Mobile Communications

Chapter 4: Wireless
Telecommunication Systems
Market
GSM

Overview
Services
Sub-systems
Components

GPRS
DECT
Not a part if this course!
TETRA Not a part if this course!
w-cdma (rel 99), IMT2000

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.1

It all started like this

The first car mounted radio telephone 1921

1946 First commercial mobile radio-telephone service by Bell and AT&T

in Saint Louis, USA. Half duplex
1973 First handheld cellular phone
Motorola.
1978 First cellular net in Bahrein
1979 NMT at 450MHz (Scandinavian countries)
1992 Start of GSM
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.2

Basic Definitions

Forward Link, Downlink, Downstream

The path from the network or base station to the mobile
GSM terminology uses Downlink
CDMA, AMPS and TDMA use Forward Link
Most wireline technologies use Downstream

Reverse Link, Uplink, Upstream

The path from the mobile to the network or base station
GSM terminology uses Uplink

CDMA, AMPS and TDMA use Reverse Link

Most wireline technologies use Upstream

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.3

Duplex Techniques
Frequency Division Duplex (FDD), Time Division Duplex (TDD)

time

Reverse Link

GSM
UMTS
FDD

Forward Link

Reverse Link
time

Forward Link

TDD
Reverse Link
Forward Link

Frequency channels

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.4

GSM

1982 The GSM group was formed

1986 Field trials in France
1987 TDMA was chosen as access method
1988 Memorandum of understanding -18 countries
1991 Phase I specifications published
1990 GSM specifications ported to DCS 1800
1992 Official commercial launch of GSM in Europe
1995 GSM specifications ported to PCS 1900
2000 Responsibility for GSM Standard transferred to 3GPP (3rd
Generation Partnership Project)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.5

GSM frequency bands

900 MHz

2*25 MHz Bands

45 MHz Duplex Spacing

890-915 MHz Uplink

125 carriers

935-960 MHz Downlink

1800 MHz

2*75 MHz Bands

1710-1785 MHz Uplink

95 MHz Duplex Spacing

1805-1880 MHz Downlink

375 carriers
1900 MHz

2*60 MHz Bands

80 MHz Duplex Spacing

1850-1910 MHz Uplink

1930-1990 MHz Downlink

300 carriers
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.6

North America

SYSTEM ARCHITECTURE
GSM is a PLMN (Public Land Mobile Network)
AUC

PSTN

EIR

GMSC

HLR

ISDN
MSC

VLR

MSC

VLR

PLMN
BSC

BSC
OMC

BTS

BTS

MS
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

AUC:
OMC:
BTS:
BSC:
EIR:
GMSC:
HLR:
MS:
MSC:
VLR:

MC SS02

AUthentication Center
Operation and Managing Center
Base Tranciver Staition
Base Station Controller
Equipment Identity Register
Gateway MSC
Home Location Register
Mobile Station
Mobile Switching Center
Visiting Location Register

4.7

GSM: elements and interfaces

The Radio Station Subsystem (RSS) The Wireless Part
radio cell
MS

Base Transceiver Station (BTS),

cell coverage, comprises radio specific
functions

MS

Um

radio cell
MS

BTS

RSS

Base Station Controller (BSC)

controls several BTSs, the switching
center for radio channels

BTS
Abis
BSC

BSC

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF
O
OSS

EIR

AUC

OMC

ISDN, PSTN

PDN

Functions
Management of radio channels
Frequency hopping (FH)
Management of terrestrial channels
Mapping of terrestrial onto radio channels
Channel coding and decoding
Rate adaptation
Encryption and decryption
Paging
Uplink signal measurements
Traffic measurement
Authentication
Location registry, location update
Handover management

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.8

BTS
X

X
X
X
X
X

BSC
X
X
X
X

X
X
X
X
X
X

GSM: elements and interfaces

radio cell
MS

BSS

MS

Um

radio cell
MS

BTS

RSS

BTS

Network Switching SubSystem

Abis
BSC

BSC

NSS is the main component of the public

mobile network GSM

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF

ISDN, PSTN

switching, mobility management,

interconnection to other networks,
system control

PDN

O
OSS

EIR

AUC

OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.9

GSM: elements and interfaces

The Network Switching Subsystem (NSS) radio cell
MS

BSS

MS

Um

The Mobile Switching Centre (MSC) manages a

large number of BSCs

radio cell
MS

BTS

RSS

Gateway Mobile Switching Centre (GMSC) is

the gateway to other networks
BTS

Various Registers (data bases)

