vYV lsaVj

GSM Architecture

1
vYV lsaVj

2
 AGENDA vYV lsaVj

GSM Network Architecture

GSM Interfaces

GSM subsystems

Elements of GSM Network

Mobile Identification Numbers in GSM

Authentication

3
 vYV lsaVj

GSM:- Global System for Mobile communications

GSM is a 2G (second generation) system

4
 GSM Network Architecture- typical vYV lsaVj

OSS
NSS
HLR SCP
BSS
CAP
AuC

B E1
MS T PSTN
S ISDN
A SMSC
B
T E1 MSC VLR
S BSC
BSC CCS-7 Data
Signaling
Abis Networks
EIR
B
E1/Microwave
T LAPD Signaling E1
S IP
Air interface
MSC- VLR2 Billing
Server
5
 Abbreviations vYV lsaVj

• BSS:-Base station Subsystem (Radio Subsystem).

• NSS:-Network Subsystem
• OSS:-Operations and Maintenance subsystem
• MS : Mobile Station
• BTS : Base Transceiver Station
• BSC : Base Station Controller
• MSC : Mobile Switching Center
• VLR : Visitor Location Register
• HLR : Home Location Register
• SMSC : Short Message Service Center
• SCP:Service Control Point(IN Node)

6
 GSM Network Architecture…. vYV lsaVj

In practical implementation nodes like HLR,SCP are

connected with SSTP (Stand alone Signaling Transfer
Point).
CCS-7 signaling is used between MSC-BSC,MSC-
HLR,MSC-SCP,MSC-MSC,MSC-PSTN etc and LAPD
signaling is used between BSC-BTS and BSC-Transcoder.
Transcoder is controlled by the BSC and it is a BSS
element.
Due to low data rate requirement micro wave can be used
between BTS-BSC, but E1 is used for the connectivity of
rest of the elements
 Chaining of BTS is also possible i.e. one BTS can be
connected with other BTSs.
7
 GSM Network Architecture…. vYV lsaVj

 More then 1 MSC can be connected with one HLR,

Generally one PLMN have one HLR. HLR can be shared
by more then one PLMN also
 SCP (Service Control Point ) is an IN node that is
responsible for prepaid call handling and to provide
various Value added services to both pre/post paid
subscribers. SMP (Service Management node, SRP
(Service Resource Point) are other IN supporting nodes.
 Subscriber is created in HLR and AUC only, MSC get the
subscriber information from VLR/HLR

8
 GSM Interfaces vYV lsaVj

Following are the specified interfaces:

Um : MS - BTS (air or radio interface)

A : MSC – BSC
Abis : BSC – BTS (proprietary interface)
Ater/(Asub) : BSC – TRAU (proprietary interface)
B : MSC – VLR
C : MSC – HLR
D : HLR – VLR
E : MSC – MSC
F : MSC – EIR
G : VLR - VLR.

9
 GSM subsystems vYV lsaVj

MS:-Mobile Station
BSS:-Base station Subsystem (Radio Subsystem).
NSS:-Network Subsystem
OSS:-Operations and Maintenance subsystem
10
 Mobile Station (MS)
 Mobile Station consist of two units
Mobile Hand set Subscriber Identity Module
Mobile Hand set is one of the most complicated
GSM device. It provides user the access to the
Network. Each handset has unique identity no.
called IMEI.
vYV lsaVj
SIM is a removable module goes into the mobile
handset. Each SIM has unique number called
International Mobile Subscriber Identity (IMSI).
It has built in Micro-computer & memory into it.
It contains the ROM of 6 to 16KB,RAM of 128 to
256 bytes and EEPROM of 3 to 8KB
11
 Mobile Station (MS) vYV lsaVj

The Mobile Station consists of the Mobile Equipment (ME)

and the Subscriber Identity Module (SIM).

