CHAPTER 4: GSM NETWORK TECHNOLOGY

This is the most popular and matured mobile network, reasons being its extensive usage
in Europe, Africa, and a large part of Asia. Also, it’s very interesting ability to evolve and last far
longer than its expected life cycle. Despite this 3G/4G world of today, the 2G GSM still strives
on, working interoperate ably with 3G UMTS networks and evolving on its air interface constantly
to meet requirements of quality, coverage and capacity. To put it in short terms, it is the network
which does simple things most efficiently.
In Cameroon, the Orange and MTN networks are 2G GSM for their voice calls and SMS services.
For data services, they employ GPRS/EDGE, UMTS, and LTE technologies.

4.1 GSM Network Elements

A typical GSM network is shown in Figure 4.1.

Figure 4.1: GSM network architecture

4.1.1 Mobile Station

The mobile station (MS) is the starting point of a mobile wireless network. This is the terminal
used by a user to access GSM services. Within it is the subscriber identity module, SIM. This
contains a computer chip and some non-volatile memory and is inserted into the MS. The memory
on the SIM holds information about the subscriber that enables a wireless network to provide
subscriber services. The information includes:
1. The subscriber’s identity numbers: International Mobile Subscriber Identity (IMSI),
and Temporary Mobile Subscriber Identity (TMSI).

1|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

2. The telephone number, otherwise known as the Mobile Subscriber ISDN Number
(MSISDN).
3. Subscriber authentication key, Kc.
4. The original network to which the subscriber is subscribed.
A SIM can be moved from one handset to another. A handset reads the information off the SIM
and transmits it to the network

4.1.2 Base Transceiver Station

When a subscriber uses the MS to make a call in the network, the MS transmits the call request to
the base transceiver station (BTS). The BTS includes all the radio equipment (i.e., antennas, signal
processing devices, and amplifiers) necessary for radio transmission within a geographical area
called a cell. This makes the connection to the MS via the air interface and controls the transceiver
(TRX). The TRX is the central functional unit of the BTS, maintains calls to a maximum of 8 MSs
via one frequency pair each.
The BTS is also responsible for the monitoring of the signal quality and the encoding and
modulation of useful signals. Via the A-bis interface, it forwards calls, signals and control
information destined for the network to the Base Station Controller (BSC).

Figure 4.2: Components of the BTS

2|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.1.3 Base Station Controller

The base station controller (BSC) is the controlling component of the radio network, and it
manages the BTSs. Several BTSs are controlled by the BSC. The BSC assigns free radio channels
in the TRX for the link to the MS. It controls the necessary output power for mobile station and
TRX.
It monitors the existing radio link to and from the MS and controls handover between neighboring
radio cells if they are under its control. During an existing radio connection, the BSC monitors its
quality and controls disconnection of the radio link when the call is over.
The BSC has two major components:
1. Base Module: Performs the control part of the BSC. Manages the BSS resources and all
the signaling.
2. Transcoder: Performs sub-mutiplexing and rate adaptation. Sub-mutiplexing involves
the multiplexing of four 16 kbps timeslots into one 64 kbps timeslot. Rate adaptation
involves the transformation of 64 kbps timeslots to 16 kbps, in one direction, and 16 kbps
to 64 kbps on the other. This will be further explained under the A-ter interface section.

Figure 4.3: Base Station Subsystem

The Base Station Subsystem (BSS) forwards the signals to the Network Subsystem (NSS) where
speech and circuit-switched data are controlled and forwarded to other networks if necessary. The
NSS provides data relevant for security and mobility.

3|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.1.4 Mobile Switching Center

The speech signals processed by the transcoder reach the Mobile Services Switching Center (MSC)
via the A interface. The MSC serves as a digital exchange for the forwarding of messages,
connecting mobile subscribers with each other or with subscribers in other networks such as the
Public Switched Telephone Network, the ISDN network, or data networks.

Figure 4.4: Typical Network Subsystem

The MSC is responsible for the following functions:
• It forwards incoming and outgoing calls.
• It makes a connection to other MSCs in the same mobile radio network and also
establishes connections with other mobile radio networks and to fixed networks.
• It monitors and controls the calls.
• It is responsible for call data acquisition and the forwarding of signalling information to
connected registers or databases.
In order to monitor, route and control mobile telephone calls in GSM networks, several
registers are connected to the MSC.

