oma000001 gsm fundamentals issue32

70
modified by Ahmed Awny Wireless Curriculum Development Section Wireless Curriculum Development Section ISSUE ISSUE 3.2 3.2 GSM Fundamentals GSM Fundamentals

Upload: just-ismail

Post on 22-Oct-2014

47 views

Category:

Documents


6 download

TRANSCRIPT

Page 1: Oma000001 Gsm Fundamentals Issue32

modified by Ahmed Awny

Wireless Curriculum Development SectionWireless Curriculum Development SectionWireless Curriculum Development SectionWireless Curriculum Development Section

ISSUEISSUE 3.23.2

GSM FundamentalsGSM FundamentalsGSM FundamentalsGSM Fundamentals

Page 2: Oma000001 Gsm Fundamentals Issue32

2

modified by Ahmed AwnySecurity Level: Internal

Contents Contents haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network Components

Terrestrial Interface

Service Area and Number Planning

Channels on The Air Interface

Radio Technologies

Page 3: Oma000001 Gsm Fundamentals Issue32

3

modified by Ahmed AwnySecurity Level: Internal

ObjectivesObjectiveshaoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Name the two different cell types and understand why and when each would be used.

Get the concept of frequency reuse.

Name the frequency spectrum used in GSM

Name the two different cell types and understand why and when each would be used.

Get the concept of frequency reuse.

Name the frequency spectrum used in GSM

On completion of this section you will be able to:

Page 4: Oma000001 Gsm Fundamentals Issue32

4

modified by Ahmed AwnySecurity Level: Internal

CELLCELL

Omni

1

120degree

1

23

Omni-Directional CellsOmni-Directional Cells

120 Degree Sectors120 Degree Sectors

Page 5: Oma000001 Gsm Fundamentals Issue32

5

modified by Ahmed AwnySecurity Level: Internal

Cell conceptCell concept

HighwayHighway

TownTownSuburbSuburb

RuralRural

• Flexible network planning based on location nature Flexible network planning based on location nature

• Smooth Handover (no service degradation while subscriber moves)Smooth Handover (no service degradation while subscriber moves)

• Frequency reuse (same group of frequencies used in different cells)Frequency reuse (same group of frequencies used in different cells)

Signal Signal strengthstrength

distancedistance

• Cell : basic service area that can be efficiently managed by the network

• One base station per cell for comm. between MS and the network

• Cell boundaries are defined by BS signal strength

Page 6: Oma000001 Gsm Fundamentals Issue32

6

modified by Ahmed AwnySecurity Level: Internal

25 MHz Uplink (MS to BS)

25 MHz Downlink (BS to MS)

f

200 KHz

915 MHz890 MHz

……

960 MHz935 MHz

45 MHz duplex spacing

Frequency Spectrum GSM 900Frequency Spectrum GSM 900

……

For DCS1800 , downlink is from 1805 to 1880MHz , uplink from 1710 to 1785MHz 75Mhz , 374 RF carriers each . Frequencies are separated by 95MHz.

t

f

200 KHz

……

200 KHz x 125 = 25 MHz

1 TDMA frame = 0.577 m

s x 8 TS

……

915 MHz

890 MHz

Physical channelsPhysical channels

Page 7: Oma000001 Gsm Fundamentals Issue32

7

modified by Ahmed AwnySecurity Level: Internal

GSM delays uplink TDMA framesGSM delays uplink TDMA framesGSM delays uplink TDMA framesGSM delays uplink TDMA frames

T1 T2 T3 T5 T6 T7T4 T8

R T

R T

R1 R2 R3 R5 R6 R7R4 R8

Uplink TDMA Frame

F1 + 45MHz

Downlink TDMA F1MHz

The start of the uplink TDMA is delayed of

three time slotsTDMA frame (4.615 ms)

Fixed transmit Delay of three time-slots

Page 8: Oma000001 Gsm Fundamentals Issue32

8

modified by Ahmed AwnySecurity Level: Internal

Contents Contents haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network Components

Terrestrial Interface

Service Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio Technologies

Page 9: Oma000001 Gsm Fundamentals Issue32

9

modified by Ahmed AwnySecurity Level: Internal

Understand the structure of multiframes

On completion of this section you will be able to:

ObjectivesObjectives

Name the 4 most commonly used channel combinations

Identify the types of physical channels and logical channels

Page 10: Oma000001 Gsm Fundamentals Issue32

10

modified by Ahmed AwnySecurity Level: Internal

The physical channel is the medium over which the information is carriedThe logical channels consist of the information carried over the physical channel

