Professional Documents
Culture Documents
UNIT – II
2
TEXT BOOKS:Jochen Schiller, Mobile Communications, PHI, Second Edn, 2003.
Mobile phone subscribers worldwide
1200
1000
GSM total
Subscribers [million]
800
TDMA total
CDMA total
600 PDC total
Analogue total
Total wireless
400
Prediction (1998)
200
0
year
1996 1997 1998 1999 2000 2001 2002
3
FDMA Development of mobile telecommunication systems
CT0/1
AMPS
NMT CT2
IMT-FT
IS-136 DECT
TDMA
TDMA
EDGE IMT-SC
D-AMPS
IS-136HS
GSM GPRS
UWC-136
PDC
IMT-DS
UTRA FDD / W-CDMA
IMT-TC
UTRA TDD / TD-CDMA
CDMA
IMT-TC
TD-SCDMA
IS-95 IMT-MC
cdma2000 1X
cdmaOne cdma2000 1X EV-DO
1X EV-DV
1G 2G 2.5G 3G (3X)
4
GSM: Overview
tele services
8
Bearer Services
9
Tele Services I
❑ Additional services
❑ Non-Voice-Teleservices
❑ group 3 fax
❑ voice mailbox (implemented in the fixed network
supporting the mobile terminals)
❑ electronic mail (MHS, Message Handling System,
implemented in the fixed network)
❑ ...
❑ Short Message Service (SMS)
alphanumeric data transmission to/from the mobile
terminal using the signaling channel, thus allowing
simultaneous use of basic services and SMS
11
Supplementary services
12
Architecture of the GSM system
13
GSM: overview
OMC, EIR,
AUC
HLR
GMSC
NSS fixed network
with OSS
BSC
BSC
RSS
14
GSM: elements and interfaces
radio cell
BSS
MS MS
Um radio cell
RSS BTS MS
BTS
Abis
BSC BSC
A
MSC MSC
15
GSM: system architecture
BTS Abis
BSC EIR
BTS
SS7
HLR
BTS VLR
BSC ISDN
BTS MSC
A PSTN
BS IWF
S PSPDN
CSPDN
16
System architecture: radio subsystem
radio network and switching
subsystem subsystem
Components
❑ MS (Mobile Station)
MS MS
❑ BSS (Base Station Subsystem):
consisting of
Um ⚫ BTS (Base Transceiver Station):
Abis sender and receiver
BTS
BSC MS ⚫ BSC (Base Station Controller):
BTS controlling several transceivers
C
Interfaces
❑ Um : radio interface
❑ Abis : standardized, open interface
A with
BTS
BSC MS 16 kbit/s user channels
BTS C
❑ A: standardized, open interface
BSS
with
64 kbit/s user channels
17
System architecture: network and switching subsystem
network fixed partner Components
subsystem networks MSC (Mobile Services Switching
Center):
ISDN IWF (Interworking Functions)
PSTN ISDN (Integrated Services Digital
MSC
Network)
PSTN (Public Switched Telephone
EIR Network)
PSPDN (Packet Switched Public Data
SS7
HLR Net.)
CSPDN (Circuit Switched Public Data
Net.)
