Introduction to GSM
GSMGSMGSM
1. GSM(European Telecommunications Standard InstituteETSI)GSM
Phase 1Phase 2(digital cellular telecommunications system)Phase 2+
GSM(services)(quality of services and security)(radio frequency utilization)(network)(cost)
(services)GSM(service portability)MSGSMGSMMS
(quality of services and security)GSMGSM
(radio frequency utilization)GSM
(network)CCITT Recommendation E.164(cost)MS
2. GSM2.1 GSM2.2 2.3
NSS (Network and Switch Subsystem)MSC (Mobile Switching Center)BSS (Base Station Subsystem)BSC (Base Station Controller)BTS (Base Transceiver Station)MS (Mobile Station)ME (Mobile Equipment)SIM (Subscriber Identity Module)
GSM Location Area Hierarchy
Coverage
(Operations and Maintenance Centre)BSCMSCGMSCBSCBTSBTSMSBTS MSOMCHLR (Home Location Register)VLR (Visitor Location Register)EIR (Equipment Identity Register) AUC (Authentication Centre)
GSM(MS)(radio interface)(BSS)(BSS)A(A interface)(MSC)(NSS)
2.1 GSMGSM(MS)(SIM)(ME)
(SIM)SIM(customized dialing numbers)(short message)
SIMIMSI (International Mobile Subscriber Identity)TMSI (Temporary Mobile Subscriber Identity)KiKc(updatable by the network)subscriber informationaccess control class
additional GSM service(updatable by the network)LAI (Location Area ID)(updatable by the network)forbidden PLMN ()(updatable by the network)
PIN (Personal Identity Number)PUK (PIN Un-lock Key)BCCH (Broadcast Control Channel) frequency listpreferred PLMN list () (A3,A5,A8)
PIN (Personal Identity Number)SIMPINSIM48**04*PIN*PIN*PIN#
PUK (PIN Un-lock Key)PINPINSIMPUK (PIN Un-lock Key)SIM10PUKSIM**05*PUK*PIN*PIN#
(ME)BSMSSIMME(112)SIM
SIMMEMEGSMGSM MSGSMME(classmark)GSMGSMMS
2.2 (BSS)(MS)(MSC)(BTS)(BSC)
(BTS)BTS(Transmitter)(Receiver) (signal)
TRAU (Transcoder/Rate Adapter Unit)Transcoding (for speech channels)PCM (Pulse Code Modulation)GSM speechRate adaptation (for data channels)TRAUBSCMSCBTSPCM is used to digitally represent sampled analog signals. It is the standard form for digital audio in computers and various Blu-ray, DVD and Compact Disc formats, as well as other uses such as digital telephone systems.
(BSC)(BSS)GSMMSCMS(handoff)(BTS)A-bisISDN
2.3 (NSS)MS(roaming management)MSCA(BSS)MSCPSTN
GSM(Home Location RegisterHLR)(Visitor Location RegisterVLR)(Authentication CenterAuC)(Equipment Identity RegisterEIR)
(HLR)(VLR)MSVLRVLRHLRHLRMS(AuC)HLR
(Gateway MSCGMSC)GMSCHLRGMSCMSMSC
3. GSM3.1 3.2 GSM/3.3 GSM
3.1 GSM(radio link)(Frequency Division Multiple AccessFDMA)(Time Division Multiple Access TDMA)
Frequency MultiplexSeparation of the whole spectrum into smaller frequency bandsA channel gets a certain band of the spectrum for the whole timeAdvantagesno dynamic coordination necessaryworks also for analog signalsDisadvantageswaste of bandwidth if the traffic is distributed unevenlyinflexible
Time MultiplexA channel gets the whole spectrum for a certain amount of timeAdvantagesonly one carrier in the medium at any timethroughput high even for many usersDisadvantagesprecise synchronization necessary
Time and Frequency MultiplexCombination of both methodsA channel gets a certain frequency band for a certain amount of time
