Professional Documents
Culture Documents
Course Objectives:
Aware of the Development Background of GSM technology
1 GSM Basic.....................................................................................................................................................1
2 GSM Events.................................................................................................................................................21
2.1.3 MS Busy.................................................................................................................................22
2.3 Handover............................................................................................................................................23
i
2.3.1 Purpose of Handover..............................................................................................................23
2.5 Authentication....................................................................................................................................25
2.6 Encryption..........................................................................................................................................26
3.1 Initialization.......................................................................................................................................29
ii
1 GSM Basic
1991 - GSM Committee renamed Special Mobile Group and GSM renamed as
Global System for Mobile Communication
1994 – A new research phase (Phase 2+) added to improve GSM for mobile data
services
In 1920, mobile communication system was first used by military while in 1940’s; it
was put in use for civil purpose.
Mobile communication started flourishing in recent decade. Its development phases are
as follows:
1
1G during 1980’s
At the end of 1980’s Analog System was unable to meet continuing demands due to:
2G during 1990’s
GSM
CDMA IS95
2
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
Advantages of 2G
Discrepancies of 2G
Provides low-rate data services only and cannot support multi-media service.
For example, Internet data access speed of GSM MS can reach 9.6 kbps
theoretically.
3
GBC_001_E1_0 GSM Basic
IS-95 IS-2000
IS-95-B
CDMA MC WCDMA
ARIB
PDC
WCDMA
IMT-2000
HSCSD
GSM
GPRS
EDGE UTRA
UWC-136 WCDMA
IS-136+
IS-136
IS-136HS
2G 2.5G 2.75G 3G
GSM 2.5G
GSM system (2.5G) Phase2 and Phase2+ were then developed, adopting high-rate
adaptive coding solution. GPRS provides the data rate up to 171 kbps. Two high-rate
data service options are:
High Speed Circuit Switched Data (HSCSD) based on high-speed data bit rate
and circuit switching
GSM 2.75G
Enhanced Data Rates for GSM Evolution (EDGE) developed by the European
Telecommunications Standards Institute (ETSI) adopts 8-PSK (Phase Shift Keying)
modulation. It supports data rate up to 384 kbps theoretically. EDGE is more advanced
than GPRS. However, EDGE cannot provide rate up to 2 Mbps as 3G system does.
Therefore EDGE is often called 2.75G.
4
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
IMT-2000
IMT-2000 introduces:
Mobile data service and some fixed high-speed data services through one or
more radio channels
A global standard
IMT-2000 services, which are compatible with other fixed network services
High quality
Global roaming
5
GBC_001_E1_0 GSM Basic
4G Services
Over 100 Mbps data transmission rate, which is 10,000 times of current MSs
and 50 times of 3G MSs
1986: Eight proposals put forward by European countries after massive research
and experiments were accepted in Paris, and on-site experiments were
performed.
6
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
1994: A new research phase (Phase 2+) was added to further improvement of
GSM as a platform of mobile data services.
GSM system features high spectrum efficiency due to the high-efficient modulator,
channel coding, interleaving, balancing, and voice coding technologies adopted.
Large capacity
GSM standard provides open air interface, also open interfaces between networks and
those between network entities, such as A interface and Abis interface.
High security
7
GBC_001_E1_0 GSM Basic
GSM can interconnect with other networks through current standard interfaces, such as
Integrated Service User Part (ISUP) or Telephone User Part (TUP).
Roaming function
GSM supports roaming by introducing Subscriber Identity Module (SIM) card that
separates subscriber from the terminal equipment.
Diversified services
Inter-cell handover
ETSI developed GSM in several phases and set up more Special Mobile Groups
(SMG) to make the related GSM standard.
Field 1: General
Field 2: Services
8
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
AUC
SMC
PSTN
ISDN
PDN
HLR
GMSC
BTS
BSC TRAU MSC/VLR
M
S
BTS
Traffic & Signaling IWF EIR
MS Signaling
NSS is the core element of network switching which interfaces with subscriber services
for voice and data.
9
GBC_001_E1_0 GSM Basic
Home Location Register - HLR is a central database of a system. HLR stores all the
information related to subscribers, including the roaming authority, basic services,
supplementary services, and current location information. It provides routing
information for MSC for call setup. HLR may cover several MSC service areas or
even the whole PLMN.
Visitor Location Register - VLR stores all subscriber information in its coverage area
and provides call setup conditions for the registered mobile subscribers. As a dynamic
database, VLR must exchange large volume of data with HLR to ensure data validity.
