Global System for Mobile Communication GSM n n

Global System for Mobile Communication (GSM) n n Also known as: "Global System for Mobile Communications", "Groupe Special Mobile" to describe protocols for second generation (2 G) digital cellular networks circuit-switched network optimized for full duplex voice telephony. It is used by mobile phones and a replacement for first generation (1 G) analog cellular networks. GSM is a TDMA based wireless network technology developed in Europe that is used throughout most of the world. GSM phones make use of a SIM card to identify the user's account. The use of the SIM card allows GSM network users to quickly move their phone number from one GSM phone to another by simply moving the SIM card. Currently GSM networks operate on the 850 MHz, 900 MHz, 1800 MHz, and 1900 MHz frequency bands.

Global System for Mobile Communication (GSM) n n n n Why GSM? The GSM study group aimed to provide the followings through the GSM: Improved spectrum efficiency. International roaming. Low-cost mobile sets and base stations (BSs). High-quality speech. Compatibility with Integrated Services Digital Network (ISDN) and other telephone company services. Support for new service

GSM characteristics n n n previous standard in cellular communication were restrictive GSM – global digital standard for cellular phones that offered roaming facility first named Groupe Special Mobile and used in Europe; then usage extended to other continents GSM operate in frequency bands: 900 MHz, 1800 MHz, 1900 MHz GSM provides voice and data services

The GSM Architecture n n n n n SIM Subscriber Identity Module HLR Home Location Register MS Mobile Station VLR Visitor Location Register BTS Base Transceiver Station EIR Equipment Identity Register BSC Base Station Controller AC Authentication Centre MSC Mobile services Switching Centre PSTN Public Switched Telecomm Network VLR Visitor Location Register ISDN Integrated Services Digital Network PLMN Public land mobile Network

The GSM Architecture

The GSM Architecture-Working n n n The GSM network can be divided into three broad parts. The Mobile Station is carried by the subscriber. Base Station Subsystem controls the radio link with the Mobile Station. The Network Subsystem, the main part of which is the Mobile services Switching Center, performs the switching of calls between the mobile and other fixed or mobile network users, as well as management of mobile services, such as authentication. The Mobile Station and the Base Station Subsystem communicate across the Um interface, also known as the air interface or radio link. The Base Station Subsystem communicates with the Mobile service Switching Center across the A interface.

Subscriber Identity Module (SIM) card n n n SIM – a memory card (integrated circuit) holding identity information, phone book etc. GSM system support SIM cards other systems, like CDMA do not support SIM cards, but have something similar called Re-Usable Identification Module (RUIM)

International Mobile Equipment Identity (IMEI) key n n IMEI – a unique 15 digit number identifying each phone, is incorporated in the cellular phone by the manufacturer IMEI ex. : 994456245689001 when a phone tries to access a network, the service provider verifies its IMEI with a database of stolen phone numbers; if it is found in the database, the service provider denies the connection the IMEI is located on a white sticker/label under the battery, but it can also be displayed by typing *#06# on the phone

International Mobile Subscriber Identity (IMSI) key n n n IMSI – a 15 -digit unique number provided by the service provider and incorporated in the SIM card which identifies the subscriber IMSI enables a service provider to link a phone number with a subscriber first 3 digits of the IMSI are the country code

Temporary Mobile Subscriber Identity (TMSI) key n n TMSI – is a temporary number, shorter than the IMSI, assigned by the service provider to the phone on a temporary basis TMSI key identifies the phone and its owner in the cell it is located; when the phone moves to a different cell it gets a new TMSI key as TMSI keys are shorter than IMSI keys they are more efficient to send TMSI key are used for securing GSM networks

HLR, VLR and EIR registers n n n Home Location Register (HLR) - is a database maintained by the service provider containing permanent data about each subscriber (i. e. location, activity status, account status, call forwarding preference, caller identification preference) Visitor Location Register (VLR) – database that stores temporary data about a subscriber; it is kept in the MSC of the area the subscriber is located in; when the subscriber moves to a new area the new MSC requests this VLR from the HLR of the old MSC Equipment Identity Register (EIR) – database located near the MSC and containing information identifying cell phones

Authentication Center (Au. C) n n 1 st level security mechanism for a GSM cellular network is a database that stores the list of authorized subscribers of a GSM network it is linked to the MSC and checks the identity of each user trying to connect also provides encryption parameters to secure a call made in the network