The physical channel is the medium over which the information is carriedThe logical channels consist of the information carried over the physical channel

00 1 2 3 4 5 6 7

TDMA FRAME

Timeslot

The information carried in one time slot is called a “burst”

The information carried in one time slot is called a “burst”

Physical and Logical ChannelsPhysical and Logical Channels

Page 11: Oma000001 Gsm Fundamentals Issue32

11

modified by Ahmed AwnySecurity Level: Internal

Logical channels Logical channels

Logical ChannelsLogical ChannelsLogical ChannelsLogical Channels

CCHCCHCCHCCHTCHTCHTCHTCH DATADATADATADATASPEECHSPEECHSPEECHSPEECH

TCH/HRTCH/HR7kbps7kbps

TCH/HRTCH/HR7kbps7kbps

TCH/FRTCH/FR13kbps13kbps

TCH/FRTCH/FR13kbps13kbps

2.4/4.8kbps2.4/4.8kbps((FR&HR)FR&HR)2.4/4.8kbps2.4/4.8kbps((FR&HR)FR&HR) 9.6kbps 9.6kbps FRFR9.6kbps 9.6kbps FRFR

Logical traffic channelsLogical traffic channels

logical channels consist of the information carried over the physical channel.logical channels consist of the information carried over the physical channel.

Page 12: Oma000001 Gsm Fundamentals Issue32

12

modified by Ahmed AwnySecurity Level: Internal

Logical control channelsLogical control channels

CCHCCHCCHCCH

BCHBCHBCHBCHDCHDCHDCHDCH CCCHCCCHCCCHCCCH

SCHSCHSCHSCH

FCCHFCCHFCCHFCCHPCHPCHPCHPCH AGCHAGCHAGCHAGCH RACHRACHRACHRACHSDCCHSDCCHSDCCHSDCCH

BCCHBCCHBCCHBCCH

•Power Control indicator•cell ID , LAI , PLMN code •List of neighboring cells

SACCHSACCHSACCHSACCH

Power & timing controlRSSI & link quality

FACCHFACCHFACCHFACCH

Auth. and HO.

- Frequency-correction channel, used for MS frequency correction.- Frequency-correction channel, used for MS frequency correction.- Synchronization channel, used for MS frame synchronization and BS - Synchronization channel, used for MS frame synchronization and BS identification.identification.

Broadcast control channel, used to send cell information.Broadcast control channel, used to send cell information.-Random access channel, for dedicated channels assignment requestRandom access channel, for dedicated channels assignment request-Access grant channel, used to assign dedicated control channels for the MSAccess grant channel, used to assign dedicated control channels for the MS-Paging channel : used to page (alert) MS Paging channel : used to page (alert) MS -Standalone dedicated channel : Supports the transfer of data during connection Standalone dedicated channel : Supports the transfer of data during connection setupsetup-Slow/Fast associated control channels : carrying information associated with the Slow/Fast associated control channels : carrying information associated with the process being carried out on either the SDCCH or the TCH.process being carried out on either the SDCCH or the TCH.

Page 13: Oma000001 Gsm Fundamentals Issue32

13

modified by Ahmed AwnySecurity Level: Internal

Timeslots and TDMA FramesTimeslots and TDMA Frames

Higher Capacity Cell / more than 1 RF carriermore than 1 RF carrier

Broadcast TrafficDedicated

Traffic00 1 2 3 4 5 6 7

00 1 2 3 4 5 6 7

Low Capacity Cell / 1 RF carrier 1 RF carrier

Combined Traffic

0 1 2 3 4 5 6 7

Page 14: Oma000001 Gsm Fundamentals Issue32

14

modified by Ahmed AwnySecurity Level: Internal

GSM Logical ChannelGSM Logical Channel

Channel Combination• Main BCH combination – BCCH + CCCH (used in TS 0,2,4,6 -

0 is used first )

• DCH combination – SDCCH8 + SACCH8 (used in any time slot

)

• Combined Channel Combination – BCCH + CCCH +SDCC

H4 + SACCH4 (used only in TS0 )

• TCH combination – TCH8/FACCH + SACCH

Page 15: Oma000001 Gsm Fundamentals Issue32

15

modified by Ahmed AwnySecurity Level: Internal

GSM MultiframeGSM Multiframe

TDMA Frames

0 1

0 1 2 43 21 22 23 2524

26 – Frame Multiframes

0 1 10

TRAFFIC CHANNELS

2 3 4 5 6 7 2 3 5 764

Page 16: Oma000001 Gsm Fundamentals Issue32

16

modified by Ahmed AwnySecurity Level: Internal

TCH MultiframeTCH Multiframe

IDLE

SACCH

IDLE

SACCH

25

12

0

This is used to transmit a Traffic Channel Combination (TCH/ SACCH/FACCH). The FACCH is not showed in the diagram as it does not receive its own time allocation. The FACCH steals a time period from the TCH is required.

