GSM

CE – B.E. Sem VII– Mobile Communication and Computing

Suvarna Chaure
Asst. Prof.Dept. of Computer Engineering,
SIES Graduate School of Technology
 Topics to be covered

GSM
• overview
• services
• sub-systems
• components

2
➢ GSM
❑ formerly: Groupe Spéciale Mobile (founded 1982)
❑ now: Global System for Mobile Communication
❑ Pan-European standard (ETSI, European
Telecommunications Standardisation Institute)
❑ simultaneous introduction of essential digital cellular
services in three phases (1991, 1994, 1996) by the
European telecommunication administrations, seamless
roaming within Europe possible
❑ many providers all over the world use GSM (more than 130
countries in Asia, Africa, Europe, Australia, America)
❑ more than 100 million subscribers
3
 Performance characteristics of GSM
➢ Communication
❑ mobile, wireless digital communication; support for voice and data services
➢ Total mobility
❑ international access, chip-card enables use of access points of different
providers
➢ Worldwide connectivity
❑ one number, the network handles localization High capacity
❑ better frequency efficiency, smaller cells, more customers per cell
➢ High transmission quality
❑ high audio quality
❑ uninterrupted phone calls at higher speeds (e.g., from cars, trains) – better
handoffs and
➢ Security functions
❑ access control, authentication via chip-card and PIN
4
GSM: Mobile Services
➢GSM offers
• several types of connections
voice connections, data connections, short message service
• multi-service options (combination of basic services)
➢ Three service domains
• Bearer Services – interface to the physical medium (transparent for example in the
case of voice or non transparent for data services)
• Tele Services – services provided by the system to the end user (e.g., voice, SMS,
fax, etc.)
• Supplementary Services – associated with the tele services: call forwarding,
redirection, etc. bearer services
MS

transit source/
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)

tele services
 Bearer Services
➢ Telecommunication services to transfer data between access points
❑ R and S interfaces – interfaces that provide network independent data transmission from
end device to mobile termination point.
❑ U interface – provides the interface to the network (TDMS, FDMA, etc.)

➢ Specification of services up to the terminal interface (OSI layers 1-3)

❑ Transparent – no error control of flow control, only FEC
❑ Non transparent – error control, flow control

➢ Different data rates for voice and data (original standard)

❑ voice service (circuit switched)
• synchronous: 2.4, 4.8 or 9.6 Kbps.
❑ data service (circuit switched)
• synchronous: 2.4, 4.8 or 9.6 kbit/s
• asynchronous: 300 - 1200 bit/s
❑ data service (packet switched)
• synchronous: 2.4, 4.8 or 9.6 kbit/s
• asynchronous: 300 - 9600 bit/s

6
 Tele Services

➢ Telecommunication services that enable voice communication via mobile

phones
➢ All these basic services have to obey cellular functions, security measures
etc.
➢ Offered voice related services
❑ mobile telephony
primary goal of GSM was to enable mobile telephony offering the traditional bandwidth
of 3.1 kHz
❑ Emergency number
common number throughout Europe (112); mandatory for all service providers; free of
charge; connection with the highest priority (preemption of other connections possible)
❑ Multinumbering
several ISDN phone numbers per user possible

Cont
7
➢ Additional services: Non-Voice-Teleservices
group 3 fax
voice mailbox (implemented in the fixed network supporting the mobile
terminals)
electronic mail (MHS, Message Handling System, implemented in the fixed
network)

Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the signaling
channel, thus allowing simultaneous use of basic services and SMS (160
characters)
Major driving force now

8
Supplementary services
Services in addition to the basic services,
cannot be offered stand-alone
May differ between different service providers, countries and protocol
versions
Important services
• identification: forwarding of caller number
• suppression of number forwarding
• automatic call-back
• conferencing with up to 7 participants
• locking of the mobile terminal (incoming or outgoing calls)
Architecture of the GSM system
GSM is a PLMN (Public Land Mobile Network)
several providers setup mobile networks following the GSM standard within each
country
components
• MS (mobile station)
• BS (base station)
• MSC (mobile switching center)
• LR (location register)
subsystems
• RSS (radio subsystem): covers all radio aspects
• NSS (network and switching subsystem): call forwarding, handover,
switching
• OSS (operation subsystem): management of the network
GSM World Coverage Map

https://www.worldtimezone.com/gsm.html
India 900 1800 3G 900/2100 AirTel; 3G 2100 BSNL; 3G 4G LTE Vodafone Idea
2100 MTNL; 3G 2100 Tata Docomo; 3G LTD 1800/2100/2500Mhz ;
2100 Vodafone Idea LTD ; 4G LTE Bharti Airtel
1800/2100/2300Mhz; 4G
LTE Jio
850/1800/2300mhz; 4G
LTE BSNL 2500Mhz (trial);
4G LTE Tata DoCoMo
Teleservices
900/1800/2100/2300Mhz ;

4.12
GSM: elements and interfaces

radio cell
BSS
MS MS

Um radio cell

RSS BTS MS

BTS

Abis

BSC BSC
A

MSC MSC

NSS signaling
VLR VLR
ISDN, PSTN
HLR GMSC
PDN
IWF
O

OSS
EIR AUC OMC
 A RADIO CELL

Voice
Channels

Or MS
Lines to control
BSC channels
System architecture: radio subsystem
radio network and switching
subsystem subsystem

MS MS
Components
MS (Mobile Station)
Um
BSS (Base Station Subsystem):
BTS Abis consisting of
BSC MSC BTS (Base Transceiver Station):
BTS
sender and receiver
BSC (Base Station Controller):
controlling several transceivers

BTS
A Interfaces
BSC MSC Um : radio interface
BTS
Abis : standardized, open interface with
BSS
16 kbit/s user channels
A: standardized, open interface with
64 kbit/s user channels
Radio subsystem
The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching
centers
Components
Base Station Subsystem (BSS):
Base Transceiver Station (BTS): radio components including sender, receiver, antenna - if
directed antennas are used one BTS can cover several cells

Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of
network resources, mapping of radio channels (Um) onto terrestrial channels (A interface)

BSS = BSC + sum(BTS) + interconnection

Mobile Stations (MS)