Time and Frequency MultiplexExampleGSM Advantagesprotection against frequency selective interferencehigher data ratesDisadvantagesprecise coordination required
GSM combines FDMA and TDMAbandwidth is subdivided into channels of 200KHz, shared by up to eight stations, assigning slots for transmission on demand
(downlink) [BS MS]935-960MHz(uplink) [MS BS] 890-915MHz124200KHz [(960-935)*1024]/124=204KHzGSMTDMA
GSM Uses Paired Radio Channels
3.2 GSM/
GSM(burst)(timeslots)GSM(time frame)4.615ms8 0.577ms (= 0.546ms + 0.031ms)(timeslot)burstguard time
GSM Bursts
Burst Normal burstF burst (Frequency Correction Burst)MS
S burst (Synchronization Burst)MS A burst (Access Burst)A burst
Normal Burst
Normal burst156.25 bits (0.577ms)148 bits (0.546ms)(burst)8.25 bits (0.031ms)(guard time)(tailing)3 bits026 bits(training sequence)()
Data57 bits1 bit(flag)
F Burst (Frequency Correction Burst)F burstFCCH (Frequency Correction Channel)Data1420MSBTS
S Burst (Synchronization Burst)SCH (Synchronization Channel)64 bitstraining sequenceMSS burstMSdemodulationburst (F burstdemodulation)S bursttraining sequenceData(Base Station Identity CodeBSIC)frame numberMSBTSframe structure
A Burst (Access Burst)RACH (Random Access Channel)RACHA burstMSRACHtime slotA burstcollision
MSA burstMSBTSMSBTSA burstBTSA burstBTSA burstMSA burstguard timeBTSA bursttime slotA burstA burst83 bits (=3+41+36+3 bits)time slot (156.25 bits)
GSM (FDMA + TDMA)
Traffic channel frames are transmitted in groups of 26 (26-multiframe), of length 120ms (= 26 8 0.577 ms)
SACCH: Slow Associated Control Channel
GSMFDDuplinkdownlinktimeslotMSdownlinktimeslotuplink burst (MS)traffic channel offset3time slotsMSBS(Timing Advance, TA)(synchronization)
(Timing AdvanceTA)BSMS(round-trip delay)BSMS30kmTA0.2msTA(BSS)MSMSBSTA
round-trip propagation delayMSTA(3 timeslots-TA)BS
GSM Delays Uplink TDMA Frames
3.3 GSM3.3.1 (TCH)3.3.2 (CCH)
CM (Connection Management) call control, short message service and supplementary service MM (Mobility Management) registration, authentication, location and handover management RR (Radio Resource Management) setup, maintenance and release of radio channels control of radio transmission quality
Physical channelBTSMSlogical channels ()Logical channelGSMlogical channels
GSM(Traffic ChannelTCH)(Control ChannelCCH)
3.3.1 (TCH)(Full Rate TCHTCH/F)13Kbps9.64.82.4Kbps(Half Rate TCHTCH/H)6.5Kbps4.82.4Kbps
Sub-Rating Strategy(sub-rating)(full-rate)(half-rate)
3.3.2 (CCH)(Common Control ChannelCCCH) MS(Dedicated Control ChannelDCCH) MS(Broadcast ChannelBCH)
3.3.2.1 (CCCH)(Paging ChannelPCH) (Random Access ChannelRACH)(Access Grant ChannelAGCH)
(Paging ChannelPCH)MSMS(Random Access ChannelRACH)MSBSMSBS(access collisions)GSMSlotted Aloha
NoteAlohaalgorithmif you have data to send, send the dataif the message collides with another transmission, try resending "laterperformancea maximum throughput of about 18.4%, or about 81.6% of the total available bandwidth was essentially wasted due to losses from packet collisions
Note (cont.)
Note (cont.)Slotted Alohaalgorithma station can send only at the beginning of a timeslot, and thus collisions are reducedperformanceintroduces discrete timeslots and increases the maximum throughput to 36.8%
Note (cont.)