VLR Databases
MSC ISDN HLR (Home Location Register)
IWF PSTN
VLR (Visitor Location Register)
PSPDN EIR (Equipment Identity Register)
CSPDN
18
Radio subsystem
19
GSM: cellular network
21
Base Transceiver Station and Base Station Controller
22
Mobile station
TE TA MT
Um
R S
23
Network and switching subsystem
24
Mobile Services Switching Center
25
Operation subsystem
26
GSM - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink
890-915 MHz
124 channels (200 kHz)
uplink
higher GSM frame structures
time
superframe
0 1 2 ... 48 49 50
6.12 s
0 1 ... 24 25
multiframe
0 1 ... 24 25 120 ms
0 1 2 ... 48 49 50 235.4 ms
frame
0 1 ... 6 7 4.615 ms
slot
burst 577 µs
28
GSM protocol layers for signaling
Um Abis A
MS BTS BSC MSC
CM CM
MM MM
BSSAP
BSSAP
RR RR’
RR’ BTSM BTSM
SS7 SS7
LAPDm LAPDm LAPD LAPD
29
Mobile Terminated Call
1: calling a GSM subscriber
2: forwarding call to GMSC
4
3: signal call setup to HLR HLR VLR
5
4, 5: request MSRN from VLR 8 9
3 6 14 15
6: forward responsible calling 7
PSTN GMSC MSC
MSC to GMSC station 1 2
10 10 13 10
7: forward call to 16
current MSC BSS BSS BSS
11 11 11
8, 9: get current status of MS
10, 11: paging of MS 11 12
17
12, 13: MS answers MS
1, 2: connection request
3, 4: security check
5-8: check resources (free VLR
circuit) 3 4
6 5
9-10: set up call PSTN GMSC MSC
7 8
2 9
1
MS BSS
10
31
MTC/MOC
MS MTC BTS MS MOC BTS
paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange
32
4 types of handover
1
2 3 4
MS MS MS MS
MSC MSC
33
Handover decision
HO_MARGIN
MS MS
BTSold BTSnew
34
Handover procedure
HO decision
HO required HO request
resource allocation
ch. activation
HO complete HO complete
clear command clear command
clear complete clear complete
35
Security in GSM
Security services
❑ access control/authentication
⚫ user SIM (Subscriber Identity Module): secret PIN (personal identification
number)
⚫ SIM network: challenge response method
❑ confidentiality
⚫ voice and signaling encrypted on the wireless link (after successful
authentication)
❑ anonymity “secret”:
⚫ temporary identity TMSI • A3 and A8
available via the
(Temporary Mobile Subscriber Identity) Internet
⚫ newly assigned at each new location update (LUP) • network providers
can use stronger
⚫ encrypted transmission mechanisms
3 algorithms specified in GSM
❑ A3 for authentication (“secret”, open interface)
❑ A5 for encryption (standardized)
❑ A8 for key generation (“secret”, open interface) 36
GSM - authentication
RAND
Ki RAND RAND Ki
A3 A3
SIM
SRES* 32 bit SRES 32 bit
SRES
MSC SRES* =? SRES SRES
32 bit
37
GSM - key generation and encryption
RAND
Ki RAND RAND Ki
AC 128 bit 128 bit 128 bit 128 bit SIM
A8 A8
cipher Kc
key 64 bit Kc
64 bit
data encrypted SRES
data
BSS
data MS
A5 A5
38
Data services in GSM I
Data transmission standardized with only 9.6 kbit/s
❑ advanced coding allows 14,4 kbit/s
❑ not enough for Internet and multimedia applications
HSCSD (High-Speed Circuit Switched Data)
❑ mainly software update
❑ bundling of several time-slots to get higher
AIUR (Air Interface User Rate)
(e.g., 115.2 kbit/s using 8 slots, 14.4 each)
❑ advantage: ready to use, constant quality, simple
❑ disadvantage: channels blocked for voice transmission
AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4
4.8 1
9.6 2 1
14.4 3 1
19.2 4 2
28.8 3 2
38.4 4
43.2 3
57.6 4
39
Data services in GSM II
GPRS (General Packet Radio Service)
❑ packet switching
❑ using free slots only if data packets ready to send
(e.g., 115 kbit/s using 8 slots temporarily)
❑ standardization 1998, introduction 2001
❑ advantage: one step towards UMTS, more flexible
❑ disadvantage: more investment needed (new hardware)
GPRS network elements
❑ GSN (GPRS Support Nodes): GGSN and SGSN
❑ GGSN (Gateway GSN)
⚫ interworking unit between GPRS and PDN (Packet Data Network)
❑ SGSN (Serving GSN)
⚫ supports the MS (location, billing, security)
❑ GR (GPRS Register)
⚫ user addresses
40
GPRS quality of service
41
GPRS architecture and interfaces
SGSN
Gn
Um Gb Gn Gi
MSC HLR/
GR
VLR EIR
42
GPRS protocol architecture
IP/X.25 IP/X.25
SNDCP GTP
SNDCP GTP
LLC LLC UDP/TCP UDP/TCP
RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio
43
DECT
DECT (Digital European Cordless Telephone) standardized by
