GSM System Overview 1 GSM GSM GSM Global System for Mobile Communication, Group Special Mobile,,. GSM, GSM. GSM features AMPS IS- 4, ISDN,., 1984, net

Size: px

Start display at page:

Download "GSM System Overview 1 GSM GSM GSM Global System for Mobile Communication, Group Special Mobile,,. GSM, GSM. GSM features AMPS IS- 4, ISDN,., 1984, net"

收嵇
4 years ago
Views:

1 GSM System Overview 1 GSM GSM GSM Global System for Mobile Communication, Group Special Mobile,, GSM, GSM GSM features AMPS IS- 4, ISDN,, 1984, network architecture, signaling protocol, open interface GSM3 (a working group of GSM) ISDN, service definition signaling protocol ISDN, OSI (Open System Interconnection) layered model

2 Reference (1/2) [1] Wireless and Mobile Network Architectures Y-Bing Lin and Imrich Chlamtac Wiley Computer Publishing [2] Mobile and Wireless Networks Uyless Black Prentice Hall [3] The GSM System for Mobile Communication Michel Mouly and Marie-Bernadette Pautel published by the authors 2

3 Reference (2/2) [4] Wireless and Personal Communications Systems Vijay K Garg and Joseph E Wilkes Prentice Hall [5] Introduction to GSM [6] GPRS and 3G Wireless Application Christoffer Andersson Wiley Computer Publishing 3

4 Outlines Introduction GSM Architecture Air Interface Location Tracking and Call Setup Security GSM Data Services Unstructured Supplementary Service Data Summary 4 : GSM, GSM GSM,, BS GSM,, GSM, HSCSD,GPRS EDGE,, USSD GSM, USSD summary

5 Introduction 5 GSM GSM : 1982 CEPT Group Spécial Mobile 1986 Permanent Nucleus, GSM 1987 Main radio transmission techniques 1989 GSM ETSI technical committee 1990 Phase 1 GSM 900, DCS First system, DCS GSM 900

6 Introduction Global System for Mobile Communications (GSM) is a digital wireless network standard It was developed by Group Special Mobile of Conference Europeenne des Postes et Telecommunications (CEPT) and European Telecommunications Standards Institute (ETSI) GSM Phases 1 and 2 define digital cellular telecommunications system GSM Phase 2+ targets on Speech Codec and Data Service 6 GSM European Telecommunications Standard Institute ETSI GSM ETSI GSM, communication system structure, GSM, 1, 2 (phase 1 call forwarding, call barring( ), phase 2 fax supplementary services), 2+ GSM services: speech, message handling (such as X400), fax, emergency call (119), data service

7 The Basic Requirements of GSM (1/2) Basic Requirements set out by GSM Original text as written by the committee in 1985 Services Quality of Services and Security Radio Frequency Utilization Network Cost 7 GSM, 5, services ie, GSM service portability,, ISND-related services (PSTN/ISDN) GSM, GSM GSM, GSM MS MS quality of services and security, GSM GSM

8 The Basic Requirements of GSM (2/2) Basic Requirements set out by GSM Original text as written by the committee in 1985 Services Quality of Services and Security Radio Frequency Utilization Network Cost 8 radio frequency utilization GSM network (identification plan) (numbering plan) ITU Recommendation (charging), GSM signaling information network control information cost

9 GSM Architecture 9 GSM, GSM,

10 GSM Architecture ME BTS BTS BTS BSC EIR HLR VLR AUC SIM Abis interface MSC GMSC PSTN MS Um interface BTS BTS BTS BSC Base Station Subsystems (BSS) A interface Network and Switching Subsystem Subsystem (NSS) 10 GSM Mobile Station radio interface Um Base Station System BSS A A Interface Mobile Switching Center MSC Network and Switch Subsystem NSS, NSS Switching system, BSS Base Station System GSM,, component

11 Mobile Station (MS) Also called Mobile Terminal (MT) The MS consists of two parts: Subscriber Identity Module (SIM) Mobile Equipment (ME) 11 GSM Subscriber Identity Module SIM Mobile Equipment ME

12 SIM A SIM contains subscriber-related information A list of abbreviated and customized short dialing numbers Short message Names of preferred Networks to provide service Personal Identity Number (PIN) SIM information can be modified: By the subscriber either by keypad or a PC using an RS232 connection By sending codes through short messages (network operators) 12 customized dialing numbers short message SIM PIN PUK [4] SIM : IMSI + Ki + Subscriber information + Access control class+ Kc* + TMSI* + Additional GSM service* (, )+ LAI* + Forbidden PLMN* ( ) + PIN + PUK + BCCH Frequency List + Preferred ( ) PLMN list * means that term is updatable by the network (ie, ) (A3,A5,A6),Ki, Personal Identity Number PIN [5] SIM 8k 16k,

