Cellular Communication

Cellular
Communication
Cellular Communication
The key principle is determined by subdividing a
relatively large geographic market area called
coverage zone, into small sections, called cells. The
concept of frequency reuse was could be employed
to dramatically increase the capacity of a mobile
telephone channel. In essence, cellular telephone
(cellular radio) system allows a large number of
users to share the limited number of common-
usage radio channels available in a region.
In addition, integrated-circuit technology,
microprocessors and microcontroller chips
and the implementation of Signaling System
No. 7 (SS7) enabled complex radio and logic
circuits to be used in electronic switching
machines to store programs that provide
faster and more efficient call processing.
With the cellular concept, each area is further
divided into hexagonal-shaped cells that fit
together to form a honeycomb pattern. The
hexagonal shape was chosen because it provides
the most effective transmission by approximating a
circular pattern while eliminating gaps inherently
present between adjacent circles.
A cell is defined by its physical size and, more
importantly by the size of its population and traffic
patterns. The physical size of a cell varies,
depending on user density and calling patterns.
Macro cells typically have radius between 1 mile
and 15 miles with base station transmit powers
between 1 W and 6 W. Micro cells typically have
radius of 1500ft or less with base station transmit
powers between 0.1 W and 1 W.
Occasionally, cellular radio signals are too
weak to provide reliable communications
indoors. In these circumstances, very small
cells, called Pico cells, are used. Indoor Pico
cells can use the same frequencies as regular
cells in the same areas if the surrounding
infrastructure is conducive, such as in
underground malls.
Frequency Reuse
It is the process in which the same set of
frequencies can be allocated more than one
cell, provided the cells are separated by
sufficient distance. Cells using the same set
of radio channels can avoid mutual
interference, provided they are properly
separated.
Frequency Reuse
Re-using the carrier frequencies according to
well-proven re-use patterns , neither co-
channel interference nor adjacent channel
interference should become a problem, if
the cells have homogenous propagation
properties for the radio waves.
Frequency Reuse
GSM
GLOBAL SYSTEM FOR MOBILE COMMUNICATION
GSM
GSM (Global System for Mobile communication) is
a digital mobile telephony system that is widely
used in Europe and other parts of the world
GSM
A GSM network is made up of three
subsystems:
• The Mobile Station (MS)
• The Base Station Sub-system (BSS) –
comprising a BSC and several BTSs
• The Network and Switching Sub-system
(NSS) – comprising an MSC and associated
registers
Section 1 – GSM Architecture Overview
GSM
The interfaces defined between each of these
sub systems include:
• 'A' interface between NSS and BSS
• 'Abis' interface between BSC and BTS (within
the BSS)
• 'Um' air interface between the BSS and the
MS
GSM
Abbreviations:
MSC – Mobile Switching Center
BSS – Base Station Sub-system
BSC – Base Station Controller
HLR – Home Location Register
BTS – Base Transceiver Station
VLR – Visitor Location Register
GSM
TRX – Transceiver
AuC – Authentication Center
MS – Mobile Station
EIR – Equipment Identity Register
OMC – Operations and Maintenance Center
PSTN – Public Switched Telephone Network
GSM
The Mobile Station (MS) consists of the
physical equipment used by a PLMN
subscriber to connect to the network. It
comprises the Mobile Equipment (ME) and
the Subscriber Identity Module (SIM). The ME
forms part of the Mobile Termination (MT)
which, depending on the application and
services, may also include various types of
Terminal Equipment (TE) and associated
Terminal Adapter (TA).
GSM
The IMSI identifies the subscriber within the GSM
network while the MS ISDN is the actual telephone
number a caller (possibly in another network) uses to
reach that person.
Security is provided by the use of an authentication key
and by the transmission of a temporary subscriber
identity (TMSI) across the radio interface where possible
to avoid using the permanent IMSI identity.
The IMEI may be used to block certain types of
equipment from accessing the network if they are
unsuitable and also to check for stolen equipment.
MS and SIM
The mobile station consists of :
• Mobile Equipment (ME)
• Subscriber Identity Module
(SIM)
MS and SIM
The SIM stores permanent and temporary data about
the mobile, the subscriber and the network, including :
• The International Mobile Subscribers Identity (IMSI)
• MS ISDN number of subscriber
• Authentication key (Ki) and algorithms for
authentication check
The mobile equipment has a unique International

Mobile Equipment Identity (IMEI), which is used by the
EIR
Base Station Subsystem (BSS)


The BSS comprises:
1. Base Station Controller (BSC)
2. One or more Base Transceiver Stations (BTSs)
The purpose of the BTS is to:

o provide radio access to the mobile stations
o manage the radio access aspects of the system
BTS contains:
o Radio Transmitter/Receiver (TRX)
o Signal processing and control equipment
o Antennas and feeder cables

The BSC:
o allocates a channel for the duration of a call
o maintains the call
o monitors quality
o controls the power transmitted by the BTS or
MS
o generates a handover to another cell when
required
Section 3 – NSS Topology
Network Switching Subsystem

Network Sub System can be considered as a heart of
the GSM Network. All the major activities like
switching of calls, routing, security functions, call
handling, charging, operation & maintenance,
handover decisions, takes place within the entities
of NSS.
Various kinds of interfaces are used to communicate
between the different entities. Different methods
are used to optimize and provide the quality
network with the minimum operating cost.
Network Switching Subsystem

The NSS combines the call routing switches (MSCs
and GMSC) with database registers required to keep
track of subscribers’ movements and use of the
system. Call routing between MSCs is taken via
existing PSTN or ISDN networks. Signaling between
the registers uses Signaling System No. 7 protocol.
Network Switching System (NSS)