Mobile Station n n The mobile station (MS) consists of the physical equipment, such as the radio transceiver, display and digital signal processors, and a smart card called the Subscriber Identity Module (SIM). The SIM provides personal mobility, so that the user can have access to all subscribed services irrespective of both the location of the terminal and the use of a specific terminal. By inserting the SIM card into another GSM cellular phone, the user is able to receive calls at that phone, make calls from that phone, or receive other subscribed services. The mobile equipment is uniquely identified by the International Mobile Equipment Identity (IMEI). The SIM card contains the International Mobile Subscriber Identity (IMSI), identifying the subscriber, a secret key for authentication, and other user information. The IMEI and the IMSI are independent, thereby providing personal mobility. The SIM card may be protected against unauthorized use by a password or personal identity number.

Base Station Subsystem n n n The Base Station Subsystem is composed of two parts, the Base Transceiver Station (BTS) and the Base Station Controller (BSC). These communicate across the specified bits interface, allowing (as in the rest of the system) operation between components made by different suppliers. The Base Transceiver Station houses the radio transceivers that define a cell and handles the radio-link protocols with the Mobile Station. In a large urban area, there will potentially be a large number of BTSs deployed. The requirements for a BTS are ruggedness, reliability, portability, and minimum cost. The Base Station Controller manages the radio resources for one or more BTSs. It handles radio-channel setup, frequency hopping, and handovers, as described below. The BSC is the connection between the mobile and the Mobile service Switching Centre (MSC).

Network Substation n The central component of the Network Subsystem is the Mobile services Switching Centre (MSC). It acts like a normal switching node of the PSTN or ISDN, and in addition provides all the functionality needed to handle a mobile subscriber, such as registration, authentication, location updating, handovers, and call routing to a roaming subscriber. These services are provided in conjunction with several functional entities, which together form the Network Subsystem. The MSC provides the connection to the public fixed network (PSTN or ISDN), and signalling between functional entities uses the ITU Signalling System Number 7 (SS 7), used in ISDN and widely used in current public networks.

Network Substation (Cont. . ) n The Home Location Register (HLR) and Visitor Location Register (VLR), together with the MSC, provide the call routing and (possibly international) roaming capabilities of GSM. The HLR contains all the administrative information of each subscriber registered in the corresponding GSM network, along with the current location of the mobile. The current location of the mobile is in the form of a Mobile Station Roaming Number (MSRN) which is a regular ISDN number used to route a call to the MSC where the mobile is currently located. There is logically one HLR per GSM network, although it may be implemented as a distributed database.

Network Substation (Cont. . ) n The Visitor Location Register contains selected administrative information from the HLR, necessary for call control and provision of the subscribed services, for each mobile currently located in the geographical area controlled by the VLR. Although each functional entity can be implemented as an independent unit, most manufacturers of switching equipment implement one VLR together with one MSC, so that the geographical area controlled by the MSC corresponds to that controlled by the VLR, simplifying the signalling required. Note that the MSC contains no information about particular mobile stations - this information is stored in the location registers.

GSM Access Scheme and Channel Structure n n n GSM uses FDMA and TDMA to transmit voice and data the uplink channel between the cell phone and the BTS uses FDMA and a specific frequency band the downlink channel between the BTS and the cell phone uses a different frequency band the TDMA technique there is sufficient frequency separation between the uplink freq. band the downlink freq. band to avoid interference each uplink and downlink frequency bands is further split up as Control Channel (used to set up and manage calls) and Traffic Channel (used to carry voice)

GSM uplink/downlink frequency bands used GSM Frequency band Uplink/BTS Transmit Downlink/BTS Receive 900 MHz 935 -960 MHz 890 -915 MHz 1800 MHz 1805 -1880 MHz 1710 -1785 MHz 1900 MHz 1930 -1990 MHz 1850 -1910 MHz

GSM uplink/downlink frequency bands n n uplink and downlink take place in different time slots using TDMA uplink and downlink channels have a bandwidth of 25 MHz these channels are further split up in a 124 carrier frequencies (1 control channels and the rest as traffic channels); each carrier frequency is spaced 200 KHz apart to avoid interference these carrier frequencies are further devided by time using TDMA and each time slot lasts for 0. 577 ms.