The 13th frame is used by the SACCH which carriers link control information to and from the mobile and BTS.

The 26th frame is idle in FR.

This is used to transmit a Traffic Channel Combination (TCH/ SACCH/FACCH). The FACCH is not showed in the diagram as it does not receive its own time allocation. The FACCH steals a time period from the TCH is required.

The 13th frame is used by the SACCH which carriers link control information to and from the mobile and BTS.

The 26th frame is idle in FR.

Downlink Uplink

25

12

0

Page 17: Oma000001 Gsm Fundamentals Issue32

17

modified by Ahmed AwnySecurity Level: Internal

TDMA Frames

0 1

0 1 2 43 46 47 48 5049

51 – Frame Multiframes

0 1 10

CONTROL CHANNELS

2 3 4 5 6 7 2 3 5 764

GSM MultiframeGSM Multiframe

Page 18: Oma000001 Gsm Fundamentals Issue32

18

modified by Ahmed AwnySecurity Level: Internal

Combined Multiframe (combination V)Combined Multiframe (combination V)

BSF C CSF C D0SF D1 D2SF D3 A0S A1F I

BSF C CSF C D0SF D1 D2SF D3 A2S A3F I

0 2 6 10 20 30 40 50

Downlink

D3 RR A2 A3 RR R D0 D1 RR D2R

0 4 6 10 20 30 40 50

D3 RR A2 A3 RR R D0 D1 RR D2R

Uplink

R = RACH (Random) B = BCCH (Broadcast)F = FCCH (Frequency) S = SCH (Sync.)C = CCCH (Common) D = SDCCH/4 (Dedicated)A = SACCH/4 (Associated) I = Idle

Page 19: Oma000001 Gsm Fundamentals Issue32

19

modified by Ahmed AwnySecurity Level: Internal

BCCH/CCCH Multiframe (combination IV)BCCH/CCCH Multiframe (combination IV)

F SB B B B

C C C C F F S C C C C C C C CI

Downlink

0 10 20 30 40 50

S C C .. F S C C .. F S C C ..

R R R R R R R R R R R R R R R R R R R R R R

Uplink

R R R .. R R R ..R R R ..

0 10 20 30 40 50

F = FCCH (Frequency) S = SCH (Sync.)C = CCCH (Common) PCH/AGCHI = Idle R = RACH (Random)

Page 20: Oma000001 Gsm Fundamentals Issue32

20

modified by Ahmed AwnySecurity Level: Internal

D0 D1 D7 A0 A3 I I I

D0 D1 D6 D7 A4 A7 I I I

A5 A6 D0 D7 A0A7 I I I

A1 A2 D0 D7 A4A3 I I I

Downlink

0 7 24 32 44 50

0 7 12 15 44 50

Uplink

D = SDCCH/8 (Dedicated) A = SACCH/C8 (Associated) I = Idle

D6

SDCCH Multiframe (combination VII)SDCCH Multiframe (combination VII)

Page 21: Oma000001 Gsm Fundamentals Issue32

21

modified by Ahmed AwnySecurity Level: Internal

Frames hierarchy Frames hierarchy

The hyper frame lasts for over 3 hours, after which ciphering and FH algorithms are restarted.The hyper frame lasts for over 3 hours, after which ciphering and FH algorithms are restarted.

Occurrence of same frame number is every 1 superframe where TCH is always moving relative Occurrence of same frame number is every 1 superframe where TCH is always moving relative to CCH to enable the receiver to receive other BTSs system information during Idle periods.to CCH to enable the receiver to receive other BTSs system information during Idle periods.

Page 22: Oma000001 Gsm Fundamentals Issue32

22

modified by Ahmed AwnySecurity Level: Internal

Contents Contents haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network ComponentsGSM Network Components

Terrestrial Interface

Service Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio Technologies

Page 23: Oma000001 Gsm Fundamentals Issue32

23

modified by Ahmed AwnySecurity Level: Internal

On completion of this section you will be able to:

Draw the structure of GSM

Identify the functions of each component

ObjectivesObjectives

Page 24: Oma000001 Gsm Fundamentals Issue32

24

modified by Ahmed AwnySecurity Level: Internal

PSTPSTN N

OthOther er GSGSM M

OMCOMC

GSM network architectureGSM network architecture

Permanent data:Permanent data:

-IMSIIMSI

-Suppl. service info .Suppl. service info .