Key elements of the NSS:
Mobile Switching Center (MSC)
Visitor Location Register (VLR)
Home Location Register (HLR)
Authentication Center (AuC)
Equipment Identity Register (EIR)
Gateway MSC (GMSC)
These elements are interconnected by

means of an SS7 network
NSS Identifier
IMEI – International Mobile Equipment Identifier.
The IMEI is an internationally-unique serial number allocated
to the MS hardware at the time of manufacture. It is
registered by the network operator and (optionally) stored in
the AuC for validation purposes.
IMEI = TAC + FAC + SNR +sp
TAC = Type Approval Code by central GSM body

FAC = Final Assembly Code, identifies the manufacturer
SNR = Serial Number, unique six digit number
sp = spare for future use
NSS Identifier
IMSI – International Mobile Subscriber Identifier
When a subscriber registers with a network operator, a unique
subscriber IMSI identifier is issued and stored in the SIM of
the MS as well as in the HLR . An MS can only function fully if
it is operated with a valid SIM inserted into an MS with a valid
IMEI. IMSI consist of three parts:
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code

MNC = Mobile Network Code
MSIN = Mobile Station Identification Number
NSS Identifier
TMSI –Temporary Mobile Subscriber Identity
A TMSI is used to protect the true identity (IMSI) of a
subscriber. It is issued by and stored within a VLR (not
in the HLR) when an IMSI attach takes place or a
Location Area (LA) update takes place. At the MS it is
stored in the MS’s SIM. The issued TMSI only has
validity within a specific LA.
Since TMSI has local significance, the structure may be
chosen by the administration. It should not be more
than four octets.
NSS Identifier
MSISDN – Mobile Station Integrated Services Digital Network
The MSISDN represents the ‘true’ or ‘dialled’ number
associated with the subscriber. It is assigned to the subscriber
by the network operator at registration and is stored in the
SIM.
According to the CCITT recommendations, it is composed in
the following way:
MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number
NSS Identifier
MSRN – Mobile Station Roaming Number
The MSRN is a temporary, location-dependant ISDN
number issued by the parent VLR to all MSs within
its area of responsibility. It is stored in the VLR and
associated HLR but not in the MS. The MSRN is used
by the VLR associated MSC for call routing within the
MSC/VLR service area.
NSS Identifier
LAI – Location Area Identity
Each Location Area within the PLMN has an associated
internationally unique identifier (LAI). The LAI is broadcast
regularly by BTSs on the Broadcast Control channel (BCCH),
thus uniquely identifying each cell with
an associated LA.
LAI = MCC + MNC + LAC
MCC = Mobile Country Code, same as in IMSI

MNC = Mobile Network Code, same as in IMSI
LAC = Location Area Code

The Mobile services Switching Center (MSC) performs the
telephony switching functions of the system. It also controls
calls to and from other telephony and data systems, such as
the Public Switched Telephone Network (PSTN) and Public
Land Mobile Network (PLMN).
Difference between a MSC and an exchange in a fixed network
is - MSC has to take into account the impact of the allocation
of radio resources and the mobile nature of the subscribers
and has to perform in addition, at least the following
procedures:
◦ required for location registration
◦ procedures required for handover

An MSC can be connected to only one VLR. Therefore,
all mobile stations that move around under base
stations connected to the MSC are always managed
by the same VLR.
An MSC would communicate typically with one EIR.
While it is possible for an MSC to communicate to
multiple EIRs, this is highly unlikely since the EIR
provides a centralized and geographic independent
function.

The MSC consults an HLR to determine how a call should be
routed to a given mobile station:
For incoming calls to a mobile station, the MSC would
typically consult one HLR.
For mobile-to-mobile calls in larger networks, a MSC could
consult HLRs of other systems to help minimize the trunk
paths to the other mobile station.
A given MSC can be interconnected to other MSCs to support

inter-MSC handovers

The following are typical MSC functions in a cellular
system:
◦ Provide switched connections with PSTN
◦ Provide switched connections between mobile
subscribers
◦ Provide coordination over signaling with mobiles
◦ Coordinate the location and handover process
◦ Provide custom services to mobile users
◦ Collect billing data
Protocols
MSC/BSC MSC/HLR OMC/MSC MSC/Fixed Network
MSC/VLR OMC/HLR
MSC/EIR OMC/VLR MSC/Voice
MSC/GMSC OMC/BSS messaging
VLR/VLR
VLR/HLR
MSC/MSC
BSSMAP TCAP+MAP X.225 R2, ISUP other
Signaling
SCCP SCCP X.224
MTP MTP X.25 MTP
SS7 SS7
Interfaces
A-Interface (MSC – BSC)

The interface between the MSC and its BSS is
specified in the 08-series of GSM Technical
Specifications. The BSS-MSC interface is used to
carry information concerning:
◦ BSS management;
◦ Call handling;
◦ Mobility management.
B-Interface (MSC – VLR)

The VLR is the location and management data base for the
mobile subscribers roaming in the area controlled by the
associated MSC(s). Whenever the MSC needs data related to a
given mobile station currently located in its area, it
interrogates the VLR. When a mobile station initiates a
location updating procedure with an MSC, the MSC informs its
VLR which stores the relevant information. This procedure
occurs whenever an MS roams to another location area. Also,
when a subscriber activates a specific supplementary service
or modifies some data attached to a service, the MSC informs
(via the VLR) the HLR which stores these modifications and
updates the VLR if required.
C-Interface (HLR - MSC)

The Gateway MSC must interrogate the HLR
of the required subscriber to obtain routing
information for a call or a short message
directed to that subscriber.
D-Interface (HLR - VLR)

This interface is used to exchange the data related
to the location of the mobile station and to the
management of the subscriber. The main service
provided to the mobile subscriber is the capability
to set up or to receive calls within the whole
service area. To support this, the location registers
have to exchange data. The VLR informs the HLR of
the location of a mobile station managed by the
latter and provides it (either at location updating or
at call set-up) with the roaming number of that
station.
D-Interface (HLR - VLR)
The HLR sends to the VLR all the data needed to
support the service to the mobile subscriber. The
HLR then instructs the previous VLR to cancel the
location registration of this subscriber. Exchanges
of data may occur when the mobile subscriber
requires a particular service, when he wants to
change some data attached to his subscription or
when some parameters of the subscription are
modified by administrative means
E-Interface (MSC - MSC)

