GSM NETWORK ARCHITECHTURE

The Main Cellular Standard

Frequencies for Major Mobile Standards

Frequency Specifications of GSM Systems

GSM Network Architecture

GSM Geographical Network Structure

Cell:

Basic unit of a cellular system Defined as the area of radio coverage Is assigned unique number called Cell Global Identity (CGI)

GSM Geographical Network Structure

Location Area (LA)

Is defined as a group of cells Within the network, a subscribers location is linked to the LA in which it is currently located The identity of a LA (LAI) is store in the VLR When the MS crosses the boundary between to cells belongs to different LA, it must report its new location area to the network

GSM Geographical Network Structure

MSC service Area

An MSC service area is made up of a number of LA Represents the geographical part of the network controlled by one MSC

GSM Geographical Network Structure

PLMN Service Area

Entire set of cells served by one network operator There may be several PLMN service area, one for each mobile operator

GSM Geographical Network Structure

GSM service area

Entire geographical area in which a subscriber can gain access to GSM network GSM service area increases as more operators signs contract agreeing to work together

International roaming is the term applied when an MS moves from one PLMN to another when abroad

GSM Network Architecture

GSM Network Components

GSM Subsystems

GSM system is composed of

Mobile station: Mobile equipment, including SIM card Base station subsystem (BSS): including Base Station (BTS, BS) and Base Station Controller (BSC) Network Subsystem (NSS): being responsible for call routing Operation Subsystem (OSS/NMS): being responsible for network management

GSM Subsystems

Mobile Station

Mobile Station

Mobile equipment:

The cellular telephone or the vehicular telephone Address / identifier IMEI (international Mobile Equipment Identity) Fixed installed chip (plug-in SIM) or exchangeable card (SIM card) Address / identifier:

Subscriber Identity Module (SIM)

IMSI (International Mobile Subscriber Identity) MSISDN (Mobile Subscriber ISDN number >> the telephone number) TSMI (Temporary Mobile Subscriber Identity) MSRN (Mobile Station Roaming Number)

Mobile Station
Mobile Equipment Structure

Mobile termination functions

Radio interface (Tx, Rx, Signaling)

Terminal equipment functions

User interface (microphone, speaker, keypad) Function specific of services (fax, messaging, phone, etc.) Independent of GSM

Terminal adaptor functions

Mobile Station
Functions

Transmission and receipt Measurements

Used in making decision about signal strength and handovers Discontinuous transmission & reception

Power saving functions

Mobile Station
Classes

Mobile Station
IMEI

Uniquely identifies the mobile equipment 15 digits hierarchical address Assigned to ME during manufacturing and type approval testing

Type approval procedure: guarantees that the MS meets a minimum standard, regardless of the manufacturer
http://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity

IMEI structure:

Mobile Station
IMEI

Example

Check IMEI: *#06#

Mobile Station
IMEI

Mobile Station
IMEI Management

Protection against stolen and malfunctioning terminals Equipment Identity Register (EIR): 1 Database for each operator; keeps:

WHITE list:

Valid IMEIs Corresponding MEs may be used in GSM network IMEIs of all MEs that must be barred from using the GSM network Exception: emergency calls (to a set of emergency numbers) Black list periodically exchanged among different operators IMEIs that correspond to MEs that can be used, but that, for some reason (malfunctioning, obsolete SW, evaluation terminals, etc), need to be tracked by the operator A call from a gray IMEI is reported to the operator personnel

BLACK list:

GRAY LIST:

Mobile Station
SIM Card

Subscriber Identification Module (SIM)

Smartcard single chip computer, containing OS, file system, applications Owned by operator

Mobile Station
SIM Card

Mobile Station
SIM Card

Store user addresses

IMSI, MSISDN, TMSI, MSRN All security features of GSM are stored in the SIM for maximum protection Subscribers secret authentication key (Ki) Authentication algorithm (secret algorithm - A3 not unique) Cipher key generation algorithm (A8) SIM stores user profile (subscribed services) RAM available for SMS, short numbers, users directory, etc Protection codes

Authentication and encryption features

Personalization

PIN (Personal Identification Number, 4-8 digits) PUK (PIN Unblocking Key, 8 digits)

