GSM GPRS Primer By Erick O Connor February

GSM & GPRS Primer By Erick O’Connor February 2005

Topics Background General Packet Radio System (GPRS) • The history of cellular communications • Key statistics • • – Worldwide subscribers – Top 20 global mobile operators Protocol layers Key information Dimensioning a Network Mobility Management Global System for Mobile (GSM) Third-Generation Systems (UMTS) • • Evolution paths • Core components The Radio environment Basestation & Network subsystems Subscriber data & addressing Circuit-switched network architecture Overview of PDH transmission Common Channel Signalling & GSM MAP © 2001 - 2005 Erick O’Connor The following symbol indicates that the slide contains animations. Press the A space bar to advance the animation 2

History of Cellular Communications 1960 s to the Present Day

…the early years 1960 – 1970 s • Idea of a cell-based mobile radio system developed by AT&T’s Bell Labs in late 1960 s • First commercial analogue mobile cellular systems deployed 1978 1980 s (1 st Generation Analogue Systems) • Usage in N. America grows rapidly – Advanced Mobile Phone System (AMPS) becoming the de facto standard • Europe, run by the PTTs, characterised by multiple incompatible analogue standards – – – Nordic Mobile Telecommunications (NMT-450) Total Access Communications (TAC) – United Kingdom C-Netz – West Germany Radiocom 2000 – France RTM / RTMS – Italy etc. • Capacity limitations already becoming apparent by end of decade…. © 2001 - 2005 Erick O’Connor 4

… going digital Late 1980 s to early 1990 s (2 nd Generation Digital Systems) • N. America relies on de facto “let the best technology win” standardisation • By contrast Europe decides to rely on standardisation & co-operation – Huge pent-up demand for mobility can not be met by upgrading existing purely analogue systems. Parallel advances in digital techniques and Very Large Scale Integration (VLSI) chipset manufacture suggest a new way forward – However European domestic markets individually too small to achieve the economies of scale necessary for vendors to take the risk of developing such a risky new solution – Enter the European Commission with a political agenda – demonstrate Europe’s “technology leadership” and ensure European manufacturers can compete globally • New spectrum auctions in USA in early 1990 (PCS 1900) lead to plethora of standards – D-AMPS IS-54 – Motorola sponsored, TDMA IS-136, CDMA IS-95 – Qualcomm sponsored – Plus, limited GSM • Meanwhile in Europe… © 2001 - 2005 Erick O’Connor 5

…GSM is born Late 1980 s to early 1990 s (2 nd Generation Digital Systems) • Guided by European Commission & European Telecommunications Standard Institute • 26 European telecommunication administrations establish the Groupe Spéciale Mobile (GSM) in 1982 with aim to develop a new specification for a fully digital pan-European mobile communications network • The Group notes that the “new industry’s economic future will rely on unprecedented levels of pan-European co-operation” • Political decision to force member countries to: – allocate frequencies at 900 MHz in every EC country (later 1800 MHz) – specify the exact technology to be used and; – deploy systems by 1991 • First commercial GSM networks deployed in 1992 – Denmark / Finland / France / Germany / Italy / Portugal / Sweden / United Kingdom © 2001 - 2005 Erick O’Connor 6

…beginning of the GSM success story By End of 1993 • One million subscribers using GSM • GSM Association has 70 members, 48 countries • First non-European operator, Telstra of Australia And, by technology. … www. gsmworld. com …. Subscribers © 2001 - 2005 Erick O’Connor 7

…the turn of the century & 3 rd generation services • Multiple operators per country & worldwide (800+) – intense price based competition – Huge growth in subscribers thanks to pre-paid but falling ARPU & high churn (c. 25%) – Market close to saturation – slowing subscriber penetration growth rates (c. 85%) • The challenge – what to do in future? • Europe keen to replicate commercial success of GSM but, Americans & Japanese had different views and needs – Japan had run out of spectrum for voice – Americans unhappy at being “dictated to” by a European standard – European vision of always on data & rich value added content services • America & Japan jointly force Europe to open up standardisation process so as not to once again “lock-out” other trading blocs’ vendors – Creation of 3 rd Gen Partnership Programme (3 GPP) body – Heated standardisation on Wideband CDMA (Qualcomm vs Ericsson) – Final agreement on Universal Mobile Telecommunications Standard (UMTS) in 1998…. © 2001 - 2005 Erick O’Connor 8

