Fundamentals of

Communications

17: GSM I

EE3158
Professor Ian Groves
ian.groves@kcl.ac.uk
www.ctr.kcl.ac.uk/members
GSM I
 Basic components of GSM
 MS / SIM / ME / BTS / BSC
 MSC / VLR / HLR / IN / AuC / EIN
 Basic Processes of GSM
 Handover
 Paging
 Location Updating
 Incoming / Outgoing Call
 Message flow sequences

EE3158 – Lecture 17 Fundamentals of Communications Slide 2

Basic Components of GSM
AuC

HLR VLR

BTS other BSSs

Mobile
Services
BSC Switching
BTS Centre IN Fixed line
(MSC)
telephone
BTS network
MS: Mobile Station
SIM: Subscriber Identity Module
other MSCs
BTS: Base Transceiver Station
MS including SIM
BSC: Base Station Controller
HLR: Home Location Register
VLR: Visited Location Register
AuC: Authentication Centre
IN: Interrogating Node

EE3158 – Lecture 17 Fundamentals of Communications Slide 3

1. Mobile Station
 MS is the physical equipment used by a GSM
subscriber (their ‘mobile handset’).
 It comprises two parts:
 a Subscriber Identity Module (SIM) and
 the Mobile Equipment (ME).

EE3158 – Lecture 17 Fundamentals of Communications Slide 4

2. Subscriber Identity Module
 (SIM) is a smart card which carries all the subscriber specific
information used by an MS. Major functions are to identify the current
user of an MS and to take part in security and confidentiality
procedures. It also stores recent location data and may also store
personal information for the user such as abbreviated dialling codes
(telephone directory). Specific functions include:
 Permanent storage of a subscriber’s International Mobile
Subscriber Identity (IMSI) and Authentication key (Ki)
 Semi permanent storage of system information e.g. current
Location Area Identity (LAI), encryption key Kc and lists of
preferred / forbidden GSM networks
 Semi permanent storage of user data, ‘telephone directory’,
short messages
 Participation in mobility procedures e.g. user authentication,
generation of ciphering key, instigation of location updates.
 Protected by PIN

EE3158 – Lecture 17 Fundamentals of Communications Slide 5

3. Mobile Equipment
 (ME) provides the radio and processing needed to
access the GSM network, plus a man machine
interface MMI to enable the user to access services.
Specific functions
 radio transceiving and signal processing
 radio related operations: power control; timing advance;
discontinuous transmission (DTX); slow frequency hopping
(SFH).
 Call handling
 man-machine interface, display, keypad, speech
transducers.
 interfaces to external equipment e.g. laptops / palmtops

EE3158 – Lecture 17 Fundamentals of Communications Slide 6

4. Base Transceiver Station
 (BTS) provides GSM radio coverage within a cell. It
comprises radio transmitting and receiving equipment
(including antennas) and associated signal
processing. A ‘sophisticated’ radio modem. Specific
functions include:
 antennas (with diversity)
 radio transceiving and signal processing
 sending TDMA timing advance instructions to MS
 implementation of radio related operations: slow
frequency hopping (SFH); discontinuous
transmission (DTX); ciphering and power control.

EE3158 – Lecture 17 Fundamentals of Communications Slide 7

5. Base Station Controller
 (BSC) is a small switch with enhanced processing
capability. It acts as a local concentrator of traffic
and provides local switching to effect handover
between a number of BTSs. It manages the radio
channel and undertakes control of a variety of radio
related procedures ensuring that reliable radio links
are maintained. Its responsibilities include:
 co-ordination and control of a number of BTSs
 traffic concentration
 low level switching operations
 network management interface to all radio elements

EE3158 – Lecture 17 Fundamentals of Communications Slide 8

5. Base Station Controller… 2
 radio channel management
 handover between BTSs within its domain
 scheduling of paging request
 passing system information e.g. LAI (Location Area Identity)
to BTSs for onward transmission
 queuing
 control of radio related operations: slow frequency hopping
(SFH); discontinuous transmission (DTX); ciphering and
power control
 service transcoding, changing air interface rates to
network rates e.g. converting speech from 13 kbit/s
to 64 kbit/s

EE3158 – Lecture 17 Fundamentals of Communications Slide 9

6. Mobile Switching Centre
 (MSC) is an ISDN switch with (significantly) enhanced
processing capability. An MSC will parent a number of BSCs.
Responsible for call handling of the mobile subscribers within
its domain; this includes generating call charging records
(for billing). Specific responsibilities of the MSC include:
 call control
 generation of call records
 supplementary service execution
 inter BSC and inter MSC handover
 Whilst they are identified as distinct entities within the
specifications, the Mobile-services Switching Centre and
Visitor Location Register (VLR) are invariably implemented
as a single MSC/VLR unit.

EE3158 – Lecture 17 Fundamentals of Communications Slide 10

7. Visitor Location Register
(VLR) is an intelligent database and service control function. It
stores (on a temporary basis) the information needed to handle
calls set up or received by MSs registered with it and controls
certain services (primarily those associated with outgoing calls).
This includes their International Mobile Subscriber Identities (IMSI),
current Location Area Identities (LAIs) and supplementary service
entitlements. Responsibilities of the VLR include:
 executing supplementary service programs (outgoing calls barred)
 initiating authentication and ciphering
 initiating paging
 mapping of various identities (MSISDN, IMSI, TMSI, MSRN)
 passing location information to HLR

EE3158 – Lecture 17 Fundamentals of Communications Slide 11

8. Interrogating Node
 (IN) is the target for calls bound for GSM users. It is
responsible for determining the location of a called
subscriber and for routeing calls accordingly. The IN
is commonly combined with an MSC forming what is
known as a Gateway MSC (GMSC).