4.1.5 Visitor Location Register

The Visitor Location Register (VLR) is usually found in the MSC, but is a functional
unit in its own right. It is designed as a dynamic subscriber file with dedicated geographical areas

4|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

of responsibility, the so-called Location Areas. The VLR acquires the data of all GSM customers
in its areas and is always well informed of their whereabouts. It assists the MSC in the acquisition
of charge-relevant data with subscriber information. The bills are prepared from these data in the
Billing Center. But where does the VLR get the GSM customer data from?

4.1.6 Home Location Register

For GSM customer data acquisition, there is a register, the so-called Home Location Register
(HLR), in which each network operator registers the customer data necessary for dealing with
traffic. The HLR supplies these data to all VLRs in which the GSM customers involved are to be
found at any given moment. Inversely, the VLR in question informs the HLR of the location area
of the customer, and is thus able to give routing information when calls come in. The HLR data
contain information on access rights with regard to roaming, service rights with regard to voice,
fax and data services, and additional subscribed services.

4.1.7 Authentication Center

The Authentication Center (AuC) contains the customer data necessary to protect connections
against unauthorised access, and is mostly integral to the HLR. The AuC checks the information
stored in the SIM card, for correspondence with its own register. If the data proves to be identical,
the authentication of the subscriber is successful, and he is given permission to enter the network.
If the SIM card is stolen, authorization to access the network is disabled very easily via the AuC.
Additionally, the AuC provides necessary information to cipher the air interface.

4.1.8 Equipment Identity Register

The Equipment Identity Register (EIR) can be implemented as an option by the network
operator. The EIR permits the detection of stolen terminal equipment used in GSM networks by
checking the IMEI (International Mobile Equipment Identity) against the data stored in the
EIR. This check is carried out independently of the SIM card, and only applies to the mobile station
in question.
Check the IMEI in your MS by dialing the code *#06#

4.1.9 Operation and Maintenance Subsystem

The GSM network is monitored and controlled from a central point. This is the Operation and
Maintenance Center (OMC). The OMC has the following tasks:
1. The Fault Management system analyses alarms from the BSS elements. When faults
occur, they are eliminated when necessary via software command or in situ by
technicians.
2. The Configuration Management function installs the software when new BSS network
elements are implemented, manages hardware inventory lists, and changes operation
parameters, for example for radio frequencies of a BTS.

5|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

3. The Software Management system feeds in new software or updates and manages the
software inventory lists.

Figure 4.5: OMC and NMC

The Network Management Center (NMC) assumes special functions in the context of OMS
which are not defined in the GSM standard but are based on definitions of the International
Standardization Organisation (ISO), and on recommendations of the International
Telecommunication Union (ITU). An NMC carries out functions of
1. Performance Management
2. Alarms and fault elimination times are evaluated statistically.
3. Capacity bottlenecks in the network are detected
The service quality is monitored, for example the Dropped Call Rate in percentage. Depending
on the network operator, the NMC functions are carried out in a centralised or decentralized way
in the geographical areas.
All NMC and OMC of a certain defined geographical area form the third subsystem, the Operation
and Maintenance Subsystem, or OMS.

6|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

The three subsystems, BSS, NSS and OMS are vital for the operation of a GSM network. The
interfaces within and between the subsystems are mostly specified by the ETSI.

4.1.10 Additional components

Administration & Billing Center

Figure 4.6: Administration and Billing center

For dealing with customer support and supplying certain services, GSM includes a number of
additional components. The Administration & Billing Center (ABC) transfers customer data to
the appropriate registers of the NSS and into the AuC and the HLR. The Administration Center
is connected to the Personalization Center for SIM Cards (PCS) via an interface. This makes it
possible to disable the SIM card if necessary and protect it from abuse. The so-called Call Detailed
Records are used in the Billing Center for bill preparation.

7|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Voice Mail System

Figure 4.7: Voice Mail System

The Voice Mail System (VMS) is a memory system for voice, data and fax messages spread over
the network, i.e. a large-scale answering machine. If a subscriber has switched off his mobile
station or can’t be reached for other reasons, the messages are not sent to his mobile station but
are fed directly into the VMS and stored there. The subscriber can either request them from the
VMS or he is notified via SMS. The VMS can have interfaces to several MSCs and to the Short
Message Service Center.