The market today – key statistics © 2001 - 2005 Erick O’Connor 9

GSM design Radio & Network subsystems, Signalling & Transmission

Basic GSM network elements A PSTN Network Subsystem ISDN PDN ISC BTS BSC GMSC SIWF XCDR User Data & Authentication MSC BTS BSC BTS MS + SIM Radio Subsystem © 2001 - 2005 Erick O’Connor EIR AUC HLR VLR AUC BSC BTS EIR GMSC HLR ISC ISDN MSC PDN PSTN SIWF VLR XCDR Authentication Centre Basestation Controller Basestation Transceiver Equipment Identity Register Gateway Mobile Switching Centre Home Location Register International Switching Centre Integrated Services Digital Network Mobile Switching Centre Packet Data Network (X 25) Public Switched Telephony Network Shared Interworking Function Visitor Location Register Transcoder (16 / 64 kbps coding) 11

GSM air interface design • Access Techniques – Time Division Multiple Access – Frequency Division Multiple Access – Space Division Multiple Access • Radio characteristics Slow Frequency Hopping f 3 f 2 • Logical structure – 1 Downlink Timeslot reserved for signalling – 3 timeslot difference between uplink & downlink f 1 8 Timeslots per Carrier – +400 k. Hz GMSK Spectrum 8 timeslots Gaussian Minimum Shift Keying (GMSK) – f 0 -400 k. Hz Frequency – Multiple cells f 0 FDMA & TDMA Time • Frame structure used for synchronisation – 51 -frame Multiframe (235. 4 ms) – 51 or 26 Multiframe Superframe (6. 12 sec) – 2048 Superframe Hyperframe (3 hr 28 mins) 2 3 4 5 6 7 Downlink Uplink 0 1 2 3 4 5 0 1 6 7 Delay © 2001 - 2005 Erick O’Connor 12

Radio subsystem (i) • Basestation Transceiver (BTS) provides radio channels for signalling & user data BTS BSC • A BTS has 1 to 6 RF carriers per sector and 1(omni) to 6 sectors – e. g. 3/3/3 = 3 sector with 3 carriers per sector – 3 x 7 Timeslots x 3 = 63 Timeslots total – c. 52 Erlangs @ 2% Grade of Service – c. 2, 000 users per BTS @ 25 m. Erl / User (90 seconds) XCDR • Frequency reuse depends on terrain, frequencies available etc. BTS MS + SIM 2 Frequency reuse & cluster formation 3 2 1 3 1 f 2 f 3 f 1 K=3 • Paired spectrum shared by Operators – 900 / 1800 MHz in Europe / Asia (25 & 75 MHz) 6 – 1900 MHz in N. America 5 7 1 4 • 200 k. Hz channel separation f 6 • 125 Channels @ 900 MHz f 5 © 2001 - 2005 Erick O’Connor BSC 2 3 f 7 f 1 f 4 6 5 f 2 f 3 7 1 4 2 3 K=7 13

Radio subsystem (ii) BTS BSC • Basestation Controller (BSC) controls a number of BTS XCDR – Acts as a small switch BTS – Assists in handover between cells and between BTS – Manages the Radio Resource, allocating channels on the air interface BSC BTS MS + SIM • Transcoding (XCDR) function is logically associated with BTS – But, typically located at BSC to save on transmission costs – XCDR provides 13 kbps Coding / Decoding between GSM Codec & standard 64 kbps A-law encoded voice • Interfaces – “Abis” – BTS to BSC interface (never fully standardised so vendor-specific variants exist) – “A” – BSC to MSC interface carrying voice, BSC signalling and Radio – Traffic Channels are mapped one-to-one between BTS and Transcoder – BTS can be connected in “Star” or “Daisy-chain” arrangement to BSC (max. 15) © 2001 - 2005 Erick O’Connor 14

