GSM

Global System for Mobile Communication

1

GSM
General :
    

Evolution Concepts Architecture Planning Implementation

GSM
Evolution :


First Generation:


1946 - Manual

GSM GSM
Various subsystems
1. Network Subsystem includes the equipments and functions related to end-to-end call, management of end-tosubscribers, mobility and interface with the fixed PSTN. 2. Radio Subsystem includes the equipments and functions related to the management of the connections on the radio path including the management of handovers. 3. Operations and Maintenance subsystem (OMS) includes the operation and maintenance of GSM equipment and supports the operator and network interface. 4

GSM
Network Architecture
OSS
HLR
B T S B T S

PSTN ISDN

BSC

MSC VLR

Data Networks

B T S

Air interface

MSC VLR
5

GSM GSM
Interfaces
ISDN

SS AUC
PSPDN

X.25 VLR X.25 HLR EIR

CSPDN

PSTN

MSC OMC

PLMN

A - Interface BSS BSC

A-bit interface

Access to different services

BTS Base station system Information transmission Call connections and information transmission MS

GSM GSM
Network Structure
GSM Service Area  PLMN Service Area  MSC Service Area  Location Area  Cells

7

GGSMM S
PLMN Service Area
I MSC VLR MSC GSM-PLMN III IV
V

II MSC VLR

MSC

VLR

GSM
GSM
MSC Service Area
LA2 LA1 VLR MSC LA3

LA4

LA6 LA5

GSM
GSM Cells
LA2 LA1 VLR MSC LA3

LA4

C1 C2 LA6 LA5 C6 C5

C3 C4 C=CELL
10

GSM GSM
Relation between areas in GSM

Cell Location Area Area served by a BTS Location Area MSC Service Area PLMN Service Area GSM Service Area
11

GSM GSM
LA Coding
MCC 3 digit MNC 3 digit LAI LAC 2 Octets

12

GSM GSM
Cell Layout (4-Cell,3-sectored) (4-Cell,31A 1B 1C 4A 4B 4C 2C 3A 3B 2A 2B 2C 4C 4A 4B 4C 3C 3C 4A 4B 2C 3A 3B 1C 1C 3C 2A 2B 4C 1A 1B 3C 2A 2B 1A 1B 3A 3B 1C 4A 4B 3A 3B 1A 1B

= BTS = BSC

13

GSM GSM
Frequency Assignment


1A - 1,13,25,37,49,61,73,85,97,109,121 2A - 2,14,26,38,50,62,74,86,98,110,122 1B - 5,17,29,41,53,65,77,89,101,113 1C - 9,21,33,45,57,69,81,93,10,115

14

GSM GSM
Mobile Station
  

Portable, vehicle mounted, hand held MS identified by unique IMEI MSISDN number to identify the destination MS in the complete network IMSI is mobile identity within the mobile network and also for billing purpose Stored in SIM card and usable with any mobile equipment The GSM system can also assign a TMSI to identify a mobile.
15

GSM GSM
Functions of Mobile Station
  

 

Voice and data transmission Frequency and time synchronization Monitoring of power and signal quality of the surrounding cells for optimum handover determined by BER and six best received BTS signals list by ms to current BTS Provision of location updates even during inactive state Equalization of multi path distortions in the MS for the received signal Display of short messages upto 160 characters long Timing advance
16

GSM GSM
Mobile Station - Power Levels
Power Class Class 1 1 2 2 3 3 4 4 5 5 Max. Peak Max. Peak Power Power 20W 20W (43 dBm) (43 dBm) 8W 8W (39 dBm) (39 dBm) 5W 5W (37 dBm) (37 dBm) 2W 2W (33 dBm) (33 dBm) 0.8W 0.8W (29 dBm) (29 dBm) Tolerance (dB) Tolerance (dB) Normal Extreme Normal Extreme +/- 22 +/- 2.5 +/+/- 2.5 +/- 22 +/+/- 22 +/+/- 22 +/+/- 2 +/- 2 +/- 2.5 +/- 2.5 +/- 2.5 +/- 2.5 +/- 2.5 +/- 2.5 +/- 2.5 +/- 2.5
17

GSM GSM
Mobile Terminal Types
Mobile Termination ( type 0 ) Mobile Termination ( type 1 ) Terminal Terminal Adaptor ISDN S interface Terminal Mobile Termination ( type 2 )

