1.

Architecture globale

BTS The BTS handles the radio interface to the mobile station. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the network. BSC The BSC provides all the control functions and physical links between the MSC and BTS. It is a high-capacity switch that provides functions such as handover, cell configuration data, and control of radio frequency (RF) power levels in base transceiver stations. home location register (HLR) The HLR is a database used for storage and management of subscriptions, including a subscriber's service profile, location information, and activity status mobile services switching center (MSC) performs the telephony switching functions of the system. It controls calls to and from other telephone and data systems. It also performs such functions as toll ticketing, network interfacing, common channel signaling, and others. visitor location register (VLR) a database that contains temporary information about subscribers that is needed by the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC. When a mobile station roams into a new MSC area, the VLR connected to that MSC will request data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR will have the information needed for call setup

authentication center (AUC) provides authentication and encryption parameters that verify the user's identity and ensure the confidentiality of each call. The operations and maintenance center (OMC) The operations and maintenance center (OMC) is connected to all equipment in the switching system and to the BSC. The implementation of OMC is called the operation and support system (OSS). The OSS is the functional entity from which the network operator monitors and controls the system. gateway mobile services switching center (GMSC) A gateway is a node used to interconnect two networks. The gateway is often implemented in an MSC. The MSC is then referred to as the GMSC.

2. Structure de trame

GSM frame consisting of eight slots The basic GSM frame defines the structure upon which all the timing and structure of the GSM messaging and signalling is based. The fundamental unit of time is called a burst period and it lasts for approximately 0.577 ms (15/26 ms). Eight of these burst periods are grouped into what is known as a TDMA frame. This lasts for approximately 4.615 ms (i.e.120/26 ms) and it forms the basic unit for the definition of logical channels. One physical channel is one burst period allocated in each TDMA frame.

GSM multiframe The GSM frames are grouped together to form multiframes and in this way it is possible to establish a time schedule for their operation and the network can be synchronised. There are several GSM multiframe structures: Traffic multiframe: The Traffic Channel frames are organised into multiframes consisting of 26 bursts and taking 120 ms. In a traffic multiframe, 24 bursts are used for traffic. These are numbered 0 to 11 and 13 to 24. One of the remaining bursts is then used to accommodate the SACCH, the remaining frame remaining free. The actual position used alternates between position 12 and 25. Control multiframe: the Control Channel multiframe that comprises 51 bursts and occupies 235.4 ms. This always occurs on the beacon frequency in time slot zero and it may also occur within slots 2, 4 and 6 of the beacon frequency as well. This multiframe is subdivided into logical channels which are time-scheduled. These logical channels and functions include the following: o Frequency correction burst o Synchronisation burst o Broadcast channel (BCH) o Paging and Access Grant Channel (PACCH) o Stand Alone Dedicated Control Channel (SDCCH) Example

GSM Superframe Multiframes are then constructed into superframes taking 6.12 seconds. These consist of 51 traffic multiframes or 26 control multiframes. As the traffic multiframes are 26 bursts long and the control multiframes are 51 bursts long, the different number of traffic and control multiframes within the superframe, brings them back into line again taking exactly the same interval. GSM Hyperframe Above this 2048 superframes (i.e. 2 to the power 11) are grouped to form one hyperframe which repeats every 3 hours 28 minutes 53.76 seconds. It is the largest time interval within the GSM frame structure. Within the GSM hyperframe there is a counter and every time slot has a

unique sequential number comprising the frame number and time slot number. This is used to maintain synchronisation of the different scheduled operations with the GSM frame structure. http://www.radioelectronics.com/info/cellulartelecomms/gsm_technical/frames-structure-superhyper.php

3. Catgorie de canal logique

There are two main categories of logical channels in GSM: Signaling Channels Traffic Channels (TCH)

Broadcast Channels (BCH) - Transmitted by the BTS to the MS. This channel carries system parameters needed to identify the network,

synchronize time and frequency with the network, and gain access to the network. Common Control Channels (CCH) - Used for signaling between the BTS and the MS and to request and grant access to the network. Standalone Dedicated Control Channels (SDCCH) - Used for call setup. Associated Control Channels (ACCH) - Used for signaling associated with calls and call-setup. An ACCH is always allocated in conjunction with a TCH or a SDCCH.

