oma000001 gsm fundamentals issue32
TRANSCRIPT
modified by Ahmed Awny
Wireless Curriculum Development SectionWireless Curriculum Development SectionWireless Curriculum Development SectionWireless Curriculum Development Section
ISSUEISSUE 3.23.2
GSM FundamentalsGSM FundamentalsGSM FundamentalsGSM Fundamentals
2
modified by Ahmed AwnySecurity Level: Internal
Contents Contents haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network Components
Terrestrial Interface
Service Area and Number Planning
Channels on The Air Interface
Radio Technologies
3
modified by Ahmed AwnySecurity Level: Internal
ObjectivesObjectiveshaoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Name the two different cell types and understand why and when each would be used.
Get the concept of frequency reuse.
Name the frequency spectrum used in GSM
Name the two different cell types and understand why and when each would be used.
Get the concept of frequency reuse.
Name the frequency spectrum used in GSM
On completion of this section you will be able to:
4
modified by Ahmed AwnySecurity Level: Internal
CELLCELL
Omni
1
120degree
1
23
Omni-Directional CellsOmni-Directional Cells
120 Degree Sectors120 Degree Sectors
5
modified by Ahmed AwnySecurity Level: Internal
Cell conceptCell concept
HighwayHighway
TownTownSuburbSuburb
RuralRural
• Flexible network planning based on location nature Flexible network planning based on location nature
• Smooth Handover (no service degradation while subscriber moves)Smooth Handover (no service degradation while subscriber moves)
• Frequency reuse (same group of frequencies used in different cells)Frequency reuse (same group of frequencies used in different cells)
Signal Signal strengthstrength
distancedistance
• Cell : basic service area that can be efficiently managed by the network
• One base station per cell for comm. between MS and the network
• Cell boundaries are defined by BS signal strength
6
modified by Ahmed AwnySecurity Level: Internal
25 MHz Uplink (MS to BS)
25 MHz Downlink (BS to MS)
f
200 KHz
915 MHz890 MHz
……
960 MHz935 MHz
45 MHz duplex spacing
Frequency Spectrum GSM 900Frequency Spectrum GSM 900
……
For DCS1800 , downlink is from 1805 to 1880MHz , uplink from 1710 to 1785MHz 75Mhz , 374 RF carriers each . Frequencies are separated by 95MHz.
t
f
200 KHz
……
200 KHz x 125 = 25 MHz
1 TDMA frame = 0.577 m
s x 8 TS
……
915 MHz
890 MHz
Physical channelsPhysical channels
7
modified by Ahmed AwnySecurity Level: Internal
GSM delays uplink TDMA framesGSM delays uplink TDMA framesGSM delays uplink TDMA framesGSM delays uplink TDMA frames
T1 T2 T3 T5 T6 T7T4 T8
R T
R T
R1 R2 R3 R5 R6 R7R4 R8
Uplink TDMA Frame
F1 + 45MHz
Downlink TDMA F1MHz
The start of the uplink TDMA is delayed of
three time slotsTDMA frame (4.615 ms)
Fixed transmit Delay of three time-slots
8
modified by Ahmed AwnySecurity Level: Internal
Contents Contents haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network Components
Terrestrial Interface
Service Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio Technologies
9
modified by Ahmed AwnySecurity Level: Internal
Understand the structure of multiframes
On completion of this section you will be able to:
ObjectivesObjectives
Name the 4 most commonly used channel combinations
Identify the types of physical channels and logical channels
10
modified by Ahmed AwnySecurity Level: Internal
The physical channel is the medium over which the information is carriedThe logical channels consist of the information carried over the physical channel
The physical channel is the medium over which the information is carriedThe logical channels consist of the information carried over the physical channel
00 1 2 3 4 5 6 7
TDMA FRAME
Timeslot
The information carried in one time slot is called a “burst”
The information carried in one time slot is called a “burst”
Physical and Logical ChannelsPhysical and Logical Channels
11
modified by Ahmed AwnySecurity Level: Internal
Logical channels Logical channels
Logical ChannelsLogical ChannelsLogical ChannelsLogical Channels
CCHCCHCCHCCHTCHTCHTCHTCH DATADATADATADATASPEECHSPEECHSPEECHSPEECH
TCH/HRTCH/HR7kbps7kbps
TCH/HRTCH/HR7kbps7kbps
TCH/FRTCH/FR13kbps13kbps
TCH/FRTCH/FR13kbps13kbps
2.4/4.8kbps2.4/4.8kbps((FR&HR)FR&HR)2.4/4.8kbps2.4/4.8kbps((FR&HR)FR&HR) 9.6kbps 9.6kbps FRFR9.6kbps 9.6kbps FRFR
Logical traffic channelsLogical traffic channels
logical channels consist of the information carried over the physical channel.logical channels consist of the information carried over the physical channel.