(Access Grant ChannelAGCH)BSMSBS
3.3.2.2 (DCCH)(Standalong Dedicated Control ChannelSDCCH)(Slow Associated Control ChannelSACCH)(Fast Associated Control ChannelFACCH)(Cell Broadcast ChannelCBCH)
(Standalong Dedicated Control ChannelSDCCH)(short message)(Slow Associated Control ChannelSACCH)(time alignment)MSBS
(Fast Associated Control ChannelFACCH) (time-critical signaling)
(Cell Broadcast ChannelCBCH)BSMS
3.3.2.3 (BCH)(Frequency Correction ChannelFCCH)(Synchronization ChannelSCH) (Broadcast Control ChannelBCCH)
(Frequency Correction ChannelFCCH) & (Synchronization ChannelSCH)BSMSFCCHMSBTSSCHBase Station Identity Code (BSIC)frame numberMSBTSframe structure
(Broadcast Control ChannelBCCH)MSBSMSBS
Uplink & DownlinkUplink[MSBS](RACH)Downlink[BSMS](FCCH)(SCH)(BCCH)(PCH)(AGCH)
Uplink/Downlink[MSBS](SDCCH)(SACCH)(FACCH)(CBCH)
CBCH
CBCH BTSMS
4. 4.1 GSM4.2 (SS7)4.3 4.4
4.1 GSMGSMMobile Station ISDN Number (MSISDN) []Mobile Station Roaming Number (MSRN) []International Mobile Subscriber Identity (IMSI) []Temporary Mobile Subscriber Identity (TMSI) []Location Area Identity (LAI) []Cell Global Identity (CGI) []International Mobile station Equipment Identity (IMEI) []
MSISDN (Mobile Station ISDN Number)MSISDN()CCITT Recommendation E.164MSISDN=CC+NDC+SN(CC)-(NDC)-(SN) (15)
MSRN (Mobile Station Roaming Number)MSMSCVLRMSRN = CC+NDC+SNMSISNDCall termination procedure
call deliveryHLRGMSCVLRVLR(MSRN)HLRMSRNMSMSCMSCMSRNGMSCMSRNMSCCall termination procedure
IMSI (International Mobile Subscriber Identity)HLR/VLRMSPLMNSIMHLRAUCVLR
MNCnetwork providerPLMN (Public Land Mobile Network)ExMCC=466MNC=01 (=92=97)
TMSI (Temporary Mobile Subscriber Identity)(IMSI)IMSIair interfaceTMSIIMSIMSMSMSC/VLRIMSITMSI
TMSIVLR(assign)MSMSMSC/VLRTMSITMSIMSnew LA(IMSI)registration (location update)MSCpageMSLABSPCH(broadcast)MSTMSI
LAI (Location Area Identity)(Location AreaLA)LAa cella group of cellsMSCLAs
LAIcall terminationMSLALAcellspageMSLAI = Mobile Country Code (3-digit) + Mobile Network Code (2 or 3-digit) + location access code (up to 16-digit)LAI = MCC (3-digit) + MNC (1-2 digits) + LAC (2 digits)Ex466-01-91ROC--
CGI (Cell Global Identity)CGI = LAI + CI = MCC + MNC + LAC + CI(CICell Identity)cellExcellCGI= 466-01-91-1 466-01-91-2
MSGSMMSBSCGILAI CILAMSC/VLRMSregistrationlocation update
IMEI (International Mobile station Equipment Identity)*#06#IMEI(SNR)
TAC (Type Approval Code)GSM componentconformanceinteroperabilityTACFAC (Final Assembly Code )SNR ( )TAC/FAC
IdentifiersComponents
IMSITMSIMSISDNCGILAIMSCMSRNVLRMSHLRHLRMSVLRVLRIMSI
4.2 (SS7) (Common Channel SignalingCCS) (signal)(out-of-band)
NoteIn-band signalingthe sending of metadata and control information in the same band, on the same channel, as used for dataOut-of-band signalingthe exchange of call control information in a separate band of the data or voice channel, or on an entirely separate, dedicated channel (as in Common Channel Signaling)
4.2.1 (CCS)(information transfer)call controlremote controloperationsmanagementadministrationGSM uses SS7 signaling for call control, mobility management, short messages and value-added services
4.2.2
SS7
(Access linkA-link)SSPSCP STPSSPSTPA-link12816(Diagonal linksD-link)(PCNPSTN) STPSTP64D-links
SS7(Service Switching PointSSP) (Signal Transfer PointSTP)(Service Control PointSCP)
(SSP)SSP(trunk)SSP(originating SSP)(terminating SSP)(tandem SSP)
SSPPSTN(Central OfficeCO)(End OfficeEO)PCN(MSC)
(STP)SS7(SSP)(SCP)STPSTP
(SCP)SCPSSPSSPSCP serves as interface to a telephone companys databaseSCP is a computer used as a front-end to a database
Database store information aboutsubscribers servicesrouting of special service numberscalling card validation and fraud protectionadvanced intelligent network features for service creationCommunication between SCP and mainframe/mini-computer that hosts the database is via X.25 links