Terminal -tomodem interface

Mobile terminal types

18

GSM GSM
SIM Card
 

 

SIM Module Unique Mobile Subscribers ID through IMSI and ISDN numbers PIN Authentication Key Ki and A3,A5 and A8 algorithms

19

GSM GSM
Mobile Identification Numbers
   

MSISDN IMSI TMSI MSRN

20

GSM GSM
MSISDN
 

Mobile Subscribers ISDN Number The MSISDN is a number assigned to the mobile subscriber. It is registered in the telephone directory and used by the calling party for dialing.
1 to 3 digits CC Variable NDC Variable SN

N(S)N MSISDN : not more than 15 digits

21

GSM GSM
IMSI
 

International mobile subscribers Identity The IMSI is an unique identity which is used internationally and used within the network to identify the mobile subscribers. The IMSI is stored on the subscriber identity module (SIM), the HLR, VLR and AC database.

22

GSM GSM
IMSI
3 digits MCC 3 digits MNC NMSI Not more than 9 digits MSIN

IMSI : Not more than 15 digits

23

GSM GSM
TMSI



Temporary Mobile subscribers Identity

The TMSI is an identity which guarantees the integrity of the mobile subscribers on the radio interface. The VLR assigns a TMSI to each mobile subscribers entering the VLR area and reallocation of TMSIs is possible. The TMSI may also change under certain circumstances.

24

GSM GSM
MSRN



Mobile Station Roaming Number

The MSRN is used in the GMSC to set up a connection to the visited MSC/VLR. The MSC/VLR assigns an MSRN to a visiting mobile subscribers when he is involved in a mobile terminated call during the interrogation procedure.

25

GSM GSM
IMEI
 

International Mobile Equipment Identity The IMEI is an unique code allocated to each mobile equipment. It is used for the IMEI check performed in the EIR. Equipment control (IMEI check)
White List  Grey List  Black List

26

RADIO SUB SYSTEM (RSS)

GSM
MSC/VLR

BSC BSC

BSC

RSS
n BTS n BTS
27

GSM GSM
BASE STATION SUBSYSTEM(BSS)-I SUBSYSTEM(BSS) 

It consists of Base Transceiver (BTS) and Base Station Controller(BSC) BTS serves one cell and is a network component controlled by BSC One BTS can handle 3 to 5 radio carriers carrying between 24 and 40 simultaneous connections

28

GSM GSM
BASE STATION SUBSYSTEM(BSS)-II SUBSYSTEM(BSS)

BTS comprises radio transmission and reception devices, includes antenna, signal processors A single transceiver within BTS supports 8 basic radio channels of the same TDMA frame Interface between MS and BTS is Um and between BTS and BSC is Abis Interface between BSC and MSC is SS7
29

G S BTS M Functions Of
functions RF Transceiver control Base band processing and multiplexing Dedicated channel function and control Common& terrestrial channel function and control Synchronization O & M function
30

G SOF BTS -I M FUNCTION

  

GSM

 

Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna Transcoding and rate adaption Time and frequency synchronisation signals transmitted from BTS over FCCH and BCCH channels Each BTS serves a single cell Voice communication through full rate or half rate speech channel
31

G SOF BTS -II M FUNCTION

 

GSM

  

Received signal from mobile is decoded , decrypted and equalized before demodulation Frequency hopping controlled such that no two MSs in the same BSC area are hopped together Random access detection Timing advance Uplink radio channel measurements
32

G S M -III FUNCTION OF BTS

 

GSM

13 kbps transcoded into 16 kbps and combining four such channels to bring it to 64 kbps BTS mainly consists of coupling network, radio section, base band processing section and maintenance unit Max. no of channels that can supported by a single antenna is dependent on the peak power requirement of various channels Multiple antennas for diversity are used to combat adverse effects of radio path
33

G S BSC M Functions Of
Channel Configuration management Traffic & dedicated channel management channel coding/ decoding Timing Advance Radio Source Management Mobility management. Paging Handover Encryption
34

G S OF BSC-I M FUNCTIONS BSCGSM

 

Radio resource management for the cells under its control InterInter-cell handover for MS moving between BTS in its control Reallocation of frequencies among BTSs to meet heavy demand during peak hours Power management of BTSs by broadcasting minimum power level over BCCH Time and frequency synchronization reference signals broadcast by its BTSs
35

