (Real time information).

o OMAP (Operation and Management Application Part).



Protocol stack on BSS:

o RR (Radio Ressource) protocol is divided into three sub layers: RIL3-RR: Radio Interface Layer 3 BTSM BSSAP: it is also divided into two sub layers

BSSAP DTAP

o B, C, D, E, F and G interfaces are MAP (Mobile Application Part) interfaces.

RR

LAPD-m

Radio

CM

MM

MS

Radio MTP1

LAPD-m LAPD

RR BTSM

MTP1

LAPDMTP2

SCCPBTSM

RR BSSAP

BTS BSCUm Abis A

Network layer

Data link layer

Application

Physical

Presentation

Session

Transport

Network

Data link

OSI layers:

Physical

Application

Network

Data link

GSM layers:

Physical

Application

Data link

GSM signaling layers:



Location update procedure (initiated by the MS):

SCCP connection confirm

SCCP connection request

MAP/B location updateacknowledge

MAP/B location update(TMSI, old LAI)

RIL3-RR Immediateassign (AGCH)

RIL3-RR Channelrequest (RACH)

MM Location Update (TMSI, Old LAI) (SDCCH)

MM seizes adedicated signalingchannel

EstablishesBSSMAP and DTAPsignaling connection

MAP/D location update(IMSI, old VLR nbr)MAP/D location updatereset

MM Location Update accepted (SDCCH)

MS BSS MSC HLRVLR

RIL3-RR ChannelreleaseRIL3-RR Channeldisconnect

UA (SDCCH)

BSSMAP clearcommand

BSSMAP clearcomplete



Identification procedure (initiated by the VLR, MAP protocol):

MAP/B provides IMSI

MAP/B IMSI acknowledge

MAP/D Insertsubscriber data result

MAP/D update location

MAP/D update locationresult

MAP/D Insertsubscriber data

MS BSS MSC HLRVLR

RIL3-MM Identity Request

RIL3-MM Identity Response (IMSI)



Authentication (initiated by the VLR, MAP):

RAND, SRES, KcMAP/D sendparameters result

MAP/D sendparameters

MAP/B sendauthenticate

MAP/Bauthentication

complete

MAP/Dauthentication

complete

RIL3-MM service reject

RIL3-MM service accept

RIL3-MM authentication request(SRES)

RIL3-MM authentication request(RAND)

MS BSS MSC HLRVLR AuC



Ciphering (initiated by the VLR, MAP):

BSSMAP Ciphermode command

MAP/B set ciphermode (Kc)

BSSMAP Ciphermode complete

MS BSS MSC VLR

RIL3-RR ciphermode command

RIL3-RR Ciphermode complete

gsm theory.pdf

Documents