8|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Short Message Service Center (SMSC)

Figure 4.8: Short Message Service Center

Via the Short Message Service Center (SMSC), network operators, service providers and
private customers can send short messages directly onto the mobile station of any subscriber. In
the SMSC, the short messages are stored temporarily and forwarded to the recipient. Point-to-point
short messages are alphanumerical messages with a maximum basic length of 160 characters,
which are entered directly via the keyboard of the mobile phone. Compression and concatenating
techniques increase the number of transmitted characters. The Cell Broadcast SMS, i.e. the service
offering point-to-multipoint short messages, is a “one-way” communication from the network to
all mobile phones in certain geographical areas. The messages with a basic length of 93
alphanumerical characters are entered in the OMC, fed centrally into the BSC, and transmitted to
the mobile stations via all connected BTSs at regular intervals.

9|Page
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Interworking Function

Figure 4.9: Interworking Function

In order that data can be fed into the GSM network from packet-switched networks such as the
Internet or company Intranets, a so-called Interworking Function (IWF) is required. This is an
external data server connected to the different data networks. The IWF translates the unstructured
incoming packet-switched data into circuit-switched signals which can be understood by GSM. A
firewall upstream of the IWF protects the GSM network from unauthorized access by hackers.
In GSM Phase 2, only circuit-switched data services are supported. The IWF, integral to the
MSC, connects the circuit-switched GSM data traffic to the existing packet-oriented networks, in
other words, the Internet, corporate networks, public data networks and WAP servers. It converts
protocols and adapts the data rate for the BSS.

10 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.2 GSM Interfaces

Figure 4.10: GSM interfaces

Mobile wireless communication occurs over the interfaces between the network elements in a sequential
manner. In Figure 4.10, the MS transmits to the BTS, the BTS to the BSC, and the BSC to the MSC.
Communications also occur over the interfaces to the management databases (HLR, VLR,
AuC, and EIR). Communications might traverse multiple MSCs but ultimately must reach the gateway
MSC (GMSC). The GMSC provides the gateway to the public switched telephone network (PSTN). A
separate interface exists between each pair of elements, and each interface requires its
own set of protocols.
In the BSS block, mobile communication occurs over the air interface to the BTS using the ISDN Link
Access Procedure-D mobile (LAP-Dm). This traffic channel carries speech and data. In this example, voice
operates at full-rate 13 kbps (supported by LAP-Dm), and data operates at full rate 9.6 kbps. The BTS
communicates to the BSC over the Abis interface using the ISDN LAP-D signaling protocol. The BSC
communicates to the GMSC via the transcoder rate adapter unit (TRAU), which translates between 16
kbps on the BTS side to 64 kbps on the GMSC side. This interface uses the signaling system 7 (SS7)
protocol, which defines call set-up and call services across the interface.
At the NSS, the GMSC is the central node. Link-level traffic and signaling control occurs over
the interface between the GMSC and MSC and the interface to the external network (PSTN, ISDN
or PDN). Different signaling protocols are used on the interfaces. Some NSS interfaces involve only
control signaling protocols with no traffic. For example, no traffic is generated on the interfaces between
the GMSC, HLR, and VLR. The GMSC establishes call traffic (at 64 kbps) onto the PSTN
via an SS7-based protocol. The GMSC and MSC exchange traffic (over LAP-D at 64 kbps) and use
SS7 control.

11 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.3 Um interface
The air interface, or Um, is the weakest part of a radio link. In GSM, a lot is done to ensure high
quality, security, and reliability.

Figure 4.11: Um Duplex arrangement

At the air interface, the frequencies are arranged in pairs. Each uplink frequency has a downlink
frequency permanently assigned to it. The arrangement in pairs is what actually enables simultaneous
communication. The difference between the frequency pair is fixed and is called “duplex frequency”.
In GSM 900, the duplex frequency is 45 MHz. Accordingly, the uplink frequency range 890 to 915
MHz, is assigned to a frequency range of 935 to 960 MHz in the downlink. In GSM 1800, the duplex
frequency is 95 MHz. The uplink frequency range lies between 1710 and 1785 MHz, the downlink
frequency range between 1805 and 1880 MHz. In GSM 1900, the duplex frequency is 80 MHz. The
uplink frequency lies between 1850 and 1910 MHz, and the downlink frequency between 1930 and
1990 MHz.
The GSM frequency spectrum allocation for GSM in the 900 MHz band is given by:
Fu(n) = 890 + 0.2n where n is an integer between 0 – 124 inclusive
Fd(n) = Fu(n) + 45
Where n is “Absolute Radio Frequency Channel Number” (ARFCN).