When a mobile station moves from one MSC area to another
during a call, a handover procedure has to be performed in
order to continue the communication. For that purpose the
MSCs have to exchange data to initiate and then to realize
the operation. After the handover operation has been
completed, the MSCs will exchange information to transfer A-
interface signaling as necessary. When a short message is to
be transferred between a Mobile Station and Short Message
Service Centre (SC), in either direction, this interface is used
to transfer the message between the MSC serving the Mobile
Station and the MSC which acts as the interface to the SC.
F-Interface (MSC - EIR)

This interface is used between MSC and EIR to
exchange data, in order that the EIR can verify the
status of the IMEI retrieved from the Mobile
Station.
G-Interface (VLR - VLR)

When a mobile subscriber moves from a VLR
area to another Location Registration
procedure will happen. This procedure may
include the retrieval of the IMSI and
authentication parameters from the old VLR.
H-Interface (HLR - AUC)

When an HLR receives a request for
authentication and ciphering data for a
Mobile Subscriber and it does not hold the
requested data, the HLR requests the data
from the AuC. The protocol used to transfer
the data over this interface is not
standardized.
Home Location Register

HLR is a database that stores subscription and set of functions
needed to manage subscriber data in one PLMN area. Any
administrative action by the service provider or changes
made by subscriber is first carried out on the HLR and then
update the VLR. Following are the subscriber data which
frequently changes:
- Identification number MSISDN & IMSI
- Service restriction
- Teleservices
- Bearer services
- Supplementary services

Beside the permanent data it also include dynamic
data of home subscriber including VLR address, call
forward number and call barring numbers.
Triplets are also stored in the HLR for the
authentication purpose.
The HLR communicates with other nodes: VLR, AUC,
GMSC & SMS – SC via MAP (Mobile Access Protocol).
To support this communication HLR needs MTP and
SCCP
MAP (Mobile Application

Protocol)
The only way via which HLR communicates with other GSM nodes is
Mobile Access Protocol. Number of functional blocks exist to support
different MAP operations e.g HLCAP is used for location cancellation
or HLUAP is required for location updating. Other functions defined
on the MAP are:
 Inter MSC Handover and subsequent handover

 Update HLR and VLR
 Fault Recovery
 Management and handling of supplementary services.
 Support of Short Message Services.
 Call establishment / delivery
 Security related data.
 Retrieval of subscriber data during call setup.

HLR is responsible for:
◦ Connection of mobile subscribers and definition of
corresponding subscriber data.
◦ Subscription to basic services.
◦ Registration/deletion of supplementary services.
◦ Activation/deactivation of supplementary services.
◦ Interrogation of supplementary services status.
◦ Functions for analysis of mobile subscriber numbers
(MSISDN, IMSI, additional MSISDN) and other types
of addresses.

◦ Statistical functions for collecting data regarding
the performance of the system.
◦ Functions for communication with GMSC and VLR
using the No. 7 signaling system and MAP
◦ Handling of authentication and ciphering data for
mobile subscribers including communication with
an authentication center.
◦ Get Password/Register Password
◦ Alert Service Center
◦ Provide Roaming Number
◦ Send Routing Information for SMS
◦ Send Routing Information for GMSC
◦ Set Message Waiting Data
Visitor Location Register

It is a subscriber database containing the
information about all the MS currently located in
the MSC service area. VLR can be considered as a
distributed HLR in the case of a roaming subscriber.
If MS moves into a new service area (MSC), VLR
requests the HLR to provide the relevant data and
store it, for making the calls for that MS.
VLR is always integrated with MSC to avoid the
signaling load on the system. It can also be viewed
as a subset of a HLR.

VLR connects with MSC via B interface, HLR via D
interface and with another VLR via G interface.
G
VLR is responsible for:
◦ Setting up and controlling calls along with supplementary
services.
◦ Continuity of speech (Handover)
◦ Location updating and registration
◦ Updating the mobile subscriber data.
◦ Maintain the security of the subscriber by allocating TMSI
◦ Handling signaling to and from BSC and MSs using
BSSMAP
VLR is responsible for:
◦ IMEI check
◦ Retrieve data from HLR like authentication data,
IMSI, ciphering key
◦ Retrieve information for outgoing calls.
◦ Attach/Detach IMSI
◦ Search for mobile subscriber, paging and
complete the call.
AuC is always integrated with HLR for the purpose of the
authentication. At subscription time, the Subscriber
Authentication Key (Ki) is allocated to the subscriber,
together with the IMSI. The Ki is stored in the AUC and used
to provide the triplets, same Ki is also stored in the SIM.
AUC stores the following information for each subscriber