Mobile Equipment (ME)

The Mobile Equipment is the hardware used by the
subscriber to access the network.
The mobile equipment can be Vehicle mounted, with the
antenna physically mounted on the outside of the
vehicle or portable mobile unit, which can be handheld.
Mobiles are classified into five classes according to their
power rating. CLASS POWER OUTPUT
1 20W
2 8W
3 5W
4 2W
5 0.8W

12
 SIM vYV lsaVj

The SIM is a removable card that plugs into the ME;

identifies the mobile subscriber and provides information about those
services that the subscribers are entitled for.
The SIM contains several pieces of information
– International Mobile Subscribers Identity (IMSI)- identifies the mobile
subscribe; and used during initializing the mobile .
– Temporary Mobile Subscriber Identity (TMSI ) – This also identifies
the subscriber.; but is periodically changed by the system to protect
the identity of the subscriber.
– Location Area Identity (LAI ) - Identifies the current location of the
subscriber.
– Subscribers Authentication Key ( Ki ) - This is used to authenticate the
SIM card.
– Mobile Station International Subscriber Directory Number (MSISDN ) -
This is the telephone number of the mobile.

13
 SIM vYV lsaVj

Most of the data contained within the SIM is protected

against reading or alterations after the SIM is issued.
Some of the parameters ( e.g.. LAI ) will be continuously
updated to reflect the current location of the
subscriber.
The SIM card can be protected by use of Personal
Identity Number (PIN ) password.
The SIM is capable of storing additional information such
as accumulated call charges.

14
 Base Station Sub System (BSS) vYV lsaVj

Base station Subsystem includes the equipment

and functions related to the management of the
connections on the radio path

15
 Base Station Sub-System vYV lsaVj

The BSS is the fixed end of the radio interface

• provides control and radio coverage functions for one or
more cells and their associated MSs.
• the interface between the MS and the MSC.

 The BSS consists of two basic Network Elements .

o Base Transceiver Stations (BTSs).
o Base Station Controller (BSC).
 BTS contains the radio components, to communicate with
MSs in a given area
 BSC supports call processing functions and the interfaces
to the MSC.

16
 Base Transceiver Station (BTS) vYV lsaVj

• The BTS consists of the hardware components, to

provide the Air Interface between the BSS and the
MSs.
• The BTS provides radio channels (RF carriers) for a
specific RF coverage area. The radio channel is the
communication link between the MSs within an RF
coverage area and the BSS.
• The BTS also has a limited amount of control
functionality which reduces the amount of traffic
between the BTS and BSC.
• A BTS comprises of radio transmission and reception
devices, including the antennas, and also all the signal
processing specific to the radio interface

17
 Base Station Controller (BSC) vYV lsaVj

Controls and manages the associated BTSs, and

interfaces with the MSC and the Operations and
Maintenance Centre (OMC).
The following functions are provided by the BSC:
– Controls the BTS components
– Performs Call Processing.
– Provides the O & M link (OML) between the BSS
and the OMC.
– Provides the A Interface between the BSS and
the MSC.
– Manages the radio channels.
– Transfers signaling information to and from MSs.

18
 Role of BSC vYV lsaVj

Why there is a need of BSC? Why BTS are not

directly connected with MSC?

B
T B
S T
S
MSC/
MSC/ VLR
VLR

BSC B
B T
T S
S
Assumption :-BTSs are directly connected with
MSC
19
 Why BTS are not directly connected with MSC? vYV lsaVj

It will be the wastage of media (as

compare to the current practice)
It will increase the load of MSC i.e. B
MSC has to manage the radio channels, T
control the BTSs, manage the handover S
MSC/
etc, apart from other regular works VLR
BTS does not have any switch, it just
puts 16 Kbps data of each subscriber in
PCM time slot and forward further. So
B
one PCM time slot has data of 4 T
subscribers. MSC works on 64 Kbps so in S
this condition transcoders are required
Assumption :-BTSs are directly
between BTS & MSC, so the number of
transcoders required will be much more , connected with MSC
it is will be a costly practice

20
 Transcoder( XCDR ) vYV lsaVj

• The speech transcoder is the interface

between the 64 kb/s PCM channel and the
13 kb/s vocoder (actually 22.8 kb/s after
channel coding) channel used on the Air
Interface.
• This reduces the amount of information
carried on the Air Interface and hence, its
bandwidth.
• If the 64 kb/s PCM is transmitted on the air
interface without compression, it would
occupy an excessive amount of radio
bandwidth. This would use the available
radio spectrum inefficiently.
21
 Transcoder( XCDR ) vYV lsaVj

• The required bandwidth is therefore reduced by processing

the 64 kb/s PCM so that the amount of information required
to transmit the digitized voice falls to 13kb/s.
• The XCDR can multiplex 4 traffic channels into a single 64
kb/s timeslot. Thus a E1 serial link can carry 4 times as
many channels.
• This can reduce the number of E1 leased lines required to
connect remotely located equipment.
• When the transcoder is located between the MSC and the
BSC it is called a remote transcoder (RXCDR).

