GSM Architecture
GSM Architecture
GSM
GSM Architecture
Presented by
S. R. Gulhane, SDE RTTC Pune.
Marconi made economical use of EM theory by developing devices for wireless transmission of Morse signals (about 1885). After 6 years, the first transatlantic wireless transmission of Morse signal took place. Voice was transmitted for the first time in 1906 (R. Fess Eden), and the first radio broadcast transmission in 1909 in New York.
History
Economically most successful wireless application in the first half of the 20th century was Radio broadcast. There is one transmitter, the so called Radio station. Information, such as news, music etc. is transmitted from the radio station to the receiver equipment, the radio device. This type of one-way transmission is called Simplex transmission. Here the transmission takes place in one direction, from the transmitter to the receiver.
Mobile concepts
For telephony services, a technical solution is required, where subscribers have the impression, that they can speak (transmit) and hear (receive) simultaneously. This type of solution is regarded as full- duplex transmission.
Mobile Phone
1946 :The first car mounted radio telephone
Mobile Phone
1946 : The first commercial mobile radio-telephone service by Bell Lab in Saint Louis, Missouri (USA). Half duplex, 120KHz/Chl, 50 miles coverage, operator assisted. It was a car phone service, the mobile phone equipment was bulky and heavy. But it was real full duplex solution.
Mobile Phone
In the 50s, several vehicle radio systems were also installed in Europe. These systems are now a days called Single cell system. The user data transmission takes place between the mobile phone and the base station (BS). A base station transmit and receive data and handle the calls of several subscribers simultaneously.
Going further
1960 IMPS( Improved mobile phone system) by Bell and AT&T, direct dial, 30 KHz/Chl. 1976 First handheld cellular phone (Motorola) Multiplicity of Mobile systems thereafter.
Generation Gap
Many Different Standards:
o o o o o o
Mobile Generation-1
AMPS (US) NMT (Northern Europe) TACS (Europe) NTT (Japan) C-450 ( W-Germany) many others... around 800 and 900 MHz.
Spectrum
o
Generation Gap
Mobile Generation-1
Analog [mainly for voice] All systems are incompatible No international roaming Little capacity cannot accommodate masses of subscribers Security problems
Mobile Generation-1
All of them launched in the 80s of the last century. Support Voice communication. Offered national wide coverage. Limitations: Most of them did not support international roaming. No support to data transmission. No Supplementary services (like ISDN), such as number indication and call forwarding, when busy. Unprotected transmission over the radio interface. Heavy Cost.
Mobile Generation-1
Mobile communication started to become a mass market. And the radio interface is the main bottleneck in terms of capacity. Improved solution was urgently required.
This lead to the launch of the second generation mobile communication systems, one of which is GSM.
Generation Gap
Mobile Generation-2
Digital [voice encoding] Increased capacity More security ( by encryption) Compatibility/Flexibility Can use TDMA or CDMA for increasing capacity
Generation Gap
Mobile Generation-2
Four Major Standards:
GSM IS-54 JDC IS-95 (European, now Global) (Later becomes IS-136, US) (Japanese Digital Cellular, now PDC) (CDMA, US)
GSM History
1982 : CEPT GSM (Group Special Mobile) was created to study and develop a Pan-European Mobile system to replace first generation (analogue) cellular technology in Europe. The Purpose: o Good subjective speech quality o Efficient use of available spectrum o Low terminal and network equipment costs o Support of international roaming o Integration of various bearer, supplementary and tele-services in a single mobile network 1989 : GSM work was transferred to the ETSI. 1990 : Phase I of GSM specifications published.
GSM History
All GSM networks and equipment conform to a defined GSM standard issued by ETSI. Due to great International demand the system name changed to Global Systems for Mobile Communications (still GSM). 1991 : Commercial service started . 1992 : First paying customers were signed up for service.
GSM History
1992 : Worlds first GSM network launched in Finland. The first roaming agreement was made. By Dec-92 there were 13 networks operating in 7 areas. Australian operators were the first non- European signatories of the GSM MoU. New frequency allocation for GSM 1800 (DCS 1800) 1710-1785 MHz (uplink) & 1805-1880 MHz (downlink). 1993 : GSM demonstrated for first time in Africa at Telkom.
