GSM and Umts: Mobile Phone Subscribers Worldwide

Mobile phone subscribers worldwide approx. 1.
7 bn
1600
1400
1200
Subscribers [million]
GSM total
GSM and UMTS 1000 TDMA total

CDMA total
800 PDC total
Analogue total
W-CDMA
600
Market UMTS/IMT-2000 Total wireless
Prediction (1998)
GSM 400
Overview
Services 200
Sub-systems
0
Components
1996 1997 1998 1999 2000 2001 2002 2003 2004 year
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 1 Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 2
Development of mobile telecommunication systems How does it work?

FDMA
CT0/1
AMPS
NMT CT2 How can the system locate a user?
IMT-FT
IS-136 DECT Why don’t all phones ring at the same time?
TDMA What happens if two users talk simultaneously?
TDMA
EDGE IMT-SC
D-AMPS
IS-136HS Why don’t I get the bill from my neighbor?
GSM GPRS
UWC-136 Why can an Australian use her phone in Berlin?
PDC
IMT-DS
UTRA FDD / W-CDMA
IMT-TC HSDPA
Why can’t I simply overhear the neighbor’s
UTRA TDD / TD-CDMA
communication?
CDMA
IMT-TC How secure is the mobile phone system?

TD-SCDMA
IS-95 IMT-MC
What are the key components of the mobile
cdma2000 1X phone network?
cdmaOne cdma2000 1X EV-DO
1X EV-DV
1G 2G 2.5G 3G (3X)
GSM: Overview Performance characteristics of GSM (wrt. analog sys.)
GSM Communication
formerly: Groupe Spéciale Mobile (founded 1982) mobile, wireless communication; support for voice and data
services
now: Global System for Mobile Communication
Pan-European standard (ETSI, European Telecommunications Total mobility
Standardisation Institute) international access, chip-card enables use of access points of
simultaneous introduction of essential services in three phases (1991, different providers
1994, 1996) by the European telecommunication administrations Worldwide connectivity
(Germany: D1 and D2) one number, the network handles localization
seamless roaming within Europe possible
High capacity
today many providers all over the world use GSM (more than 200
better frequency efficiency, smaller cells, more customers per cell
countries in Asia, Africa, Europe, Australia, America)
more than 1.2 billion subscribers in more than 630 networks High transmission quality
more than 75% of all digital mobile phones use GSM (74% total) high audio quality and reliability for wireless, uninterrupted phone
calls at higher speeds (e.g., from cars, trains)
over 200 million SMS per month in Germany, > 550 billion/year worldwide
(> 10% of the revenues for many operators) Security functions
[be aware: these are only rough numbers…] access control, authentication via chip-card and PIN
Disadvantages of GSM GSM: Mobile Services
There is no perfect system!! GSM offers

no end-to-end encryption of user data several types of connections
voice connections, data connections, short message service
no full ISDN bandwidth of 64 kbit/s to the user, no transparent B- multi-service options (combination of basic services)
channel
Three service domains
B-channel (bearer channel): channel that carries main data
Bearer Services
Telematic Services
reduced concentration while driving Supplementary Services
electromagnetic radiation Enhancements for standard telephony service
bearer services
abuse of private data possible MS
roaming profiles accessible transit source/
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)
high complexity of the system
several incompatibilities within the GSM standards tele services
Bearer Services Tele Services I
Telecommunication services to transfer data between access points Telecommunication services that enable voice communication
Specification of services up to the terminal interface (OSI layers 1-3) via mobile phones
Different data rates for voice and data (original standard) All these basic services have to obey cellular functions, security
data service (circuit switched) measurements etc.
synchronous: 2.4, 4.8 or 9.6 kbit/s encrypted voice transmission, message services, and basic data
asynchronous: 300 - 1200 bit/s communication with terminals as known from the PSTN or ISDN
data service (packet switched) Offered services
synchronous: 2.4, 4.8 or 9.6 kbit/s mobile telephony
asynchronous: 300 - 9600 bit/s primary goal of GSM was to enable mobile telephony offering the
traditional bandwidth of 3.1 kHz
transparent bearer services Emergency number
do not try to recover lost data common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the highest
non-transparent bearer services priority (preemption of other connections possible)
use protocols of layers 2 and 3 to implement error correction and flow control
Multinumbering
several ISDN phone numbers per user possible
Today: data rates of approx. 50 kbit/s possible – will be covered later! according to the desired service
Tele Services II Supplementary services
Additional services Services in addition to the basic services, cannot be offered