ETSI (ETS 300.175-x) for cordless telephones
❑ standard describes air interface between base-station and
mobile phone
❑ DECT has been renamed for international marketing reasons
into „Digital Enhanced Cordless Telecommunication“
❑ Characteristics
❑ frequency: 1880-1990 MHz
❑ channels: 120 full duplex
❑ duplex mechanism: TDD (Time Division Duplex) with 10 ms frame
length
❑ multplexing scheme: FDMA with 10 carrier frequencies,
TDMA with 2x 12 slots
❑ modulation: digital, Gaußian Minimum Shift Key (GMSK)
❑ power: 10 mW average (max. 250 mW)
❑ range: approx. 50 m in buildings, 300 m open space
44
DECT system architecture reference model
D4 D3
D2 VDB
PA PT
FT
local HDB
network
PA PT D1
global
FT network
local
network
45
DECT reference model
C-Plane U-Plane
❑ close to the OSI reference
signaling, application
interworking processes model
❑ management plane over
all layers
❑ several services in
network C(ontrol)- and U(ser)-
management
OSI layer 3
layer plane
data link data link
control control
OSI layer 2
medium access control
46
DECT layers I
❑ Physical layer
❑ modulation/demodulation
❑ generation of the physical channel structure with a guaranteed
throughput
❑ controlling of radio transmission
⚫ channel assignment on request of the MAC layer
⚫ detection of incoming signals
⚫ sender/receiver synchronization
⚫ collecting status information for the management plane
❑ MAC layer
❑ maintaining basic services, activating/deactivating physical channels
❑ multiplexing of logical channels
⚫ e.g., C: signaling, I: user data, P: paging, Q: broadcast
❑ segmentation/reassembly
❑ error control/error correction
47
DECT time multiplex frame
1 frame = 10 ms
48
DECT layers II
❑ Data link control layer
❑ creation and keeping up reliable connections between the mobile
terminal and basestation
❑ two DLC protocols for the control plane (C-Plane)
⚫ connectionless broadcast service: paging functionality
⚫ Lc+LAPC protocol:
in-call signaling (similar to LAPD within ISDN), adapted to the underlying
MAC service
❑ several services specified for the user plane (U-Plane)
⚫ null-service: offers unmodified MAC services
⚫ frame relay: simple packet transmission
⚫ frame switching: time-bounded packet transmission
⚫ error correcting transmission: uses FEC, for delay critical, time-bounded
services
⚫ bandwidth adaptive transmission
⚫ „Escape“ service: for further enhancements of the standard
49
DECT layers III
❑ Network layer
❑ similar to ISDN (Q.931) and GSM (04.08)
❑ offers services to request, check, reserve, control, and
release resources at the basestation and mobile terminal
❑ resources
⚫ necessary for a wireless connection
⚫ necessary for the connection of the DECT system to the fixed
network
❑ main tasks
⚫ call control: setup, release, negotiation, control
⚫ call independent services: call forwarding, accounting, call redirecting
⚫ mobility management: identity management, authentication,
management of the location register
50
Enhancements of the standard
GAP
❑ DECT/GSM Interworking Profile (GIP): connection to GSM
❑ ISDN Interworking Profiles (IAP, IIP): connection to ISDN
❑ Radio Local Loop Access Profile (RAP): public telephone service
❑ CTM Access Profile (CAP): support for user mobility
51
TETRA - Terrestrial Trunked Radio
52
TDMA structure of the voice+data system
hyperframe
0 1 2 ... 57 58 59 61.2 s
multiframe
0 1 2 ... 15 16 17 1.02 s
CF
frame
0 1 2 3 56.67 ms Control Frame
0 slot 509
14.17 ms
53
UMTS and IMT-2000
Proposals for IMT-2000 (International Mobile
Telecommunications)
❑ UWC-136, cdma2000, WP-CDMA
❑ UMTS (Universal Mobile Telecommunications System) from ETSI
UMTS
❑ UTRA (was: UMTS, now: Universal Terrestrial Radio Access)
❑ enhancements of GSM
⚫ EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s
⚫ CAMEL (Customized Application for Mobile Enhanced Logic)
⚫ VHE (virtual Home Environment)
❑ fits into GMM (Global Multimedia Mobility) initiative from ETSI
❑ requirements
⚫ min. 144 kbit/s rural (goal: 384 kbit/s)
⚫ min. 384 kbit/s suburban (goal: 512 kbit/s)
⚫ up to 2 Mbit/s urban
54
Frequencies for IMT-2000
T T
GSM DE UTRA MSS UTRA MSS
Europe D D
1800 CT D FDD D FDD
MSS MSS
North PCS rsv.