Typical databases in SS7 networkscall management service database (CMSDB)local number portability (LNP)line information database (LIDB)business service database (BSDB)home location register (HLR)visitors location register (VLR)
Point CodeSS7uniquepoint code (PC)SS7A point code can be 24 bits (North America, China)16 bits (Japan)14 bits (ITU standard, International SS7 network and most countries)3-bit()8-bit/3-bit/
SS7SS7OSI(Layers)MTPSCCPTCAPISUP (ISDN-UP)OMAPMAPTCAP
SS7 Protocol Stack
MTPMessage Transfer Part ()SCCPSignaling Connection Control Part ()NSP Network Service Part ()TCAPTransaction Capabilities Application Part ()ASE Application Service Entities ()
MAPMobile Application Part ()OMAPOperations, Maintenance, and Administration Part ()ISUPIntegrated Service Digital Network User Part ()TUPTelephone User Part ()
ITU-T SS7 Specifications
(Message Transfer PartMTP)MTPOSIMTP Level1 ()signal linkbearercodingtime slot number bit rateframingimpedance bit invert64kbpsdigital line (T1E1)
MTP Level2 ()SS7MTP Level1
error detection and correctionflow controlsignal unit delimitation and alignment ()initial alignment ()
MTP Level3 ()message routingmessage discriminationmessage distributionnetwork management
MTProuting labelOriginating point code (OPC)Destination point code (DPC)Signaling link selection (SLS) [for load sharing among STPs]Point codeSS7uniqueSS7
incoming messageuser (SCCPISUP)MTPservice indicatoridentify the usernetwork indicatordetermine whether national or international signaling
MTP Layer RoutingSS7MTP (Message Transfer Part)SCCP (Signaling Connection Control Part)SSPSTPSCPMTP Level 1-3DPCOPC (Originating Point Code)originatingDPC (Destination Point Code)destination
OPCDPCSLS (Signaling Link Selection)MTP Level 3fieldOPCDPCsource IPdestination IPCIC (Circuit Identification Code)voiceMTPSCCP
(Signaling Connection Control PartSCCP)SCCP provides means for end-to-end routingSCCP uses more extensive addressing than MTPSCCPconnectionlessconnection-orientedSCCP0 basic connectionless (does not guarantee in-sequence delivery)1 in-sequence-delivery connectionless class2 basic connection-oriented class3 flow-control connection-oriented class
SCCP Layer RoutingSCCPaddresscalled party address (PC+SSN+GT)calling party addressPC is a hierarchical address consisting ofcluster membernetwork clusternetwork identifier
SSN (SubSystem Number)identify a particular entity within a nodee.g.,1-800 number service, calling card module, ISUP, etcGT (Global Title)could be dialed digits of a telephone number
SCCPGTT(Global Title TranslationGTT)MTPGTT (Global Title Translation)SCCPfunctionHLR/VLR(SSN)HLR/VLRSS7hoppoint code
SCCPentitySSN numberSSNASE (Application Service Entity)addressSSNHLRSSN0000110SSNSSN: identify a particular entity within a node
800MSC800request messageGTTSTPSTP800 translation servicesSCPrequestSCP
SCP800 xxx xxxx(directory number)SCPSTPSTPMSCSTPMTP Level 1-3SCCPGTT
GTT ExampleVLRVLRHLRVLRrequest messageGTTSTP ASTP AaddressGTT Tablehop (GA)point codeDPCrequestSSP GAaddressGTT Tablehop (GB)point codeDPCrequest
STP C(STP CGTT)SSP GBaddressGTT Tablehop (STP B)point code DPCrequestSTP BaddressGTT Tablehop (SCP B)point codeDPCrequestGTT for SCP B
SSPSSP
(Transaction Capabilities Application PartTCAP)Most typically used as a protocolbetween a switch and a network databasebetween two network databasesAll the applications are transaction-orientedsupport (multiple) requests and responses
TCAP SCCP UNIT DATA MESSAGECLASS 0 or 1TRANSACTION MESSAGESCOMPONENTSREQUEST/RESPONSETCAP
TCAP has two sublayersComponent Sublayer (CSL) responsible forassociating the users request with the responseshandling all abnormalities
CSL operation can be viewed as procedure callsthe CSL messaging unit is called a componentTransaction Sublayer (TSL)manages the message, e.g., identify the type of message, execute the message, etc.