12 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.3.1 FDMA & TDMA

In GSM networks, the transmission over the air interface is digital. Digital transmission in GSM is
based on a combination of the FDMA and the TDMA methods, which already have been introduced.
In FDMA different frequency channels are assigned to each BTS. Mobile phones in neighbouring cells
- or within the same cell - can be used simultaneously, but occupy different frequencies. The FDMA
method uses different carrier frequencies - 124 in GSM 900, 374 in GSM 1800, and 299 in GSM 1900.

Figure 4.12: FDMA and TDMA in GSM

With TDMA, several subscribers share one frequency. Each subscriber is assigned its own time
unit, which is known as a timeslot. In analog mobile systems, on the other hand, a frequency is
occupied by one subscriber for the duration of the call. In TDMA systems, each mobile station sends
and receives information only on the timeslot it has been assigned. These timeslots are either used

13 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

to transmit voice data, or information on signalling and synchronization. The information carried in
one timeslot is called a “burst”.

4.3.2 Modulation
To send digital information over the air interface, the analog radio signals must be interpreted as
bit signals. This process - the transmission of digital information to the air interface - is called
modulation. Modulation takes advantage of the physical characteristics of analog signals, and changes them
in a certain way, depending whether the digital value to be transmitted is 1 or 0.
Signals can be modulated on the basis of their amplitude, their frequency, or their phase. GSM uses
a specific frequency modulation known as the Gaussian Minimum Shift Keying , or GMSK.

4.3.3 TDMA Multiframes

To organize the radio transmission, various frame types consisting of numbered timeslots are specified
in GSM. The numbered timeslots are continuously numbered off by the MS.

14 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Figure 4.13: TDMA frames

TDMA, splits a radio frequency into consecutive periods known as TDMA frames. A simple
TDMA frame consists of eight timeslots. These time slots represent the physical basis for data
transmission. The radio signal between the MS and the BTS consists of a continuous stream of time
slots, organized in TDMA frames. Each connection is always assigned one timeslot. A timeslot is
0.557 ms long. Thus a simple TDMA frame is 4.62 ms long. The length of a timeslot is also referred
to as the burst period. Information is transmitted as bursts in each TDMA frame period. Traffic
channels, i.e. timeslots 1 to 7 in a basic TRX configuration, contain their information organized
in 26 TDMA periods of time known as a multi-frame. This is 26 x 4.62 ms = 120 ms long.
Signaling information, normally provided in time slot 0, is organized in 51 TDMA periods of 4.62
ms each, which makes 235 ms altogether. 26 of these “long” 51-multiframes, or 51 of the ”short” 26-
multiframes form a superframe, which is 6.12 seconds. The largest transmission unit defined is the
hyperframe, which contains 2,048 superframes and is 3 hours, 28 minutes, 53 seconds, and 760 ms long.
TDMA frames, multiframes, superframes and the hyperframe can be considered as counters to organize
user and signalling information within the TRX, and to support cyphering at the air interface.

15 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.3.4 Physical Channels

The information which is physically transmitted over the air interface, Um via the physical channels
must be converted into a 16 kbps signal within a 2 Mbit/s Frame, which connects the BTS and
the BSC as the A-bis interface. It is very important that all MSs within a cell send their digital
information at the right moment, in order to avoid collisions at the timeslots of the air interface,
which would destroy the transmitted information. Therefore, each MS sends its digital voice data
at regular periodic intervals, using a different timeslot to the other MSs within the same cell. The
medium for this transmission process is the timeslots, or physical channels. The content of such a
channel is also known as a burst. Bursts consist of different data blocks containing payload- as well
as security information, to guarantee high data reliability and transmission quality.

4.3.5 Logical Channels

In the GSM network, logical channels are divided into two main groups based on their functionality:
Control and Traffic channels. Control channels, as the name suggests, carry over control plane
information. Traffic channels on the other hand carry user plane data.
Also, by considering the data within each logical channel, they can also be divided into common
and dedicated channels. Common channels contain information common to many users, whilst
dedicated channels are that contain information specific for each user. Figure 4.14 below depicts the
various GSM logical channels:

Figure 4.14: GSM Logical Channels

16 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Broadcast channels
After the subscriber has switched on his mobile station, the mobile station searches for a network. But
how does it log on to the network the subscriber is registered with? For this purpose, the BTS sends out
the Frequency Correction Channel (FCCH) at short regular intervals, to help the MS find a frequency
for downlink reception and adjust its frequency oscillator for the uplink transmission. To do so, it picks
out the strongest received signal. The Synchronization Channel (SCH) then helps the MS to synchronize
itself to timeslot 0 sent out by the BTS. This means the MS must adjust to the rhythm given by the BTS.