Mobile Station
SIM Card

Mandatory storage in SIM:

Administrative information: describes the SIM mode of operation, e.g., normal or type approval IC card identification: unique information identifying the SIM and the card issuer SIM service table: indicates which optional services are provided by the SIM (e.g. last number dialed, call length indication, etc.) IMSI Location information: comprising LAI, current value of periodic location updating timer and location update status Ciphering key (Kc) and Ciphering key sequence number List of carrier frequencies to be used for cell selection Forbidden PLMNs Language preferred

Mobile Station
SIM Card

SIM must be able to manage and provide storage in accordance with security requirements

PIN PIN enable / disable indicator PIN error counter PIN Unlock Key (PUK) PUK error counter Subscriber authentication key (Ki)

Mobile Station
IMSI

Uniquely identifies the user (SIM card) GSM-specific address

Unlike MSISDN normal phone number

Assigned by operator to SIM card upon subscription ISMI permanently stored in SIM card IMSI is permanently stored on the SIM card and unknown by the subscriber In HLR, it is used as the storage address for the subscriber data

Mobile Station
IMSI

15 digits hierarchical address IMSI structure (http://en.wikipedia.org/wiki/IMSI)

Mobile Station
IMSI

Mobile Station
MSISDN

MSISDN: The usual telephone number

Follows International ISDN Numbering Plan (ITU-T E.164) Structure

Mobile Station
MSISDN

GSM is the first network to distinguish

The user identity, i.e., IMSI The number to dial, i.e., MSISDN ISMI is real user address: never public Faking false identity: need signal ISMI to the network, but IMSI hard to obtain Easy modification of numbering and routing plans

Separation IMSI-MSISDN protects confidentiality

Separation IMSI-MSISDN allows

Single IMSI may be associated with several MSISDN numbers

e.g., different services (fax, voice, data, etc.) may be associated with different MSISDN number

Mobile Station
Address Temporary

TMSI

MSRN

32 bits Assigned by VLR within an administrative area Has significance only in this area Transmitted on the radio interface instead of IMSI to reduce problem of eavesdropping

An MSISDN number CC, NDC of the visited network SN assigned by VLR Used to route calls to a roaming MS Subscriber number (SN) assigned to provide routing information towards actually responsible MSC

Mobile Station
Address Temporary

Mobile Station
Summary of GSM Numbers

Fixed Infrastructure
Components and Interfaces

Fixed Infrastructure
Components and Interfaces

Fixed Infrastructure
Base Station Subsystem (BSS)

Fixed Infrastructure
Base Station Subsystem (BSS)

Base Transceiver Station (BTS)

Transmitter & receiver devices, voice coding and decoding, rate adaptation for data Provides signaling channels on radio interface Performs most important radio interface management functions:

Base Station Controller (BSC)

Radio channel allocation / de-allocation Handover management

Transcoder Controller (TRC)

Provide BSS with rate adaptation capabilities

Fixed Infrastructure
BSS- BTS

TRX radio interface functions:

GMSK modulation-demodulation Channel coding Encryption/decryption Burst formatting, interleaving Signal strength measurements Interference measurements

Fixed Infrastructure
BSS - BTS

Fixed Infrastructure
BSS - BSC

Functions

Switch calls from MSC to correct BTS and conversely Protocol and coding conversion: for traffic (voice) & signaling (GSM-specific to ISDN specific) Manage MS mobility Enforce power control

DB contains: State information of all BTS BTS software

Fixed Infrastructure
BSS Transcoder Controller
BTS: Collects speech traffic Deciphers and removes error protection Result: 13 kbps air-interface GSM speechcoded signal MSC: A 64kp/s ISDN switch Needs to receive ISDN-coded speech : 64 kbps PCM format (A-law)

Transcoding and Rate Adaptation Unit (TRAU)

Needed !