22
 Transcoding vYV lsaVj

30 Timeslots
1 traffic channel / TS Each Timeslot =16 X 4
64 Kbps / TS = 64 Kb/s
4 E1 lines = 30 X 4 30 timeslots = 30 x 4
=120 Timeslots =120 traffic channels

MSC XCDR BSC

Transcoded information from four calls

0 1 2 16 31

23
Network & Switching Subsystem (NSS) vYV lsaVj

Network and Switching Subsystem includes

the equipment and functions related to the
total network i.e. for end-to-end of a call

24
 Network & Switching Subsystem vYV lsaVj

• The Network Switching Subsystem includes the main

switching functions of GSM as well as the databases
needed for subscriber data and mobility management.
The NSS also manages the communications between
the GSM users and other telecommunication network
users.
• The basic switching function like setting up calls to
and from GSM users is performed by the MSC. The
MSC has interface with the BSS on one side (through
which MSC/ VLR is in contact with GSM users) and the
external networks on the other (ISDN/ PSTN/ PSPDN)
& other PLMN or MSCs.
25
 Mobile Switching Centre (MSC) vYV lsaVj

• The Mobile services Switching Centre (MSC) co-

ordinates the setting up of calls to and from GSM
users.
• It is the telephone switching office for MS originated or
terminated traffic and provides the appropriate bearer
services, teleservices and supplementary services.
• It controls a number of BSC’s within a specified
geographical coverage area and gives the radio
subsystem access to the subscriber and equipment
databases.

26
 Functions of MSC vYV lsaVj

• The MSC carries out several different functions depending

on its position in the network.
• When the MSC provides the interface between PSTN and
the BSS in the GSM network it is called the Gateway MSC.
• Some important functions carried out by MSC are Call
processing including control of data/voice call setup, inter
BSS & inter MSC handovers, control of mobility
management, Operation & maintenance support including
database management, traffic metering and man machine
interface & managing the interface between GSM & PSTN.

27
 Home Location Register( HLR ) vYV lsaVj

• The HLR contains the master database of all

subscribers in the PLMN.
• This data is remotely accessed by the MSC´s and VLRs
in the network.
• The data can also be accessed by an MSC or a VLR in
a different PLMN to allow inter-system and inter-country
roaming.
• A PLMN may contain more than one HLR, in which case
each HLR contains a portion of the total subscriber
database. There is only one database record per
subscriber.

28
 Functions of HLR vYV lsaVj

• The subscribers data may be accessed by the IMSI or the

MSISDN.
• The parameters stored in HLR are
– Subscribers’ ID (IMSI and MSISDN )
– Current VLR of the subscriber
– Supplementary services subscribed to by the
subscriber
– Supplementary services information
(e.g. Current forwarding address).
– Authentication key and AuC functionality.
– TMSI and MSRN

29
 Visitor Location Register (VLR) vYV lsaVj

• The VLR is a local subscriber database, holding

details of those subscribers who enter the area of the
network that it covers.

• The details are held in the VLR until the subscriber

moves into the area serviced by another VLR.

• The VLR provides the system elements local to the

subscriber, with basic information of that subscriber,
thus removing the need to access the HLR every
time subscriber information is required.

30
 Functions of VLR vYV lsaVj

• The data in VLR includes most of the information

stored at the HLR, as well as more precise and
latest location and status information.
• The additional data stored in VLR are
– Mobile status ( Busy / Free / No answer etc)
– Location Area Identity ( LAI )
– Temporary Mobile Subscribers Identity ( TMSI)
– Mobile Station Roaming Number ( MSRN )

31
 Need of HLR vYV lsaVj

In traditional telephone exchanges subscriber data is

attached with switch itself, then why subscriber data
in GSM is attached with HLR not with the MSC ?

