Introduction to GSM

GSMGSMGSM

1. GSM(European Telecommunications Standard InstituteETSI)GSM

Phase 1Phase 2(digital cellular telecommunications system)Phase 2+

GSM(services)(quality of services and security)(radio frequency utilization)(network)(cost)

(services)GSM(service portability)MSGSMGSMMS

(quality of services and security)GSMGSM

(radio frequency utilization)GSM

(network)CCITT Recommendation E.164(cost)MS

2. GSM2.1 GSM2.2 2.3

NSS (Network and Switch Subsystem)MSC (Mobile Switching Center)BSS (Base Station Subsystem)BSC (Base Station Controller)BTS (Base Transceiver Station)MS (Mobile Station)ME (Mobile Equipment)SIM (Subscriber Identity Module)

GSM Location Area Hierarchy

Coverage

(Operations and Maintenance Centre)BSCMSCGMSCBSCBTSBTSMSBTS MSOMCHLR (Home Location Register)VLR (Visitor Location Register)EIR (Equipment Identity Register) AUC (Authentication Centre)

GSM(MS)(radio interface)(BSS)(BSS)A(A interface)(MSC)(NSS)

2.1 GSMGSM(MS)(SIM)(ME)

(SIM)SIM(customized dialing numbers)(short message)

SIMIMSI (International Mobile Subscriber Identity)TMSI (Temporary Mobile Subscriber Identity)KiKc(updatable by the network)subscriber informationaccess control class

additional GSM service(updatable by the network)LAI (Location Area ID)(updatable by the network)forbidden PLMN ()(updatable by the network)

PIN (Personal Identity Number)PUK (PIN Un-lock Key)BCCH (Broadcast Control Channel) frequency listpreferred PLMN list () (A3,A5,A8)

PIN (Personal Identity Number)SIMPINSIM48**04*PIN*PIN*PIN#

PUK (PIN Un-lock Key)PINPINSIMPUK (PIN Un-lock Key)SIM10PUKSIM**05*PUK*PIN*PIN#

(ME)BSMSSIMME(112)SIM

SIMMEMEGSMGSM MSGSMME(classmark)GSMGSMMS

2.2 (BSS)(MS)(MSC)(BTS)(BSC)

(BTS)BTS(Transmitter)(Receiver) (signal)

TRAU (Transcoder/Rate Adapter Unit)Transcoding (for speech channels)PCM (Pulse Code Modulation)GSM speechRate adaptation (for data channels)TRAUBSCMSCBTSPCM is used to digitally represent sampled analog signals. It is the standard form for digital audio in computers and various Blu-ray, DVD and Compact Disc formats, as well as other uses such as digital telephone systems.

(BSC)(BSS)GSMMSCMS(handoff)(BTS)A-bisISDN

2.3 (NSS)MS(roaming management)MSCA(BSS)MSCPSTN

GSM(Home Location RegisterHLR)(Visitor Location RegisterVLR)(Authentication CenterAuC)(Equipment Identity RegisterEIR)

(HLR)(VLR)MSVLRVLRHLRHLRMS(AuC)HLR

(Gateway MSCGMSC)GMSCHLRGMSCMSMSC

3. GSM3.1 3.2 GSM/3.3 GSM

3.1 GSM(radio link)(Frequency Division Multiple AccessFDMA)(Time Division Multiple Access TDMA)

Frequency MultiplexSeparation of the whole spectrum into smaller frequency bandsA channel gets a certain band of the spectrum for the whole timeAdvantagesno dynamic coordination necessaryworks also for analog signalsDisadvantageswaste of bandwidth if the traffic is distributed unevenlyinflexible

Time MultiplexA channel gets the whole spectrum for a certain amount of timeAdvantagesonly one carrier in the medium at any timethroughput high even for many usersDisadvantagesprecise synchronization necessary

Time and Frequency MultiplexCombination of both methodsA channel gets a certain frequency band for a certain amount of time

Time and Frequency MultiplexExampleGSM Advantagesprotection against frequency selective interferencehigher data ratesDisadvantagesprecise coordination required

GSM combines FDMA and TDMAbandwidth is subdivided into channels of 200KHz, shared by up to eight stations, assigning slots for transmission on demand

(downlink) [BS MS]935-960MHz(uplink) [MS BS] 890-915MHz124200KHz [(960-935)*1024]/124=204KHzGSMTDMA

