Global System for

Mobile Communications (GSM)

Jenn-Wei Lin 1

Reference
• Overview of the Global System for Mobile Communication, John
Scourias, University of Waterloo, May 1995.

• Overview of the GSM system and Protocol Architecture, More

Rahnema, IEEE Communication Magazine, April 1993.

• A Brief Overview of the GSM Radio Interface, Thierry Turletti,

CS MIT, March 1996.

Jenn-Wei Lin 2

1
 GSM
• History
– Conference of European Posts and
Telgraphs (CEPT)
• A study group Group Special Mobile to develop a
pan-European public land mobile system in 1982
• GSM responsibility transferred to the European
Telecommunication Standards Institute (ETSI)
• Phase I of the GSM spec. in 1990
• Commercial service in mid-1991
• GSM acronym →Global System for Mobile
Communications

Jenn-Wei Lin 3

GSM
• Spectrum
– Uplink 890 - 915 MHz
– Downlink 935-960 MHz
– Spacing
• Duplex spacing: 45 MHz
• Channel spacing: 200 KHz
• Total channel number: 124
• Number of slots per channel: 8

Jenn-Wei Lin 4

2
 GSM
• Spectrum (Cont.)

Jenn-Wei Lin 5

GSM
• Working Frequency Bands

Jenn-Wei Lin 6

3
 GSM
• GSM -900

Extended-GSM

Jenn-Wei Lin 7

GSM
• GSM -900 in Taiwan

Jenn-Wei Lin 8

4
 GSM
• GSM -1800

Jenn-Wei Lin 9

GSM
• GSM- 1800 in Taiwan

Jenn-Wei Lin 10

5
 GSM
• PCS -1900

Jenn-Wei Lin 11

GSM
• Radio Transmission Aspect
– From speech to radio waves

– From radio waves to speech

Jenn-Wei Lin 12

6
 GSM
• Radio Transmission Aspect
– GSM speech coding
• Regular Pulse Excitation with Long Term
Prediction (GSM 0.10 RPE-LTP)
– Encoder divides the speech into short-term predictable
parts, long-term predictable parts, and the remaining
residual pulse
• Information from previous samples, which does
not change very quickly, is used to predict the
current sample
– Decoder reconstructs the speech by passing the
residual pulse through the long-term and short-term
predictors

Jenn-Wei Lin 13

GSM
• Radio Transmission Aspect
– GSM speech coding

Jenn-Wei Lin 14

7
 GSM
• Radio Transmission Aspect
– Channel coding
• Redundancy into the data flow to allow the
detection or correction
• 260 bits every 20 ms (speech coding algorithm)
– 128 Class I bits
• 50 Class Ia bits
• (protected by 3 parity bits for error correction)
• 132 Class Ib bits
• (added with 4 tail bits before convolution)
– 78 Class I bits (less important and unprotected)

Jenn-Wei Lin 15

GSM
• Radio Transmission Aspect
– Channel coding

Jenn-Wei Lin 16

8
 GSM
• Radio Transmission Aspect
– Channel coding
• Error detection
– 3-bit error redundancy code
– One of Class Ia 50-bits wrong→A loud noise
• Convolution coding
– Adding 4 bits (set to “0”) to the initial 185 (50+3+132)
bit sequence and applying two different convolutions
– Twice 189 bit sequences (2*189=378)
• Convolution decoding
– Using a Viterbi algorithm
– A maximum likelihood decoder

Jenn-Wei Lin 17

GSM
• Radio Transmission Aspect
– Interleaving
• De-correlate the relative positions of the bits in
the code words and in the modulated radio
bursts
– Avoid the risk of loosing consecutive data bits
• Interleave on 8 bursts
– 8 bursts in sub-blocks of 57 bits each
– Sub-block of 57 bits carried by a different burst and in
a different TDMA frame
– De-interleaving
• Reverse operation
• Interleaving delay 8 TDMA frames (~37 ms)
Jenn-Wei Lin 18

9
 GSM
• Radio Transmission Aspect
– Interleaving

Jenn-Wei Lin 19

GSM
• Radio Transmission Aspect
– Interleaving
• De-correlate the relative positions of the bits in
the code words and in the modulated radio
bursts
– Avoid the risk of loosing consecutive data bits
• Interleave on 8 bursts
– 8 bursts in sub-blocks of 57 bits each
– Sub-block of 57 bits carried by a different burst and in
a different TDMA frame
– De-interleaving
• Reverse operation
• Interleaving delay 8 TDMA frames (~37 ms)
Jenn-Wei Lin 20

10
 GSM
• Radio Transmission Aspect
– Ciphering
• Protection by means of transmission ciphering
• Performing an “exclusive or” operation between
– A pseudorandom bit sequence
• Generating by burst number and key session
– 114 useful bits of a normal burst (two 57 bits)
– Deciphering
• Performing the same operation

Jenn-Wei Lin 21

GSM
• Radio Transmission Aspect
– Modulation/Demodulation
• Gaussian Modulation Shift Keying (GMSK)