13 Mobile Equipment (ME) ME: non-customer-related hardware and software specific to the radio interface ME can not be used if no SIM is on the MS Except for emergency calls The SIM-ME design supports portability: The MS is the property of the subscriber The SIM is the property of the service provider GSM GSM GSM classmark GSM GSM, burst, BS broadcast ( idle mode),, MS carrier ( dedicated mode),, MS transmitter

14 Base Station System (BSS) The Base Station System (BSS) connects the MS and NSS BSS contains Base transceiver station (BTS) Base station controller (BSC) 14 GSM BSS MS BSS, BSS, Base Transceiver Station BTS Base Station Controller

15 BTS Base Transceiver Station (BTS) contains Transmitter Receiver Signaling equipment specific to the radio interface in order to contact the MSs Transcoder/Rate Adapter Unit (TRAU) GSM-specific speech encoding/decoding and rate adaptation in data transmission 15 BTS GSM MS transcoder/rate adapter unit TRAU GSM spec BTS sub-part, TRAU MSC BTS, Ericsson BSC MSC, BSC BTS Transcoding: PCM GSM speech Rate adaptation: MSC- 64kbps-TRAU-BSC- 16kbps-BTS 16kbps 13 kbps traffic 3kbps signaling Ericsson BTS RBS, TRAU Ericsson TRC (Transcoder Controller), MSC-TRC-BSC-RBS TRC discontinuous transmission pause, TRAU comfort noise MSC/VLR

16 GSM BTS (in YZU ) 16 BTS

17 BSC (1/2) Base Station Controller (BSC) Radio channel assignment Call Setup Handoff management Connect to an MSC Connect to several BTSs Maintain cell configuration data of these BTSs The BSC communicates with the BTSs via the A-bis 17 GSM allocation release handover ISDN A-bis A-bis

18 BSC (2/2) The processor load of a BSC: Call activities (around 20-25%) Paging and short message service (around 10-15%) Mobility management (handoff and location update, around 20-25% Hardware checking/network-triggered events (around 15-20%) When a BSC is overloaded, it first rejects location update, next MS originating calls, then handoff 18 BSC, BSC 80%, busy hours, BSC : Call activities (around 20-25%) Paging and short message service (around 10-15%) Mobility management (handoff and location update, around Hardware checking/network-triggered events (around 15-20%),BSC,MS ( ), Handoff call

19 NSS (1/2) Network and Switching Subsystem (NSS) Telephone switching functions Subscriber profiles Mobility management Components in NSS: MSC: provide basic switching function Gateway MSC (GMSC): route an incoming call to an MSC by interrogating the HLR directory 19 roaming management A A interface

20 NSS (2/2) Components in NSS (continuous): HLR and VLR maintain the current location of the MS Authentication Center (AuC) is used in the security management Equipment Identity Register (EIR) is used for the registration of MS equipment 20 HLR, VLR, AuC, EIR GSM HLR VLR HLR, IMSI, home subscription base, any supplementary services (ex: call forwarding), location of MS VLR, (switch on/off), any supplementary services VLR HLR traffic HLR standalone MSC, VLR MSC (for Ericsson) Authentication Center AuC AC EIR,IMEI, EIR MS, AuC/EIR implemented together

21 GSM Interfaces ME BTS BTS BTS BSC EIR HLR VLR AUC SIM Abis interface MAP interface MSC GMSC PSTN MS Um interface BTS BTS BTS BSC Base Station Subsystems (BSS) A interface Network and Switching Subsystem Subsystem (NSS) 21 GSM,, interface GSM interface: Um: MS BTS Abis: BTS BSC A: BSC MSC MAP: MSC HLR, VLR, AuC, EIR

22 Air Interface 22 GSM Air Interface, TDMA/FDD, Frame/ Burst, logic channels, call origination call termination logic channel

23 Radio Interface Um (1/3) The GSM radio link uses TDMA/FDD technology MHz (uplink) MHz (downlink) 124 pairs 200 KHz 8 time slots (bursts) per carrier A frame consists 8 bursts (time slot) (each 0577 msec for a time slot) The length of GSM frame in a frequency carrier is 4615 msec 23 The technologies of GSM are summarized as follows:, GSM : TDMA/FDD (Frequency Division Duplex, FDD),, (uplink 200kHz+downlink 200kHz) MHz for handset transmission (to BS), 124 carriers MHz for base station transmission (to MS), 124 carriers Uplink downlink 25MHz (Bandwidth) FDMA: 200 KHz spacing, 124 TDMA : 4615msec frame, frame 8 8 GMSK modulation,,, 13 Kbps RPE-LTP full-rate and 56 Kbps VSELP DCS 1800 GSM MHz (uplink) and MHz(downlink) Uplink downlink 75MHz 200 KHz spacing, 374 GSM, : MHz (uplink) and MHz(downlink) MHz (uplink) and MHz(downlink)

