You are on page 1of 40

Security Level:

GSM Fundamentals

www.huawei.com

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential


Contents

Basic Concepts of Cellular Mobile System


Channels on The Air Interface
Service Area and Number Planning

GSM Network Components


Radio Technologies

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 2


Objectives

On completion of this section


you will be able to:

 Name the two different cell types and


understand why and when each would
be used.
 Get the concept of frequency reuse.
 Name the frequency spectrum used in
GSM

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 3


CELL

Omni
Omni-Directional
Omni-Directional Cells
Cells
1

120
120 Degree
Degree Sectors
Sectors 1
120
degree 2
3
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 4
Cell concept Signal
strength

Rural
Highway

Suburb Town
distance

• Cell
Flexible
: basic
network
service
planning
area that
based
can be
on efficiently
location nature
managed by the
network
• Smooth Handover (no service degradation while subscriber
•moves)
One base station (equipment to switch, transmit and receive calls)
per cell for comm. between MS and the network
• Frequency reuse (same group of frequencies used in different
•cells)
Cell boundaries are defined by BS signal strength
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 5
Physical Spectrum
Frequency channels GSM 900
45 MHz duplex spacing

… S
200 KHz x 125 = 25 MHz ……
8T
… sx t
890 MHz
0. 57 7
m 915 MHz
…935 MHz 960 MHz f
e=
fra
m
200 KHz …
D MA
1T

25 MHz … 25 MHz
Uplink (MS to BS) Downlink (BS to MS)
f
890 MHz
… 915 MHz

200 KHz
For DCS1800: uplink from 1710 to 1785MHz, downlink is from 1805 to
1880MHz 75Mhz each / 374 RF carriers . 95MHz duplex spacing.
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 6
Contents

Basic Concepts of Cellular Mobile System


Channels on The Air Interface
Service Area and Number Planning
GSM Network Components
Radio Technologies

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 7


Objectives

On completion of this section


you will be able to:

Identify the types of physical channels


and logical channels

Name the 4 most commonly used channel


combinations

Understand the structure of multiframes

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 8


Logical traffic channels
Logical channels
LogicalChannels
Logical Channels

TCH
TCH
SPEECH
SPEECH DATA
CCH DATA
CCH

TCH/HR
TCH/HR TCH/FR
TCH/FR
7kbps
7kbps 13kbps
13kbps 2.4/4.8kbps((FR&HR)
2.4/4.8kbps FR&HR) 9.6kbpsFR
9.6kbps FR

logical channels consist of the information carried over the physical channel.

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 9


Logical control channels
CCH
CCH

DCH
DCH CCCH
CCCH BCH
BCH

SACCH SDCCH
SACCH SDCCH PCH AGCH
PCH AGCH RACH
RACH
FCCH
FCCH
Power & timing control
RSSI & link quality
BCCH
BCCH SCH
SCH
FACCH
FACCH •Power Control indicator
•cell ID , LAI , PLMN code
Auth. and HO. •List of neighboring cells

--Broadcast
Standalone
Slow/Fast
Random
Paging control
access
associated
channel channel,
- Frequency-correction
dedicated
:channel,
usedcontrolused
tochannel,
channel
for
page toused
channels
dedicatedsend
:(alert)
Supports
MS cell
:for MS
theinformation.
channels
carryingfrequency
transfer correction.
of data
assignment
information during connection
request
associated with the
- Synchronization
setup
-Access
process being
grantcarried channel,
channel, out
used used
on to
either for
assigntheMS frameor
dedicated
SDCCH synchronization
control channels and
the TCH. BS MS
for the
identification.
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 10
Timeslots and TDMA Frames
Low Capacity Cell / 1 RF carrier

0 1 2 3 4 5 6 7
Combined Traffic

Higher Capacity Cell / more than 1 RF carrier

0 1 2 3 4 5 60 7
Broadcast Traffic
Dedicated

0 1 2 3 4 5 60 7
Traffic
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 11
GSM Logical Channel