GSM Uses Paired Radio Channels

3.2 GSM/

GSM(burst)(timeslots)GSM(time frame)4.615ms8 0.577ms (= 0.546ms + 0.031ms)(timeslot)burstguard time

GSM Bursts

Burst Normal burstF burst (Frequency Correction Burst)MS

S burst (Synchronization Burst)MS A burst (Access Burst)A burst

Normal Burst

Normal burst156.25 bits (0.577ms)148 bits (0.546ms)(burst)8.25 bits (0.031ms)(guard time)(tailing)3 bits026 bits(training sequence)()

Data57 bits1 bit(flag)

F Burst (Frequency Correction Burst)F burstFCCH (Frequency Correction Channel)Data1420MSBTS

S Burst (Synchronization Burst)SCH (Synchronization Channel)64 bitstraining sequenceMSS burstMSdemodulationburst (F burstdemodulation)S bursttraining sequenceData(Base Station Identity CodeBSIC)frame numberMSBTSframe structure

A Burst (Access Burst)RACH (Random Access Channel)RACHA burstMSRACHtime slotA burstcollision

MSA burstMSBTSMSBTSA burstBTSA burstBTSA burstMSA burstguard timeBTSA bursttime slotA burstA burst83 bits (=3+41+36+3 bits)time slot (156.25 bits)

GSM (FDMA + TDMA)

Traffic channel frames are transmitted in groups of 26 (26-multiframe), of length 120ms (= 26 8 0.577 ms)

SACCH: Slow Associated Control Channel

GSMFDDuplinkdownlinktimeslotMSdownlinktimeslotuplink burst (MS)traffic channel offset3time slotsMSBS(Timing Advance, TA)(synchronization)

(Timing AdvanceTA)BSMS(round-trip delay)BSMS30kmTA0.2msTA(BSS)MSMSBSTA

round-trip propagation delayMSTA(3 timeslots-TA)BS

GSM Delays Uplink TDMA Frames

3.3 GSM3.3.1 (TCH)3.3.2 (CCH)

CM (Connection Management) call control, short message service and supplementary service MM (Mobility Management) registration, authentication, location and handover management RR (Radio Resource Management) setup, maintenance and release of radio channels control of radio transmission quality

Physical channelBTSMSlogical channels ()Logical channelGSMlogical channels

GSM(Traffic ChannelTCH)(Control ChannelCCH)

3.3.1 (TCH)(Full Rate TCHTCH/F)13Kbps9.64.82.4Kbps(Half Rate TCHTCH/H)6.5Kbps4.82.4Kbps

Sub-Rating Strategy(sub-rating)(full-rate)(half-rate)

3.3.2 (CCH)(Common Control ChannelCCCH) MS(Dedicated Control ChannelDCCH) MS(Broadcast ChannelBCH)

3.3.2.1 (CCCH)(Paging ChannelPCH) (Random Access ChannelRACH)(Access Grant ChannelAGCH)

(Paging ChannelPCH)MSMS(Random Access ChannelRACH)MSBSMSBS(access collisions)GSMSlotted Aloha

NoteAlohaalgorithmif you have data to send, send the dataif the message collides with another transmission, try resending "laterperformancea maximum throughput of about 18.4%, or about 81.6% of the total available bandwidth was essentially wasted due to losses from packet collisions

Note (cont.)

Note (cont.)Slotted Alohaalgorithma station can send only at the beginning of a timeslot, and thus collisions are reducedperformanceintroduces discrete timeslots and increases the maximum throughput to 36.8%

Note (cont.)

(Access Grant ChannelAGCH)BSMSBS

3.3.2.2 (DCCH)(Standalong Dedicated Control ChannelSDCCH)(Slow Associated Control ChannelSACCH)(Fast Associated Control ChannelFACCH)(Cell Broadcast ChannelCBCH)

(Standalong Dedicated Control ChannelSDCCH)(short message)(Slow Associated Control ChannelSACCH)(time alignment)MSBS

(Fast Associated Control ChannelFACCH) (time-critical signaling)

(Cell Broadcast ChannelCBCH)BSMS

3.3.2.3 (BCH)(Frequency Correction ChannelFCCH)(Synchronization ChannelSCH) (Broadcast Control ChannelBCCH)

(Frequency Correction ChannelFCCH) & (Synchronization ChannelSCH)BSMSFCCHMSBTSSCHBase Station Identity Code (BSIC)frame numberMSBTSframe structure