24 Radio Interface Um (2/3) Downlink FDMA C0 C1 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS MHz 8924 MHz Frame MS Control channel Frame (TDMA) Traffic channel 24 GSM TDMA carrier (timeslot), 8 timeslots Frame 8, carrier Frame,, 8 MS timeslot, channel channel, (Traffic channel), (Control channel) BS channels, carrier ( C0) timeslots (TS0, TS1) control channel traffic channel BS carrier (C0, C1), 6 (C0) + 8 (C1)= 14 traffic channels, 14 BS

25 Radio Interface Um (3/3) To improve spectrum efficiency: Control of the transmitted power Slow frequency hopping Discontinuous transmission Mobile assisted handover frequency time 25 GSM, (spectral efficiency),, : 1 Control of the transmitted power (dynamic power control in MS and BTS):,, BS MS, (interference) BSC MS,, 480 ms, BTS MS power 2 Frequency hopping:,, ( ), (interference diversity), spectral efficiency GSM 64 hopping sequence, hopping sequence carrier, Fast frequency transmission symbol ( frequency change modulation rate ), security 3 Discontinuous transmission: user data type, speech, Voice Activity Detection (VAD),, ( ), interference 4 Mobile assisted handover: MS cell, network handover decision algorithm, local optimization, cell interference

26 GSM Burst Structure Tailing Data Flag Training Flag Data Tailing Guard 3 57 bits 1 26 bits 1 57 bits bits Burst (148 bits/0564 msec) Time Slot (15625 bits or 0577 msec) Begin with 3 head bits, and end with 3 bits Two groups are separated by an equalizer training sequence of 26 bits The flags indicates whether the information carried is for speech/data, or signaling 26 GSM channel burst timeslots Several burst formats are defined: normal burst, access burst, normal burst, F and S bursts for FCCH and SCH burst normal burst, traffic channels Normal burst 0577 msec bits, Data 114 bits Three head and tailing bits are all logical zeros Training sequence is for synchronization Guard burst

27 Time Advance Timing Advance: the exact shift between downlink and uplink seen by MS BS 8922 MHz (downlink) MHz MS TA/2 TA/ MHz (uplink) timeslot -TA 27 GSM FDD, uplink downlink timeslot,, Downlink timeslot, MS uplink burst Traffic channel offset is 3 time slots TA BS MS round-trip delay, BS MS 30km, round-trip delay 02 ms round-trip propagation delay, so MS TA The exact shift between downlink and uplink seen by the MS value is three time slots minus the timing advance value The timing advance(ta) is calculated by the BSS, based on the bursts received from the MS BS TA MS, MS time slot 2, uplink, MS cell

28 Logical Channels TCH/F Logical Channel TCH CCH TCH/H CCCH PCH AGCH RACH DCCH SDCCH SACCH FACCH CBCH BCH FCCH SCH BCCH 28 BTS MS physical channel physical channel, logical channels GSM logical channels

29 Traffic Channel (TCH) TCHs are intended to carry user information (speech or data) Full-rate TCH (TCH/F) Transmission speed: 13 Kbps for speech Transmission speed: 96, 48 or 24 Kbps for data Enhanced full-rate (EFR) speech coders for improving the speech quality Half-rate TCH (TCH/H) Transmission speed: 65 Kbps speech Transmission speed: 48 or 24 Kbps of data 29 Traffic channel TCH Full rate TCH TCH/F 13Kb/s Kb/s 1/2 Half rate TCH TCH/H 7Kb/s 6 36Kb/s

30 Control Channels (CCH) CCHs: to carry signaling information Three types of CCHs : Common control channel (CCCH) Dedicated control channel (DCCH) Broadcast channel (BCH) 30 Control channel CCH signaling common control channel

31 Broadcast Channels (BCHs) BTS broadcasts system information to the MSs through BCHs Two types in BCH: Broadcast Control Channel (BCCH) (downlink) Access information for the selected cell Information related to the surrounding cells to support cell selection Location registration procedures in an MS Frequency Correction Channel (FCCH) and Synchronization Channel (SCH) The information allows the MS to acquire and stay synchronized with the BSS 31 FCCH SCH BCCH BCH Broadcast Control Channel BCCH Frequency Correction Channel FCCH Synchronization Channel SCH