Abis
BSC

BSC

Signalling messages and data base accesses

are transported by the Signalling System Nr. 7
(SS7) using the Mobile Application Part (MAP)

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF

ISDN, PSTN

PDN

O
OSS

EIR

AUC

OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.10

GSM: elements and interfaces

The MSC plays a central role in GSM
controls all connections via a separated network to/from a
mobile terminal within the domain of the MSC - several BSC
can belong to a MSC

radio cell
MS

BSS

MS

Um

radio cell
MS

BTS

RSS

switching functions
additional functions for mobility support
management of network resources
interworking functions via Gateway MSC (GMSC)
integration of several databases

BTS
Abis
BSC

BSC

A
MSC
NSS

VLR

signaling

VLR
GMSC

HLR

IWF
O
OSS

EIR

AUC

Functions of a MSC

MSC

OMC

ISDN, PSTN

PDN

specific functions for paging and call forwarding

mobility specific signaling
location registration and forwarding of location information
support of short message service (SMS)
generation and forwarding of accounting and billing
information

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.11

GSM: elements and interfaces

Home Location Register (HLR)
Central master database containing user data,
permanent and semi-permanent data of all
subscribers assigned to the HLR

radio cell
MS

BSS

MS

Um

* usually one HLR per provider

* primarilly a data base for subscriber data.
* Subscriber identifiers service profiles, etc.
* Localization information (current VLR, MSC)
* Is a platform for all kinds of services

radio cell
MS

BTS

RSS

BTS
Abis
BSC

BSC

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF
O
OSS

EIR

AUC

Visitor Location Register (VLR)

local database for a subset of user data, including
data about all user currently in the domain of the
VLR

ISDN, PSTN

PDN

* usually one VLR per MSC

* stores all relevant data of visiting MS

OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.12

GSM: elements and interfaces

radio cell
MS

BSS

MS

Um

The OSS (Operation Subsystem) enables

centralized operation, management, and
maintenance of all GSM subsystems

radio cell
MS

BTS

RSS

Components
BTS

Authentication Center (AUC)

Abis
BSC

Equipment Identity Register (EIR)

BSC

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF

Operation and Maintenance Center (OMC)

different control capabilities for the radio
subsystem and the network subsystem

ISDN, PSTN

PDN

O
OSS

EIR

AUC

OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.13

GSM: elements and interfaces

Equipment Identification Register (EIR)
registers GSM mobile stations and user rights
stolen or malfunctioning mobile stations can be
locked and sometimes even localized

radio cell
MS

BSS

MS

Um

radio cell

stores serial numbers (IMEI) of MS equipment

(models, software versions, black list)

MS

BTS

RSS

BTS
Abis
BSC

BSC

A
MSC
NSS

MSC

VLR

signaling

VLR
GMSC

HLR

IWF

Authentication Centre (AUC)

generates user specific authentication parameters
on request of a VLR authentication parameters
used for authentication of mobile terminals and
encryption of user data on the air interface within
the GSM system

ISDN, PSTN

PDN

* stores cryptographic data (keys)

O
OSS

EIR

AUC

OMC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.14

GSM: Mobile Services

GSM offers

several types of connections

voice connections, data connections, short message service

multi-service options (combination of basic services)

Three service domains

Bearer Services: to transfer data between access points

Telematic Services: mobile telephony, SMS, MMS
Supplementary Services: conferencing, suppression of number forwarding,
etc.
bearer services
MS
TE

MT
R, S

GSM-PLMN
Um

transit
network
(PSTN, ISDN)

source/
destination
network

TE
(U, S, R)

tele services

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.15

Bearer Services

Bearer services to transfer data between access points

Specification of services up to the terminal interface (OSI layers 1-3)
Different data rates for voice and data (original standard)

data service (circuit switched)

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 1200 bit/s

data service (packet switched)

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 9600 bit/s

Today: data rates of approx. 50 kbit/s possible will be covered later!