The above categories can be divided into the following logical channels: Broadcast Channels (BCH) Broadcast Control Channel (BCCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Cell Broadcast Channel (CBCH) Common Control Channels (CCCH) Paging Channel (PCH) Random Access Channel (RACH) Access Grant Channel (AGCH) Dedicated Control Channel (DCCH) Standalone Dedicated Control Channel (SDCCH) Fast Associated Control Channel (FACCH) Slow Associated Control Channel (SACCH)

1.Signaling Channels Broadcast Channels (BCH) Broadcast Control Channel (BCCH) - DOWNLINK - This channel contains system parameters needed to identify the network and gain access. These paramters include the Location Area Code (LAC), the Mobile Network Code (MNC), the frequencies of neighboring cells, and access parameters. Frequency Correction Channel (FCCH) - DOWNLINK - This channel is used by the MS as a frequency reference. This channel contains frequency correction bursts.

Synchronization Channel (SCH) - DOWNLINK - This channel is used by the MS to learn the Base Station Information Code (BSIC) as well as the TDMA frame number (FN). This lets the MS know what TDMA frame they are on within the hyperframe. Cell Broadcast Channel (CBCH) - DOWNLINK - This channel is not truly its own type of logical channel. The CBCH is for point-to-omnipoint messages. It is used to broadcast specific information to network subscribers; such as weather, traffic, sports, stocks, etc. Messages can be of any nature depending on what service is provided. Messages are normally public service type messages or announcements. The CBCH isnt allocated a slot for itself, it is assigned to an SDCCH. It only occurs on the downlink. The CBCH usually occupies the second subslot of the SDCCH. The mobile will not acknowledge any of the messages.

Common Control Channels (CCCH) Paging Channel (PCH) - DOWNLINK - This channel is used to inform the MS that it has incoming traffic. The traffic could be a voice call, SMS, or some other form of traffic. Random Access Channel (RACH) - UPLINK This channel is used by a MS to request an initial dedicated channel from the BTS. This would be the first transmission made by a MS to access the network and request radio resources. The MS sends an Access Burst on this channel in order to request access. Access Grant Channel (AGCH) - DOWNLINK - This channel is used by a BTS to notify the MS of the assignement of an initial SDCCH for initial signaling.

Dedicated Control Channels (DCCH) Standalone Dedicated Control Channel (SDCCH) - UPLINK/DOWNLINK This channel is used for signaling and call setup between the MS and the BTS.

Fast Associated Control Channel (FACCH) - UPLINK/DOWNLINK - This channel is used for control requirements such as handoffs. There is no TS and frame allocation dedicated to a FACCH. The FACCH is a burst-stealing channel, it steals a Timeslot from a Traffic Channel (TCH). Slow Associated Control Channel (SACCH) - UPLINK/DOWNLINK - This channel is a continuous stream channel that is used for control and supervisory signals associated with the traffic channels. Control Channel (aka signaling channels) is composed of 51 TDMA frames. There are several channel combinations allowed in GSM. Some of the more common ones are: http://www.gsmfordummies.com/tdma/logical.shtml#ccch 2. Traffic Channels (TCH) Traffic Channels are used to carry two types of information to and from the user: Encoded Speech Data There are two basic types of Encoded Speech channels: Encoded Speech - Encoded speech is voice audio that is converted into digital form and compressed. See the Speech Encoding tutorial to see the process. Full Rate Speech TCH (TCH/FS) - 13 kb/s Half Rate Speech TCH (TCH/HS) - 5.6 kb/s Data - Data refers to user data such as text messages, picture messages, internet browsing, etc. It includes pretty much everything except speech. Full rate Data TCH (TCH/F14.1) - 14.4 kb/s Full rate Data TCH (TCH/F9.6) - 9.6 kb/s Full rate Data TCH (TCH/F4.8) - 4.8 kb/s Half rate Data TCH (TCH/F4.8) - 4.8 kb/s Full rate Data TCH (TCH/F2.4) - 2.4 kb/s Half rate Data TCH (TCH/H2.4) - 2.4 kb/s Message envoy dans les canaux : traffic messages for speech and data, signaling messages for different procedures and supplementary services,

