Transcript
Global system for
mobile
communication
1
Introduction
It covers around 71% of the market today
People not only use for business but also personal life
Used for wireless telephony and messaging through SMS
Supports facsimile (Fax) and data communication
GSM is based on set of standards. The proposed GSM had to meet certain business
objectives, these are:
Support for international roaming
Good speech quality
Ability to support handheld terminals
Low terminal and service cost
ISDN compatibility
2
GSM history timeline 3
Frequency reuse concept led to the development of Cellular technology by AT&T and Bell Labs in 1947
Characteristics were:
The area covered is subdivided into radio zones or cells. Cells can be of any shape, for convenient it is considered as hexagon. Base stations are placed at the centre of these cells
Each cells i receives a subset of frequencies from the total set assigned to respective mobile network. To avoid any type of interference, no to neighbouring cells can use same frequency
Only at distance of D (known as frequency reuse distance) , the same frequency from the set can be reused.
When moving from one cell to another during an outgoing conversation , an automatic channel change occurs. This phenomenon is called handover
4
Regular repetition of frequencies in cells result in a clustering of cells
The size of cluster is defined by k, the number of cells in the cluster
This also defines the frequency reuse distance D
The following fig is an example of cluster size of 4
5
Cell clusters in GSM 6
GSM Architecture
Are structured in hierarchic fashion
Administrative region assigned to one MSC(mobile switching centre)
Administrative region is called PLMN i.e. Public Land Mobile Network
It is subdivided into one or many Location Area (LA).One LA consists of many cell groups
Each cell group is assigned to one BSC (base station controller)
Each LA there will be at least one BSC
Cells in one BSC can belong to different LA’s
Cells are formed by the radio areas covered by a BTS (Base Transceiver Station)
Several BTs are controlled by one BSC
Traffic from the MS is routed through MSC
7
GSM System hierarchy 8
Architecture of GSM9
All subscribers with cellular network operator , permanent data such
as the service profile is stored in the Home Location Register (HLR)
Authentication information like International Mobile Subscriber
Identity (IMSI)
Identification information like name, address etc of the subscriber
Operator selected denial of service to the subscriber
Billing information like prepaid or postpaid customer
10
Handling supplementary services like CFU (Call forwarding
Unconditional), CFB (Call Forwarding Busy), CFNR (Call Forwarding Not Reachable ), CFNR( Call Forwarding Not Reachable)or CFNA
(Call forwarding Not Answered)
Storage of SMS number in case the mobile not connectable so that
whenever the mobile is connectable , a paging signal is sent to the
SC
11
GSM entities12
GSM entities
The GSM technical specifications define different entities that form
the GSM network by defining their functions and interface requirements
Can be divided into five different groups:
The Mobile Station (MS): Includes the Mobile Equipment (ME) and
the Subscriber Identity Module(SIM)
The Base Station Subsystem (BSS) : includes the Base Transceiver
Station (BTS) and Base Station Controller (BSC)
13
The Network and Switching Subsystem (NSS) : it includes MSTN,
HLR,VLR, Equipment Identity Register (EIR) , Authentication Centre (AUC)
The Operation and Support Subsystem (OSS): includes the
operation and Maintenance Centre (OMC)
The data infrastructure: include PSTN, ISDN , PDN(Public Data
network)
14
Mobile Station
Technical name for mobile or the cellular phone
Earlier days , mobile phone were large in size and now they come in
smaller in size
It has two important components in it
The mobile equipment or device or phone without SIM
Subscriber Identity Module (SIM)
The weight and volume of the mobile phones are decreasing
Life of Battery charging is also increasing.
15
SIM is installed in every GSM phone, they are smart processor card
They have a processor and small amount of memory i.e 32K bytes
By inserting SIM card, user have access to all subscribed services.
