Wireless Communications Engineering

Lecture 9: GSM

Prof. Mingbo Xiao

Nov. 25, 2004

Introduction to GSM Short for Global System for Mobile

Communications Most Popular 2G Cellular System: ¾ of

the mobile users worldwide are GSM subscribers

TDMA system with slow frequency hopping (channel=time slot in a band)

Multiple Access Control

Power

Frequency

Time

FDMA

Frequency

Power Time

FDMA/TDMA

FrequencyCDMA

Power

Time

Frequency Bands / Bandwidth

Uplink 890 – 915 MHz 25 MHz

Downlink 935 – 960 MHz 25 MHz

100 KHz 200 KHz 100 KHz

1 43 1242 …………….

A 200 kHz carrier spacing has been chosen. Excluding 2x100 kHz edges ofthe band, this gives 124 possible carriers for the uplink and downlink. The use of carrier 1 and 124 are optional for operators.

Multiple Access Technique

FDMA/TDMA. The total band is divided into 124x200 kHz bands (FDMA).Each group of 8 users transmit through a 200 kHz band sharingtransmission time (TDMA).

Basic Components of GSM

BTS

MS

Um

BTS

BTSBSC

Base Station Subsystem (BSS)

A-bisA

BTS: Base Transceiver StationBSC: Base Station ControllerHLR: Home Location RegisterVLR: Visited Location RegisterOMC: Operation & Maintenance CentreEIR: Equipment Identity RegisterAUC: Authentication Centre

MobileServicesSwitchingCentre(MSC)

HLREIR VLR OMC

AUC

F

H G

BC

other MSCs

E

PSTN ISDN CSPDN PSPDN

other VLRs

other BSSs

D

1. Mobile Station MS is the physical equipment used by a

GSM subscriber (their ‘mobile handset’). It comprises two parts:

a Subscriber Identity Module (SIM) and the Mobile Equipment (ME).

2. Subscriber Identity Module (SIM) is a smart card which carries all the subscriber specific

information used by an MS. Major functions are to identify the current user of an MS and to take part in security and confidentiality procedures. It also stores recent location data and may also store personal information for the user such as abbreviated dialling codes (telephone directory). Specific functions include:

Permanent storage of a subscriber’s International Mobile Subscriber Identity (IMSI) and Authentication key (Ki)

Semi permanent storage of system information e.g. current Location Area Identity (LAI), encryption key Kc and lists of preferred / forbidden GSM networks

Semi permanent storage of user data, ‘telephone directory’, short messages

Participation in mobility procedures e.g. user authentication, generation of ciphering key, instigation of location updates.

Protected by PIN

3. Mobile Equipment (ME) provides the radio and processing needed to

access the GSM network, plus a man machine interface MMI to enable the user to access services. Specific functions

radio transceiving and signal processing radio related operations: power control; timing advance;

discontinuous transmission (DTX); slow frequency hopping (SFH).

Call handling man-machine interface, display, keypad, speech

transducers. interfaces to external equipment e.g. laptops / palmtops

4. Base Transceiver Station (BTS) provides GSM radio coverage within a cell.

It comprises radio transmitting and receiving equipment (including antennas) and associated signal processing. A ‘sophisticated’ radio modem. Specific functions include:

antennas (with diversity) radio transceiving and signal processing sending TDMA timing advance instructions to MS

implementation of radio related operations: slow frequency hopping (SFH); discontinuous transmission (DTX); ciphering and power control.

5. Base Station Controller (BSC) is a small switch with enhanced processing

capability. It acts as a local concentrator of traffic and provides local switching to effect handoff between a number of BTSs. It manages the radio channel and undertakes control of a variety of radio related procedures ensuring that reliable radio links are maintained. Its responsibilities include:

co-ordination and control of a number of BTSs traffic concentration low level switching operations network management interface to all radio elements

5. Base Station Controller… 2 radio channel management handoff between BTSs within its domain scheduling of paging request passing system information e.g. LAI (Location Area

Identity) to BTSs for onward transmission queuing control of radio related operations: slow frequency

hopping (SFH); discontinuous transmission (DTX); ciphering and power control

service transcoding, changing air interface rates to network rates e.g. converting speech from 13 kbit/s to 64 kbit/s

6. Mobile Switching Centre (MSC) is an ISDN switch with (significantly) enhanced

processing capability. An MSC will parent a number of BSCs. Responsible for call handling of the mobile subscribers within its domain; this includes generating call charging records (for billing). Specific responsibilities of the MSC include:

call control generation of call records supplementary service execution inter BSC and inter MSC handoff

Whilst they are identified as distinct entities within the specifications, the Mobile-services Switching Centre and Visitor Location Register (VLR) are invariably implemented as a single MSC/VLR unit.

7. Visitor Location Register(VLR) is an intelligent database and service control function. It stores (on a temporary basis) the information needed to handle calls set up or received by MSs registered with it and controls certain services (primarily those associated with outgoing calls). This includes their International Mobile Subscriber Identities (IMSI), current Location Area Identities (LAIs) and supplementary service entitlements. Responsibilities of the VLR include:

executing supplementary service programs (outgoing calls barred)

initiating authentication and ciphering initiating paging mapping of various identities (MSISDN, IMSI, TMSI, MSRN) passing location information to HLR

8. Interrogating Node (IN) is the target for calls bound for GSM

users. It is responsible for determining the location of a called subscriber and for routeing calls accordingly. The IN is commonly combined with an MSC forming what is known as a Gateway MSC (GMSC).

