1

Mobile Station

Terminal for the use of GSM services A mobile station (MS) comprises several functional groups

MT (Mobile Terminal): offers common functions used by all services the MS offers corresponds to the network termination (NT) of an ISDN access end-point of the radio interface (Um)

TA (Terminal Adapter): terminal adaptation, hides radio specific characteristics

TE (Terminal Equipment): peripheral device of the MS, offers services to a user does not contain GSM specific functions

SIM (Subscriber Identity Module): personalization of the mobile terminal, stores user parameters

R SUm

TE TA MT

2

GSM Components

3

Network and switching subsystem

NSS is the main component of the public mobile network GSM switching, mobility management, interconnection to other networks,

system control Components

Mobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC

Databases (important: scalability, high capacity, low delay) Home Location Register (HLR)

central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs)

Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR

4

HLR and VLR

home location register (HLR) - stores permanent data about subscribers, including a

subscriber's service profile, location information, and activity status.

When an individual buys a subscription from one of the PCS operators, he or she is registered in the HLR of that operator.

5

HLR and VLR

visitor location register (VLR) – stores temporary information about subscribers that is

needed by the MSC in order to service visiting subscribers.

The VLR is always integrated with the MSC. When a

mobile station roams into a new MSC area, the VLR connected to that MSC will request data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR will have the information needed for call setup without having to interrogate the HLR each time.

6

Mobile Services Switching Center

The MSC (mobile switching center) plays a central role in GSM switching functions additional functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) integration of several databases

Functions of a MSC specific functions for paging and call forwarding termination of SS7 (signaling system no. 7) mobility specific signaling location registration and forwarding of location information provision of new services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing information

7

Mobile Services Switching Center

MSC is a sophisticated Telephone Exchange that provides:

Circuit switched calling Mobility Management GSM Services to roaming mobiles (use same phone with

different company services, roam into different countries etc)

Fax & Data are directly encoded and sent to MSC. It is at MSC that the signal is recoded into analogue signal.

8

Operation subsystem

The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems

Components Authentication Center (AUC)

generates user specific authentication parameters on request of a VLR authentication parameters used for authentication of mobile terminals

and encryption of user data on the air interface within the GSM system Equipment Identity Register (EIR)

registers GSM mobile stations and user rights stolen or malfunctioning mobile stations can be locked and sometimes

even localized Operation and Maintenance Center (OMC)

different control capabilities for the radio subsystem and the network subsystem

9

GSM - TDMA/FDMA

1 2 3 4 5 6 7 8

higher GSM frame structures

935-960 MHz124 channels (200 kHz)downlink

890-915 MHz124 channels (200 kHz)uplink

frequ

ency

time

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3

10

GSM TIME SLOT USAGE

124 channels up link and 124 channels downlink:

- Channels 1 & 124 are not used- 32 channels are reserved for management functions- Rest 90 channels are used for customers

In all, theoretically, 124*8 users can access the system at a given point in time..

11

GSM hierarchy of frames

0 1 2 2045 2046 2047...

hyperframe

0 1 2 48 49 50...

0 1 24 25...

superframe

0 1 24 25...

0 1 2 48 49 50...

0 1 6 7...

multiframe

frame

burst

slot

577 µs

4.615 ms

120 ms

235.4 ms

6.12 s

3 h 28 min 53.76 s

12

TDM Burst composition

First and last 3 bits : set to 000 to improve receiver performance

Training Sequence : Used to adapt the parameters of the receiver to the current path propagation characteristics. Select the strongest signal in case of multipath propagation

Flag S : Indicate whether the data field has user data or network data.

13

Types of Bursts

- Normal Burst- Frequency Correction Bursts : Corrects the

oscillator frequency to avoid interference with adjacent channels

- Synchronization Burst : Synchronizes MS with the local BTS

- Access Burst : For initial connection set-up.

- Dummy Burst – When no data is available for a slot.

14

Types of Logical Channels

TRAFFIC CHANNEL : carries voice and dataTwo rates namely Full Rate (22.8kbps) and Half

rate(11.4 kbps)

Initial codecs : 13 kbps used for voice transfer

: Remaining capacity of 22.8kbps used for

error correction.

Speech quality decreases with Half rate channels. So, many providers avoid this.