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.16

Tele Services I

Telecommunication services that enable voice communication

via mobile phones
All these basic services have to obey cellular functions, security
measurements etc.
Offered services

mobile telephony
primary goal of GSM was to enable mobile telephony offering the
traditional bandwidth of 3.1 kHz
Emergency number
common number throughout Europe (112); mandatory for all
service providers; free of charge; connection with the highest
priority (preemption of other connections possible)
Multinumbering
several ISDN phone numbers per user possible

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.17

Tele Services II
Additional services

Non-Voice-Teleservices

group 3 fax
voice mailbox (implemented in the fixed network supporting the mobile
terminals)
electronic mail (MHS, Message Handling System, implemented in the fixed
network)
...

Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the
signaling channel, thus allowing simultaneous use of basic services and
SMS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.18

Supplementary services

Services in addition to the basic services, cannot be offered

stand-alone
Similar to ISDN services besides lower bandwidth due to the
radio link
May differ between different service providers, countries and
protocol versions
Important services

identification: forwarding of caller number

suppression of number forwarding
automatic call-back
conferencing with up to 7 participants
locking of the mobile terminal (incoming or outgoing calls)
...

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.19

GSM Mobile Communications

The GSM 900 MHz Frequency Band

*)
25 MHz

P-GSM

10

E-GSM
R-GSM
860

870

25 MHz
10

4
880

4
890

900

910

920

930

Uplink
*) several other Systems:

940

950

Downlink
Duplex Distance 45 MHz

- Cordless Telephone CT1, CT1+, CT2

- Telemetry / Telecommand
- Terrestrial Trunked Radio (TETRA)
- Digital Satellite System Receiver (DSSR)
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.20

960

970

GSM Mobile Communications

The GSM 1800, DECT and UMTS Bands
1: Time Division Duplex (TDD)
2: Frequency Division Duplex (FDD)
3: Mobile Satellite System (MSS)

DECT

3 1

UMTS

GSM 1800
75 MHz
1700

1750

Uplink

75 MHz
1800

1850

1900

1950

200

2050

2100

2150

Downlink
Duplex Distance
95 MHz

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.21

2200

2250

GSM Mobile Communications

Spatial Frequency Re-use in Cell Clusters
5
6
4
1
5
12
5
7
6
4
3
K=7
6
4
2
1
11
1
8
7
10
3
9
7
5
3
5
2
5
2
6
4
5
6
4
6
4
1
12
6
4
1
12
1
7
3
1
7
3
7
3
2
11
7
2
3
11
2
8
10
2
8
10
9
9
5
R cell radius
6
4
1
1
1
12
K cluster size
3
3
7
3
2
2
D repeating
2
11
D
1
1
distance
8
10
3
3
K = 12
9
K=3 2
D R 3K
2
R

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.22

GSM: cellular network

segmentation of the area into cells
possible radio coverage of the cell

cell

idealized shape of the cell

use of several carrier frequencies

not the same frequency in adjacent cells
cell sizes vary from some 100 m up to 35 km depending on user
density, geography, transceiver power etc.
hexagonal shape of cells is idealized (cells overlap, shapes depend on
geography)
if a mobile user changes cells
handover of the connection to the neighbor cell

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.23

MACRO, MICRO AND PICO CELLS

By using small macro

cells in combination with
Tighter Frequency Reuse
and a micro cellular
overlay, the capacity of a
standard 4/12 reuse
cellular network with 7.5
MHz available spectrum
can be increased eightfold. The micro cellular
network operates in a
segmented frequency and
from the nearby macro
cells and provides the
additional benefit of
coverage redundancy.

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.24

GSM Mobile Communications

Combined FDMA / TDMA Scheme
f

fU

Guard Band

fN

...

...

fk

f2

...

...

...

...

Frame

Frequency
Band

Time Slots

...
B = 200 kHz

f1

Radio
Frequency
Channels

...

Guard Band

T 577 s

fL

0
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

...

t
MC SS02

4.25

TDMA: FRAME

4.613 ms

156.25 bit/s
0.579 ms

A slot lasts for a duration of 156.25 bit times

The slot lasts 15/26 ms=579.9 micro s
so a frame takes 4.613 ms
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.26

GSM Radio Interface Um

Bursts
Tail Bits:

Power p(t)

Set to zero
Can be used to
Enhance the receiver
t performance

useful part
f2
f1

0 1 2 ... 7 0 1 ...
0 1 2 ... 7 0 1 ...