Jenn-Wei Lin 22

11
 GSM
• Channel Concept

Jenn-Wei Lin 23

GSM
• Channel Concept

Jenn-Wei Lin 24

12
 GSM
• Channel Concept

57*2=114

Jenn-Wei Lin 25

GSM
• Channel Concept

GP: Guard Period 8.25 bits~30.4us

Jenn-Wei Lin 26

13
 GSM
• Channel Concept
– TB (Tail Bits)
• Set to logical “0”
• Transmitter power is ramped up or ramped down
– S (Stealing Flags)
• Signaling bits which indicate whether the burst
contains traffic data or signaling data
– TS (Training Sequence)
• Channel estimation to optimize reception with an
equalizer and for synchronization
– GP (Guard Period)
• Prevent interferences and multipath propagation
between two adjacent time slots (burst).
Jenn-Wei Lin 27

GSM
• Channel Concept
– Organization of bursts, TDMA frames, and
multiframes for speech and data

BP:Burst Period

Jenn-Wei Lin 28

14
 GSM
• Channel Concept

Jenn-Wei Lin 29

GSM
• Channel Concept

Double the capacity

Jenn-Wei Lin 30

15
 GSM
• Channel Concept

Jenn-Wei Lin 31

GSM
• Channel Concept

Base station information code

MCC (Mobile Country Code)

MNC (Mobile Network Code) to identity the operator
Jenn-Wei Lin 32

16
 GSM
• Channel Concept
– Frequency hopping
• Each TDMA frame on a different frequency
• Propagation conditions (Multipath fading) are
different for each individual carrier frequency
• Frequency hopping alleviate the multipath fading
– Discontinuous transmission
• A person speaks less than 40 percent of the time
in normal conversation
• Turn the transmitter off during silence periods
• Distinguish between voice and noise inputs (voice
activity detection)
• Power is conserved at the mobile unit
Jenn-Wei Lin 33

GSM
• Channel Concept

Jenn-Wei Lin 34

17
 GSM
• Channel Concept

Jenn-Wei Lin 35

GSM
• Channel Concept

Jenn-Wei Lin 36

18
 GSM
• Channel Concept

Jenn-Wei Lin 37

GSM
• Channel Concept

Jenn-Wei Lin 38

19
 GSM
• Channel Concept

Jenn-Wei Lin 39

GSM
• Channel Concept

Jenn-Wei Lin 40

20
 GSM
• Channel Concept
– Broadcast channels (BCH)
• Used by the BTS (Base Transceiver Station) to
broadcast information to the MSs in its coverage
area
• Frequency correction channel (FCCH) and
synchronization channel (SCH) carry
information from the BSS (Base station system)
to the MS (Mobile Station).
• The information allows the MS to acquire and
stay synchronized with the BSS.
– Frequency and time alignment

Jenn-Wei Lin 41

GSM
• Channel Concept
– Common control channels
• Paging channel (PCH)
– Used by the network to page the destination MS in call
termination.
• Access grant channel (AGCH)
– Used by the network to indicate radio link allocation
• Random access channel (RACH)
– Used by the MSs for initial access to the network

Jenn-Wei Lin 42

21
 GSM
• Channel Concept
– Dedicated control channels
• Supported in GSM for dedicated used by a
specific MS
• Standalone dedicated control channel (SDCH)
– Used only for signaling and for short messages
• Slow associated control channel (SACCH)
– Associated with either a TCH or an SDCCH
– Used for nonurgent procedures
• Transmission of power and time alignment control
information over the downlink
• Measurement reports from the MS over the uplink
• Fast associated control channel (FACCH)
– Used for time-critical signaling
Jenn-Wei Lin
• call-establishing 43 progress, authentication of
subscriber or handoff

GSM
• Channel Concept
– Dedicated control channels (Cont.)
• Fast associated control channel (FACCH)
– Used for time-critical signaling
• call-establishing progress, authentication of
subscriber or handoff
• Cell broadcast channel (CBCH)
– Carriers only the short message service cell broadcast
messages

Jenn-Wei Lin 44

22
 GSM
• Channel Concept
– GSM call origination (radio aspect)
MS BSS
RACH (request signaling channel)

AGCH (assign signaling channel)

SDCCH (request call setup)

SDCCH message exchange for call setup

SDCCH (assign TCH)

FACCH (complete assignment)

Jenn-Wei Lin 45

GSM
• Channel Concept
– GSM call termination (radio aspect)
MS BSS
PCH (page MS)

RACH (request signaling channel)

AGCH (assign signaling channel)

SDCCH (respond to paging)

Call setup procedure

Jenn-Wei Lin 46

23
 GSM
• Channel Concept

Jenn-Wei Lin 47

GSM
• Channel Concept

Jenn-Wei Lin 48

24
 GSM
• Channel Concept

Jenn-Wei Lin 49

GSM
• Channel Concept

Jenn-Wei Lin 50

25
 GSM
• Channel Concept

Jenn-Wei Lin 51

GSM
• Channel Concept

Jenn-Wei Lin 52

26
 GSM
• Channel Concept

Jenn-Wei Lin 53

GSM
• Channel Concept

Jenn-Wei Lin 54

27
 GSM
• Services Provided
– ISDN (Integrated Services Digital Network)
compatibility
• Radio transmission limitations →ISDN B-channel
(64 kbps ?)
– ITU-T (International Telecommunication Union-
Telecommunication Standardization Sector)
• Bearer services
• Teleservices
• Supplementary services
– On top of teleservices or bearer services
– Data services

