Mobile Communications

 Introduction
 GSM
 Overview
 Services
 Sub-systems
 Components
Mobile phone subscribers worldwide
1200

1000

GSM total
Subscribers [million]

800
TDMA total
CDMA total
600 PDC total
Analogue total
Total wireless
400
Prediction (1998)

200

0
year
1996 1997 1998 1999 2000 2001 2002
 GSM: Overview
 GSM
formerly: Groupe Spéciale Mobile (founded 1982)
now: Global System for Mobile Communication
Pan-European standard (ETSI, European
Telecommunications Standardisation Institute)
simultaneous introduction of essential services in three
phases (1991, 1994, 1996) by the European
telecommunication administrations (Germany: D1 and D2)
 seamless roaming within Europe possible
today many providers all over the world use GSM (more
than 184 countries in Asia, Africa, Europe, Australia,
America)
more than 747 million subscribers
more than 70% of all digital mobile phones use GSM
over 10 billion SMS per month in Germany, > 360
billion/year worldwide
 Performance characteristics of GSM (wrt. analog sys.)
 Communication
mobile, wireless communication; support for voice and data
services
 Total mobility
international access, chip-card enables use of access points
of different providers
 Worldwide connectivity
one number, the network handles localization
 High capacity
better frequency efficiency, smaller cells, more customers per
cell
 High transmission quality
high audio quality and reliability for wireless, uninterrupted
phone calls at higher speeds (e.g., from cars, trains)
 Security functions
access control, authentication via chip-card and PIN
 Disadvantages of GSM
 There is no perfect system!!
 no end-to-end encryption of user data
 no full ISDN bandwidth of 64 kbit/s to the user, no
transparent B-channel
B(bearer)-channels carry data, voice, and other services.
D(delta) -channel carries control and signaling information.
 reduced concentration while driving
 electromagnetic radiation

 abuse of private data possible

 roaming profiles accessible

 high complexity of the system

 several incompatibilities within the GSM standards
 GSM: Mobile Services TE _terminal
 GSM offers MT : Mobile
terminal
 several types of connections
PLMN :Public
 voice connections, data connections, short Landline
message service Mobile n/w
 multi-service options (combination of basic ISDN:
services) Integrated
Service
 Three service domains Digital n/w
 Bearer Services (transmission only, connection PSTN: Public
oriented) Switched
 Telematics Services (application specific)
Telepohone
bearer services N/w
 Supplementary Services (user identification, call MS: Mobile
MS
forwarding, groups, …) transit source/ Station
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)

tele services
Within the mobile station MS, the mobile
termination (MT) performs all network specific
tasks (TDMA, FDMA, coding etc.)
• offers an interface for data transmission
(S) to the terminal TE which can then be
network independent.
• Depending on the capabilities of TE, further
• MSinterfaces may
–GSM public land be network
mobile needed, such
(PLMN) as R, via
is connected
Umaccording
interface to the ISDN reference model
• transparent transmission of data between the interfaces to the
network, i.e., S in case of the mobile station.
 Bearer Services
 Telecommunication services to transfer data between access points
 Specification of services up to the terminal interface (OSI layers 1-3)
 Different data rates for voice and data (original standard)
• Using transparent and non-transparent services, GSM specifies several bearer services for
interworking with PSTN, ISDN, and packet switched public data networks (PSPDN) like X.25, which is
available worldwide.
• Data transmission can be full-duplex
data service (circuit switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 1200 bit/s
data service (packet switched)
 synchronous: 2.4, 4.8 or 9.6 kbit/s
 asynchronous: 300 - 9600 bit/s