o The IMSI number,
o The individual authentication key Ki,
o A version of A3 and A8 algorithm.
Authentication is required at each registration, at
each call setup attempt (mobile originated or
terminated), at the time of location updating,
before supplementary service activation, de-
activation , registration.
Ciphering
The user data and signaling data passes over the
radio interface are ciphered to prevent intrusion.
The ciphered key (Kc) previously computed by the
AUC is sent from the VLR to the BSS after the
mobile has been authenticated. The Kc is also
computed in the MS and in the way both ends of
the radio link (MS and BSS) possess the same key.
Equipment Identity Register
Purpose of this feature is to make sure that no
stolen or unauthorized mobile equipment is used in
the network. EIR is a database that stores a unique
International Mobile Equipment Identity (IMEI)
number for each item of mobile equipment.
Equipment Identity Register
The MSC/VLR requests the IMEI from the MS and sends it to
a EIR. On request of IMEI, the EIR makes use of three
possible defined lists:
◦ A white list: containing all number of all equipment identities that
have been allocated in the different participating countries.
◦ A black list: containing all equipment identities that are considered
to be barred.
◦ A grey list: containing (operator’s decision) faulty or non-approved
mobile equipment.
Result is sent to MSC/VLR and influences the decision about
access to the system.
Gateway MSC (GMSC)
Gateway MSC (GMSC) connects the PLMN with
other networks and the entry point for the mobile
subscriber calls having the interrogation facility. It
has the function to obtain the information from the
HLR about the subscriber’s current location and
reroute the calls accordingly. In case of the network
having only on MSC, the same MSC work as the
GMSC, while in the case having more than one MSC,
one dedicated MSC works as GMSC.
GPRS Core
Network Planning
Section 7 – Dimensioning
Circuit vs Packet
Circuit Switched Service:
◦ 2G system (primarily voice and data on circuit
switched air interface)
◦ Call charging based on channel holding time.
◦ Maximum number of users per TDMA channel is 8
◦ Suitable for constant bit rate applications
◦ Resource allocation is done such that UL and DL
are paired.
Circuit vs Packet
Packet Switched Service:
◦ Several users can share the same channel.
◦ Charges based on channel usage (actual usage of
byte transferred).
◦ Well suited for bursty traffic.
◦ Resource allocation done independently on UL
and DL (good for applications with asymmetrical
bit rate)
◦ Dynamic allocation of resources
◦ Can multiplex traffic (voice, data, video).
Speech traffic leaves some capacity for

10
9
packet data
8
TCH 14
7
6
5 12
4
3 GSM
2 10
1 capacity
0
8
Offered GPRS Traffic

6
14 4
12
10 2
8
TCH 0
6
Circuit Switched Traffic
2
GPRS System Feature

 Variable quality of service.
 Independent packet routing.
 Protocol transparent (encapsulation & tunneling)
 Slotted ALOHA for random access procedure
 Provides IP connectivity to mobile subscriber.
 Build on existing GSM infrastructure with added
nodes for supporting packets.
◦Serving GPRS Support Node (SGSN)
◦Gateway GPRS Support Node (GGSN)
Conceptual View on GPRS

GSM Voice
Access
Point
GPRS Core Internet

BTS BSC
Corporate Intranet
Shared GSM and GPRS GPRS Infrastructure IP World

Infrastructure
Air Interface Mobile Terminal

• Type C GPRS only
(or manually switched between GPRS and speech modes)
• Type B GPRS and Speech (not at same time)

(Automatically switches between GPRS and speech modes)
• Type A GPRS and Speech at the same time BSC
BTS
GPRS Attach/Detach
Attach
Performed when the MS indicates its presence to PLMN for
the purpose of using GPRS service
Carried out between MS and SGSN
MS identifies itself with its GSM identity
GPRS subscription necessary for successful attach
Detach
Performed when the MS indicates to the PLMN that it no
longer be using GPRS services
MS identifies itself with its GSM identity
System Architecture
HLR
BTS Gc
Gr
BTS BSC SGSN GGSN
Gb Gn
BTS
Gi
Data
Um Abis Networks
SGSN
 Responsible for delivery of packets to mobile
subscribers in its service area.
 Mobility Management
 Logical link management, authentication
 GPRS user- related data needed by SGSN to
perform routing and transfer functionality stored in
GPRS Register e.g., current cell, current VLR, user
profile including IMSI and its address in PDN.
 Interface point between core and Radio networks
GGSN
 Acts as an interface between GPRS network and
external PDNs
 Mainly responsible for packet routing, transfer and
mobility management
 Converts packets from SGSN into appropriate PDP
format and sends them out to corresponding PDN
 PDP addresses of incoming data packets from PDN
are converted to IMSI of the destination user and
sent to the responsible SGSN.
 Tunneling
GPRS and GSM Resource sharing

Circuit
CCCH TS TS TS TS TS TS TS
Switched
TRX 1 Territory
TRX 2 TS TS TS TS TS TS TS TS Packet
Switched
Territory
Additional Default Dedicated
GPRS GPRS GPRS
Capacity Capacity Capacity
Territory border moves

Dynamically based on Circuit
Switched traffic load
• Circuit Switched traffic has priority

• In each cell Circuit Switched & Packet Switched territories are defined
• Territories consist of consecutive timeslots
PDP Context Activation - 1

Accessing the HLR • (1) MS sends "Activate PDP
Context Request" to SGSN
– Access Point Name
HLR
– PDP Type (IP)
2. – PDP Address (empty ==
BTS BSC
dynamic)
SS7
1. – QoS & other options
APN=
"Intranet.Ltd.com" SGSN
DNS (2) SGSN checks against HLR
Access Point Name
Access Dynamic / static IP address
GPRS
Backbone Point QoS
IP Network Intranet
GGSN
Internet
• Access Point Name = Reference to an

external packet data network the user
wants to connect to

Finding the GGSN
• (1) SGSN gets the GGSN IP address
from DNS
– APN maps to the GGSN IP
address
(2) SGSN sends "Create PDP Context
Request" to GGSN
BTS BSC PDP Type (IP)
PDP Address (if empty=> dynamic
address)
Access Point Name
SGSN QoS
1. DNS
GPRS Access
Backbone Point
2. IP Network Intranet
GGSN
• DNS = Domain Name System = mechanism to

map logical names to IP addresses

Access Point Selection
• Access Point Name refers to the

external network the subscriber
wants to use
–Physical/logical interface in
GGSN
BTS BSC
• Access Point configuration in
GGSN defines where to connect
the user
• If dynamic address, allocated by
SGSN
GGSN
DNS
APN="Intranet.Ltd.com"
GPRS
Backbone
IP Network Intranet
GGSN
Internet

