GSM

❑ Overview
❑ Services
❑ Sub-systems
❑ Components
 GSM: Overview

➢ GSM
❑ formerly: Groupe Spéciale Mobile (founded 1982)
❑ now: Global System for Mobile Communication
❑ Pan-European standard (ETSI, European Telecommunications
Standardisation Institute)
❑ simultaneous introduction of essential digital cellular services
in three phases (1991, 1994, 1996) by the European
telecommunication administrations, seamless roaming within
Europe possible
❑ today many providers all over the world use GSM (more than
130 countries in Asia, Africa, Europe, Australia, America)
❑ more than 5 Billion subscribers *

https://www.gsma.com/newsroom/press-release/number-mobile-subscribers-worldwide-hits-
5-billion/
*
ETEC 405: Wireless Communications
CSE,MAIT
 Advantages of GSM
➢ GSM technology has been matured since long and hence GSM mobile
phones and modems are widely available across the world.
➢ It provides very cost effective products and solutions.
➢ The GSM based networks (i.e. base stations) are deployed across the
world and hence same mobile phone works across the globe. This
leverages cost benefits as well as provides seamless wireless
connectivity. This will help users avail data and voice services without
any disruption. Hence international roaming is not a concern.
➢ It is easy to maintain GSM networks due to availability of large number
of network engineers at affordable cost. This will help in revenue
increase by the telecom operators.
➢ The phone works based on SIM card and hence it is easy to change
the different varieties of phones by users.
➢ The GSM signal does not have any deterioration inside the office and
home premises.

ETEC 405: Wireless Communications

CSE,MAIT
 Disadvantages of GSM

➢ Many of the GSM technologies are patented by Qualcomm and hence

licenses need to be obtained from them.
➢ In order to increase the coverage repeaters are required to be installed.
GSM provides limited data rate capability, for higher data rate GSM
advanced version devices are used.
➢ GSM uses FTDMA access scheme. Here multiple users share same
bandwidth and hence will lead to interference when more number of users
are using the GSM service. In order to avoid this situation, robust
frequency correction algorithms are used in mobile phones and base
stations.
➢ GSM uses pulse based burst transmission technology and hence it
interferes with certain electronics. Due to this fact airplanes, petrol bunks
and hospitals prevent use of GSM based mobile or other gadgets.

ETEC 405: Wireless Communications

CSE,MAIT
 GSM: Mobile Services

➢ GSM offers
❑ several types of connections
voice connections, data connections, short message service
❑ multi-service options (combination of basic services)
➢ Three service domains
❑ Bearer Services – interface to the physical medium (transparent for
example in the case of voice or non transparent for data services)
❑ Telematic Services – services provided by the system to the end user
(e.g., voice, SMS, fax, etc.)
❑ Supplementary Services – associated with the tele services: call
forwarding, redirection, etc.
bearer services
MS
transit source/
TE MT GSM-PLMN network destination TE
R, S Um (PSTN, ISDN) network (U, S, R)

tele services

ETEC 405: Wireless Communications

CSE,MAIT
Tele Services II

➢ Additional services: Non-Voice-Teleservices

❑ group 3 fax
❑ voice mailbox (implemented in the fixed network supporting the
mobile terminals)
❑ electronic mail (MHS, Message Handling System, implemented in
the fixed network)
❑ ...

❑ Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal
using the signaling channel, thus allowing simultaneous use of
basic services and SMS (160 characters)

ETEC 405: Wireless Communications

CSE,MAIT
 Supplementary services

➢ Services in addition to the basic services, cannot be offered

stand-alone
➢ May differ between different service providers, countries
and protocol versions
➢ Important services
❑ identification: forwarding of caller number
❑ suppression of number forwarding
❑ automatic call-back
❑ conferencing with up to 7 participants
❑ locking of the mobile terminal (incoming or outgoing calls)

ETEC 405: Wireless Communications

CSE,MAIT
Subscriber Identity Module (SIM) card

➢ SIM – a memory card (integrated circuit) holding

identity information, phone book etc.
➢ GSM system support SIM cards
➢ other systems, like CDMA do not support SIM cards,
but have something similar called Re-Usable
Identification Module (RUIM)