GSM Control Channel n n is used to communicate management data (setting up calls, location) between BTS and the cell phone within a GSM cell only data is exchanged through the control channel (no voice) a specific frequency from the frequency band allocated to a cell and a specific time slot are allocated for the control channel (beacon frequency); a single control channel for a cell GSM control channels can have the following types: n n n broadcast channel common control channel dedicated control channel

Broadcast Channel n n type of control channel used for the initial synchronization between the cell phone and the BTS is composed from: n n n Frequency Correction Channel (FCCH) – is composed from a sequence of 148 zeros transmitted by the BTS Synchronization Channel (SCH) – follows the FCCH and contains BTS identification and location information Broadcast Control Channel (BCCH) – contains the frequency allocation information used by cell phones to adjust their frequency to that of the network; is continuously broadcasted by the BTS

Common Control Channels n n type of control chan. used for call initiation is composed of: n n n Paging Channel (PCH) – the BTS uses this channel to inform the cell phone about an incoming call; the cell phone periodically monitors this channel Random Access Channel (RACH) – is an uplink channel used by the cell phone to initiate a call; the cell phone uses this channel only when required; if 2 phones try to access the RACH at the same time, they cause interference and will wait a random time before they try again; once a cell phone correctly accesses the RACH, BTS send an acknowledgement Access Grant Channel (AGCH) – channel used to set up a call; once the cell phone has used PCH or RACH to receive or initiate a call, it uses AGCH to communicate to the BTS

Initializing a call 1. when the cell phone is turned on it scans all the available frequencies for the control channel 2. all the BTS in the area transmit the FCCH, SCH and BCCH that contain the BTS identification and location 3. out of available beacon frequencies from the neighboring BTSs, the cell phone chooses the strongest signal 4. based on the FCCH of the strongest signal, the cell phone tunes itself to the frequency of the network 5. the phone send a registration request to the BTS 6. the BTS sends this registration request to the MSC via the BSC 7. the MSC queries the AUC and EIR databases and based on the reply it authenticates the cell phone 8. the MSC also queries the HLR and VLR databases to check whether the cell is in its home area or outside 9. if the cell phone is in its home area the MSC gets all the necessary information from the HLR if it is not in its home area, the VLR gets the information from the corresponding HLR via MSCs 10. then the cell phone is ready to receive or make calls.

Making a call 1. when thee phone needs to make a call it sends an access request (containing phone identification, number) using RACH to the BTS; if another cell phone tries to send an access request at the same time the messages might get corrupted, in this case both cell phones wait a random time interval before trying to send again 2. then the BTS authenticates the cell phone and sends an acknowledgement to the cell phone 3. the BTS assigns a specific voice channel and time slot to the cell phone and transmits the cell phone request to the MSC via BSC 4. the MSC queries HLR and VLR and based on the information obtained it routes the call to the receiver’s BSC and BTS 5. the cell phone uses the voice channel and time slot assigned to it by the BTS to communicate with the receiver

Receiving a call 1. when a request to deliver a call is made in the network, the MSC or the receiver’s home area queries the HLR; if the cell phone is located in its home area the call is transferred to the receiver; if the cell phone is located outside its home area, the HLR maintains a record of the VLR attached to the cell phone 2. based on this record, the MSC notes the location of the VLR and indicated the corresponding BSC about the incoming call 3. the BSC routes the call to the particular BTS which uses the paging channel to alert the phone 4. the receiver cell phone monitors the paging channel periodically and once it receives the call alert from the BTS it responds to the BTS 5. the BTS communicates a channel and a time slot for the cell phone to communicate 6. now the call is established

The Air-Interface of GSM n The Air-interface is the central interface of every mobile system and typically the only one to which a customer is exposed. The physical characteristics of the Air-interface are particularly important for the quality and success of a new mobile standard. For some mobile systems, only the Air-interface was specified in the beginning, like IS-95, the standard for CDMA. Although different for GSM, the Air-interface still has received special attention. Considering the small niches of available frequency spectrum for new services, the efficiency of frequency usage plays a crucial part. Such effi-ciency can be expressed as the quotient of transmission rate (kilobits per second) over bandwidth (kilohertz). In other words, how much traffic data can be squeezed into a given frequency spectrum at what cost?