Non-Voice-Teleservices stand-alone
group 3 fax Similar to ISDN services besides lower bandwidth due to the
voice mailbox (implemented in the fixed network supporting the mobile radio link
terminals) May differ between different service providers, countries and
electronic mail (MHS, Message Handling System, implemented in the fixed protocol versions
network)
... Important services
identification: forwarding of caller number
Short Message Service (SMS) suppression of number forwarding
alphanumeric data transmission to/from the mobile terminal (160 automatic call-back: keep trying the number until getting through
characters) using the signaling channel, thus allowing simultaneous use of
basic services and SMS conferencing with up to 7 participants
(almost ignored in the beginning now the most successful add-on!) locking of the mobile terminal (incoming or outgoing calls)
...
Architecture of the GSM system (GSM-PLMN) Ingredients 1: Mobile Phones, PDAs & Co.
GSM is a PLMN (Public Land Mobile Network)

several providers setup mobile networks following the GSM standard within
each country
components
MS (mobile station)
BS (base station)
MSC (mobile switching center)
LR (location register)
subsystems
RSS (radio subsystem): covers all radio aspects
The visible but smallest
NSS (network and switching subsystem): call forwarding, handover, switching
OSS (operation subsystem): management of the network
part of the network!
Ingredients 2: Antennas Ingredients 3: Infrastructure 1
Base Stations
Cabling
Microwave links
Still visible – cause many discussions…

Ingredients 3: Infrastructure 2 GSM: overview
OMC, EIR,
Not „visible“, but AUC
HLR
comprise the major part GMSC
NSS fixed network
of the network (also with OSS
from an investment VLR MSC MSC
VLR
point of view…)
BSC
Management BSC
Data bases RSS
Switching units
Monitoring
GSM: elements and interfaces GSM: system architecture

radio network and fixed
subsystem switching subsystem partner networks
radio cell
BSS MS MS
MS MS
ISDN
Um radio cell PSTN
MS Um MSC
RSS BTS
BTS Abis
BTS BSC EIR
BTS
Abis
BSC BSC
SS7
A HLR
MSC MSC
NSS VLR VLR signaling

BTS VLR
HLR ISDN, PSTN
GMSC
IWF
PDN BSC ISDN
BTS MSC PSTN
O A
BSS IWF
OSS EIR AUC OMC
PSPDN
CSPDN
System architecture: radio subsystem System architecture: network and switching subsystem
radio network and switching network fixed partner
subsystem subsystem subsystem networks
Components
MS MS MSC (Mobile Services Switching Center):
Components ISDN IWF (Interworking Functions)
MS (Mobile Station) PSTN
Um MSC
BSS (Base Station Subsystem):
ISDN (Integrated Services Digital Network)
BTS Abis consisting of
BTS (Base Transceiver Station):
PSTN (Public Switched Telephone Network)
BSC MSC EIR
BTS sender and receiver PSPDN (Packet Switched Public Data Net.)
BSC (Base Station Controller): CSPDN (Circuit Switched Public Data Net.)
SS7
controlling several transceivers
HLR
Interfaces Databases
Um : radio interface HLR (Home Location Register)
A VLR
BTS Abis : standardized, open interface with VLR (Visitor Location Register)
BSC MSC 16/64 kbit/s user channels
BTS MSC
ISDN EIR (Equipment Identity Register)
A: standardized, open interface with PSTN
BSS IWF
64 kbit/s user channels PSPDN
CSPDN
Radio subsystem GSM: cellular network
The Radio Subsystem (RSS) comprises the cellular mobile network up to segmentation of the area into cells
the switching centers
Components possible radio coverage of the cell
Base Station Subsystem (BSS):

Base Transceiver Station (BTS): radio components including sender, receiver,
antenna - if directed antennas are used one BTS can cover several cells idealized shape of the cell
Base Station Controller (BSC): switching between BTSs, controlling BTSs, cell
managing of network resources, mapping of radio channels (Um) onto terrestrial
channels (A interface)
use of several carrier frequencies
BSS = BSC + sum(BTS) + interconnection not the same frequency in adjoining cells
cell sizes vary from some 100 m up to 35 km depending on user
Mobile Stations (MS) density, geography, transceiver power etc.
hexagonal shape of cells is idealized (cells overlap, shapes depend on
geography)
if a mobile user changes cells
handover of the connection to the neighbor cell
GSM frequency bands Example coverage of GSM networks (www.gsmworld.com)
T-Mobile (GSM-900/1800) Germany O2 (GSM-1800) Germany

Type Channels Uplink [MHz] Downlink [MHz]
GSM 850 128-251 824-849 869-894

(Americas)
GSM 900 0-124, 955-1023 876-915 921-960
classical 124 channels 890-915 935-960
extended +49 channels 880-915 925-960
GSM 1800 512-885 1710-1785 1805-1880
AT&T (GSM-850/1900) USA Vodacom (GSM-900) South Africa
GSM 1900 512-810 1850-1910 1930-1990
(Americas)
GSM-R 955-1024, 0-124 876-915 921-960

exclusive 69 channels 876-880 921-925
- Additionally: GSM 400 (also named GSM 450 or GSM 480 at 450-458/460-468 or 479-486/489-496 MHz
- Please note: frequency ranges may vary depending on the country!
- Channels at the lower/upper edge of a frequency band are typically not used
Base Transceiver Station and Base Station Controller Mobile station
Tasks of a BSS are distributed over BSC and BTS