ETEC 405: Wireless Communications

CSE,MAIT
 International Mobile Equipment Identity (IMEI) key

➢ IMEI – a unique 15 digit number identifying each

phone, is incorporated in the cellular phone by the
manufacturer
➢ IMEI ex.: 994456245689001
➢ when a phone tries to access a network, the service
provider verifies its IMEI with a database of stolen
phone numbers; if it is found in the database, the
service provider denies the connection
➢ the IMEI is located on a white sticker/label under the
battery, but it can also be displayed by typing *#06#
on the phone

ETEC 405: Wireless Communications

CSE,MAIT
International Mobile Subscriber Identity (IMSI) key

➢ IMSI – a 15-digit unique number provided by the

service provider and incorporated in the SIM card
which identifies the subscriber
➢ IMSI enables a service provider to link a phone
number with a subscriber
➢ first 3 digits of the IMSI are the country code

ETEC 405: Wireless Communications

CSE,MAIT
Temporary Mobile Subscriber Identity (TMSI) key

➢ TMSI – is a temporary number, shorter than the

IMSI, assigned by the service provider to the
phone on a temporary basis
➢ TMSI key identifies the phone and its owner in the
cell it is located; when the phone moves to a
different cell it gets a new TMSI key
➢ as TMSI keys are shorter than IMSI keys they are
more efficient to send
➢ TMSI key are used for securing GSM networks

ETEC 405: Wireless Communications

CSE,MAIT
Architecture of the GSM system

➢ GSM is a PLMN (Public Land Mobile Network)

❑ several providers setup mobile networks following the GSM
standard within each country
❑ components
MS (mobile station)
BS (base station)
MSC (mobile switching center)
LR (location register)
❑ subsystems
RSS (radio subsystem): covers all radio aspects
NSS (network and switching subsystem): call forwarding, handover,
switching
OSS (operation subsystem): management of the network

ETEC 405: Wireless Communications

CSE,MAIT
ETEC 405: Wireless Communications
CSE,MAIT
 Radio subsystem

➢ The Radio Subsystem (RSS) comprises the cellular mobile

network up to the switching centers
➢ Components
❑ Base Station Subsystem (BSS):
Base Transceiver Station (BTS): radio components including sender,
receiver, antenna - if directed antennas are used one BTS can cover
several cells
Base Station Controller (BSC): switching between BTSs, controlling
BTSs, managing of network resources, mapping of radio channels (Um)
onto terrestrial channels (A interface)

BSS = BSC + sum(BTS) + interconnection

❑ Mobile Stations (MS)

ETEC 405: Wireless Communications

CSE,MAIT
 Mobile station

➢ Terminal for the use of GSM services

➢ A mobile station (MS) comprises several functional groups
❑ MT (Mobile Terminal):
offers common functions used by all services the MS offers
corresponds to the network termination (NT) of an ISDN access
end-point of the radio interface (Um)
❑ TA (Terminal Adapter):
terminal adaptation, hides radio specific characteristics (TE connects via modem,
Bluetooth, IrDA etc. to MT)
❑ TE (Terminal Equipment):
peripheral device of the MS, offers services to a user
Can be a headset, microphone, etc.
does not contain GSM specific functions
❑ SIM (Subscriber Identity Module):
personalization of the mobile terminal, stores user parameters

TE TA MT
Um
R S

ETEC 405: Wireless Communications

CSE,MAIT
Network and switching subsystem

➢ NSS is the main component of the public mobile network

GSM
❑ switching, mobility management, interconnection to other
networks, system control
➢ Components
❑ Mobile Services Switching Center (MSC)
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC
can belong to a MSC
❑ Databases (important: scalability, high capacity, low delay)
Home Location Register (HLR)
central master database containing user data, permanent and semi-
permanent data of all subscribers assigned to the HLR (one provider
can have several HLRs)
Visitor Location Register (VLR)
local database for a subset of user data - data about all users currently
visiting in the domain of the VLR