TCAPIS-41MSC(inter-MSC handoff)(automatic roaming)(operations, administration, and maintenance) TCAP TCAP (transaction portion) [TSL](package type) (component portion) [CSL]
IS-41TCAP(Package Type)(QUERY With Permission)TCAP(RESPONSE)TCAP
(CONVERSATION With Permission)(UNIDIRECTIONAL)
SS7
IS-41(Component Type)(INVOKE LAST)SS7(operation)Last(component part)(component)(RETURN RESULT NOT LAST)RETURN
(RETURN RESULT LAST)SS7INVOKERETURN RESULT(RETURN ERROR)INVOKEMIN (Mobile Identification Number)HLR
(REJECT)()SS7REJECT(task)(error recovery)
IS-41TCAP(timeout)IS-41(RETURN ERRORTCAP)
IS-41 ()
(location update)IS-41PCN1 PCN2 PCNMSCVLRSTP
IS-41 TCAP
T1MSC2 RegistrationNotification(INVOKE) VLR2MSC1MSC2VLR2 VLR2VLR2 MSC1
T2MSC1MSC2VLR2VLR2VLR2 RegistrationNotification(INVOKE) HLRVLR2MINHLRTCAP (GTT)HLRSTP3 ((DPC)STP3)STP3 HLR
STP3STP2HLRHLRRegistrationNotification(RETURN RESULT)VLR2VLR2 HLR RegistrationNotification(INVOKE) SCCPVLR2T2 T1
T3HLRRegistrationCancellation(INVOKE) VLR (VLR 1)T4MSC1
T5T2VLR2 QualificationRequest(INVOKE)HLRT6VRL2ServiceProfileRequest(INVOKE)HLR (service profile)
(Integrated Service Digital Network User PartISUP)ISUPa circuit-related protocol used for establishing and maintaining connections throughout a call(call control)call set upconversation (include pure data exchange)call teardown
(value added service)(call forwarding)caller(caller ID)user to user signalcheck call statustrunk management
ISUPthe choice for ISDN network support for call managementcall management is realized through switch-to-switch signaling (call management switch to switch signaling)ISUP is the protocol used for switch-to-switch signaling (switch to switch signaling ISUP protocol)ISUP entity addresses each other with the MTP addressing scheme, augmented by circuit identification, which refers to a specific trunk
ISUP Basic Message CategoriesForward setup ( called party)set up a call with particular characteristics in the direction toward the called partyBackward setup ( calling party)complete the call establishment in the direction from the exchange containing the called party toward the calling partyaccounting and charging procedures belong to this category
General setupcarry additional call-related information needed to set up a callCall supervisionnotifications of events like the call being answered, the circuit being released, or the need for an international operator intervention
Circuit supervisionall kinds of notifications of the events related to circuits allocated for a callCircuit group supervisionrelate to circuit groups rather than individual circuitsused for network management purposesE.g., call blocking on the indicated trunk groups, circuit group status queries, etc.
In-call modificationthe messages in this group support modification of the existing call characteristics (for example, a change from a voice call to a data call) or invoking a particular medium (facility)End-to-endthe messages in this group include user-to-user signaling independent of call control messages
Telephone User Part (TUP)Provides conventional PSTN telephony services across the SS7 networkDefined in ITU-T Recommendations Q.721-725, which define the international telephone call control signaling functions for use over SS7
4.3 GSMHLRVLR
Home Location Register (HLR)An HLR record consists of 3 types of informationmobile station informationIMSI (used by the MS to access the network)MSISDN (the ISDN number Phone Number of the MS)location informationISDN number of the VLR (where the MS resides)ISDN number of the MSC (where the MS resides)service informationservice subscriptionservice restrictionssupplementary services