synchronization messages for temporal and logical synchronization between the mobile stations and the BTS, measurements messages for uplink report of the downlink measurements, control messages to manage the access to the network. Logical channels can be thought of as just different types of data that is transmitted only on certain frames in a certain timeslot. Different time slots will carry different logical channels, depending on the structure the BSS uses.

4. Comment lappel se droule

Cell Mobile station User Mobile

Mobile network Bas station NSS BSS MSC

Fixnetwork PSTN PSTN

1. Send buttons 2. RR Channel request 3. Allocate TCH

4. RR IMMEDIATE ASSIGNMENT

5. Apply correction

6. Turn to the frequency and timeslot

7. RR SABM + MM CM SERVICE REQUEST

8. RR UA

Cell Mobile station User Mobile

Mobile network Bas station NSS BSS MSC

Fixnetwork PSTN PSTN

9. SCCP CONNECTION REQUEST + MM CM SERVICE REQUEST

10. Check subscriber authentication

11. BSSMAP CIPHER MODE COMMAND

12. Expect ciphered data from the mobile

13. RR CIPHERING MODE COMMAND (clear) 14. Enable ciphering for received and transmitted data

15. RR CIPHERING MODE COMPLETE (ciphered)

16. Enable ciphering of data transmitted to the mobile

17. BSSMAP CIPHER MODE COMPLETE

18. CC SETUP (Dialed Digits) 19. CC CALL PROCEEDING 20. Connecting

2. Call related information needs to be transported from the mobile phone to the Mobile Switching Center (MSC). This requires the establishment of a Radio Resource (RR) connection to MSC. The first phase of the call setup just sets up this RR connection. RR connection establishment is triggered by sending the Channel Request message (RACH). This message requests the Base Station System (BSS) for allocation for radio resources for the RR connection setup. The mobile now waits for an assignment on the Access Grant Channel (AGCH). At this point the mobile is listening to the AGCH for a reply. The RR CHANNEL REQUEST is sent on a Random Access Channel (RACH). This is a slotted aloha channel that can be used at random, without any coordination between the mobiles. Any mobile can transmit on this channel whenever it wishes. If two mobiles transmit on the channel at the same time, their messages will be lost in a collision. The mobiles will detect the collision via a timeout and retransmit the message after a random back off. 3. The BSS allocates a Traffic Channel (TCH) data channel, called Standalone Dedicated Control Channel (SDCCH) to the mobile. The TCH allocation assigns a specifies a frequency and a timeslot on that frequency. After the mobile receives this message, the mobile shall only use the specified resources for communication with the mobile network. 4. The BSS transmits the radio resource assignment to the Mobile via the AGCH channel. The message also contains the time and frequency corrections. The time corrections allow the mobile to time it's transmissions so that they reach the BSS only in the specified slot. The frequency corrections correct for the Doppler shift caused by the mobile's motion. 5. Adjust the frequency and timing based on the advice from the BSS. This step is required so that transmissions from the mobile reach the base station at the precise time and with the correct frequency. 6. The mobile detunes from the AGCH and tunes to the specified radio channel. 7. This is the first message that is sent after tuning to the channel. The Mobile initiates a LAPm Link Access Procedure for Modemsconnection with the BSC by sending a Set Asynchronous Balanced Mode (SABM) message. The service request message meant for the MSC is also sent in this message. 8. The BSS replies with Unnumbered Acknowledge (UA) to complete the LAPm setup handshake