Location Areas and
Base Station SubSystems

PSTN
MSC

BSC 1
BSC 1

BTS Location
BTS BTS
Area 2
BTS BTS
Location
Area 1
Base Transceiver Station and Base Station Controller
• Tasks of a BSS are distributed over BSC and BTS
• BTS comprises radio specific functions
• BSC is the switching center for radio channels
Mobile station
Terminal for the use of GSM services
A mobile station (MS) comprises several functional groups
• MT (Mobile Terminal):
• offers common functions used by all services the MS offers
• corresponds to the network termination (NT) of an ISDN access
• end-point of the radio interface (Um)
• TA (Terminal Adapter):
• terminal adaptation, hides radio specific characteristics (TE connects via modem,
Bluetooth, IrDA etc. to MT)
• TE (Terminal Equipment):
• peripheral device of the MS, offers services to a user
• Can be a headset, microphone, etc.
• does not contain GSM specific functions
• SIM (Subscriber Identity Module):
• personalization of the mobile terminal, stores user parameters

TE TA MT
Um
R S
 GSM cellular handset

GSM cellular handset : GSM cellular handset

Mobile equipment (ME) + SIM card

• Subscriber Identity Module (SIM) contains SIM
encryption key and personal data
• The user is uniquely identified through
”International Mobile Subscriber Identity” (IMSI) ME
• The mobile equipment is uniquely identified
through ”International Mobile Equipment Identity”
(IMEI)
Both equipment and user uniquely identified
System architecture: network and switching subsystem
network fixed partner
subsystem networks
Components
• MSC (Mobile Services Switching
ISDN Center):
PSTN
MSC • IWF (Interworking Functions)

• ISDN (Integrated Services Digital

EIR
Network)
• PSTN (Public Switched Telephone
SS7

HLR Network)
• PSPDN (Packet Switched Public Data
Net.)
VLR
• CSPDN (Circuit Switched Public Data
ISDN Net.)
MSC
PSTN
IWF
PSPDN
CSPDN Databases
• HLR (Home Location Register)
• VLR (Visitor Location Register)
• EIR (Equipment Identity Register)
Network and switching subsystem
• NSS is the main component of the public mobile network GSM
• switching, mobility management, interconnection to other networks, system control

Components
• Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a mobile terminal within the domain of
the MSC - several BSC can belong to a MSC
• Databases (important: scalability, high capacity, low delay)
• Home Location Register (HLR)
central master database containing user data, permanent and semi-permanent data of all
subscribers assigned to the HLR (one provider can have several HLRs)
• Visitor Location Register (VLR)
local database for a subset of user data - data about all users currently visiting in the domain of
the VLR
Mobile Services Switching Center
The MSC (mobile switching center) plays a central role in GSM

• switching functions
• additional functions for mobility support
• management of network resources
• interworking functions via Gateway MSC (GMSC)
• integration of several databases

Functions of a MSC

• specific functions for paging and call forwarding

• termination of SS7 (signaling system no. 7)
• mobility specific signaling
• location registration and forwarding of location information
• provision of new services (fax, data calls)
• support of short message service (SMS)
• generation and forwarding of accounting and billing information
The mobile switching center (MSC) performs the telephony switching function. A mobile
station must be attached to a single MSC at a time (either homed or visitor), if it is currently
active (not switched off). The visitor location register (VLR) is a database attached to an
MSC to contain information about its currently associated mobile stations.
• Information of currently attached mobile stations
IMSI/TMSI numbers
MSISDN/MSRN numbers
Security triple (authentication and encryption information)
Location Area Identity (where the mobile station is currently located)
• List of base stations that belong to this MSC/VLR (by their BSIC or Base Station Identity
Code)
• List of location areas that belong to this MSC/VLR (by their LAI or Location Area Identity
code)
Home Location Register
• The home location register (HLR) is the central database for all users to register to the
GSM network. It stores static information about the subscribers such as the
international mobile subscriber identity
• (IMSI), subscribed services, and a key for authenticating the subscriber. The HLR
also stores dynamic subscriber information (i.e., the current location of the mobile
subscriber).
• The home location register (HLR) is a database used for storing and managing
subscriptions. When an individual buys a subscription from one of the GSM operators,
he or she is registered in the HLR of that operator.
 HLR Data Elements

• Mobile Station’s Identities:

IMSI (International Mobile Subscriber Identity) (the primary Key),
Current TMSI (Temporary IMSI)
IMEI (International Mobile Equipment Identity)
• Mobile Station’s Telephone number
MSISDN (Mobile Stations ISDN number)
Current MSRN (Mobile Station Roaming Number), if assigned
• Name and address of the subscriber
• Current service subscription profile
• Current location (MSC/VRL address)
• Authentication and encryption keys
Individual Subscriber Authentication Key (KI)
• Mobile Country Code (MCC) and MNC (Mobile Network Code)
• List of MSC/VLR that belongs to this HLR
Visitor Location Register
The visitor location register (VLR) is a distributed database that temporarily stores
information about the mobile stations that are active in the geographic area for which the
VLR is responsible. A VLR is
associated with each MSC in the network. When a new subscriber roams into a
location area, the VLR is responsible for copying subscriber information from the HLR to
its local database. This relationship between the VLR and HLR avoids frequent HLR
database updates and long distance signaling of the user information, allowing faster
access to subscriber information.
Operation subsystem
The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of
all GSM subsystems

Components

• Authentication Center (AUC)

generates user specific authentication parameters on request of a VLR
• authentication parameters used for authentication of mobile terminals and encryption of user data
on the air interface within the GSM system
• Equipment Identity Register (EIR)
registers GSM mobile stations and user rights
stolen or malfunctioning mobile stations can be locked and sometimes even localized
• Operation and Maintenance Center (OMC)
different control capabilities for the radio subsystem and the network subsystem
Authentication Center
Associated with the HLR is the authentication center (AuC); this database contains the
algorithms for authenticating subscribers and the necessary keys for encryption to
safeguard the user input for authentication.
Equipment Identity Register
The equipment identity register (EIR) is a database that stores the international mobile
equipment identities (IMEIs) of all the mobile stations in the network. The IMEI is an
equipment identifier assigned
by the manufacturer of the mobile station. The EIR provides security features such as
blocking calls from handsets that have been stolen.
GSM: cellular network
segmentation of the area into cells

possible radio coverage of the

cell

cell
idealized shape of the cell

• use of several carrier frequencies

• not the same frequency in adjoining cells
• cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver
power etc.
• hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)
• if a mobile user changes cells
handover of the connection to the neighbor cell
GSM Radio Interface - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink

890-915 MHz
124 channels (200 kHz)
uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8

4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
Radio Interface

Frequency division multiplexing for multiple access and duplex

36
There is relationship
If the uplink frequency is fu = 890 MHz + n·0.2 MHz,
the downlink frequency is fd = fu + 45 MHz,
i.e., fd = 935 MHz + n·0.2 MHz for a certain channel n.

