Professional Documents
Culture Documents
Mobile Communication Systems: GSM
Mobile Communication Systems: GSM
Overview
GSM
today many providers all over the world use GSM (more than 180
countries in Asia, Africa, Europe, Australia, America)
GSM
Total mobility
Worldwide connectivity
High capacity
high audio quality and reliability for wireless, uninterrupted phone calls
at higher speeds (e.g., from cars, trains)
Security functions
GSM
Mobile Services
GSM services
basic services
z
voice services
z data services
z short message service
additional services
z
emergency number
z group 3 fax
z electronic mail
supplementary services
z
z
z
z
z
GSM
Basic Services
full rate: 13 / 12.2 kbit/s (original coder / enhanced full rate coder)
half rate: 5.6 kbit/s (enhanced half rate coder)
GSM
radio cell
MS
BSS
MS
radio cell
MS
BTS
RSS
BTS
BSC
BSC
MSC
NSS
MSC
VLR
signaling
VLR
HLR
GMSC
IWF
OSS
EIR
AuC
ISDN, PSTN
PDN
OMC
GSM
MS
Mobile Station
BTS
BSS
Base Station
Subsystem
BSC
BSC
MS
BTS
GSM
MSC
HLR
VLR
HLR
VLR
MSC
GMSC
MSC
VLR
BSC
BSC
fixed network
GSM
OMC
AuC
Authentication Centre
Security functions
EIR
OMC
AuC
Network
Element
EIR
HLR
MSC
GSM
network and
switching subsystem
fixed
partner networks
MS
ISDN
PSTN
Um
BTS
MSC
Interfaces
Abis
BSC
HLR
Um : radio interface
A: standardized, open
interface with 64 kbit/s user
channels
SS7
BTS
VLR
BTS
BSC
BTS
BSS
ISDN
PSTN
GMSC
IWF
PDN
GSM
10
BTS
BTS
BSC
TRAU
MSC
64 kbit/s
BTS
BSC
64 kbit/s
BSC TRAU
16 kbit/s
BTS
MSC
64 kbit/s
BSC
16 kbit/s
MSC
TRAU
MSC
64 kbit/s
(4 x 16 sub-mux)
GSM
11
Mobile addresses
GSM
12
MT (Mobile Termination)
TE (Terminal Equipment)
TA (Terminal Adapter)
TE1
MT
TE2
Um
TA
MT
GSM
Um
13
GSM
14
Functions
Management of radio channels
Frequency hopping (FH)
Management of terrestrial channels
Mapping of terrestrial onto radio channels
Channel coding and decoding
Rate adaptation
Encryption and decryption
Paging
Uplink signal measurements
Traffic measurement
Authentication
Location registry, location update
Handover management
BTS
X
X
X
X
X
X
BSC
X
X
X
X
X
X
X
X
X
X
GSM
15
switching functions
additional functions for mobility support
management of network resources
interworking functions via Gateway MSC (GMSC)
integration of several databases
GSM
16
Location registers
Database requirements
scalability
high capacity
low delay
subscriber data
z
location data
z
GSM
17
Location registers
Visitor Location Register (VLR)
local database
z
subscriber identity
z
temporary location
z
temporary addresses
z
GSM
18
Temporary
Temporary
GSM
19
associated to HLR
search key: IMSI
supports authentication and encryption mechanisms
z
GSM
20
GSM - TDMA/FDMA
nc
y
935-960 MHz
124 channels (200 kHz)
downlink
fre
qu
e
FDMA channels
890-915 MHz
124 channels (200 kHz)
uplink
time
TDMA frame
0
7
4.615 ms
Radio interface
bit rate
156.25 bits/0.5769 ms=
270.8 kbit/s
user data
training
user data
3 bits
57 bits
26 bits
57 bits
tail
guard
space
21
GSM
Burst structures