In GSM, the Subscriber is “mobile”, so the

subscriber may not be always available in the same
MSC area ; hence, subscriber data is not attached
with the MSC and it is copied to a separate database
(the VLR) from time-to-time

32
 Need of VLR and HLR vYV lsaVj

Why there is two subscriber data base in GSM i.e. VLR &
HLR? Why HLR it self do not keep the information of in-
roamers?
If HLR can also contain information regarding active /in-
roamer subscribers then for each call (whether it is mobile
originating or mobile terminating) MSC has to contact the
HLR and that will unnecessarily increase the signaling
load
VLR contains the information regarding location area of
subscriber which is being frequently updated. So if VLR
is not there this has to be taken care by the HLR itself and
which would also increase the signaling load.

33
 Authentication Centre (AUC) vYV lsaVj

• The AuC is a processor system that perform

authentication function.
• It is normally co-located with the HLR.
• The authentication process usually takes place
each time the subscriber initializes on the
system.
• Each subscriber is assigned an authentication
key (Ki) which is stored in the SIM and at the
AUC.
• A random number of 128 bits is generated by the
AUC & sent to the MS.

34
 Equipment Identity Register (EIR) vYV lsaVj

• The EIR contains a centralized database for validating the

international mobile station equipment identity, the IMEI.
• The database contains three lists:
– The white list contains the number series of equipment
identities that have been allocated in the different
countries. This list does not contain individual numbers
but a range of numbers by identifying the beginning and
end of the series.
– The grey list contains IMEI’s of equipment to be
monitored and observed for location and correct function.
– The black list contains IMEI’s of MS’s which have been
reported stolen or are to be denied service.
• The EIR database is remotely accessed by the MSC’s in the
Network and can also be accessed by an MSC in a different
PLMN.

35
 Equipment Identity Register (EIR) vYV lsaVj

EIR

White List Grey List Black List

All Valid Service allowed Service denied

assigned ID’s but noted

Range 1 MS IMEI 1 MS IMEI 1

Range 2 MS IMEI 2 MS IMEI 2

Range n MS IMEI n MS IMEI n

36
Operation & Maintenance Subsystem (OSS) vYV lsaVj

Operations and Maintenance Subsystem

includes the operation and maintenance of GSM
equipment for the radio and core network
through OMC-R and OMC-S.

37
 Operation And Maintenance Centre vYV lsaVj

Controls and monitors the Network elements within a region.

Also monitors the QoS being provided by the Network.

The following are the main functions performed by the OMC

– The OMC allows network devices to be manually removed for or
restored to service. The status of network devices can be checked
from the OMC and tests and diagnostics invoked.
– The alarms generated by the Network elements are reported and
logged at the OMC.
– Maintenance personnel monitor and analyze these alarms and take
appropriate action .
– The OMC keeps on collecting and accumulating traffic statistics from
the network elements for analysis.
– Software loads can be downloaded to network elements or uploaded
to the OMC

38
 Network Structure vYV lsaVj

• GSM Service Area

• PLMN Service Area
• MSC Service Area
• Location Area
• Cells

39
Relation between areas in GSM N/w vYV lsaVj

Cell

Location Area
MSC Service Area
PLMN Service Area

GSM Service Area

40
 PLMN Service Area vYV lsaVj

MSC2
MSC1 VLR1
VLR2

MSC 2 VLR3
V
MSC4
VLR4

41
 MSC Service Area vYV lsaVj

LA2
LA1 LA3
VLR

MSC

LA4 LA6
LA5

42
 MSC Service Area vYV lsaVj

LA2
LA1 LA3
VLR

MSC
C2 C3
C1 LA6
LA4 C4
LA5
C6 C5

43
 Mobile Identification Numbers vYV lsaVj

• IMEI
• MSISDN
• IMSI
• TMSI
• MSRN

44
Mobile Station International Subscriber Directory Number (MSISDN vYV lsaVj

Human identity used to call a MS

The MSISDN is the telephone number of the MS.
This is the number a calling party dials to reach the subscriber.
It is used by the land network to route calls toward the MSC.