32 Common Control Channel (CCCH) Three types in CCCH: Paging Channel (PCH) (downlink) Used by the network to page the destination MS in call termination Random Access Channel (RACH) (uplink) Used by the MSs for initial access to the network Collision may occurs Slotted Aloha protocol is used to resolve access collision Access Grant Channel (AGCH) (downlink) Used by the network to indicate radio link allocation upon prime access of an MS 32 Paging Channel PCH Random Access Channel RACH access collisions GSM Aloha slotted Aloha protocol Access Grant Channel AGCH

33 Dedicated Control Channel (DCCH) (1/2) DCCH is for dedicated use by a specific MS Four types in DCCH: Standalone Dedicated Control Channel (SDCCH) (down/uplink) used only for signaling and for short message Slow Associated Control Channel (SACCH) (down/uplink) Associated with either a TCH or an SDCCH For non-urgent procedures Power and time alignment control information (downlink) Measurement reports from the MS (uplink) 33 dedicated control channel, DCCH DCCH SDCCH, SACCH, FACCH, CBCH Stand Along Dedicated Control Channel SDCCH signaling short message Slow Associated Control Channel SACCH power time alignment

34 Dedicated Control Channel (DCCH) (2/2) Four types in DCCH (continuous): Fast Associated Control Channel (FACCH) (down/uplink) Used for time-critical signaling, such as call-establishing progress, authentication of subscriber, or handoff FACCH use TCH during a call May cause user data loss Cell Broadcast Channel (CBCH) (downlink) Carries only the short message service cell broadcast messages, which use the same time slot as the SDCCH 34 Fast Associated Control Channel FACCH time-critical signaling authentication handover Cell Broadcast Channel CBCH short message service cell broadcast messages Ericsson CBCH

35 Registration 35 MS, GSM,, MS, BCCH-carrier (ie, BCCH (broadcast control channel) ) BCCH-carrier, MS BS, cell PLMN, cell FCCH (Frequency Correction Channel) MS BS SCH (Synchronization Channel) BSIC BCCH cell : CGI (Cell Global Identity), MS CGI PLMN cell MS IMSI MSC MS idle mode, MS signal strength BER of the serving BTS cell, new cell

36 MS GSM Call Origination RACH(request signaling channel) AGCH(assign signaling channel) SDCCH(request call setup) BSS SDCCH message exchanges for call setup SDCCH(assign TCH) FACCH(complete assignment) 36 MS logic channel 1 MS RACH 2 BSC SDCCH MS, AGCH MS 3 MS SDCCH BSS, 4, BSS TCH MS 5 MS FACCH BSS (MS SDCCH, FACCH)

37 MS GSM Call Termination PCH(page MS) RACH(request signaling channel) AGCH(assign signaling channel) SDCCH(respond to paging) BSS SDCCH message exchanges for call setup 37 MS logic channel 1 BSC LA BTS PCH MS TMSI (PERM_PAGE) 2 MS TMSI, RACH (CHH_REQ) 3 BSC SDCCH MS, AGCH MS (DSCH_ASS) MS TCH, MS SDCCH BSC 4 MS SDCCH call setup PAGE_RESP BSS, TMSI LAI 5 BS PAGE_RESP MSC 6 MSC VLR MS (PAGE_RESP) 7 BSC TCH MS, voice cell TCH, BSC cell TCH Note: BSC channel assignment

38 Location Tracking and Call Setup 38 GSM (location tracking) (call setup)

39 Two-level Hierarchical Strategy The current location of an MS is maintained by a two-level hierarchical strategy with the HLR and the VLRs HLR VLR 1 VLR 2 MSC 1 MSC 2 39 GSM user profile

40 Location Area Location area (LA) is the basic unit for location tracking Also, called as Registration area MSC LA 2 MSC MSC LA 3 LA 1 40 GSM Location Area LA, MS new LA, registration, location update LA, VLR (ie, LA address), HLR, VLR

41 Key Terms GSM uses some identifiers Mobile system ISDN (MSISDN) Mobile Station Roaming Number (MSRN) International mobile subscriber identity (IMSI) Temporary mobile subscriber identity (TMSI) Location area identity (LAI) International mobile station equipment identity (IMEI) 41 GMS, source,, key terms

42 MSISDN Mobile System ISDN MSISDN uses the same format as the ISDN address (based on ITU-T Recommendation E164) HLR uses MSISDN to provide routing instructions to other components in order to reach the subscriber Total up to 15 digits Country code (CC) National destination code (NDC) Subscriber number (SN) 42 GSM ISDN Mobile Station ISDN Number MSISDN CCITT Recommendation E164

43 MSRN Mobile Station Roaming Number The routing address to route the call to the MS through the visited MSC MSRN=CC+NDC+SN 43 routable address