CD
TS
CD
TB GP
57
26
57
3 8.25
Guard Period - avoids
overlapping between bursts
SS
CD
TB
GP
41
36
68.25
GSM
22
Burst structures
FBS
TB GP
142
3 8.25
Fixed Bit Sequence - frequency
information for MS local oscilator locking
CD
SS
CD
TB GP
39
64
39
3 8.25
23
GSM
Frame hierarchy
frame
8 x 15/26 ms = 60/13 ms = 4.615 ms
time-slot
15/26 ms = 0.577 ms
0
frame 0
frame 1
frame 2
traffic multiframe
26 x 60/13 = 120 ms
frame 24
frame 25
frame 0
frame 1
frame 2
x 51
superframe (*)
6.12 s
x 2048
hyperframe (**)
3.5 hours
x 26
control multiframe
51 x 60/13 = 235.38 ms
0
frame 49
frame 50
GSM
24
Logical channels
SCH
BCCH
RACH
AGCH
PCH
Broadcast
Control Channel
Random Access
Channel
Access Grant
Channel
Paging
Channel
SDCCH
Stand-alone
Dedicated
Control Channel
ACCH
Associated
Control
Channels
SACCH
FACCH
Fast Associated
Control Channel
FCCH
Synchronization
Channel
TCH/H
DCCH
Dedicated
Control
Channels
CCCH
Common
Control
Channels
BCH
Broadcast
Channels
Frequency Correction
Channel
TCH/F
TrafficChannels
Half-rate
Half-rate
TrafficChannels
Full-rate
Full-rate
CCH
Control Channels
Slow Associated
Control Channel
TCH
Traffic Channels
25
GSM
Logical channels
Channel
TCH
Traffic Channels
Direction
TCH/H
TCH/F
SCH
Carrier synchronization
BTS MS Frame synchronisation
DCCH
Dedicated
Control
Channels
RACH
Permanent
BCCH
CCCH
Common
Control
Channels
Allocation
Allocated by network on
demand by MS
FCCH
BCH
Broadcast
Channels
Application
BTS MS
AGCH
PCH
Permanent
Allert MS to a call originated in the network
SDCCH
Allocated by network on
demand
SACCH BTS MS
FACCH
(*) Fast allocation by setting S bit; bits are stolen from TCH
GSM
26
Logical channels
Channel
TCH
Traffic Channels
BCH
Broadcast
Channels
CCCH
Common
Control
Channels
TCH/H
TCH/F
Burst type
Time-slot
Mulitiframe
Normal
(114 data bits)
Any
26 frames
(120 ms)
12
FCCH
SCH
Synchronisation
BCCH
Normal
(114 data bits)
RACH
Random
access
27 minimum
51 typical
PCH
Normal
(114 data bits)
SACCH
5
TS0 - base channel (*)
TS0/TS2/TS4/TS6 (**)
SDCCH
Same TS as SDCCH
Normal
(114 data bits)
51 frames
(235.38 ms)
51 frames
(235.38 ms)
Same TS as TCH
26 frames
(120 ms)
12 minimum
51 frames
(235.38 ms)
FACCH
Capacity
24
Frequency
correction
AGCH
DCCH
Dedicated
Control
Channels
Bursts /
Multiframe
2 (***)
Same as
TCH
Same as TCH
27
GSM
transmission is half-duplex
downlink
0
receive
3
uplink
transmit
transmit
GSM
28
Principle of operation
z
z
z
z
z
Initial ranging
z
Adaptive control
z
BTS monitors burst and measures delays with specified time advance
z if path delay varies more than 1 bit period, the new value is signalled on
SACCH
GSM
29
Frequency hopping
Hoping sequence
period: 4.615 ms
z frequency: 217 hops/s
z number of bits: 1250 bits/hop
GSM
30
Transmission power
GSM 1800
8W
39 dBm
vehicular
4W
36 dBm
vehicular
5W
37 dBm
portable
1W
30 dBm
portable
2W
33 dBm
portable
0.25 W
24 dBm
portable
0.8 W
29 dBm
portable
usual classes
several advantages