-Authentication key Authentication key

-Roaming & billing info Roaming & billing info

Temporary data:Temporary data:

-MSC/VLR address-MSC/VLR address

-SMS gateways ID-SMS gateways ID

-Response to Auth.-Response to Auth.

Temporary data:Temporary data:

-copy of most of data for -copy of most of data for active subscribers in VLR active subscribers in VLR coverage coverage

-Mobile status-Mobile status

-LAI-LAI

-current MSC ID-current MSC ID

-TMSI-TMSI

Mobile Station : - Mobile Equipment contains IMEI for ME identification Mobile Station : - Mobile Equipment contains IMEI for ME identification - Subscriber Identity module contains IMSI,TMSI,LAI,Auth. key - Subscriber Identity module contains IMSI,TMSI,LAI,Auth. key

Base Transceiver Station : the first access point for mobile stations to access the Base Transceiver Station : the first access point for mobile stations to access the networknetworkBase Station Controller : controls one or more BTSs and interfaces BSS to NSSBase Station Controller : controls one or more BTSs and interfaces BSS to NSSMobile Station Controller : controls one or more BSCs and manages switching Mobile Station Controller : controls one or more BSCs and manages switching

White list :White list :

Valid mobiles Valid mobiles

Black list :Black list :

Stolen or forbidden Stolen or forbidden

Gray list :Gray list :

Faulty mobilesFaulty mobiles

Page 25: Oma000001 Gsm Fundamentals Issue32

25

modified by Ahmed AwnySecurity Level: Internal

GSM network architectureGSM network architecture

Page 26: Oma000001 Gsm Fundamentals Issue32

26

modified by Ahmed AwnySecurity Level: Internal

Subscriber Identity Module – SIMSubscriber Identity Module – SIM

Page 27: Oma000001 Gsm Fundamentals Issue32

27

modified by Ahmed AwnySecurity Level: Internal

Transcoder and submultiplexerTranscoder and submultiplexer

30 x 64k voice channels = 120 x 16k compressed/combined = 2Mbps PCM link

Page 28: Oma000001 Gsm Fundamentals Issue32

28

modified by Ahmed AwnySecurity Level: Internal

Mobile Switching Center – MSC Home Location Register – HLR Visitor Location Register – VLR Equipment Identity Register – EIR Authentication Center – AUC Inter-Working Function – IWFEcho Cancellor – EC

Mobile Switching Center – MSC Home Location Register – HLR Visitor Location Register – VLR Equipment Identity Register – EIR Authentication Center – AUC Inter-Working Function – IWFEcho Cancellor – EC

AUCAUCHLRHLR

MSC/VLRMSC/VLR

PSTN

NSS

EIREIROMC

BSS

ECEC

IWFIWF

The Network Switching SystemThe Network Switching System

Page 29: Oma000001 Gsm Fundamentals Issue32

29

modified by Ahmed AwnySecurity Level: Internal

• Rate Conversion• Protocol Adaptation

PSTN

MSCMSC

ECEC IWF

Inter-Working Function – IWFInter-Working Function – IWF

Page 30: Oma000001 Gsm Fundamentals Issue32

30

modified by Ahmed AwnySecurity Level: Internal

Echo takes place by GSM system delay caused by call processing,speech encoding and decoding etc.An Echo Canceller is used on the PSTN side of the MSC for all voice circuits

2-wire4-wire

2- wire

Hybrid Hybrid

Generation of Echo at 2-wire to 4-wire Interface

Echo Canceller - ECEcho Canceller - EC

Page 31: Oma000001 Gsm Fundamentals Issue32

31

modified by Ahmed AwnySecurity Level: Internal

OSS(NMC)

OMCOMC

OMC

Region2

Region 1

Region 3

Operation and Maintenance Sub SystemOperation and Maintenance Sub System

Page 32: Oma000001 Gsm Fundamentals Issue32

32

modified by Ahmed AwnySecurity Level: Internal

Operation and Maintenance Center – OMC Operation and Maintenance Center – OMC

OMC – R: OMC assigned specifically to the Base Station Subsystem

OMC – S: OMC assigned specifically to the Network Switching Subsystem

Page 33: Oma000001 Gsm Fundamentals Issue32

33

modified by Ahmed AwnySecurity Level: Internal

OMC Functional ArchitectureOMC Functional Architecture

OS

MMI

DB

Event/AlarmManagement

SecurityManagement

ConfigurationManagement

Performance Management

Fault Management

Page 34: Oma000001 Gsm Fundamentals Issue32

34

modified by Ahmed AwnySecurity Level: Internal

Mobile to Landline callMobile to Landline call

MS BSS MSC VLR HLR CHANNEL REQUEST <RACH>

<AGCH>DCCH ASSIGN

<SDCCH>

SIGNALING LINK ESTABLISHED

REQ. FOR SERVICECR

CC

AUTHENTICATION

SET Cipher MODE

SET-UP <SDCCH>

Call Info EQUIP. ID REQ.