12
modified by Ahmed AwnySecurity Level: Internal
Logical control channelsLogical control channels
CCHCCHCCHCCH
BCHBCHBCHBCHDCHDCHDCHDCH CCCHCCCHCCCHCCCH
SCHSCHSCHSCH
FCCHFCCHFCCHFCCHPCHPCHPCHPCH AGCHAGCHAGCHAGCH RACHRACHRACHRACHSDCCHSDCCHSDCCHSDCCH
BCCHBCCHBCCHBCCH
•Power Control indicator•cell ID , LAI , PLMN code •List of neighboring cells
SACCHSACCHSACCHSACCH
Power & timing controlRSSI & link quality
FACCHFACCHFACCHFACCH
Auth. and HO.
- Frequency-correction channel, used for MS frequency correction.- Frequency-correction channel, used for MS frequency correction.- Synchronization channel, used for MS frame synchronization and BS - Synchronization channel, used for MS frame synchronization and BS identification.identification.
Broadcast control channel, used to send cell information.Broadcast control channel, used to send cell information.-Random access channel, for dedicated channels assignment requestRandom access channel, for dedicated channels assignment request-Access grant channel, used to assign dedicated control channels for the MSAccess grant channel, used to assign dedicated control channels for the MS-Paging channel : used to page (alert) MS Paging channel : used to page (alert) MS -Standalone dedicated channel : Supports the transfer of data during connection Standalone dedicated channel : Supports the transfer of data during connection setupsetup-Slow/Fast associated control channels : carrying information associated with the Slow/Fast associated control channels : carrying information associated with the process being carried out on either the SDCCH or the TCH.process being carried out on either the SDCCH or the TCH.
13
modified by Ahmed AwnySecurity Level: Internal
Timeslots and TDMA FramesTimeslots and TDMA Frames
Higher Capacity Cell / more than 1 RF carriermore than 1 RF carrier
Broadcast TrafficDedicated
Traffic00 1 2 3 4 5 6 7
00 1 2 3 4 5 6 7
Low Capacity Cell / 1 RF carrier 1 RF carrier
Combined Traffic
0 1 2 3 4 5 6 7
14
modified by Ahmed AwnySecurity Level: Internal
GSM Logical ChannelGSM Logical Channel
Channel Combination• Main BCH combination – BCCH + CCCH (used in TS 0,2,4,6 -
0 is used first )
• DCH combination – SDCCH8 + SACCH8 (used in any time slot
)
• Combined Channel Combination – BCCH + CCCH +SDCC
H4 + SACCH4 (used only in TS0 )
• TCH combination – TCH8/FACCH + SACCH
15
modified by Ahmed AwnySecurity Level: Internal
GSM MultiframeGSM Multiframe
TDMA Frames
0 1
0 1 2 43 21 22 23 2524
26 – Frame Multiframes
0 1 10
TRAFFIC CHANNELS
2 3 4 5 6 7 2 3 5 764
16
modified by Ahmed AwnySecurity Level: Internal
TCH MultiframeTCH Multiframe
IDLE
SACCH
IDLE
SACCH
25
12
0
This is used to transmit a Traffic Channel Combination (TCH/ SACCH/FACCH). The FACCH is not showed in the diagram as it does not receive its own time allocation. The FACCH steals a time period from the TCH is required.