z
31
GSM
Transmission power
Power control
procedure
z
control range
GSM 900
GSM 1800
5 - 39 dBm
0 - 36 dBm
Comments
effective maxima depend on cell size and MS capability
control steps of 2 dB
channels with no power control - use maximum power for the cell
z
GSM
32
Security in GSM
Security services
access control/authentication
confidentiality
anonymity
secret:
A3 and A8
available via the
Internet
network providers
can use stronger
mechanisms
33
GSM
GSM - authentication
SIM
mobile network
Ki
RAND
128 bit
AuC
RAND
128 bit
RAND
Ki
128 bit
128 bit
A3
A3
SIM
SRES* 32 bit
MSC
SRES* =? SRES
SRES
SRES
32 bit
GSM
32 bit
SRES
34
MS with SIM
RAND
RAND
128 bit
RAND
128 bit
128 bit
A8
cipher
key
128 bit
SIM
A8
Kc
64 bit
Kc
64 bit
data
BTS
Ki
SRES
data
encrypted
data
MS
A5
A5
35
GSM
Um
Abis
MS
BTS
BSC
MSC
CM
CM
MM
MM
BSSAP
RR
RR
BTSM
RR
BTSM
LAPDm
LAPDm
LAPD
LAPD
radio
radio
PCM
PCM
16/64 kbit/s
GSM
BSSAP
SS7
SS7
PCM
PCM
64 kbit/s /
2048 kbit/s
36
CM (Connection Management)
MM (Mobility Management)
37
GSM
HLR
VLR
calling
station 1
PSTN
GMSC
15
MSC
7
10
14
10 13
16
10
BSS
BSS
BSS
11
11
11
12
MS
GSM
38
MS
BCCH System parameters and other overhead
incoming call
PCH
idle updated
announced TMSI
matches stored value
successful access
successful paging
send RAND
calculate SRES / Kc
calculate SRES / Kc
send SRES
SRES confirmed
39
GSM
switch signaling to
FACCH using
assigned TCH
generate ringing sound
Connect FACCH
switch to traffic channel
MS
mobile off-hook
switch to traffic channel
data flow
FACCH Disconnect
Release FACCH
GSM
idle updated
40
3, 4: security check
5-8: check resources (free circuit)
3
6
5
GMSC
PSTN
MSC
8
2 9
1
MS
BSS
10
41
GSM
MS
idle updated
number dialed
successful access
calculate SRES / Kc
send SRES
SRES confirmed
GSM
42
MS
switch signaling to
FACCH using
assigned TCH
ringing tone
FACCH Connect
TCH
data flow
Disconnect FACCH
mobile on-hook
FACCH Release
Release complete FACCH
idle updated
43
GSM
4 types of handover
1
MS
BTS
MS
MS
MS
BTS
BTS
BTS
BSC
BSC
BSC
MSC
MSC
GSM
44
Handover decision
receive level
BTSold
receive level
BTSnew
handover
margin
HO_MARGIN
MS
MS
BTSold
BTSnew
45
GSM
NEW
BTS
measurement
report
BSC
BSC
MSC
BTS
measurement
result
HO decision
HO required
HO request
resource allocation
ch. activation
HO command
HO command
HO command
HO request ack
HO complete
HO complete
HO access
link establishment
clear command
clear command
clear complete
clear complete
GSM
46
Location update
MS is aware of location
47
GSM
Location update
OLD
MSCold
NEW
VLRold
HLR
VLR
request IMSI
MSC
location update
request
MS
location update
request
(old LAI/TMSI sent)
send IMSI
send IMSI
update location
request
cancel location
cancellation
confirmed
cancel location
request
update
confirmed
update location
update
confirmed
update
confirmed
cancellation
confirmed
GSM
48
Location update
MS
BCCH System parameters and other overhead
idle updated
SRES confirmed
GSM
idle updated
49