9. The BSS receives the CM Service Request message from the mobile and forms a "BSSMAP COMPLETE LAYER 3 INFORMATION". The BSS then piggy backs the message on the SCCP connection request message. 10. MSC checks if the subscriber has been authenticated. In this case, the subscriber has already been authenticated, so the authentication procedure is skipped. 11. Since the subscriber has been successfully authenticated, the MSC initiates ciphering of the data being sent on the channel. The channel is ciphered so as so protect the call from eavesdropping.data channel, called Stand-alone Dedicated Control Channel (SDCCH) 12. Ciphering on the radio link is enabled in three steps. As a first step, the BSS starts expecting ciphered data from the mobile but continues to send data in clear. Since the mobile has not been informed about the ciphering, all data received from the mobile will be in error. 13. The BSS sends the CIPHERING MODE COMMAND to the mobile. The mobile will be able to receive this message as the transmission from the BSS is still in clear. 14. As a second step, the Mobile receives the message and enables ciphering in transmit and receive directions. This action will result in all BSS data being received in error. (The BSS is still transmitting data in clear.) 15. Ciphering has already been enabled, so this message is transmitted with ciphering. The BSS will receive this message as it is already expecting ciphered data in the receive direction. 16. The third and final step in the ciphering handshake. The BSS enables the ciphering in transmit direction. From this point on ciphering is enabled in both directions. 17. BSS replies back to the MSC, indicating that ciphering has been successfully enabled. RR Connection Establishment Completed. At this point a connection has been setup between the Mobile and the MSC. From this point onward, the BSS is just acting as a conduit for transporting the signaling messages between the Mobile and the MSC. 18. The Mobile sends the setup message to establish a voice call. The message contains the dialed digits and other information needed for call

19. The mobile is informed that the call setup is in progress. 20. At this point, the mobile phone displays a message on the screen to indicate that call setup is being attempted.

(suite de rapport1)

Processus de appel

1. The MSC allocates a voice circuit on one the digital trunks between the

MSC and the BSS. 2. MSC informs the BSS about the allocated voice circuit. The call is also switched from signaling to voice. 3. The BSS notifies the Mobile about the changeover to voice mode. 4. Mobile acknowledges.

5. The BSS responds back to the MSC. 6. The MSC routes the call and sends the call towards the called subscriber 7. The PSTN indicates to the MSC that it has received all the digits and the called subscriber is being rung. 8. The MSC informs the mobile that the called subscriber is being alerted via a ring 9. The called subscriber answers the call. 10. The MSC informs the mobile that the call has been answered. 11. Acknowledge the recipt of CC CONNECT 12. Display that the call has been connected. 13. The call has entered the conversation phase. The speech path has been setup between the mobile subscriber and the land-line subscriber.

14. The mobile subscriber hits End to clear the call. 15. The mobile sends the disconnect message to the MSC. 16. The MSC initiates release on the PSTN side. 17. The MSC disconnects the voice path 18. releases the voice circuit between the BSS and the MSC. 19. The MSC informs the Mobile that it has initiated call release

Conclusion

Appellant

MOBILE STATION Channel Request Immediate Assignment CM Service Request

NETWORK RR connection establishment(MO) Service request

Authentication Request Authentication Response Cipher Mode Command Cipher Mode Complete Setup Proceeding

Authentication

Ciphering mode seting

Call initiation

Call

Assignment Command Assignment Complete Alerting

Assignment of a traffic channel User alerting

Connect Connect Acknowledge

Call accepted

When the caller MS successfully seizes the TCH channel it sends the assignment complete message to the network in the channel assignment phase. Then the MSC waits for an address complete message from the other end (the terminating switch), which indicates that the called party is ringing. The MSC sends the caller MS an alert signal as soon as it receives the address complete message from the terminating switch. The MS now sends the connect request message to the MSC. The originating MSC returns an acknowledgement to the MS, and waits for an answer message (which confirms that the called party responded) from the terminating switch. The MSC completes the connection as soon as it receives that message. The following diagram depicts the message transactions between the caller MS and the network. The called side is covered in the next section