 Clearly, these relatively low data rates reflect the assumption that
data services will only constitute some small percentage of the
overall traffic.
 Today: data rates of approx. 50 kbit/s possible – will be covered later!
• Transparent bearer services only use the
functions of the physical layer (layer 1) to transmit
data.
• Data transmission has a constant delay and
throughput if no transmission errors occur.
• only mechanism to increase transmission quality is
the use of forward error correction (FEC),
• Non-transparent bearer services use
protocols of layers two and three to
 implement error correction and flow control.
• These services use the transparent bearer services,
adding a radio link protocol (RLP).
• This protocol comprises mechanisms of high-level
data link control (HDLC), and special selective-
reject mechanisms to trigger retransmission of
erroneous data
 Tele Services I
 Tele services are application specific and may thus need all
seven layers of the ISO/OSI reference model. These services
are specified end-to-end, i.e., from one terminal TE to another.
 Telecommunication services that enable voice communication
via mobile phones
 All these basic services have to obey cellular functions,
security measurements etc.
 Offered services
mobile telephony
primary goal of GSM was to enable mobile telephony offering
the traditional bandwidth of 3.1 kHz
 Emergency number
 common number throughout Europe (112); mandatory for all service providers; free of charge;
connection with the highest priority (preemption of other connections possible) will automatically be
set up with the closest emergency center.
Multinumbering
several ISDN phone numbers per user possible
Additional services
• Special codecs (coder/decoder) are used for
voice transmission, while other codecs are
used for the transmission of analog data for
communication with traditional computer
modems used in, e.g., fax machines.

Short Message Service (SMS)

• alphanumeric data transmission to/from the mobile terminal
which offers transmission of messages of up to 160 characters.
• SMS messages do not use the standard data channels of GSM
but exploit unused capacity in the signalling channels
• Sending and receiving of SMS is possible during data or voice
transmission
• way to reach a mobile phone from within the network. Thus SMS
is used for updating mobile phone software or for implementing
• Successor of SMS, the enhanced message
service (EMS), offers a larger message size (e.g.,
760 characters, concatenating several SMs),
formatted text, and the transmission of animated
pictures, small images and ring tones in a
standardized way

• MMS offers the transmission of larger pictures (GIF,

JPG, WBMP), short video clips etc. and comes with
mobile phones that integrate small cameras.

Non-Voice-Teleservices
 group 3 fax
 voice mailbox (implemented in the fixed network supporting
the mobile terminals)
 electronic mail (MHS, Message Handling System, implemented
in the fixed network)
University Question on GSM Architecture
Q1> Explain in detail GSM architecture. (mutiple
times) 10M
Q2> What is the use of HLR and VLR registers in
Mobile Computing

05M
Q3> Draw a neat diagram of GSM architecture
and explain with different types of interfaces.
10M
Q4>Explain Network and switching subsystem of
GSM architecture.
05M
 Architecture of the GSM system
GSM
several providers setup mobile networks
following the GSM standard within each country
Subsystems
 RSS (radio subsystem): covers all radio aspects
 NSS (network and switching subsystem): call
forwarding, handover, switching
 OSS (operation subsystem): management of the
network
Main components
 MS (mobile station)
 BS (base station)
 MSC (mobile switching center)
 LR (location register)
 GSM: overview

OMC, EIR,
AUC
HLR
NSS GMSC
fixed network
with OSS

VLR MSC MSC

VLR

BSC
BTS
BSC

BTS BTS
RSS BSS

BTS
BTS
MS
GSM Architecture
GSM: elements and interfaces of RSS
Components:
BSS: Base Station subsystem
Radio cell: consists of MS and
BTS.
MS: Mobile Station
BTS: Base transfer station
BSC: Base Station Controller

Interface:
Um: interface between MS and
BTS
Abis: interface between BTS
and BSC
GSM: elements and interfaces
BSS: Base Station subsystem
BTS: Base transfer station
BSC: Base Station Controller
MS: Mobile Station
MSC: Mobile Switching
Center
VLR:Visitor Location Register
HLR: Home location Register
GMSC: Gateway MSC
IWF: InterWorking Function
AUC: Authentication Center
EIR: Equipment Identity
Register
OMC: Operation and
Maintenance Center
PDN: Public Data Network
PSTN: Public Switched
Telephone Network
ISDN: Integrated Service
Digital Network
GSM: elements and interfaces
BSS: Base Station subsystem
BTS: Base transfer station
BSC: Base Station Controller
MS: Mobile Station
MSC: Mobile Switching Center
VLR:Visitor Location Register
HLR: Home location Register
GMSC: Gateway MSC
IWF: InterWorking Function
AUC: Authentication Center
EIR: Equipment Identity Register
OMC: Operation and
Maintenance Center
PDN: Public Data Network
PSTN: Public Switched
Telephone Network
ISDN: Integrated Service Digital
Network
RSS: Radio Sub-System
NSS: Network and switching
Sub-System
OSS: Operation Sub-System
 GSM: system architecture
radio network and switching fixed
subsystem subsystem partner networks