Terminal for the use of GSM services
BTS comprises radio specific functions
A mobile station (MS) comprises several functional groups
BSC is the switching center for radio channels MT (Mobile Terminal):
offers common functions used by all services the MS offers
Functions BTS BSC
Management of radio channels X corresponds to the network termination (NT) of an ISDN access
Frequency hopping (FH) X X end-point of the radio interface (Um)
Management of terrestrial channels X TA (Terminal Adapter):
Mapping of terrestrial onto radio channels X
terminal adaptation, hides radio specific characteristics
Channel coding and decoding X
Rate adaptation X TE (Terminal Equipment):
Encryption and decryption X X peripheral device of the MS, offers services to a user
Paging X X does not contain GSM specific functions
Uplink signal measurements X
Traffic measurement X SIM (Subscriber Identity Module):
Authentication X personalization of the mobile terminal, stores user parameters
Location registry, location update X
Handover management X
TE TA MT
Um
R S
Network and switching subsystem Mobile Services Switching Center
NSS is the main component of the public mobile network GSM The MSC (mobile switching center) plays a central role in GSM
switching, mobility management, interconnection to other networks, system switching functions
control additional functions for mobility support
mobility management: handovers between different BSSs management of network resources
Components interworking functions via Gateway MSC (GMSC)
Mobile Services Switching Center (MSC) integration of several databases
controls all connections via a separated network to/from a mobile terminal Functions of a MSC
within the domain of the MSC - several BSC can belong to a MSC specific functions for paging and call forwarding
Databases (important: scalability, high capacity, low delay) termination of SS7 (signaling system no. 7)
Home Location Register (HLR) SS7: handles all signalling needed for connection setup, connection release and
central master database containing user data, permanent and semi-permanent handover of connections to other MSCs
(dynamic) data of all subscribers assigned to the HLR (one provider can have mobility specific signaling
several HLRs) location registration and forwarding of location information
Visitor Location Register (VLR) provision of new services (fax, data calls)
local database for a subset of user data, including data about all user currently support of short message service (SMS)
in the domain of the VLR
– avoid frequent HLR updates and long-distance signalling of user information
generation and forwarding of accounting and billing information
Operation subsystem GSM - TDMA/FDMA
The OSS (Operation Subsystem) enables network operation, 935-960 MHz

management, and maintenance of all GSM subsystems 124 channels (200 kHz)
downlink
Components
y
nc
e
qu
890-915 MHz
Authentication Center (AUC)
fre
124 channels (200 kHz)
situated in a special protected part of the HLR uplink
generates user specific authentication parameters on request of a VLR higher GSM frame structures
authentication parameters used for authentication of mobile terminals and time
encryption of user data on the air interface within the GSM system
Equipment Identity Register (EIR) GSM TDMA frame
registers GSM mobile stations and user rights 1 2 3 4 5 6 7 8
stolen or malfunctioning mobile stations can be locked and sometimes even
localized 4.615 ms
Operation and Maintenance Center (OMC)

GSM time-slot (normal burst)
different control capabilities for the radio subsystem and the network subsystem
guard guard
traffic monitoring, status reports of network entities, subscriber and security tail user data S Training S user data tail space
space
management, or accounting and billing
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
GSM – TDMA/FDMA (Definitions) GSM hierarchy of frames
hyperframe: count each TDMA frame as input for encryption algorithm
Normal burst
0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s
data transmission
Tail superframe
set to 0 0 1 2 ... 48 49 50
used to enhance the receiver performance 6.12 s
0 1 ... 24 25
Training sequence
adapt the parameters of the receiver to the current path propagation characteristics multiframe
select the strongest signal in case of multi-path propagation 0 1 ... 24 25 120 ms (traffic)
Flag S 0 1 2 ... 48 49 50 235.4 ms (control)

indicate whether the data field contains user or network control data
frame
Guard space
0 1 ... 6 7 4.615 ms
avoid overlapping with other bursts due to different path delays
give the transmitter time to turn on and off slot
burst 577 µs
GSM protocol layers for signaling GSM protocol layers for signaling (Definitions)
Layer 1
handles all radio-specific functions
Um Abis A LAPDm
MS BTS BSC MSC offers reliable data transfer over connections
re-sequencing of data frames
CM CM flow control
LAPD: LAPDm + synchronization and checksumming for error detection
MM MM Radio resource management (RR)
BSSAP setup, maintenance, and release of radio channels
BSSAP
RR RR’ Mobility management (MM)
RR’ BTSM BTSM
SS7 SS7 functions for registration, authentication, identification, location updating, and the
LAPDm LAPDm LAPD LAPD provision of a temporary mobile subscriber identity (TMSI)
Call management (CM)
radio radio PCM PCM PCM PCM call control, short message service, and supplementary service
Pulse code modulation (PCM)
offer transparent 64 kbps digital channels
16/64 kbit/s 64 kbit/s / BTS management (BTSM)
2.048 Mbit/s functions of RR’ supported by BSC via BTS
BSS application part (BSSAP)
controls a BSS by MSC
Mobile Terminated Call Mobile Originated Call
1: calling a GSM subscriber 1, 2: connection request