Channel Combination

•Main BCH combination – BCCH + CCCH

•DCH combination – SDCCH8 + SACCH8

•Combined Channel Combination – BCCH + CCCH +SDCCH4 +


SACCH4
•TCH combination – TCH8/FACCH + SACCH

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 12


Structure of Logical Channel Combination
Frame-Main BCCH
1 multi-frame (51TDMA Frames) 235.38ms Downlink

Group3,4
Group Group1 Group2 (same as Grpup5
Group2)

Channel F S BX4 CX4 F S CX4 CX4 …… F S CX4 CX4 I

Frame
0 1 2-5 6-9 10 11 12-15 16-19 20-39 40 41 42-45 46-49 50
Number

1 multi-frame (51TDMA Frames) 235.38ms Uplink

Channel R R R R R R R R R R R R R R……R R R R R

Frame
0 1 2 3 4 5 6 7 8 9 10 11 12 13-46 47 48 49 50
Number

F:FCCH; S:SCH; B:BCCH; C:CCCH; I:IDLE; R:RACH

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 13


Structure of Logical Channel Combination
Frame-Main SDCCH
1 multi-frame (51TDMA Frames) 235.38ms Downlink

Channel D0×4 D1×4 D2×4 D3×4 D4×4 D5×4 D6×4 D7×4 A0×4 A1×4 A2×4 A3×4 I I I

Channel D0×4 D1×4 D2×4 D3×4 D4×4 D5×4 D6×4 D7×4 A4×4 A5×4 A6×4 A7×4 I I I

Frame Number 0-3 4-7 8-11 12-15 16-19 20-23 24-27 28-31 32-35 36-39 40-43 44-47 48 49 50

1 multi-frame (51TDMA Frames) 235.38ms Uplink

D1×
Channel A5×4 A6×4 A7×4 I I I D0×4 D2×4 D3×4 D4×4 D5×4 D6×4 D7×4 A0×4
4

D1×
Channel A1×4 A2×4 A3×4 I I I D0×4 D2×4 D3×4 D4×4 D5×4 D6×4 D7×4 A4×4
4

Frame 19-
0-3 4-7 8-11 12 13 14 15-18 23-26 27-30 31-34 35-38 39-42 43-46 47-50
Number 22

F:FCCH; S:SCH; B:BCCH; C:CCCH; I:IDLE; R:RACH


HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 14
Structure of Logical Channel Combination
Frame-Combined BCCH
1 multi-frame (51TDMA Frames) 235.38ms Downlink

Group Group1 Group2 Group3 Group4 Grpup5

B× C× C× C× D0 D1 D2 D3 A0 A1
Channel F S F S F S F S F S I
4 4 4 4 ×4 ×4 ×4 ×4 ×4 ×4

B× C× C× C× D0 D1 D2 D3 A2 A3
Channel F S F S F S F S F S I
4 4 4 4 ×4 ×4 ×4 ×4 ×4 ×4

Frame 12- 16- 22- 26- 32- 36- 42- 46-


0 1 2-5 6-9 10 11 20 21 30 31 40 41 50
Number 15 19 25 29 35 39 45 49

1 multi-frame (51TDMA Frames) 235.38ms Uplink

Channel D3×4 R R A2×4 A3×4 R……R D0×4 D1×4 R R D2×4

Channel D0×4 R R A0×4 A1×4 R……R D0×4 D1×4 R R D2×4

Frame Number 0-3 4 5 6-9 10-13 14-36 37-40 41-44 45 46 47-50

F:FCCH; S:SCH; B:BCCH; C:CCCH; I:IDLE; R:RACH


HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 15
Structure of Logical Channel Combination
Frame-TCH
1 multi-frame (26TDMA Frames) 120ms

Channel T T T T T T T T T T T.A…T T T T T I

Frame Number 0 1 2 3 4 5 6 7 8 9 10-12 - 20 21 22 23 24 25

T:TCH; I:IDLE ; A:SACCH

.The FACCH is not showed in the diagram as it does not receive its own
time allocation. The FACCH steals a time period from the TCH when
required.
.The 13th frame is used by the SACCH which carriers link control
information to and from the mobile and BTS.