MS MS
ISDN
PSTN
Um MSC

BTS Abis
BSC EIR
BTS

SS7
HLR

BTS VLR
BSC ISDN
BTS MSC PSTN
A
BSS IWF
PSPDN
CSPDN
Signaling system No. 7 (SS7) is used for signaling between an MSC and a BSC. This protocol
also transfers all management information between MSCs, HLR, VLRs, AuC, EIR, and OMC.
 System architecture: radio subsystem
radio network and switching  Components
subsystem subsystem
 MS (Mobile Station)
MS MS  BSS (Base Station
Subsystem):
Um
consisting of
 BTS (Base Transceiver
BTS Abis
Station):
BSC MSC
BTS sender and receiver
 BSC (Base Station
Controller):
controlling several
transceivers
A  Interfaces
BTS
BSC MSC  Um : radio interface
BTS
BSS  Abis : standardized, open
GSM Abis Interface interface with
16and
The GSM A-bis interface is responsible for transmitting traffic kbit/s userinformation
signaling channelsbetween
the GSM BSC and the GSM BTS its First Actual Physical Connection for Call.
 A: standardized, open
The GSM transmission protocol used for sending signaling information on the A-bis interface is
Link Access Protocol on the D Channel (LAPD) interface with
System architecture: network and switching subsystem
network fixed partner Components
subsystem networks
 MSC (Mobile Services Switching
Center):
ISDN  IWF (Interworking Functions)
PSTN  ISDN (Integrated Services Digital
MSC Network)
 PSTN (Public Switched Telephone
Network)
EIR  PSPDN (Packet Switched Public Data
Net.)
 CSPDN (Circuit Switched Public Data
SS7

HLR Net.)

 Databases
 HLR (Home Location Register)
VLR
 VLR (Visitor Location Register)
ISDN
MSC  EIR (Equipment Identity Register)
PSTN
IWF
PSPDN
CSPDN
 Radio subsystem
The Radio Subsystem (RSS) comprises the
cellular mobile network up to the switching
centers
Components
Base Station Subsystem (BSS):
Base Transceiver Station (BTS): radio
components including sender, receiver, antenna
- if directed antennas are used one BTS can
cover several cells
Base Station Controller (BSC): switching
between BTSs, controlling BTSs, managing of
network resources, mapping of radio channels
(Um) onto terrestrial channels (A interface)
 Mobile station
Terminal for the use of GSM services
 A mobile station (MS) comprises several functional
groups
MT (Mobile Terminal):
 offers common functions used by all services the MS offers
 corresponds to the network termination (NT) of an ISDN
access
 end-point of the radio interface (Um)
TA (Terminal Adapter):
 terminal adaptation, hides radio specific characteristics
TE (Terminal Equipment):
 peripheral device of the MS, offers services to a user
 does not contain GSM specific functions
SIM (Subscriber Identity Module):
 personalization of the mobile terminal, stores user parameters
TE TA MT
Um
R S
 Network and switching subsystem
 NSS is the main component of the public mobile
network GSM
switching, mobility management, interconnection to
other networks, system control
 Components
Mobile Services Switching Center (MSC)
controls all connections via a separated network
to/from a mobile terminal within the domain of the
MSC - several BSC can belong to a MSC
Databases (important: scalability, high capacity, low
delay)
Home Location Register (HLR)
central master database containing user data,
permanent and semi-permanent data of all
subscribers assigned to the HLR (one provider can
have several HLRs)
 Mobile Services Switching
Center
The MSC (mobile switching center) plays a central role in
GSM
switching functions
additional functions for mobility support
management of network resources
interworking functions via Gateway MSC (GMSC)
integration of several databases
 Functions of a MSC
specific functions for paging and call forwarding
termination of SS7 (signaling system no. 7)
mobility specific signaling
location registration and forwarding of location information
provision of new services (fax, data calls)
support of short message service (SMS)
generation and forwarding of accounting and billing
information
 Operation Sub-System
The OSS (Operation Subsystem) enables centralized
operation, management, and maintenance of all
GSM subsystems
 Components
Authentication Center (AUC)
 generates user specific authentication parameters on request of
a VLR
 authentication parameters used for authentication of mobile
terminals and encryption of user data on the air interface within
the GSM system
Equipment Identity Register (EIR)
 registers GSM mobile stations and user rights
 stolen or malfunctioning mobile stations can be locked and
sometimes even localized (IMEI)
Operation and Maintenance Center (OMC)
 different control capabilities for the radio subsystem and the
network subsystem
 GSM - TDMA/FDMA