Jenn-Wei Lin 55

GSM
• Services Provided

Jenn-Wei Lin 56

28
 GSM
• Services

Packet-Assembler/Disassembler GSM-PSTN-PSPDN

Jenn-Wei Lin 57

GSM
• Services

Jenn-Wei Lin 58

29
 GSM
• Services

Jenn-Wei Lin 59

GSM
• Services

Jenn-Wei Lin 60

30
 GSM
• Services

Jenn-Wei Lin 61

GSM
• Services

Jenn-Wei Lin 62

31
 GSM
• Services

Jenn-Wei Lin 63

GSM
• Services

Jenn-Wei Lin 64

32
 GSM
• Services

Jenn-Wei Lin 65

GSM
• Services

Jenn-Wei Lin 66

33
 GSM
• Services

Jenn-Wei Lin 67

GSM
• Services

Jenn-Wei Lin 68

34
 GSM
• Services

Jenn-Wei Lin 69

GSM
• Services

Jenn-Wei Lin 70

35
 GSM
• Services

Jenn-Wei Lin 71

GSM
• Services

Jenn-Wei Lin 72

36
 GSM
• Services

Jenn-Wei Lin 73

GSM
• Services

Jenn-Wei Lin 74

37
 GSM
• Services

Jenn-Wei Lin 75

GSM
• Services

Jenn-Wei Lin 76

38
 GSM
• Services

Jenn-Wei Lin 77

GSM
• Services

Jenn-Wei Lin 78

39
 GSM
• Services

Jenn-Wei Lin 79

GSM
• Services

Jenn-Wei Lin 80

40
 GSM
• Services

Jenn-Wei Lin 81

GSM
• Services

Jenn-Wei Lin 82

41
 GSM
• Services

Jenn-Wei Lin 83

GSM
• Services

Jenn-Wei Lin 84

42
 GSM
• GSM Architecture

Jenn-Wei Lin 85

GSM
• GSM Architecture (Cont.)
GSM Reference Model
MSC B
VLR
C G
OMC
VLR
E D
B
Um D
BSS

BTS BSC A
MSC C
HLR AUC
A bis F
MS
ISC EIR

Other PLMN GMSC

& International SS or SMSS
PLMN PSTN PSDN ISDN

Jenn-Wei Lin 86

43
 GSM
• Functional Entities
– Mobile station
• Subscriber
– Base Station Subsystem
• Radio link →Mobile station
– Network subsystem
• Switching of calls between the mobile and other
users

Jenn-Wei Lin 87

GSM
• Functional Entities (Cont.)

Jenn-Wei Lin 88

44
 GSM
• Mobile station
– Mobile equipment (the terminal)
– Smart card called Subscriber Identity Mobile
(SIM)
• Personal mobility irrespective of a specific
terminal
• Protection using password or personal identity
number
• A secret key for authentication
• International Mobile Subscriber Identity (IMSI)
to identify the subscriber to the system
• Other information
Jenn-Wei Lin 89

GSM
• Mobile station (Cont.)
– International Mobile Subscriber Identity
(IMSI)

Jenn-Wei Lin 90

45
 GSM
• Mobile station (Cont.)
– International Mobile Equipment Identity
(IMEI)

Jenn-Wei Lin 91

GSM
• Mobile station (Cont.)
– Mobile Station ISDN Number (MSISDN)

Jenn-Wei Lin 92

46
 GSM
• Base Station Subsystem (BSS)
– Base Transceiver Station (BTS)
• Transmit and receive radio signals from a mobile
unit over an air interface
– Base Station Controller (BSC)
• Radio resource management for the cells under
its control
– Transcoder Unit (TU)
• Take 13-Kbps speech or 3.6/6/12-Kbps data
multiplexs and four of them to covert into
standard 64-Kbps

Jenn-Wei Lin 93

GSM
• BTS
– Each BTS serves a single cell
– Encodes, encrypts, multiplexed, modulates
and feeds the RF signals to the antenna
– Transcoding and rate adaption
– Time and frequency synchronization signals
transmitted from BTS
– Voice communication
– Received signal from mobile is decoded,
decrypted and equalized before modulation

Jenn-Wei Lin 94

47
 GSM
• BTS
– Each BTS serves a single cell
– Encode, encrypt, multiplexed, modulate and
feed the RF signals to the antenna
– Transcoding and rate adaption
– Time and frequency synchronization signals
transmitted from BTS
– Voice communication
– Received signal from mobile is decoded,
decrypted and equalized before modulation

Jenn-Wei Lin 95

GSM
• BTS (Cont.)
– Frequency hopping controlled
– Random access detection
– Timing advance
– Uplink radio channel measurement

Jenn-Wei Lin 96

48
 GSM
• BSC
– RR management for BTS under its control
– Intercell handover
– Reallocation of frequencies among BTS
– Power management of BTSs
– Time and frequency synchronization signals
to BTSs
– Time delay measurement
– Control frequency hopping
– Perform traffic concentration
– Provide interface to the OAM
Jenn-Wei Lin 97