4.37
GSM Radio Interface - TDMA/FDMA • Each of the 248 channels
is additionally separated in
time via a GSM TDMA
935-960 MHz
124 channels (200 kHz)

frame,
downlink

890-915 MHz i.e., each 200 kHz carrier

is subdivided into
124 channels (200 kHz)
uplink
higher GSM frame structures frames that are repeated
time continuously.
• The duration of a frame is
GSM TDMA frame
4.615 ms.
1 2 3 4 5 6 7 8 • Aframe is again subdivided
into 8 GSM time slots,
where each slot represents
4.615 ms

GSM time-slot (normal burst)

a physical TDM channel
• physical TDM channel lasts
for 577 µs.
guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3 • Each TDM channel
occupies the 200 kHz
546.5 µs
577 µs
carrier for 577 µs every
4.615 ms.
• Normal burst as used for data transmission inside a time slot (user and
signaling data).
• The burst is only 546.5 µs long and contains 148 bits.
• The remaining 30.5 µs are used as guard space to avoid overlapping with
other bursts due to different path delays and to give the transmitter time to turn
on and off.
• Filling the whole slot with data allows for the transmission of 156.25 bit within
577 µs.
• Each physical TDM channel has a raw data rate of about 33.8 kbit/s, each
radio carrier transmits approximately 270 kbit/s over the Um interface.

4.39
Bursts for data transmission:
• Normal Burst
• Frequency Correction Burst allows the MS to correct the local oscillator to avoid interference
with neighboring channels,
• Synchronization Burst with an extended training sequence synchronizes the MS with the BTS in
time,
• Access Burst is used for the initial connection setup between MS and BTS,
• Dummy Burst is used if no data is available for a slot.

If the BTS sends data at time t0 in slot one on the downlink, the MS accesses slot one on the uplink
at time t0+3·577 µs. An MS does not need a full-duplex transmitter, a simpler half-duplex
transmitter switching between receiving and sending is enough.

To avoid frequency selective fading, GSM specifies an optional slow frequency hopping
mechanism. MS and BTS may change the carrier frequency after each frame based on a common
hopping sequence.

4.40
 TB Data Training seq. Data TB GP
Normál burst (NB) 000 58 bit 26 bit 58 bit 000 8.25 bit time

TB 000...0 TB GP
Frequency Correction Burst (FB) 000 142 bit 000 8.25 bit time

TB Data Sync. seq. Data TB GP

Synchronization burst (SB) 000 39 bit 64 bit 39 bit 000 8.25 bit time

TB Sync. seq. Data TB GP

Access burst (AB)or RACH 000 41 bit 36 bit 000 68.25 bit time
GSM Channels

Prof. Anirudha Sahoo 3.42

Logical Channels
Traffic Channels
• Transfer either encoded speech or user data
• Bidirectional

1. Full Rate TCH

Rate 22.4kbps
Full Rate Speech Coding
Speech Coding for 20ms segments ,260 bits at the output ; Effective data rate 13kbps
Unequal error protection
182 bits are protected
78 bits unprotected
Channel Encoding:Codes 260 bits into (8 x 57 bit blocks) 456 bits
Interleaving:2 blocks of different set interleaved on a normal burst (save damages by error
bursts)
2. Half Rate TCH
Rate 11.2 kbps
 Traffic Channels Cntd....
Full Rate TCH Half Rate
TCH
TCH/FR TRAFFIC TCH/HR
TCH/F 9.6
CHANNELS TCH/H4.8
TCH/F 4.8
TCH/H2.4
TCH/F 2.4
Full Rate Traffic Channels Half Rate Traffic Channels

Name Type Data Rate NAME Type Data Rate

TCH/FR Speech 22.8 kbps TCH/HR Speech 11.4 kbps

TCH/F9.6 Data 22.8 kbps TCH/H9.6 Data 11.4 kbps

TCH/F4.8 Data 22.8 kbps TCH/H4.8 Data 11.4 kbps

TCH/F2.4 Data 22.8 kbps

44
Logical Channels

• Signalling Channel
Broadcast Channel (BCH) (unidirectional)
Common Control Channel (CCH) (unidirectional)
Dedicated/Associated Control Channel (DCCH/ACCH) (bidirectional)
BCCH
• Broadcast Control Channel (BCCH)
• BTS to MS
• send cell identities, organization info about common control channels,
cell service available, etc
• Radio channel configuration
• Current cell + Neighbouring cells
• Synchronizing information
• Frequencies + frame numbering
• Registration Identifiers
• LA + Cell Identification (CI) + Base Station Identity Code (BSIC)
FCCH & SCH

• Frequency Correction Channel

send a frequency correction data burst containing all zeros to
effect a constant frequency shift of RF carrier
Mobile station knows which frequency to use
Repeated broadcast of Frequency Bursts

• Synchronization Channel
send TDMA frame number and base station identity code to
synchronize MSs
MS knows which timeslot to use
Repeated broadcast of Synchronization Bursts
 AGCH & PCH
• Access Grant Channel (AGCH)
BTS to MS
Used to assign an SDCCH/TCH to MS

• Paging Channel (PCH)

BTS to MS
Page MS
RACH & SDCCH
• Random Access Channel (RACH)
MS => BTS
Slotted Aloha
Request for dedicated SDCCH
• Standalone Dedicated Control Channel (SDCCH)
MS => BTS
Standalone; Independent of Traffic Channel
Used before MS is assigned a TCH
DCCH
• DCCH (dedicated control channel):
bidirectional point-to-point -- main signaling channels
• SDCCH (stand-alone dedicated control channel): for service request, subscriber
authentication, equipment validation, assignment to a traffic channel
• SACCH (slow associated control channel): for out-of-band signaling associated
with a traffic channel, eg, signal strength measurements
• FACCH (fast associated control channel): for preemptive signaling on a traffic
channel, eg, for handoff messages
• Uses timeslots which are otherwise used by the TCH
GSM hierarchy of frames hyperframe
0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s

superframe
0 1 2 ... 48 49 50
6.12 s
0 1 ... 24 25

multiframe
0 1 ... 24 25 120 ms

0 1 2 ... 48 49 50 235.4 ms

frame
0 1 ... 6 7 4.615 ms

slot
burst 577 µs

GSM structuring of time using a frame hierarchy

GSM protocol layers for signaling
Um Abis A
MS BTS BSC MSC

CM CM

MM MM

BSSAP
BSSAP
RR RR’
RR’ BTSM BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD

radio radio PCM PCM PCM PCM

16/64 kbit/s 64 kbit/s /

2.048 Mbit/s
Layer 1, the physical layer

• handles all radio-specific functions

-includes the creation of bursts according to the five different formats,
multiplexing of bursts into a TDMA frame, synchronization with the BTS,
detection of idle channels, and measurement of the channel quality on the downlink.