ETEC 405: Wireless Communications

CSE,MAIT
Mobile Services Switching Center

➢ The MSC (mobile switching center) plays a central role in

GSM
❑ switching functions
❑ additional functions for mobility support
❑ management of network resources
❑ interworking functions via Gateway MSC (GMSC)
❑ integration of several databases
➢ Functions of a MSC
❑ specific functions for paging and call forwarding
❑ termination of SS7 (signaling system no. 7)
❑ mobility specific signaling
❑ location registration and forwarding of location information
❑ provision of new services (fax, data calls)
❑ support of short message service (SMS)
❑ generation and forwarding of accounting and billing
information

ETEC 405: Wireless Communications

CSE,MAIT
 Operation subsystem

➢ The OSS (Operation Subsystem) enables centralized

operation, management, and maintenance of all GSM
subsystems
➢ Components
❑ Authentication Center (AUC)
generates user specific authentication parameters on request of a VLR
authentication parameters used for authentication of mobile terminals
and encryption of user data on the air interface within the GSM system
❑ Equipment Identity Register (EIR)
registers GSM mobile stations and user rights
stolen or malfunctioning mobile stations can be locked and sometimes
even localized
❑ Operation and Maintenance Center (OMC)
different control capabilities for the radio subsystem and the network
subsystem

ETEC 405: Wireless Communications

CSE,MAIT
 GSM Access Scheme and Channel
Structure
➢ GSM uses FDMA and TDMA to transmit voice and data
➢ the uplink channel between the cell phone and the BTS
uses FDMA and a specific frequency band
➢ the downlink channel between the BTS and the cell
phone uses a different frequency band and the TDMA
technique
➢ there is sufficient frequency separation between the
uplink freq. band and the downlink freq. band to avoid
interference
➢ each uplink and downlink frequency bands is further
split up as Control Channel (used to set up and manage
calls) and Traffic Channel (used to carry voice)

ETEC 405: Wireless Communications

CSE,MAIT
 GSM uplink/downlink frequency
bands used

GSM Frequency Downlink/BTS Uplink/MS Transmits

band Transmit

900 MHz 935-960 MHz 890-915 MHz

1800 MHz 1805-1880 MHz 1710-1785 MHz

1900 MHz 1930-1990 MHz 1850-1910 MHz

ETEC 405: Wireless Communications

CSE,MAIT
 GSM uplink/downlink frequency bands

➢ uplink and downlink take place in different time

slots using TDMA
➢ uplink and downlink channels have a bandwidth of
25 MHz
➢ these channels are further split up in a 124 carrier
frequencies (1 control channels and the rest as
traffic channels); each carrier frequency is spaced
200 KHz apart to avoid interference
➢ these carrier frequencies are further devided by
time using TDMA and each time slot lasts for 0.577
ms.

ETEC 405: Wireless Communications

CSE,MAIT
 GSM Control Channel
➢ is used to communicate management data (setting
up calls, location) between BTS and the cell phone
within a GSM cell
➢ only data is exchanged through the control channel
(no voice)
➢ a specific frequency from the frequency band
allocated to a cell and a specific time slot are
allocated for the control channel (beacon
frequency); a single control channel for a cell
➢ GSM control channels can have the following types:
❑ broadcast channel
❑ common control channel
❑ dedicated control channel

ETEC 405: Wireless Communications

CSE,MAIT
 Broadcast Channel
➢ type of control channel used for the initial
synchronization between the cell phone and the BTS
➢ is composed from:
❑ Frequency Correction Channel (FCCH) – is composed from a
sequence of 148 zeros transmitted by the BTS
❑ Synchronization Channel (SCH) – follows the FCCH and
contains BTS identification and location information
❑ Broadcast Control Channel (BCCH) – contains the frequency
allocation information used by cell phones to adjust their
frequency to that of the network; is continuously broadcasted
by the BTS

ETEC 405: Wireless Communications

CSE,MAIT
 Common Control Channels
➢ type of control chan. used for call initiation
➢ is composed of:
❑ Paging Channel (PCH) – the BTS uses this channel to
inform the cell phone about an incoming call; the cell
phone periodically monitors this channel
❑ Random Access Channel (RACH) – is an uplink channel
used by the cell phone to initiate a call; the cell phone uses
this channel only when required; if 2 phones try to access
the RACH at the same time, they cause interference and
will wait a random time before they try again; once a cell
phone correctly accesses the RACH, BTS send an
acknowledgement
❑ Access Grant Channel (AGCH) – channel used to set up a
call; once the cell phone has used PCH or RACH to receive
or initiate a call, it uses AGCH to communicate to the BTS

