2.2.

AN OVERVIEW OF THE GSM NETWORK ARCHITECTURE

73

controlling the transmitted power of an MS to ensure that it is just sufcient to reach its serving BTS. BSCs vary from manufacturer to manufacturer, but a BSC might typically control up to 40 BTSs. In addition to its processing capacity, a BSC will also have a limited switching capability, enabling it to route calls between the different BTSs under its control. The interface between a BSC and an associated BTS is known as the A-bis interface and it is fully dened by an open, or public, specication. In theory this allows a network operator the freedom to procure their BSCs and BTSs from different equipment manufacturers. The BTS and BSC are collectively known as the base station subsystem (BSS).

2.2.3

The mobile services switching centre

Referring to Figure 2.1, we see that each BSS is connected to a mobile services switching centre (MSC). The MSC is concerned with the routing of calls to and from the mobile users. It possesses a large switching capability that varies between manufacturers, but a typical MSC will control a few tens of BSCs and it will have a capacity of several tens of thousands of subscribers. The MSC is similar to the switching exchange in a xed network. However, it must include additional functions to cope with the mobility of the subscribers, e.g. functions to cope with location registration and handover. The GSM specications use the term MSC area to describe the part of a network that is covered by a particular MSC and its associated BSCs and BTSs. The interface between the MSC and BSS is known as the A interface and it is fully dened in the specications, giving the network operator the freedom to choose their MSCs and BSCs from different manufacturers. The interface between different MSCs is called the E interface. The network operator may also select one or a number of MSCs to act as gateway MSCs (GMSC). As its name would suggest, the GMSC provides the interface between the PLMN and external networks. In the event of an incoming call from another network, the GMSC communicates with the relevant network databases to ensure that the call is routed to the appropriate MS.

2.2.4

The GSM network databases

In the previous sections we have examined the various components within the GSM network that are used to form the communication path between an MS and another MS or a user on another network, e.g. the public switched telephone network (PSTN). Equally important in a commercial network are the means of charging and billing subscribers, maintaining accurate subscription records and preventing fraudulent network access. In a cellular network where subscribers are free to roam throughout the coverage area, the network must also possess some way to track MSs so that it is able successfully to route incoming calls to them. All of these functions are supported using a combination of databases or registers.

74

CHAPTER 2. THE GSM SYSTEM

The home location register (HLR) is used to store information that is specic to each subscriber. It will contain details of a particular users subscription, e.g. the services to which they have access, and some information relating to the location of each subscriber, e.g. the details of the MSC area within which the subscriber is currently registered. The information contained within the HLR may be accessed using either the subscribers IMSI or mobile station international ISDN (MSISDN) number, which is essentially the subscribers telephone number. Every GSM subscriber will have an entry in the HLR of their home network. The interface between an HLR and an MSC is called the C interface. Another GSM database that is very closely associated with the HLR is the authentication centre (AuC). The AuC is solely used to store information that is concerned with GSMs security features, i.e. user authentication and radio path encryption. It will contain the subscribers secret Ki key and the A3 and A8 security algorithms. The functions of the Ki key and the security algorithms are described in detail in Section 2.5. The AuC will only ever communicate with the HLR and it does this using the H interface. Another important database used in the GSM system is the visitor location register (VLR). A VLR is associated with one or a number of MSCs and it contains information relating to those subscribers that are currently registered within the MSC area(s) of its associated MSC(s). The area that is served by a particular VLR is termed the VLR area. It is termed the visitor location register because it holds information on those subscribers that are visiting its VLR area. The main function of the VLR is to provide a local copy of the subscribers information for the purposes of call handling and it removes the need to continually access the HLR to retrieve information about a particular subscriber. This becomes important in a system such as GSM where subscribers may use networks in countries other than the country of their home network. The VLR also contains information that enables the network to nd a particular subscriber in the event of an incoming call. The process of locating a subscriber is facilitated by subdividing the networks coverage area into a number of location areas, each consisting of one or a number of cells or sectors. The VLR will contain the details of the location area in which each subscriber is registered. In the event of an incoming call, an MS will be paged in each of the cells within its location area and this means that the MS may move freely between the cells of a location area without having to inform the network. However, when an MS moves between cells belonging to different location areas, it must register in the new area using the location updating procedure. Where a subscriber moves between location areas controlled by different VLRs, its details are copied from the HLR to the new VLR. The HLR will also ensure that the subscribers details are removed from the old VLR. The interface between the HLR and the VLR is called the D interface and the interface between an MSC and its associated VLR is called the B interface. An interface also exists between different VLRs and this is termed the G interface.

