Base Station Controller - An Overview - ScienceDirect Topics
Base Station Controller - An Overview - ScienceDirect Topics
Related terms:
The BSC application, i.e. the protocol handlers for GSM signalling traffic, is
specified in SDL and automatically implemented using proprietary code generation
tools. The BSC internal communication is built with a proprietary middleware that
offers transparent and absolute addressing of SDL process instances.
Measurements at the current BSC show that major parts of the performance is
“lost” for the transparent message transfer for SDL-processes and system calls (see
Table 2). This underlines the need for performance evaluation techniques that
integrate these aspects. New features of the GSM system will be implemented
using the standard tool SDT [15]. This is important since we use this existing tool
chain for our examination.
Table 2. Typical percentage of processor load for common and cell workstations
within a BSC cluster at the same external traffic demand
Radio Side
(CEWS) Net Side (COWS)
We have specified the GSM protocol standards for the Base Station Controller by
use cases with approximately 100 Message Sequence Charts.
Figure 5.20.
As previously discussed, the backhaul for the legacy BTS for 2G is TDM using
E1/T1 transport. The TDM links are terminated at the BSC, which connects
through to the core using TDM over SDH.
The new generation Node Bs for 3G rely on ATM encapsulation, still over E1/T1
transmission. For the 3G transmission, ATM switches were required to terminate
and aggregate the connection to the RNC. Likewise, ATM was used from the RNC
to the core mobile network over the SDH transmission. Remember that the 3GPP
evolution sought to reduce new infrastructure investment as much as possible;
hence, the SDH transmission into the MGW in the core network remained.
Figure 5.21 shows the extension of MPLS to the network edge. The Node B sites
can be connected at strategically located aggregation sites to optimize the backhaul
without placing IP transport equipment at every base station site.
Figure 5.21.
Multiple Node Bs are transporting over traditional E1/T1 TDM links to the pre-
aggregation site, which connects to the MPLS network.
Given that the capability for transporting the mobile access over IP/MPLS was now
in place, providers realized the potential for further savings. The QoS requirements
for the voice, signaling, and data were vastly different, giving an opportunity to use
more cost-effective transport options for the less important traffic.
The voice and signaling traffic is very sensitive to any packets loss, delay, or jitter. If
received traffic strays outside the strict parameters, user experience can be severely
impacted. Effectively all of the traffic in these categories can be considered as
requiring the highest possible forwarding priority.
The data traffic, however, is generally of much lower priority. Some of the traffic
may be video, which has similar requirements to the voice and signaling; however,
the vast majority of data is not sensitive to delay, loss, and jitter parameters. As
such, sending this traffic over more cost-effective transport could greatly reduce
transmission costs for the provider while still meeting customer expectations.
Vendors implementing the Node B and RNC have standard PVC mappings for the
signaling, voice, and data, making separation technically possible by mapping to
the VC/VP identifiers. The ATM interfacing device simply needs to route a given
VC/VP over the alternative transport paths based on the vendors’ mapping
standards.
The data path can utilize standard broadband access types such as metro Ethernet
or xDSL to provide a cost-effective, high capacity channel for the less sensitive
traffic traversing the access layer. If video is a data service implemented by the
provider, this traffic can be sent through the data path with higher priority to other
traffic. If the data path does not support the necessary QoS for the video traffic, the
provider can choose to forward the video over the voice and signaling path to
ensure that QoS parameters are met. See Figure 5.22.
Figure 5.22.
2.1.1 GSM
At first, GSM was designed as a circuit-switched system in a similar way to fixed-
line phone networks that establish between two users an exclusive and direct
connection on every interface [3]. The GSM chooses a combination of FDMA
(Frequency Division Multiple Access) and TDMA (Time Division Multiple Access) to
divide the bandwidth in order to exploit the limited radio spectrum resource
shared by all users. The GSM architecture consists of four basic components [1]:
• The Mobile Station (MS) consists of the terminal equipment and the Subscriber
Identity Module (SIM).
• The Base Station Subsystem (BSS) handles the radio access functions and
includes the Base Transceiver System (BTS) and the Base Station Controller
(BSC).