COMPLETE CALL

CALL PROCEEDING <SDCCH>

PSTN

SFOC

services Auth.

Page 35: Oma000001 Gsm Fundamentals Issue32

35

modified by Ahmed AwnySecurity Level: Internal

Mobile to Landline callMobile to Landline call

ASSIG. COMMAND<SDCCH>

ASSIG. COMPLETE

Address Complete(ACM)

Alerting

<FACCH>

Answer (ANS)Connect

TCH connect

<TCH>

Initial and Final Address Message (IAM)

MS hears ring tone from land phone

<FACCH>

Ring tone stops

MS BSS MSC VLR HLR PSTN

Connect Acknowledge<FACCH>

BILLINGBILLING

ISUP (IAM)ISUP (IAM)

(ACM) (ACM)

+ alerting + alerting

ANSANS

Conn.

Conn. ack

Page 36: Oma000001 Gsm Fundamentals Issue32

36

modified by Ahmed AwnySecurity Level: Internal

Contents Contents haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network ComponentsGSM Network Components

Terrestrial Interface

Service Area and Number PlanningService Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio Technologies

Page 37: Oma000001 Gsm Fundamentals Issue32

37

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

On completion of this section you will be able to:

Identify the system identification number

Identify the of mobile identification number

Identify the cell identification number

ObjectivesObjectives

Page 38: Oma000001 Gsm Fundamentals Issue32

38

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: Service AreaService Area

PLMN service area

......

System area

PLMN service area

MSC service area...

Location area...

Base station area...

Radio cell

...... ......

MSC service area...

Location area...

Base station area...

Radio cell

PLMN service area

Page 39: Oma000001 Gsm Fundamentals Issue32

39

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: MSC/VLR NumberMSC/VLR Number

The format is CC+NDC+LSPCC : Country Code. For example: The CC of China is "86".

NDC : National Destination Code. For example: The NDC of China Mobile is 139 、 138 、 137 、 136 、 135.

LSP(locally significant part): is defined by Telecom operator.For example: 86-139-00311

CC NDC LSP

MSC/VLR number

Page 40: Oma000001 Gsm Fundamentals Issue32

40

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: HLR NumberHLR Number

The format is : CC+NDC+H0 H1 H2 H3 0000.CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of China Mobile is 139 、138 、 137 、 136 、 135.H0H1H2H3 is defined by Telecom operator.For example: 86-139-0666-0000.

The format is : CC+NDC+H0 H1 H2 H3 0000.CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of China Mobile is 139 、138 、 137 、 136 、 135.H0H1H2H3 is defined by Telecom operator.For example: 86-139-0666-0000.

CC NDC H0H1H2H3

HLR number

Page 41: Oma000001 Gsm Fundamentals Issue32

41

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: LAILAI

Location Area Identification

The LAI is the international code for a location area.

MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460"MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Mobile is "00"LAC : Location Area Code , It is a two bytes BCD

code(hex). The value 0000 and FFFF is invalid.For example: 460-00-0011

MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460"MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Mobile is "00"LAC : Location Area Code , It is a two bytes BCD

code(hex). The value 0000 and FFFF is invalid.For example: 460-00-0011

MCC MNC LAC

Page 42: Oma000001 Gsm Fundamentals Issue32

42

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: CGICGI

The CGI is a unique international identification for a cell

The format is LAI+CI

LAI: Location Area Identification

CI : Cell Identity. This code uses two bytes BCD

code(hex) to identify the radio cells within an LAI.

For example : 460-00-0011-0001

The CGI is a unique international identification for a cell

The format is LAI+CI

LAI: Location Area Identification

CI : Cell Identity. This code uses two bytes BCD

code(hex) to identify the radio cells within an LAI.

For example : 460-00-0011-0001

CGI: Cell Global Identification

Page 43: Oma000001 Gsm Fundamentals Issue32

43

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: BSICBSIC

NCC : PLMN network color code. It comprises 3 bit. It allows various neighboring PLMNs to be distinguished.BCC : BTS color code. It comprises 3 bit. It allows distinction between different radio frequency channels using the same frequency in neighboring cells (used in clustering).