GSM
• Network Subsystem
– Mobile services Switching Center (MSC)
– Home Location Register (HLR)
– Visitor Location Register (VLR)
– Authentication Center (Auc)
– Equipment Identity Register (EIR)
– Interworking Function (IWF)
– Echo Canceller (EC)

Jenn-Wei Lin 98

49
 GSM
• MSC
– Paging
– Coordination of call set up from all MSs in
its area
– Location Registration
– Interworking function with different
networks
– Handover management
– Billing for all subscribers based in its area

Jenn-Wei Lin 99

GSM
• MSC (Cont.)
– Echo canceler (EC) operation control
– Signaling exchange between different
interfaces
– Gateway to SMS

Jenn-Wei Lin 100

50
 GSM
• HLR
– Call-routing and roaming capabilities
– Registration
– Authentication
– Location updating
– Handovers
– Records of supplementary services
subscribed

Jenn-Wei Lin 101

GSM
• VLR
– Work with the HLR and AUC on
authentication
– Relay cipher key from HLR to BSS for
encryption/decryption
– Control allocation of new TMSI numbers
– Support paging
– Track state of all MSs in its area

Jenn-Wei Lin 102

51
 GSM
• AuC
– Protect communications through the air
interface against intrusions
– Store authentication and ciphering keys in a
database

Jenn-Wei Lin 103

GSM
• AuC (Cont.)

Jenn-Wei Lin 104

52
 GSM
• EIR
– Store the IMEI numbers for all registered
MS units
– Three classes of MS stored in the database
• White (Valid) list: contains valid equipment
• Black list: contains all suspended equipment. This
list is periodically exchanged among the network
operators.
• Grey (Suspect) list: malfunctioning equipment or
equipment with obsolete software versions is
registered.

Jenn-Wei Lin 105

GSM
• IWF
– Provide the GSM system interface with
various form of public and private data
networks
• PSTN
• ISDN
• Circuit-switched public data networks (CSPDN)
• Packet-switched public data networks (PSPDN)
– Protocol conversion
• Traffic and signaling messages

Jenn-Wei Lin 106

53
 GSM
• EC
– On the PSTN side of the MSC for voice
circuit
• Reduce the effect of GSM delay when the mobile
is connected to the PSTN circuit
– Result of speech encoding, decoding and signal
processing
– 4-wire to 2-wire hybrid transformer in the circuit
– Retransmission occurrence
4w to
BSS MSC EC PSTN 2w
Hybrid

Jenn-Wei Lin 107

GSM
• Operations and Maintenance Center
(OMC)
– Perform all operations and maintenance
functions on regional elements
• X.25 interface for software downloading
• Alarm handling
• Fault management
• Performance management
• Network status
• Traffic collection from network
• System change control for software revisions and
configuration
Jenn-Wei Lin 108

54
 GSM
• Network Management Center (NMC)
– Provide global and centralized management
• Single NMC per network
• Provide traffic management for the whole
network
• Monitors high-level arms such as failed or
overloaded nodes;
• Performs responsibility of an OMC when it is not
staffed
• Provide network planners with essential data for
network performance

Jenn-Wei Lin 109

GSM
• Security Management
– Temporary Mobile Subscriber Identification
(TMSI) assignment
– Authentication
– Encryption
– SIM module
– Equipment identification

Jenn-Wei Lin 110

55
 GSM
• TMSI
– MSC/VLR allocate to a new TMSI and
transmit it to MS
– Signaling exchange between MSC/VLR and
MS makes use of only TMSI
– Protect the privacy and identities of the
subscribers
– Prevent the location of a mobile subscriber
from being traced by listening to the
signaling exchanges on the radio path

Jenn-Wei Lin 111

GSM
• Authentication
– Protect the network against the unauthorized
use
– Perform subscriber authentication at each
registration, call set-up attempt
– Perform after the IMSI/TMIS is known by
the network and before channel is encrypted

Jenn-Wei Lin 112

56
 GSM
• Authentication (Cont.)

A3 Algorithm

Sign Response

Jenn-Wei Lin 113

GSM
• Authentication (Cont.)

Data Base in AUC AUC

IMSI 1 ßà Ki 1
IMSI 2 ßà Ki 2 Ki
A3
…

A8
RAND SRES
IMSI n ßà Ki n

RAND
HLR
AUC Random
Number Generator
RAND, SERS,Kc
RAND
VLR
RAND,SRES,Kc
BSS
…

SRES
RAND
RAND,SRES,Kc

AUC and Authentication Functional Block

Jenn-Wei Lin 114

57
 GSM
• Encryption
– Ensure the privacy of the user information
and user related signaling
– A series of bits is transformed by
mathematical or logical functions into
another series of bits

Jenn-Wei Lin 115

GSM
• Encryption (Cont.)
MS Network
Ki: Random Random Ki:
(in SIM) Number Generator In HLR