• The Network and Switching Subsystem (NSS) is also called the core network,
which includes all nodes and functionalities that are necessary for control and
switching of calls between different mobile and fixed switching centers and
other networks, for subscriber management and mobility management. NSS
consists of MSC, which represents a central element responsible for all
processing of voice and data communications, the HLR that contains all
subscription details of each subscriber registered in the network, the VLR that
contains similar information to the HLR, but on a temporary basis for every
active mobile.
• The Operation Sub-System (OSS) contains all the functions necessary for
network operation and maintenance. It facilitates the operations of MSCs. The
OSS entities are: the authentication center (AuC), which is responsible for the
authentication process and security purposes (Sauter, 2011 [3]); and the
Operation and Maintenance Center (OMC) which monitors and controls all
other GSM network entities (traffic monitoring, status reports of the network
entities, subscribers and security management, accounting and billing, among
others).
Messaging and multimedia services, including SMS Telephony via Internet (Voice
services over Internet Protocol–VoIP)
Figure 10.1. Common components of mobile networks (Gibbs & Clark, 2001).
The wireless portion of mobile networks uses Time Division Multiple Access
(TDMA) or Code Division Multiple Access (CDMA) technology to transfer data via
radio frequency. Fundamentally, CDMA is a spread-spectrum technology to enable
data from multiple devices to be multiplexed on a single physical channel, whereas
TDMA breaks the transmission signal into discrete timeslots for each device.
TDMA is digital transmission technology that allows a number of users to access a
single radio-frequency (RF) channel without interference by allocating unique time
slots to each user within each channel. The TDMA digital transmission scheme
multiplexes three signals over a single channel. The current TDMA standard for
cellular divides a single channel into six time slots, with each signal using two slots,
providing a 3 to 1 gain in capacity over advanced mobile-phone service (AMPS).
Each caller is assigned a specific time slot for transmission. (IEC, 2007)
All the mobile network components in Figure 10.1 can be important in a digital
investigation. Mobile devices connect to a base station (a.k.a. Base Transceiver
Station) over a radio link using TDMA or CDMA technology. Each base station has
at least one radio transceiver that provides radio coverage of a specific geographical
region (a.k.a. cell).
Some mobile network technologies (including GSM but not IS-136) use base
station controllers (BSC/CBSC) to control communication between base stations.
For instance, the BSC coordinates the transfer of a device from one base station to
another, enabling continuity of communication as a mobile device moves to
different places within a given Location Area.1 The wireless portion of mobile
networks connect to a switching system, typically including a Mobile Switching
Center (MSC), to perform call processing within the system and connect to other
wireless networks and land lines. For instance, the MSC delivers call and SMS
messages to mobile devices in its jurisdiction, and coordinates handovers of
ongoing communications as a mobile device moves between Location Areas.
Because MSCs are the crux of communications between base stations and the core
network, they generate a wealth of information about mobile network activities that
can support digital investigations, including usage logs and charging detail
records. Furthermore, all mobile devices that are currently being handled by a
given MSC are listed in a Visitor Location Register (VLR) database associated with
that MSC.
In addition to MSCs, mobile networks have systems called the Interworking
Functions (IWF) that operate as a gateway to external data network like the Internet.
An IWF is “essentially a bank of modems (ISDN, analog, etc.) and equipment to
perform, if necessary, protocol conversions to connect the MSC to other data
networks” (Gibbs & Clark, 2001).
Information about the individual subscriber, their billing details, and services they
can use on the mobile network is contained in the Home Location Register (HLR)
of their NSP. The current location of a given mobile device is also stored in the
HLR. The HLR also contains the subscriber's encryption keys and supports billing.
Information in the HLR is also used by an Authentication Center (AuC), which
restricts access to the network and services to authorized subscribers, to provide
security and prevent fraud.
At the heart of a mobile network, NSPs have one or more centers of operation to
maintain and monitor their systems. These centers of operation provide access to
data for billing or investigative purposes, and support interception of mobile traffic.
There are other service-specific systems in the core network that may contain data
of relevance to an investigation. For instance, text messages are processed by a
Short Message Service Center (SMSC). Although an SMSC may only retain
messages for a short period, it can be a fruitful source of evidence depending on
the policy of the operator. Voicemail stored on the provider network can be another
useful source of evidence.
NSPs may also maintain additional information about activities relating to mobile
devices and subscribers, including a blacklist of devices in their Equipment Identity
Register (EIR) that have been reported stolen or have been flagged as bad for some
other reason.