When an MS leaves the controlling area of a VLR, it registers in another VLR. The
original VLR deletes the temporary records of that subscriber. VLR integrated within
MSC.
Equipment Identification Register - EIR stores the parameters related to MS. It can
identify, monitor, and block the MS. ERI preventing unauthorized MS from accessing
the network.
Base Station Subsystem BSS serves as a bridge between NSS and MS. It performs
radio channel management and wireless reception and transmission. Base Station
Controller (BSC) and Base Transceiver Station (BTS) are main components of BSS.
Base Station Controller - Located between MSC and BTS, it controls and manages
more than one BTS. It performs radio channel assignments. BTS and MS transmit
power control, and inter-cell handover. BSC is also small a switch that converge and
connects local network with the MSC through A interface. Abis interface connects BTS
to BSC.
10
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
Transcoding and Rate Adaptation Unit - TRAU Located between BSC and MSC,
TRAU transcodes between 16 kbps RPE-LTP codes and 64 kbps A law PCM codes.
OMS consists of two parts: OMC – System (OMC-S) and OMC-Radio (OMC-R). The
OMC-S performs operation and NSS maintenance, while OMC-R performs operation
and BSS maintenance.
Mobile Station
Mobile equipment processes voice signals, receives and transmits radio signals.
SIM stores all information required for identifying a subscriber and security
information, preventing unauthorized subscribers. Mobile equipment cannot access
GSM network without a SIM card.
GSM service area refers to the total area covered by networks of all GSM operators.
Network consists of several MSC service areas, each of which consists of several cells.
Logically, several cells form a location area (LA).
MSC Service Area - A Public Land Mobile Network (PLMN) includes multiple MSC
service areas. MSC service area refers to the MSC coverage area, that is, the total area
covered by BTS under control of BSC connected to MSC. All MSs in the service area
table register in local VLR. Therefore, in actual network, MSC is always integrated
with VLR as a node.
Location Area - Each MSC/VLR service area includes multiple of LAs. MS can move
freely without performing location update in LA. Hence, LA is the paging area of a
broadcast paging message. An LA belongs to one MSC/VLR only, that is, LA cannot
11
GBC_001_E1_0 GSM Basic
cross MSC/VLR. The system can identify different LA via LA Identity (LAI).
Cell - LA contains several cells. Each cell has a unique Cell Global Identification
(CGI), which indicates a basic radio coverage area in a network.
Fig 1.6 -4shows the relationship among different coverage areas in a GSM network.
Location area
An area for location update and paging
Cell
A service area provided by a
specific BTS
GSM Interfaces
G
VLR VLR
Sm Um Abis A B
D
C
MS BTS BSC MSC HLR
E F
EIR
MSC
Abis Interface: It is an interface between BSC and BTS. Supports all services
provided to subscribers. Also supports the control of BTS radio equipment and
management of radio resources assigned.
B Interface: It is an interface between MSC and VLR. VLR is a database locating and
managing MS when MS roams in the related MSC control area. MSC can query the
current location of MS from VLR and update MS location. When subscriber uses a
special supplementary service or changes a relevant service, MSC notifies the VLR.
Sometime VLR also updates information in HLR.
13
GBC_001_E1_0 GSM Basic
that time, related MSCs exchange the handover information through E interface.
2G cellular mobile network GSM adopts Open System Interconnection (OSI) model to
define its protocol structure. Fig 1.7 -6 shows GSM interface protocol model, which
defines the interfaces and protocols between MS and MSC.
CM CM
MM MM
SCCP SCCP
64 64 64 64
Radio Radio
kbit/s kbit/s kbit/s kbit/s
MS BTS BSC MSC
14
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
Second layer L2 is data link layer, which is marked as LAPDm. It covers various data
transmission structures and controls data transmission.
Application layer is the third highest layer L3. It covers various messages and
programs, and controls services. L3 includes Radio Resource Management (RRM),
Mobility Management (MM) and Call connection Management (CM).
First layer of A interface protocol is 64 kbps land line, and second layer is the
Message Transfer Part (MTP), which is part of Common Channel Signalling7
(CCS7) network. MTP consists of many network protocols and centralizes all
link layer protocols. Signaling connection control part (SCCP) and MTP
together represent a network layer protocol on A interface.
1. Circuit Services
1) Voice Service
2) Data service
Point-to-point short message service with the mobile user serving as called
15
GBC_001_E1_0 GSM Basic
Point-to-point short message service with the mobile user serving as caller
Cell broadcast service originated from the SMS center or the OMC-R.
3. Packet Services
1) GPRS service
2) EDGE service
Access to the database: Allocate service to users as needed, e.g. Internet, and
provide storing and forwarding, as well as information processing for user-to-
user communications.