44 IMSI International Mobile Subscriber Identity Each mobile unit is identified uniquely with an IMSI IMSI includes the country, mobile network, mobile subscriber Total up to 15 digits 3 digits 1-2 digits Up to 10 digits Mobile country code (MCC) Mobile network code (MNC) Mobile subscriber identification code (MSIC) 44 IMSI IMSN (international subscriber number), International Mobile Subscriber Identity IMSI IMSI SIM, HLR, AUC, VLR MNC network provider, PLMN (public land mobile network) Example: MCC=466, MNC=01 Example: MNC =01 Telecom Australia, 234 UK Vodafone IMSI HLR/VLR MS PLMN

45 TMSI Temporary Mobile Subscriber Identify TMSI is an alias used in place of the IMSI This value is sent over the air interface in place of the IMSI for purposes of security 45 International Mobile Subscriber Identity IMSI IMSI air interface, TMSI identify MS itself MS, MSC/VLR IMSI, TMSI TMSI VLR assign MS MS MSC/VLR, TMSI TMSI MS new LA, ( IMSI), registration (location update), MSC paging a MS, LA BS PCH broadcast the TMSI of MS Length TMSI is no longer than 8 digits (TMSI structure defined by the operator), [4] TMSI 32 bits

46 LAI Location Area Identity LAI identifies a location area (LA) When an MS roams into another cell, if it is in the same LAI, no information is exchanged Total up to 15 digits 3 digits 1-2 digits Up to 10 digits Mobile country code (MCC) Mobile network Location area code (LAC) code (MNC) 46 LAI (Location Area Identity) ( Location Area, LA) LA a cell a group of cells, MSC LAs LAI call termination MS LA, LA cells page MS In the Lin s Chapter 11 LAI = Mobile Country Code (3-digit) + Mobile Network Code (2 or 3- digit) + location access code (16-digit) LAI = MCC (3-digit) + MNC (1-2 digits) + LAC (2 digits), ex: ROC- -

47 CGI Cell Global Identity CGI = LAI + CI = MCC + MNC + LAC + CI CI : Cell Identity 47 cell CGI (cell global identity), LAI CI Example: cell CGI = MS GSM, MS BS CGI LAI CI LA, MSC/VLR MS Registration Location Update MS, CGI LA registration, BTS

48 IMEI International Mobile Station Equipment Identity IMEI is assigned to the GSM at the factory When a GSM component passes conformance and interoperability tests, it is given a TAC Up to 15 digits 3 digits 2 digits Up to 10 digits Type approval code (FAC) Final assembly code (FAC) Serial number (MSIC) Spare 1 digit 48 IMEI,,, *#06#, IMEI My IMEI= IMEI GSM component passes conformance and interoperability tests, TAC FAC SNR TAC/FAC

49 Identifiers and Components HLR VLR/MSC BSC BTS MS MSISDN MSRN IMSI TMSI LAI CGI MSC 49 : IMSI, TMSI, MSISDN : CGI : LAI MSC :MSRN, VLR MS, HLR, HLR MS VLR, VLR IMSI

50 MS Registration Process (1/2) HLR 5 3 Old VLR 2 New VLR ( HLR LAI) inter-vlr movement inter-msc registration HLR, VLR identifiers

51 MS Registration Process (2/2) HLR 5 3 Old VLR 2 New VLR BCCH Temporary Mobile Subscriber Identity TMSI Step 4: Step 5:

52 Periodically Registration The MS periodically send registration messages to the network The period is 6 minutes to 24 hours Periodic registration is useful for faulttolerance purposes 52 re-registration 6 24 GSM IMSI detach GSM detach, MSC/VLR MS, periodically registration, MSC/VLR, MS

53 The Mobile Call Termination (Delivery) Procedure (1/2) 1 GMSC HLR 2 VLR 1 Other Switches 3 Other Switches 3 MSC 3 53 Call termination call delivery GSM IS-41 GSM ISDN Mobile Station ISDN Number MSISDN

54 The Mobile Call Termination (Delivery) Procedure (2/2) 1 GMSC HLR 2 VLR 1 Other Switches 3 Other Switches 3 MSC 3 54 GSM MSISDN MSISDN MSISDN routable address

55 Handover 55 Ericsson : MS, (active mode) GSM, MS 480 ms BS (ex: 480ms Bit error rate, BER ), BSC MS BSs (BCCH carrier), BSC BTS BTS, MS SCH (time slot 0, carrier 0) BTS identity 6 neighboring cells SACCH BTS MS neighboring cell, 8 timeslots BCCH timeslot 0, idle frame signal MS BTS MS, serving BTS MS BSC BSC MS BS (measurement report), BS serve MS BSC new BS old BS MS, (handover) MS, new BS, location tracking, MS MSC/VLR registration process