Network subsystem (i) PSTN ISDN PDN ISC • Core component is Mobile Switching Centre (MSC) GMSC SIWF – Performs all switching functions of a fixed-network switch MSC – Allocates and administers radio resources & controls mobility of users – Multiple BSC hosted by one MSC • Gateway MSC (GMSC) provide interworking with other fixed & mobile networks – Crucial role in delivering in-coming call to mobile user in association with Home Location Register (HLR) interrogation • Shared Interworking Function (SIWF) – Bearer Services are defined in GSM including 3. 1 k. Hz Voice, ISDN, 9. 6 kbps Data & 14. 4 kbps – IWF provides “modem” capabilities to convert between digital bearer & PSTN, ISDN & PDN • International Switching Centre (ISC) – Provides switching of calls internationally. Switch may be provided by another carrier © 2001 - 2005 Erick O’Connor 15

Network subsystem (ii) • Home Location Register (HLR) holds master database of all subscribers – Stores all permanent subscriber data & relevant temporary data including: • MS-ISDN (Mobile Subscriber’s telephone no. ) • MSRN (Mobile Station Roaming no. ) • Current Mobile Location Area – Actively involved in incoming call set-up & supplementary services • Visitor Location Register (VLR) associated with individual MSCs – VLR stores temporary subscriber information obtained from HLR of mobiles currently registered in serving area of MSC EIR AUC HLR VLR • Authentication Centre (AUC) & Equipment Identity Register (EIR) – GSM is inherently secure using encryption over the air-interface and for authentication / registration – AUC holds each subscriber’s secret key (Ki) & calculates “triplet” for challenge / respond authentication with mobile – SIM is sent data and must calculate appropriate response – EIR is used to store mobile terminals serial numbers – Involved in registration of mobiles – Assists in delivery of supplementary service features such as Call Waiting / Call Hold © 2001 - 2005 Erick O’Connor 16

GSM call setup & Signalling

Signalling – Air interface Air Interface Signalling • Downlink signalling (to Mobile Station) – Relies on Bearer Control Channel (BCCH) set at fixed frequency per cell • Mobile Stations use this to lock-on to network • Mobile Stations periodically scan environment and report back other BCCH power levels to BSC to assist in handover – Access Grant Channel (AGCH) – used to assign a Control or Traffic Channel to the mobile – Paging Channel (PCH) – paging to find specific mobiles © 2001 - 2005 Erick O’Connor • Uplink signalling (from MS) more complicated – Random Access Channel (RACH) – competitive multi-access mode using slotted ALOHA to request dedicated signalling channel (SDCCH) • Bidirectional channels include – Traffic Channels (TCH) – Carrying full rate voice @ 13 kbps / half-rate voice – Standalone Dedicated Control Channel (SDCCH) – used for updating location information or parts of connection set-up – Slow Associated Control Channel (SACCH) – used to report radio conditions & measurement reports – Fast Associated Control Channel (FACCH) – uses “stolen” traffic channel capacity to add extra signalling capacity 18

Signalling – Mobile Application Part interfaces Network Signalling Um Radio management A BSS management, connection control & mobility management B (Mobile Application Part) Air interface signalling Abis GSM Specific Signalling Interfaces Subscriber data, location information, supplementary service settings C EIR Inter-MSC handover, transfer of subscriber data BTS B Abis Subscriber & equipment identity check G © 2001 - 2005 Erick O’Connor C A D HLR VLR Inter-MSC handover signalling F E BSC Exchange of location-dependent subscriber data & subscriber management E MSC F Routing information requests D MSC BTS G VLR Um MS + SIM 19

ITU-T Common Channel Signalling System Number 7 A Application Parts GSM interfaces B, C, D, E & G carried as Mobile Application Part Most basic CSS 7 signalling MAP Transaction Control Application Part – component responsible for “carrying” higher level Application Parts to their correct destinations INAP TCAP OMAP ISUP TUP SCCP Signalling Connection Control Part Functionally equivalent to TCP layer, carries “Connectionless” messages between Network elements Standard Telephone User Part (TUP) ISDN User Part MTP Layers 1/2/3 Add functionality to permit ISDN signalling (i. e. fully digital) between networks ISO Layers 1 thro 7 Actually carry the specific messages for Mobile (MAP), Intelligent Network (INAP) or Operations & Maintenance (OMAP) Signalling 101 • Line signalling – “tell the other end you want to make call” • Register signalling – “tell the other end the destination of the call” © 2001 - 2005 Erick O’Connor Message Transfer Part Lowest level, permits interconnection with underlying physical transmission medium 20