935-960 MHz
124 channels (200 kHz)
downlink
cy
en
qu

890-915 MHz
f re

124 channels (200 kHz)

uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
 Um Abis A
MS BTS BSC MSC
CM CM
MM MM
BSSAP BSSAP
RR RR’
RR’ BTSM BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD
radio radio PCM PCM PCM PCM

16/64 kbit/s
64 kbit/s /
2.048 Mbit/s

Um Interface: MS - BTS
1. Physical layer (L1) (radio)
2. LAPD- Link access protocol on D-channel (L2)
3. The network layer (L3)
1. CM- Call management sublayer
2. MM- Mobility management sublayer
3. RR- Radio resource management sublayer
• Physical layer comprise channel coding and error detection/correction.

• Channel coding uses different forward error correction (FEC) schemes. FEC adds
redundancy to user data, allowing for the detection and correction of selected
errors.

• link access procedure for the D-channel (LAPD )protocol has been defined at the
Um interface for layer two

• LAPDm is a lightweight and does not need synchronization flags or check

summing for error detection.

• LAPDm offers reliable data transfer over connections, re-sequencing of data

frames, and flow control. LAPDm include segmentation and reassembly of data
and acknowledged/unacknowledged data transfer.
• Layer three , comprises several sublayers The lowest sublayer is the radio
resource management (RR) The main tasks of RR are setup, maintenance, and
release of radio channels.

• The functions of RR’ are supported by the BSC via the BTS management (BTSM).

• Mobility management (MM): functions are registration, authentication,

identification, location updating, and the provision of a temporary mobile
subscriber identity (TMSI) that replaces the international mobile subscriber
identity (IMSI) and which hides the real identity of an MS user over the air
interface.

• Call management (CM)layer contains three entities: call control (CC), short
message service (SMS), and supplementary service (SS)

• Data transmission at the physical layer typically uses pulse code modulation
(PCM)systems.
 Um Abis A
MS BTS BSC MSC
CM CM
MM MM
BSSAP BSSAP
RR RR’
RR’ BTSM BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD
radio radio PCM PCM PCM PCM

16/64 kbit/s
64 kbit/s /
2.048 Mbit/s
Abis interface: BTS – BSC
Function:
1. Radio channel Management
2. Traffic channel management
3. Terrestrial channel managemnt
Its support 2 different links
a.64kbs link – carrying speech or user data
b. 16kbs link – control information link between BTS - BSC and
BSC - MSC
 GSM protocol layers for signaling
Um Abis A
MS BTS BSC MSC
CM CM
MM MM
BSSAP BSSAP
RR RR’
RR’ BTSM BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD
radio radio PCM PCM PCM PCM

16/64 kbit/s
64 kbit/s /
2.048 Mbit/s

RR: Radio Resource Mgmt, LAPD: Link Access Procedure D

Channel, MM: Mobility Management, BSSAP: BSS Application
CM: Call Management (CC, SMS, SS: Circuit-switched Call Control Protocol., Short Message
Transfer Protocol., Supplementary Service),
 GSM: system architecture
radio network and switching fixed
subsystem subsystem partner networks

MS MS
ISDN
PSTN
Um MSC

BTS Abis
BSC EIR
BTS

SS7
HLR

BTS VLR
BSC ISDN
BTS MSC PSTN
A
BSS IWF
PSPDN
CSPDN
Signaling system No. 7 (SS7) is used for signaling between an MSC and a BSC. This protocol
also transfers all management information between MSCs, HLR, VLRs, AuC, EIR, and OMC.
 GSM protocol layers for signaling
Um Abis A
MS BTS BSC MSC
CM CM
MM MM
BSSAP BSSAP
RR RR’
RR’ BTSM BTSM SS7 SS7
LAPDm LAPDm LAPD LAPD
radio radio PCM PCM PCM PCM