Visitor Location Register (VLR)The VLR information consists of three partsmobile station informationIMSIMSISDNTMSI
location informationMSC NumberLocation Area ID (LAI)MSRN (VLRMSMSCtrunk)HON (MShandover)service informationa subset of the service Information stored in HLR
MSCVLRMSLALAVLRHLRMSLAMSHLRMSVLR
GSM Location Area Hierarchy
(a) Inter-LA movement(b) Inter-MSC movement(c) Inter-VLR movemnet
NoteMS(idle)(roaming)BSBCCH (Broadcast Control CHannel)CGI (CILAI)BSMSBSchannel
new BSold BSLAIpaging areaMSMSC/VLRnew BSBCH (Broadcast channel)
new BSold BSLAI(location update)(registration)casesInter-LA movementBSs MSCVLRHLR (HLRLAI)
Inter-MSC movementBSs MSCVLR VLRHLRMSInter-VLR movementBSs VLRVLRHLRMS
LA1LA2LA3
MSGSM MSBCCH-carrierYES MSBScellPLMNNO cell
FCCH (Frequency Correction Channel)MSBSSCH (Synchronization Channel)BSIC (Base Station Identity Code)BCCHCGI (Cell Global Identity)MSCGIPLMNcell
Inter-LA
1MSC1MSTMSILA (old LAI)MSCVLR2MSC1LAVLR1MSCTMSILAILAI
3LA1LA2MSC1VLR1VLR1LAIVLR14MSC1
Inter-MSC
12MSC2LAVLR13VLR1LA1LA2VLR1MSLAIMSCIMSIMSHLRVLR1HLR
4HLRIMSI MSC56VLR1LAMSC2MSC2
Inter-VLR
1MSBSBSBCCHLAMS(Temporary Mobile Subscriber IdentityTMSI)VLR (old VLR)VLRTMSIMS(International Mobile Subscriber IdentityIMSI)
2 IMSIVLRVLRTMSIPSTNVLRIMSIMSIMSIPSTNVLR
3 VLRIMSIMSHLRMS HLRHLRMSVLR4VLRTMSI MSMS
5 3HLRVLRMSVLRMS
MSroamingHLRGSM(re-registration)624
periodical registrationGSMVLRHLRre-registrationSIMIMSI detachGSMMSIMSI detachMSC/VLRMSperiodical registrationMSC/VLRMS
4.4 4.4.1 (call origination procedure)4.4.2 (call termination procedure)
4.4.1 (Call Origination Procedure)
4.4.2 (Call Termination Procedure)
5. (Handoff)MSBSBSMSMSBSBS
MSGSMBSBS
Handoff ProcedureMSBSBSBSBSMSC
(radio link measure) (channel quality)(Word Error IndicatorWEI)(Received Signal Strength IndicatorRSSI)(Quality IndicatorQI)
(WEI)WEIMS(demodulate)(current burst)WEIWEIhandoff
(RSSI)RSSI(signal strength)80100 dBRSSIRSSIhandoff
RSSI(distance dependent fading or path loss)occurs when the received signal becomes weaker due to increasing distance between MS and BS(Shadow FadingLog-Normal)occurs when there are physical obstacles (e.g., hills, towers, and buildings) between the BS and the MS, which can decrease the received signal strength
(Multipath Fading) (Rayleigh Fading)occurs when two or more transmission paths exist (due to signal being reflected off buildings or mountains) between the MS and BS
RSSITDMA100500ms
(QI)QI/SIR: Signal to Interference RatioSNR: Signal to Noise RatioSINR: Signal to Interference & Noise RatioQIinterferencenoisedispersion ()
WEIRSSIWEIRSSIhandoffchannel comparisonWEIRSSIQI
TDMA
PACS(frame)2.5ms2562.5ms(handoff)
RSSIQI(filtering)(window averaging) (leaky-bucket integration)
w(w)Sk= Mk + Mk-1 + Mk-(w-1) SkkMkkw-l
Sk = aSk-1 + Mka < 1 (forgetting factor)
GSM Handoff(Intra-BSC handoff)BTSBSC(Inter-BSC handoff)BTSBSCBSCMSC(Inter-MSC handoff)BTSMSC
Handover Decision
(Mobile Controlled HandoffMCHO)(Network Controlled HandoffNCHO)(Mobile Assisted HandoffMAHO)
MCHO
(TDMA)idle time-slotDECT (TDMA/TDD)handoff100ms-500msPACS (TDMA/FDD)handoff20ms-50msMCHO(implement)
ALT: Automatic Link TransferTST: Time Slot Transfer
(downlink)(uplink)(WEI)
()
handoffATL (Automatic Link Transfer)time slotTST (Time Slot Transfer)
block
(MSC) ()
RSSIMSC
(FDMA)CT2+ AMPS
NCHO (signaling)(MSCtraffic)(heavy)NCHO10
NCHOMSCMSCRSSI
GSM
GSM(MSC)GSM1
MAHO(BS)MSCglobal optimizationNCHOMAHOMCHOMSChandoffcellradio linkMSC
(bridge) (HON)
GSM: Mobile-Assisted Handover (MAHO)
6. GSM(authentication)GSM(encryption)MS