Context Activated
• (1) GGSN sends "Create PDP

Context Response" back to SGSN
• (2) SGSN sends "Activate PDP
Context Accept" to the MS
• SGSN now ready to route user
BTS BSC
traffic between MS and GGSN
2.
SGSN
GPRS
Backbone
IP Network
GGSN Intranet
1.
Internet
UMTS
UNIVERSAL MOBILE TELECOMMUNICATION SYSTEM
UMTS Architecture
Functional Network Elements
 User Equipment (UE)
◦ interfaces with user and radio interface
 Radio Access Network (RAN, UMTS Terrestrial RAN =
UTRAN)
◦ handles all radio-related functionality
 Core Network
◦ switches and routes calls and data connections to
external networks
UMTS Architecture
What is PLMN
PLMN (Public Land Mobile Network)
◦ operated by a single operator
◦ distinguished from each other with unique
identities
◦ operational either on their own or together with
other sub-networks
◦ connected to other PLMNs as well as to other
types of network, such as ISDN, PSTN, the
Internet, etc.
User Equipment
UE consists of two parts
 Mobile Equipment (ME)
◦ the radio terminal used for radio communication over
Uu interface
 UMTS Subscriber Identity Module (USIM)

◦ a smartcard that holds the subscriber identity
◦ performs authentication algorithms
◦ stores authentication and encryption keys
◦ some subscription information that is needed at the
terminal
UTRAN
UTRAN consists of two elements:
 Node B
◦ converts data flow between Iub and Uu interfaces
◦ participates in radio resource management
 Radio Network Controller (RNC)