PDH transmission …composition of 32 channel E 1 bearer TS 0 Synchronisation Header TS 16 Signalling ITU-T G. 703 E 1 link 2048 kbps 32 x 64 kbps Timeslots 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 140 Mbps Plesiochronous Digital Hierarchy (PDH) 34 Mbps Voice / Data Timeslot 2 Mbps Abis - Voice GSM Codec 4 x 13 kbps Timeslots STM-16 STM-4 Synchronous Digital Hierarchy (SDH) (SONET - USA) STM-1 © 2001 - 2005 Erick O’Connor 21

Circuit-switched network architecture A (Transmission & Signalling planes) BSS CCS 7 CO HLR MSC SDH SSP STP Basestation Subsystem Common Channel Signalling #7 Central Office Home Location Register Mobile Switching Centre Synchronous Digital Hierarchy Service Switching Point Signalling Transfer Point CSS 7 Signalling Plane SSP HLR CCS 7 Links CO Switch STP MSC SDH Fibre Optic Network Synchronisation Other Networks Drop & Insert Multiplexers BSS © 2001 - 2005 Erick O’Connor Transmission Plane 22

Call setup Data held in HLR: • Subscriber & Subscription Data – International Mobile Subscriber Identity (IMSI) – – – A When thedirects thea BSCthe–interrogates the queries“virtual” The HLR returnsto the MSCroutes the subscriber telling the Usingis placedreceives registration and number andfind. VLR to handset acknowledges incoming call andto its status MSC MS-ISDN MSRN page the MSRN the at to a subscriber it the call is MSC call another inform Call. TMSI is assigned. GMSC the incomingisto HLR serving MSC. mobile “virtual” by dialling 8 7 6 established incoming subscriber. 5 handset of anroute 4 number used for security purposes. 3 obtain the TMSI for the call to the Together with 2 GMSC how toof mobile subscriber. serving handset may also 1 and locationbetween the two parties. The MSC. cell ID call. mobile number (MS-ISDN). signal the BSC / MSC during the call to set MSC now has location information stored in the VLR the up supplementary services such as Call Hold, 3 -way calling etc. sufficient information to be able to route the call. Mobile Station ISDN (MS-ISDN) – Bearer & teleservice subscriptions MS-ISDN Service restrictions Parameters for additional services Information on subscriber equipment Authentication data MSRN – – Mobile Station Roaming Number (MSRN) Temporary Mobile Subscriber Identity (TMSI) Current VLR address Current MSC address Local Mobile Subscriber Identity © 2001 - 2005 Erick O’Connor PSTN 4 BTS BSC XCDR GMSC 7 BTS 3 MSRN 5 MSRN BSC HLR 7 TMSI BTS MS + SIM 2 MS-ISDN MSC 7 • Tracking & Routing Information – 1 6 VLR TMSI 8 TMSI Principle of routing call to mobile subscribers 23

GPRS Design

GPRS network elements A Other GPRS PLMN SM-SC BTS BSC GGSN PCU BG SGSN PDN GGSN BTS BSC VLR BTS GPRS MS + SIM © 2001 - 2005 Erick O’Connor HLR BG BSC BTS GGSN HLR PCU PDN PLMN SM-SC SGSN VLR Border Gateway Basestation Controller Basestation Transceiver Gateway GPRS Support Node Home Location Register Packet Control Unit Packet Data Network (X 25) Public Land Mobile Network Short Message Service Centre Serving GPRS Support Node Visitor Location Register 25

How GSM & GPRS co-exist A DHCP X. 25 / IP / PDN PSTN Internet De facto interfaces G. 703 E 1 64 kbps Radius Firewall DNS Gi (IP) SMSC OSS GMSC MAP E VLR GSM MAP Gr SGSN A (G. 703 E 1 16 kbps) BTS Cells PCU Gb (Frame Relay) Abis (G. 703 E 1) Voice or Data link Signalling & Name of Interface © 2001 - 2005 Erick O’Connor DNS MAP Ga GPRS XCDR BSC LIAN Gn (IP) HLR MAP D SMSC CG GGSN IWF BSC BTS CCS 7 CG DHCP DNS GSN HLR IWF LIAN MAP MSC OSS PCU PSTN VLR XCDR Basestation Controller Basestation Transceiver Common Channel Signalling #7 Charging Gateway Dynamic Host Configuration Protocol Domain Name Server GPRS Serving Node (Serving / Gateway) Home Location Register Interworking Function (Circuit / Packet) Legal Intercept Attendance Node Mobile Application Part (CCS 7) Mobile Switching Centre (Serving / Gateway) Operational Support System Packet Control Unit Public Switched Telephony Network Visitor Location Register Transcoder (16 / 64 kbps coding) 26