Appel

MOBILE STATION Paging Request Channel Request Immediate Assignment

NETWORK RR connection establishment(MT)

Paging Response

Service request

Authentication Request Authentication Response Cipher Mode Command Cipher Mode Complete Setup Confirmed

Authentication Ciphering mode setting

Call

Call initiation

Assignment Command Assignment Complete Alerting

Assignment of a traffic channel User alerting

Connect Connect Acknowledge

Call accepted

When an MS receives a page it sends a request of service message to the network and gets an SDCCH channel assigned. After passing through the standard authentication and security procedures the Ms receives a call initiation message from the network. This message informs the MS that it is a voice call. The MS sends call confirmed message to the network to tell that it is ready to accept the call. The network in return assigns the voice channel (the TCH channel) to the MS and sends the assignment command. The MS sends assignment complete message to confirm that it seized the channel. The MS also generates the ring tone for itself and sends alert message to the network. The terminating MSC then let the other side of the network (the caller side) know that the Ms is ringing. If the user of the MS answer the call the MS sends the connect message to the network. The network acknowledge the connect request. Finally the link is established between the two users.

1. Mobile state
A mobile station (MS) can be in one of the following states: Detached MS is powered off or the SIM card is deactivated When it is switched-off its data in the VLR and the HLR get updated (detached state) so that no incoming call will try to page the MS. Attached MS power is on and the SIM card is activated. An attached MS can be: o Idle MS has no dedicated channel allocated. It just listens to base stations broadcasted signals (called beacon signal) to remain attached o Active (dedicated) MS has a dedicated connection to the network When an MS is switched-on it starts the initialization procedure in order to find the network and synchronizes itself to a right frequency (beacon frequency) and TDMA (Time Division Multiple Access) slot. After that the MS gets through the association procedure in order to anchor itself to the base-station (idle state). When an MS is idle it still listens the paging channels for an incoming call, periodically re-synchronize itself and measures the signal strength of its own as well as its neighboring cells (for the purpose of location update).

2. Mobile Station Initialization

When a mobile station is switched on it starts initializing itself through the following three phases. 1. Frequency Synchronization 2. Time Synchronization 3. Network and cell information acquisition All these happen by detecting the beacon signal (also called base frequency signal) which the network broadcasts from its radio base station (RBS). The

beacon signal is a special signal that an RBS broadcasts in order to advertise its presence, identities (such as, which operator it is) and all the necessary initial information (such as, information about the paging channels).

2.1 Frequency Synchronization

Step 1: Find out a GSM signal Step 2: Check if the frequency is a beacon frequency (Frequency Synchronization) If the frequency is not a beacon the mobile station will reject that frequency and start searching for a new frequency (back to Step 1). If the frequency is a beacon frequency then the mobile station records this frequency and proceeds to the time synchronization phase FCCH serves the following two purposes: 1. It indicates that this is the beacon channel 2. It helps synchronize with the carrier frequency (and phase)

2.2 Detect the start of a time-slot (Time Synchronization)

TDMA Frame Number (FN) (to be discussed in another session) Base Station Identity Code (BSIC) which consists of At this stage an MS already frequency and time synchronized, and it detected the operating companys identity. If the identity is its own service provider the MS will proceed to next phase (collection of further information about the cell and the network). Otherwise, it will go back to frequency synchronization phase and try with new frequencies.

2.3 Network and Cell Information Acquisition

When a mobile station is successful in synchronizations, it reads four time-slot long Broadcast Control CHannel (BCCH) for the system information. This channel has a specific time-slot relative to the FCCH/SCH channels. The information in the BCCH channel includes: Location Area ID (LAI) o Mobile Country Code (MCC) o Mobile Network Code (MNC) o Location Area Code (LAC) Cell ID (CID) BCCH Allocation List (BA list) a list of neighboring cells beacon frequencies Information about the locations of common control channels (paging, random access and access grant channels)

 Frequency hopping Sequence Maximum mobile station power limit (MSTXPwr) Base stations minimum received signal power to access the network (RxLevAM) Update period (location update) At this stage an MS is fully furnished with necessary information and synchronization in order to communicate with the network. A mobile station is not yet to be attached to the network. It requires IMSI (International Mobile Subscriber Identity) attach and location update procedure. The IMSI attach procedure lets the network record that the mobile station is powered on and is ready to make or receive calls. The location update procedure lets the network record which location the MS is now anchored. To proceed with those tasks the mobile station must make a service request to the network.