The Structure of the Air. Interface in GSM n 1. The FDMA/TDMA Scheme

1. The FDMA/TDMA Scheme n GSM utilizes a combination of frequency division multiple access (FDMA) and time division multiple access (TDMA) on the Air-interface. That results in a two-dimensional channel structure, which is presented in Figure. Older standards of mobile systems use only FDMA (an example for such a network is the C-Netz in Germany in the 450 MHz range). In such a pure FDMA system, one specific frequency is allocated for every user during a call. That quickly leads to overload situations in cases of high demand. GSM took into account the overload problem, which caused most mobile communications systems to fail sooner or later, by defining a two-dimensional access scheme. In full rate configuration, eight time slots (TSs) are mapped on every frequency; in a hal-frate configuration there are 16 TSs per frequency.

2. Frame Hierarchy and Frame Numbers n In GSM, every impulse on frequency 1, as shown in Figure, is called a burst. Therefore, every burst shown in Figure corresponds to a TS. Eight bursts or TSs, numbered from 0 through 7, form a TDMA frame. Transmitted Power Time

2. Frame Hierarchy and Frame Numbers n In a GSM system, every TDMA frame is assigned a fixed number, which repeats itself in a time period of 3 hours, 28 minutes, 53 seconds, and 760 milliseconds. This time period is referred to as hyper frame. Multiform and super frame are layers of hierarchy that lie between the basic TDMA frame and the hyper frame. Figure 7. 3 presents the various frame types, their periods, and other details, down to the level of a single burst as the smallest unit.

3. Synchronization Between Uplink and Downlink n For technical reasons, it is necessary that the MS and the BTS do not transmit simultaneously. Therefore, the MS is transmitting three timeslots after the BTS. The time between sending and receiving data is used by the MS to perform various measurements on the signal quality of the receivable neighbor cells.

GSM - Protocol Stack n The layered model of the GSM architecture integrates and links the peer-to-peer communications between two different systems. The underlying layers satisfy the services of the upper-layer protocols

GSM - Protocol Stack n n The signalling protocol in GSM is structured into three general layers, depending on the interface. Layer 1: The physical layer, which uses the channel structures over the air interface. Layer 2: The data-link layer. Across the Um interface, the data-link layer is a modified version of the Link access protocol for the D channel (LAPD) protocol used in ISDN, called Link access protocol on the Dm channel (LAP-Dm). Across the A interface, the Message Transfer Part (MTP), Layer 2 of SS 7 is used. Layer 3: The third layer of the GSM signaling protocol is divided into three sublayers: n n n Radio Resource management (RR) Mobility Management (MM) and Connection Management (CM).

The MS to BTS Protocol n n n The RR layer oversees the establishment of a link, both radio and fixed, between the MS and the MSC. The main functional components involved are the MS, the BSS, and the MSC. The RR layer is concerned with the management of an RR-session. The MM layer is built on top of the RR layer and handles the functions that arise from the mobility of the subscriber, as well as the authentication and security aspects. The CM layer is responsible for CC, supplementary service management, and Short Message Service (SMS) management. Each of these may be considered as a separate sublayer within the CM layer.

BSC Protocols n n After the information is passed from the BTS to the BSC, a different set of interfaces is used. The Abis interface is used between the BTS and BSC. At this level, the radio resources at the lower portion of Layer 3 are changed from the RR to the Base Transceiver Station Management (BTSM). The BTS management layer is a relay function at the BTS to the BSC. The BSC still has some radio resource management in place for the frequency coordination, frequency allocation, and the management of the overall network layer for the Layer 2 interfaces.

MSC Protocols n n At the MSC, the information is mapped across the A interface to the MTP Layers 1 through 3 from the BSC. Here, the equivalent set of radio resources is called the BSS MAP. The BSS MAP/DTAP and the MM and CM are at the upper layers of Layer 3 protocols. Each user of a GSM MS is assigned a HLR that is used to contain the user's location and subscribed services. A separate register, the VLR, is used to track the location of a user. As the users roam out of the area covered by the HLR, the MS notifies a new VLR of its whereabouts.