◦ owns and controls radio resources in its domain
◦ the service access point (SAP) for all services that
UTRAN provides the CN
◦ e.g., management of connections to UE
Core Network
Main elements of CN
◦ HLR (Home Location Register)
◦ MSC/VLR (Mobile Services Switching
Centre/Visitor Location Register)
◦ GMSC (Gateway MSC)
◦ SGSN (Serving GPRS (General Packet Radio
Service) Support Node)
◦ GGSN (Gateway GPRS Support Node)
Core Network
 HLR (Home Location Register)
◦ a database located in user’s home system that
stores the master copy of user’s service profile
◦ service profile consists of, e.g.,
 information on allowed services, forbidden
roaming areas
 supplementary service information such as
status of call forwarding and the call forwarding
number
Core Network
 it is created when a new user subscribes to the
system, and remains stored as long as the
subscription is active
 for the purpose of routing incoming transactions
to UE (e.g. calls or short messages)
• HLR also stores the UE location on the level of
MSC/VLR and/or SGSN
Core Network
 MSC/VLR (Mobile Services Switching
Centre/Visitor Location Register)
◦ the switch (MSC) and database (VLR) that serve the UE
in its current location for Circuit Switched (CS) services
◦ the part of the network that is accessed via MSC/VLR is
often referred to as CS domain
Core Network
MSC
◦ used to switch CS transactions
VLR
◦ holds a copy of the visiting user’s service profile, as well
as more precise information on the UE’s location within
the serving system
Core Network
 GMSC (Gateway MSC)
◦ the switch at the point where UMTS PLMN is connected
to external CS networks
◦ all incoming and outgoing CS connections go through
GMSC
Core Network
 SGSN (Serving GPRS (General Packet
Radio Service) Support Node)
◦ functionality is similar to that of MSC/VLR but is
typically used for Packet Switched (PS) services
◦ the part of the network that is accessed via SGSN is
often referred to as PS domain
 GGSN (Gateway GPRS Support Node)
◦ functionality is close to that of GMSC but is in relation to
PS services
External Network
External networks can be divided into two
groups:
 CS networks
◦ provide circuit-switched connections, like the existing
telephony service
◦ ISDN and PSTN are examples of CS networks
 PS networks
◦ provide connections for packet data services
◦ Internet is one example of a PS network
UMTS Interfaces
Main open interfaces
 Cu interface
◦ the electrical interface between USIM smartcard and
ME
 Uu interface
◦ the WCDMA radio interface
◦ the interface through which UE accesses the fixed part
of the system
◦ the most important open interface in UMTS
UMTS Interfaces
 Iu interface
◦ connects UTRAN to CN
 Iur interface
◦ allows soft handover between RNCs
 Iub interface
◦ connects a Node B and an RNC
UTRAN Architecture
 Radio Network Controller
 Node B (Base Station)
UTRAN Architecture
 UTRAN
◦ consists of one or more Radio Network Sub-systems
(RNS)
 RNS
◦ a subnetwork within UTRAN
◦ consists of one Radio Network Controller (RNC) and one
or more Node Bs
 RNCs
◦ may be connected to each other via Iur interface
◦ RNCs and Node Bs are connected with Iub interface
UTRAN Architecture
Main characteristics of UTRAN
◦ support of UTRA and all related functionality
◦ support soft handover and WCDMA-specific Radio
Resource Management algorithms
◦ use of ATM transport as the main transport
mechanism in UTRAN
◦ use of IP-based transport as the alternative
transport mechanism in UTRAN from Release 5
onwards
UTRAN Architecture
 RNC (Radio Network Controller)
◦ the network element responsible for radio resources
control of UTRAN
◦ it interfaces CN (normally to one MSC and one SGSN)
◦ terminates RRC (Radio Resource Control) protocol that
defines the messages and procedures between mobile
and UTRAN
◦ it logically corresponds to the GSM BSC
NODE B (BASE STATION)
 Main function of Node B
◦ perform the air interface L1 processing, e.g.,
 channel coding and interleaving
 rate adaptation
 spreading
◦ also performs some basic Radio Resource
Management operations, e.g.
 inner loop power control
◦ It logically corresponds to the GSM Base Station
INTERLEAVING
The transmission of pulses from two or more
digital sources in time-division sequence
over a single path
RANAP PROTOCOL
 RANAP
◦ defines interactions between RNS and CN
◦ the signaling protocol in Iu that contains all the
control information specified for Radio Network
Layer
◦ implemented by various RANAP Elementary
Procedures (EP)
◦ each RANAP function may require execution of
one or more EPs
RANAP Protocol
 three classes of EP
 class 1 EP
◦ request and response (failure or success)
 class 2 EP
◦ request without response
 class 3 EP
◦ request and possibility for one or more
responses
RANAP Protocol
 RANAP functions
◦ relocation
◦ RAB (Radio Access Bearer) management
◦ Iu release
◦ report unsuccessfully transmitted data
◦ common ID management
◦ paging
RANAP Protocol
 RANAP functions
◦ management of tracing
◦ UE–CN signaling transfer
◦ security mode control
◦ management of overload
◦ reset
◦ location reporting
RANAP Protocol
RELOCATION：handles both SRNS relocation and
hard handover (including inter-system case to/from
GSM)
◦ SRNS relocation
 the serving RNS functionality is relocated from one
RNS to another without changing the radio
resources and without interrupting the user data
flow
 prerequisite：all Radio Links are already in the same
DRNC that is the target for the relocation
RANAP Protocol
◦ Inter-RNS hard handover
 relocate the serving RNS functionality from one RNS
to another and to change the radio resources
correspondingly by a hard handover in Uu interface
 prerequisite：UE is at the border of the source and
target cells
RANAP Function
RAB (Radio Access Bearer) management:
combines all RAB handling
◦ RAB set-up
◦ modification of the characteristics of an existing
RAB
◦ clearing an existing RAB
Iu release
◦ releases all resources (Signaling link and U-Plane)
from a given instance of Iu related to the
specified UE
RANAP Function
Reporting unsuccessfully transmitted data
◦ allows CN to update its charging records with
information from UTRAN if part of the data sent
was not successfully sent to UE
Common ID management
◦ the permanent identification of the UE is sent
from CN to UTRAN to allow paging coordination
from possibly two different CN domains
RANAP Function
Paging
◦ used by CN to page an idle UE for a UE
terminating service request, such as a voice call
◦ a paging message is sent from CN to UTRAN with
the UE common identification (permanent Id)
and the paging area
◦ UTRAN will either use an existing signaling
connection, if one exists, to send the page to UE
or broadcast the paging in the requested area
RANAP Function
Management of tracing
◦ CN may, for operation and maintenance purposes,
request UTRAN to start recording all activity related to a
specific UE–UTRAN connection
RANAP Function
UE–CN signaling transfer
◦ transfer of the first UE message from UE to UTRAN
◦ example
◦ a response to paging
◦ a request of a UE-originated call
◦ a registration to a new area
◦ it also initiates the signaling connection for Iu
◦ direct transfer
◦ used for carrying all consecutive signaling messages
over the Iu signaling connection in both uplink and
downlink directions
RANAP Function
Security mode control
◦ used to set the ciphering or integrity checking on
or off
◦ when ciphering is on
◦ the signaling and user data connections in the radio
interface are encrypted with a secret key algorithm
RANAP Function
◦ when integrity checking is on
◦ an integrity checksum, further secured with a
secret key, is added to some or all of the Radio
Interface signaling messages
◦ this ensures that the communication partner has
not changed, and the content of the information
has not been altered
RANAP Function
Management of overload
 control the load over Iu interface against
overload due
 example, to process overload at the CN or
UTRAN
◦ a simple mechanism is applied that allows stepwise
reduction of the load and its stepwise resumption,
triggered by a timer
RANAP Function
Reset
◦ reset the CN or the UTRAN side of Iu interface in
error situations
◦ one end of the Iu may indicate to the other end
that it is recovering from a restart, and the other
end can remove all previously established
connections
RANAP Function
Location reporting
◦ allows CN to receive information on the location
of a given UE
◦ includes two elementary procedures
◦ control the location reporting in RNC
◦ send the actual report to CN
UTRAN ENHANCEMENTS AND
EVOLUTION
Release’99 UTRAN architecture
◦ defines the basic set of network elements and interface
protocols for the support of Release ’99 WCDMA radio
interface
Enhancement of the Release’99 UTRAN
architecture
◦ support new WCDMA radio interface features to provide
a more efficient, scalable and robust 3GPP system
architecture
IP TRANSPORT in UTRAN
ATM
◦ the transport technology used in the first release of
UTRAN
IP transport
◦ introduced in Release 5
In addition to the initially defined option of
AAL2/ATM, user plane FP frames can also be
conveyed
◦ over UDP/IP protocols on Iur/Iub
◦ over RTP/UDP/IP protocols in Iu CS interface
IU FLEX
Release’99 architecture presented in Figure 5.3
◦ only one MSC and one SGSN connected to RNC
◦ i.e. only one Iu PS and Iu CS interface in the RNC
Iu flex (flexible)
◦ allows one RNC to have more than one Iu PS and
Iu CS interface instances with the core
Main benefits of this feature
◦ possible load sharing between core network
nodes
Interworking betweem GERAN
AND UTRAN, AND THE IUR-G
INTERFACE
Iu interface
◦ scheduled to be part of the GSM/EDGE Radio
Access Network (GERAN) in GERAN Release 5
◦ allows reusing 3G Core Network also for
GSM/EDGE radio interface (and frequency band),
but also allows a more optimized interworking
between the two radio technologies
Interworking betweem GERAN
AND UTRAN, AND THE IUR-G
INTERFACE
Effect
◦ RNSAP basic mobility module is enhanced to
allow the mobility to and from GERAN cells in the
target and the source
◦ RNSAP global module is enhanced in order to
allow GERAN cells measurements to be
exchanged between controllers
◦ allows a Common Radio Resource Management
(CRRM) between UTRAN and GERAN radios
Interworking betweem GERAN AND
UTRAN, AND THE IUR-G INTERFACE
UMTS radio interface, WCDMA
◦ a bigger step in radio access evolution from GSM networks
UMTS core network