NCC : PLMN network color code. It comprises 3 bit. It allows various neighboring PLMNs to be distinguished.BCC : BTS color code. It comprises 3 bit. It allows distinction between different radio frequency channels using the same frequency in neighboring cells (used in clustering).

NCC BCC

BSIC

BSIC ( Base Station Identification Color Code)

Page 44: Oma000001 Gsm Fundamentals Issue32

44

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of

China Telecom is 139, 138, 137, 136, 135.SN : Subscriber Number. Format:H0 H1 H2 H3 ABCDExample: 86-139-0666-1234

CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of

China Telecom is 139, 138, 137, 136, 135.SN : Subscriber Number. Format:H0 H1 H2 H3 ABCDExample: 86-139-0666-1234

MSISDNMSISDN

CC NDC SN

National (significant)Mobile number

Mobile station internationalISDN number

Page 45: Oma000001 Gsm Fundamentals Issue32

45

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460" 。MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Telecom is "00" 。MSIN : Mobile Subscriber Identification Number. H1H2H3 S

ABCDEF For example: 666-9777001NMSI : National Mobile Subscriber Identification , MNC and MSIN

form it together. For Example of IMSI : 460-00-666-9777001

MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460" 。MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Telecom is "00" 。MSIN : Mobile Subscriber Identification Number. H1H2H3 S

ABCDEF For example: 666-9777001NMSI : National Mobile Subscriber Identification , MNC and MSIN

form it together. For Example of IMSI : 460-00-666-9777001

Not more than 15 digits

3 digits 2 digits

IMSI

MCC MNC MSIN

NMSI

IMSI IMSI

Page 46: Oma000001 Gsm Fundamentals Issue32

46

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

The TMSI is assigned only after successful subscriber authentication.

The VLR controls the allocation of new TMSI numbers and notifies them to the HLR.

TMSI is used to ensure that the identity of the mobile subscriber on the air interface is kept secret.

The TMSI consists of 4 bytes( 8 HEX numbers) and determined by the telecom operator.

The TMSI is assigned only after successful subscriber authentication.

The VLR controls the allocation of new TMSI numbers and notifies them to the HLR.

TMSI is used to ensure that the identity of the mobile subscriber on the air interface is kept secret.

The TMSI consists of 4 bytes( 8 HEX numbers) and determined by the telecom operator.

TMSITMSI

TMSI: Temporary Mobile Subscriber Identification)

Page 47: Oma000001 Gsm Fundamentals Issue32

47

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: IMEIIMEI

TAC FAC SNR SP

IMEI

TAC : Type approval code. It is administered by the type approval center.

FAC : Final assembly code.It is administered by the manufacturer.

SNR : Serial number.It is issued by the manufacturer of the MS.

SP : Not used.

TAC : Type approval code. It is administered by the type approval center.

FAC : Final assembly code.It is administered by the manufacturer.

SNR : Serial number.It is issued by the manufacturer of the MS.

SP : Not used.

IMEI: International Mobile Station Equipment Identification

Page 48: Oma000001 Gsm Fundamentals Issue32

48

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: MSRN/HONMSRN/HON

The MSRN is used to route the call to the MSC to which MS is currently connected.

The HON is used by the MSC-A to set up a connection to the MSC-B during handover process

Usually, MSRN and HON share the same numbering plan. The format is CC+NDC+individual number. CC and NDC is the

same as that of MSISDN. The individual number is taken from a pool of numbers specially reserved for MSRN.

The MSRN is used to route the call to the MSC to which MS is currently connected.

The HON is used by the MSC-A to set up a connection to the MSC-B during handover process

Usually, MSRN and HON share the same numbering plan. The format is CC+NDC+individual number. CC and NDC is the

same as that of MSISDN. The individual number is taken from a pool of numbers specially reserved for MSRN.