3 Tail Bits

156.25 Bits in 576.923 s

(3.6923 s/Bit)

26 Training Bits

3 Tail Bits

2 x 58 Encrypted Bits
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

8.25 Bits Guard Period

4.27

GSM Radio Interface Um

Types of Burst
Structure of Normal Burst

2 x 3 Tail Bits (TB)

2 x 58 Encrypted Bits (Payload for Traffic and Control Channels)

2 x 1 Stealing Flag (Switch between Traffic / Control Payload)

2 x 57 Payload Bits

26 Bits Training Sequence (Midamble)

Fixed bit sequence used for channel estimation allowing optimum channel
equalization

Five Different Types of Burst

Normal Burst - Traffic and Control Payload

Frequency Correction Burst - All Zeroes Sequence
Synchronization Burst - Special Fixed Sequence
Access Burst - Extended Guard Period of 68.25 Bits (252 s)
Dummy Burst

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.28

GSM Radio Interface Um

Adaptive Frame Alignment
BTS
0 1 2 3 4 5 6 7 TX

MS

t = s / c

0 1 2 3 4 5 6 7 RX

0 1 2 3 4 5 6 7 TX

0 1 2 3 4 5 6 7 RX
0

TA = 2t

Thanks to the time shift of 3 time slots between the BTS TX and RX
TDMA frames, the MS is not required to receive and transmit
simultaneously. This simplifies the MS hardware.
The MS continuously aligns its TX frame start based on the Timing
Advance (TA) measurements received from the BTS
The extended guard period of the access burst (252 s) allows a
maximum range between MS and BTS of 35 km.

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.29

GSM Radio Interface Um

Logical Channels
Control
Channels
(CCH)
Broadcast
Channels

Common
Control
Channels

Traffic
Channels
(TCH)
Dedicated
Control
Channels

Full Rate
(TCH/F)

Half Rate
(TCH/H)

Slow Associated Control Channel (SACCH)

Fast Associated Control Channel (FACCH)
Stand Alone Dedicated Control Channel (SDCCH)
Random Access Channel (RACH)
Access Grant Channel (AGCH)
Paging Channel (PCH)
Notification Channel (PCH)
Downlink (DL)
Synchronization Channel (SCH)
Frequency Control Channel (FCCH)
Broadcast Control Channel (BCCH)
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

Uplink (UL)

MC SS02

4.30

GSM Radio Interface Um

Broadcast Channels
Broadcast Channels are used for
synchronisation purposes and
broadcasting of cell-specific
information in the downlink from
BTS to MS

Control
Channels
(CCH)

Broadcast
Channels

Common
Control
Channels

Frequency Correction Channel (FCCH)

carries information for frequency correction of the MS
Synchronization Channel (SCH)
carries information for frame synchronization of the MS (e.g.
TDMA frame number FN) and for identification of the BTS (e.g
Base Station Identity Code BSIC)
Broadcast Control Channel (BCCH)
broadcasts general information on the BTS as well as cellspecific information like control channel organisation, frequency
hopping sequences, cell identification, etc.
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.31

Dedicated
Control
Channels

GSM Radio Interface Um

Common Control Channels
Common Control Channels
are point-to-multipoint
channels used mainly for
access control

Control
Channels
(CCH)

Broadcast
Channels

Common
Control
Channels

Paging Channel (PCH) - downlink only

used by the BTS for paging and localizing the MS
Random Access Channel (RACH) - uplink only
used by any MS to request allocation of a signalling channel
(SDCCH). A slotted Aloha protocol is used, so collisions among
concurring MS are quite possible.
Access Grant Channel (AGCH) - downlink only
used to allocate a SDCCH or directly a TCH
Notification Channel (NCH) - downlink only
used to notify MS of voice group and voice broadcast calls (ASCI
feature)
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.32

Dedicated
Control
Channels

GSM Radio Interface Um

Dedicated Control Channels
Dedicated Control Channels are
bidirectional point-to-point
channels, that allow authentication,
signalling, handover and the
exchange of measurement values.

