Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 1
GSM and UMTS
MarketGSM
OverviewServicesSub-systemsComponents
UMTS/IMT-2000
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 2
Mobile phone subscribers worldwide
year
Subs
crib
ers
[mill
ion]
0
200
400
600
800
1000
1200
1400
1600
1996 1997 1998 1999 2000 2001 2002 2003 2004
approx. 1.7 bn
GSM total
TDMA total
CDMA total
PDC total
Analogue total
W-CDMA
Total wireless
Prediction (1998)
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 3
Development of mobile telecommunication systems
1G 2G 3G2.5G
IS-95cdmaOne
IS-136TDMAD-AMPSGSMPDC
GPRS
IMT-DSUTRA FDD / W-CDMA
EDGE
IMT-TCUTRA TDD / TD-CDMA
cdma2000 1X
1X EV-DV(3X)
AMPSNMT
IMT-SCIS-136HSUWC-136
IMT-TCTD-SCDMA
CT0/1
CT2IMT-FTDECT
CD
MA
TDM
AFD
MA
IMT-MCcdma2000 1X EV-DO
HSDPA
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 4
How does it work?
How can the system locate a user?Why don’t all phones ring at the same time?What happens if two users talk simultaneously?Why don’t I get the bill from my neighbor?Why can an Australian use her phone in Berlin?
Why can’t I simply overhear the neighbor’s communication?How secure is the mobile phone system?What are the key components of the mobile phone network?
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 5
GSM: Overview
GSMformerly: Groupe Spéciale Mobile (founded 1982)now: Global System for Mobile CommunicationPan-European standard (ETSI, European Telecommunications Standardisation Institute)simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations (Germany: D1 and D2)
seamless roaming within Europe possibletoday many providers all over the world use GSM (more than 200 countries in Asia, Africa, Europe, Australia, America)more than 1.2 billion subscribers in more than 630 networksmore than 75% of all digital mobile phones use GSM (74% total)over 200 million SMS per month in Germany, > 550 billion/year worldwide(> 10% of the revenues for many operators)[be aware: these are only rough numbers…]
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 6
Performance characteristics of GSM (wrt. analog sys.)
Communication mobile, wireless communication; support for voice and data services
Total mobility international access, chip-card enables use of access points of different providers
Worldwide connectivityone number, the network handles localization
High capacity better frequency efficiency, smaller cells, more customers per cell
High transmission qualityhigh audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e.g., from cars, trains)
Security functions access control, authentication via chip-card and PIN
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 7
Disadvantages of GSM
There is no perfect system!!no end-to-end encryption of user datano full ISDN bandwidth of 64 kbit/s to the user, no transparent B-channel
B-channel (bearer channel): channel that carries main data
reduced concentration while drivingelectromagnetic radiation
abuse of private data possibleroaming profiles accessible
high complexity of the systemseveral incompatibilities within the GSM standards
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 8
GSM: Mobile Services
GSM offersseveral types of connections
voice connections, data connections, short message servicemulti-service options (combination of basic services)
Three service domainsBearer ServicesTelematic ServicesSupplementary Services
Enhancements for standard telephony service
GSM-PLMNtransit
network(PSTN, ISDN)
source/destination
networkTE TE
bearer services
tele services
R, S (U, S, R)Um
MT
MS
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 9
Bearer Services
Telecommunication services to transfer data between access pointsSpecification of services up to the terminal interface (OSI layers 1-3) Different data rates for voice and data (original standard)
data service (circuit switched)synchronous: 2.4, 4.8 or 9.6 kbit/sasynchronous: 300 - 1200 bit/s
data service (packet switched)synchronous: 2.4, 4.8 or 9.6 kbit/sasynchronous: 300 - 9600 bit/s
transparent bearer servicesdo not try to recover lost data
non-transparent bearer servicesuse protocols of layers 2 and 3 to implement error correction and flow control
Today: data rates of approx. 50 kbit/s possible – will be covered later!
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 10
Tele Services I
Telecommunication services that enable voice communication via mobile phonesAll these basic services have to obey cellular functions, security measurements etc.
encrypted voice transmission, message services, and basic data communication with terminals as known from the PSTN or ISDN
Offered servicesmobile telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz Emergency numbercommon number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible)Multinumberingseveral ISDN phone numbers per user possible
according to the desired service
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 11
Tele Services II
Additional servicesNon-Voice-Teleservices
group 3 faxvoice mailbox (implemented in the fixed network supporting the mobile terminals)electronic mail (MHS, Message Handling System, implemented in the fixed network)...