The 13th frame is used by the SACCH which carriers link control information to and from the mobile and BTS.
The 26th frame is idle in FR.
This is used to transmit a Traffic Channel Combination (TCH/ SACCH/FACCH). The FACCH is not showed in the diagram as it does not receive its own time allocation. The FACCH steals a time period from the TCH is required.
The 13th frame is used by the SACCH which carriers link control information to and from the mobile and BTS.
The 26th frame is idle in FR.
Downlink Uplink
25
12
0
17
modified by Ahmed AwnySecurity Level: Internal
TDMA Frames
0 1
0 1 2 43 46 47 48 5049
51 – Frame Multiframes
0 1 10
CONTROL CHANNELS
2 3 4 5 6 7 2 3 5 764
GSM MultiframeGSM Multiframe
18
modified by Ahmed AwnySecurity Level: Internal
Combined Multiframe (combination V)Combined Multiframe (combination V)
BSF C CSF C D0SF D1 D2SF D3 A0S A1F I
BSF C CSF C D0SF D1 D2SF D3 A2S A3F I
0 2 6 10 20 30 40 50
Downlink
D3 RR A2 A3 RR R D0 D1 RR D2R
0 4 6 10 20 30 40 50
D3 RR A2 A3 RR R D0 D1 RR D2R
Uplink
R = RACH (Random) B = BCCH (Broadcast)F = FCCH (Frequency) S = SCH (Sync.)C = CCCH (Common) D = SDCCH/4 (Dedicated)A = SACCH/4 (Associated) I = Idle
19
modified by Ahmed AwnySecurity Level: Internal
BCCH/CCCH Multiframe (combination IV)BCCH/CCCH Multiframe (combination IV)
F SB B B B
C C C C F F S C C C C C C C CI
Downlink
0 10 20 30 40 50
S C C .. F S C C .. F S C C ..
R R R R R R R R R R R R R R R R R R R R R R
Uplink
R R R .. R R R ..R R R ..
0 10 20 30 40 50
F = FCCH (Frequency) S = SCH (Sync.)C = CCCH (Common) PCH/AGCHI = Idle R = RACH (Random)
20
modified by Ahmed AwnySecurity Level: Internal
D0 D1 D7 A0 A3 I I I
D0 D1 D6 D7 A4 A7 I I I
A5 A6 D0 D7 A0A7 I I I
A1 A2 D0 D7 A4A3 I I I
Downlink
0 7 24 32 44 50
0 7 12 15 44 50
Uplink
D = SDCCH/8 (Dedicated) A = SACCH/C8 (Associated) I = Idle
D6
SDCCH Multiframe (combination VII)SDCCH Multiframe (combination VII)
21
modified by Ahmed AwnySecurity Level: Internal
Frames hierarchy Frames hierarchy
The hyper frame lasts for over 3 hours, after which ciphering and FH algorithms are restarted.The hyper frame lasts for over 3 hours, after which ciphering and FH algorithms are restarted.
Occurrence of same frame number is every 1 superframe where TCH is always moving relative Occurrence of same frame number is every 1 superframe where TCH is always moving relative to CCH to enable the receiver to receive other BTSs system information during Idle periods.to CCH to enable the receiver to receive other BTSs system information during Idle periods.
22
modified by Ahmed AwnySecurity Level: Internal
Contents Contents haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network ComponentsGSM Network Components
Terrestrial Interface
Service Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio Technologies
23
modified by Ahmed AwnySecurity Level: Internal
On completion of this section you will be able to:
Draw the structure of GSM
Identify the functions of each component
ObjectivesObjectives
24
modified by Ahmed AwnySecurity Level: Internal
PSTPSTN N
OthOther er GSGSM M
OMCOMC
GSM network architectureGSM network architecture
Permanent data:Permanent data:
-IMSIIMSI
-Suppl. service info .Suppl. service info .