(Broadcast Control ChannelBCCH)MSBSMSBS

Uplink & DownlinkUplink[MSBS](RACH)Downlink[BSMS](FCCH)(SCH)(BCCH)(PCH)(AGCH)

Uplink/Downlink[MSBS](SDCCH)(SACCH)(FACCH)(CBCH)

CBCH

CBCH BTSMS

4. 4.1 GSM4.2 (SS7)4.3 4.4

4.1 GSMGSMMobile Station ISDN Number (MSISDN) []Mobile Station Roaming Number (MSRN) []International Mobile Subscriber Identity (IMSI) []Temporary Mobile Subscriber Identity (TMSI) []Location Area Identity (LAI) []Cell Global Identity (CGI) []International Mobile station Equipment Identity (IMEI) []

MSISDN (Mobile Station ISDN Number)MSISDN()CCITT Recommendation E.164MSISDN=CC+NDC+SN(CC)-(NDC)-(SN) (15)

MSRN (Mobile Station Roaming Number)MSMSCVLRMSRN = CC+NDC+SNMSISNDCall termination procedure

call deliveryHLRGMSCVLRVLR(MSRN)HLRMSRNMSMSCMSCMSRNGMSCMSRNMSCCall termination procedure

IMSI (International Mobile Subscriber Identity)HLR/VLRMSPLMNSIMHLRAUCVLR

MNCnetwork providerPLMN (Public Land Mobile Network)ExMCC=466MNC=01 (=92=97)

TMSI (Temporary Mobile Subscriber Identity)(IMSI)IMSIair interfaceTMSIIMSIMSMSMSC/VLRIMSITMSI

TMSIVLR(assign)MSMSMSC/VLRTMSITMSIMSnew LA(IMSI)registration (location update)MSCpageMSLABSPCH(broadcast)MSTMSI

LAI (Location Area Identity)(Location AreaLA)LAa cella group of cellsMSCLAs

LAIcall terminationMSLALAcellspageMSLAI = Mobile Country Code (3-digit) + Mobile Network Code (2 or 3-digit) + location access code (up to 16-digit)LAI = MCC (3-digit) + MNC (1-2 digits) + LAC (2 digits)Ex466-01-91ROC--

CGI (Cell Global Identity)CGI = LAI + CI = MCC + MNC + LAC + CI(CICell Identity)cellExcellCGI= 466-01-91-1 466-01-91-2

MSGSMMSBSCGILAI CILAMSC/VLRMSregistrationlocation update

IMEI (International Mobile station Equipment Identity)*#06#IMEI(SNR)

TAC (Type Approval Code)GSM componentconformanceinteroperabilityTACFAC (Final Assembly Code )SNR ( )TAC/FAC

IdentifiersComponents

IMSITMSIMSISDNCGILAIMSCMSRNVLRMSHLRHLRMSVLRVLRIMSI

4.2 (SS7) (Common Channel SignalingCCS) (signal)(out-of-band)

NoteIn-band signalingthe sending of metadata and control information in the same band, on the same channel, as used for dataOut-of-band signalingthe exchange of call control information in a separate band of the data or voice channel, or on an entirely separate, dedicated channel (as in Common Channel Signaling)

4.2.1 (CCS)(information transfer)call controlremote controloperationsmanagementadministrationGSM uses SS7 signaling for call control, mobility management, short messages and value-added services

4.2.2

SS7

(Access linkA-link)SSPSCP STPSSPSTPA-link12816(Diagonal linksD-link)(PCNPSTN) STPSTP64D-links

SS7(Service Switching PointSSP) (Signal Transfer PointSTP)(Service Control PointSCP)

(SSP)SSP(trunk)SSP(originating SSP)(terminating SSP)(tandem SSP)

SSPPSTN(Central OfficeCO)(End OfficeEO)PCN(MSC)

(STP)SS7(SSP)(SCP)STPSTP

(SCP)SCPSSPSSPSCP serves as interface to a telephone companys databaseSCP is a computer used as a front-end to a database

Database store information aboutsubscribers servicesrouting of special service numberscalling card validation and fraud protectionadvanced intelligent network features for service creationCommunication between SCP and mainframe/mini-computer that hosts the database is via X.25 links

Typical databases in SS7 networkscall management service database (CMSDB)local number portability (LNP)line information database (LIDB)business service database (BSDB)home location register (HLR)visitors location register (VLR)