2: forwarding call to GMSC 3, 4: security check
3: signal call setup to HLR 4 5-8: check resources (free circuit)
HLR VLR
4, 5: request MSRN from VLR 5 9-10: set up call
8 9 VLR
6: forward responsible 3 6 14 15
MSC to GMSC calling 7 3 4
PSTN GMSC MSC
7: forward call to station 1 2 6 5
PSTN GMSC MSC
current MSC 10 10 13 10
16 7 8
8, 9: get current (availability) status of MS 2 9
BSS BSS BSS
10, 11: paging of MS 11 11 11 1
MS BSS
12, 13: MS answers 10
14, 15: security checks 11 12
17
16, 17: set up connection
MS
MSRN: mobile station roaming number
MTC/MOC 4 types of handover

MS MTC BTS MS MOC BTS
paging request
channel request channel request 1
2 3 4
immediate assignment immediate assignment
paging response service request MS MS MS MS
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
BTS BTS BTS BTS
ciphering complete ciphering complete
setup setup
call confirmed call confirmed BSC BSC BSC
assignment command assignment command
assignment complete assignment complete MSC MSC
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange
GSM Handover Handover decision
Intra-cell handover
change the carrier frequency
receive level receive level
Inter-cell, intra-BSC handover BTSold BTSold
assign a new radio channel in the new cell and release the old one
Inter-BSC, intra-MSC handover

perform handovers between cells controlled by different BSCs
HO_MARGIN
Inter-MSC handover
handover between two cells belonging to different MSCs MS MS
BTSold BTSnew
Handover procedure Security in GSM
Security services
MS BTSold BSCold MSC BSCnew BTSnew access control/authentication
measurement measurement user SIM (Subscriber Identity Module): secret PIN (personal identification
report result number)
SIM network: challenge response method
HO decision
– challenge: random number; response: signed response (SRES)
HO required HO request confidentiality
resource allocation voice and signaling encrypted on the wireless link (after successful authentication)
ch. activation anonymity
temporary identity TMSI
HO command HO request ack ch. activation ack
HO command (Temporary Mobile Subscriber Identity) “secret”:
HO command
HO access newly assigned at each new location update (LUP) • A3 and A8
encrypted transmission available via the
Link establishment Internet
HO complete
HO complete 3 algorithms specified in GSM • network providers
HO complete
clear command clear command A3 for authentication (“secret”, open interface) can use stronger
mechanisms
clear complete clear complete A5 for encryption (standardized)
A8 for key generation (“secret”, open interface)
A3 and A8: proprietary
GSM - authentication GSM - key generation and encryption
mobile network SIM mobile network (BTS) MS with SIM
RAND RAND
Ki RAND RAND Ki Ki RAND RAND Ki
128 bit 128 bit 128 bit 128 bit AC 128 bit 128 bit 128 bit 128 bit SIM
AC
A3 A3 A8 A8
SIM
SRES* 32 bit SRES 32 bit cipher Kc
key 64 bit Kc
64 bit
SRES
MSC SRES* =? SRES SRES data encrypted SRES
data
32 bit BSS
data MS
(BTS / BSC)
A5 A5
Ki: individual subscriber authentication key SRES: signed response
Data services in GSM I Data services in GSM II

Data transmission standardized with only 9.6 kbit/s GPRS (General Packet Radio Service)
advanced coding allows 14,4 kbit/s packet switching
not enough for Internet and multimedia applications using free slots only if data packets ready to send
HSCSD (High-Speed Circuit Switched Data) (e.g., 50 kbit/s using 4 slots temporarily)
mainly software update (upgrades in MS and MSC) standardization 1998, introduction 2001
bundling of several time-slots to get higher advantage: one step towards UMTS, more flexible
AIUR (Air Interface User Rate)
(e.g., 57.6 kbit/s using 4 slots, 14.4 each) disadvantage: more investment needed (new hardware)
advantage: ready to use, constant quality, simple GPRS network elements
disadvantage: channels blocked for voice transmission GSN (GPRS Support Nodes): GGSN and SGSN
still use the connection-oriented mechanisms of GSM GGSN (Gateway GSN)
AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4 interworking unit between GPRS and PDN (Packet Data Network)
4.8 1
9.6 2 1 SGSN (Serving GSN)
14.4 3 1 supports the MS (location, billing, security)
19.2 4 2
28.8 3 2 GR (GPRS Register)
38.4 4 user addresses
43.2 3
mapping between a mobile’s identity and the PSPDN address
57.6 4
GPRS quality of service Examples for GPRS device classes
Reliability Lost SDU Duplicate Out of Corrupt SDU

class probability SDU sequence probability
probability SDU
probability Receiving
Class Sending slots Maximum number of slots
1 10-9 10-9 10-9 10-9 slots
2 10-4 10-5 10-5 10-6 1 1 1 2
3 10-2 10-5 10-5 10-2
2 2 1 3
3 2 2 3
Delay SDU size 128 byte SDU size 1024 byte
class mean 95 percentile mean 95 percentile 5 2 2 4
1 < 0.5 s < 1.5 s <2s <7s 8 4 1 5
2 <5s < 25 s < 15 s < 75 s
3 < 50 s < 250 s < 75 s < 375 s 10 4 2 5
4 unspecified 12 4 4 5
Delay
-- channel access delay, coding for error correction, and transfer delay
in the fixed and wireless part of the GPRS network
GPRS user data rates in kbit/s GPRS architecture and interfaces
SGSN
Gn
Coding 1 slot 2 slots 3 slots 4 slots 5 slots 6 slots 7 slots 8 slots BSS SGSN GGSN PDN
MS
scheme
CS-1 9.05 18.1 27.15 36.2 45.25 54.3 63.35 72.4 Um Gb Gn Gi

