newgsm zarka

ZARKA/2005ZARKA/2005

1

DISCUSSION TOPICS

• 2 G System Architecture

• 2.5 G

• 3G

2

GSM – GLOBAL SYSTEM FOR MOBILE COMMUNICATION

Nizar ZARKA 2005


3

Global System for Mobile

( Group Special Mobile )

G S MG S M


4

HISTORY GSM• Early 80’s Several first generation analog cellular

systems in Europe but incompatible - limited roaming

• 1987-1989 ETSI standards for pan-European Global System for Mobile Communications (GSM, originally Group Special Mobile) at 900 MHz– 1992 GSM is launched– 1990-1993 Standards for Digital Cellular System at

1800 MHz (DCS 1800, recently renamed GSM 1800; US version is PCS 1900)


5

Building Blocks

• AMPS – Advanced Mobile Phone System

• TACS – Total Access Communication System

• NMT – Nordic Mobile Telephone System


6

Building Blockscontd.

AMPS – Advanced Mobile Phone System

• analog technology

• used in North and South America and approximately 35 other countries

• operates in the 800 MHz band using FDMA technology


7

Building Blockscontd.

TACS – Total Access Communication System

• variant of AMPS

• deployed in a number of countries

• primarily in the UK


8

HISTORYcontd.

• GSM criteria – – Good subjective speech quality– Low terminal and service cost– Support for international roaming – one system for all of

Europe– Ability to support handheld terminals– Support for range of new services and facilities– Enhanced Features– ISDN compatibility– Enhance privacy– Security against fraud


9

GSM: History

• 1982 CEPT (Conference of European Posts and Telegraphs) establishes Groupe Speciale Mobile

• Motivation develop European mobile network• Support European roaming and interoperability in

landline• Increase system capacity• Provide advanced features• Emphasis on STANDARDIZATION, supplier

independence• Low cost infrastructure and terminals


10

GSM: History

• 1989 European Telecommunications Standardization Institute (ETSI) takes over standardization• changes name: Global System for Mobile Communication• 1990 First Official Commercial launch in Europe• 1992 first paying customers were signed up for service• By 1993 there were 36 GSM networks in 22 countries• Early 1994 there were 1.3 million subscribers worldwide• 1995 GSM Specifications ported to 1900 MHz band• By 1996 there were more than 25 million subscribers

worldwide• GSM is the most popular 2G technology


11

GSM Market


12

GSM System Architecture

PSTN

Data Terminal

HLR/VLR

MSCBSC

OMC(Operation & Maintenance

Center)

OperationTerminal

BTS

HandsetA

X.25

A-bis SS7

Network sub-system PSTNRadiosub-system

Mobilestation

UM

SIMcard


13



14

Functional Architecture


15


VLR = Visitor Location Register AUC = Authentication Center

BTS = Base Transceiver Station HLR = Home Location Register

ADC = Admission Data Center EIR = Equipment Identity Register

OMC = Operation Maintenance Center


16

Radio Station Subsystem (RSS)


17

System ArchitectureMobile Station (MS)

The Mobile Station is made up of two entities:

1. Mobile Equipment (ME)

2. Subscriber Identity Module (SIM)


18

BTS Base Transceiver Station. The BTS comprises the radio transmission and reception devices, and also manages the signal processing related to the air interface.

BSC Base Station Controller. The BSC manages the radio interface, mainly through the allocation, release and handover of radio channels.

MSC Mobile Switching Centre. The MSC is basically an ISDN-switch, coordinating and setting up calls to and from MSs.

GSM General Architecture


19

VLR Visitor Location Register. The VLR contains all the subscriber data, both permanent and temporary, which are necessary to control a MS in the MSCs coverage area

HLRHome Location Register. The HLR database is used to store permanent and semi-permanent subscriber data; as such, the HLR will always know in which location area the MS is (assuming the MS is in a coverage area), and this data is used to locate an MS in the event of a MS terminating call set-up.



20

The AuC database contains the subscriber authentication keys and the algorithm required to calculate the authentication parameters to be transferred to the HLR.