Point CodeSS7uniquepoint code (PC)SS7A point code can be 24 bits (North America, China)16 bits (Japan)14 bits (ITU standard, International SS7 network and most countries)3-bit()8-bit/3-bit/

SS7SS7OSI(Layers)MTPSCCPTCAPISUP (ISDN-UP)OMAPMAPTCAP

SS7 Protocol Stack

MTPMessage Transfer Part ()SCCPSignaling Connection Control Part ()NSP Network Service Part ()TCAPTransaction Capabilities Application Part ()ASE Application Service Entities ()

MAPMobile Application Part ()OMAPOperations, Maintenance, and Administration Part ()ISUPIntegrated Service Digital Network User Part ()TUPTelephone User Part ()

ITU-T SS7 Specifications

(Message Transfer PartMTP)MTPOSIMTP Level1 ()signal linkbearercodingtime slot number bit rateframingimpedance bit invert64kbpsdigital line (T1E1)

MTP Level2 ()SS7MTP Level1

error detection and correctionflow controlsignal unit delimitation and alignment ()initial alignment ()

MTP Level3 ()message routingmessage discriminationmessage distributionnetwork management

MTProuting labelOriginating point code (OPC)Destination point code (DPC)Signaling link selection (SLS) [for load sharing among STPs]Point codeSS7uniqueSS7

incoming messageuser (SCCPISUP)MTPservice indicatoridentify the usernetwork indicatordetermine whether national or international signaling

MTP Layer RoutingSS7MTP (Message Transfer Part)SCCP (Signaling Connection Control Part)SSPSTPSCPMTP Level 1-3DPCOPC (Originating Point Code)originatingDPC (Destination Point Code)destination

OPCDPCSLS (Signaling Link Selection)MTP Level 3fieldOPCDPCsource IPdestination IPCIC (Circuit Identification Code)voiceMTPSCCP

(Signaling Connection Control PartSCCP)SCCP provides means for end-to-end routingSCCP uses more extensive addressing than MTPSCCPconnectionlessconnection-orientedSCCP0 basic connectionless (does not guarantee in-sequence delivery)1 in-sequence-delivery connectionless class2 basic connection-oriented class3 flow-control connection-oriented class

SCCP Layer RoutingSCCPaddresscalled party address (PC+SSN+GT)calling party addressPC is a hierarchical address consisting ofcluster membernetwork clusternetwork identifier

SSN (SubSystem Number)identify a particular entity within a nodee.g.,1-800 number service, calling card module, ISUP, etcGT (Global Title)could be dialed digits of a telephone number

SCCPGTT(Global Title TranslationGTT)MTPGTT (Global Title Translation)SCCPfunctionHLR/VLR(SSN)HLR/VLRSS7hoppoint code

SCCPentitySSN numberSSNASE (Application Service Entity)addressSSNHLRSSN0000110SSNSSN: identify a particular entity within a node

800MSC800request messageGTTSTPSTP800 translation servicesSCPrequestSCP

SCP800 xxx xxxx(directory number)SCPSTPSTPMSCSTPMTP Level 1-3SCCPGTT

GTT ExampleVLRVLRHLRVLRrequest messageGTTSTP ASTP AaddressGTT Tablehop (GA)point codeDPCrequestSSP GAaddressGTT Tablehop (GB)point codeDPCrequest

STP C(STP CGTT)SSP GBaddressGTT Tablehop (STP B)point code DPCrequestSTP BaddressGTT Tablehop (SCP B)point codeDPCrequestGTT for SCP B

SSPSSP

(Transaction Capabilities Application PartTCAP)Most typically used as a protocolbetween a switch and a network databasebetween two network databasesAll the applications are transaction-orientedsupport (multiple) requests and responses

TCAP SCCP UNIT DATA MESSAGECLASS 0 or 1TRANSACTION MESSAGESCOMPONENTSREQUEST/RESPONSETCAP

TCAP has two sublayersComponent Sublayer (CSL) responsible forassociating the users request with the responseshandling all abnormalities

CSL operation can be viewed as procedure callsthe CSL messaging unit is called a componentTransaction Sublayer (TSL)manages the message, e.g., identify the type of message, execute the message, etc.