15

Types of Logical Channels

CONTROL CHANNEL :Broadcast Control Channel : BTS uses this channel to send to MSs

- cell identifier

- option available (freq. hopping etc), frequencies available within the cell and in neighboring cells

- Freq correction channel : BTS sends info for freq correction

- Synchronization channel

Common Control Channel : For communication regarding connection set-up etc.

- Paging channel for BTS to talk to mobile

- Random access channel (for mobiles to talk to BTS using ALOHA)

16

Types of Logical Channels

CONTROL CHANNEL :Dedicated Control Channel :

- Signaling (bidirectional) : authentication, registration etc.

17

GSM protocol layers for signaling

CM

MM

RR

MM

LAPDm

radio

LAPDm

radio

LAPD

PCM

RR’ BTSM

CM

LAPD

PCM

RR’BTSM

16/64 kbit/s

Um Abis A

SS7

PCM

SS7

PCM

64 kbit/s /2.048 Mbit/s

MS BTS BSC MSC

BSSAP BSSAP

Link Access protocol for D Channel

18

Layer Functions – Layer-1

Physical (Radio) : Channel coding and error detection/correction. Creation of Bursts Multiplexing into TDMA frame Synchronization with BTS, including correction of path delay Detection of idle channels Measurement of downlink channel quality.

MS should adjust the access time based on the distance. Else, synchronization problems crop up.

Generally, voice channels are active only 60% of the time. The Physical layer generates a comfort noise just to fake the connection.

19

Terminology – Layer-2

LAPDm : Link Access Protocol for D-Channel- Re-sequences the data frames- Flow control- Reliable transfer of data packets- Reassembly of data- Acknowledgement / unacknowledgement of data transfer

-

20

Layer-3

RR: Radio Resource Management

- A part of RR’ is implemented in BTS. Rest is in BSC.

Tasks : Set-up, Maintenance and Release of Radio Channels.

MM : Mobility Management

- Registration,Identification, Authentication, Mobile location updating

21

Call Management :- Call Control- Short Message Service- Supplementary Service

22

Mobile Terminated Call

1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible

MSC to GMSC7: forward call to current MSC8, 9: get current status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection

PSTNcallingstation

GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

23

Mobile Originated Call

1, 2: connection request

3, 4: security check

5-8: check resources (free circuit)

9-10: set up callPSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

24

MTC/MOC

BTSMS

paging request

channel request

immediate assignment

paging response

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

BTSMS

channel request

immediate assignment

service request

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

MTC MOC

25

4 types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4

26

Handover decision

receive levelBTSold

receive levelBTSold

MS MS

HO_MARGIN

BTSold BTSnew

27

Handover procedure

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decision

HO required

BTSnew

HO request

resource allocation

ch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete

28

Security in GSM

Security services access control/authentication

user SIM (Subscriber Identity Module): secret PIN (personal identification number)

SIM network: challenge response method confidentiality

voice and signaling encrypted on the wireless link (after successful authentication)

anonymity temporary identity TMSI

(Temporary Mobile Subscriber Identity) newly assigned at each new location update (LUP) encrypted transmission

3 algorithms specified in GSM A3 for authentication (“secret”, open interface) A5 for encryption (standardized) A8 for key generation (“secret”, open interface)

29

GSM - authentication

A3

RANDKi

128 bit 128 bit

SRES* 32 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

SRES32 bit

mobile network SIM

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response

Access Control

Signed Response

30

Authentication

SIM stores the authentication key K1 and user identification IMSI. The Access Control generates a RAND no. The SIM answers with SRES. This info is passed on to HLR. The current VLR requests for appropriate values of RAND, SRES

and KC from HLR. For authentication, VLR sends RAND to the SIM. On both sides, A3 module computes the same operations. MS sends back the SRES computed by SIM. These are compared by the VLR and accepted/rejected

accordingly.