It has International Mobile Subscriber identity used to identify the
subscriber to the system, a secret key for authentication and other
security information
Applications are developed and stored in SIM cards using SAT (Sim
Application Toolkit)
16
The base station subsystem
Connects the Mobile station and the NSS (Network and Switching
Subsystem)
Can be divided into two parts
The base transceiver station (BTS) or base station
The base station controller (BSC)
The base station corresponds to the transceivers and antennas used
in each cell of the network
Urban areas large number of BTS will be deployed
Usually placed in the centre of the cell
17
Its transmitting power defines the size of cell
Each BTS has one to 16 transceivers depending on the density of
users in a cell
BSC is the connection between the BTS and Mobile service
Switching Centre (MSC)
It manages the radio resources for one or more BTS
It handles handovers, radio-channels setup, control of radio
frequency power levels of BTSs, exchange function and frequency
hopping.
18
The network and switching
subsystem
The central component of the network subsystem is the Mobile Switching Center (MSC)
Functions are:
It acts like a normal switching node for mobile subscribers of the same network
Acts like a normal switching node for PSTN fixed telephone
Acts like a normal switching node for ISDN
Provides all the functionality needed to handle a mobile subscriber such as registration, authentication, location updating handovers and call routing.
It includes databases needed in order to store information to manage the mobility of a roaming subscriber.
19
The MSC with Home Location Register (HLR) and Visitor Location
Register (VLR) databases, provide the call routing and roaming capabilities of GSM
HLR stores the important information of subscribers belonging to the
covering area of a MSC
It contains all administrative information like current location of the
mobile, authentication data
HLR is always fixed an stored in the home network and VLR logically
moves with subscriber.
20
VLR considered as temporary copy of some important information
stored in HLR
VLR is similar to cache, HLR is persistent storage
It contains the selected administrative information borrowed from
HLR, necessary for control and provisioning of the subscribed
services.
When a subscriber enters a covering area of new MSC, the VLR
associated with this MSC will request information about the new
subscriber from its corresponding HLR in home network
21
Another component called (GMSC) Gateway MSC that is
associated with MSC
It is a gateway is node interconnecting two networks
The GMSC is the interface between the mobile cellular network and
the PSTN
It is in charge of routing calls from fixed network towards a GSM user
and vice versa
22
The operation and support
subsytem
It controls and monitors the GSM system
Is connected to different components of the NSS and to the BSC
Controls the traffic of load of the BSS
Provisioning information for different services is managed in this subsystem
Equipment Identity Register (EIR) is a database that contains a list all valid
mobile equipment's within the network, where each mobile station is
identified by its IMEI (international Mobile Equipment identity)
EIR consists a list of IMEI all valid terminals
23
An IMEI is marked invalid if it reported as stolen or not type
approved.
EIR allows the MSC to forbid the calls from the stolen or unauthorized
terminals.
Authentication Center(AUC) is responsible for authentication of
subscribers
It is a protected database and stores a copy of secret key stored in
each subscribers sim card
These data help in verifying the user’s identity
24
Message centre
Popular service provided by GSM is SMS i.e. Short Message Service.
Is a data service and allows a user to enter a text message upto 160
characters in length when 7-bit English characters are used
Is always ON network
Message center is also called as Service Center (SC) or SMS
controller
There are two types of SMS
SMMT
SMMO
25
26
SMMT- Short Message Mobile Terminal
Is an incoming short message from the network
Terminated in the MS
SMMO-Short Message Mobile Originated
Is an outgoing message
Originated at MS
Forwarded to network for delivery
27
Call routing in GSM
Human interface is analog
There are many complex technologies used between the human
analog interface in mobile and digital network
The following figure is sequence of operation from speech to radio
wave
28
29
Digitizer and source coding
User speech is digitized at 8 KHz sampling rate using Regular Pulse
Excited-Linear Predictive Coder (RFE-LPC) with a Long Term Predictor
loop
Here information from previous sample is used to predict the current
sample
Each sample is then represented in signed 13-bit linear PCM value
It is then passed to coder with frames of 160 samples
30
Channel coding
Introduces redundancy information into the data for error detection
Gross bit rate after channel coding is 22.8 kbps
456 bits are divided into eight 57-bit blocks, and result is interleaved
among eight successive time slots bursts for protection against burst
transmission.
