Network Architecture

GSM Network Architecture

A GSM network is made up of multiple components and interfaces that facilitate sending and
receiving of signaling and traffic messages. It is a collection of transceivers, controllers,
switches, routers, and registers.
A Public Land Mobile etwork !PLM" is a network that is owned and operated b# one GSM
service provider or administration, which includes all of the components and e$uipment as
described below. %or e&ample, all of the e$uipment and network resources that is owned and
operated b# 'ingular is considered a PLM.
Mobile Station (MS)
(he Mobile Station !MS" is made up of two components)
Mobile Equipment (ME) (his refers to the ph#sical phone itself. (he phone must be able to
operate on a GSM network. *lder phones operated on a single band onl#. ewer phones are
dual+band, triple+band, and even $uad+band capable. A $uad+band phone has the technical
capabilit# to operate on an# GSM network worldwide.
,ach phone is uni$uel# identified b# the International Mobile Equipment Identity (IMEI)
number. (his number is burned into the phone b# the manufacturer. (he IM,I can usuall# be
found b# removing the batter# of the phone and reading the panel in the batter# well.
It is possible to change the IM,I on a phone to reflect a different IM,I. (his is known as IM,I
spoofing or IM,I cloning. (his is usuall# done on stolen phones. (he average user does not have
the technical abilit# to change a phone-s IM,I.
Subscriber Identity Module (SIM) + (he SIM is a small smart card that is inserted into the
phone and carries information specific to the subscriber, such as IMSI, TMSI, Ki !used for
encr#ption", Service Provider ame !SP", and Local Area Identity !LAI". (he SIM can also
store phone numbers !MSIS." dialed and received, the Kc !used for encr#ption", phone books,
and data for other applications. A SIM card can be removed from one phone, inserted into
another GSM capable phone and the subscriber will get the same service as alwa#s.
,ach SIM card is protected b# a /+digit Personal Identification umber !PI". In order to unlock
a card, the user must enter the PI. If a PI is entered incorrectl# three times in a row, the card
blocks itself and can not be used. It can onl# be unblocked with an 0+digit Personal 1nblocking
2e# !P12", which is also stored on the SIM card.
Base Transceiver Station (BTS)
Base ranscei!er Station (BS) + (he 3(S is the Mobile Station-s access point to the network.
It is responsible for carr#ing out radio communications between the network and the MS. It
handles speech encoding, encr#ption, multiple&ing !TDMA", and modulation4demodulation of
the radio signals. It is also capable of fre$uenc# hopping. A 3(S will have between 5 and 56
(ransceivers !(78", depending on the geograph# and user demand of an area. ,ach (78
represents one A7%'.
*ne 3(S usuall# covers a single 59: degree sector of an area. 1suall# a tower with ; 3(Ss will
accommodate all ;6: degrees around the tower. <owever, depending on geograph# and user
demand of an area, a cell ma# be divided up into one or two sectors, or a cell ma# be serviced b#
several 3(Ss with redundant sector coverage.
A 3(S is assigned a Cell Identity. (he cell identit# is 56+bit number !double octet" that identifies
that cell in a particular Location Area. (he cell identit# is part of the 'ell Global Identification
!'GI", which is discussed in the section about the =isitor Location 7egister !=L7".
120 Sector
(he interface between the MS and the 3(S is known as the Um Interface or the Air Interface.
Um Interface
Base Station Controller (BSC)
Base Station "ontroller (BS") + (he 3S' controls multiple 3(Ss. It handles allocation of radio
channels, fre$uenc# administration, power and signal measurements from the MS, and handovers
from one 3(S to another !if both 3(Ss are controlled b# the same 3S'". A 3S' also functions
as a >funneler>. It reduces the number of connections to the Mobile Switching Center !MS'" and
allows for higher capacit# connections to the MS'.
A 3S' m# be collocated with a 3(S or it ma# be geographicall# separate. It ma# even be
collocated with the Mobile Switching 'enter !MS'".
Base Station "ontroller
The interface between the BTS and the BSC is known as the Abis
Interface
Abis Interface
The Base Transceiver Station (BTS) and the Base Station Controller
(BSC) together make up the Base Station System (BSS).
Base Station System
Mobile Switcin! Center (MSC)
Mobile Switchin# "enter (MS") + (he MS' is the heart of the GSM network. It handles call
routing, call setup, and basic switching functions. An MS' handles multiple 3S's and also
interfaces with other MS'-s and registers. It also handles inter+3S' handoffs as well as
coordinates with other MS'-s for inter+MS' handoffs.