31

GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc

64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS) MS with SIM

AC

BSS

SIM

A5

Kc

64 bit

A5

MSdata data

cipherkey

32

Data services in GSM I

Data transmission standardized with only 9.6 kbit/sadvanced coding allows 14,4 kbit/snot enough for Internet and multimedia applications

HSCSD (High-Speed Circuit Switched Data)mainly software updatebundling of several time-slots to get higher

AIUR (Air Interface User Rate)(e.g., 57.6 kbit/s using 4 slots, 14.4 each)

advantage: ready to use, constant quality, simpledisadvantage: channels blocked for voice transmission

AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.44.8 19.6 2 1

14.4 3 119.2 4 228.8 3 238.4 443.2 357.6 4

33

GPRS : General Packer Radio Network

The General Packet Radio Service (GPRS) is a new non-voice value added service that allows information to be sent and received across a mobile telephone network

It supplements today’s Circuit Switched Data and Short

Message Service

34

GPRS : General Packer Radio Network

Enabling GPRS on a GSM network requires the addition of two core modules,

- the Gateway GPRS Service Node (GGSN) - GGSN acts as a gateway between the GPRS network and

Public Data Networks such as IP and X.25.- GGSNs also connect to other GPRS networks to facilitate

GPRS roaming.

- the Serving GPRS Service Node (SGSN). - provides packet routing to and from the SGSN service area for all users in that service area.

35

GPRS : General Packer Radio Network

Further additions to the GSM System :- addition of Packet Control Units; often hosted in the

Base Station Subsystems- mobility management to locate the GPRS Mobile

Station- a new air interface for packet traffic- new security features such as ciphering and new

GPRS specific signaling

36

GPRS

Difference : Ckt Switched Vs Packet Switched In CSD, a data connection establishes a circuit, and

reserves the full bandwidth of that circuit during the lifetime of the connection

packet-switched multiple users share the same transmission

channel, only transmitting when they have data to send.

total available bandwidth can be immediately dedicated to those users who are actually sending at any given moment, providing higher utilization where users only send or receive data intermittently.

37

Data services in GSM II

GPRS (General Packet Radio Service) packet switching using free slots only if data packets ready to send

(e.g., 50 kbit/s using 4 slots temporarily) standardization 1998, introduction 2001 advantage: one step towards UMTS, more flexible disadvantage: more investment needed (new hardware)

GPRS network elements GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN)

interworking unit between GPRS and PDN (Packet Data Network) SGSN (Serving GSN)

supports the MS (location, billing, security) GR (GPRS Register)

user addresses

38

GPRS Advantages

IMMEDIACY instant connections whereby information can be sent or

received immediately as the need arises. is a very important feature for time critical applications such

as remote credit card authorization where it would be unacceptable to keep the customer waiting for even thirty extra seconds.

No Dial-up This is why GPRS users are sometimes referred to be as

being "always connected". Immediacy is one of the advantages of GPRS (and SMS) when compared to Circuit Switched Data. High immediacy

39

GPRS Advantages

SPEED Theoretical maximum speeds of up to 171.2 kilobits

per second (kbps) This is about three times as fast as the data

transmission speeds possible over today’s fixed telecommunications networks and

ten times as fast as current Circuit Switched Data services on GSM networks.

40

GPRS Advantages

INTERNET AWARE GPRS fully enables Mobile Internet functionality by

allowing inter-working between the existing Internet and the new GPRS network.

Any service that is used over the fixed Internet today- File Transfer Protocol (FTP), web browsing, chat, email, telnet- will be as available over the mobile network because of GPRS. In fact, many network operators are considering the opportunity to use GPRS to help become wireless Internet Service Providers in their own right..

41

How to Access GPRS ?

a mobile phone or terminal that supports GPRS (existing GSM phones do NOT support GPRS)

a subscription to a mobile telephone network that supports GPRS

use of GPRS must be enabled for that user. Automatic access to the GPRS may be allowed by some mobile network operators, others will require a specific opt-in

knowledge of how to send and/ or receive GPRS information using their specific model of mobile phone, including software and hardware configuration (this creates a customer service requirement)

a destination to send or receive information through GPRS. Whereas with SMS this was often another mobile phone, in the case of GPRS, it is likely to be an Internet address, since GPRS is designed to make the Internet fully available to mobile users for the first time. From day one, GPRS users can access any web page or other Internet applications- providing an immediate critical mass of uses.

42

How Does a GPRS Work?

43

How Does a GPRS System Work?

a notebook computer connected to a GPRS-capable cell phone or modem, either through a serial cable or other type of connection such as Universal Serial Bus (USB) or local wireless link /

Or perhaps the connection device is in the form of a PC Card.

The GPRS phone or modem communicates with GSM base stations, but unlike circuit-switched data calls which are connected to voice networks by the mobile switching center, GPRS packets are sent from the base station to what is called a Serving GPRS Support Node (SGSN).

44

How Does a GPRS System Work?