Short Message Service (SMS)alphanumeric data transmission to/from the mobile terminal (160 characters) using the signaling channel, thus allowing simultaneous use of basic services and SMS(almost ignored in the beginning now the most successful add-on!)
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 12
Supplementary services
Services in addition to the basic services, cannot be offered stand-aloneSimilar to ISDN services besides lower bandwidth due to the radio linkMay differ between different service providers, countries and protocol versions Important services
identification: forwarding of caller numbersuppression of number forwardingautomatic call-back: keep trying the number until getting throughconferencing with up to 7 participantslocking of the mobile terminal (incoming or outgoing calls)...
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 13
Architecture of the GSM system (GSM-PLMN)
GSM is a PLMN (Public Land Mobile Network)several providers setup mobile networks following the GSM standard within each countrycomponents
MS (mobile station)BS (base station)MSC (mobile switching center)LR (location register)
subsystemsRSS (radio subsystem): covers all radio aspectsNSS (network and switching subsystem): call forwarding, handover, switchingOSS (operation subsystem): management of the network
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 14
Ingredients 1: Mobile Phones, PDAs & Co.
The visible but smallestpart of the network!
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 15
Ingredients 2: Antennas
Still visible – cause many discussions…
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 16
Ingredients 3: Infrastructure 1
Base Stations
Cabling
Microwave links
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 17
Ingredients 3: Infrastructure 2
Switching units
Data bases
Management
Monitoring
Not „visible“, butcomprise the major partof the network (also from an investmentpoint of view…)
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 18
GSM: overview
fixed network
BSC
BSC
MSC MSC
GMSC
OMC, EIR, AUC
VLR
HLRNSSwith OSS
RSS
VLR
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 19
GSM: elements and interfaces
NSS
MS MS
BTS
BSC
GMSC
IWF
OMC
BTS
BSC
MSC MSC
Abis
Um
EIR
HLR
VLR VLR
A
BSS
PDN
ISDN, PSTN
RSS
radio cell
radio cell
MS
AUCOSS
signaling
O
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 20
Um
Abis
ABSS
radiosubsystem
MS MS
BTSBSC
BTS
BTSBSC
BTS
network and switching subsystem
MSC
MSC
fixedpartner networks
IWF
ISDNPSTN
PSPDNCSPDN
SS
7
EIR
HLR
VLR
ISDNPSTN
GSM: system architecture
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 21
System architecture: radio subsystem
ComponentsMS (Mobile Station)BSS (Base Station Subsystem):consisting of
BTS (Base Transceiver Station):sender and receiverBSC (Base Station Controller):controlling several transceivers
InterfacesUm : radio interfaceAbis : standardized, open interface with 16/64 kbit/s user channelsA: standardized, open interface with 64 kbit/s user channels
Um
Abis
A
BSS
radiosubsystem
network and switchingsubsystem
MS MS
BTSBSC MSC
BTS
BTSBSC
BTSMSC
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 22
System architecture: network and switching subsystem
ComponentsMSC (Mobile Services Switching Center):IWF (Interworking Functions)
ISDN (Integrated Services Digital Network)PSTN (Public Switched Telephone Network)PSPDN (Packet Switched Public Data Net.)CSPDN (Circuit Switched Public Data Net.)