TCAPIS-41MSC(inter-MSC handoff)(automatic roaming)(operations, administration, and maintenance) TCAP TCAP (transaction portion) [TSL](package type) (component portion) [CSL]

IS-41TCAP(Package Type)(QUERY With Permission)TCAP(RESPONSE)TCAP

(CONVERSATION With Permission)(UNIDIRECTIONAL)

SS7

IS-41(Component Type)(INVOKE LAST)SS7(operation)Last(component part)(component)(RETURN RESULT NOT LAST)RETURN

(RETURN RESULT LAST)SS7INVOKERETURN RESULT(RETURN ERROR)INVOKEMIN (Mobile Identification Number)HLR

(REJECT)()SS7REJECT(task)(error recovery)

IS-41TCAP(timeout)IS-41(RETURN ERRORTCAP)

IS-41 ()

(location update)IS-41PCN1 PCN2 PCNMSCVLRSTP

IS-41 TCAP

T1MSC2 RegistrationNotification(INVOKE) VLR2MSC1MSC2VLR2 VLR2VLR2 MSC1

T2MSC1MSC2VLR2VLR2VLR2 RegistrationNotification(INVOKE) HLRVLR2MINHLRTCAP (GTT)HLRSTP3 ((DPC)STP3)STP3 HLR

STP3STP2HLRHLRRegistrationNotification(RETURN RESULT)VLR2VLR2 HLR RegistrationNotification(INVOKE) SCCPVLR2T2 T1

T3HLRRegistrationCancellation(INVOKE) VLR (VLR 1)T4MSC1

T5T2VLR2 QualificationRequest(INVOKE)HLRT6VRL2ServiceProfileRequest(INVOKE)HLR (service profile)

(Integrated Service Digital Network User PartISUP)ISUPa circuit-related protocol used for establishing and maintaining connections throughout a call(call control)call set upconversation (include pure data exchange)call teardown

(value added service)(call forwarding)caller(caller ID)user to user signalcheck call statustrunk management

ISUPthe choice for ISDN network support for call managementcall management is realized through switch-to-switch signaling (call management switch to switch signaling)ISUP is the protocol used for switch-to-switch signaling (switch to switch signaling ISUP protocol)ISUP entity addresses each other with the MTP addressing scheme, augmented by circuit identification, which refers to a specific trunk

ISUP Basic Message CategoriesForward setup ( called party)set up a call with particular characteristics in the direction toward the called partyBackward setup ( calling party)complete the call establishment in the direction from the exchange containing the called party toward the calling partyaccounting and charging procedures belong to this category

General setupcarry additional call-related information needed to set up a callCall supervisionnotifications of events like the call being answered, the circuit being released, or the need for an international operator intervention

Circuit supervisionall kinds of notifications of the events related to circuits allocated for a callCircuit group supervisionrelate to circuit groups rather than individual circuitsused for network management purposesE.g., call blocking on the indicated trunk groups, circuit group status queries, etc.

In-call modificationthe messages in this group support modification of the existing call characteristics (for example, a change from a voice call to a data call) or invoking a particular medium (facility)End-to-endthe messages in this group include user-to-user signaling independent of call control messages

Telephone User Part (TUP)Provides conventional PSTN telephony services across the SS7 networkDefined in ITU-T Recommendations Q.721-725, which define the international telephone call control signaling functions for use over SS7

4.3 GSMHLRVLR

Home Location Register (HLR)An HLR record consists of 3 types of informationmobile station informationIMSI (used by the MS to access the network)MSISDN (the ISDN number Phone Number of the MS)location informationISDN number of the VLR (where the MS resides)ISDN number of the MSC (where the MS resides)service informationservice subscriptionservice restrictionssupplementary services

Visitor Location Register (VLR)The VLR information consists of three partsmobile station informationIMSIMSISDNTMSI

location informationMSC NumberLocation Area ID (LAI)MSRN (VLRMSMSCtrunk)HON (MShandover)service informationa subset of the service Information stored in HLR

MSCVLRMSLALAVLRHLRMSLAMSHLRMSVLR

GSM Location Area Hierarchy

(a) Inter-LA movement(b) Inter-MSC movement(c) Inter-VLR movemnet

NoteMS(idle)(roaming)BSBCCH (Broadcast Control CHannel)CGI (CILAI)BSMSBSchannel

new BSold BSLAIpaging areaMSMSC/VLRnew BSBCH (Broadcast channel)

new BSold BSLAI(location update)(registration)casesInter-LA movementBSs MSCVLRHLR (HLRLAI)