G S OF BSC--II M FUNCTIONS BSC

GSM
  

Time delay measurement of the received signals from MSs with respect to BTS clock Controls frequency hopping Performs traffic concentration to reduce the number of lines from BSC to MSC and BTSs Provide interface to the operations and management for BSS BSC can perform traffic concentration to reduce congestion between BTS and BSC
36

G SOF BSC-III M FUNCTIONS BSCGSM

  

BSC performs call processing Speech transcoders are generally located at the site of MSC For omni directional rural configurations, BSC and BTS are on the same site BSC consists of terminal control unit towards BTS, switching matrix and digital trunk controller towards MSC, and central processor to OMC All data of interest are at BSC and OMC and down loaded to BTS Switching matrix is used for switching 64kbps 37 channels

GSM GSM
BTSBTS-BSC Configurations-I ConfigurationsBTS BSC BTS A-Interface Omnidirectional Configuration BTS BTS 1

A-Interface

2 Omnidirectional Configuration A-Interface BTS BTS BSC 3 Star configurations BTS

38

GSM GSM
BTSBTS-BSC Configurations-II ConfigurationsBTS BTS BTS A-Interface BSC 4 A-Interface 5 A-Interface 6
39

Multidrop configuration
BTS BTS BTS

BSC
BTSBTS BTS

Sectorized Configuration

BTS BTS BTS

BSC

GSM GSM
MSCMSC-BSS Configurations
Multi - cell site (sector Cells Configuration -5 A BTS A BSS Single - cell site Configuration -1 A-bis BSC A-bis BTS Multi - cell site = multi--BTS site BTS BTS BTS Many single cell sites

MSC

BSS

BTS

BTS

MCC: Mobile Switching Centre BSS: Base Station System BSC: Base Station Controller BTS: Base Transceiver Station

Configuration -6

40

GSM GSM
Transcoder Configurations
To MS BTS TRAU BSC MSC To fixed networks To MS BTS BSC TRAU MSC To fixed networks

To MS RF Air Interface

A-bis BTS Interface BSC A Interface TRAU MSC To fixed networks

13 kbps encoded voice/ 12 kbps data 16 kbps transmission 64 kbps transmission

Transcoder (XC) configurations

41

Network and Switching Subsystem (NSS)

SS7 Signalling Traffic Path

GSM
VLR D C

F EIR A

HLR E

AUC

MSC

Other MSC

(PSTN) (BSS)

MSC to PSTN usually country specific Signalling (ISUP) development

42

G SCentre (MSC) M Mobile Switching

A switching Centre in the IMPCS which
Functions as a gateway to other networks Is connected to other MSCs in the network Connects the network elements of the network Sub System (NSS) to the network of the Radio Sub System (RSS)

43

G SofM Functions MSC

Call handling function : Routing, and Signaling Radio resource management and RSS Signaling protocol management Location registration Hand-over Inter-working functions Transfer of encryption parameters

44

G S OF MSC M FUNCTIONS
   

special security functions like checking the IMEI. Control the operation of echo-chancellors. echoCollect billing data and Collect traffic data Operation and Maintenance

45

GSM GSM
MSC ( MOBILE SWITCHING CENTRE)
  

Manages communication between GSM users and other telecommunications network users Call setup functions, basic switching are done Interface with BSS and contact to GSM users through VLR of MSC Interfaces with external networks like PSTN, ISDN, PSPDN, etc., MSC takes into account the RR allocation in addition to normal exchange functions MSC is telephone exchange office for mobile originated and terminated traffic MSC does gateway function while communication is to be established between its customers to other network 46 customers by using HLR /VLR

GSM GSM
MSC Functions - I
  

Paging, specifically call handling Coordination of call setup from all MSs in its jurisdiction Dynamic allocation of resources in coordination with BSS
 

MSC decides what type of channel and when to be used BSS decides channel identity and radio parameters

    

Location registration Interworking function with different networks Handover management Billing for all subscribers based in its area Reallocation of frequencies to BTSs in its area to meet heavy demands Encryption parameters- transfer data from VLR to BSS parametersto facilitate ciphering on the radio interface