CC NDC SN

91 9412 xxxxxx

CC = Country code
NDC = National Destination Code
SN = Subscriber Number

45
 International Mobile Subscribers Identity (IMSI) vYV lsaVj

• Network Identity Unique to a MS

• The International Mobile Subscriber Identity (IMSI) is the
primary identity of the subscriber within the mobile
network and is permanently assigned to that subscriber.
• The IMSI can be maximum of 15 digits.

MCC MNC MSIN

404 XX 12345..10

MCC = Mobile Country Code ( 3 Digits )

MNC = Mobile Network Code ( 2 Digits )
MSIN = Mobile Subscriber Identity Number

46
 Temporary Mobile Subscribers Identity (TMSI ) vYV lsaVj

• The GSM system can also assign a Temporary Mobile

Subscriber Identity (TMSI).
• After the subscriber's IMSI has been initialized on the
system, the TMSI can be used for sending messages
backwards and forwards across the network to identify
the subscriber.
• The system automatically changes the TMSI at regular
intervals, thus protecting the subscriber from being
identified by someone attempting to monitor the radio
channels.
• The TMSI is a local number and is always allocated by
the VLR.
• The TMSI is maximum of 4 octets.
47
International Mobile Equipment Identity(IMEI) vYV lsaVj

• IMEI is a serial number unique to each mobile

• MS is identified by an International Mobile station Equipment Identity
(IMEI) number which is permanently stored in the Mobile Equipment.
• On request, the MS sends this number over the signalling channel to
the MSC.
• The IMEI can be used to identify MSs that are reported stolen or
operating incorrectly.

TAC FAC SNR SP

6 2 6 1

TAC = Type Approval Code

FAC = Final Assembly Code
SNR = Serial Number
SP = Spare

48
 Base Station Identity Code vYV lsaVj

BSIC allows a mobile station to distinguish between neighboring base

stations.
It is made up of 8 bits.
7 6 5 4 3 2 1 0

0 0 NCC BCC
BCC

NCC = National Colour Code( Differs from operator to operator )

BCC = Base Station Colour Code, identifies the base station to help
distinguish between Cell’s using the same BCCH frequencies

49
 Cell Global Identity ( CGI ) : vYV lsaVj

LAI

MCC MNC LAC CI

CGI

MCC = Mobile Country Code (404 & 405 for India)

MNC = Mobile Network Code
LAC = Location Area Identity
CI = Cell Identity

50
 Mobile Station Roaming Number(MSRN) vYV lsaVj

• The MSRN is used in the GMSC to set up a

connection to the visited MSC/VLR.

51
 Authentication vYV lsaVj

• AUC is a separate entity and physically included in

HLR.
• AUC Protect against intruders in air interface.
• Authentication (Ki) and ciphering (Kc) key are stored
in AUC data base.
• Keys change randomly with each call.
• Keys are never transmitted to MS on air Only
calculated response are sent.

52
 Authentication & Encription vYV lsaVj

AUC
Database SRES RAND
Kc
IMSI1 ki1 H
Algorithm for
Ciphering L
IMSI2 ki2
A8 Kc R
IMSI3 ki3 64 bits
Algorithm for
Generation
Authentication SRES
of Random A3
Number 32 bits
RAND RAND

53
 Authentication vYV lsaVj

• Authentication is used to check the validity of a

mobile subscriber.

At MS At N/W

Ki Ki
RAND( 128 bits )

A3 A3

SRES SRES
=? ( 32 bits )

AUTHENTICATION

54
 vYV lsaVj

• Ki ( 128 bits) : Identification Key

- Purpose : Ki is used to calculate SRES and Kc.
- Ki is stored in SIM and HLR.
- Ki is never transmitted over signaling network.

• RAND ( 128 bits ):Random Number

- Purpose : RAND is used to calculate SRES and Kc.

• Kc ( 64 bits ) : Ciphering Key

- Purpose : Kc is used to encrypt data over radio interface.

• SRES ( 32 bits) :Signed Response

55
 Ciphering vYV lsaVj

• Ciphering is used to encrypt data on radio interface.

RAND Ki
Kc generation is done at the
time of Authentication.
A8
Frame
No. (22
bits ) Kc ( 64 bits)

A5

Ciphering Stream
Ciphered Bits
XOR
Information Bits ( 114 bits )

CIPHERING
56
Thank You vYV lsaVj

vYV lsUVj

57