• The physical layer at Um uses GMSK for digital modulation and performs
encryption/decryption of data, encryption is between MS and BSS over the air interface.

• The main tasks of the physical layer comprise

channel coding and error detection/correction, which is directly combined with the coding
mechanisms.
Channel coding uses forward error correction (FEC) schemes.
• The physical layer also contains special functions, such as voice activity detection (VAD),
which transmits voice data only when there is a voice signal
• During periods of silence the physical layer generates a comfort noise to fake a connection
but no actual transmission takes place.
53
Layer 2, LAPDm

• The LAPDm protocol has been defined at the Um interface .

• LAPDm, link access procedure for the D-channel (LAPD) in ISDN systems, . LAPDm is
a lightweight LAPD
• LAPDm offers reliable data transfer over connections, re-sequencing of data frames,
and flow control
• LAPDm has to obey the frame structures recurrence patterns etc. defined for the Um
interface as there is no buffering between layer one and two,
• LAPDm provides segmentation and reassembly of data and
acknowledged/unacknowledged data transfer.

54
layer 3,network layer
Comprises several sublayers as
• Radio resource management (RR).
Only a part of this layer, RR’, is implemented in the BTS, the remainder is situated in
the BSC.
The functions of RR’ are supported by the BSC via the BTS management
(BTSM).
The main tasks of RR are setup, maintenance, and release of radio channels.RR also
directly accesses the physical layer for radio information and offers a reliable
connection to the next higher layer.
• Mobility management (MM)
registration, authentication, identification, location updating, and the provision of a
temporary mobile subscriber identity (TMSI) that replaces the international mobile
subscriber identity (IMSI) and which hides the real identity of an MS user over the
air interface. MM offers a reliable connection to the next higher layer.

55
Call management (CM) layer contains three entities:

• call control (CC), short message service (SMS), and supplementary service (SS).
• SMS allows for message transfer using the control channels SDCCH and SACCH .
• CC provides a point-to-point connection between two terminals and is used by higher layers
for call establishment, call clearing and change of call parameters.
• This layer provides functions to send in-band tones, called dual tone multiple frequency
(DTMF), over the GSM network.
• These tones are used,e.g., for the remote control of answering machines or the entry of PINs
in electronic banking and are, also used for dialing in traditional analog telephone
systems. These are transferred as signals and then converted into tones in the fixed network
part of the GSM system.

56
Additional protocols are used at the Abis and A interfaces
• Data transmission at the physical layer typically uses pulse code modulation (PCM) systems.
GSM also allows for the submultiplexing of four 16 kbit/s channels into a single 64 kbit/s
channel
• The physical layer at the A interface typically includes leased lines with 2.048 Mbit/s capacity.
• LAPD is used for layer two at Abis,
• BTSM for BTS management.
• Signaling system No. 7 (SS7) is used for signaling between an MSC and a BSC. This protocol
also transfers all management information between MSCs, HLR, VLRs, AuC, EIR, and OMC.
• MSC can also control a BSS via a BSS application part (BSSAP).

57
Localization and Calling
GSM: Identification
• Identification of Mobile Subscriber
• International Mobile Subscriber Identity (IMSI)
• Temporary IMSI (TMSI)
• Mobile Subscriber ISDN number (MSISDN)
• Identification of Mobile Equipment
• International Mobile Station Equipment Identification
(IMEI)
• Mobile Station Roaming Number (MSRN)
MSISDN
“real telephone number” of a MS
It is stored centrally in the HLR
MS can have several MSISDNs depending on SIM
It follows international ISDN numbering plan
Country Code (CC): upto 3 decimal places
National Destination Code (NDC): 2-3 decimal places
Subscriber Number (SN) : maximal 10 decimal places
MSISDN = CC + NDC + SN
IMSI
International Mobile Subscriber Identity
Stored in SIM, not more than 15 digits
3 digits for Mobile Country Code (MCC)
3 digits for Mobile Network Code (MNC)
It uniquely identifies the home GSM PLMN of the mobile
subscriber.
Not more than 10 digits for National Mobile Station Identity (MSIN)
The first 3 digits identify the logical HLR-ID of the mobile
subscriber
MNC+MSIN makes National Mobile Station Identity (NMSI)
TMSI and LMSI
Temporary Mobile Subscriber Identity
Has only local and temporal significance
Is assigned by VLR and stored there only
Is used in place of IMSI for security reasons
Local Mobile Subscriber Identity
Is an additional searching key given by VLR
It is also sent to HLR
Both are assigned in an operator specific way
Mobile Terminated Call
1: calling a GSM subscriber
4
2: forwarding call to GMSC HLR VLR
5
3: signal call setup to HLR 8 9
3 6
4, 5: request MSRN from VLR 14 15
6: forward responsible calling 7
PSTN GMSC MSC
MSC to GMSC station 1 2
7: forward call to 10 10 13 10
current MSC 16
8, 9: get current status of MS BSS BSS BSS
10, 11: paging of MS 11 11 11
12, 13: MS answers
14, 15: security checks 11 12
16, 17: set up connection 17
MS
Mobile Originated Call
1, 2: connection request
3, 4: security check
5-8: check resources (free circuit) VLR
9-10: set up call
3 4
6 5
PSTN GMSC MSC
7 8
2 9

1
MS BSS
10
 MS MTC BTS MS MOC BTS
MTC/MOC paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange
Handoffs (Handover)
Two basic reasons for a handover
• The mobile station moves out of the range of a BTS
• traffic in one cell is too high
GSM aims at maximum handover duration of 60 ms.
GSM uses mobile assisted hand-off (MAHO). Signal strength measurements are sent to the
BS from the mobile.
The MSC decides when to do a handoff and it informs the new BS and the mobile.
When a mobile switches to a new BS it sends a series of shortened bursts to adjust its timing
(giving the BS time to calculate it and send it) and allow the new BS to synchronize its
receiver to the arrival time of the messages

https://www.youtube.com/watch?v=lSwRfjgUYqQ
Handoffs (Handover)
Two categories of Handoffs
1. Hard Handoff
2. Soft Handoff
4 types of handover
1
2 3 4

MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC
GSM handoffs
Intra-cell handover:caused due to narrowband interference

Intra-BSS: if old and new BTSs are attached to same base station
MSC is not involved

Intra-MSC: if old and new BTSs are attached to different base

stations but within same MSC

Inter-MSC: if MSCs are changed

Handover decision

receive level receive level

BTSold BTSold

HO_MARGIN

MS MS

BTSold BTSnew
Handover procedure
MS BTSold BSCold MSC BSCnew BTSnew
measurement measurement
report result