(secret key) KiGSMAuCSIMAuC (Home System)128 (random number)RANDAuCRANDMSAuCMSKiRANDA3
A3(SignedResult (or SignedResponse)SRES)MSSRESAuCAuCSRESMS
A3MSAuCA8A8Kc(encryption key)AuCKcMSBSBSTDMA(frame number)MSTDMA2204194303(frame counter)
MSBS(Kc)A5GSMA5
A3AuCSIM
A8(encryption key)KcAuCSIMA5visited system (BSS VLR)(ciphering) (deciphering)
TripletsKiAuCAuCMSVLRAuC(triplet)Triplet3RANDSRESKcHLRRANDSRESKctriplet
VLRRANDMStripletSRESMSSRESVLRKcBTSKc
7. GSM(Functional Plane)GSMGSM
GSM Functional PlaneConnection
GSM Entities and Functional PlaneCM
MM
RR
Transmission
Transmission PlaneTransmission plane includesmodulation, coding, multiplexing, format dataensure proper sequencingcorrect errors through repetitionsroute information through networkTransmission plane includes two independent functionsprovide the means to carry user informationprovide the means to carry signaling messages between entities
Radio Resource Management(Radio Resource managementRR)RRMSMSC(connection)MSRRMSBSCMSC inter-MSC handoverRR
Mobility Management(Mobility ManagementMM)MMHLRAuCSIMMMMMCMMMMM()
Connection Management(Connection ManagementCM)CMCM(Call ControlCC)(Supplementary Service managementSS)(Short Message ServiceSMS)
(CC)HLRMSC/VLRGMSCCC(SS)GSM(SMS)GSM
SummarySMSCMGSM(signal)MMRRSDCCH (Standalong Dedicated Control Channel)GSM MAP (Mobile Application Part)
Radio Resource (RR) ManagementMobility Management(MM)ConnectionManagement (CM)SMS
Operations, Administration & Maintenance(OperationsAdministration & MaintenanceOA&M)OA&MOperation and Support Subsystem (OSS)Base Station Subsystem (BSS)Network and Switching Subsystem (NSS)OA&M
Request for Connection EstablishmentScenario: MSBSSdedicated control channeldedicated control channelchannel assignmentRRevent 1MSidle statelisten to BCCHevent 1 (Establish MM connection)CMsublayer CCCMcallcallemergency call
Establish MM connectionCM service requestRR channel requestRR IMM ASS
event 2 (CM service request)MMRR connectionCM service requestMS IDinformationevent 3 (RR channel request)MSRRBSSMSdedicated control channelRACHBSSBSSRR layer
event 4 (RR IMM ASS)BSSRRMSAGCHMSMSRR layerMS RRMMRR connection
8. 8.1 Short Message Service (SMS)8.2 SMS
8.1 Short Message Service (SMS)(SDCCHSACCH)(store and forward)140(char)SMS concatenationSMSSMS compression
SMSsignal bandwidthdatalow capacity cheaperbest effortnon real-time
8.2 SMStworkGSM networkShort Message SenderOriginal MSTerminating MSBTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS center
SM-SC (Short Message Service Center)store and forwardIWMSC (Interworking MSC)MSshort messageSM-SCSMS GMSCGMSCSMS
Short Message Service Gateway MSC (SMS GMSC)SM-SC MS MSC MSCshort messageMSCbroadcast SMSs to all its BSSsBTSpage the MS
SM-SCSM-SCstore-and-forwardscalableavailablereliableGSM networksGSM networkSMS GMSC
SM-SCSema SM-SCCompaq Alpha ServerEricsson SM-SCSun SPARCNokia SM-SCHP 9000SM-SCTCP/IP (Internet)WAP (Wireless Application Protocol)
Mobile OriginatingBTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS center
LuqTx
Cloud
IBM Compatible
BTS
BSC
BTS
BSC
MSC
BTS
SM-SC
SMS GMSC
IWMSC
GSM network
GSM network
Short Message Sender
Original MS
Terminating MS
MSshort messageMS[Step 1] MSshort messageIWMSC (Inter-working MSC)
[Step 2] short messageSM-SC (Short Message Service Center)SM-SC[Step 3]short message
BTSBase Transceiver Station BSCBase Station Controller MSCMobile Switch Center GMSCGateway MSC IWMSCInterworking MSC SM-SCSMS centerMobile Terminated
SM-SCshort messageMS[Step 1] SM-SCSMS GMSCGSM[Step 2]GMSCMSMSCshort messageMSC
[Step 3] MSCBSSBTSshort messagebroadcast[Step 4] MSsoftware