Figure 4.15: Broadcast channels

The SCH contains the TDMA frame number as well as the Base Station Identity Code,
containing basic information about the network operator that can be compared with the information stored
on the SIM card. After this step, the mobile is able to decide whether it has chosen the proper
network. If not, it starts the same procedure again trying with the second strongest FCCH received.
While the mobile station uses the FCCH to adjust its frequency, and the SCH for synchronization
and network identification, the Broadcast Control Channel (BCCH), which is also sent by the
BTS. The BCCH supplies the mobile station with additional information about the selected cell, for
example for ciphering. For some Value Added Services, for example location-dependent services,
additional information has to be transmitted from the BTS to the mobile. The Cell Broadcast Channel
CBCH is used for this purpose to transmit geographical parameters, for example Gauss-Krueger
Coordinates of the BTS, to the MS. The FCCH, SCH, BCCH and CBCH are Broadcast Channels,
and exist only in the downlink. They are the first logical channels belonging to the Common Channels.
The information contained within these channels is technically known as System Information (SI).

17 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Assignment: What are the different SI of the GSM network.

Common Control Channels
The MS has now adjusted its frequency and synchronized its TDMAs, and has picked out the best
cell available. But before it can be reached by other subscribers, and before it can initiate calls,
a Location Update and Authentication procedure are necessary. Only after that is the MS
logged on to the network and has radio coverage. It can now be reached by other MSs, or initiate
a call. For this purpose, Common Control Channels are required. Common Control Channels are
“point-to-multipoint” channels, which exist either only in the uplink, or only in the downlink.

Figure 4.16: Common Control Channels

When a subscriber is called, the Paging Channel (PCH) is broadcast in the downlink by all
base stations within a Location Area, so that the MS concerned can react. To initiate a call, the MS sends
out a Random Access Channel (RACH), which carries its identification and request,
for example for registration, to the network. This channel only exists in the uplink. In return, the
network sends the Access Grant Channel (AGCH) in the downlink direction, to assign resources
to the mobile station, by granting it a Stand-Alone Dedicated Control Channel, SDCCH.
The PCH, RACH and AGCH form the group of the Control Channels belonging also to the Common
Channels.

18 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Dedicated Control Channels

Figure 4.17: Dedicated Control Channels

A Stand-alone Dedicated Control Channel (SDCCH) has to be assigned to the mobile station
to exchange the requested signaling with the network, for example authentication, ciphering or call
set-up. Also, it is used to assign a traffic channel, and used to transmits short messages (SMS). The Slow
Associated Control Channel (SACCH) is always linked with an SDCCH or a traffic channel. It sends
measurement reports to the network, and is used for power control and to handle the exact temporal
alignment of the channels, the so-called Timing Advance (TA).

If the subscriber moves into the service area of another BTS, the handover command needed is
transmitted over the Fast Associated Control Channel (FACCH). This channel is also used
for every call release. During the call, FACCH data is transported over the Traffic Channel assigned.

19 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

The Dedicated Control Channels are bidirectional point-to-point channels and belong to the group
of Dedicated Control Channels.

Traffic Channels

Figure 4.18: Traffic Channels

User speech and data are transmitted over the traffic channels we have already spoken about. Traffic
channels are bidirectional, and also belong to the group of dedicated channels. There are two different
channel types supporting different gross bit rates. The Traffic Channel Full rate (TCH/F) has
a gross bit rate of 22.8 kbps. It is used for speech encoded by a Full Rate codec as well as for user
data encapsulating a net bit rate of 9.6 kbps for standard bearer services, or up to 21.4 kbps with
GPRS. The Traffic Channel Half rate (TCH/H) supports 11.4 kbps and is only used for Half
Rate codec speech.

20 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.4 Abis interface

The A-bis interface connects BTS with the BSC. PCM30 configuration is used, whereby the data at
this interface is transmitted via cable or via microwave transmission, at a bit rate of 2 Mbit/s. A
cable connection is more resistant to interference, but a network operator must lease it from a fixed
network operator. The microwave links can be operated independently and are easily configured by
the network operator, but they are more sensitive to interference.
Four types of information can be transmitted over the A-bis interface:

• user information,
• synchronization data,
• signaling information, and
• data for the operation and maintenance of the BTS, known as O&M alarms.