56 Handoff Three basic kind of handoff: Intra-BSS Intra-MSC (inter-bss) Inter-MSC We discuss the intra-msc and inter-msc handoff 56 Handover GSM, handoff Ericsson BSC, BSC handoff cell handover Inter-BSS handover, MSC/VLR, MSC/VLR BSC, BSC, MSC real-time Handover roaming, BS, cases: Intra-BSS: BTS BSC, BSC handover Intra-MSC Inter-BSS: BTS BSC, MSC Inter-MSC: BTS MSC BSC

57 MS 1 STRN_MEAS 6 HAND_COMM Serving BSS Intra-MSC 2 HAND_REQ 5 HAND_COMM 7 HAND_ACC 8 CHH_INFO 10 HAND_COMP MSC 12 REL_RCH 13 REL_RCH_COMP 3 HAND_REQ 4 HAND_REQ_ACK 9 HAND_DET 11 HAND_COMP Target BSS 57 1 MS STRN_MEAS serving BSS Serving BSC handoff 2 Serving BSS HAND_REQ MSC, MS target BSSs 3 MSC BSS candidate, BSS target BSS, intra-msc handoff resources, MSC target BSS truck, radio channel MSC trunk HAND_REQ target BSS cell area ID ( BTS), MSC-BSS trunk ID, encryption key Kc 4 BSS resource, HAND_REQ_ACK MSC, radio channel ID 5 MSC HAND_COMM serving BSS, target BSS new radio channel ID 6 Serving BSS HAND_COMM MS 7 MS new radio channel HAND_ACC target BSS 8 Target BSS CHH_INFO 9 Target BSS MSC handoff 10 Target BSS MS synchronization, time-slot, MS HAND_COMP target BSS 11 MSC voice trunk target BSS MS BSS synchronization signal, BSS HAND_COMP MSC, handoff 12 MSC REL_RCH serving BSS, old radio channel 13 serving BSS MS resource, REL_RCH_COMP MSC GSM spec open interval gap ( MS new radio channel synchronization) 90% 150ms

58 Serving BSS 1 STRN_MEAS MS Inter-MSC (1/2) 2 HAND_REQ Serving MSC Targst MSC 9 NET_SETUP 10 SETUP_COMP 11 HAND_COMM 12 HAND_COMM Target BSS 3 HAND_PER 4 HAND_NUM 5 HAND_NUM_COMP 6 HAND_REQ 7 HAND_REQ_ACK 8 HAND_PER_ACK Target VLR 58 * Intra-MSC handoff 1 MS STRN_MEAS serving BSS Serving BSC handoff 2 Serving BSS HAND_REQ MSC, MS target BSSs 3 *MSC ( serving MSC) MS, MSC( target MSC), Serving MSC target MSC directory number target MSC voice trunk,, PSTN Serving MSC target MSC HAND_PER 4 *Target MSC HAND_NUM VLR, TMSI 5 *VLR TMSI HAND_NUM_COMP target MSC 6 Target MSC HAND_REQ target BSS cell area ID ( BTS), MSC-BSS trunk ID, encryption key Kc 7 BSS resource, HAND_REQ_ACK MSC, radio channel ID 8 *Target MSC HAND_PER_ACK serving MSC, handoff 9 *Serving MSC NET_SETUP target MSC 10 *Target MSC serving MSC SETUP_COMP

59 MS Serving BSS Inter-MSC (2/2) Serving MSC 13 HAND_ACC 14 CHH_INFO 16 HAND_COMP Targst MSC Target BSS 15 HAND_DET 17 HAND_COMP Target VLR 18 SEND_ENDING 19 ANSWER 20 REL_RCH 21 REL_RCH_COMP 22 END_SIGNAL 23 NET_REL 24 ERL_HAND_NUM 59 * Intra-MSC handoff 13 MS new radio channel HAND_ACC target BSS 14 Target BSS CHH_INFO 15 Target BSS Target MSC handoff 16 Target BSS MS synchronization, time-slot, MS HAND_COMP target BSS 17 target MSC voice trunk target BSS MS BSS synchronization signal, BSS HAND_COMP MSC, handoff 18 *Target MSC SEND_ENDIG Serving MSC handoff 19 * MS new radio channel, Target MSC ANDWER Serving MSC 20 Serving MSC REL_RCH serving BSS, old radio channel 21 serving BSS MS resource, REL_RCH_COMP Serving MSC 22 *Serving MSC END_SIGNAL target MSC 23 *Serving MSC network resource, NET_REL target MSC 24 *Target MSC ERL_HAND_NUM VLR, VLR