Control
Channels
(CCH)

Broadcast
Channels

Common
Control
Channels

Stand Alone Dedicated Control Channel (SDCCH)

used for call setup (authentication, signalling, assignment
of actual TCH), localisation updates and SMS
Slow Associated Control Channel (SACCH)
is always coupled with a SDCCH or TCH and is used for the
exchange of measurement values and control parameters

Downlink : Control of MS Power Level and MS Timing Advance

Uplink
: Measurement reports (MS reception levels) used
by the BTS for its handover-decisions

Fast Associated Control Channel (FACCH)

is activated in case of increased signalling demand e.g. during
handover. Bandwidth is stolen from associated TCH
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.33

Dedicated
Control
Channels

GSM Radio Interface Um

Traffic Channels (TCH)

Traffic
Channels
(TCH)

Traffic Channels are used for

bidirectional transmission of
circuit switched voice or data.

Full Rate Traffic Channel

Speech @ 13 kbps
Speech @ 12.2 kbps
Data @ 14.4 kbps
Data @ 9.6 kbps
Data @ 4.8 kbps
Data @ 2.4 kbps

Half Rate Traffic Channel

Speech @ 6.5 kbps

Data @ 4.8 kbps
Data @ 2.4 kbps

Full Rate
(TCH/F)

Half Rate
(TCH/H)

(TCH / F)

Speech Codec

(TCH / FS)
(TCH / EFS)
(TCH / F14.4)
(TCH / F9.6)
(TCH / F4.8)
(TCH / F2.4)

Full Rate
Enhanced Full Rate

(TCH / H)

Speech Codec

(TCH / HS)
(TCH / H4.8)
(TCH / H2.4)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

Half Rate

4.34

GSM Radio Interface Um

Call Setup (MS terminating)
MS

Paging Request

Channel Request
Channel Assignment

PCH
RACH

Paging Channel

RACH Random Access Ch.

Authentication / Cipher Mode

Call Confirmation

PCH

AGCH

Paging Response
Setup

BTS

AGCH Access Grant Ch.

SDCCH
SDCCH Stand-alone
Dedicated Control
Channel

Assign Command
Assign Completion
Alert
Connect

FACCH

Connect Acknowledge
Voice or Data

PCH

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

FACCH Fast Associated

Control Channel

TCH
MC SS02

Traffic Channel
4.35

GSM Radio Interface Um

Enhanced Full Rate Voice Channel Coding
160 Samples
RPE-LPC
Codec

260 bits
267 bits
every
20 ms

78

182

Block
Coding
78

sensitive (class I)
insensitive (class II)
3 bit CRC
4 tail bits

182

Convolutional
Coding

456 bits
4 blocks
@ 114 Bits
456 bits spread
over 8 bursts

78

189

189

Interleaving
1

Encryption

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.36

GSM - TDMA/FDMA
935-960 MHz
124 channels (200 kHz)
downlink
890-915 MHz
124 channels (200 kHz)
uplink

higher GSM frame structures

time

GSM TDMA frame

1

8
4.615 ms

GSM time-slot (normal burst)

guard
space

tail

3 bits

user data

S Training S

user data

57 bits

1 26 bits 1

57 bits

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

guard
tail space

MC SS02

546.5 s
577 s
4.37

GSM hierarchy of frames

12 frames

hyperframe
0

...

one frame for

slow signalling
for all the 8 slots
SACCH

2045 2046 2047

superframe
0

...

48

...

49
24

12 frames

50

1 empty frame

25

multiframe
0

...
0

24
2

120 ms

25

...

48

49

50

235.4 ms

frame
0

...

4.615 ms

slot
577 s

burst
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.38

GSM hierarchy of frames

hyperframe
0

2045 2046 2047 3 h 28 min 53.76 s

...

Larger frames
for encryption

superframe
0

...

48

...

49
24

50

6.12 s

25

multiframe
0

...
0

24
2

120 ms

25

...

48

49

50

235.4 ms

frame
0

...