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 16


Frames hierarchy

The hyper frame lasts for over 3 hours, after which ciphering and FH algorithms are restarted.

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 17


Contents

Basic Concepts of Cellular Mobile System


Channels on The Air Interface
Service Area and Number Planning
GSM Network Components
Radio Technologies

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 18


Service Area
System area
PLMN
PLMN service
service area
area PLMN service area

MSC service area... MSC service area...

Location area... Location area...


......
Base station area... Base station area...

Radio cell
Radio cell

...... ......

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 19


LAI

MCC MNC LAC

Location Area Identification

The LAI is the international code for a location area.

MCC : Mobile Country Code , It consists of 3 digits .


For example: The MCC of China is "460"
MNC : Mobile Network Code , It consists of 2 digits .
For example: The MNC of China Mobile is "00"
LAC : Location Area Code , It is a two bytes BCD
code(hex).
The value 0000 and FFFF is invalid.
For example: 460-00-0011
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 20
CGI

CGI: Cell Global Identification

The CGI is a unique international identification for a


cell
The format is LAI+CI
LAI: Location Area Identification
CI : Cell Identity. This code uses two bytes BCD
code(hex) to identify the radio cells within an LAI.
For example : 460-00-0011-0001

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 21


MSISDN

CC NDC SN
National (significant)
Mobile number
Mobile station international
ISDN number

CC : Country Code. For example: The CC of China is


"86".
NDC : National Destination Code. For example: The NDC of
China Telecom is 139, 138, 137, 136, 135.
SN : Subscriber Number. Format:H0 H1 H2 H3 ABCD
Example: 86-139-0666-1234
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 22
IMSI

Not more than 15 digits


3 digits 2 digits

MCC MNC MSIN


NMSI
IMSI

MCC : Mobile Country Code , It consists of 3 digits .


For example: The MCC of China is "460" 。
MNC : Mobile Network Code , It consists of 2 digits .
For example: The MNC of China Telecom is "00" 。
MSIN : Mobile Subscriber Identification Number. H1H2H3 S
ABCDEF
For example: 666-9777001
NMSI : National Mobile Subscriber Identification , MNC and MSIN
form it together.
For Example of IMSI : 460-00-666-9777001
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 23
TMSI

TMSI: Temporary Mobile Subscriber Identification)

 The TMSI is assigned only after successful


subscriber authentication.
 TMSI is used to ensure that the identity of the
mobile subscriber on the air interface is kept
secret.
 The TMSI consists of 4 bytes( 8 HEX numbers)
and determined by the telecom operator.

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 24


IMEI

IMEI: International Mobile Station Equipment Identification

TAC FAC SNR SP

IMEI

TAC : Type approval code. It is administered by the type


approval center.
FAC : Final assembly code.It is administered by the
manufacturer.
SNR : Serial number.It is issued by the manufacturer of the
MS.
SP : Not used.
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 25
Contents

Basic Concepts of Cellular Mobile System


Channels on The Air Interface
Service Area and Number Planning
GSM Network Components
Radio Technologies

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 26


GSM network architecture

Permanent
White list : data:
Temporary data:
--copy
IMSIof
Valid most of data for
mobiles
active
- subscribers in
Suppl. service info . OMC
Black list :
VLR coverage
-Authentication key Other GSM
Stolen
-Mobileor forbidden
status
-Roaming & billing info
-LAI list :
Gray
-TMSI
-TMSI
Faulty mobiles
Temporary data:
-MSC/VLR address

