GSM

GLOBAL SYSTEM FOR

MOBILE COMMUNICATION

EE 737
Digital Spread Spectrum
Dr. James Stephens
May 24, 2004
Submitted by,
Sohel K. Baramatiwala
1

INDEX
1. Objective3
2. History....3
3. Basics and Specifications of GSM.3
4. Architecture and Building Blocks..5
5. Signaling schemes and Ciphering codes used7
5.1 Ciphering Codes...8
5.1.1 A3/8 Algorithm.9
5.1.2 A3/1 Algorithm.10
6. Two Main Interfaces..10
6.1 Air Interface.10
6.2 Abis Interface...11
7. Summary12
8. Future Enhancements.12
9. SUGGESTIONS FOR FURTHER STUDY..13
10. References..13

FIGURES
Fig1. Representation of a GSM signal using TDMA and FDMA with respect to the
transmitted power.
Fig 2. The Basic Blocks of the whole GSM system
Fig 3. Transmitter for the voice signal
Fig 4. Receiver for voice signal

1. OBJECTIVE
In this paper I have outlined the reasons GSM started and how, the architecture
that the GSM is built on, the signaling and ciphering codes used, the Air and Abis
Interface and last but not the least future prospects and enhancements possible.

2. HISTORY
In 1980s the analog cellular telephone systems were growing rapidly all
throughout Europe, France and Germany. Each country defined its own protocols and
frequencies to work on. For example UK used the Total Access Communication System
(TACS), USA used the AMPS technology and Germany used the C-netz technology.
None of these systems were interoperable and also they were analog in nature.
In 1982 the Conference of European Posts and Telegraphs (CEPT) formed a study
group called the GROUPE SPECIAL MOBILE (GSM) The main area this focused on
was to get the cellular system working throughout the world, and ISDN compatibility
with the ability to incorporate any future enhancements. In 1989 the GSM transferred the
work to the European Telecommunications Standards Institute (ETSI.) the ETS defined
all the standards used in GSM.

3. BASICS OF WORKING AND SPECIFICATIONS OF GSM

The GSM architecture is nothing but a network of computers. The system has to
partition available frequency and assign only that part of the frequency spectrum to any
base transreceiver station and also has to reuse the scarce frequency as often as possible.
GSM uses TDMA and FDMA together. Graphically this can be shown below

Fig 1. Representation of a GSM signal using TDMA & FDMA with

respect to the transmitted power.
Some of the technical specifications of GSM are listed below
Multiple Access Method
Uplink frequencies (MHz)
Downlink frequencies (MHz)
Duplexing
Channel spacing, kHz
Modulation
Portable TX power, maximum / average (mW)
Power control, handset and BSS
Speech coding and rate (kbps)
Speech Channels per RF channel:
Channel rate (kbps)
Channel coding
Frame duration (ms)

TDMA / FDMA
933-960 (basic GSM)
890-915 (basic GSM)
FDD
200
GMSK
1000 / 125
Yes
RPE-LTP / 13
8
270.833
Rate 1/2 convolutional
4.615

GSM was originally defined for the 900 Mhz range but after some time even the 1800
Mhz range was used for cellular technology. The 1800 MHz range has its architecture and
specifications almost same to that of the 900 Mhz GSM technology but building the
Mobile exchanges is easier and the high frequency Synergy effects add to the advantages
of the 1800 Mhz range.

4. ARCITECTURE AND BUILDIGN BLOCKS

GSM is mainly built on 3 building blocks. (Ref Fig. 2)

GSM Radio Network This is concerned with the signaling of the system. Handovers occur in the radio network. Each BTS is allocated a set of frequency
channels.

GSM Mobile switching Network This network is concerned with the storage of
data required for routing and service provision.

GSM Operation and Maintenance The task carried out by it include

Administration and commercial operation , Security management, Network
configuration, operation, performance management and maintenance tasks.

Fig.2 The basic blocks of the whole GSM system

Explanations of some of the abbreviations used

Public Land Mobile Network(PLMN)

The whole GSM system

Mobile System (MS)

Base Transceiver Station

The actual cell phone that we use

(BTS) Provides connectivity between network and
mobile station via the Air- interface

Controls the whole subsystem.