Figure 4.19: Abis interface

In the basic configuration, the channels of the A-bis interface are directly connected to the timeslots
of the radio transmission at the air interface. The physical data rate at the Abis interface is 64 kbps. In
PCM30, timeslot 0 of the Abis interface is used for synchronization. The remaining 31 timeslots of the
PCM30 configuration carry data from and to the TRXs of the BTS, as well as signalling information and
O&M alarms. In the uplink, 4 traffic channels of 16 kbps each are sub-multiplexed and transmitted
from the BTS to the BSC in a physical A-bis time slot, 64 kbps. The same happens in the downlink,
only in the opposite direction, i.e. from the BSC to the TRXs of the BTS. Today’s BSC - BTS
connection can also be configured as a dynamic link with variable signaling and traffic time slots,
according to the current traffic situation.

21 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Figure 4.20: PCM 30

Two PCM30 channels can be assigned to one TRX. These channels consist of 4 subtimeslots each.
Each PCM30-subtimeslot corresponds to a timeslot in the TRX. Thus, by mapping 8 PCM30 subtimeslots
onto one TDMA frame consisting of timeslots 0 to 7, the entire TDMA frame of the TRX would
theoretically be available for the transmission of payload data. But then there wouldn’t be
enough space left for the necessary signalling traffic from and to the mobile stations. According to
a fixed, producer-, and configuration-specific pattern, the signalling information is carried in a specific
A-bis timeslots of 64 kbps each, or in 16 kbps sub-timeslots, for at least 1 TRX per cell, where it uses
timeslot 0 to be transmitted over the air interface. Special timeslots carry the O&M alarm traffic between
the OMC and the BTS over the BSC. The information is, of course, not transmitted over the air interface.
Each 16 kbps of a traffic channel consist of 13 kbps of payload and 3 of in-band signalling between
the BTS and the transcoder. Only the 13 kbps of payload data may be transmitted over the air
interface. Depending on the producer, and on the configuration, each A-bis connection in the PCM30
configuration may transport user information, signalling information, and O&M information from and to
up to 15 TRXs. In the PCM24 configuration, 24 channels achieve an overall bit rate of 1536 kbps at the A-
bis interface. Up to 10 TRXs can be assigned to a connection.

22 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.5 A-ter interface

Figure 4.21: A-ter interface

Four (4) traffic channels of the A interface are bundled into four A-ter channels of 16 kbps each, which
are subsequently transmitted to the BSC in a 64 kbps physical A-ter timeslot. Conversely, signals
coming from the BSC are transcoded from 16 to 64 kbps, which is the bit rate typically used in fixed
networks. Signalling channels are not transcoded. At the A-ter interface, 120 speech channels of
16 kbps each form a 2 Mbit/s multiplex connection. Four times as many A links as A-ter links are
necessary to transmit the same amount of voice data.

23 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.6 A interface

Figure 4.22: A interface

The A-interface transmits user and signalling data between the MSC and the transcoder. It’s the
second completely standardized interface in GSM after the air interface. As an open interface it is
not tied to a specific producer. The A-interface is an ISDN-S2M interface that has been adjusted to
GSM with a data rate of 64 kbps per timeslot. In the PCM30 configuration, the A interface contains
30 traffic channels. Timeslot number 0 takes over synchronization tasks, and timeslot number 16
contains signalling information in the No 7 signalling system format, or SS7. Thus, the air interface
has an overall bit rate of 2048 kbps. The PCM24 configuration, which is generally used in the USA, uses
24 traffic channels. In both configurations, each frame has clearly defined channels for signalling and
synchronization information.

24 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.7 NSS interfaces

Figure 4.23: NSS interfaces

Between the NSS elements we find the following interfaces. Note that the Mobile Services Center
(MSC) and the Visitor Location Register (VLR) form a spatial unit. Between the MSC and the VLR we
find the B-interface. This interface is used to transmit signalling data.
▪ The C-interface is located between the MSC and the Home Location Register (HLR). It is also
used exclusively for signalling data.
▪ The D interface provides the connection between the VLR and the HLR. Like the interfaces B and
C, it transmits signalling data.
▪ The E interface is located between two MSCs. Apart from signalling data, user data and speech
can be transmitted as well.
▪ The F interface is located between the MSC and the Equipment Identity Register (EIR). If an EIR
exists, the interface is used exclusively for signalling data concerning the IMEI control.
The MSCs which provide connections to another mobile radio network, that is a Public Land Mobile
Network (PLMN), or a Public Switched Telephone Network (PSTN), and which are connected to
the HLR, are also known as Gateway-MSCs, or GMSCs. The interface between the visited network
and a GMSC transmits user- and signalling data.