Another important aspect of mobile networks is the Signaling System 7 (SS7). This
system provides the control link needed to support call establishment, routing, and
information-exchange functions. For instance, SMS text messages can be
transmitted over this link, thus providing communication services even when a call
is not established. Investigators should be aware of SS7 because it releases
information that is very useful as a correlation point.
Another number useful to obtain is the International Mobile Equipment Identifier
(IMEI), which is a unique number associated with a particular device. The IMEI
allows digital investigators to obtain valuable digital evidence associated with a
particular mobile device even if a subject uses different NSPs or accounts with the
same device. In addition to obtaining stored data from NSPs, digital investigators
can use the IMEI to monitor telephone traffic associated with a particular device,
obtaining voice communication, attempted calls, SMS, MMS, and video calls.
The packet core network for GSM/GPRS and WCDMA/HSPA forms the basis for the
evolution towards EPC. As a result, it is worthwhile taking the time for a brief
review of the technology. Again, do not be put off by the number of acronyms.
Parts II and III provide more details.
The packet core architecture was designed around a tunneling protocol named
GTP (GPRS Tunneling Protocol) developed within ETSI and then continued within
3GPP after its creation. GTP is a fundamental part of 3GPP packet core, running
between the two core network entities, the SGSN and the GGSN. GTP runs over IP
and provides mobility, Quality of Service (QoS), and policy control within the
protocol itself. As GTP was created for use by the mobile community, it has
inherent properties that make it suitable for robust and time-critical systems such
as mobile networks. Since GTP is developed and maintained within 3GPP, it also
readily facilitates the addition of the special requirements of a 3GPP network such
as the use of the Protocol Configuration Option (PCO) field between the terminal
and the core network. PCO carries special information between the terminal and
the core network, allowing for flexible, efficient running and management of the
mobile networks.
GTP has from time to time faced criticism, however, from parts of the
communication industry outside 3GPP. This has mainly been due to the fact that it
was not developed in the IETF community, the traditional forum for
standardization of Internet and IP technologies. GTP is instead a unique solution
for 3GPP packet data services and was therefore not automatically a good choice
for other access technologies. GTP was instead tailor-made to suit the needs of
3GPP mobile networks. Whether the criticism is justified or not is largely
dependent on the viewpoint of the individual.
Regardless, GTP is today a globally deployed protocol for 3GPP packet access
technologies such as HSPA, which has emerged as the leading mobile broadband
access technology deployed prior to LTE. Due to the number of subscribers using
GSM and WCDMA packet data networks, now numbering billions in total for both
circuit- and packet-switched systems, GTP has been proven to scale very well and
to fulfill the purposes for which it has been designed.
Another significant aspect of GPRS is that it uses SS7-based signaling protocols
such as MAP (Mobile Application Part) and CAP (CAMEL Application Part), both
inherited from the circuit-switched core network. MAP is used for user data
management and authentication and authorization procedures, and CAP is used
for CAMEL-based online charging purposes. Further details on CAMEL
(Customized Applications for Mobile networks Enhanced Logic) are beyond the
scope of this book. For our purposes, it is enough to understand that CAMEL is a
concept designed to develop non-IP-based services in mobile networks. The use of
SS7-based protocols can be seen as a drawback for a packet network created for
delivering Internet connections and IP-based services.
The 3GPP packet core uses a network-based mobility scheme for handling user and
terminal mobility, relying on mechanisms in the network to track movements of
end-user devices and to handle mobility. Another aspect that was to become a
target for optimization at a later date was the fact that it has two entities (i.e. SGSN
and GGSN) through which user data traffic is carried. With the increased data
volumes experienced as a result of WCDMA/HSPA, an optimization became
necessary and was addressed in 3GPP Release 7, completed in early 2007 with the
enhancement of the packet core architecture to support a mode of operation
known as “direct tunnel” where the SGSN is not used for the user plane traffic.
Instead, the radio network controller connects directly to the GGSN via the Iu-user
plane (based on GTP). This solution, however, only applies to non-roaming cases,
and also requires packet data charging functions to reside in the GGSN instead of
the SGSN.
For further details on the packet core domain prior to SAE/EPC, please refer to
3GPP Technical Specification TS 23.060 (see References section for full details).
Recommended publications:
Wireless Networking
Book • 2008