MSRN: Mobile Subscriber Roaming Number

HON: Hand-over NumberHLRHLR

MSRNMSRNGMSCGMSC MSC / VLRMSC / VLRIncoming CallIncoming Call

MSISDNMSISDN

(1) MSISDN(1) MSISDN (2) IMSI(2) IMSI

(4) MSRN(4) MSRN (3) MSRN(3) MSRN

Page 49: Oma000001 Gsm Fundamentals Issue32

49

modified by Ahmed AwnySecurity Level: Internal

Contents Contents haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network ComponentsGSM Network Components

Terrestrial InterfaceTerrestrial Interface

Service Area and Number PlanningService Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio Technologies

Page 50: Oma000001 Gsm Fundamentals Issue32

50

modified by Ahmed AwnySecurity Level: Internal

On completion of this section you will be able to:

Identify the protocols used on the terrestrial interfaces between the GSM system entities

ObjectivesObjectives

Page 51: Oma000001 Gsm Fundamentals Issue32

51

modified by Ahmed AwnySecurity Level: Internal

HLR

VLR

MSC

EIR

AUC

EC IWF

TC

VLR

MSC

IWF EC

BTS BSCMS

B

H

F

G

A

E

C

D

Um Abis

GSM InterfaceGSM Interface

Page 52: Oma000001 Gsm Fundamentals Issue32

52

modified by Ahmed AwnySecurity Level: Internal

Protocol layers architectureProtocol layers architecture

CMCM

MMMM

RRRR

MMMM

LAPDmLAPDm

radioradio

LAPDmLAPDm

radioradio

LAPDLAPD

PCMPCM

RR’ RR’ BTSMBTSM

CMCM

LAPDLAPD

PCMPCM

RR’RR’BTSM BTSM

16 kbit/s16 kbit/s

UUmm AAbisbis AA

SS7SS7

PCMPCM

SS7SS7

PCMPCM

64 kbit/s 64 kbit/s

MSMS BTSBTS BSCBSC MSCMSC

BSSAPBSSAPBSSAPBSSAP

Physical layer : RF between MS and BTS and PCM between BTS and MSCPhysical layer : RF between MS and BTS and PCM between BTS and MSCLink layer : LAPD between BTS and BSC , modified LAPD between MS and BTS Link layer : LAPD between BTS and BSC , modified LAPD between MS and BTS and MTP L2 between BSC and MSCand MTP L2 between BSC and MSCRadio Resources : for RR management between MS and BSC Radio Resources : for RR management between MS and BSC DTAP and BSSAP between BSC and MSCDTAP and BSSAP between BSC and MSCMM & CM : mobility management and connection management between MS and MM & CM : mobility management and connection management between MS and MSCMSC

Page 53: Oma000001 Gsm Fundamentals Issue32

53

modified by Ahmed AwnySecurity Level: Internal

Typical Configuration

TS 0 TS 1-15 TS16 TS 17-31

TS = Time slot

TS# Used for

0

1-15

16

17-31

Frame Alignment /Error Checking /Signaling

Traffic

CCS7 Signaling (Other TS may also the used)

Traffic

2MBps Trunks2MBps Trunks

Page 54: Oma000001 Gsm Fundamentals Issue32

54

modified by Ahmed AwnySecurity Level: Internal

Abis (LAPD) InterfacesAbis (LAPD) Interfaces

FlagAddressControlInformationFrame check Sequence

Flag

last bit first bit

Page 55: Oma000001 Gsm Fundamentals Issue32

55

modified by Ahmed AwnySecurity Level: Internal

OSI Layers

7. Application

6. Presentation

5. Session

4. Transport

3. Network

2. Link

1 Physical

CCS7 Levels

MTP Level 1 2 Mb/s Trunk

MTP Level 3

TUP

SCCP

BSSAP(DTAP+BSSMAP)ISUP

MAP

TCAP

MTP Level 2

ITU Signaling System CCS7 ITU Signaling System CCS7

Page 56: Oma000001 Gsm Fundamentals Issue32

56

modified by Ahmed AwnySecurity Level: Internal

Abbreviation of CCS7Abbreviation of CCS7

MTP Message Transfer Part TCAP Transaction Capabilities Application Part SCCP Signaling Connection Control Part TUP Telephone User Part ISUP ISDN User Part MAP Mobile Application Part BSSAP Base Station System Application Part BSSMAP BSS Management Application Part DTAP Direct Transfer Application Part

MTP Message Transfer Part TCAP Transaction Capabilities Application Part SCCP Signaling Connection Control Part TUP Telephone User Part ISUP ISDN User Part MAP Mobile Application Part BSSAP Base Station System Application Part BSSMAP BSS Management Application Part DTAP Direct Transfer Application Part

Page 57: Oma000001 Gsm Fundamentals Issue32

57

modified by Ahmed AwnySecurity Level: Internal

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:

haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: Contents Contents

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network ComponentsGSM Network Components

Terrestrial InterfaceTerrestrial Interface

Service Area and Number PlanningService Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio TechnologiesRadio Technologies

Page 58: Oma000001 Gsm Fundamentals Issue32

58

modified by Ahmed AwnySecurity Level: Internal

On completion of this section you will be able to know about the following radio technologies :