HO decision
HO required HO request
resource allocation
ch. activation

HO command HO request ack ch. activation ack

HO command HO command
HO access
Link establishment

HO complete HO complete
clear command clear command
clear complete clear complete

Intra-MSC handover
GSM Intra-MSC handoff
1. Mobile station monitors signal quality and determines handoff is
required, sends signal measurements to serving BSS
2. Serving BSS sends handoff request to MSC with ranked list of
qualified target BSSs
3. MSC determines that best candidate BSS is under its control
4. MSC reserves a trunk to target BSS
5. Target BSS selects and reserves radio channels for new connection,
sends Ack to MSC
6. MSC notifies serving BSS to begin handoff, including new radio
channel assignment
GSM Intra-MSC handoff
7. Serving BSS forwards new radio channel assignment to mobile station
8. Mobile station retunes to new radio channel, notifies target BSS on new
channel
9. Target BSS notifies MSC that handoff is detected
10. Target BSS and mobile station exchange messages to synchronize
transmission in proper timeslot
11. MSC switches voice connection to target BSS, which responds when
handoff is complete
12. MSC notifies serving BSS to release old radio traffic channel
GSM Inter-MSC handoff
1. MS sends signal measurements to serving BSS
2. Serving BSS sends handoff request to MSC
3. Serving MSC determines that best candidate BSS is under control of a
target MSC and calls target MSC
4. Target MSC notifies its VLR to assign a TMSI
5. Target VLR returns TMSI
6. Target MSC reserves a trunk to target BSS
7. Target BSS selects and reserves radio channels for new connection,
sends Ack to target MSC
8. Target MSC notifies serving MSC that it is ready for handoff
GSM Inter-MSC handoff
9. Serving MSC notifies serving BSS to begin handoff, including new
radio channel assignment
10. Serving BSS forwards new radio channel assignment to mobile station
11. Mobile station retunes to new radio channel, notifies target BSS on
new channel
12. Target BSS notifies target MSC that handoff is detected
13. Target BSS and mobile station synchronize timeslot
14. Voice connection is switched to target BSS, which responds when
handoff is complete
15. Target MSC notifies serving MSC
16. Old network resources are released
Security in GSM
Security services
• access control/authentication
• user SIM (Subscriber Identity Module): secret PIN (personal identification
number)
• SIM network: challenge response method
• confidentiality
• voice and signaling encrypted on the wireless link (after successful
authentication)
• anonymity
• temporary identity TMSI
(Temporary Mobile Subscriber Identity) “secret”:
• newly assigned at each new location update (LUP) • A3 and A8
available via the
• encrypted transmission Internet
3 algorithms specified in GSM • network
• A3 for authentication (“secret”, open interface) providers can use
stronger
• A5 for encryption (standardized) mechanisms
• A8 for key generation (“secret”, open interface)
GSM - authentication

mobile network SIM

RAND
Ki RAND RAND Ki

AC 128 bit 128 bit 128 bit 128 bit

A3 A3
SIM
SRES* 32 bit SRES 32 bit

MSC SRES
SRES* =? SRES SRES
32 bit

Ki: individual subscriber authentication key SRES: signed response

GSM - key generation and encryption

mobile network (BTS) MS with SIM

RAND
Ki RAND RAND Ki
AC 128 bit 128 bit 128 bit 128 bit SIM

A8 A8

cipher Kc
key 64 bit Kc
64 bit
data encrypted SRES
data
BTS MS
data
A5 A5
 Conclusion on GSM security
• Focused on the protection of the air interface
• No protection on the wired part of the network (neither for privacy nor
for confidentiality)
• The visited network has access to all data (except the secret key of
the end user)
• Generally robust, but a few successful attacks have been reported:
• faked base stations
• cloning of the SIM card

78
Data services in GSM I
• Data transmission standardized with only 9.6 kbit/s
• advanced coding allows 14.4 kbit/s
• not enough for Internet and multimedia applications
HSCSD (High-Speed Circuit Switched Data)
• already standardized
• bundling of several time-slots to get higher
AIUR (Air Interface User Rate)
(e.g., 57.6 kbit/s using 4 slots, 14.4 each)
advantage: ready to use, constant quality, simple
disadvantage: channels blocked for voice transmission

AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4

4.8 1
9.6 2 1
14.4 3 1
19.2 4 2
28.8 3 2
38.4 4
43.2 3
57.6 4
Disadvantages of GSM
➢ There is no perfect system!!
• no end-to-end encryption of user data
• no full ISDN bandwidth of 64 kbit/s to the user, no transparent B-channel

• abuse of private data possible

roaming profiles accessible

• high complexity of the system

several incompatibilities within the GSM standards

80
Data services in GSM II
GPRS (General Packet Radio Service)
• packet switching
• using free slots only if data packets ready to send
(e.g., 115 kbit/s using 8 slots temporarily)
• standardization 1998
advantage: one step towards UMTS, more flexible
disadvantage: more investment needed
General Packet Radio Service
• General Packet Radio Service (GPRS) is a packet radio access technique based on
GSM radio to transfer data in an efficient manner optimizing the use of network
resources.
• It provides packet radio access to external Packet Data Networks, for instance to the
Internet.
• It offers direct IP connectivity, in a Point-To-Point (PTP) or Point-To-Multipoint (PTM)
data transmission mode.
• GPRS is an add-on to existing GSM networks, i.e., it makes use of the existing GSM
radio infrastructure.

82
GPRS characteristics
GPRS uses packet switched resource allocation
• resources allocated only when data is to be sent/received
Flexible channel allocation
• one to eight time slots
• available resources shared by active users
• up and down link channels reserved separately
• GPRS and circuit switched GSM services can use same time slots
alternatively
Traffic characteristics suitable for GPRS
• Intermittent, bursty data transmissions
• Frequent transmissions of small volumes of data
• Infrequent transmission of larger volumes of data
Security Services:
• Authentication
• Access Control
• Confidentiality
• Anonymity
GPRS quality of service
Reliability Lost SDU Duplicate Out of Corrupt SDU
class probability SDU sequence probability
probability SDU
probability
1 10-9 10-9 10-9 10-9
2 10-4 10-5 10-5 10-6
3 10-2 10-5 10-5 10-2

Delay SDU size 128 byte SDU size 1024 byte

class mean 95 percentile mean 95 percentile
1 < 0.5 s < 1.5 s <2s <7s
2 <5s < 25 s < 15 s < 75 s
3 < 50 s < 250 s < 75 s < 375 s
4 unspecified
GPRS architecture and interfaces
SGSN