16/64 kbit/s
64 kbit/s /
2.048 Mbit/s

RR: Radio Resource Mgmt, LAPD: Link Access Procedure D Channel,

MM: Mobility Management, BSSAP: BSS Application
CM: Call Management (CC, SMS, SS: Circuit-switched Call Control Protocol., Short Message
Transfer Protocol., Supplementary Service),
University Question on Localization and Calling
Q1> Explain how Mobile Orginated call (MOC)
works
(mutiple times) 10M
Q2> Explain Mobile Call termination in GSM,
detailing the need and the use of MSRN,IMSI,TMSI
nos. 10M

Q3> Explain Mobile Call termination works

detailing the role of HLR and VLR. 10M
Q4>Explain Network and switching subsystem of
GSM architecture.
05M
 Localization and calling

• To locate an MS and to address the MS, several numbers are needed:

• Mobile station international ISDN number (MSISDN):The only important

number for a user of GSM is the phone number. Remember that the phone number
is not associated with a certain device but with the SIM, which is personalized for a
user. This number consists of the country code (CC) the national destination code
(NDC), and the subscriber number (SN)

• International mobile subscriber identity (IMSI):GSM uses the IMSI for internal
unique identification of a subscriber. IMSI consists of a mobile country code (MCC),
the mobile network code (MNC), and finally the mobile subscriber identification
number (MSIN)
Temporary mobile subscriber identity (TMSI):To hide the IMSI, which
would give away the exact identity of the user signaling over the air interface,
GSM uses the 4 byte TMSI for local subscriber identification. TMSI is selected
by the current VLR and is only valid temporarily and within the location area
of the VLR
Mobile station roaming number (MSRN): Another temporary address that
hides the identity and location of a subscriber is MSRN. The VLR generates this
address on request from the MSC, and the address is also stored in the HLR.
MSRN contains the current visitor country code (VCC), the visitor national
destination code (VNDC) , the identification of the current MSC together with
the subscriber number. The MSRN helps the HLR to find a subscriber for an
incoming call.
 4
HLR VLR
5
8 9
3 6
14 15

7
PSTN GMSC MSC
1 2

10 13 10
10
16

BSS BSS BSS

11 11 11

11 12
17

MS

Mobile Terminated Call

 Mobile Terminated Call
1: calling a GSM subscriber
2: forwarding call to GMSC 4
HLR VLR
3: signal call setup to HLR 5
8 9
4, 5: request MSRN from VLR 3 6 14 15
6: forward responsible calling 7
PSTN GMSC MSC
station 1 2
MSC to GMSC
10 10 13 10
7 : forward call to current MSC 16
8, 9: get current status of MS BSS BSS BSS
11 11 11
10, 11: paging of MS
12, 13: MS answers 11 12
17
14, 15: security checks
MS
16, 17: set up connection

MSRN: Mobile Station Roaming Number

 Mobile Terminated Call
1: calling a GSM subscriber
2: forwarding call to GMSC 4
HLR VLR
3: signal call setup to HLR 5
8 9
4, 5: request MSRN from VLR 3 6 14 15
6: forward responsible calling 7
PSTN GMSC MSC
station 1 2
MSC to GMSC
10 10 13 10
7 : forward call to current MSC 16
8, 9: get current status of MS BSS BSS BSS
11 11 11
10, 11: paging of MS
12, 13: MS answers 11 12
17
14, 15: security checks
MS
16, 17: set up connection
 Mobile Terminated Call
1: A user dials the phone number of a GSM subscriber
2: PSTN notices and forwards call to Gateway MSC
3: GMSC identifies the HLR for the subscriber & signals call setup to HLR
4:HLR checks for existence of number and subscription of services &
request MSRN from VLR
5: VLR replies to HLR
6: HLR determines MSC for MS & forwards this information to GMSC
7: GMSC forwards call setup request to current MSC
8: MSC requests current status of MS to the VLR
9: MSC gets current status of MS from the VLR
10: MSC initiates paging in all cells BSSs
11: BTSs of all BSSs transmit this paging to the MS
12, 13 ,14, : MS answers
15: VLR performs security checks & signals MSC to set up connection
16, 17: MSC sets up connection
Mobile Originated Call VLR