A8 ciphering algorithm A8 ciphering algorithm

Kc used for Frame Frame Kc used for

each connection Number Number each connection

A5 ciphering algorithm A5 ciphering algorithm

Data EXOR EXOR Data

Encryption process

Jenn-Wei Lin 116

58
 GSM
• Encryption (Cont.)

Jenn-Wei Lin 117

GSM
• SIM
– Protection using password or personal
identity number
– SIM storage capability (supplementary)
• Storage of short messages and associated
parameters
• Management of an abbreviated dialing number
list
• Memorization of various bearer capability
configuration
• Memorization of the advice of charge information
• Implementation of the MS feature of barring
Jenn-Wei Lin 118

59
 GSM
• SIM (Cont.)
– SIM storage capability (supplementary)
• Storage of a list of BCCH frequencies
• Storage of network access control parameters
• Storage of certain location updating failure causes

Jenn-Wei Lin 119

GSM
• Equipment Identification
– Check the MS identity at call setup
– No stolen or unauthorized ME used in the
system

Jenn-Wei Lin 120

60
 GSM
• Handover
– Mobile moves out of range (coverage) of
“old” cell
– Subscriber assigned to “new” RF channel in
adjacent cell
– Controlled by base station controller and
MSC

Jenn-Wei Lin 121

GSM
• Handover
– Mobile moves out of range (coverage) of
“old” cell
– Subscriber assigned to “new” RF channel in
adjacent cell
– Controlled by base station controller and
MSC

Jenn-Wei Lin 122

61
 GSM
• Handover
– Handover between cells controlled by the
same BSC
2 6 2
VLR
BSC MSC
old
3 1
4 5
5

new
Jenn-Wei Lin 123

GSM
• Handover
– Handover between cells controlled by the
same BSC
• 1. BSC orders the new BTS to activate a TCH.
• 2. BSC sends a message to MS via old BTS over FACCH.
• 3. MS tunes to new freq., and transmits Handover(HO)
access bursts in the correct time slot.
• 4. The new BTS detects the HO burst, it sends Timing
Advance on FACCH.
• 5. MS sends a Handover Complete message to BSC via new
BTS.
• 6. BSC tells the old BTS to release the old TCH.

Jenn-Wei Lin 124

62
 GSM
• Handover
– Handover between cells controlled by
different BSCs but the same MSC
1
4 4
8
4 9
old VLR
BSC MSC
old 2 2
5 4
6 7 7
7 8
new
BSC
Jenn-Wei Lin 125

GSM
• Handover
– Handover between cells controlled by
different BSCs but the same MSC (Cont.)
1. The old BSC sends a HO required message to the MSC.
2. MSC knows which BSC that controls this BTS and sends a HO request to this
BSC.
3. The new BSC orders target BTS to activate a TCH.
4. New BSC sends a message (contained about the freq. , time slot and what
output power to use) to the MS via MSC, old BSC and old BTS.
5. MS tunes to the new freq., and transmit HO access bursts in the correct time slot.
6. The new BTS detects the HO burst, it sends Timing Advance on FACCH.
7. MS sends a Handover Complete message to MSC via new BSC.
8. The new BSC tells the old BSC to release the old TCH via MSC.
9. The old BSC tells the old BTS to release the previously used TCH.

Jenn-Wei Lin 126

63
 GSM
• Handover
– Handover between cells controlled by
different MSC
1 11
7 7 7 PSTN
old old VLR
BSC MSC
old 6
2 5 10
3
8 4
9 5
10 10 10
new new VLR
BSC MSC
Jenn-Wei Lin new 127

GSM
• Handover
– Handover between cells controlled by
different MSC (Cont.)
1. The old BSC sends a HO required message to the old MSC
2. The old MSC knows that this cell belongs to the new MSC and ask for help.
3. The new MSC allocates a handover no. in order to request reroute the call. A HO request is then
sent to the new BSC
4. The new BSC orders target BTS to activate a TCH.
5. The new MSC receives the info., and pass it on to the old MSC together with the handover no.
6. A link is setup from old to new MSC, possibly via PSTN.
7. The old MSC sends a HO command (contained about the freq. , time slot and what output power
to use) to MS
8. MS tunes to the new freq., and transmit HO access bursts in the correct time slot
9. The new BTS detects the HO burst, it sends Timing Advance on FACCH.
10. MS sends a Handover Complete message to the old MSC via new BSC and new MSC.
11. A new path in the group switch in the old MSC is established, and the call is switched through.
.
Jenn-Wei Lin 128

64
 GSM
• Handover
– Hard handoff: MS can only converse with
one base station at one time; there is some
small gap in the conversation during the link
transition, e.g. TDMA, FDMA
– Soft Handoff MS can receive the signals from
both stations simultaneously and both
stations can receive MS. The network must
combine the signals from the two stations in
some way, e.g. CDMA

Jenn-Wei Lin 129

GSM
• Location
– Determines subscriber current location
– Inform network when subscriber enters a
new cell
– Have to trade-off between paging and
location update traffic in system planning
– Location info contained in
• Mobile country code, mobile network code,
location area code, cell ID

Jenn-Wei Lin 130

65
 GSM
• Location
– Hierarchy

LA

cell RA

cellcell RA

Jenn-Wei Lin 131

GSM
• Location
– Movement
• Inter-LA movement
– In the same MSC
• Inter-MSC movement
– In the same GSM Operator
• Inter-VLR movement