2.2. AN OVERVIEW OF THE GSM NETWORK ARCHITECTURE

75

The introduction of the SIM card in GSM means that tracking a subscriber no longer implies the tracking of a piece of equipment, and vice versa. For this reason the equipment identity register (EIR) has been introduced to allow the network operator to track stolen and malfunctioning MEs. Each ME is assigned a unique 15-digit international mobile equipment identity (IMEI) at the point of manufacture. Each model of ME must undergo a process known as type approval, wherein a number of its features are tested using a GSM system simulator. The type approval testing is carried out by accredited laboratories that are independent of any manufacturing or operating companies and it is used to ensure that all GSM ME models meet a minimum standard, regardless of the manufacturer. Once an ME model has been type approved it will be assigned a six-digit type approval code (TAC) and this forms the rst six digits of an MEs IMEI. The next two digits of the IMEI represent the nal assembly code (FAC) and this is assigned by the manufacturer to identify the place where the ME was nally assembled or manufactured. The next six digits of the IMEI represent the MEs serial number (SNR) and this will be unique to every MS for a given combination of TAC and FAC. The remaining digit of the 15-digit IMEI is dened as spare. The EIR is used to store three different lists of IMEIs. The white list contains the series of IMEIs that have been allocated to MEs that may be used on the GSM network. The black list contains the IMEIs of all MEs that must be barred from using the GSM network. This will contain the IMEIs of stolen and malfunctioning MEs. Finally, the network operator may also use a grey list to hold the IMEIs of MEs that must be tracked by the network for evaluation purposes. During an access attempt or during a call, the network has the ability to command an MS to supply its IMEI at any time. If the IMEI is on the black list or it is not on the white list, the network will terminate the call or access attempt and the subscriber will be sent an illegal ME message. Once an MS has failed an IMEI check it will be prevented from making any further access attempts, location updates or paging call responses. However, this MS may still be used to make emergency calls. The IMEI check is performed within the EIR and the IMEI is passed to the EIR by the MSC that is currently serving the MS. The results of the IMEI check are then returned by the EIR to the relevant MSC. The interface between the EIR and the MSC is termed the F interface.

2.2.5

The management of GSM networks

From an operators viewpoint, an effective network management system is an important part of any telecommunications network. It is essential for the network operator to be able to identify problems in the network at an early stage and correct them quickly and efciently. It is also important for the network operator to be able to make changes to the network conguration with a minimum of effort and without affecting the service provided to its

76

CHAPTER 2. THE GSM SYSTEM

subscribers. The functional blocks associated with the management of the GSM network, as shown in Figure 2.1, are the operations and maintenance centre (OMC), the network management centre (NMC) and the administration centre (ADC). The OMC provides the means by which the operator controls the network. Each OMC will typically be in charge of a subsystem, e.g. the BSS or the Network Switching Subsystem, NSS (i.e. the MSC, HLR, VLR, etc.) The NMC is concerned with the management of the entire network and it generally has a wider operational role than an OMC. The ADC is concerned, as its name would suggest, with the administrative functions required within the network.

2.3 The GSM Radio Interface

The radio interface provides the means by which an MS communicates with the BTSs of a GSM network whilst it moves within the coverage area. The performance of the radio interface, and particularly its ability to provide acceptable speech links in the face of co-channel interference from other users within the system, acutely affects the overall capacity of a cellular system. In this section we examine the features of the GSM radio interface. Figure 2.2 shows a simplied block diagram of the GSM radio link. In the following sections we will examine the function and operation of each of these blocks in some detail. It is difcult to keep to a strict top-down or bottom-up description of the GSM radio interface because, in some cases, in order to appreciate the reason for a particular feature of the radio interface, it is necessary to understand some features associated with a higher or lower layer protocol. For this reason we have adopted a somewhat unconventional approach to the description of the radio interface. We will begin by examining the modulation scheme and the carrier frequencies used in GSM. Then we will discuss the construction of the TDMA bursts, or packets, and the way in which these may be demodulated in the presence of intersymbol interference (ISI) caused by the radio channel and the modulation process itself. Following this we will discuss the different channels that are available in GSM and the manner in which the radio resources are allocated to each of the channels. At this point we will have effectively built up a picture of the radio interface as a bit pipe where data are applied to the transmitter and the same data, possibly with a number of errors, are recovered at the receiver. We will then turn our attention to the coding, interleaving and ciphering processes that occur on the GSM radio interface. These processes are different for speech information, user data (e.g. fax transmissions) and signalling information and, therefore, we will deal with each of these different types of information separately. Finally, we will bring the two halves of our radio interface description together by describing the manner in which the coded, interleaved and ciphered, or encrypted, data are mapped onto the TDMA bursts.