ETEC 405: Wireless Communications

CSE,MAIT
 Dedicated Control Channels

➢ control channel sed to manage calls

➢ is comprised from:
❑ Standalone Dedicated Control Channel (SDCCH) – used
along with SACCH to send and receive messages; relays
signalling information
❑ Slow Associated Control Channel (SACCH) – on the
downlink BTS broadcasts messages of the beacon
frequency of neighboring cells to the cell phones; on the
uplink BTS receives acknowledgement messages from the
cell phone
❑ Fast Associated Control Channel (FACCH) – used to
transmit unscheduled urgent messages; FACCH is faster
than SACCH as it can carry 50 messages per second, while
SACCH an caryy only 4.

ETEC 405: Wireless Communications

CSE,MAIT
 Traffic Channel

➢ is used to carry voice data

➢ based on the TDMA the traffic (voice channel) is
divided in 8 different time slots numbered from 0 to 7
➢ the BTS sends signals to a particular cell phone in a
specific time slot (from those 8 time slots) and the
cell phone replies in a different time slot

ETEC 405: Wireless Communications

CSE,MAIT
GSM Radio Interface - TDMA/FDMA

935-960 MHz
124 channels (200 kHz)
downlink

890-915 MHz
124 channels (200 kHz)
uplink
higher GSM frame structures
time

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
ETEC 405: Wireless Communications
CSE,MAIT
GSM protocol layers for signaling

Um Abis A
MS BTS BSC MSC

CM CM

MM MM

BSSAP
BSSAP
RR RR’
RR’ BTSM BTSM
SS7 SS7
LAPDm LAPDm LAPD LAPD

radio radio PCM PCM PCM PCM

16/64 kbit/s 64 kbit/s /

2.048 Mbit/s

ETEC 405: Wireless Communications

CSE,MAIT
 Mobile Terminated Call

➢1: calling a GSM subscriber ➢

➢2: forwarding call to GMSC
4
➢3: signal call setup to HLR HLR VLR
5
➢4, 5: request MSRN from VLR 8 9
3 6 14 15
➢6: forward responsible
MSC to GMSC calling 7
PSTN GMSC MSC
station 1 2
➢7: forward call to
10 10 13 10
➢ current MSC 16
➢8, 9: get current status of MS BSS BSS BSS
➢10, 11: paging of MS 11 11 11
➢12, 13: MS answers
11 12
➢14, 15: security checks 17
➢16, 17: set up connection MS

ETEC 405: Wireless Communications

CSE,MAIT
 Initializing a call
1. when the cell phone is turned on it scans all the available frequencies
for the control channel
2. all the BTS in the area transmit the FCCH, SCH and BCCH that contain
the BTS identification and location
3. out of available beacon frequencies from the neighboring BTSs, the
cell phone chooses the strongest signal
4. based on the FCCH of the strongest signal, the cell phone tunes itself
to the frequency of the network
5. the phone send a registration request to the BTS
6. the BTS sends this registration request to the MSC via the BSC
7. the MSC queries the AUC and EIR databases and based on the reply it
authenticates the cell phone
8. the MSC also queries the HLR and VLR databases to check whether
the cell is in its home area or outside
9. if the cell phone is in its home area the MSC gets all the necessary
information from the HLR if it is not in its home area, the VLR gets
the information from the corresponding HLR via MSCs
10. then the cell phone is ready to receive or make calls.