Jenn-Wei Lin 132

66
 GSM
• Location
– Inter-LA movement

Jenn-Wei Lin 133

GSM
• Inter-LA Movement
– 1. A location update message is sent from the
MS to the MSC. This message includes the
address of the previously visited LA, MSC,
and VLR.
– 2. The MSC forwards the location update
request to the VLR.
– 3. and 4. The VLR notices that both LA1 and
LA2 belong to the same MSC. It updates the
LAI field of the VLR record, and replies with
an ack. to the MS.
Jenn-Wei Lin 134

67
 GSM
• Location
– Inter-MSC movement

Jenn-Wei Lin 135

GSM
• Inter-MSC Movement
– 1. and 2. The location update request is sent
form the MS to the VLR.
– 3. The VLR notices that the previous LA and
target LA belong to MSC1 and MSC2,
respectively. The VLR updates the LAI and
the MSC fields of the VLR record. The VLR
sends the update-location message to the
HLR.
– 4. The HLR identifies the MS’s record. The
MSC number field of the record is updated.
An ack. Is sent to the VLR.
Jenn-Wei Lin 136

68
 GSM
• Inter-MSC Movement (Cont.)
– 5. and 6. Similar to step 3 and 4 in case 1, the
ack. Is forwarded to the MS.

Jenn-Wei Lin 137

GSM
• Location
– Inter-VLR movement

Jenn-Wei Lin 138

69
 GSM
• Inter-VLR Movement
– 1. A location update message is sent from the
MS to the MSC.
– 2. and 3. VLR2 does not have a VLR record
of the MS. VLR2 send the message send-
identification message to VLR1.
– 4. and 5. VLR2 creates a VLR record for the
MS, and sends a registration message to
update the HLR. The HLR updates the
record of the MS. An ack. Is sent back to
VLR2.
Jenn-Wei Lin 139

GSM
• Inter-VLR Movement (Cont.)
– 6. VLR2 generates a new TMSI and sents it
to the MS.
– 7. and 8. The obsolete record of the MS in
VLR1 is deleted.

Jenn-Wei Lin 140

70
 GSM
• Call Routing
– Connection setup (outgoing)
SS#7
MS BSS/MSC VLR HLR Network
IMSI, TMSI
Ki, Kc, LAI
Setup Indication
(TMSI, LAI) Process Acc. Req.
(TMSI, LAI)

Authentication

Start of ciphering procedure

Auth. Para. Req.

Access Req.
CM-Service (IMSI)
Accepted
Accept Auth. Info
Setup (IMSI, Kc , RAND, SRES)
Send Info for setup
Call Proc.

Jenn-Wei Lin 141

GSM
• Call Routing
– Call from MS
• 行動台經由RACH向系統要求建立接續
• BSC指配一SDCCH訊號頻道，並通知行動台
• 行動台送出“呼叫建立請求”訊息
• 系統與行動台之間所有呼叫建立所需傳送之訊號均
經由此SDCCH信號頻道傳送
• MSC/VLR命令BSC指配一空閒之話務頻道給該主叫之
行動台
• BSC 將其指配之話務頻道號碼通知基地台及行動
台，請它們啟動該話務頻道
• MSC/VLR將被叫號碼傳送給PSTN之介接交換機，再
由此交換機建立與被叫用戶間之鏈路。
Jenn-Wei Lin 142

71
 GSM
• Call Routing
– Call from MS (Cont.)
• 若被叫用戶應答，即可完成接續，兩方及可開始通
信，MSC/VLR開始計費。

Jenn-Wei Lin 143

GSM
• Call Routing
– Connection setup (outgoing) (Cont.) SS#7
MS BSS/MSC VLR HLR Network
Info ack. for setup
Assign comnd.

Assign compl.
IAM
ACM
Alert
ANS
Connect

Connect Ack.

Jenn-Wei Lin 144

72
 GSM
• Call Routing
– Routing information for incoming call
SS#7 GMSC HLR VLR MSC
Network
Routing Information (MSRN) in the HLR
IAM

Send Routing
Information
Routing Information
IAM

GMSC HLR VLR MSC

Routing Information (MSRN) from the HLR

IAM
Send Routing
Provide Roaming
Information
Number
Roaming
Routing Information Number
IAM

Jenn-Wei Lin 145

GSM
• Call Routing
– Incoming call setup SS#7
MS BSS/MSC VLR HLR Network
IMSI, TMSI
IAM
Ki, Kc, LAI

Send Info for setup

Page MS
Paging Request
(TMSI, LAI)
(TMSI)
Paging Response
Process
(TMSI)
Access Req.
Authentication

Start of ciphering procedure

Optional TMSI Reallocation

Jenn-Wei Lin 146

73
 GSM
• Call Routing
– Incoming call setup (Cont.) SS#7
MS BSS/MSC VLR HLR Network
Access Req.
Accepted Auth. Para. Req.
Complete Call (IMSI)
Setup Auth. Info
(IMSI, Kc , RAND, SRES)
Call Conf
ACM
Assign comnd.
Alert

Connect
ANS
Connect Ack.