CS-2 13.4 26.8 40.2 53.6 67 80.4 93.8 107.2
CS-3 15.6 31.2 46.8 62.4 78 93.6 109.2 124.8 MSC HLR/
GR
CS-4 21.4 42.8 64.2 85.6 107 128.4 149.8 171.2
VLR EIR
GPRS protocol architecture GPRS protocol architecture (Definitions)
Base station subsystem GPRS protocol (BSSGP)

MS BSS SGSN Convey routing and QoS-related information between BSS and SGSN
Um Gb Gn GGSN Gi
apps.
Subnetwork dependent convergence protocol (SNDCP)
IP/X.25 IP/X.25
adapt to different characteristics of the underlying networks between SGSN
SNDCP
SNDCP GTP
GTP and MS
LLC LLC UDP/TCP UDP/TCP transport between GSNs within the GPRS backbone
RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio
Original Goals for 3G UMTS and IMT-2000
Establish a common worldwide communication system Proposals for IMT-2000 (International Mobile Telecommunications)
allowed for terminal and user mobility UWC-136, cdma2000, WP-CDMA
UMTS (Universal Mobile Telecommunications System) from ETSI
Support the idea of universal personal telecommunication UMTS
UTRA (was: UMTS, now: Universal Terrestrial Radio Access)
enhancements of GSM
EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s
– enhanced modulation schemes
CAMEL (Customized Application for Mobile Enhanced Logic)
– intelligent network support
VHE (Virtual Home Environment)
fits into GMM (Global Multimedia Mobility) initiative from ETSI
provide an architecture to integrate mobile and fixed terminals, many different
access networks, and core transport networks
requirements
min. 144 kbit/s rural (goal: 384 kbit/s)
min. 384 kbit/s suburban (goal: 512 kbit/s)
up to 2 Mbit/s urban
Frequencies for IMT-2000 IMT-2000 family
IS-634: define the messaging interface between TDMA, BS, and MSC
1850 1900 1950 2000 2050 2100 2150 2200 MHz
Interface
ITU allocation MSS MSS for Internetworking
(WRC 1992) IMT-2000 ↑
IMT-2000
↓
T T
GSM DE UTRA MSS UTRA MSS IMT-2000
Europe D D GSM ANSI-41
1800 CT D FDD ↑ ↑ D FDD ↓ ↓ Core Network IP-Network
(MAP) (IS-634)
ITU-T
GSM MSS MSS
China IMT-2000 ↑
IMT-2000
↓
1800
Initial UMTS Flexible assignment of
cdma2000 MSS cdma2000 MSS (R99 w/ FDD) Core Network and Radio Access
Japan PHS
W-CDMA ↑ W-CDMA ↓
MSS MSS IMT-DS IMT-TC IMT-MC IMT-SC IMT-FT

North PCS rsv. (Time Code)
↑ ↓ (Direct Spread) (Multi Carrier) (Single Carrier) (Freq. Time)
America IMT-2000 UTRA TDD
Radio Access UTRA FDD (TD-CDMA); cdma2000 UWC-136 DECT
1850 1900 1950 2000 2050 2100 2150 2200 MHz
ITU-R (W-CDMA) TD-SCDMA (EDGE)
3GPP 3GPP 3GPP2 UWCC/3GPP ETSI
GSM and UMTS Releases GSM and UMTS Releases (Definitions)
Release 99
Spec version Freeze date
GSM/EDGE Release 3G Release Abbreviated name new radio access technologies
number (indicative only)
December 2004 -
Phase 2+ Release 6 Release 6 Rel-6 6.x.y
March 2005
Phase 2+ Release 5 Release 5 Rel-5 5.x.y March - June 2002
Release 4
Phase 2+ Release 4 Release 4 Rel-4 4.x.y March 2001 introduces QoS in fixed network plus several execution environments and
- Release 2000 4.x.y new service architectures
R00 Renaming…
Phase 2+ Release 2000 - 9.x.y
- Release 1999
R99
3.x.y
March 2000
Release 5
Phase 2+ Release 1999 - 8.x.y radically different core (all-IP) network
Phase 2+ Release 1998 - R98 7.x.y early 1999
Phase 2+ Release 1997 - R97 6.x.y early 1998 Release 6

Phase 2+ Release 1996 - R96 5.x.y early 1997 comprises the use of MIMO antennas, enhanced MMS, security
Phase 2 - Ph2 4.x.y 1995
enhancements, WLAN/UMTS interworking, broadcast/multicast services,
Phase 1 - Ph1 3.x.y 1992
enhanced IMS, IP emergency calls, and many more management features
Licensing Example: UMTS in Germany, 18. August 2000 UMTS architecture (Release 99 used here!)
UTRAN (UTRA Network)