ETEC 405: Wireless Communications

CSE,MAIT
Initializing a call (2)

ETEC 405: Wireless Communications

CSE,MAIT
 Making a call
1. when thee phone needs to make a call it sends an access
request (containing phone identification, number) using RACH
to the BTS; if another cell phone tries to send an access
request at the same time the messages might get corrupted, in
this case both cell phones wait a random time interval before
trying to send again
2. then the BTS authenticates the cell phone and sends an
acknowledgement to the cell phone
3. the BTS assigns a specific voice channel and time slot to the
cell phone and transmits the cell phone request to the MSC via
BSC
4. the MSC queries HLR and VLR and based on the information
obtained it routes the call to the receiver’s BSC and BTS
5. the cell phone uses the voice channel and time slot assigned to
it by the BTS to communicate with the receiver

ETEC 405: Wireless Communications

CSE,MAIT
Making a call (2)

ETEC 405: Wireless Communications

CSE,MAIT
Receiving a call
1. when a request to deliver a call is made in the network, the MSC
or the receiver’s home area queries the HLR; if the cell phone is
located in its home area the call is transferred to the receiver; if
the cell phone is located outside its home area, the HLR
maintains a record of the VLR attached to the cell phone
2. based on this record, the MSC notes the location of the VLR and
indicated the corresponding BSC about the incoming call
3. the BSC routes the call to the particular BTS which uses the
paging channel to alert the phone
4. the receiver cell phone monitors the paging channel
periodically and once it receives the call alert from the BTS it
responds to the BTS
5. the BTS communicates a channel and a time slot for the cell
phone to communicate
6. now the call is established

ETEC 405: Wireless Communications

CSE,MAIT
Receiving a call (2)

ETEC 405: Wireless Communications

CSE,MAIT
 Mobile Originated Call

➢1, 2: connection request

➢3, 4: security check
➢5-8: check resources (free
circuit) VLR
➢9-10: set up call
3 4
6 5
PSTN GMSC MSC
7 8
2 9
1
MS BSS
10

ETEC 405: Wireless Communications

CSE,MAIT
MTC/MOC
MS MTC BTS MS MOC BTS
paging request
channel request channel request
immediate assignment immediate assignment
paging response service request
authentication request authentication request
authentication response authentication response
ciphering command ciphering command
ciphering complete ciphering complete
setup setup
call confirmed call confirmed
assignment command assignment command
assignment complete assignment complete
alerting alerting
connect connect
connect acknowledge connect acknowledge
data/speech exchange data/speech exchange

ETEC 405: Wireless Communications

CSE,MAIT
Handoffs

➢ GSM uses mobile assisted hand-off (MAHO). Signal strength

measurements are sent to the BS from the mobile.
➢ The MSC decides when to do a handoff and it informs the new
BS and the mobile.
➢ When a mobile switches to a new BS it sends a series of
shortened bursts to adjust its timing (giving the bS time to
calculate it and send it) and allow the new BS to synchronize its
receiver to the arrival time of the messages

ETEC 405: Wireless Communications

CSE,MAIT
4 types of handover

1
2 3 4
MS MS MS MS

BTS BTS BTS BTS

BSC BSC BSC

MSC MSC

ETEC 405: Wireless Communications

CSE,MAIT
Handover decision

receive level receive level

BTSold BTSold

HO_MARGIN

MS MS

BTSold BTSnew

ETEC 405: Wireless Communications

CSE,MAIT
 Handover procedure

MS BTSold BSCold MSC BSCnew BTSnew

measurement measurement
report result

HO decision
HO required HO request
resource allocation
ch. activation

HO command HO request ack ch. activation ack

HO command HO command
HO access
Link establishment

HO complete HO complete
clear command clear command
clear complete clear complete

ETEC 405: Wireless Communications

CSE,MAIT
 Security in GSM
➢ Security services
❑ access control/authentication
user SIM (Subscriber Identity Module): secret PIN (personal
identification number)
SIM network: challenge response method
❑ confidentiality
voice and signaling encrypted on the wireless link (after successful
authentication)
❑ anonymity
“secret”:
temporary identity TMSI
• A3 and A8
(Temporary Mobile Subscriber Identity) available via the
newly assigned at each new location update (LUP) Internet
encrypted transmission • network providers
can use stronger
➢ 3 algorithms specified in GSM mechanisms
❑ A3 for authentication (“secret”, open interface)
❑ A5 for encryption (standardized)
❑ A8 for key generation (“secret”, open interface)