60 Security 60

61 Security GSM security is addressed in two aspects: authentication and encryption Authentication avoids fraudulent access by a cloned MS Encryption avoids unauthorized listening 61 GSM authentication encryption GSM GSM, token-based system using security triplets, IS-41 Shared Secret (Key) Data (SSD) SSD : network and phone share the secret key

62 Parameters Parameters: Ki is used to achieve authentication Ki is stored in the AuC and SIM Ki is not known to the subscriber RAND A 128-bit random number generated by the home system SRES is generated by algorithm A3 Kc is generated by algorithm A8 for the encryption Frame Number A TDMA frame number encoded in the data bits 62 secret key, or authentication key Ki Ki GSM Ki GSM, service provider security system, secret data system GSM system in Europe country, intersystem communication 128 random number Ki RAND A3 Signed Result SRES A3 SRES Kc A8 encryption key or cipher key

63 Algorithms Authentication Algorithms: A3 Authentication function In AuC and SIM Encryption Algorithms: A8 To generate the encryption Key In AuC and SIM A5 An algorithm stored in the MS (handset hardware) and the visited system Used for the data ciphering and deciphering 63 A3 GSM GSM GSM A3 GSM Note that if (SRES, RAND) generated by the AuC are sent from the HLR to the visited VLR in advance, the comparison can be done at the visited VLR Discussed later GSM IS-41 A8 GSM GSM A5 GSM

64 Authentication and Encryption RAND Ki Ki A8 A3 A3 A8 Kc SRES SRES Frame Number Kc authentication encryption A5 A5 64,, secret key Ki 128 random number RAND RAND Ki RAND A3 A3 SRES SRES

65 Authentication by Triplet Triplet: RAND, SRES, Kc AuC HLR VLR in advance Example: Authentication in registration New VLR uses LAI to find old VLR Old VLR sends triplets to new VLR New VLR challenges MS by using RAND and SRES 65 MS Ki, RAND, Security, Ki SIM AuC/HLR AuC/HLR, AuC/HLR, GSM, : MS system, VLR AuC/HLR security, triplet ( 3-5 triplet) triplet 3 : RAND, SRES, Kc SRES RAND MS Ki authentication challenge, VLR RAND MS, SRES MS SRES Kc MS, HLR SRES, VLR Ki, A3, A8, MS registration, MS TMSI LAI network New VLR LAI old VLR, old VLR authentication (unused triplets and location of HLR) New VLR challenge MS SRES VLR, VLR, New VLR HLR location update New VLR MS TMSI VLR, VLR HLR triple (ex: 5 triples) triple, (mark used), triple,,

66 Encryption RAND Ki Ki A8 A3 A3 A8 Kc SRES SRES Frame Number Kc authentication encryption A5 A5 66 A3 (for authentication) A8 (to generate the encryption Key Kc) Ki RAND, A8 Kc encryption key Kc TDMA frame number Kc A5

67 GSM Data Services 67, GSM,, Data Communications HSCSD, GPRS EDGE

68 Data Services GSM phase 2 standard supports two data services: Short Message Services (SMS) Bearer Services are similar to the ISDN services, and the maximum data rate is 96 Kbps GSM phase 2+ standard supports two data services: High-Speed Circuit-Switched Data (HSCSD) for high-speed file transfers and mobile video applications General Packet Radio Service (GPRS) for burst data applications such as and WWW 68 GSM Phase 2 short message services bearer Bearer service data circuit duplex 96Kb/s PDA PC card GSM GSM circuit-switching connection GSM Phase 2 packet-switched transmission ETSI GSM Phase 2+ GSM Phase 2+ GSM + EDGE GSM ++, EDGE High Speed Circuit Switched Data HSCSD General Packet Radio Service GPRS mobile video WWW GPRS burst

69 HSCSD High-Speed Circuit-Switched Data (HSCSD) A circuit-switched protocol for large file transfer and multimedia applications Radio link protocol (RLP) in HSCSD to support multi time-slot operation Up to 8 time slots can be used Data rate of HSCSD = no of time slots Data rate of one timeslot The physical layer of HSCSD is the same as that for the Phase 2 GSM data services 69 HSCSD HSCSD 8 data compression HSCSD GSM HSCSD Radio Link Protocol RLP In June 1999, Nokia announced Card Phone 20 for HSCSD with 432 Kbps

70 HSCSD Architecture 70 HSCSD Terminal Equipment TE Terminal Adaption Function TAF interworking function IWF end-to-end service GSM

71 GPRS General Packet Radio Service (GPRS) A packet-switched protocol GPRS radio link protocol To guarantee fast call setup procedure and low-bit error rate for data transfer between the MSs and the BSs A new infrastructure is introduced to GPRS for the packet services 71 GPRS WWW HSCSD GSM GPRS transport network GPRS MAC RLC GPRS GSM physical channels RLC/MAC GPRS supports up to 100 users with one to eight channels