AuC: Authentication Centre



21

System ArchitectureMobile Station (MS) contd.

Mobile Equipment

• Produced by many different manufacturers• Must obtain approval from the

standardization body• Uniquely identified by an IMEI

(International Mobile Equipment Identity)


22

International Mobile Equipment Identity ( IMEI )International Mobile Equipment Identity ( IMEI )

TAC = Type Approval CodeFAC = Final Assembly CodeSNR = Serial NumberSP = Spare

IMEI = TAC + FAC + SNR SP+

6 digits 2 digits 6 digits 1digit


23

System ArchitectureMobile Station (MS) contd.

Subscriber Identity Module (SIM)

• Smart card containing the International Mobile Subscriber Identity (IMSI)

• Allows user to send and receive calls and receive other subscribed services

• Encoded network identification details• Protected by a password or PIN• Can be moved from phone to phone –

contains key information to activate the phone


24

International Mobile Subscriber Identity ( IMSI )International Mobile Subscriber Identity ( IMSI )

IMSI = MCC + MNC + MSIN

NMSI

3 digits 2 digits

Not more than 15 digits

MCC = Mobile Country CodeMNC = Mobile Network CodeMSIN = Mobile Station Identification NumberNMSI = National Mobile Subscriber Identity


25

GSM Security:The SIM card (Subscriber Identity Module)

• Must be tamper-resistant• Protected by a PIN code (checked locally by the SIM)• Is removable from the terminal• Contains all data specific to the end user which have to reside in the Mobile Station:

– IMSI: International Mobile Subscriber Identity (permanent user’s identity)– PIN– TMSI (Temporary Mobile Subscriber Identity)– Ki : User’s secret key – Kc : Ciphering key – List of the last call attempts– List of preferred operators– Supplementary service data (abbreviated dialing,– last short messages received,...)


26

System ArchitectureBase Station Subsystem (BSS)

Base Station Subsystem is composed of two parts that communicate across the standardized Abis interface allowing operation between components made by different suppliers

1. Base Transceiver Station (BTS)

2. Base Station Controller (BSC)


27

System ArchitectureBase Station Subsystem (BSS) contd.

Base Transceiver Station (BTS)

• Houses the radio transceivers that define a cell• Handles radio-link protocols with the Mobile Station• Speech and data transmissions from the MS are recoded• Requirements for BTS:

ruggednessreliabilityportabilityminimum costs


28

System ArchitectureBase Station Subsystem (BSS) contd.

Base Station Controller (BSC)

• Manages Resources for BTS• Handles call set up• Location update• Handover for each MS


29

Base Transceiver Station and Base Station Controller

• Tasks of a RSS are distributed over BSC and BTSBTS comprises radio specific functionsBSC is the switching center for radio channels


30

System ArchitectureNetwork Subsystem

Mobile Switching Center (MSC)

• Switch speech and data connections between:Base Station ControllersMobile Switching CentersGSM-networksOther external networks

• Heart of the network• Three main jobs:

1) connects calls from sender to receiver2) collects details of the calls made and received3) supervises operation of the rest of the network components


31

System ArchitectureNetwork Subsystem contd.

• Home Location Registers (HLR)- contains administrative information of each

subscriber(IMSI,Services,,)- current location of the mobile

• Visitor Location Registers (VLR)- contains selected administrative information from the HLR- authenticates the user- tracks which customers have the phone on and ready to receive

a call- periodically updates the database on which phones are turned

on and ready to receive calls


32

System ArchitectureNetwork Subsystem contd.