UTRA-FDD:
handles cell level mobility
Uplink 1920-1980 MHz Radio Network Subsystem (RNS)
Downlink 2110-2170 MHz radio channel ciphering and deciphering, handover control, radio resource
duplex spacing 190 MHz management
12 channels, each 5 MHz Encapsulation of all radio specific tasks
UTRA-TDD: UE (User Equipment)
comprises all the functions needed to access UMTS services
1900-1920 MHz,
2010-2025 MHz;
CN (Core Network)
Inter system handover
5 MHz channels
gateways to other networks (fixed or wireless)
Coverage of the population Location management if there is no dedicated connection between UE and
25% until 12/2003 UTRAN
Uu Iu
50% until 12/2005
UE UTRAN CN
Sum: 50.81 billion €
UMTS domains and interfaces I UMTS domains and interfaces II
Home Universal Subscriber Identity Module (USIM)

Network Functions for encryption and authentication of users
Domain
Located on a SIM inserted into a mobile device
Zu
Cu Uu Iu Yu Mobile Equipment Domain
Mobile Access Serving Transit
USIM Functions for radio transmission
Equipment Network Network Network
Domain
Domain Domain Domain Domain User interface for establishing/maintaining end-to-end connections
Core Network Domain Access Network Domain
Access network dependent functions
User Equipment Domain Infrastructure Domain
Core Network Domain
Access network independent functions
User Equipment Domain Serving Network Domain
Assigned to a single user in order to access UMTS services Network currently responsible for communication
Infrastructure Domain Home Network Domain
Shared among all users Location and access network independent functions
Offers UMTS services to all accepted users
Spreading and scrambling of user data OSVF (Orthogonal Variable Spreading Factor) coding
Constant chipping rate of 3.84 Mchip/s
Different user data rates supported via different spreading factors
higher data rate: less chips per bit and vice versa
1,1,1,1,1,1,1,1
User separation via unique, quasi orthogonal scrambling codes
1,1,1,1 ...
users are not separated via orthogonal spreading codes
1,1,1,1,-1,-1,-1,-1
spreading codes: separate different data streams of a sender 1,1
much simpler management of codes: each station can use the same orthogonal 1,1,-1,-1,1,1,-1,-1
spreading codes 1,1,-1,-1 ...
X,X
precise synchronisation not necessary as the scrambling codes stay quasi- 1,1,-1,-1,-1,-1,1,1
X 1
orthogonal
1,-1,1,-1,1,-1,1,-1
data1 data2 data3 data4 data5
X,-X 1,-1,1,-1 ...
spr. spr. spr. spr. spr. 1,-1,1,-1,-1,1,-1,1
code1 code2 code3 code1 code4
SF=n SF=2n 1,-1
1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 ...
scrambling scrambling 1,-1,-1,1,-1,1,1,-1
code1 code2
SF=1 SF=2 SF=4 SF=8
sender1 sender2
UMTS FDD frame structure Typical UTRA-FDD uplink data rates
W-CDMA
Radio frame • 1920-1980 MHz uplink
• 2110-2170 MHz downlink
10 ms 0 1 2 ... 12 13 14 • chipping rate:
3.840 Mchip/s
Time slot • soft handover
• QPSK
666.7 µs Pilot TFCI FBI TPC uplink DPCCH • complex power control 12.2 64 144 384
(1500 power control User data rate [kbit/s] (voice)
2560 chips, 10 bits
cycles/s)
666.7 µs Data uplink DPDCH • spreading: UL: 4-256; DPDCH [kbit/s] 60 240 480 960
DL:4-512
2560 chips, 10*2k bits (k = 0...6) DPCCH [kbit/s] 15 15 15 15
666.7 µs Data1 TPC TFCI Data2 Pilot downlink DPCH Spreading 64 16 8 4
FBI: Feedback Information
DPDCH DPCCH DPDCH DPCCH TPC: Transmit Power Control
TFCI: Transport Format Combination Indicator
2560 chips, 10*2k bits (k = 0...7) DPCCH: Dedicated Physical Control Channel
DPDCH: Dedicated Physical Data Channel
Slot structure NOT for user separation DPCH: Dedicated Physical Channel
but synchronisation for periodic functions!
UMTS TDD frame structure (burst type 2) UTRAN architecture
RNS RNC: Radio Network Controller
Radio frame
RNS: Radio Network Subsystem
10 ms 0 1 2 ... 12 13 14
UE1 Node B Iub
Iu
RNC CN
Time slot
UE2
666.7 µs Data Midample Data Traffic burst
GP Node B
1104 chips 256 chips 1104 chips UTRAN comprises several
2560 chips midample: training and channel estimation RNSs
UE3 Node B can support FDD or
GP: guard period
96 chips
TDD or both
Iur
TD-CDMA Node B RNC is responsible for handover
• 2560 chips per slot Iub decisions requiring
• spreading: 1-16 signalingto the UE
• symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction) Node B
RNC Cell offers FDD or TDD
• tight synchronisation needed
• simpler power control (100-800 power control cycles/s)
Node B
RNS
UTRAN architecture UTRAN functions