Fixed Infrastructure
BSS Transcoder Controller

Function

Perform transcoding and rate adaptation Convert PCM coder information to GSM coder information Involves the conversion of information arriving from MSC/VLR at rate of 64 Kbps to rate of 16 Kbps or transmission to a BSC

Transcoding

Rate adaptation

16 Kbps contains 13 Kbps of traffic and 3 Kbps of in-band signaling information

Hardware unit: TRAU (Transcoder and Rate Adaptation Unit)

Fixed Infrastructure
BSS Transcoder Controller

Fixed Infrastructure
Network Switching Sub-system

Fixed Infrastructure
Network Switching Sub-system

Elements

Mobile Switching Center (MSC) / Gateway MSC Home Location Register (HLR) / Authentication Center (AUC) Visitor Location Center (VLR) Equipment Identity Register (EIR)

Fixed Infrastructure
NSS Mobile Switching Center (MSC)

An ISDN switch (64 Kbps channel) Perform all switching and routing functions of a fixed network switching node Plus specific mobility-related functions:

Allocation and management of radio resources Management of mobile users

Registration, authentication Handover execution and control Paging

A PLMN, in general, has many MSCs

Each MSC is responsible of a set of BSS

Fixed Infrastructure
NSS Home Location Register (HLR)

HLR:

Centralized network database that store and manage all mobile subscriptions belonging to a specific operator Acts as a permanent store for a persons subscription information until that subscription is cancelled

Fixed Infrastructure
NSS Home Location Register (HLR)

HLR:

The information stored includes:

Permanent information associated to a user

Subscriber identity (i.e., IMSI, MSISDN) Subscriber supplementary service Subscriber location information (i.e., MSC service area) Subscriber authentication information Current VLR address (if available) Current MSC address (if available) MSRN (if user outside PLMN)

Temporary information associated to a user

Fixed Infrastructure
NSS Home Location Register (HLR)

Functions:

Subscription data management Communication with MSCs Communication with GMSCs Communication with AUC Communication with VLR/IRL

Fixed Infrastructure
NSS Visitor Location Register (VLR)

VLR acts as a temporary storage location for subscription information for MSs which are within a particular MSC service area there is one VLR for each MSC service area

MSC does not have to contact the HLR every time the subscriber uses a service or changes its status

Fixed Infrastructure
NSS Visitor Location Register (VLR)

When MS moves to a new service area

Fixed Infrastructure
NSS Visitor Location Register (VLR)

While a MS is within one MSC service area, the VLR contains complete copy of necessary subscription details:

Identity numbers of subscriber (IMSI, MSISDN) Supplementary service information Activity of MS (e.g. idle mode) Current LA of MS

Fixed Infrastructure
NSS Authentication Center (AUC)

AUC is an intelligent database concerned with the regulation of access to the network ensuring that services can be used by those who are entitled to do so and that the access is achieved in a secure way AUC provides information which is then used by MSC/VLR

To perform subscriber authentication and To establish ciphering procedure on the radio link between the network and MSs

The AUC is generally integrated with the HLR

Fixed Infrastructure
NSS Authentication Center (AUC)

The information provided is called triplet and consist of:

Non-predictable random number (RAND) A Signed RESponse (SRES) A ciphering key (Kc)

Fixed Infrastructure
NSS Authentication Center (AUC)

Fixed Infrastructure
NSS Authentication Center (AUC)

The principle is that the AUC and the SIM have a unique key for every subscriber (Ki ) which is used as the basis for generating a response (SRES) to a random number (RAND) generated by the AUC. Only the true SIM will be able to generate the correct response and thus gain access to the network.

Fixed Infrastructure
NSS Authentication Center (AUC)

Authentication can by operators choice be performed during:

Each registration Each call setup attempt Location Updating Before supplementary service activation and deactivation There can be exceptions for subscribers belonging to other PLMN)

Fixed Infrastructure
NSS Equipment Identity Register

EIR: database that holds list of allowed equipment identity, i.e. IMEI number: WHITE/ GREY/ BLACK list EIR procedure:

Fixed Infrastructure
NSS Gateway MSC(GMSC)

GMSC: Interrogating Node Gateway functionality enables an MSC to interrogate a HLR in order to route a mobile terminating call.

Fixed Infrastructure
Operation & Maintenance Subsystem

Network measurement and control functions Monitor and initiated from OMC (Operation and Maintenance Center) Basic functions:

Network Administration

Configuration, operation, performance management, statistic collection and analysis, network maintenance Accounting and billing e.g. EIR management

Commercial operation and charging

Security management

Summary of User Identification