DatabasesHLR (Home Location Register)VLR (Visitor Location Register)EIR (Equipment Identity Register)
networksubsystem
MSC
MSC
fixed partnernetworks
IWF
ISDNPSTN
PSPDNCSPDN
SS
7
EIR
HLR
VLR
ISDNPSTN
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 23
Radio subsystem
The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centersComponents
Base Station Subsystem (BSS):Base Transceiver Station (BTS): radio components including sender, receiver, antenna - if directed antennas are used one BTS can cover several cellsBase Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (Um) onto terrestrial channels (A interface)
BSS = BSC + sum(BTS) + interconnection
Mobile Stations (MS)
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 24
possible radio coverage of the cell
idealized shape of the cellcell
segmentation of the area into cells
GSM: cellular network
use of several carrier frequenciesnot the same frequency in adjoining cellscell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc.hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)if a mobile user changes cells
handover of the connection to the neighbor cell
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 25
GSM frequency bands
921-960921-925
876-915876-880
955-1024, 0-12469 channels
GSM-Rexclusive
1930-19901850-1910512-810GSM 1900 (Americas)
1805-18801710-1785512-885GSM 1800
921-960935-960925-960
876-915890-915880-915
0-124, 955-1023124 channels+49 channels
GSM 900classicalextended
869-894824-849128-251GSM 850 (Americas)
Downlink [MHz]Uplink [MHz]ChannelsType
- Additionally: GSM 400 (also named GSM 450 or GSM 480 at 450-458/460-468 or 479-486/489-496 MHz- Please note: frequency ranges may vary depending on the country!- Channels at the lower/upper edge of a frequency band are typically not used
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 26
Example coverage of GSM networks (www.gsmworld.com)
T-Mobile (GSM-900/1800) Germany O2 (GSM-1800) Germany
AT&T (GSM-850/1900) USA Vodacom (GSM-900) South Africa
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 27
Base Transceiver Station and Base Station Controller
Tasks of a BSS are distributed over BSC and BTSBTS comprises radio specific functionsBSC is the switching center for radio channels
Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 28
Mobile station
Terminal for the use of GSM servicesA mobile station (MS) comprises several functional groups
MT (Mobile Terminal):offers common functions used by all services the MS offerscorresponds to the network termination (NT) of an ISDN accessend-point of the radio interface (Um)
TA (Terminal Adapter):terminal adaptation, hides radio specific characteristics
TE (Terminal Equipment):peripheral device of the MS, offers services to a userdoes not contain GSM specific functions
SIM (Subscriber Identity Module):personalization of the mobile terminal, stores user parameters
R S UmTE TA MT
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 29
Network and switching subsystem
NSS is the main component of the public mobile network GSMswitching, mobility management, interconnection to other networks, system control
mobility management: handovers between different BSSs
ComponentsMobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSCDatabases (important: scalability, high capacity, low delay)
Home Location Register (HLR)central master database containing user data, permanent and semi-permanent (dynamic) data of all subscribers assigned to the HLR (one provider can have several HLRs)Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR
– avoid frequent HLR updates and long-distance signalling of user information
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 30
Mobile Services Switching Center
The MSC (mobile switching center) plays a central role in GSMswitching functionsadditional functions for mobility supportmanagement of network resourcesinterworking functions via Gateway MSC (GMSC)integration of several databases
Functions of a MSCspecific functions for paging and call forwardingtermination of SS7 (signaling system no. 7)
SS7: handles all signalling needed for connection setup, connection release and handover of connections to other MSCs
mobility specific signalinglocation registration and forwarding of location informationprovision of new services (fax, data calls)support of short message service (SMS)generation and forwarding of accounting and billing information
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 31
Operation subsystem
The OSS (Operation Subsystem) enables network operation, management, and maintenance of all GSM subsystemsComponents
Authentication Center (AUC)situated in a special protected part of the HLR generates user specific authentication parameters on request of a VLR authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system
Equipment Identity Register (EIR)registers GSM mobile stations and user rightsstolen or malfunctioning mobile stations can be locked and sometimes even localized
Operation and Maintenance Center (OMC)different control capabilities for the radio subsystem and the network subsystemtraffic monitoring, status reports of network entities, subscriber and security management, or accounting and billing
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 32
1 2 3 4 5 6 7 8
higher GSM frame structures
935-960 MHz124 channels (200 kHz)downlink
890-915 MHz124 channels (200 kHz)uplink
frequ
ency
time
GSM TDMA frame
GSM time-slot (normal burst)
4.615 ms
546.5 µs577 µs
tail user data TrainingSguardspace S user data tail
guardspace
3 bits 57 bits 26 bits 57 bits1 1 3
GSM - TDMA/FDMA
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 33
GSM – TDMA/FDMA (Definitions)
Normal burstdata transmission
Tailset to 0used to enhance the receiver performance
Training sequenceadapt the parameters of the receiver to the current path propagation characteristicsselect the strongest signal in case of multi-path propagation
Flag Sindicate whether the data field contains user or network control data
Guard spaceavoid overlapping with other bursts due to different path delaysgive the transmitter time to turn on and off
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 34
GSM hierarchy of frames
0 1 2 2045 2046 2047...hyperframe: count each TDMA frame as input for encryption algorithm
0 1 2 48 49 50...
0 1 24 25...
superframe
0 1 24 25...
0 1 2 48 49 50...