GSM History
1993 : 36 GSM networks in 22 countries. 1994 : The first GSM network in Africa was launched in South Africa. 1994 : 1.3 million subscribers worldwide. 1995 : There were 117 GSM networks. Fax, data, and SMS roaming was implemented. The GSM phase-2 standardization was completed, for GSM 1900 (PCS1900). 1996 : There were 120 networks operating. 1996 : 25 million subscribers worldwide. 1997 : 55 million subscribers worldwide
GSM History
At present more than 800 million end users in 190 countries and representing over 60% of today's digital wireless market.
source: GSM Association
Mobile Communication
Subscriber Line (2W) Inter-Exchange Junction
BSC
BTS MS
Telephone Exchange
890MHz
915MHz
935MHz
960MHz
124
124
Mobile concepts
Transmission of user data from base station to the mobile phone is called downlink (DL). Transmission from mobile phone to base station is called uplink (UL).
The area, where the wireless transmission between mobile phone to the base station can take place, is the base station supply area, called a Cell.
GSM
GSM comes in three flavors : GSM-900, 1800 and 1900 MHz. BSNL used 900 and 1800 MHz. Voice is digitized using Full-Rate coding. 20 ms sample => 260 bits . 13 Kbps bitrate
Mobile Problems
Radio range, or coverage. No. of channels, or voice circuits. Full, seamless service coverage. Huge number of subscribers.( Millions)
A Radio Cell
Voice Channels
Lines to BSC
Or control channels
MS
Cellular Concept
A base station (transmitter) having a number of RF channels is called a cell. Each cell covers a a limited number of mobile subscribers within the cell boundaries. (Coverage area). Typical Cell Radius :
Approx = 30 Km (Start up), 1 KM (Mature).
Mobile concepts
Single cell system are quite limited. The more and more distant the subscriber is from the base station, the lower the quality of the radio link. If the subscriber is leaving the cell, no communication is possible any more. In order to over come this limitation, cellular systems were introduced.
Mobile concepts
A cellular mobile system consists of several cells, which can overlap so as to cover whole geographical area.
While moving if the subscriber is leaving a cell and enters into a new cell, the system makes new radio resources available in that cell, the call is handed over from one cell to this one. The process is known as handover. A hand over takes place during a call i.e. when a mobile in active mode.
Mobile concepts
In the idle mode of mobile, the mobile is switched on, but no resources are allocated to it to allow user data transmission, and the mobile phone is still listening the information, broadcast by the base station.
Why? Imagine, there is a mobile terminated call. The mobile phone is then paged in the cell. This means the phone receive information that there is a mobile terminated call.
Mobile concepts
A cellular system may consists of hundreds of cell. If the mobile network does not know, in which cell the mobile phone is located, it must be paged in all of them. To reduce load on networks, paging is done in small parts of mobile an operators network. Mobile network operators group cells in administrative units called location areas (LA). A mobile phone is paged in only one direction area.
Mobile concepts
But How does the cellular system know, in which location area the mobile phone is located? In every cell, system information is continuously transmitted. System information includes the location area information. In the idle mode, the mobile phone is listening to this system information. If the subscriber moves hereby from one cell to the next cell, and the new cell belongs to the same location area, the mobile stays idle.
Mobile concepts
If the new cell belongs to a new location area, then the mobile phone has to become active. It starts a communication with the network informing it about it new location. This is stored in database with in the mobile network, and if there is a mobile terminated call, the network knows where to page the subscriber.
The process, where the mobile phones informs the network about its new location is called Location Update Procedure (LUP).
GSM SYSTEM
Frequency of Operation: Up link : 890-915 MHz (MS- BTS)
Down link : 935-960 MHz (BTS- MS)
Access Method : FDMA & TDMA Duplexing Method : FDD RF CHL spacing : 200 KHz Duplex Separation : 45 MHz Modulation : GMSK Coverage: 5 km to 35 km radius. Voice coding : 6.5/13 Kbps RPE-LTP
Sharing
GSM uses TDMA and FDMA to let everybody talk. FDMA: 25MHz freq. is divided into 124 carrier frequencies. Each base station gets few of those. TDMA: Each carrier frequency is divided into bursts [0.577 ms]. 8 bursts are a frame.
Mobile to Base
(MHz)
Base to Mobile
935.4
890.2
890.4
890.6
935.2
935.6
200 kHz
45MHz Channel layout and frequency bands of operation
200 kHz
Amplitude
45 MHz
7 8 5 6 2 1 3 4 2 1 3 4 5 6
7 8
Frequency
F1 (Cell Rx)
F2
F2 F1 (Cell transmit)
FDMA/TDMA Scheme
TIME
BP2 BP1 BP8 BP7 BP6 BP5 BP4 BP3 BP2 BP1 890.2 890.6 891.0 890. 890.4 890.8 891.2 0
BURST
F
R A M E FREQ MHz 915.8
GSM Channels
The physical channel in GSM is the timeslot. The logical channel is the information that goes through the physical channel. Both user data and signaling are logical channels.