Interleaving
Rearranges a group of bits in a particular way
Improves performance of the error correction mechanisms
Decreases possibility of whole bursts during the transmission
31
Ciphering
Encrypts block of user data using a symmetric key shared by the mobile station
and BTS
Burst formatting
Adds some binary information to the ciphered block
Is used for synchronization and equalization of the received data
Modulation
Technique chosen for the GSM system is Gaussian Minimum Shift Keying(GMSK)
The binary data is converted back into analog signal to fit the frequency and
time requirements for multiple access rules
32
Multipath and equalization
GSM frequency bands gets reflected from buildings, hills etc, so not only
the right signal received by an antenna but many reflected signals
which corrupt the information are also received
An equalizer is responsible for extracting the right signal from the
received signal
It estimates the channel impulse response of the GSM system and then
constructs an invers filter
33
Synchronization
For successful operation of a mobile, time and frequency
synchronization is needed.
Frequency synchronization is needed so that transmitter and receiver
frequency match
Time synchronization is necessary to identify the frame boundary and
bits within the frame
34
An example
Assume that a party called a GSM directory number +919845052534
The directory number dialled to reach a mobile subscriber is called the
Mobile Subscriber ISDN (MSISDN)
It includes country code and national destination code which indicated
subscriber’s operator
MSISDN number of subscriber in Bangalore associated with Airtel network is +919845XYYYYY
+ means the prefix for international dialling like 00 in UK / India or 011 in USA
35
91 is the country code for India
98 is the network operator code, here Airtel
X is the level number managed by the network operator ranging
from 0 to 9
YYYYY is the subscriber code managed by operator
36
Call routing for mobile terminating
call
37
Call first goes to local PSTN exchange
PSTN exchange looks at the routing table and determines that is a
call to mobile network
It forwards call to Gateway MSC of the mobile network
It decides whether to route this call or not
If the user has not paid the bills, the call may not be routed
If the phone is powered off then , a message may be played or call is
forwarded to voice mail
38
If MSC finds that the call can be processed, it will find out address of
the VLR where mobile is expected to be present
If the VLR is of different PLMN , it will forward the call to foreign PLMN
through gateway MSC
If VLR is in the home network, it will determine the location Area (LA)
Within the LA it will page and locate the phone and connect the
call
39
PLMN interfaces
Basic configuration of PLMN consists of a central HLR and central
VLR
Contains all security, provisioning and subscriber-related information
MSC needs subscriber parameter for successful call set-up
40
Configuration
of GSM PLMN
41
GSM addresses and identifiers
To manage all complex functions, GSM deals with many address and identifiers, they are
IMEI
IMSI
MSISDN
LAI
MSRN
TMSI
LMSI
Cell identifier
Identification of MSCs and location registers
42
International Mobile Station
Equipment Identity (IMEI)
Every mobile equipment in this world has a unique identifier, called as
IMEI
Allocated by the manufacturer and registered by the network operator
in Equipment Identity Register (EIR)
To see your IMEI number, type *#06# on the phone
43
International Mobile Subscriber
Identity (IMSI)
When registered with a GSM operator, each subscriber is assigned with
a unique identifier
IMSI is stored in SIM card and secured by the operator
A mobile station can operate only when it has a valid IMSI
There are several parts in IMSI, which are as follows
44
Three decimal digits of Mobile Country Code(MCC), for India it is 404
Two decimal digits of Mobile Network Code (MNC)
Uniquely identifies a mobile operator within a country
For airtel in Delhi it is 10
Maximum 10 digits of Mobile Subscriber Identification Number (MSIN)
This is unique number of the subscriber within a home network
45
Mobile Subscriber ISDN numbers
(MSISDN) Real telephone number that is known in this external world
It is public information where as IMEI is private information to a operator
The MSISDN categories follow the following international ISDN (Integrated
Systems Data Network) numbering plan as the following
Country Code (CC): one of three decimal digits of the country code
Eg: USA-1, India-91, Finland-358
National Destination Code (NDC) : typically 2 to 3 decimal digits
In India 94 for BSNL, 98 for all other operators
Subscriber Number (SN) : Maximum 10 decimal digits
Eight digit number, consist
Two decimal digits of operator code
Followed by one decimal digit level number
5 digit subscriber number
46
Location Area Identity (LAI)
Each LA in PLMN has its own identifier
It is unique
Consists three digits of CC, two digits of Mobile Network Code i.e.