BaseStationController(BSC)
Transcoding Rate & Adaption Unit This is instrumental in compressing the Data that
is passed on to the network, is a part of the BSS.

(TRAU)
Mobile Services Switching Center The BSC is connected to the MSC. The MSC
routes the incoming and outgoing calls and
(MSC)
Home Location

assigns user cannels on the A- interface.

Register

(HLR) This register stores data of large no of users. It is

like a database that manages data of all the users.
Every PLMN will have atleast one HLR.

Visitor

Location

Resigter

(VLR) This contains part of data so that the HLR is not

overloaded with inquiries. If a subscriber moves
out of VLR area the HLR requests removal of
data related to that user from the VLR.

Equipment Identity Register (EIR) The IMEI no. is allocated by the manufacturer
and is stored on the network in the EIR. A stolen
phone can be made completely useless by the

network/s if the IMEI no is known.

5. SIGNALLING SCHEMES AND CIPHERING CODES USED

GSM is digital but voice is inherently analog. So the analog signal has to be
converted and then transmitted. The coding scheme used by GSM is RPE-LTP
(Rectangular pulse Excitation Long Term Prediction)

Fig.3 Transmitter for the voice signal

Fig.4 Receiver for the Voice signal

The voice signal is sampled at 8000 bits/sec and is quantized to get a 13 bit
resolution corresponding to a bit rate of 104 kbits/sec. This signal is given to a speech
coder (codec) that compresses this speech into a source-coded speech signal of 260 bit
blocks at a bit rate of 13 kbit/sec. The codec achieves a compression ratio of 1:8. The
7

coder also has a Voice activity detector (VAD) and comfort noise synthesizer. The VAD
decides whether the current speech frame contains speech or pause, this is turn is used to
decide whether to turn on or off the transmitter under the control of the Discontinuous
Transmission (DTX). This transmission takes advantage of the fact that during a phone
conversation both the parties rarely speak at the same time. Thus the DTX helps in
reducing the power consumption and prolonging battery life. The missing speech frames
are replaced by synthetic background noise generated by the comfort noise synthesize in
a Silence Descriptor (SID) frame. Suppose a loss off speech frame occurs due to noisy
transmission and it cannot be corrected by the channel coding protection mechanism then
the decoder flags such frames with a bad frame indicator (BFI) In such a case the speech
frame is discarded and using a technique called error concealment which calculates the
next frame based on the previous frame.

5.1 CIPHERING CODES

MS Authentication algorithms
These algorithms are stored in the SIM and the operator can decide which
one it prefers using.
5.1.1 A3/8
The A3 generates the SRES response to the MSCs random
challenge, RAND which the MSC has received from the HLR. The A3
algorithm gets the RAND from the MSC and the secret key Ki from the
SIM as input and generated a 32- bit output, the SRES response. The A8
has a 64 bit Kc output.
5.1.2 A5/1 (Over the Air Voice Privacy Algorithm)

The A5 algorithm is the stream cipher used to encrypt over the air
transmissions. The stream cipher is initialized for every frame sent with
the session key Kc and the no. of frames being decrypted / encrypted. The
same Kc key is used throughout the call but different 22-bit frame is used.

6. TWO MAIN INTERFACES

The two main interfaces are the AIR and the ABIS interface. The figure shows the
signaling between them.
AIR INTERFACE signaling between MS and BTS
ABIS INTERFACE signaling between BTS and BSC

Fig.5 Signaling between Air and Abis Interface

6.1AIR INTERFACE
The air interface is like the physical layer in the model. The signaling schemes
used in the AIR interface are as follows

BROADCAST CONTROL CHANNE (BCCH)

o Broadcast Control Channel (BCCH)

This channel broadcasts a series of information elements to the MS, such

as radio channel configuration, synchronization information etc.
o FREQUENCY CORRECTION CHANNEL (FCCH)
This channel contains information about the correction in transmission
frequency broadcasted to MS.
o 0SYNCHRONIZATION CHANNEL (SCH)
It broadcasts data for the frame synchronization of a MS and information
to identify a BSC.