RNS RNC: Radio Network Controller Admission control
RNS: Radio Network Subsystem Congestion control
UE
System information broadcasting
Node B Iub
Radio channel encryption
UTRAN comprises several RNSs Handover
RNC Node B can support FDD or TDD
Iu SRNS moving
or both
Node B
Radio network configuration
Channel quality measurements
CN
Macro diversity
Radio carrier control
Iur Radio resource control
Node B RNC is responsible for handover Data transmission over the radio interface
Iub
decisions requiring signaling Outer loop power control (FDD and TDD)
Node B to the UE minimize interference between neighbouring cells or control the size of a cell
RNC
Cell offers FDD or TDD Channel coding
Node B Access control
RNS
Core network: protocols Core network: architecture
VLR
VLR
PSTN/ BSS
MSC GMSC BTS Abis Iu
GSM-CS ISDN
RNS
backbone
BSC MSC GMSC
PSTN
Node
BTSB
IuCS
HLR
AuC
EIR HLR
RNS GR
Node B
SGSN GGSN PDN (X.25), Iub
Layer 3: IP Internet (IP)
GPRS backbone (IP)
Layer 2: ATM Node B
RNC SGSN GGSN
SS 7 Gi
Layer 1: PDH, Gn
SDH, SONET Node B IuPS
RNS CN
UTRAN CN
Core network UMTS protocol stacks (user plane)
The Core Network (CN) and thus the Interface Iu, too, are separated into UE Uu UTRAN IuCS 3G
MSC
two logical domains: apps. &
Circuit Switched Domain (CSD) protocols
Circuit switched service incl. signaling Circuit RLC
RLC SAR
SAR
Resource reservation at connection setup switched MAC MAC AAL2 AAL2
GSM components (MSC, GMSC, VLR) radio radio ATM ATM
IuCS
Packet Switched Domain (PSD)
GPRS components (SGSN, GGSN) UE Uu UTRAN IuPS 3G Gn 3G
IuPS apps. & SGSN GGSN
protocols
IP, PPP, IP tunnel IP, PPP,
Release 99 uses the GSM/GPRS network and adds a new radio access! … …
Packet PDCP GTP
Helps to save a lot of money … PDCP GTP GTP GTP
switched RLC RLC UDP/IP UDP/IP UDP/IP UDP/IP
Much faster deployment
MAC MAC AAL5 AAL5 L2 L2
Not as flexible as newer releases (5, 6)
radio radio ATM ATM L1 L1
GSM circuit switched part replaced by all-IP core
UMTS protocol stacks (user plane): Definitions Support of mobility: macro diversity
AAL2 Multicasting of data via several

Connection-oriented, synchronous VBR traffic physical channels
Enables soft handover
Packet data convergence protocol (PDCP) FDD mode only
perform header compression to avoid redundant data transmission using Uplink
scarce radio resources UE Node B simultaneous reception of UE
data at several Node Bs
Reconstruction of data at Node
B, SRNC or DRNC
Node B RNC CN Downlink
Simultaneous transmission of
data via different cells
Different spreading codes in
different cells
Support of mobility: handover Example handover types in UMTS/GSM
From and to other systems (e.g., UMTS to GSM)

This is a must as UMTS coverage will be poor in the beginning
RNS controlling the connection is called SRNS (Serving RNS)
RNS offering additional resources (e.g., for soft handover) is called Drift UE1
RNS (DRNS) Node B1 RNC1 3G MSC1
End-to-end connections between UE and CN only via Iu at the SRNS Iu
UE2
SRNC relocation: hard handover Node B2 Iub Iur
Change of SRNS requires change of Iu
UE3 Node B3 RNC2 3G MSC2
Initiated by the SRNS
Controlled by the RNC and CN
UE4
BTS BSC 2G MSC3
Node B SRNC CN
Iub Abis A
Iu
UE Iur
Node B DRNC
Iub
UMTS/GSM Handover Breathing Cells
Intra-node-B, intra-RNC GSM
UE moves from one antenna of node B to another antenna
Mobile device gets exclusive signal from the base station
softer handover: node B performs combining and splitting of data streams
Number of devices in a cell does not influence cell size
Inter-node-B, intra-RNC
UE moves from one node B to another controlled by the same RNC UMTS
RNC combines and splits data Cell size is closely correlated to the cell capacity
Signal-to-nose ratio determines cell capacity
Inter-RNC
Noise is generated by interference from
UE moves from one node B to another controlled by different RNCs
internal: not visible for the CN other cells
external: relocation of controlling RNC => hard handover other users of the same cell
Interference increases noise level
Inter-MSC Devices at the edge of a cell cannot further increase their output power
hard handover of the connection (max. power limit) and thus drop out of the cell
no more communication possible
Inter-system Limitation of the max. number of users within a cell required
UE moves from a 3G UMTS network into a 2G GSM network
hard handover
Cell breathing complicates network planning
Breathing Cells: Example UMTS services (originally)
Data transmission service profiles