Inter-MSC movementBSs MSCVLR VLRHLRMSInter-VLR movementBSs VLRVLRHLRMS

LA1LA2LA3

MSGSM MSBCCH-carrierYES MSBScellPLMNNO cell

FCCH (Frequency Correction Channel)MSBSSCH (Synchronization Channel)BSIC (Base Station Identity Code)BCCHCGI (Cell Global Identity)MSCGIPLMNcell

Inter-LA

1MSC1MSTMSILA (old LAI)MSCVLR2MSC1LAVLR1MSCTMSILAILAI

3LA1LA2MSC1VLR1VLR1LAIVLR14MSC1

Inter-MSC

12MSC2LAVLR13VLR1LA1LA2VLR1MSLAIMSCIMSIMSHLRVLR1HLR

4HLRIMSI MSC56VLR1LAMSC2MSC2

Inter-VLR

1MSBSBSBCCHLAMS(Temporary Mobile Subscriber IdentityTMSI)VLR (old VLR)VLRTMSIMS(International Mobile Subscriber IdentityIMSI)

2 IMSIVLRVLRTMSIPSTNVLRIMSIMSIMSIPSTNVLR

3 VLRIMSIMSHLRMS HLRHLRMSVLR4VLRTMSI MSMS

5 3HLRVLRMSVLRMS

MSroamingHLRGSM(re-registration)624

periodical registrationGSMVLRHLRre-registrationSIMIMSI detachGSMMSIMSI detachMSC/VLRMSperiodical registrationMSC/VLRMS

4.4 4.4.1 (call origination procedure)4.4.2 (call termination procedure)

4.4.1 (Call Origination Procedure)

4.4.2 (Call Termination Procedure)

5. (Handoff)MSBSBSMSMSBSBS

MSGSMBSBS

Handoff ProcedureMSBSBSBSBSMSC

(radio link measure) (channel quality)(Word Error IndicatorWEI)(Received Signal Strength IndicatorRSSI)(Quality IndicatorQI)

(WEI)WEIMS(demodulate)(current burst)WEIWEIhandoff

(RSSI)RSSI(signal strength)80100 dBRSSIRSSIhandoff

RSSI(distance dependent fading or path loss)occurs when the received signal becomes weaker due to increasing distance between MS and BS(Shadow FadingLog-Normal)occurs when there are physical obstacles (e.g., hills, towers, and buildings) between the BS and the MS, which can decrease the received signal strength

(Multipath Fading) (Rayleigh Fading)occurs when two or more transmission paths exist (due to signal being reflected off buildings or mountains) between the MS and BS

RSSITDMA100500ms

(QI)QI/SIR: Signal to Interference RatioSNR: Signal to Noise RatioSINR: Signal to Interference & Noise RatioQIinterferencenoisedispersion ()

WEIRSSIWEIRSSIhandoffchannel comparisonWEIRSSIQI

TDMA

PACS(frame)2.5ms2562.5ms(handoff)

RSSIQI(filtering)(window averaging) (leaky-bucket integration)

w(w)Sk= Mk + Mk-1 + Mk-(w-1) SkkMkkw-l

Sk = aSk-1 + Mka < 1 (forgetting factor)

GSM Handoff(Intra-BSC handoff)BTSBSC(Inter-BSC handoff)BTSBSCBSCMSC(Inter-MSC handoff)BTSMSC

Handover Decision

(Mobile Controlled HandoffMCHO)(Network Controlled HandoffNCHO)(Mobile Assisted HandoffMAHO)

MCHO

(TDMA)idle time-slotDECT (TDMA/TDD)handoff100ms-500msPACS (TDMA/FDD)handoff20ms-50msMCHO(implement)

ALT: Automatic Link TransferTST: Time Slot Transfer

(downlink)(uplink)(WEI)

()

handoffATL (Automatic Link Transfer)time slotTST (Time Slot Transfer)

block

(MSC) ()

RSSIMSC

(FDMA)CT2+ AMPS

NCHO (signaling)(MSCtraffic)(heavy)NCHO10

NCHOMSCMSCRSSI

GSM

GSM(MSC)GSM1

MAHO(BS)MSCglobal optimizationNCHOMAHOMCHOMSChandoffcellradio linkMSC

(bridge) (HON)

GSM: Mobile-Assisted Handover (MAHO)