GMSK Modulation Techniques

Power Control

VAD, DTX, DRX

Diversity

Frequency Hopping

ObjectivesObjectives

Page 59: Oma000001 Gsm Fundamentals Issue32

59

modified by Ahmed AwnySecurity Level: Internal

Modulation TechniquesModulation Techniques

– phase modulation can be implemented easily for digital signals, this is the method which is used for the GSM air interfaces. Phase Modulation is known as Phase Shift Keying when applied to digital signals

– phase modulation can be implemented easily for digital signals, this is the method which is used for the GSM air interfaces. Phase Modulation is known as Phase Shift Keying when applied to digital signals

Amplitude Shift Keying (ASK)

Frequency Shift Keying (FSK)

Phase Shift Keying (PSK)

Page 60: Oma000001 Gsm Fundamentals Issue32

60

modified by Ahmed AwnySecurity Level: Internal

1 0 0 1 1 GaussianDigital Filter

Phase Modulator

Gaussian Minimum Shift Keying (GMSK) Gaussian Minimum Shift Keying (GMSK)

Page 61: Oma000001 Gsm Fundamentals Issue32

61

modified by Ahmed AwnySecurity Level: Internal

Battery LifeBattery Life

Power ControlPower Control

Voice Activity Detection – VAD

Discontinuous Transmission – DTX

Discontinuous Reception – DRX

Page 62: Oma000001 Gsm Fundamentals Issue32

62

modified by Ahmed AwnySecurity Level: Internal

Power ControlPower Control

Saves radio battery powerReduces co-channel andadjacent channel interference

8W

0.8W

5W

Both Uplink and Downlink power settings can be controlled independently and individually.

Page 63: Oma000001 Gsm Fundamentals Issue32

63

modified by Ahmed AwnySecurity Level: Internal

VAD & DTXVAD & DTX

Encoding the speech silences at a rate of 500 bit/s rather than the full 13Kb/s.

If the mobile does not transmit during ‘silence’ there is a reduction in the overall power output requirement

Without DTX

With DTX

Comfort Noise

Page 64: Oma000001 Gsm Fundamentals Issue32

64

modified by Ahmed AwnySecurity Level: Internal

DRXDRX

PCH is structured so that MS knows when it needs to check for a paging signal.  In the time between paging signals, the mobile can go into sleep mode, when almost no power is used.

P P P P P P BCCH P P

BCCH Multiframe P = Paging Channel

MS Being paged

MS in listen mode

MS receive System

information

MS in listen mode

Page 65: Oma000001 Gsm Fundamentals Issue32

65

modified by Ahmed AwnySecurity Level: Internal

Multipath FadingMultipath Fading

•Diversity

•Frequency Hopping

Time Dispersion

Page 66: Oma000001 Gsm Fundamentals Issue32

66

modified by Ahmed AwnySecurity Level: Internal

DiversityDiversity

When diversity is implemented two antennas are situated at the receiver. These antennas are placed several wavelengths apart to ensure minimum correlation between the two receive paths.

The two signals are then combined, this ensures that a low signal strength is less likely to occur.

Compare oradd signals

Resultant Signal

Approx. 10 wavelengths

Page 67: Oma000001 Gsm Fundamentals Issue32

67

modified by Ahmed AwnySecurity Level: Internal

Frequency HoppingFrequency Hopping

RF Hopping :each timeslot on a given transceiver can transmit at a different frequency

Baseband Hopping: each transceiver stays at the same frequency and the data is switched to the appropriate transceiver.

Each time the BTS or mobile transmits a burst, it does so on a different RF carrier frequency.

time

frequency

Page 68: Oma000001 Gsm Fundamentals Issue32

68

modified by Ahmed AwnySecurity Level: Internal

SummarySummary

Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System

GSM Network ComponentsGSM Network Components

Terrestrial InterfaceTerrestrial Interface

Service Area and Number PlanningService Area and Number Planning

Channels on The Air InterfaceChannels on The Air Interface

Radio TechnologiesRadio Technologies

Page 69: Oma000001 Gsm Fundamentals Issue32

69

modified by Ahmed AwnySecurity Level: Internal

Page 70: Oma000001 Gsm Fundamentals Issue32

70

modified by Ahmed AwnySecurity Level: Internal

1999 2000 2001

57.6 kbps

115 kbps

384 kbps

2 Mbps

GSM

HSCSD

GPRS

EDGE

IMT-2000

9.6 kbps

2G

2.5G

3G

GSM Develop PathGSM Develop Path