America
1850 1900 1950 2000 2050 2100 2150 2200 MHz
55
IMT-2000 family
Interface
for Internetworking
IMT-2000
GSM ANSI-41
Core Network IP-Network
(MAP) (IS-634)
ITU-T
56
Licensing Example: UMTS in Germany, 18. August 2000
❑ UTRA-FDD:
❑ Uplink 1920-1980 MHz
❑ Downlink 2110-2170 MHz
❑ duplex spacing 190 MHz
❑ 12 channels, each 5 MHz
❑ UTRA-TDD:
❑ 1900-1920 MHz,
❑ 2010-2025 MHz;
❑ 5 MHz channels
❑ Coverage: 25% of the
population until 12/2003,
50% until 12/2005
57
UMTS architecture (Release 99 used here!)
UE (User Equipment)
CN (Core Network)
❑ Inter
system handover
❑ Location management if there is no dedicated connection
between UE and UTRAN
Uu Iu
UE UTRAN CN
58
UMTS domains and interfaces I
Home
Network
Domain
Zu
Cu Uu Iu Yu
Mobile Access Serving Transit
USIM
Equipment Network Network Network
Domain
Domain Domain Domain Domain
59
UMTS domains and interfaces II
Universal Subscriber Identity Module (USIM)
❑ Functions for encryption and authentication of users
❑ Located on a SIM inserted into a mobile device
Mobile Equipment Domain
❑ Functions for radio transmission
❑ User interface for establishing/maintaining end-to-end connections
Access Network Domain
❑ Access network dependent functions
Core Network Domain
❑ Access network independent functions
❑ Serving Network Domain
⚫ Network currently responsible for communication
❑ Home Network Domain
⚫ Location and access network independent functions
60
Spreading and scrambling of user data
scrambling scrambling
code1 code2
sender1 sender2
61
OSVF coding
1,1,1,1,1,1,1,1
1,1,1,1 ...
1,1,1,1,-1,-1,-1,-1
1,1
1,1,-1,-1,1,1,-1,-1
1,1,-1,-1 ...
X,X
1,1,-1,-1,-1,-1,1,1
X 1
1,-1,1,-1,1,-1,1,-1
X,-X 1,-1,1,-1 ...
1,-1,1,-1,-1,1,-1,1
SF=n SF=2n 1,-1
1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 ...