Gn

BSS SGSN GGSN PDN

MS

Um Gb Gn Gi

MSC HLR/
GR

VLR EIR
GPRS network elements
• GSN (GPRS Support Nodes): GGSN and SGSN
• GGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)
• SGSN (Serving GSN)
supports the MS (location, billing, security)
• GR (GPRS Register)
user addresses

4.86
Gateway GPRS Support Node
GGSN
Typically located at one of the MSC sites
One (or few) per operator
Main functions
• Interface to external data networks
• Resembles to a data network router
• Forwards end user data to right SGSN
• Routes mobile originated packets to right destination
• Filters end user traffic
• Collects charging information for data network usage
• Data packets are not sent to MS unless the user has activated
the PDP address
Serving GPRS Support Node
SGSN
Functionally connected with BSC, physically can be at MSC or BSC site
One for few BSCs or one (or few) per every BSC
One SGSN can support BSCs of several MSC sites

Main functions
Authenticates GPRS mobile
Handles mobile’s registration in GPRS network
Handles mobile’s mobility management
Relays MO and MT data traffic
TCP/IP header compression, V.42bis data compression, error control MS- SGSN (ARQ)
Collect charging information of air interface usage
 BTS BSC Packet
Um network
PSTN
R/S

MSC
SMS-GMSC
Gb HLR/AuC
Gs Gr Gd
Gr Gd
Serving GPRS Packet Corporate 1
Support Node Gs SS7
network
(SGSN) Gn Network Server
EIR
Border GPRS
Gateway (BG) Intra-PLMN INFRASTRUCTURE MAP-F
Packet
Inter-PLMN backbone
network
Backbone network Router
Local
network Gp (IP based) Gateway GPRS Firewall area
Support Node Data
Packet
Firewall Point-To- network
(GGSN) network
network
Multipoint Gn (Internet)
Service Gi.IP
Corporate 2
Center Server
(PTM SC) Gi.X.25
Data
Packet
Firewall
network
network
(X.25)
Router
Local
area
network

4.89
GPRS protocol architecture
MS BSS SGSN
Um Gb Gn GGSN Gi

apps.

IP/X.25 IP/X.25

SNDCP GTP
SNDCP GTP
LLC LLC UDP/TCP UDP/TCP

RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio

RLC: Radio Link Control SNDCP: Subnetwork Dependent Convergence Protocol

BSSGP: BSS GPRS Protocol LAPG: Link Access Protocol on G channel
GTP: GPRS Tunnel Protocol
RLC protocol and MAC protocol is in charge of all radio related control functions on the air
interface (PCU and MS)
• LLC protocol is in charge of transmission between SGSN and MS
• Delivery of data units to the higher layer in the correct sequence
• SNDCP (Sub Network Dependent Convergence Protocol) protocol is in charge of
segmentation and compression of data (SGSN and MS)

RLC/MAC protocol is defined between MS and PCU (Packet Control Unit)

• In charge of all radio related control functions on the air
interface
• Performs segmentation of LLC frames into radio blocks

91
LLC provides different types of services to different upper layer applications, namely SNDCP
GMM/SM and SMS
• Provides the transport frames for the data transfer between MS and SGSN
• Encapsulation of higher layer protocol data units into LLC data units
• Delivery of data units to the higher layer in correct sequence
• Ciphering and deciphering (if enabled)

The SNDCP is applicable between MS and SGSN

✓ within SGSN, there is a relay function from SNDCP towards GPRS
Tunneling Protocol (GTP)
• Segmentation of user data packets (max 1520 octets)
✓ compression of Packet Data (optional)
• Relies completely on the error recovery and transmission capabilities of LLC

92
BSSGP (BSS GPRS Protocol)
✓ transparent transfer of signaling and data PDUs between SGSN and PCU
✓ administration of the packet-switched link resources between SGSN and PCU
✓ initiation of packet-switched paging for a particular MS if requested by SGSN
• NS (Network Service) - consists of two sublayers
✓ Network Service Control Protocol
- provides virtual connections (NS-VC) between the SGSN and the PCU
- these VCs need to be administrated by the NS protocol
✓ Frame Relay Protocol
- NS is a packet-switched protocol: a single virtual connection may use resources from 0 kbps up
to entire bandwidth of the transmission link
- transports BSSGP PDUs between BSS and SGSN

93
GTP
Allows multi-protocol packets to be tunneled through GPRS backbone between GPRS Support
Nodes
(GSNs)
• Responsible for the transmission of both signaling information and application data
• Based on an IP-protocol stack and uses UDP as transport layer (OSI layer 4) Also takes care of
the transfer of charging information

94
Limitation of GPRS
Limited cell capacity for all users
There are only limited radio resources that can be deployed for both voice and GPRS calls.
Speeds much lower in reality
It is unlikely that a network operator will allow all timeslots to be used by a single GPRS user.
Support of GPRS mobile terminate by terminals is no ensured
There has been no confirmation from any handset vendors that mobile terminated GPRS
calls.
Transit delays
GPRS packets are sent in all different directions to reach the same destination. the result is
that potential transit delays can occur.
No store and forward
There is no storage mechanism incorporated into the GPRS standard, apart from the
incorporation of interconnection links between SMS and
GPRS.

95
 UMTS and IMT-2000
Proposals for IMT-2000 (International Mobile Telecommunications)
❑ UWC-136, cdma2000, WP-CDMA
❑ UMTS (Universal Mobile Telecommunications System) from ETSI
UMTS
❑ UTRA (was: UMTS, now: Universal Terrestrial Radio Access)
❑ enhancements of GSM
 EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s
 CAMEL (Customized Application for Mobile Enhanced Logic)
 VHE (virtual Home Environment)
❑ fits into GMM (Global Multimedia Mobility) initiative from ETSI
❑ requirements
 min. 144 kbit/s rural (goal: 384 kbit/s)
 min. 384 kbit/s suburban (goal: 512 kbit/s)
 up to 2 Mbit/s urban
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.96
 Frequencies for IMT-2000