Call Forwarding Unconditional: forward all incoming calls to the number specified by
the subscriber.
Call Waiting: When a call is connected for a subscriber, indication of a new coming
call is given to the subscriber. The subscriber can accept, reject or ignore the waiting
call.
Call Hold: A subscriber can suspend the connected call to do other things.
Closed User Group: The subscribers of CUG are restricted from outgoing and
incoming calls, but they can normally communicate with each other.
Hot Billing: The network generates an instant call billing message from the billing
16
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
manager. It is applicable to leased phone service, including all kinds of call modes.
Bills are generated and presented to the subscriber immediately after the call is ended.
Currently, the GSM communication system works at 900 MHz, extended 900
MHz and 1800 MHz, or 1900 MHz band in some countries.
Uplink (MS transmitting and BS receiving) frequency range: 890 MHz ~ 915
MHz
Uplink (MS transmitting and BS receiving) frequency range: 880 MHz ~ 915
MHz
Downlink (BS transmitting and MS receiving) frequency range: 925 MHz ~ 960
MHz
2. Channel interval
The interval between two adjacent channels in any band is 200 kHz.
3. Channel configuration
17
GBC_001_E1_0 GSM Basic
The channel numbers are in the range of 1 ~ 124. There are 124 frequency bands
in all.
The channel numbers are in the range of 0 ~ 124 and 975 ~ 1023. There are 174
frequency bands in all.
The channel numbers are in the range of 512 ~ 885. There are 374 frequency
bands in all.
512 n 885
The channel numbers are in the range of 512 ~ 811. There are 300 frequency
bands in all.
18
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
512 n 811
19
2 GSM Events
1. If the MS is powered on for the first time, The SIM card does not store the LAI.
MS sends a Location Update Request to the MSC, notifying the GSM system
that this is a new subscriber in this location area. MSC sends a Location Update
Request to the HLR according to the IMSI number sent by this subscriber. HLR
records the number of the MSC sending the request and the corresponding VLR
number, and returns a Location Update Accepted message to the MSC. By now,
MSC has been activated and it will add an Attach flag to the IMSI of the
subscriber in the VLR. Then it sends a Location Update Acknowledgement
message to the MS. The SIM card of the MS records the LAI.
2. If the MS is not powered on for the first time, instead the MS is powered off and
then powered on again, and if the LAI received by the MS is inconsistent with
that stored in the SIM card, the MS sends a Location Update Request to the
MSC. The VLR must judge whether the original LAI is in its own service area.
If yes, MSC only needs to replace the original LAI in the SIM card of the
subscriber with the new LAI.
If no, MSC sends a Location Update Request to the HLR according to the
information in the IMSI of the subscriber. HLR records the number of MSC
sending the request in the database and returns a Location Update Accepted
message. Then MSC adds an Attach flag to the IMSI of the subscriber and
returns the Location Update Acknowledgement message to the MS. MS replaces
the original LAI on the SIM card with the new LAI.
3. If the MS is powered on again, and the LAI received is consistent with the
21
original LAI stored in the SIM card. VLR only adds Attach flag to this
subscriber.
After the MS is powered off, the MS sends a Detach Request to the MSC. After the
MSC receives the request, it informs VLR to add the Detach flag to IMSI of this MS.
At this time, HLR does not receive the notice indicating that this subscriber is detached
from the network. After this subscriber is paged, the HLR requests the MSRN from the
MSC/VLR. At this time, the VLR informs the HLR that this MS is powered off.
2.1.3 MS Busy
In this case, the MS is allocated with a traffic channel to transmit the voice or data and
the IMSI of the subscriber is marked as Busy.
When the MS sends the IMSI Detach message to the network, it is possible that the
GSM system cannot decode properly due to the poor radio quality or other reasons and
still believes that MS is in Attach status. Or when the MS is powered on but has
roamed beyond the service coverage, i.e., a blind area, the GSM system does not know
it and still believes that the MS is in Attach status. In both cases, if the subscriber is
paged, the system will keep sending paging messages, wasting radio resources.
To solve the above problems, the measure of forced registration is taken in the GSM
system: The MS must make registration at a regular interval. This is called periodical
location update. If the GSM system does not receive the periodical registration
information of the MS, the VLR where the MS resides records the Implicit Detach
status of the MS. When the correct periodical registration information is received
again, the status is changed into Attach status.
22
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
IMSI Attach.