• Authentication Center (AUC) - mainly used for security- data storage location and functional part of the network- Ki is the primary element

• Equipment Identity Register (EIR)- Database that is used to track handsets using the IMEI

(International Mobile Equipment Identity)- Made up of three sub-classes: The White List, The Black List

and the Gray List- Optional database


33

Authentication and Encoding


34

Cryptographic algorithms of GSM

R Ki

A3 A8

R S Kc Triplet

Random number User’s secret key

A5 Ciphering algorithm Authentication

Kc: ciphering keyS : signed resultA3: subscriber authentication (operator-dependent algorithm)A5: ciphering/deciphering (standardized algorithm)A8: cipher generation (operator-dependent algorithm)


35

Ciphering in GSM

A5

CIPHERINGSEQUENCE

PLAINTEXTSEQUENCE

Kc FRAME NUMBER

Sender(Mobile Station or Network)

Receiver(Network or Mobile Station)

CIPHERTEXTSEQUENCE

A5

CIPHERINGSEQUENCE

Kc FRAME NUMBER

PLAINTEXTSEQUENCE


36

Authentication Procedure in GSM


37

Ciphering Procedure in GSM


38

Authentication principle of GSMMobile Station Visited network Home network

IMSI/TMSI

IMSI (or TMSI)A8 A3

Ki R

Kc S

IMSI

Triplets (Kc, R, S)

TripletsAuthenticate (R)

A8 A3

Ki R

Kc S’ Auth-ack(S’)S=S’?


39

A3/A8

K1/Kc Rand(From MSC)

SRES

A3/A8

K1/Kc

SRES

MS MSC

Compare

Authentication & Encryption

Authentication/Encryption


40

GSM 900GSM 900

890 900 910 920 930 940930 950 960 Freq

45 MHz

Uplink ( Mobile to Base )

Downlink ( Base to Mobile )

25MHz/200KHz=124 channels 124 channels

25 MHz


41

GSM Frequency RangeGSM Frequency Range

• 890 - 915 MHz Uplink / MS Transmit

• 935 - 960 MHz Downlink / MS Receive


42

880 900 910 920 930 940930 950 960 Freq

45 MHz



174 channels 174 channels

890

35 MHz10 MHz

EGSM 900EGSM 900


43

GSM1800GSM1800

1710 1735 1760 1785 1800 1825 1850 1875 Freq

95 MHz



374 channels 374 channels


44

Channel Numbering

• In 900 MHz band: 890-915 MHz Uplink band, 935-960 MHz Downlink

Radio carrier is a 200kHz channel=> 125 pairs of radio channels

Called Absolute Radio Frequency Channel Number (ARFCN)

ARFCN numbers given by f(n) = 890 +.2n MHz for Uplink band n = 0,…124

Corresponding downlink is f(n) + 45 MHzChannels and ARFCN slightly different in other frequency

bands


45

Channel Numbering

• In EGMS 900 : 880-915 MHz Uplink band, 925-960 MHz Downlink

=> 174 pairs of radio channels ARFCN numbers: 974-1023

f(n) = 890 +.2(n –1024) MHz for Uplink n =975,…1023

Corresponding downlink is f(n) + 45 MHz


46

Channel Numbering

• In GMS 1800 : 1710-1785 MHz Uplink band, 1805-1880 MHz Downlink

=> 374 pairs of radio channels ARFCN numbers: 512-885

f(n) = 1710 +.2(n –511) MHz for Uplink n =512,…885

Corresponding downlink is f(n) + 95 MHz For GSM 1900: Same but shifted 100MHz


47

Cell Planning• Reusing frequencies

in different geographic areas:– 7 cell repeat pattern

is typical, but other patterns are also common

A3 A1A2

G3 G1G2 C3 C1

C2

B3 B1B2

F3 F1F2

D3 D1D2

E3 E1E2

G3 G1G2

F3 F1F2

C3 C1C2

A3 A1A2

B3 B1B2

E3 E1E2

D3 D1D2

7-cell reusepattern

Frequencyreuse


48

Cell Patterns

1

323

27

16

45

K=3K=7


49

Cell Patterns

4

15

63

7 27

16

45

K=7

Distance=2.5-3 Times Cell DiameterMaximum cell diameter 35Km


50

Cell Types

Micro Cell

Cell

A

B

C

Selective Cell

Umbrella Cell


51

TDMA Frame Structure TDMA Frame Structure


52

GSM - TDMA/FDMA


53

Time Division Multiple Access (TDMA)Time Division Multiple Access (TDMA)