◦ did not experience major changes in 3GPP Release’99 specification
Release’99 structure was inherited from GSM core network

◦ both UTRAN and GERAN based radio access network connect to the same
core network
UMTS CORE NETWORK
ARCHITECTURE AND EVOLUTION
Release’99 Core Network Elements
Release 5 Core Network and IP Multimedia
Sub-system
RELEASE ’99 CORE NETWORK
ELEMENTS
Two domains of Release’99 core network
◦ Circuit Switched (CS) domain
◦ Packet Switched (PS) domain
The division comes from the different requirements
for data
◦ depending on whether it is real time (circuit switched) or
non-real time (packet data)
ELEMENTS
◦ Release ’99 core network structure with both CS
and PS domains
◦ Registers
◦ HLR, VLR, EIR
◦ Service Control Point (SCP)
◦ the link for providing a particular service to end user
ELEMENTS
CS domain has the
following elements
◦ Mobile Switching Centre
(MSC), including Visitor
Location Register (VLR)
◦ Gateway MSC (GMSC)
ELEMENTS
PS domain has the following
elements
◦ Serving GPRS Support Node
(SGSN)
◦ covers similar functions as
MSC for packet data, including
VLR type functionality
◦ Gateway GPRS Support Node
(GGSN)
◦ connects PS core network to
other networks, e.g. to the
Internet
ELEMENTS
In addition to the two domains, the network needs various
registers for proper operation
◦ Home Location Register (HLR)
◦ Equipment Identity Register (EIR)
◦ contains the information related to the terminal
equipment
◦ can be used to, e.g., prevent a specific terminal from
accessing the network
RELEASE 5 CORE NETWORK AND
IP MULTIMEDIA SUB-SYSTEM
Release 4 included the change in core network CS
domain
◦ MSC was divided into MSC server and Media Gateway
(MGW)
◦ GMSC was divided into GMSC server and MGW
Release 5
◦ contains the first phase of IP Multimedia Sub-system (IMS)
◦ this will enable a standardized approach for IP-based
service provision via PS domain
RELEASE 5 CORE NETWORK AND IP
MULTIMEDIA SUB-SYSTEM
Release 6
◦ enhance IMS to allow the provision of services
similar to CS domain services from PS domain
Release 5 architecture is presented in Figure 5.13
◦ Home Subscriber Server (HSS)
◦ shown as an independent item
◦ Session Initiation Protocol (SIP)
◦ the key protocol between terminal and IMS
◦ the basis for IMS-related signaling
 MSC or GMSC server
◦ takes care of the control functionality as MSC or GMSC,
respectively
 user data goes via Media Gateway (MGW)
 one MSC/GMCS server can control multiple MGWs
◦ this allows better scalability of the network when data
rates increase with new data services
◦ in this case, only the number of MGWs needs to be
increased
 MGW performs actual switching for user data and
network interworking processing
◦ e.g., echo cancellation or speech decoding/ encoding
 IMS includes the following key elements
◦ Media Resource Function (MRF)
 controls media stream resources or mixes
different media streams
◦ Call Session Control Function (CSCF)
 the first contact point to terminal in the IMS
(as a proxy)
 handling of session states
 acting as a firewall towards other operator’s
networks
◦ Media Gateway Control Function (MGCF)
 handle protocol conversions
 control a service coming via CS domain and
perform processing in an MGW, e.g. for echo
cancellation
LTE
LONG TERM EVOLUTION
LTE Overview
LTE stands for Long Term Evolution and it
was started as a project in 2004 by
telecommunication body known as the Third
Generation Partnership Project (3GPP). SAE
(System Architecture Evolution) is the
corresponding evolution of the GPRS/3G
packet core network evolution. The term LTE
is typically used to represent both LTE and
SAE.
LTE Overview
LTE evolved from an earlier 3GPP system known as
the Universal Mobile Telecommunication System
(UMTS), which in turn evolved from the Global
System for Mobile Communications (GSM). Even
related specifications were formally known as the
evolved UMTS terrestrial radio access (E-UTRA) and
evolved UMTS terrestrial radio access network (E-
UTRAN). First version of LTE was documented in
Release 8 of the 3GPP specifications.
LTE Overview
The main goal of LTE is to provide a high data
rate, low latency and packet optimized radio
access technology supporting flexible
bandwidth deployments. Same time its
network architecture has been designed
with the goal to support packet-switched
traffic with seamless mobility and great
quality of service.
LTE Overview
Year Event
Mar 2000 Release 99 - UMTS/WCDMA
Mar 2002 Rel 5 - HSDPA
Mar 2005 Rel 6 - HSUPA
Year 2007 Rel 7 - DL MIMO, IMS (IP Multimedia Subsystem)
November 2004 Work started on LTE specification
January 2008 Spec finalized and approved with Release 8
2010 Targeted first deployment
Advantages of LTE
 High Throughput
 Low Latency
 FDD and TDD in the same platform
 Superior end-user experience
Seamless connection
 Plug and Play
 Simple Architecture
LTE Network Architecture
The high-level network architecture of LTE is comprised
of following three main components:
◦ The User Equipment (UE).
◦ The Evolved UMTS Terrestrial Radio Access Network (E-
UTRAN).
◦ The Evolved Packet Core (EPC).
The evolved packet core communicates with packet
data networks in the outside world such as the
internet, private corporate networks or the IP
multimedia subsystem. The interfaces between the
different parts of the system are denoted Uu, S1 and
SGi
The User Equipment (UE)
The internal architecture of the user equipment for
LTE is identical to the one used by UMTS and GSM
which is actually a Mobile Equipment (ME). The
mobile equipment comprised of the following
important modules:
◦ Mobile Termination (MT) : This handles all the
communication functions.
◦ Terminal Equipment (TE) : This terminates the data
streams.
Universal Integrated Circuit Card (UICC) : This is
also known as the SIM card for LTE equipment. It
runs an application known as the Universal
Subscriber Identity Module (USIM).
A USIM stores user-specific data very similar to 3G
SIM card. This keeps information about the user's
phone number, home network identity and security
keys etc.
The E-UTRAN (The access network)
The architecture of evolved UMTS Terrestrial Radio Access
Network (E-UTRAN) has been illustrated below.
The E-UTRAN handles the radio
communications between the mobile and
the evolved packet core and just has one
component, the evolved base stations,
called eNodeB or eNB. Each eNB is a base
station that controls the mobiles in one or
more cells. The base station that is
communicating with a mobile is known as its
serving eNB.
LTE Mobile communicates with just one base
station and one cell at a time and there are
following two main functions supported by eNB:
◦ The eBN sends and receives radio transmissions to all the
mobiles using the analogue and digital signal processing
functions of the LTE air interface.
◦ The eNB controls the low-level operation of all its
mobiles, by sending them signalling messages such as
handover commands.
Each eBN connects with the EPC by means of the
S1 interface and it can also be connected to nearby
base stations by the X2 interface, which is mainly
used for signalling and packet forwarding during
handover.
A home eNB (HeNB) is a base station that has been
purchased by a user to provide femtocell coverage
within the home. A home eNB belongs to a closed
subscriber group (CSG) and can only be accessed by
mobiles with a USIM that also belongs to the
closed subscriber group.
The Evolved Packet Core (EPC) (The core network)
The architecture of Evolved Packet Core (EPC) has
been illustrated below. There are few more
components which have not been shown in the
diagram to keep it simple. These components are
like the Earthquake and Tsunami Warning System
(ETWS), the Equipment Identity Register (EIR) and
Policy Control and Charging Rules Function (PCRF).
Below is a brief description of each of the
components shown in the above
architecture:
The Home Subscriber Server (HSS)
component has been carried forward from
UMTS and GSM and is a central database
that contains information about all the
network operator's subscribers.
The Packet Data Network (PDN) Gateway
(P-GW) communicates with the outside
world ie. packet data networks PDN, using
SGi interface. Each packet data network is
identified by an access point name (APN).
The PDN gateway has the same role as the
GPRS support node (GGSN) and the serving
GPRS support node (SGSN) with UMTS and
GSM.
The serving gateway (S-GW) acts as a router,
and forwards data between the base station
and the PDN gateway.
The mobility management entity (MME)
controls the high-level operation of the
mobile by means of signalling messages and
Home Subscriber Server (HSS).
The Policy Control and Charging Rules
Function (PCRF) is a component which is not
shown in the above diagram but it is
responsible for policy control decision-
making, as well as for controlling the flow-
based charging functionalities in the Policy
Control Enforcement Function (PCEF), which
resides in the P-GW.
The interface between the serving and PDN
gateways is known as S5/S8. This has two
slightly different implementations, namely
S5 if the two devices are in the same
network, and S8 if they are in different
networks.
Functional Split (E-UTRAN and
EPC
2G/3G vs LTE
2G/3G LTE
GERAN and UTRAN E-UTRAN
SGSN/PDSN-FA S-GW
GGSN/PDSN-HA PDN-GW
HLR/AAA HSS
VLR MME
SS7-MAP/ANSI-41/RADIUS Diameter
DiameterGTPc-v0 and v1 GTPc-v2
MIP PMIP