GPRS key information • Four Coding Schemes defined – – – CS 1 CS 2 CS 3 CS 4 9. 05 kbit / second per timeslot 13. 40 15. 60 21. 40 Higher speed = Trade off of Forward Error Correction & hence quality • Three Handset Types defined – Class A – simultaneous voice & data – Class B – voice or data only at one time – Class C – data only • GSM offsets uplink timeslots (Ts) from downlink by 3 to save on radio transmit / receive hardware – Therefore today’s handsets are typically: • 1 Ts downlink • 2 to 3 Ts uplink • Class B • CS 1 & CS 2 capable • Equals 3 x 13. 40 = 40. 20 kbit/s maximum – Handsets can exceed this limit • But cost more… • Use more power etc, GPRS 0 1 2 3 4 5 6 7 8 Downlink Signalling Uplink GPRS © 2001 - 2005 Erick O’Connor 27

Protocol layers in GPRS Application Protocol (http / ftp) Transmission Control Protocol (TCP) TCP IP IP TCP IP SNDCP GTP LLC UDP / TCP IP IP RLC BSSGP MAC Network Service L 2 GSM RF Laptop / PDA RLC GSM RF L 1 bis L 1 Bis L 1 GPRS MS © 2001 - 2005 Erick O’Connor BSS SGSN GGSN BSSGP GSM RF GTP LLC MAC RLC SNDCP Basestation System GPRS Protocol Radio Frequency Gateway Tunnelling Protocol Logical Link Control Medium Access Control Radio Link Control Subnetwork Dependent Convergence Protocol 28

Mobility management • Mobility management – – – Attach • Know who is the MS • Know what the user is allowed to do Detach • Leave the system Location updates • Know location of MS • Route mobile terminated (MT) packets to MS • Packet Data Protocol (PDP) Contexts – Every mobile must have an address for each PDP Context in use – – Addresses are statically or dynamically assigned Context information includes: • • • – PDP Type PDP address (optional) Quality of Service (5 classes – Service Precedence / Reliability / Delay / Throughput Maximum & Mean) SGSN has main control of Qo. S • GPRS Service Descriptions – – – Point-to-Point • Connection-orientated (X 25) • Connection-less (IPv 4 / IPv 6) Point-to-Multipoint (Release 2) • Multicast • Groupcast Short Message Service (SMS) © 2001 - 2005 Erick O’Connor 29

GPRS dimensioning • 900 MHz UK Network – – – – 7 Timeslots per Carrier 1 to 6 RF carriers / cell 1 to 3 cells / BTS 5, 000 BTS 250 BSC 50 MSC 10 GMSC • Dimensioning – – – 8 million subscribers 10% GPRS handset penetration 800, 000 users 10: 1 Activity factor 10: 1 x 800, 000 = 80, 000 simultaneous users 8 SGSN / 2 GGSN • Exact dimensioning depends on: • GPRS – SGSN c. 10, 000 simultaneous users – GGSN c. 45, 000 simultaneous users – 10 to 1 contention ratio © 2001 - 2005 Erick O’Connor – – – Number of users Geography Population density Data profile & activity GPRS growth 30

Evolution towards UMTS – All IP core Internet GSM & GPRS PSTN Packet Data Packet Gateway Circuit Gateway All IP Packet Network HLR CAMEL Call Control Server BTS RNC Server BTS BSC UMTS Node B BTS 3 rd Generation UMTS © 2001 - 2005 Erick O’Connor 31

Further Reading • ‘GSM Switching, Services and Protocols’ – Jörg Eberspöcher & Hans-Jörg Vögel, John Wiley & Sons, 2000 • ‘GPRS General Packet Radio Service’ – Regis J. “Bud” Bates, Mc. Graw-Hill Telecom Professional, 2002 • ‘GPRS Networks’ – Geoff Sanders, Lionel Thorens, Manfred Reisky, Oliver Rulik, Stefan Deylitz, John Wiley & Sons, 2003 © 2001 - 2005 Erick O’Connor 32