6. GSM(authentication)GSM(encryption)MS

(secret key) KiGSMAuCSIMAuC (Home System)128 (random number)RANDAuCRANDMSAuCMSKiRANDA3

A3(SignedResult (or SignedResponse)SRES)MSSRESAuCAuCSRESMS

A3MSAuCA8A8Kc(encryption key)AuCKcMSBSBSTDMA(frame number)MSTDMA2204194303(frame counter)

MSBS(Kc)A5GSMA5

A3AuCSIM

A8(encryption key)KcAuCSIMA5visited system (BSS VLR)(ciphering) (deciphering)

TripletsKiAuCAuCMSVLRAuC(triplet)Triplet3RANDSRESKcHLRRANDSRESKctriplet

VLRRANDMStripletSRESMSSRESVLRKcBTSKc

7. GSM(Functional Plane)GSMGSM

GSM Functional PlaneConnection

GSM Entities and Functional PlaneCM

MM

RR

Transmission

Transmission PlaneTransmission plane includesmodulation, coding, multiplexing, format dataensure proper sequencingcorrect errors through repetitionsroute information through networkTransmission plane includes two independent functionsprovide the means to carry user informationprovide the means to carry signaling messages between entities

Radio Resource Management(Radio Resource managementRR)RRMSMSC(connection)MSRRMSBSCMSC inter-MSC handoverRR

Mobility Management(Mobility ManagementMM)MMHLRAuCSIMMMMMCMMMMM()

Connection Management(Connection ManagementCM)CMCM(Call ControlCC)(Supplementary Service managementSS)(Short Message ServiceSMS)

(CC)HLRMSC/VLRGMSCCC(SS)GSM(SMS)GSM

SummarySMSCMGSM(signal)MMRRSDCCH (Standalong Dedicated Control Channel)GSM MAP (Mobile Application Part)

Radio Resource (RR) ManagementMobility Management(MM)ConnectionManagement (CM)SMS

Operations, Administration & Maintenance(OperationsAdministration & MaintenanceOA&M)OA&MOperation and Support Subsystem (OSS)Base Station Subsystem (BSS)Network and Switching Subsystem (NSS)OA&M

Request for Connection EstablishmentScenario: MSBSSdedicated control channeldedicated control channelchannel assignmentRRevent 1MSidle statelisten to BCCHevent 1 (Establish MM connection)CMsublayer CCCMcallcallemergency call

Establish MM connectionCM service requestRR channel requestRR IMM ASS

event 2 (CM service request)MMRR connectionCM service requestMS IDinformationevent 3 (RR channel request)MSRRBSSMSdedicated control channelRACHBSSBSSRR layer

event 4 (RR IMM ASS)BSSRRMSAGCHMSMSRR layerMS RRMMRR connection

8. 8.1 Short Message Service (SMS)8.2 SMS

8.1 Short Message Service (SMS)(SDCCHSACCH)(store and forward)140(char)SMS concatenationSMSSMS compression

SMSsignal bandwidthdatalow capacity cheaperbest effortnon real-time

8.2 SMStworkGSM networkShort Message SenderOriginal MSTerminating MSBTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS center

SM-SC (Short Message Service Center)store and forwardIWMSC (Interworking MSC)MSshort messageSM-SCSMS GMSCGMSCSMS

Short Message Service Gateway MSC (SMS GMSC)SM-SC MS MSC MSCshort messageMSCbroadcast SMSs to all its BSSsBTSpage the MS

SM-SCSM-SCstore-and-forwardscalableavailablereliableGSM networksGSM networkSMS GMSC

SM-SCSema SM-SCCompaq Alpha ServerEricsson SM-SCSun SPARCNokia SM-SCHP 9000SM-SCTCP/IP (Internet)WAP (Wireless Application Protocol)

Mobile OriginatingBTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS center

LuqTx

Cloud

IBM Compatible

BTS

BSC

BTS

BSC

MSC

BTS

SM-SC

SMS GMSC

IWMSC

GSM network

GSM network

Short Message Sender

Original MS

Terminating MS

MSshort messageMS[Step 1] MSshort messageIWMSC (Inter-working MSC)

[Step 2] short messageSM-SC (Short Message Service Center)SM-SC[Step 3]short message

BTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS centerMobile Terminated

SM-SCshort messageMS[Step 1] SM-SCSMS GMSCGSM[Step 2]GMSCMSMSCshort messageMSC

[Step 3] MSCBSSBTSshort messagebroadcast[Step 4] MSsoftware

9. GSM9.1 Data Service9.2 HSCSD9.3 GPRS9.4 EDGE9.5 USSD

GSM(data communications)HSCSD (High-Speed Circuit-Switched Data)GPRS (General Packet Radio Service)EDGE (Enhanced Data Rates for GSM Evolution)

9.1 Data ServiceGSM Phase 2(Short Message Services)(Bearer Services)Bearer servicedata circuit duplex9.6KbpsNotebookPDAPC cardGSM

GSM(circuit-switching connection)GSM Phase 2(packet-switched transmission)

GSM Phase 2+ETSIGSM Phase 2+GSM+(data service)(mobile video)WWW

(High Speed Circuit Switched DataHSCSD)circuit-switching(General Packet Radio ServiceGPRS)packet switchingbursty

9.2 HSCSD8(data compression)

GSMHSCSD(Radio Link ProtocolRLP)(timeslot)(data rate) = number of timeslots data rate of one timeslot

HSCSD

(Terminal EquipmentTE)(Terminal Adaptation FunctionTAF)(InterWorking FunctionIWF)(PSTNPSDNISDN)

9.3 GPRSGSM(transport network)GPRS(Radio Link Protocol)PhysicalMACRLCMSsBSs(fast call setup procedure)(low-bit error rate)

PhysicalGPRSGSM physical channelslogic channelsRLC/MAC(air interface) physicalGPRSchannels100

GPRS

GPRS(GPRS Tunnel ProtocolGTP)GPRSGPRS(SGSN & GGSN)()X.25IP(PDU)GPRS(Quality of ServiceQoS)

9.4 EDGEEDGEEnhanced Data rates for GSM EvolutionGSMTDMA3GGSM GSM GPRS (in GSM+) EDGE (in GSM++) UMTS UMTS/HSDPA()

GSM+HSCSDGPRSGSM++EDGEcoding schemetimeslot

EDGEcore networkcost-efficientmigrationEDGEE-GPRS (packet data service)E-HSCSD (circuit-switched service)WCDMAQoS

9.5 USSDUSSD (Unstructured Supplementary Service Data)GSM(supplementary services)

MSMStext string()MSUSSD(without understand the text)USSD service node (i.e.)text stringEx*128*#MSSMS

MSSS7 signaling (voicedata)messageUSSD service node (USSD gateway)USSDuses all digits 0-9 plus and keystypically 2 or 3 digits followed by several parameters

the whole string ends with , e.g.if we specify command code 159 for call forwardingthe USSD string *159*5288128# is sent by the MSthe network will forward all incoming calls to 5288128

USSDGSM MAPTCP/IP

USSDMSMSCVLRHLRUSSD service nodeMSCUSSD message(1)MS-MSCUSSD service nodeVLRUSSD message(1)(2)MS-MSC-VLRUSSD service nodeHLRUSSD message(1)(2)(3)MS-MSC-VLR-HLR

USSD service nodeHLRHLRHLRUSSD service node

USSD gatewayUSSD messageApplication Serverstock queryUSSD gatewayHLRGSM MAPUSSD gatewayapplication serverTCP/IP

******************************************Tapping ****************BP: slot length is called a burst period (BP).**********************************************************Tandem: ***********Impedance: ()****************************************************Step 1: BCCH(LAC, Location code) SDCCH new VLR MS Temporary Mobile Subscriber Identity (TMSIVLR VLR MSC VLR : MSC, TMSI, old LAI, target LAI .Step 2:IMSI VLR VLR TMSI VLR IMSI VLR authentication TMSI IMSI Step 3: VLR HLR VLR IMSI MS PLMN, i.e., HLR HLR VLR Step 4: VLR TMSI Step 5:3HLR VLR VLR

*************************************************************Triplet***GSM functional plane GSM sites interface GSM . OSI model , functional planes, . GSM functions model 5 functional planes. entities (physical transmission) external users (lower layer) (upper layer)., lower layer short time scale, upper layer long time scale.Ex: bit modulation in Transmission plane microseconds ., entity ( signaling protocol), , function. GSM functional plane OSI layer protocol , function protocol.Example: CM Q.931 (layer 3), CM Q.931 , layers 1,2. signals , CM physical layer.GSM functional plane GSM sites OS calls program . programmer, designer GSM function planes operations .

* GSM entity functional plane ., entity function.****************************************************