3. IMSI Attach and Detach 3.1 IMSI Attach

A mobile station can go switched-on or off. When switched on it gets initialized (frequency synchronization, timesynchronization and system information acquisition) and then gets attached to the network. This is a kind of status notification to the network so that it can accept MSs call request and page when there is an incoming call. This process of attachment is called IMSI attach. Note that IMSI is the primary ID that uniquely identifies a Mobile Station. The IMSI attach procedure is as follows: Like all other service requests the MS gets an SDCCH data channel for this service. 1. On the SDCCH the MS sends a message to inform the network that the MS is switched on. 2. The MSC undergoes through the authentication procedure first. Then the MSC checks its VLR for information about this MS. If available (which means the MS was under this MSC before) the MSC updates the VLR entry (IMSI attached by removing IMSI detach flag). In some system the MSC may not inform any detach update to the HLR. In that case an attach update is also not required in this situation. Otherwise, the MSC will update the HLR as well. The MSC also updates the location of the MS according to the LAI (location area identity) sent by the MS.

3. The MSC returns an acknowledgment message to the MS. When the MSC finds the MS as a new MS (that is no entry for this MS in the VLR) the MSC queries the HLR and the HLR provides the detail about the MS. The MSC then create an entry into its VLR for the new MS with status IMSI attached. The HLR updates its data for that MS and also sends a message to the MSC, where the MS was located before, asking to update its VLR.

3.2 IMSI Detach

The IMSI detach procedure may be used by the MS when it is powered off. The mobile station is marked as detached in the VLR and will not be paged when there is an incoming call. The system information, broadcast over the cell by BCCH, informs the MS whether IMSI attach and detach procedures are required or not. The IMSI detach procedure is as follows: When the MS is powered off or the SIM card is taken out, the MS requests for IMSI detach service. Like all other service requests it gets an SDCCH data channel for this service. 1. On the SDCCH the MS sends a message to inform the network that the MS is about to switch to detached mode. 2. The VLR marks the IMSI as detached (IMSI detached flag is set). The IMSI detach procedure is neither acknowledged nor authentication-performed. 3. Optionally, The MSC informs the HLR about the IMSI detach state.

4. Location Update
The request for location updating can indicate one of three procedures. Location updating type normal IMSI attach Periodic registration

1. The MS listens to the beacon and checks if the LAI (location area identity) of the cell matches with the LAI stored in its SIM (from previous location update). The location update happens when they are different. In that case the MS requests for location update service. Like all other service requests it gets an SDCCH data channel for this service.

2. On the SDCCH the MS sends a message to inform the network its new location (new LAI). 3. The MSC undergoes through the authentication procedure first. Then the MSC updates its VLR. If the MS is new to this MSC (that is, location change causes the change of MSC) the MSC interacts with HLR to get all the required information about the MS, and gets its VLR a new entry for the MS. The HLR by that time updates its data for that MS and also sends message to the MSC, where the MS was located before, asking to update its VLR. 4. The MSC returns an acknowledgment message to the MS. The network then releases the SDCCH channel.

5. Periodic Registration
The system also has a provision of periodic registration. This provision helps avoid unnecessary paging of the mobile in the case where the MSC never receives the IMSI detach message. The period of this registration is broadcasted in the beacon signal (BCCH message). After a registration the MS and MSC reset their timers. When the timer in the MS expires, the MS performs a Location Updating, and the timers in MS and MSC restart. If the MS does not register within the determined interval plus a guard time, then the MSC considers the MS detached, and it updates its VLR and optionally the HLR accordingly. The MSC sends an acknowledgment to the MS.