GSM Channels..
User data is carried on the traffic channel (TCH) , which is defined as 26 TDMA frames. There are lots of control channels for signaling, base station to mobile, mobile to base station.
GSM RF Channels
LOGICAL CHANNELS
USER INFORMATION( TRAFFIC) SIGNALLING INFORMATION (CONTROL)
OPERATIONAL CONCEPTS
Subscribers are not allocated dedicated channels. TCH Allocated to users only when needed. Hence IDLE MODE & DEDICATED MODE. DEDICATED MODE : When a full Bi directional P to P CHL has been allocated during an established call. IDLE MODE MODE : When MS is powered on (active)without being in dedicated mode.
Coding
Different mobile communication systems use different bit rates for voice encoding. The following table gives a glimpse.
S/N Technology Bit rate per voice chl Voice coding technique
1
2
GSM
CDMA IS95A
13Kbps
9.6Kbps/14.4 Kbps 32Kbps
RPE-LTP
QCELP/EV RC
Cor-DECT
ADPCM
Rake Receiver
The rake receiver is multiple receivers in one. There is a rake receiver at both the mobile and BTS.
2.
Interface : known as air interface or radio link. Abis Interface: between BTS and BSC A Interface: between BSC and MSC Other E-1 interfaces namely B, C, D, E, F, G
I I MSC VLR
II MSC VLR
MSC
MSC II I IV
VLR
65
LA4
LA6
LA5
66
GSM : Cells
LA4
C1 C2 LA6
C3
LA5
C6 C5
C4 C=CELL
67
CellArea Location Area served by a BTS Location Area MSC Service Area PLMN Service Area GSM Service Area
68
GSM : IMSI
International mobile subscribers Identity
The IMSI is an unique identity which is used internationally and used within the network to identify the mobile subscribers. The IMSI is stored on the subscriber identity module (SIM), the HLR, VLR and AC database.
75
GSM Architecture
G
VLR
Other MSC VLR
Um
BTS
MS
Abis A
BSC
B D C
GMSC HLR AUC
BTS
Abis
BSS Other MSC
F E
Other Networks (PSTN,PSPDN)
EIR
OMC Server
GSM Architecture
PSDN
BSC BTS BSC HLR SMS-SC BSC
PLMN
MSC/VLR BSC
MSC/VLR
Tandem CO
PSTN
Tandem CO
CO
MSC Mobile Switching Center VLR Visitor Location Register HLR Home Location Register
BS
PSTN
GSM Architecture
Mobile phone is identified by SIM card. Key feature of the GSM Has the secret for authentication
GSM Architecture..
BTS houses the radiotransceivers of the cell and handles the radio-link protocols with the mobile BSC manages radio resources (channel setup, handover) for one or more BTSs
GSM Architecture..
MSC Mobile Switching Center The central component of the network Like a telephony switch plus everything for a mobile subscriber: registration, authentication, handovers, call routing, connection to fixed networks. Each switch handles hundreds of cells
GSM Architecture..
HLR database of all users + current location. One per network VLR database of users + roamers in some geographic area. Caches the HLR EIR database of valid equipment AuC Database of users secret keys
Removable plastic card Stores Network Specific Data such as list of carrier frequencies and current LAI. Stores International Mobile Subscriber Identity (IMSI) + ISDN Stores Personal Identification Number (PIN) & Authentication Keys. Also stores short messages, charging information, telephone book etc. Allows separation of user mobility from equipment mobility
87
MSC/VLR
BSC
BSC
BSC
RSS
n BTS
n BTS
89
91
BTS
Consists of high speed transmitter and receiver Houses the radio transceivers of the cell and handles the radio-link protocols with the M.S. One per cell Function of BTS : Provides two channels : Signalling and Data Channel Performs error protection coding for the radio channel
FUNCTION OF BTS..
Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna. ( ie. functionality required to support traffic transmission
over the radio link e.g. channel coding, speech coding, encryption, RF modulation)
Transcoding and rate adaption Functionality. Time and frequency synchronization signals transmission. Frequency hopping. Random access detection. Uplink radio channel measurements.
93
FUNCTIONS OF BSC
Controls a group of BTS and offloads MSC by controlling the communication between the BTSs & a single MSC. Radio resource management for one or more BTSs. Primarily responsible for Inter-cell handover in same BSS. Handles such as : Channel setup, Freq.hopping/ Reallocation of frequencies. Controls the Power levels of BTSs. BSC performs call processing. Data from OMC and can be down loaded to BSC.