5 6 7 0 1 2 3 4 5 6 7 0 1 3 42

0.577ms

4.6ms

MS Only transmits at its own timeslot Speed 9.6Kb/s

ON ON


54

Power

GSM 900 GSM 1800MS 2W(33dBm) 0.8W(29dBm)BTS 40W(47dBm) 20W(43dBm)


55

Power Time TemplatePower Time Template

542.8 us / 147 Bits

10 8 1010 8 10Time

Power

-70

0

dB

Upper Limit

Lower Limit

Actual

us

Normal Burst

Bit rate= 270Kb/s

5dBm30dBm

Power= 0. 1mW1W


56

GSM Physical Channels

::

Frequency 124

Frequency 2

Frequency 1 Ch 1

Timeslot 1

Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8

::

2 3 4 5 6 7 8

TDMA frame = 4.615 ms


57

Uplink & DownlinkUplink & Downlink

Downlink / MS Receive

5 6 7 0 1 2 3 4 5 6 7 0 1 3 42

0 6 7 0 1 2 3 4 5 6 71 3 42

Uplink / MS Transmit

5


58

GSM: FDD Channels

Uplink and Downlink channels have a 3 slot offset – so that

MS doesn’t have to transmit and receive simultaneously

MS can also take measurements during this offset time and delay

between next frame


59

Frequency HoppingFrequency Hopping

MOD

Coupler

Switch

Synth

Register

ControlUplink

BS 1 BS 2MonitoringRX LevRX Qual

Downlink 1

65

124

1

65

124

Home BS


60

Registration in the Network

• Channel Request• Channel Activation• Channel Activation Ack• Channel Assignment• Location Update Req• Authentication request• Authent Response• Comparison• Assign Area&TMSI• Ack of new Area &TMSI• Entry into VLR-HR• Channel Release

Action MS BTS BSC GMS VLR HLR


61

Mobile Originated Call Establishment

• Channel Request• Channel Assignment

• Call Est. Request• Authentication Req.• Auth. Response• Ciphering Command• Ciphering complete• Setup message,indicating the number• Call proceeding,Net routes call to numb.• Assignment of the traffic channel• Assignment complete

•MS BTS Action


62

Mobile Originated Call Establishment

• Alerting,the called number-ringing• Connect, the called party accepted the call• Connect Ack., both can talk• Exchange of speech data

•MS BTS Action


63

GSM operation from speech Input to Output


64

GSM Speech Coding

4 KHz

300Hz-3.4KHz


65

• Regular pulse excited - long term prediction (RPE-LRP)

• speech encoder (RELP speech coder)

LPC: linear prediction coding filter : Vocal Model

LTP: long term prediction – pitch + input: Excitation

RPE: Residual Prediction Error: Additional tuning


66

Speech Generation

LPC: linear prediction coding filter : Vocal Model

LTP: long term prediction – pitch + input: Excitation

RPE: Residual Prediction Error: Additional tuning

FilterLPC

Excitation:LTP Periodic+RPE: tuning

Speech


67

Error protection for speech signals in GSM


68

Convolution code

+ +

+++

input


69

Interleaving Format


70

Enhanced Full Rate Voice Channel Coding


71

Structure of normal BurstTail: 3 bits *2 guard time (bits to 0). It covers the period of uncertainty during the ramping up & down of the power burst from mobile

Coded Data: 57 bits*2

Stealing flag: indication to receiver if burst carries signaling or data

Training sequence: Receivers synchronization with burst (multipath fading)

Guard Period: time


72

Multipath

Mobile

BTS


73

Modulation


74

Example of MSK


75

S(t) = d(t) cos (t/2T) cos 2ft + d(t) sin (t/2T) sin 2ft.