EE3158 – Lecture 17 Fundamentals of Communications Slide 12

9. Home Location Register
 (HLR) is an intelligent database and service control function
responsible for management of each subscriber’s records
and control of certain services (primarily those associated
with incoming calls). It carries subscription details for a
subscriber and location information enabling the routeing of
incoming calls towards the subscriber, i.e. the MSC/VLR
currently serving the MS. Responsibilities of the HLR include:
 management of service profiles
 mapping of subscriber identities (MISDN, IMSI)
 supplementary service control and profile updates
 execution of supplementary service logic e.g. incoming calls
barred.
 passing subscription records to VLR

EE3158 – Lecture 17 Fundamentals of Communications Slide 13

10. Authentication Centre
 (AuC) is an intelligent database concerned with the regulation
of access to the network ensuring that services can be used
only by those who are entitled to do so and that the access is
achieved in a secure way.
 The principle is that the AuC and the SIM have a unique key for
every subscriber (Ki) which is used as the basis for generating a
response (SRES) to a random number (RAND) generated by the
AuC. Only the true SIM will be able to generate the correct
response and thus gain access to the network.
 The AuC is generally integrated with the HLR.

 [Also EIR the Equipment Identity Register - another database

that holds a list of ‘allowed’ equipment identities, i.e. ME
numbers: white / grey / black lists]

EE3158 – Lecture 17 Fundamentals of Communications Slide 14

GSM Processes
 Handover
 brief introduction
 Paging
 Location Area
 Location Update
 Location Area Message Sequence as example
 Incoming Call
 Outgoing Call

EE3158 – Lecture 17 Fundamentals of Communications Slide 15

Handover
 Handover is the means of maintaining a call when a user
moves outside the coverage area of the serving cell.
 The call must be switched to an alternative cell to provide
service, automatically and without loss of service.
 Handover is a complex process requiring synchronisation of
events between the mobile station and the network.
 In particular, there is the need to route the call to the new
cell before handover can be effected whilst maintaining the
old connection until the new connection is known to have
succeeded.
 Handover is a time critical process requiring action to be
taken before the existing radio link degrades to such an
extent that the call is lost.

EE3158 – Lecture 17 Fundamentals of Communications Slide 16

Paging
 Paging is a process of broadcasting a message which alerts
a specific mobile to take some action, for example if there is
an incoming call to be received.
 If the system does not know the precise cell in which a
mobile is located it must perform paging in a number of
cells.
 An extreme approach would be to undertake paging
throughout the entire coverage area of a cellular system
whenever a mobile is to be alerted; however, in anything
but the smallest system this would be wasteful of valuable
signalling capacity, particularly over the air interface.
 The problem is addressed by the use of location areas and
location updating.

EE3158 – Lecture 17 Fundamentals of Communications Slide 17

Location Updating
 Location updating is used to reduce the area over which
paging must be undertaken in a cellular system.
 The cellular coverage area is divided up into a number of
location areas.
 All cells broadcast the identity of their Location Area (LAI).
 Each time a mobile station observes that it has moved into a
new location area it informs the network by performing a
location update; this enables the network to perform paging
over a smaller area than would otherwise be necessary.
 In the extreme case each cell could be a location area, the
system would know very precisely where a mobile was but
at the expense of a very high level of location update
signalling. As a compromise location areas are generally
defined as a group of cells.

EE3158 – Lecture 17 Fundamentals of Communications Slide 18

Location Area
Public Land Mobile Network (PLMN)

MSC / VLR Area

Location Area

Cell

 GSM Network Areas...

EE3158 – Lecture 17 Fundamentals of Communications Slide 19

GSM Network Areas
 Public Land Mobile Network
 the area served by one operator, e.g. Vodafone / Orange etc.
 MSC / VLR Area
 a group of Location Areas served by one MSC / VLR, i.e. all
the cells connected to that MSC / VLR
 Location Area
 a Group of Cells within one MSC/VLR Area identified by its
Location Area Identity (LAI)
 Cell
 identified by its Cell Global Identity number (CGI) corresponds
to the radio coverage are of one base transceiver station

EE3158 – Lecture 17 Fundamentals of Communications Slide 20

Location Update
 The MS detects that it has entered a new location area by
comparing the last known LA (stored on the SIM) with the
information broadcast by the local cell.
 The MS gains access to a radio channel and requests a
location update.
 If the serving MSC/VLR is unchanged the network can
immediately authenticate the MS and note the change of LA.
 If the MS has moved MSC/VLR, the MSC/VLR addresses a
message to the HLR.
 The HLR notes the new location (VLR) and downloads
security parameters to allow the network to authenticate the
mobile, it also passes on subscription details of the user to
the new VLR and informs the old VLR to delete its records.

EE3158 – Lecture 17 Fundamentals of Communications Slide 21

EE3158 – Lecture 17 Fundamentals of Communications Slide 22
LA Update Message Sequence
 MS to NEW MSC (via BSS)
 New MSC to NEW VLR
 New VLR to HLR
 HLR to OLD VLR
 OLD VLR to HLR
 HLR to NEW VLR
 NEW VLR to HLR
 HLR to NEW VLR
 NEW VLR to NEW MSC
 NEW VLR to MS
– location updating request
– update location area
– update location
– cancel location
– cancel location ACK
– insert subscriber data
– insert subscriber data ACK
– update location ACK
– update location area ACK
– location updating accept

 ACK = acknowledge

EE3158 – Lecture 17 Fundamentals of Communications Slide 23

Revision
 Components of GSM System
 Handover
 Location Areas
 Location Area Update
 Location Area Update Message Sequence

EE3158 – Lecture 17 Fundamentals of Communications Slide 24