25 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.8 GPRS/EDGE
The general packet radio system (GPRS) provides packet radio access for GSM. In addition
to providing new services for today’s mobile user, GPRS is important as a migration step toward 3G
networks. GPRS allows network operators to implement an IP-based core architecture for data
applications, which will continue to be used and expanded for 3G services for integrated voice and data
applications. The GPRS specifications are written by the European Telecommunications Standard
Institute (ETSI), the European counterpart of the American National Standard Institute (ANSI).
GPRS is the first step toward an end-to-end wireless infrastructure and has the following goals:

• Open architecture
• Consistent IP services
• Same infrastructure for different air interfaces
• Integrated telephony and Internet infrastructure
• Leverage industry investment in IP Service innovation independent of infrastructure

4.8.1 Packet switching

Due to a different transmission method, new coding schemes and the possibility of using multiple
channels, the transmission rates will increase drastically compared to GSM. The data rates in GPRS
will raise the common 9.6 kbps to a gross rate of 171.2 kbps. In contrast to GSM technology, GPRS
transmits data in packets, similar to the Internet. The data is divided into small packets before being sent.
These small packets can reach their destination via different paths in the GPRS network. This is possible,
because each packet includes the receiver address and information about its correct arrangement. On arrival,
the packets are reassembled into the original set of data. Conventional GSM has limitations in data services:
▪ It does not provide direct connection to the Internet. In order to access to the Internet, GSM needs
to call Internet Service Provider (ISP).
▪ Uplink and downlink channels allocated for a user are for entire call period.
▪ It has time-oriented charging, that is, payment is based on connection time, not on data volumes.
▪ Connection setup takes about 20-25 seconds.
▪ Limited capacity, 9.6 kbps. GSM was designed for speech, not for data, hence 50% radio capacity
is wasted, and also there is no optimal channel coding for data.

4.8.2 Benefits of GPRS

The GPRS provides the following benefits:

• Overlays on the existing GSM network to provide high-speed data service

• Always on, reducing the time spent setting up and taking down connections
• Designed to support bursty applications such as e-mail, traffic telematics, telemetry, broadcast
services, and web browsing that do not require detected connection.
By implementing GPRS products and related solutions, mobile service providers can optimize their
networks to deploy high quality mobile voice and data services. They can also benefit from new
operating efficiencies, peer-to-peer IP-based architecture for scalability, and IP standard interfaces
to billing and customer support.

26 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

4.8.3 Network Architecture

Figure 4.24: GPRS architecture

GPRS network elements are SGSN, GGSN, Border Gateway (BG), Backbone network (intraPLMN and
Inter-PLMN), HLR, MSC/VLR, SMS-GSMC.

GPRS requires major changes in the network infrastructure. In addition to the current GSM entities, a
number of new network elements are introduced in order to create an end-to-end packet transfer mode. The
HLR is enhanced with GPRS subscriber information of every MS. The serving GPRS support node (
SGSN) is responsible for the delivery of packets to/from the MSs within its service area and communicates
with the Gateway GPRS Support Node (GGSN). It also keeps track of the mobiles within its service area.
The GGSN acts as a logical interface to external packet data networks (such as the Internet, X.25 networks
or private networks) and maintains routing information used to tunnel Protocol Data Units (PDU) to the
SGSN that is currently serving the MS. A GPRS networks can use multiple serving nodes, but requires only
one gateway node for connecting to an external network (e.g., the Internet).

27 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

The GPRS phone communicates with GSM base stations, (but unlike circuit-switched data calls
which are connected to voice networks by mobile switching center), GPRS packets are sent from BSS
to a SGSN
.
When the MS sends packets of data, it is via the SGSN to the GGSN, which converts them for
transmission over the desired networks (the Internet, X.25 networks or private networks). IP packets
from the Internet addressed for mobile station are received by the GGSN, forwarded to the SGSN
and then transmitted to the mobile station.
4.8.4 GPRS MS
Three classes of GPRS MS are provided: Class A, Class B, or Class C.
▪ Class C
Class C end devices are able to use GSM as well as GPRS services. However, they can use only
one service actively at a time. The service not used is deactivated. The selection of the services is
done manually or is already set by the default-selected configuration of the mobile equipment.
▪ Class B
Class B end devices support both the monitor and activation functionality simultaneously, but
simultaneous sending and receiving of both services is not possible. Through a parallel monitor
mechanism, notification of an upcoming GPRS data transmission can be sent out to the receiver
even during the reception of a GSM service.
▪ Class A
The final high-end class of mobile stations is class A. These end devices support and use both
services
simultaneously.