3 4

6 5

PSTN
GMSC MSC
7 8

2 9

MS BSS
10
 Mobile Originated Call

1, 2: connection request
3, 4: security check
5-8: check resources (free circuit)
VLR
9-10: set up call
3 4
6 5
PSTN GMSC MSC
7 8
2 9
MS : Mobile Station localization numbers
MSC : Mobile Services Switching Center 1
MS BSS
BSS : 10
MSISDN: Mobile station ISDN
IMSI : International Mobile Subscriber Identity
TMSI : Temporary MSI (security)
MSRN : MS Roaming Number
 Mobile Originated Call

1, 2: connection
VLR
request

3 4
3, 4: security check

6 5
5-8: check resources
PSTN
GMSC MSC
7 8
9-10: set up call
2 9

MS BSS
10
 MTC/MOC
MS MTC BTS MS MOC BTS
paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange
 MU Questions on Handover in
GSM
Q1) Explain various types of Handoffs in GSM
network (05M)
Q2) What are the different types Handover in
GSM? Explain in detail Intra-MSC handover. (10M)
Q3) Discuss various types of Handoffs in cellular
networks. (10M)
Q4) Describe Inter-MSC handover technique.
(05M)
 Four types of handover
1
2 3 4

MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC
 Four types of handover
1
2 3 4

MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC

Intra-cell: narrow frequency interference, frequency change

Inter-cell: signal strength/traffic, BTS change
Inter-BSC: signal strength/traffic, BSC change
Inter-MSC: signal strength, MSC change
 Four types of handover
1
2 3 4

MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC

1. Intra-cell: narrow frequency interference, frequency change

2. Inter-cell: signal strength/traffic, BTS change
3. Inter-BSC: signal strength/traffic, BSC change
4. Inter-MSC: signal strength, MSC change
Handover decision
receive level receive level
BTSold BTSold

HO_MARGIN

MS MS

BTSold BTSnew
 Handover procedure

MS BTSold BSCold MSC BSCnew BTSnew

measurement measurement
report result

HO decision
HO required HO request
resource allocation
ch. activation

HO command HO request ack ch. activation ack

HO command HO command
HO access
Link establishment

HO complete HO complete
clear command clear command
clear complete clear complete
 Security in GSM
Security services
access control/authentication
 user  SIM (Subscriber Identity Module): secret PIN (personal
identification number)
 SIM  network: challenge response method
confidentiality
 voice and signaling encrypted on the wireless link (after
successful authentication)
anonymity
 temporary identity TMSI “secret”:
(Temporary Mobile Subscriber Identity)
• A3 and A8
 newly assigned at each new location update (LUP) available via the
 encrypted transmission Internet (1998)

• network
 Three algorithms specified in GSM
providers can
use stronger
 A3 for authentication (“secret”, open interface) mechanisms
 A5 for encryption (standardized)
 A8 for key generation (“secret”, open interface
 GSM - authentication

mobile network SIM

RAND
Ki RAND RAND Ki

128 bit 128 bit 128 bit 128 bit

AuC / AC

A3 A3
SIM
SRES* 32 bit SRES 32 bit

SRES
MSC SRES* =? SRES SRES
32 bit

Ki: individual subscriber authentication key SRES: signed response

 GSM - key generation and encryption

mobile network (BTS) MS with SIM

RAND
Ki RAND RAND Ki
AC 128 bit 128 bit 128 bit 128 bit SIM

A8 A8

cipher Kc
key Kc
64 bit
64 bit
data encrypted SRES
data
BSS MS
data
A5 A5
GSM hierarchy of frames
hyperframe
0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s

superframe
0 1 2 ... 48 49 50
6.12 s
0 1 ... 24 25

multiframe
0 1 ... 24 25 120 ms

0 1 2 ... 48 49 50 235.4 ms

frame
0 1 ... 6 7 4.615 ms
slot
burst 577 µs
 GPRS(General Packet Radio Service)
 GPRS (General Packet Radio Service)
exhibit traffic
patterns such as frequent transmission of
small volumes or infrequent transmissions of small or
medium volumes
 GPRS should also allow for broadcast, multicast, and unicast
service.
 The overall goal in this context is the provision of a more
efficient and, thus, cheaper packet transfer service for typical
internet applications
 The main benefit for users of GPRS is the ‘always on’
characteristic – no connection has to be set up prior to data
transfer.
 The GPRS concept is independent of channel characteristics and
of the type of channel (traditional GSM traffic), and does not
limit the maximum data rate.
 For GPRS, operators often reserve at least a time slot per cell to
guarantee a minimum data rate.
 Examples for GPRS device classes