Jenn-Wei Lin 147

GSM
• Call Routing
– Mobile-initiated call termination SS#7
MS BSS/MSC VLR HLR Network
Disconnect
REL
Release

RLC

Release Complete

Register Charging
Channel Release Information

Charging Information
Ack.

Jenn-Wei Lin 148

74
 GSM
• Call Routing
– Call to MS from PSTN
• PSTN 用 戶 鍵 入 被 叫 行 動 用 戶 之 行 動 號 碼
(MSISDN) ，PSTN的交換機分析此MSISDN後，
及根據其中之網路碼，將此呼叫接續到對應之
GSM網路之Gateway MSC(GMSC)
• GMSC詢問此HLR有關如何將此呼叫轉接至那一
個服勤MSC/VLR
• HLR向被叫行動台目前所在之服勤MSC/VLR 請
求為該被呼叫行動台指配一行動漫遊號碼，並送
給HLR再轉送給GMSC
• GMSC依據此行動台漫遊號碼即可將此呼叫轉接
到行動台目前服勤MSC/VLR
Jenn-Wei Lin 149

GSM
• Call Routing
– Call to MS from PSTN
• 服勤MSC/VLR 可以找出被呼叫行動台目前所在
之位置區，再送出傳乎信息給控制該位置區之所
有BSC
• 這些BSC再將此傳乎訊息分送給涵蓋該區位置之
所 有 BTS 。 各 相 關 BTS 再 將 此 呼 叫 信 息 利 用
paging channel廣播出去
• 若被呼叫行動台接收並檢測到此傳乎訊息，將送
出請求進接信息給BTS, BTS轉送給BSC
• BSC為該行動台指配一信號頻道，並通知該呼叫
行動台

Jenn-Wei Lin 150

75
 GSM
• Call Routing
– Call to MS from PSTN (Cont.)
• 行動台與系統(MSC/VLR)兩方即利用此一信號頻
道來傳送所需信號信息
• 系統MSC送“行動台振鈴信息”給行動台，同時為
該行動台指配一空閒之話務頻道
• 行動台開始振鈴，並向系統回送“振鈴確認信息”
• 被叫行動用戶應答，兩方完成接續，開始通話，
系統(MSC/VLR)開始計費

Jenn-Wei Lin 151

GSM
• GSM Protocol
OSI Model TCP/IP
• Application
• Presentation Application
• Session
• Transport Transport
• Network Internet
• Data Link Network Interface
• Physical

Jenn-Wei Lin 152

76
 GSM
• GSM Protocol
– Protocol for speech
BTS 1 TRX TRAU
BCF
BTS 2
TRX TRAU
TRX TRAU
MS BCF
BTS 3
TRX BSC MSC
TRAU
TRX
BCF
BCF: Base Control Function BTS 4
TRX: Transceiver TRX
TRAU
TRAU: TRX
Transcodingand Rate Adaptation Unit BCF

GSM
Um GSM ISDN
Abis A
Voice Voice Voice

FEC FEC G. 703 G. 703 G. 703

Cipher Cipher
G. 705 G. 705 G. 705
TDMA TDMA
FDMA FDMA G. 732 G. 732 G. 732

GSM protocol architecture for speech (TRAU at BTS site)

Jenn-Wei Lin 153

GSM
• GSM Protocol
– Protocol for data
TE MS BTS BSC MSC/IWF

Transparent Data
Each one with bit rate adaptation
e.g.
X.21
X.25 IWF
FEC FEC
V.24 G.703 G.703 G.703 G.703
Cipher Cipher
L1 TDMA TDMA
G.705 G.705 G.705 G.705 L1
FDMA FDMA G.732 G.732 G.732 G.732

Nontransparent Data
Each one with bit rate adaptation
Layer 2 Relay

e.g. L2R IWF

X.21
NTP RLP RLP NTP
X.25
V.24 G.703 G.703 G.703 G.703
TDMA
IFP
TDMA G.705 G.705 G.705 G.705 IFP
FDMA FDMA
G.732 G.732 G.732 G.732

Um Abis A

GSM protocol architecture for Transparent/Nontransparent Data

Jenn-Wei Lin 154

77
 GSM
• GSM Protocol
– Protocol for data (Cont.)
• Transparent data transmission
– User data is protected against transmission errors by
forward error correction only across the air interface
• Non-transparent data transmission
– The data transmission between mobile station and
interworking function of the MSC is protected with the
data link layer protocol RLP.
• Automatic Repeat Request (ARQ)
– The interface to the data terminal, a Nontransparent
Protocol (NTP) and an Interface Protocl (IFP)

Jenn-Wei Lin 155

GSM
• GSM Protocol
– Protocol for signaling
• Handle subscriber access to the network and the
control of the user plane (reservation, activation,
routing, and switching of channel)

Jenn-Wei Lin 156

78
 GSM
• GSM Protocol
– Physical layer
• Digital transmission over air
• Logical channel
• Channel coding

Jenn-Wei Lin 157

GSM
• GSM Protocol
– Data link layer
• LAPD-link protocol (LAPDm)
• Protected transfer of signaling messages
• Transparent transport of layer 3 messages