-Authentication key Authentication key
-Roaming & billing info Roaming & billing info
Temporary data:Temporary data:
-MSC/VLR address-MSC/VLR address
-SMS gateways ID-SMS gateways ID
-Response to Auth.-Response to Auth.
Temporary data:Temporary data:
-copy of most of data for -copy of most of data for active subscribers in VLR active subscribers in VLR coverage coverage
-Mobile status-Mobile status
-LAI-LAI
-current MSC ID-current MSC ID
-TMSI-TMSI
Mobile Station : - Mobile Equipment contains IMEI for ME identification Mobile Station : - Mobile Equipment contains IMEI for ME identification - Subscriber Identity module contains IMSI,TMSI,LAI,Auth. key - Subscriber Identity module contains IMSI,TMSI,LAI,Auth. key
Base Transceiver Station : the first access point for mobile stations to access the Base Transceiver Station : the first access point for mobile stations to access the networknetworkBase Station Controller : controls one or more BTSs and interfaces BSS to NSSBase Station Controller : controls one or more BTSs and interfaces BSS to NSSMobile Station Controller : controls one or more BSCs and manages switching Mobile Station Controller : controls one or more BSCs and manages switching
White list :White list :
Valid mobiles Valid mobiles
Black list :Black list :
Stolen or forbidden Stolen or forbidden
Gray list :Gray list :
Faulty mobilesFaulty mobiles
25
modified by Ahmed AwnySecurity Level: Internal
GSM network architectureGSM network architecture
26
modified by Ahmed AwnySecurity Level: Internal
Subscriber Identity Module – SIMSubscriber Identity Module – SIM
27
modified by Ahmed AwnySecurity Level: Internal
Transcoder and submultiplexerTranscoder and submultiplexer
30 x 64k voice channels = 120 x 16k compressed/combined = 2Mbps PCM link
28
modified by Ahmed AwnySecurity Level: Internal
Mobile Switching Center – MSC Home Location Register – HLR Visitor Location Register – VLR Equipment Identity Register – EIR Authentication Center – AUC Inter-Working Function – IWFEcho Cancellor – EC
Mobile Switching Center – MSC Home Location Register – HLR Visitor Location Register – VLR Equipment Identity Register – EIR Authentication Center – AUC Inter-Working Function – IWFEcho Cancellor – EC
AUCAUCHLRHLR
MSC/VLRMSC/VLR
PSTN
NSS
EIREIROMC
BSS
ECEC
IWFIWF
The Network Switching SystemThe Network Switching System
29
modified by Ahmed AwnySecurity Level: Internal
• Rate Conversion• Protocol Adaptation
PSTN
MSCMSC
ECEC IWF
Inter-Working Function – IWFInter-Working Function – IWF
30
modified by Ahmed AwnySecurity Level: Internal
Echo takes place by GSM system delay caused by call processing,speech encoding and decoding etc.An Echo Canceller is used on the PSTN side of the MSC for all voice circuits
2-wire4-wire
2- wire
Hybrid Hybrid
Generation of Echo at 2-wire to 4-wire Interface
Echo Canceller - ECEcho Canceller - EC
31
modified by Ahmed AwnySecurity Level: Internal
OSS(NMC)
OMCOMC
OMC
Region2
Region 1
Region 3
Operation and Maintenance Sub SystemOperation and Maintenance Sub System
32
modified by Ahmed AwnySecurity Level: Internal
Operation and Maintenance Center – OMC Operation and Maintenance Center – OMC
OMC – R: OMC assigned specifically to the Base Station Subsystem
OMC – S: OMC assigned specifically to the Network Switching Subsystem
33
modified by Ahmed AwnySecurity Level: Internal
OMC Functional ArchitectureOMC Functional Architecture
OS
MMI
DB
Event/AlarmManagement
SecurityManagement
ConfigurationManagement
Performance Management
Fault Management
34
modified by Ahmed AwnySecurity Level: Internal
Mobile to Landline callMobile to Landline call
MS BSS MSC VLR HLR CHANNEL REQUEST <RACH>
<AGCH>DCCH ASSIGN
<SDCCH>
SIGNALING LINK ESTABLISHED
REQ. FOR SERVICECR
CC
AUTHENTICATION
SET Cipher MODE
SET-UP <SDCCH>
Call Info EQUIP. ID REQ.