72 GPRS Architecture TE MSC HLR Signaling link TAF MS radio interface SGSN GGSN PSTN PSDN ISDN BSS HLR : Home Location Register VLR : Visitor Location Register MSC : Mobile Switching Center BSS : Base Station Subsystem TAF : Terminal Adaption Function SGSN : Serving GPRS Support Node GGSN : Gateway GPRS Support Node TE : Terminal Equipment PSTN : Public Switched Telephone Network PSDN : Public Switched Data Network 72 GPRS TCP/IP GPRS GPRS GPRS Tunnel Protocol GTP X25 IP GPRS Quality of Service QoS GPRSppt

73 EDGE Enhanced Data Rates for Global Evolution or Enhanced Data Rates for GSM Evolution Cost-efficient upgrade to existing GSM/GPRS and TDMA networks EDGE does not change much of the core network No additional spectrum is necessary EDGE GSM GSM GPRS UMTS UMTS/ HSDPA 73 GSM, EDGE GSM TDMA 3G (revolution) UMTS, (Revolution) GSM (voice, 96 kbps) GSM GPRS ( 80 kbps) (in GSM+) EDGE (240 kbps) (in GSM++) UMTS UMTS/HSDPA ( ) GSM+ HSCSD (High Speed Circuit Switched Data) GPRS (General Packet Radio Services) HSCSD timeslot, GPRS packet switching GSM++ EDGE (Enhanced Data rates for GSM Evolution),, coding scheme, timeslot, EDGE core network, cost-efficient migration

74 EDGE EDGE accelerates speeds over the air 8PSK 9 Coding Scheme (84kbps~ 592kbps) 384kbps when using 8 timeslot E-GPRS: packet-data services E-HSCSD: high-speed, circuit-switched service QoS supported 74 Data, bit (coded) symbol GSM GPRS/GSM coding Gaussian Modular Shift Key (GMSK), bit symbol EDGE 8PSK, bit symbol, bit rate receiver,, symbol, EDGE 9 (coding schemes) (GPRS 4 ),, EDGE bit rate MSC-1: 84kbps~ MSC-9: 592kbps 8 timeslot, 384 kbps EDGE : GPRS HSCSD E-GPRS E-HSCSD GPRS PCU data streams, EDGE WCDMA QoS

75 Unstructured Supplementary Service Data 75 (supplementary services),,, GSM,,, services,, USSD, GSM services

76 USSD These new services may not be supported in old MSs To support the new services in old MSs, USSD was introduced in GSM 0290, 0390, and 0490 Spec USSD is used as a GSM transparent bearer The USSD service node (in MSC, VLR or HLR) provides the new service 76, user,, MS, MS user the text string (usually, telephone number), the MS USSD (without understand the text) USSD service node ( ) text, Ex: *128* # MS, SMS MS USSD, MS SS7 message USSD service node ( USSD gateway), signaling, voice or data

77 The Usage of USSD USSD is flexible in terms of message length and content It uses all digits 0-9 plus and keys A USSD string is a command code Typically 2 or 3 digits followed by several parameters The parameters provide supplementary information The whole string ends with USSD,, USSD The USSD string is sent out in the same manner as placing a call If we specify command code 159 for call forwarding, the USSD string *159* # is sent by the MS The network will forward all incoming calls to

78 USSD Architecture GSM Network MSC VLR HLR 4 USSD Gateway 5 APP- Server 78 USSD MS, MSC, VLR, HLR USSD service node MSC, USSD message (1) MS-MSC USSD service node VLR, USSD message (1) (2) MS-MSC-VLR USSD service node HLR, USSD message (1) (2) (3) MS-MSC-VLR-HLR, USSD service node HLR HLR HLR USSD service node, USSD gateway USSD message server Application server stock query server USSD gateway HLR GSM MAP ; USSD gateway application server TCP/IP

79 Summary (1/2) GSM Architecture MS, BSS, NSS Radio Interface Location Tracking Registration Mobile Call Termination Security Authentication Encryption 79

80 Summary (2/2) Data Services HSCSD GPRS USSD Services EDGE 80

EE Lecture 11 (Wireless Communications Systems)

EE Lecture 11 (Wireless Communications Systems) EE110300 Lecture 11 (Wireless Communications Systems) Contents ( ) (RF) (Antenna) m(t) m(t) 90 50 40 30 20 10 0 ( ) 10 300 330 0 30 60 270 90 240 210 180 150 120 (LAN) (VSAT ) (Pager) (Cellular Phone)