The SGSN is the node within the GSM infrastructure that sends and receives data to and from the mobile stations. It also keeps track of the mobiles within its service area.

The SGSN communicates with what is called the Gateway GPRS Support Node (GGSN), a system that maintains connections with other networks such as the Internet, X.25 networks or private networks.

A GPRS network can use multiple serving nodes, but requires only one gateway node for connecting to an external network such as the Internet.

When the mobile station sends packets of data, it is via the SGSN to the GGSN, which converts them for transmission over the desired network, which could be the Internet, X.25 networks or private networks

IP packets from the Internet addressed for the mobile station are received by the GGSN, forwarded to the SGSN and then transmitted to the mobile station.

45

How Does a GPRS System Work?

To forward IP or X.25 packets between each other, the SGSN and GGSN encapsulate these packets using a specialized protocol called the GPRS tunnel protocol (GTP) which operates over the top of standard TCP/IP protocols.

But the details of the SGSN and GGSN are both invisible and irrelevant to the user who simply experiences a straightforward IP or X.25 connection that just happens to be wireless.

46

How Does a GPRS achieve high speeds?

GPRS uses the same radio channel as voice calls, a channel that is 200 kHz wide

This radio channel carries a raw digital radio stream of 271 kbps which for voice calls is divided into 8 separate data streams, each carrying about 34 kbps.

After protocol and error correction overhead, 13 kbps is left for each

voice connection or about 14 kbps for data. Circuit-switched data today uses one voice channel GPRS can combine up to 8 of these channels, and since each of these

can deliver up to 14 kbps of data throughput, the net result is that users will be able to enjoy rates over 100 Kbps.

The GPRS standard defines a mechanism by which a mobile station can request the amount of bandwidth it desires at the time it establishes a data session.

47

GPRS quality of service

Reliabilityclass

Lost SDUprobability

DuplicateSDU

probability

Out ofsequence

SDUprobability

Corrupt SDUprobability

1 10-9 10-9 10-9 10-9

2 10-4 10-5 10-5 10-6

3 10-2 10-5 10-5 10-2

Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile

1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified

48

Examples for GPRS device classes

Class

Receiving slots

Sending slots

Maximum number of slots

1 1 1 2

2 2 1 3

3 2 2 3

5 2 2 4

8 4 1 5

10 4 2 5

12 4 4 5

49

GPRS user data rates in kbit/s

Coding scheme

1 slot

2 slots

3 slots

4 slots

5 slots

6 slots

7 slots

8 slots

CS-1 9.05 18.1 27.15

36.2 45.25

54.3 63.35

72.4

CS-2 13.4 26.8 40.2 53.6 67 80.4 93.8 107.2

CS-3 15.6 31.2 46.8 62.4 78 93.6 109.2

124.8

CS-4 21.4 42.8 64.2 85.6 107 128.4

149.8

171.2

50

GPRS architecture and interfaces

MS BSS GGSNSGSN

MSC

Um

EIR

HLR/GR

VLR

PDN

Gb Gn Gi

SGSN

Gn

GPRS Support nodes(Routers)

PDN : Packet Data Networks

Servicing GSN

Gateway GSN

51

GPRS Architecture

GGSN : Interfaces b/w GPRS and other Packet Data Networks(PDN)

- contains routing info for GPRS

- performs address conversion

Tunnels data to user via encapsulation

MSC is used only for signaling

52

GPRS Architecture

SGSN : Counterpart of MSC

- supports MS via MS interface via Gb I/F

- Requests user address from GPRS Register

- Keeps track of individual MS location

- collects billing info

- access control for security

53

GPRS protocol architecture

apps.

IP/X.25

LLC

GTP

MAC

radio

MAC

radioFR

RLC BSSGP

IP/X.25

FR

Um Gb Gn

L1/L2 L1/L2

MS BSS SGSN GGSN

UDP/TCP

Gi

SNDCP

RLC BSSGP IP IP

LLC UDP/TCP

SNDCP GTP

Subnet Dependent Convergence Protocol(SNDCP)’

BSSGP : Base Station Subsystem GPRS

FR (Frame Relay Network)

54

GPRS Transmission Ref Model

All data within GPRS is transferred using GPRS tunneling protocol(GTP).

Can use either TCP(Reliable) or UDP(non-reliable) IP is the backbone network protocol To adopt to the different characteristics of the

underlying networks, ‘Subnet Dependent Convergence Protocol(SNDCP)’ is used.