1,-1,-1,1,-1,1,1,-1
62
UMTS FDD frame structure
❑W-CDMA
Radio frame ❑ 1920-1980 MHz uplink
❑ 2110-2170 MHz downlink
10 ms 0 1 2 ... 12 13 14
❑ chipping rate:
3.840 Mchip/s
Time slot
❑ soft handover
666.7 µs Pilot TFCI FBI TPC uplink DPCCH ❑ QPSK
2560 chips, 10 bits
❑ complex power control
(1500 power control
666.7 µs Data uplink DPDCH cycles/s)
2560 chips, 10*2k bits (k = 0...6)
❑ spreading: UL: 4-256;
DL:4-512
666.7 µs Data1 TPC TFCI Data2 Pilot downlink DPCH
63
UMTS TDD frame structure (burst type 2)
Radio frame
10 ms 0 1 2 ... 12 13 14
Time slot
666.7 µs Data Midample Data Traffic burst
GP
1104 chips 256 chips 1104 chips
GP: guard period
2560 chips 96 chips
❑TD-CDMA
❑ 2560 chips per slot
❑ spreading: 1-16
❑ symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction)
❑ tight synchronisation needed
❑ simpler power control (100-800 power control cycles/s)
64
UTRAN architecture
RNS RNC: Radio Network Controller
RNS: Radio Network Subsystem
UE1 Node B Iub
Iu
RNC CN
UE2
Node B UTRAN comprises several
RNSs
UE3 Node B can support FDD or
TDD or both
Iur
Node B RNC is responsible for handover
Iub decisions requiring
signalingto the UE
Node B
RNC Cell offers FDD or TDD
Node B
RNS
65
UTRAN architecture
RNS RNC: Radio Network Controller
UE
RNS: Radio Network Subsystem
Node B Iub
UTRAN comprises several RNSs
RNC Node B can support FDD or TDD
Iu
or both
Node B
CN
Iur
Node B RNC is responsible for handover
Iub
decisions requiring signaling
Node B to the UE
RNC
Cell offers FDD or TDD
Node B
RNS
66
UTRAN functions
❑ Admission control
❑ Congestion control
❑ System information broadcasting
❑ Radio channel encryption
❑ Handover
❑ SRNS moving
❑ Radio network configuration
❑ Channel quality measurements
❑ Macro diversity
❑ Radio carrier control
❑ Radio resource control
❑ Data transmission over the radio interface
❑ Outer loop power control (FDD and TDD)
❑ Channel coding
❑ Access control
67
Core network: protocols
VLR
PSTN/
MSC GMSC
GSM-CS ISDN
RNS
backbone
HLR
RNS
UTRAN CN
68
Core network: architecture
VLR
BSS
BTS Abis Iu
GR
Node B
Iub
Node B
RNC SGSN GGSN
Gn Gi
Node B IuPS
RNS CN
69
Core network
The Core Network (CN) and thus the Interface Iu, too, are separated into
two logical domains:
❑ Circuit Switched Domain (CSD)
❑ Circuit switched service incl. signaling
❑ Resource reservation at connection setup
❑ GSM components (MSC, GMSC, VLR)
❑ IuCS
❑ Packet Switched Domain (PSD)
❑ GPRS components (SGSN, GGSN)
❑ IuPS
❑ Release 99 uses the GSM/GPRS network and adds a new radio
access!
❑ Helps to save a lot of money …
❑ Much faster deployment
❑ Not as flexible as newer releases (5, 6)
70
UMTS protocol stacks (user plane)
UE Uu UTRAN IuCS 3G
MSC
apps. &
protocols
Circuit RLC
RLC SAR
SAR
switched MAC MAC AAL2 AAL2
UE Uu UTRAN IuPS 3G Gn 3G
apps. & SGSN GGSN
protocols
IP, PPP, IP tunnel IP, PPP,
… …
Packet PDCP GTP
PDCP GTP GTP GTP
switched RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
MAC MAC AAL5 AAL5 L2 L2
radio radio ATM ATM L1 L1
71
Support of mobility: macro diversity
UE Node B
Uplink
❑ simultaneous reception of UE
data at several Node Bs
❑ Reconstruction of data at
Node B RNC CN Node B, SRNC or DRNC
Downlink
❑ Simultaneous transmission of
data via different cells
❑ Different spreading codes in
different cells
72
Support of mobility: handover
Node B SRNC CN
Iub Iu
UE Iur
Node B DRNC
Iub
73
Example handover types in UMTS/GSM
UE1
Node B1 RNC1 3G MSC1
Iu
UE2
Node B2 Iub Iur
UE4
BTS BSC 2G MSC3
Abis A
74
UMTS services (originally)
75
Questions?