Receiving
Class Sending slots Maximum number of slots
slots
1 1 1 2
2 2 1 3
3 2 2 3
5 2 2 4
8 4 1 5
10 4 2 5
12 4 4 5
 GPRS architecture and interfaces
SGSN

Gn

BSS SGSN GGSN PDN

MS

Um Gb Gn Gi

MSC HLR/
GR

VLR EIR
GPRS Protocol Architecture

MS Um BSS Gb SGSN Gn GGSN Gi

apps.

IP/X.25 IP/X.25

SNDCP GTP
SNDCP GTP
LLC LLC UDP/TCP UDP/TCP

RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio
 IMT-2000
• IMT-2000 stands for
IMT: International Mobile Communications
2000: the frequency range of 2000 MHz and the year 2000

• In total, 17 proposals for different IMT-2000 standards were

submitted by regional SDOs to ITU in 1998. 11 proposals for
terrestrial systems and 6 for mobile satellite systems (MSSs).

• All 3G standards have been developed by regional standard

developing organizations (SDOs).

63
 IMT-2000
 The (IMT-2000), consists of 3 operating modes based on Code
Division Multiple Access (CDMA) technology.

 3G CDMA modes are most commonly known as:

CDMA2000,
WCDMA (called UMTS) and
TD-SCDMA

(Time Division-Synchronous Code Division Multiple Access)

64
 High-Speed Packet Data Services
 2 Mbps in fixed or in-building environments (very short distances, in

the order of metres)

 384 kbps in pedestrian or urban environment and 144 kbps in wide

area mobile environments

 Variable data rates in large geographic area systems (satellite)

 UMTS differs from GSM Phase 2+ (GSM +GPRS) mostly in the new

principles for the air interface transmission WCDMA instead of

TDMA/FDMA

 Therefore a new RAN (Radio Access Network) called: UTRAN

65
(UMTS Terrestrial Radio Access Network) must be introduced with
 UMTS architecture
UTRAN (UTRA Network)
Cell level mobility
Radio Network Subsystem (RNS)
Encapsulation of all radio specific tasks
UE (User Equipment)
CN (Core Network)
Inter system handover
Location management if there is no
dedicated connection between UE and UTRAN

Uu Iu

UE UTRAN CN
 UMTS domains and interfaces I
Home
Network
Domain
Zu
Cu Uu Iu Yu
Mobile Access Serving Transit
USIM
Equipment Network Network Network
Domain
Domain Domain Domain Domain

Core Network Domain

User Equipment Domain Infrastructure Domain

User Equipment Domain

Assigned to a single user in order to access UMTS
services
Infrastructure Domain
Shared among all users
Offers UMTS services to all accepted users
 UMTS domains and interfaces II
 Universal Subscriber Identity Module (USIM)
Functions for encryption and authentication of users
Located on a SIM inserted into a mobile device
 Mobile Equipment Domain
Functions for radio transmission
User interface for establishing/maintaining end-to-
end connections
 Access Network Domain
Access network dependent functions
 Core Network Domain
Access network independent functions
Serving Network Domain
 Network currently responsible for communication
Home Network Domain
 Location and access network independent functions
 UTRAN architecture
RNC: Radio Network
RNS Controller
RNS: Radio Network
UE1 Node B Iub
Iu Subsystem

RNC CN
UE2 UTRAN comprises several
Node B RNSs
Node B can support FDD
UE3 or TDD or both
RNC is responsible for
Iur handover decisions
Node B
Iub requiring signalingto
the UE
Node B
RNC Cell offers FDD or TDD

Node B

RNS
 UTRAN architecture
RNC: Radio Network
RNS Controller
RNS: Radio Network
UE
Subsystem
Node B Iub