1850 1900 1950 2000 2050 2100 2150 2200 MHz

ITU allocation MSS MSS
(WRC 1992) IMT-2000 IMT-2000

Europe GSM DE T UTRA MSS T UTRA MSS

D D
1800 CT D FDD D FDD
GSM MSS MSS
China IMT-2000 IMT-2000
1800

Japan cdma2000 MSS cdma2000 MSS

PHS
W-CDMA W-CDMA

North MSS MSS

PCS rsv.
America
1850 1900 1950 2000 2050 2100 2150 2200 MHz

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.97

 IMT-2000 family

Interface
for Internetworking

IMT-2000
GSM ANSI-41
Core Network IP-Network
(MAP) (IS-634)
ITU-T

Initial UMTS Flexible assignment of Core

(R99 w/ FDD) Network and Radio Access

IMT-DS IMT-TC IMT-MC IMT-SC IMT-FT

(Direct Spread) (Time Code) (Multi Carrier) (Single Carrier) (Freq. Time)
IMT-2000
Radio Access UTRA TDD
UTRA FDD cdma2000 UWC-136 DECT
ITU-R (TD-CDMA);
(W-CDMA) (EDGE)
TD-SCDMA 3GPP2 ETSI
3GPP UWCC/3GPP
3GPP
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.98
 GSM and UMTS Releases

Spec version Freeze date

GSM/EDGE Release 3G Release Abbreviated name
number (indicative only)
December 2004 -
Phase 2+ Release 6 Release 6 Rel-6 6.x.y
March 2005
Phase 2+ Release 5 Release 5 Rel-5 5.x.y March - June 2002
Phase 2+ Release 4 Release 4 Rel-4 4.x.y March 2001
- Release 2000 4.x.y
R00 Renaming…
Phase 2+ Release 2000 - 9.x.y
- Release 1999 3.x.y
R99 March 2000
Phase 2+ Release 1999 - 8.x.y

Phase 2+ Release 1998 - R98 7.x.y early 1999

Phase 2+ Release 1997 - R97 6.x.y early 1998

Phase 2+ Release 1996 - R96 5.x.y early 1997

Phase 2 - Ph2 4.x.y 1995

Phase 1 - Ph1 3.x.y 1992

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.99

 Licensing Example: UMTS in Germany, 18. August 2000

❑ UTRA-FDD:
❑ Uplink 1920-1980 MHz
❑ Downlink 2110-2170 MHz
❑ duplex spacing 190 MHz
❑ 12 channels, each 5 MHz
❑ UTRA-TDD:
❑ 1900-1920 MHz,
❑ 2010-2025 MHz;
❑ 5 MHz channels
❑ Coverage of the population
❑ 25% until 12/2003
❑ 50% until 12/2005

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC S billion €

S05 Sum: 50.814.71
 UMTS architecture (Release 99 used here!)
UTRAN (UTRA Network)
❑ Cell level mobility
❑ Radio Network Subsystem (RNS)
❑ Encapsulation of all radio specific tasks
UE (User Equipment)
CN (Core Network)
❑ Inter system handover
❑ Location management if there is no dedicated connection between UE and
UTRAN
Uu Iu
UE UTRAN CN

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

1
 UMTS domains and interfaces I
Home
Network
Domain
Zu
Cu Uu Iu Yu
Mobile Access Serving Transit
USIM
Equipment Network Network Network
Domain
Domain Domain Domain Domain
Core Network Domain

User Equipment Domain Infrastructure Domain

User Equipment Domain

❑ Assigned to a single user in order to access UMTS services
Infrastructure Domain
❑ Shared among all users
❑ Offers UMTS services to all accepted users
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10
2
 UMTS domains and interfaces II
Universal Subscriber Identity Module (USIM)
❑ Functions for encryption and authentication of users
❑ Located on a SIM inserted into a mobile device
Mobile Equipment Domain
❑ Functions for radio transmission
❑ User interface for establishing/maintaining end-to-end connections
Access Network Domain
❑ Access network dependent functions
Core Network Domain
❑ Access network independent functions
❑ Serving Network Domain
 Network currently responsible for communication
❑ Home Network Domain
 Location and access network independent functions
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10
3
 Spreading and scrambling of user data
Constant chipping rate of 3.84 Mchip/s
Different user data rates supported via different spreading factors
❑ higher data rate: less chips per bit and vice versa
User separation via unique, quasi orthogonal scrambling codes
❑ users are not separated via orthogonal spreading codes
❑ much simpler management of codes: each station can use the same orthogonal spreading codes
❑ precise synchronisation not necessary as the scrambling codes stay quasi- orthogonal

data1 data2 data3 data4 data5

spr. spr. spr. spr. spr.

code1 code2 code3 code1 code4

scrambling scrambling
code1 code2
sender1 sender2

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

4
 OSVF coding

1,1,1,1,1,1,1,1
1,1,1,1 ...
1,1,1,1,-1,-1,-1,-1
1,1
1,1,-1,-1,1,1,-1,-1
1,1,-1,-1 ...
X,X
1,1,-1,-1,-1,-1,1,1
X 1
1,-1,1,-1,1,-1,1,-1
X,-X 1,-1,1,-1 ...
1,-1,1,-1,-1,1,-1,1
SF=n SF=2n 1,-1
1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 ...
1,-1,-1,1,-1,1,1,-1

SF=1 SF=2 SF=4 SF=8

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

5
 UMTS FDD frame structure
W-CDMA
Radio frame • 1920-1980 MHz uplink
0 1 2 ... 12 13 14 • 2110-2170 MHz downlink
10 ms
• chipping rate:
3.840 Mchip/s
Time slot
• soft handover
666.7 µs Pilot TFCI FBI TPC uplink DPCCH • QPSK
2560 chips, 10 bits • complex power control
(1500 power control
666.7 µs Data uplink DPDCH
cycles/s)
2560 chips, 10*2k bits (k = 0...6) • spreading: UL: 4-256;
666.7 µs Data1 TPC TFCI Data2 Pilot downlink DPCH DL:4-512
FBI: Feedback Information TPC:
DPDCH DPCCH DPDCHDPCCH Transmit Power Control
TFCI: Transport Format Combination Indicator
2560 chips, 10*2k bits (k = 0...7) DPCCH: Dedicated Physical Control Channel
Slot structure NOT for user separation DPDCH: Dedicated Physical Data Channel
DPCH: Dedicated Physical Channel
but synchronisation for periodic functions!