GMSKGMSK ModulationModulation


76

GMSK ModulationGMSK Modulation


77

GSM Radio Interface Um Bursts


78

ZürcherHochschuleGSM Radio Interface UmTypes of BurstStructure of Normal Burst• 2 x 3 Tail Bits (TB)• 2 x 1 Stealing Flag (Switch between Traffic / Control Payload)• 2 x 57 Payload Bits• 26 Bits Training Sequence :Fixed bit sequence used for channel

estimation allowing optimum channel equalization Five Different Types of Burst• Normal Burst - Traffic and Control Payload• Frequency Correction Burst - All Zeroes Sequence:sine wave(mobile

synchronize with the system), send it by the network to Ms during fixed interval. It allows to synch the MS clock with System clock

• Synchronization Burst - Special Fixed Sequence: Allows Ms to synchronize with the base station.

• Random Access Burst - Extended Guard Period of 68.25 Bits (252 s):MS transmit it at random times & only when MS has to access to the network


79

Burst Types


80

GSM Logical Channel Structure

CCH

TCH/F(13Kb/s)

TCH/H

BCH CCCH DCCH

FCCH SCH BCCH PCH AGCH RACH

TCH

ACCH SDCCH

FACCHSACCH


81

Logical Channels


82

GSM Logical Channels

• 2 groups of logical channels, TCH, CCH and CBCH

• TCH is used to carry voice or data traffic• CCH is used for control functions


83

GSM Logical Channels, cont..

• TCH:Traffic channels = full rate (TCH/F) at 13 kb/s

or half rate (TCH/H) at 6.5 kb/s


84

GSM Logical Channels, cont..

• CCH consists of 3 groups of logical control channels, BCH, CCCH and DCCH

• BCH (broadcast channel): point-to-multipoint downlink only. Contains three sub-channels, BCCH, FCCH and SCH– BCCH (broadcast control channel): send cell

identities, organization info about common control channels, cell service available, etc


85

GSM Logical Channels

– FCCH (frequency correction channel): send a frequency correction data burst containing all zeros to effect a constant frequency shift of RF carrier

– SCH (synchronization channel): send TDMA frame number and base station identity code to synchronize MSs


86

GSM Logical Channels, cont…

• CCCH (common control channel): Consists of three sub-channels, PCH, AGCH and RACH. This channels is used for paging and access – PCH (paging channel): to page MSs– AGCH (access grant channel): to assign

MSs to stand-alone dedicated control channels for initial assignment

– RACH (random access channel): for MS to send requests for dedicated connections


87


• DCCH (dedicated control channel): bi-directional point-to-point -- main signaling channels. Consist of two sub-channels, SDCCH and ACCH– SDCCH (stand-alone dedicated control

channel): for service request, subscriber authentication, equipment validation, assignment to a traffic channel


88


– SACCH consist of two sub-channels, SACCH and FACCH• SACCH (slow associated control channel):

for out-of-band signaling associated with a traffic channel, eg, signal strength measurements

• FACCH (fast associated control channel): for signaling on a traffic channel, eg, for handoff messages


89

MS Camp on Flow ChartMS Camp on Flow Chart

MS Turn On

MS searches channelsand orders by signalstrength

MSStrongest

BCCH

FCCH on BCCH and adjusts timebase

SCH on BCCH and fine tunes timebase & timing

Decode BCCH & store info

Is BCCHin PLMN ?

MSNext Strongest

BCCH

YES

NO

YES

NO

NO

Location =Previous Location?

YES

YES

MS camped on - listens for page, can request service

Using SACCH - adjust power, TA & report RX Qualetc

MS goes to the assigned SDCCH ( Freq., timeslot, ... )for authentication + location Update

MS sendsRACH

BS assigns SDCCH to MS using the CCCH

MS = Mobile StationBCCH = Broadcast Control ChannelFCCH = Frequency Correction ChannelSCH = Synchronization ChannelPLMN = Public Land Mobile Network

SDCCH = Stand Alone dedicated Control ChannelSACCH = Slow Associated Control ChannelCCCH = Common Control ChannelRACH = Random Access Channel