ETEC 405: Wireless Communications

CSE,MAIT
GSM - authentication

mobile network SIM

RAND
Ki RAND RAND Ki

AC 128 bit 128 bit 128 bit 128 bit

A3 A3
SIM
SRES* 32 bit SRES 32 bit

SRES
MSC SRES* =? SRES SRES
32 bit

Ki: individual subscriber authentication key SRES: signed response

ETEC 405: Wireless Communications

CSE,MAIT
 GSM - key generation and encryption

mobile network (BTS) MS with SIM

RAND
Ki RAND RAND Ki
AC 128 bit 128 bit 128 bit 128 bit SIM

A8 A8

cipher Kc
key 64 bit Kc
64 bit
data encrypted SRES
data
BTS
data MS
A5 A5

ETEC 405: Wireless Communications

CSE,MAIT
Data services in GSM I
➢ Data transmission standardized with only 9.6 kbit/s
❑ advanced coding allows 14.4 kbit/s
❑ not enough for Internet and multimedia applications
➢ HSCSD (High-Speed Circuit Switched Data)
❑ already standardized
❑ bundling of several time-slots to get higher
AIUR (Air Interface User Rate)
(e.g., 57.6 kbit/s using 4 slots, 14.4 each)
❑ advantage: ready to use, constant quality, simple
❑ disadvantage: channels blocked for voice transmission
AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4
4.8 1
9.6 2 1
14.4 3 1
19.2 4 2
28.8 3 2
38.4 4
43.2 3
57.6 4

ETEC 405: Wireless Communications

CSE,MAIT
Data services in GSM II
➢ GPRS (General Packet Radio Service)
❑ packet switching
❑ using free slots only if data packets ready to send
(e.g., 115 kbit/s using 8 slots temporarily)
❑ standardization 1998
❑ advantage: one step towards UMTS, more flexible
❑ disadvantage: more investment needed
➢ GPRS network elements
❑ GSN (GPRS Support Nodes): GGSN and SGSN
❑ GGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)
❑ SGSN (Serving GSN)
supports the MS (location, billing, security)
❑ GR (GPRS Register)
user addresses

ETEC 405: Wireless Communications

CSE,MAIT
 Speech Compression

➢ Handling speech with other media information such as text,

images, video, and data is the essential part of multimedia
applications
➢ The ideal speech coder has a low bit-rate, high perceived
quality, low signal delay, and low complexity.
➢ Delay
❑ Less than 150 ms one-way end-to-end delay for a conversation
❑ Processing (coding) delay, network delay
❑ Over Internet, ISDN, PSTN, ATM, …
➢ Complexity
❑ Computational complexity of speech coders depends on
algorithms
❑ Contributes to achievable bit-rate and processing delay

ETEC 405: Wireless Communications

CSE,MAIT
Speech coding

➢ Standard voice channel:

❑ analog: 4 kHz slot (~ 40 dB SNR)
❑ digital: 64 Kbps = 8 bit µ-law x 8 kHz

➢ How to compress?
❑ Exploit redundancy
signal assumed to be a single voice, not any waveform
❑ Code only what is needed
intelligibility
speaker identification

➢ Source-filter decomposition
❑ vocal tract shape & fundamental frequency change slowly

ETEC 405: Wireless Communications

CSE,MAIT
Taxonomy of Speech Coders

Speech Coders

Waveform Coders Source Coders

Time Domain: Frequency Domain: Linear Vocoder

PCM, ADPCM e.g. Sub-band coder, Predictive
Adaptive transform Coder
coder

ETEC 405: Wireless Communications

CSE,MAIT
GSM Speech Encoder

Pre-processing STP LTP Regular pulse excitation

(RPE)

Order = 8
LAR coefficients
Hamming Short
Window Term Long
Gain, pitch
Prediction Term
Prediction

MUX
Segmentation
20ms LPC
Inverse Grid
Pre-emphasis Filter + LPF
Selection

Speech
input

ETEC 405: Wireless Communications

CSE,MAIT
 Implementation Issues

➢ Tasks: ➢ Often implemented in DSP

❑ LPC analysis filter to chips for embedded
calculate the coefficients applications (e.g. cell phone).
❑ Long term prediction for ➢ The parameter quantization
pitch analysis need to find part needs bit-level operation.
delay D and gain
❑ VQ search during CELP
encoding – Most time
consuming
❑ FIR filtering for pre- and
post processing

ETEC 405: Wireless Communications

CSE,MAIT