COMPLETE CALL
CALL PROCEEDING <SDCCH>
PSTN
SFOC
services Auth.
35
modified by Ahmed AwnySecurity Level: Internal
Mobile to Landline callMobile to Landline call
ASSIG. COMMAND<SDCCH>
ASSIG. COMPLETE
Address Complete(ACM)
Alerting
<FACCH>
Answer (ANS)Connect
TCH connect
<TCH>
Initial and Final Address Message (IAM)
MS hears ring tone from land phone
<FACCH>
Ring tone stops
MS BSS MSC VLR HLR PSTN
Connect Acknowledge<FACCH>
BILLINGBILLING
ISUP (IAM)ISUP (IAM)
(ACM) (ACM)
+ alerting + alerting
ANSANS
Conn.
Conn. ack
36
modified by Ahmed AwnySecurity Level: Internal
Contents Contents haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network ComponentsGSM Network Components
Terrestrial Interface
Service Area and Number PlanningService Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio Technologies
37
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
On completion of this section you will be able to:
Identify the system identification number
Identify the of mobile identification number
Identify the cell identification number
ObjectivesObjectives
38
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: Service AreaService Area
PLMN service area
......
System area
PLMN service area
MSC service area...
Location area...
Base station area...
Radio cell
...... ......
MSC service area...
Location area...
Base station area...
Radio cell
PLMN service area
39
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: MSC/VLR NumberMSC/VLR Number
The format is CC+NDC+LSPCC : Country Code. For example: The CC of China is "86".
NDC : National Destination Code. For example: The NDC of China Mobile is 139 、 138 、 137 、 136 、 135.
LSP(locally significant part): is defined by Telecom operator.For example: 86-139-00311
CC NDC LSP
MSC/VLR number
40
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: HLR NumberHLR Number
The format is : CC+NDC+H0 H1 H2 H3 0000.CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of China Mobile is 139 、138 、 137 、 136 、 135.H0H1H2H3 is defined by Telecom operator.For example: 86-139-0666-0000.
The format is : CC+NDC+H0 H1 H2 H3 0000.CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of China Mobile is 139 、138 、 137 、 136 、 135.H0H1H2H3 is defined by Telecom operator.For example: 86-139-0666-0000.
CC NDC H0H1H2H3
HLR number
41
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: LAILAI
Location Area Identification
The LAI is the international code for a location area.
MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460"MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Mobile is "00"LAC : Location Area Code , It is a two bytes BCD
code(hex). The value 0000 and FFFF is invalid.For example: 460-00-0011
MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460"MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Mobile is "00"LAC : Location Area Code , It is a two bytes BCD
code(hex). The value 0000 and FFFF is invalid.For example: 460-00-0011
MCC MNC LAC
42
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: CGICGI
The CGI is a unique international identification for a cell
The format is LAI+CI
LAI: Location Area Identification
CI : Cell Identity. This code uses two bytes BCD
code(hex) to identify the radio cells within an LAI.
For example : 460-00-0011-0001
The CGI is a unique international identification for a cell
The format is LAI+CI
LAI: Location Area Identification
CI : Cell Identity. This code uses two bytes BCD
code(hex) to identify the radio cells within an LAI.
For example : 460-00-0011-0001
CGI: Cell Global Identification
43
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: BSICBSIC
NCC : PLMN network color code. It comprises 3 bit. It allows various neighboring PLMNs to be distinguished.BCC : BTS color code. It comprises 3 bit. It allows distinction between different radio frequency channels using the same frequency in neighboring cells (used in clustering).
NCC : PLMN network color code. It comprises 3 bit. It allows various neighboring PLMNs to be distinguished.BCC : BTS color code. It comprises 3 bit. It allows distinction between different radio frequency channels using the same frequency in neighboring cells (used in clustering).