PSTN

Base Transceiver Station : the first access point for mobile stations to access the
Mobile
Base
Mobile
Station
Switching
network.Station
TheController
: -Center
BTS Mobile : :controls
is a radioEquipment
controlsone
onecontains
equipment or
or more
moreIMEI
BTSs
BSCsfor
(transceivers and
&and
ME
interfaces
manages
identification
antennas) BSS
switching
needed totoNSS. It is
serve
a high
each capacity
cell switch
- Subscriber
in the network. that provides
Identityhandover,
module contains
cell configuration
IMSI,TMSI,LAI,Auth.
data. key
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 27
Subscriber Identity Module – SIM
Authentication Process

Air interface
NSS MS
SIM
HLR AUC

Authentication Authentication
Algorithms Algorithms

Authentication Authentication
Algorithms Algorithms
BSS
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 28
Transcoder and submultiplexer

30 x 64k voice channels = 120 x 16k compressed/combined = 2Mbps PCM link

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 29


Mobile to Landline call
MS BSS MSC VLR HLR PSTN
CHANNEL REQUEST <RACH>

DCCH ASSIGN <AGCH>

SIGNALING LINK
ESTABLISHED

<SDCCH> CR
REQ. FOR SERVICE
CC

AUTHENTICATION

SET Cipher MODE

<SDCCH> SFOC
SET-UP
Call Info services Auth.
EQUIP. ID REQ.

COMPLETE CALL

<SDCCH>
CALL PROCEEDING

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 30


Mobile to Landline call

MS BSS MSC VLR HLR PSTN


<SDCCH>
ASSIG. COMMAND

ASSIG. COMPLETE <TCH>

Initial and Final Address ISUP (IAM)


Message (IAM)

Address Complete(ACM)
<FACCH> (ACM)
Alerting + alerting
MS hears ring
tone from land
phone

Answer (ANS)Connect
ANS 
<FACCH> Conn.
Ring tone
stops
<FACCH> Conn. ack
Connect Acknowledge
TCH BILLING
connect

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 31


Contents

Basic Concepts of Cellular Mobile System


Channels on The Air Interface
Service Area and Number Planning
GSM Network Components
Radio Technologies

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 32


Objectives

On completion of this section you


will be able to know about the
following radio technologies :

VAD, DTX, DRX

Diversity

Frequency Hopping

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 33


Battery Life

Power Control
Voice Activity Detection – VAD

Discontinuous Transmission – DTX

Discontinuous Reception – DRX

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 34


VAD & DTX

Without DTX

Encoding the speech


silences at a rate of 500
bit/s rather than the full
13Kb/s.

If the mobile does not


transmit during ‘silence’ With DTX
there is a reduction in
the overall power output
requirement

Comfort
Noise
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 35
DRX

PCH is structured so that MS knows when it needs to check for a paging


signal.  In the time between paging signals, the mobile can go into sleep
mode, when almost no power is used.

BCCH Multiframe P = Paging Channel

PPPPPP BCCH PP

MS Being MS in MS receive System MS in


paged listen mode listen mode
information
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 36
Diversity
Approx. 10
wavelengths
When diversity is implemented two
antennas are situated at the receiver.
These antennas are placed several
wavelengths apart to ensure
minimum correlation between the
two receive paths.

Compare or
The two signals are then add signals
combined, this ensures that a
low signal strength is less likely
to occur.
Resultant Signal

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 37


Frequency Hopping

Each time the BTS or mobile transmits a burst, it


does so on a different RF carrier frequency.

Synthesizer Hopping:each frequency


timeslot on a given transceiver
can transmit at a different
frequency

Baseband Hopping: each


transceiver stays at the same
frequency and the data is
switched to the appropriate
transceiver.

time
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 38
HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 39
Subscriber Identity Module – SIM

HUAWEI TECHNOLOGIES CO., LTD. HUAWEI Confidential Page 40

You might also like