Mobile Switcin! Center
(he interface between the 3S' and the MS' is known as the A Interface
A Interface
"ateway Mobile Switcin! Center ("MSC)
(here is another important t#pe of MS', called a Gatewa# Mobile Switching 'enter !GMS'".
(he GMS' functions as a gatewa# between two networks. If a mobile subscriber wants to place
a call to a regular land line, then the call would have to go through a GMS' in order to switch to
the Public Switched (elephone etwork !PS(".
"ateway Mobile Switcin! Center
%or e&ample, if a subscriber on the 'ingular network wants to call a subscriber on a (+Mobile
network, the call would have to go through a GMS'.
Connections Between Two #etwor$s
(he interface between two Mobile Switching 'enters !MS'" is called the E Interface
% Interface
&ome 'ocation (e!ister (&'()
$ome %ocation &e#ister ($%&) + (he <L7 is a large database that permanentl# stores data
about subscribers. (he <L7 maintains subscriber+specific information such as the MSIS.,
IMSI, current location of the MS, roaming restrictions, and subscriber supplemental features.
(here is logicall# onl# one <L7 in an# given network, but generall# speaking each network has
multiple ph#sical <L7s spread out across its network.
)isitor 'ocation (e!ister ()'()
'isitor %ocation &e#ister ('%&) + (he =L7 is a database that contains a subset of the
information located on the <L7. It contains similar information as the <L7, but onl# for
subscribers currentl# in its Location Area. (here is a =L7 for ever# Location Area. (he =L7
reduces the overall number of $ueries to the <L7 and thus reduces network traffic. =L7s are
often identified b# the Location Area 'ode !LA'" for the area the# service.
)isitor 'ocation (e!ister
%ocation Area "ode (%A")
A LA' is a fi&ed+length code !two octets" that identifies a location area within the network. ,ach
Location Area is serviced b# a =L7, so we can think of a Location Area 'ode !LA'" being
assigned to a =L7.
%ocation Area Identity (%AI)
An LAI is a globall# uni$ue number that identifies the countr#, network provider, and LA' of
an# given Location Area, which coincides with a =L7. It is composed of the Mobile 'ountr#
'ode !M''", the Mobile etwork 'ode !M'", and the Location Area 'ode !LA'". (he M''
and the M' are the same numbers used when forming the IMSI.
Location Area Identit# !LAI"
"ell Global Identi(ication ("GI)
(he 'GI is a number that uni$uel# identifies a specific cell within its location area, network, and
countr#. (he 'GI is composed of the M'', M', LAI, and 'ell Identit# !'I"
Cell "lobal I*entity
(he =L7 also has one other ver# important function) the assignment of a (emporar# Mobile
Subscriber Identit# !(MSI". (MSIs are assigned b# the =L7 to a MS as it comes into its
Location Area. (MSIs are onl# allocated when in cipher mode.
(he interface between the MS' and the =L7 is known as the B Interface and the interface
between the =L7 and the <L7 is known as the D Interface. (he interface between two =L7s is
called the Interface
"SM Interfaces
%+,i-ment I*entity (e!ister (%I()
Equipment Identity &e#ister (EI&) + (he ,I7 is a database that keeps tracks of handsets on the
network using the IM,I. (here is onl# one ,I7 per network. It is composed of three lists. (he
white list, the gra# list, and the black list.
(he black list is a list if IM,Is that are to be denied service b# the network for some reason.
7easons include the IM,I being listed as stolen or cloned or if the handset is malfunctioning or
doesnt have the technical capabilities to operate on the network.
(he gra# list is a list of IM,Is that are to be monitored for suspicious activit#. (his could include
handsets that are behaving oddl# or not performing as the network e&pects it to.
(he white list is an unpopulated list. (hat means if an IM,I is not on the black list or on the gra#
list, then it is considered good and is >on the white list>.
(he interface between the MS' and the ,I7 is called the ! Interface.
%+,i-ment I*entity (e!ister
A,tentication Center (A,c)
Authentication "enter (Au") + (he Au' is responsible for generating the necessar# cr#pto
variables for authentication and encr#ption on the network. (hese variables are the 7A.,
S7,S, and 2c. (he Auc also stores the 2i for each IMSI on the network. Although it is not
re$uired, the Auc is normall# ph#sicall# collocated with the <L7.
A,tentication Center
(here is one last interface that we haven-t discussed. (he interface between the <L7 and a
GMS' is called the C Interface. ?ou will see it in the full network diagram below.(his
completes the introduction to the network architecture of a GSM network. 3elow #ou will find a
network diagram with all of the components as well as the names of all of the interfaces.
.,ll "SM #etwor$