NCC BCC
BSIC
BSIC ( Base Station Identification Color Code)
44
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of
China Telecom is 139, 138, 137, 136, 135.SN : Subscriber Number. Format:H0 H1 H2 H3 ABCDExample: 86-139-0666-1234
CC : Country Code. For example: The CC of China is "86".NDC : National Destination Code. For example: The NDC of
China Telecom is 139, 138, 137, 136, 135.SN : Subscriber Number. Format:H0 H1 H2 H3 ABCDExample: 86-139-0666-1234
MSISDNMSISDN
CC NDC SN
National (significant)Mobile number
Mobile station internationalISDN number
45
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460" 。MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Telecom is "00" 。MSIN : Mobile Subscriber Identification Number. H1H2H3 S
ABCDEF For example: 666-9777001NMSI : National Mobile Subscriber Identification , MNC and MSIN
form it together. For Example of IMSI : 460-00-666-9777001
MCC : Mobile Country Code , It consists of 3 digits . For example: The MCC of China is "460" 。MNC : Mobile Network Code , It consists of 2 digits . For example: The MNC of China Telecom is "00" 。MSIN : Mobile Subscriber Identification Number. H1H2H3 S
ABCDEF For example: 666-9777001NMSI : National Mobile Subscriber Identification , MNC and MSIN
form it together. For Example of IMSI : 460-00-666-9777001
Not more than 15 digits
3 digits 2 digits
IMSI
MCC MNC MSIN
NMSI
IMSI IMSI
46
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
The TMSI is assigned only after successful subscriber authentication.
The VLR controls the allocation of new TMSI numbers and notifies them to the HLR.
TMSI is used to ensure that the identity of the mobile subscriber on the air interface is kept secret.
The TMSI consists of 4 bytes( 8 HEX numbers) and determined by the telecom operator.
The TMSI is assigned only after successful subscriber authentication.
The VLR controls the allocation of new TMSI numbers and notifies them to the HLR.
TMSI is used to ensure that the identity of the mobile subscriber on the air interface is kept secret.
The TMSI consists of 4 bytes( 8 HEX numbers) and determined by the telecom operator.
TMSITMSI
TMSI: Temporary Mobile Subscriber Identification)
47
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: IMEIIMEI
TAC FAC SNR SP
IMEI
TAC : Type approval code. It is administered by the type approval center.
FAC : Final assembly code.It is administered by the manufacturer.
SNR : Serial number.It is issued by the manufacturer of the MS.
SP : Not used.
TAC : Type approval code. It is administered by the type approval center.
FAC : Final assembly code.It is administered by the manufacturer.
SNR : Serial number.It is issued by the manufacturer of the MS.
SP : Not used.
IMEI: International Mobile Station Equipment Identification
48
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: MSRN/HONMSRN/HON
The MSRN is used to route the call to the MSC to which MS is currently connected.
The HON is used by the MSC-A to set up a connection to the MSC-B during handover process
Usually, MSRN and HON share the same numbering plan. The format is CC+NDC+individual number. CC and NDC is the
same as that of MSISDN. The individual number is taken from a pool of numbers specially reserved for MSRN.
The MSRN is used to route the call to the MSC to which MS is currently connected.
The HON is used by the MSC-A to set up a connection to the MSC-B during handover process
Usually, MSRN and HON share the same numbering plan. The format is CC+NDC+individual number. CC and NDC is the
same as that of MSISDN. The individual number is taken from a pool of numbers specially reserved for MSRN.