UTRAN comprises several

RNC
Iu RNSs
Node B
Node B can support FDD or
TDD or bot
CN

Iur
Node B RNC is responsible for
Iub
handover decisions
Node B requiring signaling to
RNC
the UE
Node B Cell offers FDD or TDD
RNS
 UTRAN functions
 Admission control Channel quality measurements
 Congestion control Macro diversity
 System information Radio carrier control
broadcasting
Radio resource control
 Radio channel encryption
Data transmission over the radio
 Handover interface
 SRNS moving Outer loop power control (FDD and
TDD)
 Radio network configuration
Channel coding
 Access control
 Core network: protocols

VLR

PSTN/
MSC GMSC
GSM-CS ISDN
RNS
backbone

HLR

RNS

SGSN GGSN PDN (X.25),

Layer 3: IP Internet (IP)
GPRS backbone (IP)
Layer 2: ATM
SS 7
Layer 1: PDH,
SDH, SONET

UTRAN CN
 Core network: architecture

VLR
BSS
BTS Abis Iu

BSC MSC GMSC

PSTN
Node
BTSB
IuCS
AuC
EIR HLR
GR
Node B
Iub
Node B
RNC SGSN GGSN
Gn Gi
Node B IuPS
RNS CN
 Core network
 The Core Network (CN) and thus the Interface I u, too, are

separated into two logical domains:

 Circuit Switched Domain (CSD)
 Circuit switched service incl. signaling

 Resource reservation at connection setup

 GSM components (MSC, GMSC, VLR)

 IuCS

 Packet Switched Domain (PSD)

 GPRS components (SGSN, GGSN)

 IuPS

 Release 99 uses the GSM/GPRS network and adds a new

radio access!
 Helps to save a lot of money …

 Much faster deployment


 UMTS protocol stacks (user plane)
UE Uu UTRAN IuCS 3G
MSC
apps. &
protocols
Circuit RLC
RLC SAR
SAR
switched MAC MAC AAL2 AAL2

radio radio ATM ATM

UE Uu UTRAN IuPS 3G Gn 3G
apps. & SGSN GGSN
protocols
IP, PPP, IP tunnel IP, PPP,
… …
Packet PDCP GTP
PDCP GTP GTP GTP
switched RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
MAC MAC AAL5 AAL5 L2 L2
radio radio ATM ATM L1 L1
Support of mobility: macro diversity

 Multicasting of data via several

physical channels
 Enables soft handover
 FDD mode only
 Uplink
UE Node B
 simultaneous reception of UE
data at several Node Bs
 Reconstruction of data at Node
B, SRNC or DRNC
 Downlink
Node B RNC CN
 Simultaneous transmission of
data via different cells
 Different spreading codes in
different cells
 Support of mobility: handover
 From and to other systems (e.g., UMTS to GSM)
 This is a must as UMTS coverage will be poor in the
beginning
 RNS controlling the connection is called SRNS
(Serving RNS)
 RNS offering additional resources (e.g., for soft
handover) is called Drift RNS (DRNS)
 End-to-end connections between UE and CN
only via Iu at the SRNS
 Change of SRNS requires change of Iu
 Initiated by the SRNS
 Controlled by the RNC
Nodeand
B CN SRNC CN
Iub Iu
UE Iur
Node B DRNC
Iub
Example handover types in UMTS/GSM

UE1

Node B1 RNC1 3G MSC1

Iu
UE2
Node B2 Iub Iur

UE3 Node B3 RNC2 3G MSC2

UE4
BTS BSC 2G MSC3
Abis A
 UMTS services (originally)
Service Profile Bandwidth Transport mode
High Interactive MM 128 kbit/s Circuit switched Bidirectional, video telephone
High MM 2 Mbit/s Packet switched Low coverage, max. 6 km/h
Medium MM 384 kbit/s Circuit switched asymmetrical, MM, downloads
Switched Data 14.4 kbit/s Circuit switched
Simple Messaging 14.4 kbit/s Packet switched SMS successor, E-Mail
Voice 16 kbit/s Circuit switched

 Data transmission service profiles

 Virtual Home Environment (VHE)
 Enables access to personalized data independent of
location, access network, and device
 Network operators may offer new services without
changing the network
 Service providers may offer services based on components
which allow the automatic adaptation to new networks and