4.9 Services
GSM networks handle both voice and data traffic requirements of the mobile communication by
providing two modes of operation:

• Circuit switched (high-speed circuit switched data)

• Packet switched (GPRS)
Circuit switching provides the customer with a dedicated channel all the way to the destination. The
customer has exclusive use of the circuit for the duration of the call, and is charged for the duration
of the call.
With packet switching, the operator assigns one or more dedicated channels specifically for shared
use. These channels are up and running 24 hours a day, and when you need to transfer data, you
access a channel and transmit your data. Packet switching is more efficient than circuit switching.
The standard data rate of a GSM channel is 22.8 kbps. From the user’s point of view, GPRS is a wireless
extension of data networks. It can access to data networks, such as IP-based networks (public internet,
private intranet, IPv4 and IPv6 protocols) and X.25 based networks.
GPRS upgrades GSM data services and provides the following services:

• Point-to-point (PTP) service: internetworking with the Internet (IP protocols) and X.25
networks.

28 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

• Point-to-multipoint (PTM) service: point-to-multipoint multicast and point-to-multipoint

group calls.
• SMS service: bearer for SMS
• Anonymous service: anonymous access to predefined services
• Future enhancements: flexible to add new functions, such as more capacity, more users, new
accesses, new protocols, new radio networks

4.10 Typical communication flows

4.10.1 Immediate Assignment
The purpose of immediate assignment is to establish a Radio Resource (RR) connection between
an MS and the network on the Um interface. The immediate assignment procedure is initiated by
the MS.

Figure 4.25: Immediate Assignment

4.10.2 Authentication
The authentication procedure is always initiated and controlled by the network. The network initiates
the authentication procedure in the following cases:

1. The MS applies to change the subscriber information in the VLR or the HLR.
2. Service access is initiated. For example, when the MS originates a call, is called, activated, or
deactivated, or the supplementary service is initiated.
3. The MS accesses the network for the first time after the MSC/VLR restarts.
4. The ciphering key Kc on the network does not match that on the MS
The authentication has two purposes:
1. To permit the network to check whether the identity provided by the MS is acceptable
2. To provide parameters that enable the MS to calculate a new ciphering key
The authentication procedure uses an Authentication Triplet, namely RAND, Kc, and SRES.
The Authentication Triplet is calculated in the AuC of the GSM network. When registering in a GSM

29 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

network, each subscriber is assigned a MSISDN and an IMSI. The IMSI is written into the
SIM through a SIM writer. The SIM writer also generates an authentication parameter Ki,
which is stored in the SIM and the authentication center as well. The IMSI and Ki are permanent
information.
A pseudo-random number generator is used in the AuC to generate an unpredictable pseudo
random number RAND. In the AuC, the RAND and Ki generate a signed response (SRES)
through algorithm A3 and a ciphering key Kc through algorithm A8. The three parameters
RAND, Kc, and SERS constitute an Authentication Triplet, which is stored as part of the subscriber
data in the HLR.

Figure 4.26: Authentication

Generally, the authentication center sends five groups of Authentication Triplet to the HLR at
one time. The HLR automatically stores them. The HLR can store ten groups of Authentication
Triplet. Upon request, the HLR sends five groups of Authentication Triplet to the MSC/VLR at one
time. The MSC/VLR uses the Authentication Triplet one by one. When only two groups are left,
the MSC/VLR requests the HLR for the Authentication Triplet again.

30 | P a g e
 CHAPTER 4: GSM NETWORK TECHNOLOGY

Figure 4.27: Authentication Flow

4.10.3 Location update

The location update procedure is a general one. It is classified into the generic location update,
periodic location update, and IMSI attach procedures. The generic location update, periodic location
update, and IMSI attach procedures are similar. Figure 4.28 shows the periodic location update procedure.

Figure 4.28: Location update

Periodic location update is used to periodically notify the network of the MS availability. The
location update type information element in the Location Updating Request message indicates periodic
update. IMSI Attach Procedure is used to indicate that the IMSI is active in the network. The
Generic location update procedure mainly consists of the following: network requesting additional
MS capability information, network requesting for identification, and authentication.
Assignment: Develop Flows for

1. Mobile originated call

2. Mobile terminated call
3. Handover

31 | P a g e