Jenn-Wei Lin 158

79
 GSM
• GSM Protocol
– Layer 3
• Radio Resource (RR) management sublayer
– Handle the administration of the frequencies and
channels
• Mobility Management (MM) sublayer
– Handle the tasks resulting from mobility
• Connection Management (CM) sublayer

Jenn-Wei Lin 159

GSM
• GSM Protocol
– RR Sublayer
• Monitoring of BCCH and PCH (readout of
system information and paging messages)
• RACH administration: mobile stations send their
requests for connections and replies to paging
announcements to the BSS
• Requests for and assignments of data and
signaling channels
• Periodic measurements of channel quality
• Transmitter power control and synchronization
of the MS

Jenn-Wei Lin 160

80
 GSM
• GSM Protocol
– RR Sublayer (Cont.)
• Handover
• Synchronization of encryption and decryption on
the data channel

Jenn-Wei Lin 161

GSM
• GSM Protocol
– MM Sublayer
• MM specific procedures
– Procedures do not set up an MM connections. They
can only be initiated when no other MM-specific
procedure is running and no MM connection is
established.
• MM common procedures
– Procedures can be initiated at any time while a
dedicated radio channel exists between the network and
the MS
• MM connection-related procedures
– Procedures are used to establish, maintain, and release
a MM connection between the MS and MSC

Jenn-Wei Lin 162

81
 GSM
• GSM Protocol
– MM Sublayer (Cont.)
• MM specific procedures
– Location updating
• Keeping the network informed of where the mobile
is roaming
• Initiating by mobile station on either detecting that
it is in a new location area, or by receiving an
indication from the network that it is not know in
the VLR
– IMSI attach
• Invoking if an IMSI is activated in a MS (power on,
or SIM insertion) in the coverage area of network,
or an activated MS enters the network’s coverage
area from outside
Jenn-Wei Lin 163

GSM
• GSM Protocol
– MM Sublayer (Cont.)
• MM common procedures
– IMSI detach
• Indicating inactive status to the network
• Releasing any ongoing MM connections before the
MM detach
– TMSI reallocation
• Providing identity confidentiality to protect the
user from being located by an intruder
• Performing at each change of the MSC coverage
area
– Authentication
– Identification

Jenn-Wei Lin 164

82
 GSM
• GSM Protocol
– MM Sublayer (Cont.)
• MM connection related procedures
– Establish, maintain, and release a MM connection
between the MS and MSC
• Each connection is identified by the protocol
discriminator, and a transaction identifier
• Parallel calls can be distinguished by the
transaction identifier
– Provide services to the CM sublayer
• Enciphering (for privacy of user information)
• Authentication (of the users-access to the network
and the service request)

Jenn-Wei Lin 165

GSM
• GSM Protocol
– MM Sublayer (Cont.)
• MM connection related procedures
– Establish, maintain, and release a MM connection
between the MS and MSC
• Each connection is identified by the protocol
discriminator, and a transaction identifier
• Parallel calls can be distinguished by the
transaction identifier
– Provide services to the CM sublayer
• Enciphering (for privacy of user information)
• Authentication (of the users-access to the network
and the service request)

Jenn-Wei Lin 166

83
 GSM
• GSM Protocol
– CM Sublayer
• Call control
– Mobile originated and mobile terminated
– Call reestablishment when the call is dropped
• Supplementary services
– Call barring, call redirection, multi-party calls, and etc.
• Short message services
– Transmission and reception of point-to-point short
messages, and the reception of cell broadcast short
messages

Jenn-Wei Lin 167

GSM
• GSM Protocol
– Base Station Application Part (BSSAP)
• Base Station System Management Part (BSSMAP)
• Direct Tranfer Application Part (DTAP)

Jenn-Wei Lin 168

84
 GSM
• GSM Protocol
– BSSMAP
• Responsible for all of the administration and
control the radio resource of the BSS
• Some functions of RR require involvement of the
MSC (e.g., some handover situations, or release of
connections or channels)
• RR messages are mapped and covered within the
BSC into BSSMAP

Jenn-Wei Lin 169

GSM
• GSM Protocol
– DTAP
• Transport Call Control (CC) and Mobility
Management (MM) messages between MSC and
MS
• Pass transparently through the BSS to the MS
without interpretation

Jenn-Wei Lin 170

85
 GSM
• GSM Protocol
– Mobile Application Part (MAP)
• Procedures
– Roaming
• Location Registration/Update, IMI
Attach/Detach, requesting subscriber data
for call setup and paging
– Control of supplementary service and
handover
– Subscriber management
– IMEI management
– Authentication and identification management

Jenn-Wei Lin 171

GSM
• GSM Protocol
– MAP (Cont.)
• Interfaces
– B (MSC-VLR)
– C (MSC-HLR)
– D (HLR-VLR)
– E (MSC-MSC)
– G (VLR-VLR)

Jenn-Wei Lin 172

86
 GSM
• GSM-900/DCS-1800
– Dual mode

Jenn-Wei Lin 173

GSM
• GSM-900/DCS-1800
– Dual mode (Cont.)

Jenn-Wei Lin 174

87