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

6
 Typical UTRA-FDD uplink data rates

12.2 64 144 384

User data rate [kbit/s] (voice)

DPDCH [kbit/s] 60 240 480 960

DPCCH [kbit/s] 15 15 15 15

Spreading 64 16 8 4

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

7
 UMTS TDD frame structure (burst type 2)

Radio frame
10 ms 0 1 2 ... 12 13 14

Time slot
Data 1104 Midample Data 1104
666.7 µs chips 256 chips chips
GP Traffic burst

2560 chips GP: guard period

96 chips

TD-CDMA
• 2560 chips per slot
• spreading: 1-16
• symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction)
• tight synchronisation needed
• simpler power control (100-800 power control cycles/s)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

8
UTRAN architecture (UMTS Terrestrial Radio Access Network)
RNS RNC: Radio Network Controller
RNS: Radio Network Subsystem
UE1 Node B Iub
Iu
RNC CN
UE2
Node B UTRAN comprises several
RNSs
UE3
Node B can support FDD or
Iur TDD or both
Node B
Iub RNC is responsible for handover
Node B decisions requiring signalingto
RNC the UE
Node B Cell offers FDD or TDD

RNS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.10

9
 RNC functions
1. Call Admission control
2. Congestion control
3. Encryption/Decryption
4. ATM Switching and multiplexing, protocol conversion
5. Radio resource control
6. Radio bearer setup and release
7. Code allocation
8. Power Control
9. Handover control and RNS relocation
10. Management

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

0
 Core network: architecture

VLR
BSS
BTS Abis Iu

BSC MSC GMSC

PSTN
Node
BTSB IuCS
AuC
EIR HLR
GR
Node B
Iub
Node B
RNC SGSN GGSN
Gn Gi
Node B IuPS CN
RNS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

1
 Core network
The Core Network (CN) and thus the Interface Iu, too, are separated into two logical domains:
❑ Circuit Switched Domain (CSD)
❑ Circuit switched service incl. signaling
❑ Resource reservation at connection setup
❑ GSM components (MSC, GMSC, VLR)
❑ IuCS
❑ Packet Switched Domain (PSD)
❑ GPRS components (SGSN, GGSN)
❑ IuPS

Release 99 uses the GSM/GPRS network and adds a new radio access!
❑ Helps to save a lot of money …
❑ Much faster deployment
❑ Not as flexible as newer releases (5, 6)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

2
 UMTS protocol stacks (user plane)
UE Uu UTRAN IuCS 3G
MSC
apps. &
protocols
Circuit RLC RLC SAR SAR
switched MAC MAC AAL2 AAL2
radio radio ATM ATM

UE Uu UTRAN IuPS 3G Gn 3G
apps. & SGSN GGSN
protocols
IP, PPP, IP tunnel IP, PPP,
… …
Packet PDCP GTP
PDCP GTP GTP GTP
switched RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
MAC MAC AAL5 AAL5 L2 L2
radio radio ATM ATM L1 L1

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

3
 Support of mobility: macro diversity
Multicasting of data via several
physical channels
❑ Enables soft handover
❑ FDD mode only
UE Node B Uplink
❑ simultaneous reception of UE
data at several Node Bs
❑ Reconstruction of data at Node B,
Node B RNC CN SRNC or DRNC
Downlink
❑ Simultaneous transmission of
data via different cells
❑ Different spreading codes in
different cells
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11
4
 Support of mobility: handover
From and to other systems (e.g., UMTS to GSM)
❑ This is a must as UMTS coverage will be poor in the beginning
RNS controlling the connection is called SRNS (Serving RNS)
RNS offering additional resources (e.g., for soft handover) is called Drift RNS
(DRNS)
End-to-end connections between UE and CN only via Iu at the SRNS
❑ Change of SRNS requires change of Iu
❑ Initiated by the SRNS
❑ Controlled by the RNC and CN
Node B SRNC CN
Iub Iu
UE I ur

Node B DRNC
Iub

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

5
 Example handover types in UMTS/GSM

UE1
Node B1 RNC1 3G MSC1
Iu
UE 2
Node B2 Iub I ur
UE3 Node B3 RNC2 3G MSC2

UE4
BTS BSC 2G MSC3
Abis A

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

6
 Breathing Cells
GSM
❑ Mobile device gets exclusive signal from the base station
❑ Number of devices in a cell does not influence cell size

UMTS
❑ Cell size is closely correlated to the cell capacity
❑ Signal-to-nose ratio determines cell capacity
❑ Noise is generated by interference from
 other cells
 other users of the same cell
❑ Interference increases noise level
❑ Devices at the edge of a cell cannot further increase their output power (max.
power limit) and thus drop out of the cell
no more communication possible
❑ Limitation of the max. number of users within a cell required
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11
❑ Cell breathing complicates network planning 7
 Breathing Cells: Example

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11

Prachi Shahane
8
 UMTS services (originally)
Data transmission service profiles
Service Profile Bandwidth Transport mode
High Interactive MM 128 kbit/s Circuit switched Bidirectional, video telephone
High MM 2 Mbit/s Packet switched Low coverage, max. 6 km/h
Medium MM 384 kbit/s Circuit switched asymmetrical, MM, downloads
Switched Data 14.4 kbit/s Circuit switched
Simple Messaging 14.4 kbit/s Packet switched SMS successor, E-Mail
Voice 16 kbit/s Circuit switched

Virtual Home Environment (VHE)

❑ Enables access to personalized data independent of location, access
network, and device
❑ Network operators may offer new services without changing the network
❑ Service providers may offer services based on components which allow the
automatic adaptation to new networks and devices
❑ Integration of existing IN services
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.11
9
 Example 3G Networks: Japan

FOMA (Freedom Of Mobile multimedia

Access) in Japan
Examples for FOMA phones

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.12

0
 Example 3G networks: Australia

cdma2000 1xEV-DO in Melbourne/Australia

Examples for 1xEV-DO devices

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.12

1
 Isle of Man – Start of UMTS in Europe as Test

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.12

Prachi Shahane
2
 UMTS in Monaco

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.12

Prachi Shahane
3
 UMTS in Europe

Orange/UK

Vodafone/Germany

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS05 4.12

4
 Some current enhancements
GSM
❑ EMS/MMS
 EMS: 760 characters possible by chaining SMS, animated icons, ring tones, was soon
replaced by MMS (or simply skipped)
 MMS: transmission of images, video clips, audio
– see WAP 2.0 / chapter 10
❑ EDGE (Enhanced Data Rates for Global [was: GSM] Evolution)
 8-PSK instead of GMSK, up to 384 kbit/s
 new modulation and coding schemes for GPRS  EGPRS
– MCS-1 to MCS-4 uses GMSK at rates 8.8/11.2/14.8/17.6 kbit/s
– MCS-5 to MCS-9 uses 8-PSK at rates 22.4/29.6/44.8/54.4/59.2 kbit/s

UMTS
❑ HSDPA (High-Speed Downlink Packet Access)
 initially up to 10 Mbit/s for the downlink, later on 20 Mbit/s using MIMO- (Multiple Input
Multiple
Prof. Dr.-Ing. Jochen Output-)
Schiller, antennas
http://www.jochenschiller.de/ MC SS05 4.12
 uses 16-QAM instead of QPSK 5
Thank You!
([email protected])

126
127