LLC : logical Link Control (ensures high reliability of transfer)

55

GPRS Transmission Ref Model

BSSGP : Base Station Subsystem GPRS Protocol(BSSGP) – Conveys routing and QOS related info b/w BSN and SGSN.

FR (Frame Relay Network) : ensures error correction RLC (Radio Link Control) : Provides Reliable Link LLC (Logical Link Control)

56

DECT

DECT (Digital European Cordless Telephone) standardized by ETSI (ETS 300.175-x) for cordless telephonesstandard describes air interface between base-station and mobile phoneDECT has been renamed for international marketing reasons into „Digital Enhanced Cordless Telecommunication“Characteristics

frequency: 1880-1990 MHzchannels: 120 full duplexduplex mechanism: TDD (Time Division Duplex) with 10 ms frame lengthmultplexing scheme: FDMA with 10 carrier frequencies, TDMA with 2x 12 slotsmodulation: digital, Gaußian Minimum Shift Key (GMSK)power: 10 mW average (max. 250 mW)range: approx. 50 m in buildings, 300 m open space

57

DECT system architecture reference model

globalnetwork

localnetwork

localnetwork

FT

FT

PTPA

PTPA

VDB

HDB

D1

D2

D3D4

Fixed Radio Termination (FT)

Portable Radio Termination(PT)

Portable Applications(PA)

58

DECT reference model

physical layer

medium access control

data linkcontrol

data linkcontrol

networklayer

OSI layer 1

OSI layer 2

OSI layer 3

U-PlaneC-Plane

signaling,interworking

applicationprocesses

man

agem

ent

close to the OSI reference modelmanagement plane over all layersseveral services in C(ontrol)- and U(ser)-plane

59

DECT layers I

Physical layer modulation/demodulation generation of the physical channel structure with a guaranteed

throughput controlling of radio transmission

channel assignment on request of the MAC layer detection of incoming signals sender/receiver synchronization collecting status information for the management plane

MAC layer maintaining basic services, activating/deactivating physical channels multiplexing of logical channels

e.g., C: signaling, I: user data, P: paging, Q: broadcast segmentation/reassembly error control/error correction

60

DECT time multiplex frame

slot

sync

A field

DATA

DATA64

C16

DATA64

C16

DATA64

C16

DATA64

C16

B field

D field

1 frame = 10 ms

12 down slots 12 up slots

0 419

0 31 0 387

0 63 0 319

protected mode

unprotected mode

simplex bearer

25.6 kbit/s

32 kbit/s

420 bit + 52 µs guard time („60 bit“) in 0.4167 ms

guard

X field 0 3

A: network controlB: user dataX: transmission quality

61

DECT layers II

Data link control layer

creation and keeping up reliable connections between the mobile terminal and basestation

two DLC protocols for the control plane (C-Plane) connectionless broadcast service:

paging functionality Lc+LAPC protocol:

in-call signaling (similar to LAPD within ISDN), adapted to the underlying MAC service

62

DECT layers II

several services specified for the user plane (U-Plane) null-service: offers unmodified MAC services frame relay: simple packet transmission frame switching: time-bounded packet transmission error correcting transmission: uses FEC, for delay critical,

time-bounded services bandwidth adaptive transmission „Escape“ service: for further enhancements of the standard

63

DECT layers III

Network layer similar to ISDN (Q.931) and GSM (04.08) offers services to request, check, reserve, control, and

release resources at the basestation and mobile terminal resources

necessary for a wireless connection necessary for the connection of the DECT system to the fixed

network main tasks

call control: setup, release, negotiation, control call independent services: call forwarding, accounting, call

redirecting mobility management: identity management, authentication,

management of the location register

64

Enhancements of the standard

Several „DECT Application Profiles“ in addition to the DECT specificationGAP (Generic Access Profile) standardized by ETSI in 1997

assures interoperability between DECT equipment of different manufacturers (minimal requirements for voice communication)enhanced management capabilities through the fixed network: Cordless Terminal Mobility (CTM)

DECT/GSM Interworking Profile (GIP): connection to GSMISDN Interworking Profiles (IAP, IIP): connection to ISDNRadio Local Loop Access Profile (RAP): public telephone serviceCTM Access Profile (CAP): support for user mobility

DECTbasestation

GAP

DECTCommonAir Interface

DECTPortable Part

fixed network