90

GSM Signaling / Traffic ChannelsGSM Signaling / Traffic Channels

SIGNALING TRAFFICBASE STATION

SIGNALING TRAFFIC

BCCH CCCH DCCH TCH

FCCH SCH PCH RACH AGCH SDCCH SACCH FACCH

MOBILE STATION

Network Ident.LAIBA listSystem parameters

MS searchesfor the strongestBCCH and locksonto it

MS adjusts its frequency

MS in idle mode listens to the CCCH

MS Sync. tothe network

MS receivespaging requests

MS sendsAccess requests

messages

BS sends Access GrantedMessage

Main SignallingChannel duringa period of TCH

MS measure-ment results

Fast SignallingChannel

Signalling afterAccess to network Granted

Speech / Data

BCCH = Broadcast Control Channel CCCH = Common Control Channel DCCH = Dedicated Control Channel TCH = Trafic Channel

FCCH = Frequency Correction ChannelSCH = Synchronization Channel

PCH = Paging ChannelRACH = Random Access ChannelAGCH = Access Grant Channel

SDCCH = Stand Alone Dedicated Control ChannelSACCH = Slow Associated Control ChannelFACCH = Fast Associated Control Channel


91

Originated CallOriginated Call

BS pages MS usingthe CCCH MS sends RACH

BS ORIGINATED CALL

MS ORIGINATED CALL

MS responds withRACH

BS assigns MS to SDCCH

or TCH

MS transmits and receives speech on TCH

TCH

Using the FACCH onTCH authentication &location update

Using the SDCCH, authentication,call setup, and TCH assignment

Using the SACCH, BS commands MS to adjust power + timing, MS

reports power + Rx quality of BCCH + adjacent BCCH

MS transmits + receives speechon TCH

Using the SACCH on TCH, MSreports power + Rx quality , BScommands MS to adjust power ,TA

During inactive timeslots, MS measures adjacent cells, BCCH

Call disconnected by MS or BS


92

Call Operation Types

Registration

Upon powering up, the MS scans common control channels and locks onto channel with strongest signal- Searches for FCCH on RF carrier, finds SCH to synch up

After synchronization the MS decodes BCCH – decides whether to update location register or not.

Once registered or locked on to BCCH

Mobile Originating (MO) Call

Mobile types in number presses Send

Mobile Terminating (MT) Call

Mobile registered and phone On – received incoming call

GSM Call Management


93

GSM Registration


94

GSM Registration


95

MTC/MOC general behavior


96

GSM MOC Calling from MS


97

GSM MTC Calling to MS


98

GSM MTC Calling to MS (cont)


99

Call Setup (MS terminating)


100

Dedicated Control ChannelsDedicated Control Channels are bidirectional point-to-pointchannels, that allow authentication, signaling, handover and the exchange of measurement values:

• Stand Alone Dedicated Control Channel (SDCCH) used for call setup (authentication, signaling, assignment of actual TCH), localization updates

• Slow Associated Control Channel (SACCH):is always coupled with a SDCCH or TCH and is used for the exchange of measurement values and control parameters Downlink : Control of MS Power Level and MS Timing Advance Uplink : Measurement reports (MS reception levels) used by the BTS for its handover-decisions

• Fast Associated Control Channel (FACCH): is activated in case of increased signaling demand e.g. during handover.


101

Broadcast Channels

BCH: Broadcast Channels are used for synchronization purposes and broadcasting of cell-specific information in the downlink from BTS to MS

• Broadcast Control Channel (BCCH): broadcasts general information on

the BTS as well as cell specific information like cell identification, Services…

• Synchronization Channel (SCH): carries information for frame synchronization of the MS (e.g.TDMA frame number FN) and for identification of the BTS (e.g Base Station Identity Code BSIC)

• Frequency Correction Channel (FCCH): carries information for frequency correction of the MS

•


102

Mapping of Logical onto Physical Channels


103

Common Control Channels• CCH:Common Control Channels are point-to-multipoint

channels used mainly for access control:

• Paging Channel (PCH) - downlink onlyused by the BTS for paging and localizing the MS

• Random Access Channel (RACH) - uplink onlyused by any MS to request allocation of a signaling

channel

• Access Grant Channel (AGCH) - downlink onlyused to allocate a SDCCH or directly a TCH


104

GSM Radio Interface UmMapping of Traffic Channels (TCH)


105

Traffic Channels (TCH)

newgsm zarka

Documents