47

GSM GSM
MSC Functions - II
   

Echo canceller operation control Signalling interface Synchronisation with BSCs Gateway to SMS - to forward short message service messages between SMS centers and subscribers

48

GSM GSM
MSC


MSC CONSISTS OF
          

SWITCH MATRIX AUTOMATIC MESSAGE ACCOUNTING (AMA) TIMING SUBSYSTEM X.25 INTERFACE SUBSYSTEMS LAND CALL MANAGEMENT MOBILE CALL MANAGEMENT MOBILITY MANAGEMENT SERVICE MANAGEMENT SUBSYSTEMS CCS#7 INTERFACE VLR / HLR SUBSYSTEM INTERFACE TO AUTHENTICATION CENTRE
49

G S Register (VLR) M Visitor Location

database and a part of MSC, with information about all mobile subscribers currently active in its service area. stores temporary data for as long as a subscriber from another area is registered and roaming in its MSC area.

50

GSM Functions Of VLR

Organization of the subscriber data Management and allocation of numbers and identities e.g. MSRN (Mobile Subscriber Roaming Number), TMSI (Temporary Mobile Subscriber Identity) Call handling functions Handling of supplementary services Short message service handling

51

G S MVLR FUNCTIONS OF
   

Location registration Support of encryption HandHand-over IMSI (International Mobile Subscriber Identity) detach/attach operation

52

G S M in VLR Information Stored

To perform above functions VLR shall be able to store the following information: The IMSI The Mobile Station International ISDN number The Mobile Station roaming number, if allocated at location updating. The Temporary Mobile Subscriber Identity, if applicable.

53

G S M VLR Information Stored in

  

The location area where the mobile station has been registered. Supplementary service parameters. Any other information needed for management of mobile station. Technical characteristics of the mobile equipment

54

G SREGISTER (VLR)-I M (VLR)VISITOR LOCATION

GSM
 

It controls those mobiles roaming in its area(known as location area interface) One VLR may be incharge of one or more MSC location areas (LA) VLR is a database and gets updated whenever a new MS enters its area, by the database of HLR data VLR contains data similar to subscriber related dynamic data in fixed telephone network functions
55

GSM G SREGISTER (VLR)-II M (VLR)VISITOR LOCATION

  

Works with HLR and AUC on authentication Relays the ciphering key from HLR to BSS VLR is responsible for assigning TMSI number the mobile subscriber in its area and can be periodically changed to secure the subscribers identity VLR supports mobile paging and tracking subsystem in the local area

56

GSM GSM
Data in VLR
  

  

IMSI & TMSI MSISDN MSRNMSRN- which is allocated to the MS either when the station is registered in an MSC area or on a per call basis and used to route the incoming calls LALA- where the MS has been registered which will be used to call the station Supplementary service parameters MS category Authentication Key, query and response obtained from AUC ID of the current MSC
57

G S M (HLR) Home Location Register

Database with the relevant data for the registered subscribers. contains the permanent subscriber description Parameters such as:

Subscriber identity, Directory number, Subscribed Services: Basic-services and Supplementary-services

58

Home Location Register (HLR)



GSM

The present (or last known) location of the subscriber . Information of temporary location of a subscriber is also stored in the HLR. provides the MSC with the information about the subscribers of that MSC area.

59

G Of HLR SM Functions
HLR stores the following information:
Subscription information Location information enabling the routing of call International mobile subscriber identity (IMSI) Mobile subscriber ISDN number (MSISDN) Routing information (e.g. Mobile station Roaming Number MSRN) Basic telecommunication services Dealing with supplementary services

60

Functions Of HLR
   

GSM

Service restrictions (e.g. roaming restrictions) Administrative software for database management Traffic measurement Any other information needed for management of mobile station.