0 1 6 7...
multiframe
frame
burstslot
577 µs
4.615 ms
120 ms (traffic)
235.4 ms (control)
6.12 s
3 h 28 min 53.76 s
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 35
GSM protocol layers for signaling
CM
MM
RR
MM
LAPDm
radio
LAPDm
radio
LAPD
PCM
RR’ BTSM
CM
LAPD
PCM
RR’BTSM
16/64 kbit/s
Um Abis A
SS7
PCM
SS7
PCM
64 kbit/s /2.048 Mbit/s
MS BTS BSC MSC
BSSAP BSSAP
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 36
GSM protocol layers for signaling (Definitions)
Layer 1handles all radio-specific functions
LAPDmoffers reliable data transfer over connectionsre-sequencing of data framesflow control
LAPD: LAPDm + synchronization and checksumming for error detectionRadio resource management (RR)
setup, maintenance, and release of radio channelsMobility management (MM)
functions for registration, authentication, identification, location updating, and the provision of a temporary mobile subscriber identity (TMSI)
Call management (CM)call control, short message service, and supplementary service
Pulse code modulation (PCM)offer transparent 64 kbps digital channels
BTS management (BTSM)functions of RR’ supported by BSC via BTS
BSS application part (BSSAP)controls a BSS by MSC
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 37
Mobile Terminated Call
PSTNcallingstation GMSC
HLR VLR
BSSBSSBSS
MSC
MS
1 2
3
45
6
7
8 9
10
11 12
1316
10 10
11 11 11
14 15
17
1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible
MSC to GMSC7: forward call to
current MSC8, 9: get current (availability) status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection
MSRN: mobile station roaming number
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 38
Mobile Originated Call
PSTN GMSC
VLR
BSS
MSC
MS1
2
6 53 4
9
10
7 8
1, 2: connection request3, 4: security check5-8: check resources (free circuit)9-10: set up call
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 39
MTC/MOC
BTSMS
paging request
channel request
immediate assignment
paging response
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
BTSMS
channel request
immediate assignment
service request
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
MTC MOC
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 40
4 types of handover
MSC MSC
BSC BSCBSC
BTS BTS BTSBTS
MS MS MS MS
12 3 4
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 41
GSM Handover
Intra-cell handoverchange the carrier frequency
Inter-cell, intra-BSC handoverassign a new radio channel in the new cell and release the old one
Inter-BSC, intra-MSC handoverperform handovers between cells controlled by different BSCs
Inter-MSC handoverhandover between two cells belonging to different MSCs
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 42
Handover decision
receive levelBTSold
receive levelBTSold
MS MS
HO_MARGIN
BTSold BTSnew
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 43
Handover procedure
HO access
BTSold BSCnew
measurementresult
BSCold
Link establishment
MSCMSmeasurementreport
HO decisionHO required
BTSnew
HO request
resource allocationch. activation
ch. activation ackHO request ackHO commandHO commandHO command
HO completeHO completeclear commandclear command
clear complete clear complete
HO complete
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 44
Security in GSM
Security servicesaccess control/authentication
user SIM (Subscriber Identity Module): secret PIN (personal identification number)SIM network: challenge response method
– challenge: random number; response: signed response (SRES)
confidentialityvoice and signaling encrypted on the wireless link (after successful authentication)
anonymitytemporary identity TMSI (Temporary Mobile Subscriber Identity)newly assigned at each new location update (LUP)encrypted transmission
3 algorithms specified in GSMA3 for authentication (“secret”, open interface)A5 for encryption (standardized)A8 for key generation (“secret”, open interface)A3 and A8: proprietary
“secret”:• A3 and A8 available via the Internet• network providers can use stronger mechanisms
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 45
GSM - authentication
A3
RANDKi
128 bit 128 bit
SRES* 32 bit
A3
RAND Ki
128 bit 128 bit
SRES 32 bit
SRES* =? SRES SRES
RAND
SRES32 bit
mobile network SIM
AC
MSC
SIM
Ki: individual subscriber authentication key SRES: signed response
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 46
GSM - key generation and encryption
A8
RANDKi
128 bit 128 bit
Kc64 bit
A8
RAND Ki
128 bit 128 bit
SRES
RAND
encrypteddata
mobile network (BTS) MS with SIM
AC
BSS(BTS / BSC)
SIM