When the MS roams to a new location area, it finds out that the LAI in its SIM card is
inconsistent with the LAI received. Thus, it originates a Location Update Request to
the current MSC/VLR If the new LAI and old LAI below to same MSC/VLR, Location
Update just renew LAI in VLR. If not, the new MSC/VLR should require MS data
from its HLR, HLR send back MS data to new MSC/VLR and inform old MSC/VLR
to delete MS record at the same time. MS register its LAI in new MSC/VLR, HLR
save the new MSC/VLR number.
When MS Power On, it will start a location update process to MSC/VLR, the location
update process is same as that in normal location update.
2.3 Handover
When a mobile subscriber who is engaged in a conversation moves from one BSS to
another, handover function ensures that the link set up for this mobile subscriber is not
interrupted. Whether to perform handover is determined by the BSS. When the BSS
finds out that the communication quality of the current radio link degrades, it performs
different types of handover according to the actual situation. MSS can also request the
handover according to the traffic information.
23
GBC_001_E1_0 GSM Basic
According to the scope of handover , it can be divided into the following types
1. Intra-cell hand-over
2. Inter-cell hand-over
4. Inter-MSCs hand-over
1. Synchronous: MS use the same TA both in destination and target cell. This
usually applies to hand-over of same cell or different sectors within the same
cell. This is the hand-over with highest speed.
After a MS is turned on, it will attempt to contact a common GSM PLMN, so the MS
will select an appropriate cell, and extract from it the parameters of the control channel
and the prerequisite system information. Such a selection process is referred to as cell
selection. The quality of a radio channel is an important factor of cell selection. The
GSM specification defines the path loss criterion C1, and such appropriate cell must
ensure that C1>0. The C1 is calculated according to the following formula:
C1=RXLEV-RXLEV_ACCESS_MIN-MAX((MS_TXPWR_MAX_CCH-P), 0)
Where:
24
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
access.
MAX (X, Y) = X; If X Y.
MAX (X, Y) = Y; If Y X.
After the MS selects a cell, it will stay in the selected cell if no major changes have
occurred to various conditions.
After a MS selects a cell, the MS will stay in the selected cell as long as no major
changes occur to various conditions. At the same time, the MS starts to measure the
signal level of the BCCH carrier of the adjacent cells, records the six adjacent cells
with the highest signal levels, and extracts from them the various system messages and
control messages of each adjacent cell. When the appropriate conditions are met, the
MS will switch from the current cell to another cell, a process known as cell
reselection. Such appropriate conditions include multiple factors, including cell
priority, and whether the cell is prohibited from access. Among them, an important
factor is the quality of the radio channel. When the signal quality of the adjacent cell
exceeds that of the current cell, cell reselection is triggered. For cell reselection, the
channel quality criterion is determined by the C2 parameter, which is calculated
according to the following formula:
2.5 Authentication
Fig. 2.5 -1 shows the authentication process, where RAND is the question asked by
the network side and only the legal subscriber can give the correct answer SRES.
RAND is generated by the random number generator of the AUC on the network side.
It is 128 bits in length. The value of RAND is obtained in a random manner from the
range of 0~2128–1.
Ki is stored in the SIM card and AUC in a very confidential way. Even the subscribers
do not know their own Ki. Ki can be of any format and any length.
25
GBC_001_E1_0 GSM Basic
Ki
A3 algorithm
A3 algorithm
SRES'
SRES
2.6 Encryption
In the GSM, the position of encryption and decryption over the transmission link
allows the transmitting data in all dedicated modes to use the same protection method.
The transmitting method can be the subscriber information (such as voice and data),
subscriber-specific signaling (such as message carrying the called number), or even the
system-specific signaling (such as the message carrying radio measurement result for
the handover).
Encryption and decryption are the exclusive or operation (this algorithm is called the
A5 algorithm) of 114 radio burst pulse code bits and one 114-bit encryption sequence
generated by a special algorithm. To obtain each burst encryption sequence, A5
calculates on two inputs: One is the frame number and the other is the key (Kc) agreed
upon by the MS and network, as shown in Fig. 2.6 -2. Two different sequences are
used over the uplink and downlink. For each burst, one sequence is used for the
encryption inside the MS and meanwhile used as the decryption sequence in BTS. The
other sequence is used for the encryption of BTS and meanwhile used as the decryption
sequence in MS.
26
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
A5 A5
S1 S2 S1 S2
(114-bit) (114-bit) (114-bit) (114-bit)
MS BTS
1. Frame number: Frame number is encoded into a serials of three values, which
are 22 bits in total.
Frame number of each burst varies with the type of radio channel. Each burst
dedicated for communication on the same direction uses different encryption
sequence.