95
MSC Functions
MSC does gateway function while its customers roams to other network by using HLR. Paging, specifically call handling Location updation. Handover management. Billing for all subscribers based in its area. Reallocation of frequencies to BTSs in its area to meet heavy demands.
98
MSC Functions
Echo canceller operation control. Signaling interface to databases like HLR, VLR. Gateway to SMS between SMS centers and subscribers. Handle interworking function while working as GMSC. (provides connectivity to other N/Ws)
99
Request routing information from the HLR and routes the connection to the local MSC
HLR...
The subscribers entry (identified by their IMSI) in their home HLR contains important information such as their current location in the GSM network and the services which the subscriber can access Reference store for subscribers parameters, numbers, authentication & Encryption values. Current subscriber status and associated VLR. Both VLR and HLR can be implemented in the same equipment in an MSC. one PLMN may contain one or several HLR.(i.e. GSM service provider can have several HLRs)
102
HLR
Permanent data in HLR
Data stored is changed only by man-machine IMSI, MS-ISDN number. Category of MS ( whether pay phone or not ) Roaming restriction ( allowed or not ). Supplementary services like call forwarding
103
HLR
Temporary data in HLR
The data changes from call to call & is dynamic MSRN RAND /SRES and Kc VLR address , MSC address. Messages waiting data used for SMS
104
VLR
Responsible for a group of location areas, typically associated with an MSC
It controls those mobiles roaming in its area. VLR reduces the number of queries to HLR One VLR may be incharge of one or more LA. VLR is updated by HLR on entry of MS its area. VLR assigns TMSI which keeps on changing. IMSI detach and attach operation
107
Data in VLR
IMSI & TMSI MSISDN MSRN. Location Area Supplementary service parameters MS category Authentication Key
108
Authentication Centre
Accessed by HLR to authenticate a user for service .
In particular, it contains information, known as a key, (for authentication and encryption) which is used to authenticate the identity of a SIM when an attempt is made by the SIM to access the network The same information is also involved in the process by which the digital radio transmissions to/from a mobile can be encrypted .
110
Security Parameters
Authentication
MS
Ki RAND
A3
SRES
MS BTS AuC
Authentication center provides RAND to Mobile AuC generates SRES using Ki of subscriber and RAND Mobile generates SRES using Ki and RAND Mobile transmits SRES to BTS BTS compares received SRES with one generated by AuC
Security Parameters
Ciphering
MS
Ki RAND
A8
Kc MS Kc
Data sent on air interface ciphered for security A5 and A8 algorithms used to cipher data Ciphering Key is never transmitted on air
Data
A5
A5
The IMEI is an unique code allocated to each mobile equipment. . It is checked in the EIR. MSC asks mobile to send it IMEI & then checks it with data available in EIR. EIR has different classification for mobile handsets like, White list, Grey list & Black list. According to category the MS can make calls or can be stopped from making calls.
December 9, 2013 GSM : Communicate on Move ... 113
EIR
This data base stores IMEI for all registered mobile equipments and is unique to every ME Databases to track handsets using the IMEI.. Only one EIR per PLMN. White list : IMEI, assigned to valid ME. Black list : IMEI reported stolen Gray list : IMEI having problems like faulty software, wrong make of equipment etc.
115
OMC monitors health of all n/w elements & carry out mnte. operations, if required. OMC link to BTSs are via parent BSC. OMC keeps records of all the faults occurred. OMC can also do Traffic analysis. OMC may prepares MIS Report for the n/w.
Configuration/supervision management.
Functions of OMC
O&M data function Configuration management . Fault report and alarm handling. Performance supervision/management. Storage of system software and data. Support GUI for operation and Maintenance.
118
In Summary . AuC/EIR/OSS
AuC: Authentication Center
Accessed by HLR to authenticate a user for service Contains authentication and encryption keys for subscribers
EIR: Equipment Identity Register allows stolen or fraudulent mobile stations to be identified
Operation Subsystem (OSS): Operations and maintenance center (OMC), network management center (NMC), and administration center (ADC) work together to monitor, control, maintain, and manage the network
It has database for all the VMS subscribers & also stores voice messages for them.
Short Message Service Centre : To provide text message service.
December 9, 2013 GSM : Communicate on Move ... 120
121
Conclusion
Wireless means convenience. However to achieve this certain measures are taken to overcome the Security issues , bandwidth scarcity, population and multipath problems etc. GSM is a 2G-digital cellular technology. Still not a single global standard. MS to BS bearer rates are still very slow for non-voice services.