COMMON CONTROL CHANNEL (BCH)

This is a point to multi-point signaling channel to deal with access

management functions. Consists of 3 channels

o RANDOM ACCESS CHANNEL (RACH)
It is the Uplink portion, accessed from the mobile stations in a cell to ask
for a dedicated signaling channel for 1 transaction.
o ACCESS GRANT CHANNEL (AGCH)
It is the downlink portion used to assign a dedicated signaling channel.
o NOTIFICATION CHANNEL (NCH)
It is used to inform mobile stations about incoming calls and broadcast
calls.

DEDICATED CONTROL CHANNEL (DCCH)

It is a Bi-directional point to point signaling channel. Consists of 3
channels
o STAND ALONE DEDICATED CONTROL CHANNEL (SDDCH)

10

Used for signaling between the BSS and MS when there is no active
connection between them.
o SLOW ASSOCIATED CONTROL CHANNEL (SACCH)
This channel had to continuously transfer data because it is considered as
proof of existence of a physical radio connection.
o FAST ASSOCIATED CONTROL CHANNEL (FACCH)
This channel is used to make additional band-width available for
signaling.

6.2. ABIS INTERFACE

This is the interface between BTS & BSC. The transmission rate is 2.048 Mbps,
portioned into 32 channels of 64 Kbps each. As commercial service was introduced
interference problems between BTSs increased and QoS decreased. Thus service
providers moved to using more cells with fewer TRXs and smaller output power (<1W.)
SIGNALLING on the Abis Interface
It utilizes layer 1-3 of the OSI protocol stack.
Layer 1 forms the D-channel It provides the basic signaling on the Abis interface that
is it helps in building a link between the BTS and BSC.
Layer 2 is the LAPD channel Also known as the Link Access Protocol. Once a
connection has been established between the BSC and BTS, data can be transmitted as
soon as layer 2 is operable.
Layer 3 is the TRX management This layer decides whether the incoming signal is to
be just passed or processed depending on whether it is a speech signal or a signal to
establish a link.

11

7. SUMMARY
In this paper I have tried to explain the basic working of the GSM system.
Although this paper might be missing many details of a detailed GSM explanation I
believe I have explained the philosophy behind GSM. GSM operates at 900 MHz and
1800 MHz and is truly an international system which is compatible with ISDN. Together
with international roaming, SMS, Data transfer etc GSM systems are coming closer to a
personal communication system, close to UMTS currently being developed in Europe.
Though 3rd generation mobile phones are taking over the market, the back-bone for most
cellular technologies will always remain GSM.

8. FUTURE ENHANCEMENTS
One major problem was number compatibility, but now this problem has been
solved and this is possible.
Another major problem is SIM card cloning which allows users to make
fraudulent calls. This can be got rid of by incorporating a more secret key in the
SIM then the currently used one which can be cracked asking a few queries.
Another possibility is making the whole GSM station design in software; this will
make upgradation of systems really easy.
3 GSM which seems to be taking over the market is an advancement in 2G and in
a few years will make 2G obsolete. The 3G system incorporates W-CDMA in it,
and makes multimedia and high speed internet access possible.
The next step is AD-HOC networks used in cellular technology. In this every MS
itself would act as a BTS. But they have a long way to go as research in this area
is still going on.

12

9. SUGGESTIONS FOR FURTHER STUDY

You could also do in depth analysis of the signaling scheme used in GSM,
including the timing and the structure of the frames, the error correcting codes and QoS.
The codecs used in GSM is a vast topic and improved codecs that can utilize the available
frequency better and yet give a sharper speech output are being developed.
Study of the ciphering techniques used in detail and type of possible attacks on
the GSM system.
Study about General Packet Radio Service (GPRS) and how packet switching
helps to reduce the complexity in networks. GPRS needs to be incorporated in the GSM
architecture. Also GPRS helps reduce misuse as is the case in GSM.
Study about the Wireless Access Protocol which defines an architecture such that
the web pages can be viewed on a mobile device using the current GSM technology.

10. REFERENCES
GSM networks: Terminology, protocols and implementation Gunnar
Heine
GSM: Switching, Services And Protocols Jorg, Vogel and Bettstetter
GSM Technical Specification ETSI
http://ccnga.uwaterloo.ca/~jscouria/GSM/gsmreport.html
www.gsm.org
www.techmind.org
An Overview of GSM www.comms.eee.strath.ac.uk/~gozalvez/gsm/gsm

13

 http://www.isaac.cs.berkeley.edu/isaac/gsm-faq.html

14

15