9. Home Location Register (HLR) is an intelligent database and service control

function responsible for management of each subscriber’s records and control of certain services (primarily those associated with incoming calls). It carries subscription details for a subscriber and location information enabling the routeing of incoming calls towards the subscriber, i.e. the MSC/VLR currently serving the MS. Responsibilities of the HLR include:

management of service profiles mapping of subscriber identities (MISDN, IMSI) supplementary service control and profile updates execution of supplementary service logic e.g. incoming calls

barred. passing subscription records to VLR

10. Authentication Centre (AuC) is an intelligent database concerned with the

regulation of access to the network ensuring that services can be used only by those who are entitled to do so and that the access is achieved in a secure way.

The principle is that the AuC and the SIM have a unique key for every subscriber (Ki) which is used as the basis for generating a response (SRES) to a random number (RAND) generated by the AuC. Only the true SIM will be able to generate the correct response and thus gain access to the network.

The AuC is generally integrated with the HLR. [Also EIR the Equipment Identity Register - another

database that holds a list of ‘allowed’ equipment identities, i.e. ME numbers: white / grey / black lists]

GSM Interfaces

The component parts of the GSM system interconnect using standard interfaces. These allows an operator to purchase different parts of the system competitively, i.e. from different manufacturers.

The more important interfaces are Um – the air interface A interface – between the BSC and MSC

GSM CharacteristicsModulation GMSKTransmit Frequency Bands Base Stations 935 – 960 MHz Mobile Stations 890 – 915 MHzDuplex Separation 45 MHzRF Carrier Spacing 200 kHzTotal RF Duplex Channels 124Maximum Base Station erp (W) 300Nominal Mobile Station Transmit Powerpeak / average (W)

20 / 2.58 / 1.05 / 0.6252 / 0.25

Cell Radius (km) min / max 0.5 / 35Access MethodTraffic Channels / carrier

TDMA8

Channel Coding rate one half convolutional codewith interleaving and errordetection

Control Channel Structure Common control channel Associated control channel Broadcast control channel

yesfast and slowyes

GSM Processes handoff

brief introduction Paging

Location Area Location Update Location Area Message Sequence as

example Incoming Call Outgoing Call

Handoff Handoff is the means of maintaining a call when a user

moves outside the coverage area of the serving cell. The call must be switched to an alternative cell to provide

service, automatically and without loss of service. handoff is a complex process requiring synchronisation of

events between the mobile station and the network. In particular, there is the need to route the call to the

new cell before handoff can be effected whilst maintaining the old connection until the new connection is known to have succeeded.

handoff is a time critical process requiring action to be taken before the existing radio link degrades to such an extent that the call is lost.

Paging Paging is a process of broadcasting a message which

alerts a specific mobile to take some action, for example if there is an incoming call to be received.

If the system does not know the precise cell in which a mobile is located it must perform paging in a number of cells.

An extreme approach would be to undertake paging throughout the entire coverage area of a cellular system whenever a mobile is to be alerted; however, in anything but the smallest system this would be wasteful of valuable signalling capacity, particularly over the air interface.

The problem is addressed by the use of location areas and location updating.

Location Updating Location updating is used to reduce the area over which

paging must be undertaken in a cellular system. Coverage area is divided up into many location areas. All cells broadcast the identity of the Location Area (LAI). Each time a mobile station observes that it has moved

into a new location area it informs the network by performing a location update; this enables the network to perform paging over a smaller area than would otherwise be necessary.

In the extreme case each cell could be a location area, the system would know very precisely where a mobile was but at the expense of a very high level of location update signalling. As a compromise location areas are generally defined as a group of cells.

Location Area

GSM Network Areas...

Cell

Location Area

MSC / VLR Area

Public Land Mobile Network (PLMN)

GSM Network Areas Public Land Mobile Network

the area served by one operator, e.g. Vodafone / Orange etc.

MSC / VLR Area a group of Location Areas served by one MSC / VLR, i.e.

all the cells connected to that MSC / VLR Location Area

a Group of Cells within one MSC/VLR Area identified by its Location Area Identity (LAI)

Cell identified by its Cell Global Identity number (CGI)

corresponds to the radio coverage are of one base transceiver station

Location Update The MS detects that it has entered a new location area

by comparing the last known LA (stored on the SIM) with the information broadcast by the local cell.

The MS gains access to a radio channel and requests a location update.

If the serving MSC/VLR is unchanged the network can immediately authenticate the MS and note the change of LA.

If the MS has moved MSC/VLR, the MSC/VLR addresses a message to the HLR.

The HLR notes the new location (VLR) and downloads security parameters to allow the network to authenticate the mobile, it also passes on subscription details of the user to the new VLR and informs the old VLR to delete its records.

LA Update Message Sequence MS to NEW MSC (via BSS) – location updating request New MSC to NEW VLR – update location area New VLR to HLR – update location HLR to OLD VLR – cancel location OLD VLR to HLR – cancel location ACK HLR to NEW VLR – insert subscriber data NEW VLR to HLR – insert subscriber data ACK HLR to NEW VLR – update location ACK NEW VLR to NEW MSC – update location area ACK NEW VLR to MS – location updating accept ACK = acknowledge