4.615 ms

slot
577 s

burst
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.39

GSM protocol layers for signaling

Um

Abis

MS

BTS

BSC

MSC

CM

CM

MM

MM

RR
RR

BTSM

RR
BTSM

LAPDm

LAPDm

LAPD

LAPD

radio

radio

PCM

PCM

16/64 kbit/s

BSSAP

BSSAP

SS7

SS7

PCM

PCM

64 kbit/s /
2.048 Mbit/s

CM: Call management, MM: Mobility management, RR: Radio Resource management
Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.40

Protocol Architecture of GSM

with signalling protocol intefaces

Interfaces:

Um

Abis

Um is here of main interests

Abis

are intefaces from the fixed network

Um
MS

Layer 3

Abis
BTS

BSC

MSC

CM

CM

MM

MM
BSSAP

RR
RR

Layer 2
Layer 1

BTSM

RR
BTSM

LAPDm

LAPDm

LAPD

LAPD

radio

radio

PCM

PCM

16/64 kbit/s

BSSAP

SS7

SS7

PCM

PCM

64 kbit/s /
2.048 Mbit/s

Layer 1 (physical) : radio

Handles all radio specific functions

creation of bursts 5 different formats

multiplexing of bursts into TDMA frames
synchronisation with the BTS (see next slide)
detection of idle channels
measurements of channel quality at downlink

Um
MS

Abis
BTS

CM

the physical layer at Um uses GMSK modulation

MM

performs enchryption/decryption of data

RR
RR

BTSM

LAPDm

LAPDm

LAPD

radio

radio

PCM

Layer 1: Synchronization:
The distance between the MS and the BTS
An MS 35 km from the BTS has a round trip time (RTT) of 0.23 ms!!!

The BTS sends the current RTT to the MS, which then adjusts its access time!!!
Adjusting the access is controlled by the variable timing advance, where a burst
can be shifted up to 63 bit times ealier => 0.23 ms. (each bit is 3.69 micro
seconds long).
Max 35 km between a BTS and a MS!!
BTS
0 1 2 3 4 5 6 7

TX

t = s / c

0 1 2 3 4 5 6 7
0

MS
0 1 2 3 4 5 6 7

RX

RX

0 1 2 3 4 5 6 7
0

TA = 2t

TX

Layer 1 (physical) : radio

Handles all radio specific functions

Channel coding and error detection/correction!

78

78

182

182

sensitive (class I)
insensitive (class II)
3 bit CRC
4 tail bits

Um
MS

78

189

189

BTS
CM
MM

The physical layer tries to correct errors, but it does

not deliver erroneous data to the higher layers.
The error correction introduses a delay of about 60 ms!

RR
RR

BTSM

LAPDm

LAPDm

LAPD

radio

radio

PCM

Layer 2 (data link) - LAPDm

It is said to be a lightweight LAPD protocol as it does not
handle error correction/detection.
It handles:
segmentation and reassembly of data and
acknowledges/unacknowledged data transfer
re-sequencing of data frames and flow control!

MS

Um
BTS

CM

Layer 3

MM

RR
RR

Layer 2
Layer 1

BTSM

LAPDm

LAPDm

LAPD

radio

radio

PCM

The network layer in GSM comprises several sublayers!

The lowest sublayer is the Radio Resource Management (RR)!

Just a part of it is implemented in the BTS, the remainder in the BSC!

Setup,
maintenence and
release
of radio channels

Um
MS

Abis
BTS

A
BSC

MSC

CM

CM

MM

MM
BSSAP

RR
RR

BTSM

RR
BTSM

LAPDm

LAPDm

LAPD

LAPD

radio

radio

PCM

PCM

16/64 kbit/s

BSSAP

SS7

SS7

PCM

PCM

64 kbit/s /
2.048 Mbit/s

The network layer in GSM comprises several sublayers!

registration
authentification
location update

Mobility Management (MM) contains functions for

It also provides a temporary mobile subscriber identity (TMSI)
that replaces the international mobile subscriber identity (IMSI)
which hides the real identity of an MS user over the air interface.
Um
MS

Abis
BTS

A
BSC

MSC

CM

CM

MM

MM
BSSAP

RR
RR

BTSM

RR
BTSM

LAPDm

LAPDm

LAPD

LAPD

radio

radio

PCM

PCM

16/64 kbit/s

BSSAP

SS7

SS7

PCM

PCM

64 kbit/s /
2.048 Mbit/s

The network layer in GSM comprises several sublayers!