MNC, maximum five digit of Location Area Code.
47
Mobile Station Roaming Number
(MSRN)
When a subscriber is roaming in another network, he is assigned with
a temporary ISDN number
This ISDN is used by the Local VLR in charge of the mobile station
48
Temporary Mobile Subscriber
Identity (TMSI)
Temporary identifier assigned by the serving VLR
Used in place of the IMSI for identification and addressing of the
mobile station
It is never stored in HLR
Difficult to determine the identity of subscriber by listening to the
radio channel
Stored in the SIM card
49
Location Mobile Subscriber Identity
(LMSI)
Assigned by the VLR and stored in the HLR
Used as searching key for faster database access in VLR
50
Cell identifier (CI)
Within a LA , every cell has unique cell identifier
Together with a Lai a cell can be identified uniquely through Global
Cell Identity
51
Identification of MSC and location
registers
MSC, HLR,VLR,SCs are addressed by ISDN numbers
They may have Signaling Point Code (SPC) within a PLMN
52
Network aspects in GSM
When a call is in progress and the user is on the move, there will be a
handover mechanism from one cell to another
Resembles to relay race, where one athlete passes the baton to
another
Roaming and handover are performed by NSS, mainly using the
Mobile Application Part (MAP) built on the Signalling System #7 (SS7)
protocol
The signalling protocol is GSM has three layers, shown in the
following figures
53
54
Layer 1 is the physical layer, which uses the channel structures over the air
interface
Layer 2 is data link layer, called LAPDm i.e. modified version of LAPD
protocol
Layer 3 is divided into three layers
Radio Resources Management
Controls set-up, maintenance, termination of radio and fixed channels including
handovers
Mobility management
Manages location updating and registration procedures such as security and
authentication
Connection Management
Handles general call control, manages supplementary services, SMS
55
Mobility management
Person travelling on train without GSM phone or wireless
communication device
If he wants to talk, how will he talk
If the train stops at a station for a long time, he can try to locate a
public call office in a station and make the call
He must finish the call before the train departs
There is no way any person can make a call when they want
56
Using MM , one can make outgoing calls and receive incoming calls while in motion
In wired network where device is stationary, the point of attachment to the
network is also fixed
Address of the device is sufficient to locate the device in routing table and
establish the connection
Incase of wireless devices, device moves from one location to another
making the old routing table invalid
Therefore establishing and maintaining a connection is complex
Paging, location updates, handover and roaming are performed to
provide mobility
57
Paging
For getting a call connected, a MS has to be traced, located and
then call connected
The MS is traced through a paging process within a location
Using the BSS signalling channel the paging message for an MS is
sent that includes the IMSI as the identifier of the MS
A single paging message across the MSC to BSS interface contains
information of the cells in which the page shall be broadcast
In paging the making a decision is difficult i.e which cell to start
paging from, this is because there is huge number of cells
58
If we cannot locate the mobile quickly, the call cannot be connected resulting the lost revenue
Eg: it can start from the centre of the network and keep searching each
and every cell for long time
Such global paging system is going to cost more and consume lot of time
To optimize the cost and response time, paging starts at location where the
MS was present last.
The location of MS is recorded in the HLR and updated through Location
Update
The MS is searched in these cells where it has the highest probability of
being present
59
Location update
Concerned with procedures that enable the network to know the
current location of powdered on MS so that mobile terminated call routing can be completed.