9. GSM9.1 Data Service9.2 HSCSD9.3 GPRS9.4 EDGE9.5 USSD
GSM(data communications)HSCSD (High-Speed Circuit-Switched Data)GPRS (General Packet Radio Service)EDGE (Enhanced Data Rates for GSM Evolution)
9.1 Data ServiceGSM Phase 2(Short Message Services)(Bearer Services)Bearer servicedata circuit duplex9.6KbpsNotebookPDAPC cardGSM
GSM(circuit-switching connection)GSM Phase 2(packet-switched transmission)
GSM Phase 2+ETSIGSM Phase 2+GSM+(data service)(mobile video)WWW
(High Speed Circuit Switched DataHSCSD)circuit-switching(General Packet Radio ServiceGPRS)packet switchingbursty
9.2 HSCSD8(data compression)
GSMHSCSD(Radio Link ProtocolRLP)(timeslot)(data rate) = number of timeslots data rate of one timeslot
HSCSD
(Terminal EquipmentTE)(Terminal Adaptation FunctionTAF)(InterWorking FunctionIWF)(PSTNPSDNISDN)
9.3 GPRSGSM(transport network)GPRS(Radio Link Protocol)PhysicalMACRLCMSsBSs(fast call setup procedure)(low-bit error rate)
PhysicalGPRSGSM physical channelslogic channelsRLC/MAC(air interface) physicalGPRSchannels100
GPRS
GPRS(GPRS Tunnel ProtocolGTP)GPRSGPRS(SGSN & GGSN)()X.25IP(PDU)GPRS(Quality of ServiceQoS)
9.4 EDGEEDGEEnhanced Data rates for GSM EvolutionGSMTDMA3GGSM GSM GPRS (in GSM+) EDGE (in GSM++) UMTS UMTS/HSDPA()
GSM+HSCSDGPRSGSM++EDGEcoding schemetimeslot
EDGEcore networkcost-efficientmigrationEDGEE-GPRS (packet data service)E-HSCSD (circuit-switched service)WCDMAQoS
9.5 USSDUSSD (Unstructured Supplementary Service Data)GSM(supplementary services)
MSMStext string()MSUSSD(without understand the text)USSD service node (i.e.)text stringEx*128*#MSSMS
MSSS7 signaling (voicedata)messageUSSD service node (USSD gateway)USSDuses all digits 0-9 plus and keystypically 2 or 3 digits followed by several parameters
the whole string ends with , e.g.if we specify command code 159 for call forwardingthe USSD string *159*5288128# is sent by the MSthe network will forward all incoming calls to 5288128
USSDGSM MAPTCP/IP
USSDMSMSCVLRHLRUSSD service nodeMSCUSSD message(1)MS-MSCUSSD service nodeVLRUSSD message(1)(2)MS-MSC-VLRUSSD service nodeHLRUSSD message(1)(2)(3)MS-MSC-VLR-HLR
USSD service nodeHLRHLRHLRUSSD service node
USSD gatewayUSSD messageApplication Serverstock queryUSSD gatewayHLRGSM MAPUSSD gatewayapplication serverTCP/IP
******************************************Tapping ****************BP: slot length is called a burst period (BP).**********************************************************Tandem: ***********Impedance: ()****************************************************Step 1: BCCH(LAC, Location code) SDCCH new VLR MS Temporary Mobile Subscriber Identity (TMSIVLR VLR MSC VLR : MSC, TMSI, old LAI, target LAI .Step 2:IMSI VLR VLR TMSI VLR IMSI VLR authentication TMSI IMSI Step 3: VLR HLR VLR IMSI MS PLMN, i.e., HLR HLR VLR Step 4: VLR TMSI Step 5:3HLR VLR VLR
*************************************************************Triplet***GSM functional plane GSM sites interface GSM . OSI model , functional planes, . GSM functions model 5 functional planes. entities (physical transmission) external users (lower layer) (upper layer)., lower layer short time scale, upper layer long time scale.Ex: bit modulation in Transmission plane microseconds ., entity ( signaling protocol), , function. GSM functional plane OSI layer protocol , function protocol.Example: CM Q.931 (layer 3), CM Q.931 , layers 1,2. signals , CM physical layer.GSM functional plane GSM sites OS calls program . programmer, designer GSM function planes operations .
* GSM entity functional plane ., entity function.****************************************************
Top Related