MSRN: Mobile Subscriber Roaming Number
HON: Hand-over NumberHLRHLR
MSRNMSRNGMSCGMSC MSC / VLRMSC / VLRIncoming CallIncoming Call
MSISDNMSISDN
(1) MSISDN(1) MSISDN (2) IMSI(2) IMSI
(4) MSRN(4) MSRN (3) MSRN(3) MSRN
49
modified by Ahmed AwnySecurity Level: Internal
Contents Contents haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network ComponentsGSM Network Components
Terrestrial InterfaceTerrestrial Interface
Service Area and Number PlanningService Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio Technologies
50
modified by Ahmed AwnySecurity Level: Internal
On completion of this section you will be able to:
Identify the protocols used on the terrestrial interfaces between the GSM system entities
ObjectivesObjectives
51
modified by Ahmed AwnySecurity Level: Internal
HLR
VLR
MSC
EIR
AUC
EC IWF
TC
VLR
MSC
IWF EC
BTS BSCMS
B
H
F
G
A
E
C
D
Um Abis
GSM InterfaceGSM Interface
52
modified by Ahmed AwnySecurity Level: Internal
Protocol layers architectureProtocol layers architecture
CMCM
MMMM
RRRR
MMMM
LAPDmLAPDm
radioradio
LAPDmLAPDm
radioradio
LAPDLAPD
PCMPCM
RR’ RR’ BTSMBTSM
CMCM
LAPDLAPD
PCMPCM
RR’RR’BTSM BTSM
16 kbit/s16 kbit/s
UUmm AAbisbis AA
SS7SS7
PCMPCM
SS7SS7
PCMPCM
64 kbit/s 64 kbit/s
MSMS BTSBTS BSCBSC MSCMSC
BSSAPBSSAPBSSAPBSSAP
Physical layer : RF between MS and BTS and PCM between BTS and MSCPhysical layer : RF between MS and BTS and PCM between BTS and MSCLink layer : LAPD between BTS and BSC , modified LAPD between MS and BTS Link layer : LAPD between BTS and BSC , modified LAPD between MS and BTS and MTP L2 between BSC and MSCand MTP L2 between BSC and MSCRadio Resources : for RR management between MS and BSC Radio Resources : for RR management between MS and BSC DTAP and BSSAP between BSC and MSCDTAP and BSSAP between BSC and MSCMM & CM : mobility management and connection management between MS and MM & CM : mobility management and connection management between MS and MSCMSC
53
modified by Ahmed AwnySecurity Level: Internal
Typical Configuration
TS 0 TS 1-15 TS16 TS 17-31
TS = Time slot
TS# Used for
0
1-15
16
17-31
Frame Alignment /Error Checking /Signaling
Traffic
CCS7 Signaling (Other TS may also the used)
Traffic
2MBps Trunks2MBps Trunks
54
modified by Ahmed AwnySecurity Level: Internal
Abis (LAPD) InterfacesAbis (LAPD) Interfaces
FlagAddressControlInformationFrame check Sequence
Flag
last bit first bit
55
modified by Ahmed AwnySecurity Level: Internal
OSI Layers
7. Application
6. Presentation
5. Session
4. Transport
3. Network
2. Link
1 Physical
CCS7 Levels
MTP Level 1 2 Mb/s Trunk
MTP Level 3
TUP
SCCP
BSSAP(DTAP+BSSMAP)ISUP
MAP
TCAP
MTP Level 2
ITU Signaling System CCS7 ITU Signaling System CCS7
56
modified by Ahmed AwnySecurity Level: Internal
Abbreviation of CCS7Abbreviation of CCS7
MTP Message Transfer Part TCAP Transaction Capabilities Application Part SCCP Signaling Connection Control Part TUP Telephone User Part ISUP ISDN User Part MAP Mobile Application Part BSSAP Base Station System Application Part BSSMAP BSS Management Application Part DTAP Direct Transfer Application Part
MTP Message Transfer Part TCAP Transaction Capabilities Application Part SCCP Signaling Connection Control Part TUP Telephone User Part ISUP ISDN User Part MAP Mobile Application Part BSSAP Base Station System Application Part BSSMAP BSS Management Application Part DTAP Direct Transfer Application Part
57
modified by Ahmed AwnySecurity Level: Internal
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan:
haoxiuyan:haoxiuyan:haoxiuyan:haoxiuyan: Contents Contents
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network ComponentsGSM Network Components
Terrestrial InterfaceTerrestrial Interface
Service Area and Number PlanningService Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio TechnologiesRadio Technologies