If the location of MS is not known, tracking the MS through the
paging costs in terms of radio and backbone SS7 signalling
bandwidth
To optimize this, location information is regularly updated within core
network
The presence and location information is kept up to date within VLR and HLR
60
Assume the MS is willing to communicate, the MS must be powered
off-on and attached to the network
If the MS is attached to the network , it must be located through the
paging before successful communication can take place for mobile
terminated calls and mobile terminated SMS
When MS is powered off, the HLR is updated with an explicit IMSI
detach which indicates that MS is not available and connection
cannot be established.
61
Handover
When the call is going on in a moving vehicle, the relationship
between the radio signals and user is dynamic
The user movements can make the user to move away from a
wireless tower, causing the radio signals to reduce and ultimately
break
The user has to be moved to another cell where the signal strength is
higher
Will result in changing the association of the resources to another
channel within the same cell or different cell altogether, this is called handover
62
Handover has to be made very fast without any disruption to the service to
the higher layer
In north America handover is called as “handoff”
A handover can be initiated by a mobile or network
A mobile initiated handover is based on radio subsystem criteria of Radio
Frequency (RF), quality of signal or distance from tower
Network initiated handover is associated by a mobile device is based on traffic
loading per cell, maintenance request etc
63
There are four different types of handover in the GSM system , which
involves transferring call in between
Channels in the same cell
Cells under the control of same BSC
Cells under the control of different BSC, but belonging to same MSC
Cells under the control of different MSC
The first two are called internal handovers [handled by BSC]and next
two are called external handovers [handled by MSC]
64
Handover procedure 65
Authentication and Security issues
during handover
GSM uses A3,A8 and A5 algorithms for security
A3 algorithm is used to authenticate the subscriber
A8 algorithm is used to generate Cipher key Kc
A5 algorithm is used to cipher everything that is transmitted over the
air that include both signal and traffic
When handover occurs necessary information is transmitted within
the system infrastructure to enable communication to proceed from
the old BSS to new BSS, synchronization process is resumed
The key remains unchanged at handover
66
Roaming
When handover happens between one network to another network
is called roaming
When a mobile is powered off , it performs an IMSI detach to say the
network that is no longer connected.
When a mobile station is turned on in a new network or the
subscriber moves to different operators PLMN , then the subscriber
must register with the new network to indicate its current location.
The first location update is called IMSI attach procedure where the
MS indicates its IMSI to the new network.
68
A location update is performed periodically
A location update message is sent to new MSC/VLR which records
the location area information and then sends this information to the
subscriber’s HLR
If the mobile station is authenticated and authorized in the new
MSC/VLR the subscriber’s HLR cancels the registration of the mobile
station with the old MSC/VLR
69
Two types of roaming
Horizontal Roaming
Roaming between two networks of the same family
GSM to GSM roaming
Vertical Roaming
Roaming between two networks of different families
When vertical roaming happens without any disruption it is called
seamless roaming.
GSM to CDMA, GPS to WIFI
70
GSM Frequency Allocation
GSM in general uses 900 MHz band
890-915 MHz are allocated for uplink i.e. MS to BS
935-960 MHz are allocated for downlink i.e. BS to MS
Mobile to Base
Ft(n)=890.2+0.2(n-1) MHz
Base to Mobile
Ft(n)=Fr(n)+45MHz
71
72
73
3 (tail) These tail bits at the start of the GSM burst give time for the
transmitter to ramp up its power
57 (data): This block of data is used to carry information, and most often contains the digitised voice data
1 (steal bit )is bit within the GSM burst indicates the type of data in the
previous field.
26 (Midamble): This training sequence is used as a timing reference and for equalisation.
1 (steal bit ) Again this flag indicates the type of data in the data field.
57 (data) Again, this block of data within the GSM burst is used for carrying
data.
3 (tail) These final bits within the GSM burst are used to enable the
transmitter power to ramp down. They are often called final tail bits, or just
tail bits.
8.25 (guard bits) At the end of the GSM burst there is a guard period. This is introduced to prevent transmitted bursts from different mobiles overlapping.
74
top related