61

GSM GSM
Home Location Register(HLR)-I Register(HLR) 

Stores permanent data of subscribers Reference store for subscribers parameters, numbers, addresses as well as authentication parameters, services etc. Current subscribers status and associated VLR details are stored Responsible for SIM authentication and obtains encryption parameters from AUC Both VLR and HLR can be implemented in the same equipment in an MSC one PLMN may contain several HLRs
62

GSM GSM
Home Location Register(HLR)-II Register(HLR) 

  

Permanent data in HLR Data stored is changed only by man-machine maninterface and not dynamically IMSI , international MS-ISDN number ( directory MSnumber of mobile phone) and authentication key Category of MS ( whether pay phone or not ) Roaming restriction ( allowed or not ) CUG , supplementary services related parameters like call forward number, activation status, etc.,
63

GSM GSM
Home Location Register(HLR)-III Register(HLR)   

 

Temporary data in HLR These data changes from call to call and is dynamic Local MS Identity ( LMSI ) , MSRN RAND /SRES and Kc - data related to authentication and ciphering VLR address , MSC address , roaming restriction Messages waiting data used for SMS

64

G S M AUC Authentication Centre

contains all information related to security and authentication. The ciphering keys / algorithm. protects against unauthorized access and ciphering of the communication.

65

G SCenter AUC M Authentication



functions:


  

Security related functions e.g. generation and management of authentication keys like, Storing the specific algorithms etc. Call handling functions Subscriber database, triplets table, key database etc. Administration software
66

GSM G SCENTRE (AUC ))--I M AUTHENTICATION



Stores information necessary to protect communication against intruders in the air interface Authentication and ciphering key are stored in this data base as secured Ki Kc keys are never transmitted to MS on air, instead a random number (Rand) is sent and must be responded by the MS with correct signed response (SRES)

67

GSM G SCENTRE (AUC ))--II M AUTHENTICATION

 

Only calculated response are sent over the air interface Cipher key is transmitted over SS7 link between home HLR and AUC Random key and cipher key changes randomly with each phone call AUC is a separate entity and physically included with HLR

68

G SRegister (EIR) M Equipment Identity

database with information about the equipment types and equipment identities of all mobile radio equipment authorized in its service area. functions: Management of IMEI Management of mobile equipment e.g. to check the category of a mobile equipment whether it is authorized or to be barred.

69

EQUIPMENT IDENTITY REGISTER ( EIR )



GSM GSM

This data base stores IMEI for all registered mobile equipments and is unique to every me Only one EIR per PLMN and interfaces with various HLRs in the PLMN White list : contains those IMEIs that are known to have been assigned to valid mobile stations. Black list : contains IMEIs of mobiles that have been reported stolen Gray list : contains IMEIs that have problems like faulty software, wrong make of equipment. These equipments are not barred
70

G S MCentre OMC Operations and Maintenance

The centralized operation of the various units in the system and functions needed to maintain the subsystems. Dynamic monitoring and controlling of the network Separate OMC-S and OMC-R for NSS and RSS

71

Operations and Maintenance Center OMC



GSM

based on the GSM specifications, series 12, for operations and maintenance, series 08 for the relevant RSS layer 3 specifications,, Telecommunication management Network (TMN) principles as per ITU-T recommendations M3010. ITUThe general philosophy based on ITU-T ITURecommendation M.20.

72

G SOf OMC M Functions

functions
O&M data function Configuration management Status report handling Fault report and alarm handling Performance supervision/management Storage of system software and data Security management.
73

GSM GSM
Security Management
   

Four basic security services provided by GSM Anonymity : TMSI Assignment Authentication Encryption: Protection against eavesdropping for signalling data and voice Users SIM module and ME ID

74

GSM GSM
Authentication Process
Random Number MS Key AL AL Key

Response Mobile Station

Yes/No Fixed Network

75

GSM GSM
Encryption Process
Plain Text

KEY

Encryption Process Cipher-text

76

GSM GSM
Generic Authentication Process
Ki IMSI RAND Radio Path A3 A3 SRES Compare Yes/No
77

RAND Ki

IMSI

Response

SRES

G S & ENCRIPTION M AUTHENTICATION

Database
IMSI1 IMSI1 IMSI1 Algorithm for Ciphering A8 Algorithm for Authentication A3

Kc Kc

SRES RAND

64 bits SRES 32 bits RAND

78

Generation of Random Number RAND

G S & ENCRIPTION M AUTHENTICATION

Key Pad RAND (128) HLR SRES (32) Kc MSC/VLR no SRES= SRESc Yes Access Granted SRESc A8 Store Kc
79

RAND A3

Ki Sim Card

Send to Cipher Key Transfer Kc to BTS BTS

GSM

Algorithm A5

Algorithm A5 S2 S1
Plain Text

Modulo 2 Cipher Sum Text BTS

MS
80

GSM

Thank You !
81

GSM

82