Cellular Communication

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Cellular Communication

Hochgeladen von

Copyright:

Verfügbare Formate

Cellular

The mobile equipment has a unique International

Base Station Subsystem (BSS)

Base Station Subsystem (BSS)

The purpose of the BTS is to:

Base Station Subsystem (BSS)

Network Switching Subsystem

Network Switching Subsystem

Network Switching System (NSS)

These elements are interconnected by

TAC = Type Approval Code by central GSM body

MCC = Mobile Country Code

LAI = MCC + MNC + LAC

MCC = Mobile Country Code, same as in IMSI

Mobile Switching Center (MSC)

Mobile Switching Center (MSC)

Mobile Switching Center (MSC)

A given MSC can be interconnected to other MSCs to support

Mobile Switching Center (MSC)

MTP MTP X.25 MTP

A-Interface (MSC – BSC)

B-Interface (MSC – VLR)

C-Interface (HLR - MSC)

D-Interface (HLR - VLR)

E-Interface (MSC - MSC)

F-Interface (MSC - EIR)

G-Interface (VLR - VLR)

H-Interface (HLR - AUC)

Home Location Register

Home Location Register

MAP (Mobile Application

 Inter MSC Handover and subsequent handover

Home Location Register

Home Location Register

Visitor Location Register

Visitor Location Register

AUC stores the following information for each subscriber

Speech traffic leaves some capacity for

Offered GPRS Traffic

Circuit Switched Traffic

GPRS System Feature

Conceptual View on GPRS

GPRS Core Internet

Shared GSM and GPRS GPRS Infrastructure IP World

Air Interface Mobile Terminal

• Type B GPRS and Speech (not at same time)

• Type A GPRS and Speech at the same time BSC

BTS BSC SGSN GGSN

GPRS and GSM Resource sharing

Territory border moves

• Circuit Switched traffic has priority

PDP Context Activation - 1

• Access Point Name = Reference to an

PDP Context Activation - 2

• DNS = Domain Name System = mechanism to

PDP Context Activation - 3

• Access Point Name refers to the

PDP Context Activation - 4

• (1) GGSN sends "Create PDP

 UMTS Subscriber Identity Module (USIM)

 Radio Network Controller (RNC)

UMTS core network

Release’99 structure was inherited from GSM core network