Basic Mobility Management Requirements n n n Support all forms of mobility Support mobility for all types of applications n real-time and non-real-time data, voice, and multimedia applications Support mobility across heterogeneous radio systems in the same or different administrative domains Support session (service) continuity n continue without significant interruptions as the user moves about Global roaming n the ability for a user to move into and use different operators’ networks

Basic Functional Components n Location management n n n a process that enables the network to determine a mobile’s current location i. e. , the mobile’s current network attachment point where the mobile can receive traffic from the network Packet delivery to mobiles n a process whereby a network node, mobile terminal, or end-user application uses location information to deliver packets to a mobile terminal

Basic Functional Components (cont. . ) n Handoff and roaming n handoff (or handover) n a process in which a mobile terminal changes its network attachment point n example: a mobile may be handed off from one wireless base station (or access point) to another, or from one router or switch to another n roaming n the ability for a user to move into and use different operators’ networks

Network Signals n Network access control n a process used by a network provider to determine whether a user is permitted to use a network and/or a specific service provided by the network n main steps n authentication: verify the identity of user n authorization: determine whether a user should be permitted to use a network or a network service n accounting: collect information on the resources used by a user

Impact of Naming and Addressing on Mobility Management n n n A name identifies a network entity, such as a user, a user terminal, a network node, or a service An address is a special identifier used by the network to determine where traffic should be routed A terminal’s address typically identifies a network attachment point n n a telephone number in a PSTN network n identifies a port on a PSTN switch rather than the telephone set itself an IP terminal’s IP address n identifies an attachment point to an IP network

Impact of Naming and Addressing on Mobility Management(cont. . ) n Today’s networks, the name of a terminal is often tied with the terminal’s address, example, n n an IP terminal has traditionally been named by the Internet Domain Name associated with the terminal’s IP address mobile terminals that use multiple network addresses are becoming increasingly popular, example, n a mobile terminal may have multiple radio interfaces n each radio interface may use a different type of radio technology n each radio interface may need to have its own IP address

Impact of Naming and Addressing on Mobility Management(cont. . ) n which domain name should be used as the terminal’s name in this case? n solutions n make the IP terminal names independent of the terminal’s addresses n e. g. , IETF has defined Network Access Identifier (NAI) that allows a terminal to be identified by a single globally unique NAI regardless of how many IP addresses this terminal may have

Impact of Naming and Addressing on Mobility Management(cont. . ) n Traditional circuit-switched networks, such as the PSTN, typically do not support user names n n they assume a static mapping between a terminal and the user responsible to pay for the services used by the terminal Static mapping of users to terminals could lead to a range of problems in a mobile network n n mobile users often have to, or like to, use different types of terminals in different locations depending on what types of terminals are available or best fit their needs this suggests that a mobile user’s name should not be statically tied to a mobile terminal

Impact of Naming and Addressing on Mobility Management(cont. . ) n Terminal-independent user names have become increasingly common in mobile networks, example, n GSM n each subscriber is identified by a globally unique International Mobile Subscriber Identity (IMSI) that is independent of the terminal used by the user n a Subscriber Identity Module (SIM) carries a mobile’s IMSI and can be ported from one mobile terminal to another to allow a user to use different terminals and still be recognized by the network as the same user

Impact of Naming and Addressing on Mobility Management(cont. . ) n Today’s IP Networks, applications provide their own naming schemes for users, example n e-mail users are identified by their e-mail addresses n SIP users are identified by their SIP URIs n the NAI may serve as a user’s globally unique and terminal-independent user name

Location Management Location update strategies Location discovery (paging) Interactions between location update and paging

Location Update Strategies n When a mobile should perform location updates and what location-related information the mobile should send to the network? n n update the mobile’s precise location every time the mobile changes its network attachment points, example, Mobile IP knowing a mobile’s precise location allows the network to deliver traffic to the mobile via unicast

Location Update Strategies(cont. . ) n n when mobiles change their network attachment points frequently, maintaining precise locations of all mobiles could lead to heavy location update traffic, which wastes limited radio bandwidth to save scarce resources on the mobile and in the wireless network, a network can group network attachment points into location areas n only keeps track of which location area each mobile is likely in when the user and the network have no traffic to send to each other n the network tries to determine a mobile’s precise location only when it needs to deliver user traffic to the mobile

Location Update n n Time-based update n update periodically at a constant interval (called update interval) Movement-based update n update whenever it traverses a predefined number of location areas, called movement threshold n most existing wireless networks (e. g. , GSM, GPRS, 3 GPP 2) use movement-based location update strategy in which the movement threshold is one

Distance-based update n update whenever it has traveled a predefined distance threshold from the location area in which it performed its last location update n distance may be measured in many different ways, such as physical distance, or cell distance (i. e. , distance measured in number of radio cells or location areas) n the physical distance-based strategy is used, for example, as an option in 3 GPP 2