2. A5 algorithm
3. Kc
Before the encryption, Kc must be agreed upon by both the MS and network. In
the GSM, the Kc is calculated during the authentication and then stored in the
SIM card permanently. On the network side, this potential key is also stored in
the visited MSC/VLR and ready for use in the encryption.
The algorithm that uses the RAND (same with the one used for authentication)
and Ki to calculate the Kc is called A8 algorithm. Like the A3 algorithm that
calculate the SRES using RAND and Ki, the A8 algorithm also needs to be
determined by the carrier.
27
GBC_001_E1_0 GSM Basic
Random number
Ki generator
RAND
Ki
A8 algorithm
A8 algorithm
Kc Kc
28
3 GSM basic calling process
Though basically similar, the call process of mobile subscribers and that of ordinary
fixed subscribers are different in the following aspects:
Before a mobile subscriber originates a call, he should first input the number, ensure
that no modification is needed, and then send the call.
Before the number is sent out and the call is connected, there is some additional
information that should be transferred between mobile stations (MS) and the network.
Such operations are automatically performed by the equipment, with no need for user
interference, but it results in a certain delay.
3.1 Initialization
Initialization is a random access process. It starts from MS which sends a “channel
request” message on RACH.
After receiving this message, BTS notifies BSC, and attaches BTS’s estimation of the
transmission delay (TA) from this MS to BTS and the cause for the current access.
BSC will select an idle and dedicated channel SDCCH to notify BTS to activate it
according to the access cause and the current information.
Access causes mainly include: location updating; response to a paging call; and
subscriber service application, such as a call, sending one short message.
After BTS completes the activiation of the designated channel, BSC sends the
“immediate allocation” message on AGCH via BTS, including the description of the
SDCCH channel assigned by BSC to MS, TA, the maximum initialization transmission
power and the access random reference value.
29
3.2 Location update
(1) MS moves from one area (belonging to the coverage of MSC-B) to another area
(belonging to the coverage of MSC-A).
(2) By detecting the broadcasting information sent persistently by the base station BS,
MS finds out that the newly received location area identification is different from the
currently used location area identification.
(3)(4) MS sends the location updating request with the message of “I’m here” via this
base station to MSC-A.
(5) MSC-A sends the location updating message that contains the MSC-A identifier
and MS identification number to HLR (the authentication or encryption calculation
process will start from here, though not shown in the diagram).
(6) HLR sends back the response message, including all the related subscriber data.
(9) Sending related location updating response message via the base station to MS (if
TMSI is re-assigned, it is sent together to MS).
(10) Notifying the original VLR to delete subscriber data related to this MS.
(2) The setup process to set up signaling connection between the mobile station MS
and the mobile service switching center MSC.
30
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
(5) Adopting the No.7 signaling user part ISUP/TUP to set up a channel from the fixed
network (ISDN/PSTN) to the called subscriber, send ringing to the called subscriber,
and send back the call connection acknowledgment signal to the mobile station.
(2) GMSC requests HLR for the MSC address (i.e., MSRN) visited by the related
called mobile subscriber.
(3) HLR requests the visited VLR to assign MSRN which is assigned and notified
by VLR to HLR in each call.
(4) After GMSC obtains MSRN from HLR, it can re-search for routes to set up
connection to the visited MSC.
(5)(6) The visited MSC obtains related subscriber data from VLR.
(7)(8) MSC sends paging messages to the mobile station through all base
31
GBC_001_E1_0 GSM Basic
(9)(10) The mobile station of the called mobile subscriber sends back the paging
response messages, then carries out the same steps of (1), (2), (3), (4) as
shown in the above outgoing call flow till the mobile station rings,
then sends back the call connection acknowledgment signal (omitted in the diagram) to
the calling subscriber.
(11) The mobile subscriber offhooks to answer, thus the response (connection)
message is sent back to the fixed network to signal calling and called parties
enter final call session.
1. MS1 dials the phone number of MS2. BSS informs MSC1 of the call.
2. MSC2 analyzes the phone number of MS2, finds out the home HLR of MSC2
and sends the route application to HLR.
3. HLR queries the current location information of MS2 and obtains the
MSC2/VLR2 that serves the MS2. HLR requests the route information from the
MSC2/VLR2.
4. MSC2/VLR2 allocates the route information, that is, MSRN and submits the
32
Error! Use the Home tab to apply 标题 1 to the text that you want to appear here. Error! Use the Home tab to apply
标题 1 to the text that you want to appear here.
10. MSC1 sends the successful connection signal to MS1. MS1 and MS2 can talk
over the phone.
33