58
modified by Ahmed AwnySecurity Level: Internal
On completion of this section you will be able to know about the following radio technologies :
GMSK Modulation Techniques
Power Control
VAD, DTX, DRX
Diversity
Frequency Hopping
ObjectivesObjectives
59
modified by Ahmed AwnySecurity Level: Internal
Modulation TechniquesModulation Techniques
– phase modulation can be implemented easily for digital signals, this is the method which is used for the GSM air interfaces. Phase Modulation is known as Phase Shift Keying when applied to digital signals
– phase modulation can be implemented easily for digital signals, this is the method which is used for the GSM air interfaces. Phase Modulation is known as Phase Shift Keying when applied to digital signals
Amplitude Shift Keying (ASK)
Frequency Shift Keying (FSK)
Phase Shift Keying (PSK)
60
modified by Ahmed AwnySecurity Level: Internal
1 0 0 1 1 GaussianDigital Filter
Phase Modulator
Gaussian Minimum Shift Keying (GMSK) Gaussian Minimum Shift Keying (GMSK)
61
modified by Ahmed AwnySecurity Level: Internal
Battery LifeBattery Life
Power ControlPower Control
Voice Activity Detection – VAD
Discontinuous Transmission – DTX
Discontinuous Reception – DRX
62
modified by Ahmed AwnySecurity Level: Internal
Power ControlPower Control
Saves radio battery powerReduces co-channel andadjacent channel interference
8W
0.8W
5W
Both Uplink and Downlink power settings can be controlled independently and individually.
63
modified by Ahmed AwnySecurity Level: Internal
VAD & DTXVAD & DTX
Encoding the speech silences at a rate of 500 bit/s rather than the full 13Kb/s.
If the mobile does not transmit during ‘silence’ there is a reduction in the overall power output requirement
Without DTX
With DTX
Comfort Noise
64
modified by Ahmed AwnySecurity Level: Internal
DRXDRX
PCH is structured so that MS knows when it needs to check for a paging signal. In the time between paging signals, the mobile can go into sleep mode, when almost no power is used.
P P P P P P BCCH P P
BCCH Multiframe P = Paging Channel
MS Being paged
MS in listen mode
MS receive System
information
MS in listen mode
65
modified by Ahmed AwnySecurity Level: Internal
Multipath FadingMultipath Fading
•Diversity
•Frequency Hopping
Time Dispersion
66
modified by Ahmed AwnySecurity Level: Internal
DiversityDiversity
When diversity is implemented two antennas are situated at the receiver. These antennas are placed several wavelengths apart to ensure minimum correlation between the two receive paths.
The two signals are then combined, this ensures that a low signal strength is less likely to occur.
Compare oradd signals
Resultant Signal
Approx. 10 wavelengths
67
modified by Ahmed AwnySecurity Level: Internal
Frequency HoppingFrequency Hopping
RF Hopping :each timeslot on a given transceiver can transmit at a different frequency
Baseband Hopping: each transceiver stays at the same frequency and the data is switched to the appropriate transceiver.
Each time the BTS or mobile transmits a burst, it does so on a different RF carrier frequency.
time
frequency
68
modified by Ahmed AwnySecurity Level: Internal
SummarySummary
Basic Concepts of Cellular Mobile SystemBasic Concepts of Cellular Mobile System
GSM Network ComponentsGSM Network Components
Terrestrial InterfaceTerrestrial Interface
Service Area and Number PlanningService Area and Number Planning
Channels on The Air InterfaceChannels on The Air Interface
Radio TechnologiesRadio Technologies
69
modified by Ahmed AwnySecurity Level: Internal
70
modified by Ahmed AwnySecurity Level: Internal
1999 2000 2001
57.6 kbps
115 kbps
384 kbps
2 Mbps
GSM
HSCSD
GPRS
EDGE
IMT-2000
9.6 kbps
2G
2.5G
3G
GSM Develop PathGSM Develop Path