Service Profile Bandwidth Transport mode
High Interactive MM 128 kbit/s Circuit switched Bidirectional, video telephone
High MM 2 Mbit/s Packet switched Low coverage, max. 6 km/h
Medium MM 384 kbit/s Circuit switched asymmetrical, MM, downloads
Switched Data 14.4 kbit/s Circuit switched
Simple Messaging 14.4 kbit/s Packet switched SMS successor, E-Mail
Voice 16 kbit/s Circuit switched
Virtual Home Environment (VHE)

Enables access to personalized data independent of location, access
network, and device
Network operators may offer new services without changing the network
Service providers may offer services based on components which allow the
automatic adaptation to new networks and devices
Integration of existing IN services
Example 3G Networks: Japan Example 3G networks: Australia
cdma2000 1xEV-DO in Melbourne/Australia

FOMA (Freedom Of Mobile multimedia
Access) in Japan
Examples for FOMA phones
Examples for 1xEV-DO devices
Isle of Man – Start of UMTS in Europe as Test UMTS in Monaco
UMTS in Europe Some current enhancements
GSM
EMS/MMS
EMS: 760 characters possible by chaining SMS, animated icons, ring tones,
was soon replaced by MMS (or simply skipped)
MMS: transmission of images, video clips, audio
– see WAP 2.0 / chapter 10
EDGE (Enhanced Data Rates for Global [was: GSM] Evolution)
8-PSK instead of GMSK, up to 384 kbit/s
new modulation and coding schemes for GPRS EGPRS
– MCS-1 to MCS-4 uses GMSK at rates 8.8/11.2/14.8/17.6 kbit/s
– MCS-5 to MCS-9 uses 8-PSK at rates 22.4/29.6/44.8/54.4/59.2 kbit/s
Orange/UK
UMTS
Vodafone/Germany HSDPA (High-Speed Downlink Packet Access)
initially up to 10 Mbit/s for the downlink, later on 20 Mbit/s using MIMO- (Multiple
Input Multiple Output-) antennas
uses 16-QAM instead of QPSK

GSM and Umts: Mobile Phone Subscribers Worldwide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GSM and Umts: Mobile Phone Subscribers Worldwide

Uploaded by

Copyright:

Available Formats

Mobile phone subscribers worldwide approx. 1.

GSM and UMTS 1000 TDMA total

Development of mobile telecommunication systems How does it work?

IMT-TC How secure is the mobile phone system?

Disadvantages of GSM GSM: Mobile Services

There is no perfect system!! GSM offers

Tele Services II Supplementary services

Additional services Services in addition to the basic services, cannot be offered

GSM is a PLMN (Public Land Mobile Network)

Ingredients 2: Antennas Ingredients 3: Infrastructure 1

Still visible – cause many discussions…

Data bases RSS

GSM: elements and interfaces GSM: system architecture

NSS VLR VLR signaling

Radio subsystem GSM: cellular network

Base Station Subsystem (BSS):

T-Mobile (GSM-900/1800) Germany O2 (GSM-1800) Germany

GSM 850 128-251 824-849 869-894

GSM-R 955-1024, 0-124 876-915 921-960

Base Transceiver Station and Base Station Controller Mobile station

Tasks of a BSS are distributed over BSC and BTS

Operation subsystem GSM - TDMA/FDMA

The OSS (Operation Subsystem) enables network operation, 935-960 MHz

Operation and Maintenance Center (OMC)

Flag S 0 1 2 ... 48 49 50 235.4 ms (control)

1: calling a GSM subscriber 1, 2: connection request

MSRN: mobile station roaming number

MTC/MOC 4 types of handover

Inter-BSC, intra-MSC handover

Handover procedure Security in GSM

mobile network SIM mobile network (BTS) MS with SIM

Data services in GSM I Data services in GSM II

Reliability Lost SDU Duplicate Out of Corrupt SDU

GPRS user data rates in kbit/s GPRS architecture and interfaces

CS-1 9.05 18.1 27.15 36.2 45.25 54.3 63.35 72.4 Um Gb Gn Gi

Base station subsystem GPRS protocol (BSSGP)

Original Goals for 3G UMTS and IMT-2000

MSS MSS IMT-DS IMT-TC IMT-MC IMT-SC IMT-FT

GSM and UMTS Releases GSM and UMTS Releases (Definitions)

Phase 2+ Release 1997 - R97 6.x.y early 1998 Release 6

UTRAN (UTRA Network)

UMTS domains and interfaces I UMTS domains and interfaces II

Home Universal Subscriber Identity Module (USIM)

UMTS FDD frame structure Typical UTRA-FDD uplink data rates

UTRAN architecture UTRAN functions

Core network UMTS protocol stacks (user plane)

AAL2 Multicasting of data via several

Support of mobility: handover Example handover types in UMTS/GSM

From and to other systems (e.g., UMTS to GSM)

Breathing Cells: Example UMTS services (originally)

Data transmission service profiles

Virtual Home Environment (VHE)

cdma2000 1xEV-DO in Melbourne/Australia

Isle of Man – Start of UMTS in Europe as Test UMTS in Monaco

You might also like