Call Management (CM) contains functions for:
call control (CC): point-to point connection between two terminals
call establishment, call clearing, etc.
short message service (SMS): using control channels SDCCH and SACCH
supplementary services (SS): user identification, forwarding, etc.
Um
MS

Abis
BTS

A
BSC

MSC

CM

CM

MM

MM
BSSAP

RR
RR

BTSM

RR
BTSM

LAPDm

LAPDm

LAPD

LAPD

radio

radio

PCM

PCM

16/64 kbit/s

BSSAP

SS7

SS7

PCM

PCM

64 kbit/s /
2.048 Mbit/s

GSM Mobile Communications

Numbers and Identifiers I
International Mobile Equipment Identifier (IMEI)

Unique serial number assigned by equipment manufacturer

International Mobile Subscriber Identifier (IMSI)

Unique subscriber identification number, stored on SIM-card

Mobile Subscriber ISDN Number (MSISDN)

Actual phone number structured according to ITU-T E.164

Country Code (CC) up to 3 digits

National Destination Code (NDC) 2 to 3 digits
Subscriber Number (SN) with a maximum of 10 digits

Strict separation of subscriber identification (IMSI)

and phone number (MSISDN)
Several MSISDN numbers can be assigned to a single IMSI
(used for service selection)
The mapping between MSISDN and IMSI is not public

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.49

HSCSD: High Speed Circuit Switched Data

Chapter: 4.1.8.1

Read yourselves!

Mobile Terminated Call

1: calling a GSM subscriber
2: forwarding call to GMSC
3: signal call setup to HLR
4, 5: request MSRN (Mobile Station
Roaming Number) from VLR
6: forward responsible
calling
MSC to GMSC
station 1
7: forward call to
current MSC
8, 9: get current status of MS
10, 11: paging of MS
12, 13: MS answers
14, 15: security checks
16, 17: set up connection

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

HLR

3 6
PSTN

GMSC

10

VLR

8 9
14 15

MSC

10 13
16

BSS

BSS

BSS

11

11

11

11 12
17
MS

MC SS02

10

4.51

Mobile Originated Call

1, 2: connection request
3, 4: security check
5-8: check resources (free circuit)
9-10: set up call
VLR

3 4
6
PSTN

5
GMSC

MSC

8
2 9
MS

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

1
10

4.52

BSS

4 types of handover

MS

BTS

MS

MS

MS

BTS

BTS

BTS

BSC

BSC

BSC

MSC

MSC

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.53

Handover decision

receive level
BTSold

receive level
BTSold

HO_MARGIN

MS

MS
BTSold

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

BTSnew

MC SS02

4.54

Handover procedure
MS
BTSold
BSCold
measurement
measurement
report
result

MSC

HO decision
HO required

BSCnew

BTSnew

HO request
resource allocation
ch. activation

HO command

HO command

HO command

HO request ack ch. activation ack

HO access
Link establishment
clear command clear command
clear complete

HO complete

HO complete

clear complete

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.55

Security in GSM
Security services

access control/authentication
user SIM (Subscriber Identity Module): secret PIN (personal
identification number)
SIM network: challenge response method

confidentiality

voice and signaling encrypted on the wireless link (after successful

authentication)

anonymity

temporary identity TMSI

(Temporary Mobile Subscriber Identity)
newly assigned at each new location update (LUP)
encrypted transmission

3 algorithms specified in GSM

secret:
A3 and A8
available via the
Internet
network providers
can use stronger
mechanisms

A3 for authentication (secret, open interface)

A5 for encryption (standardized)
A8 for key generation (secret, open interface)

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.56

GSM - authentication

SIM

mobile network
Ki

RAND

128 bit

AC

RAND

128 bit

RAND

Ki

128 bit

128 bit

A3

A3
SIM

SRES* 32 bit

MSC

SRES* =? SRES

SRES

SRES
32 bit

Ki: individual subscriber authentication key

32 bit

SRES

SRES: signed response

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.57

GSM - key generation and encryption

MS with SIM

mobile network (BTS)

Ki
AC

RAND

128 bit

RAND

128 bit

RAND
128 bit

A8
cipher
key

BSS

Ki
128 bit

SIM

A8

Kc
64 bit

Kc
64 bit
data

SRES
data

encrypted
data

MS

A5

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

A5

MC SS02

4.58

End

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/

MC SS02

4.59