A5
Kc64 bit
A5MS
data data
cipherkey
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 47
Data services in GSM I
Data transmission standardized with only 9.6 kbit/sadvanced coding allows 14,4 kbit/snot enough for Internet and multimedia applications
HSCSD (High-Speed Circuit Switched Data)mainly software update (upgrades in MS and MSC)bundling of several time-slots to get higher AIUR (Air Interface User Rate)(e.g., 57.6 kbit/s using 4 slots, 14.4 each)advantage: ready to use, constant quality, simpledisadvantage: channels blocked for voice transmission
still use the connection-oriented mechanisms of GSMAIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.4
4.8 19.6 2 1
14.4 3 119.2 4 228.8 3 238.4 443.2 357.6 4
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 48
Data services in GSM II
GPRS (General Packet Radio Service)packet switchingusing free slots only if data packets ready to send (e.g., 50 kbit/s using 4 slots temporarily)standardization 1998, introduction 2001advantage: one step towards UMTS, more flexibledisadvantage: more investment needed (new hardware)
GPRS network elementsGSN (GPRS Support Nodes): GGSN and SGSNGGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)SGSN (Serving GSN)
supports the MS (location, billing, security)GR (GPRS Register)
user addressesmapping between a mobile’s identity and the PSPDN address
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 49
GPRS quality of service
Reliabilityclass
Lost SDUprobability
DuplicateSDU
probability
Out ofsequence
SDUprobability
Corrupt SDUprobability
1 10-9 10-9 10-9 10-9
2 10-4 10-5 10-5 10-6
3 10-2 10-5 10-5 10-2
Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile
1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified
Delay-- channel access delay, coding for error correction, and transfer delay
in the fixed and wireless part of the GPRS network
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 50
Examples for GPRS device classes
54412
52410
5148
4225
3223
3122
2111
Maximum number of slotsSending slotsReceiving slotsClass
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 51
GPRS user data rates in kbit/s
171.2149.8128.410785.664.242.821.4CS-4
124.8109.293.67862.446.831.215.6CS-3
107.293.880.46753.640.226.813.4CS-2
72.463.3554.345.2536.227.1518.19.05CS-1
8 slots7 slots6 slots5 slots4 slots3 slots2 slots1 slotCoding scheme
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 52
GPRS architecture and interfaces
MS BSS GGSNSGSN
MSC
Um
EIR
HLR/GR
VLR
PDN
Gb Gn Gi
SGSN
Gn
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 53
GPRS protocol architecture
apps.
IP/X.25
LLC
GTP
MAC
radio
MAC
radioFR
RLC BSSGP
IP/X.25
FR
Um Gb Gn
L1/L2 L1/L2
MS BSS SGSN GGSN
UDP/TCP
Gi
SNDCP
RLC BSSGP IP IP
LLC UDP/TCPSNDCP GTP
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 54
GPRS protocol architecture (Definitions)
Base station subsystem GPRS protocol (BSSGP)Convey routing and QoS-related information between BSS and SGSN
Subnetwork dependent convergence protocol (SNDCP)adapt to different characteristics of the underlying networks between SGSN and MStransport between GSNs within the GPRS backbone
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 55
Original Goals for 3G
Establish a common worldwide communication systemallowed for terminal and user mobility
Support the idea of universal personal telecommunication
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 56
UMTS and IMT-2000
Proposals for IMT-2000 (International Mobile Telecommunications)UWC-136, cdma2000, WP-CDMAUMTS (Universal Mobile Telecommunications System) from ETSI
UMTSUTRA (was: UMTS, now: Universal Terrestrial Radio Access)enhancements of GSM
EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s– enhanced modulation schemes
CAMEL (Customized Application for Mobile Enhanced Logic)– intelligent network support
VHE (Virtual Home Environment)fits into GMM (Global Multimedia Mobility) initiative from ETSI
provide an architecture to integrate mobile and fixed terminals, many different access networks, and core transport networks
requirementsmin. 144 kbit/s rural (goal: 384 kbit/s)min. 384 kbit/s suburban (goal: 512 kbit/s)up to 2 Mbit/s urban
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 57
Frequencies for IMT-2000
IMT-2000
1850 1900 1950 2000 2050 2100 2150 2200 MHz
MSS↑
ITU allocation(WRC 1992) IMT-2000 MSS
↓
Europe
China
Japan
NorthAmerica
UTRAFDD ↑
UTRAFDD ↓
TDD
TDD
MSS↑
MSS↓
DECT
GSM1800
1850 1900 1950 2000 2050 2100 2150 2200 MHz
IMT-2000 MSS↑
IMT-2000 MSS↓
GSM1800
cdma2000W-CDMA
MSS↓
MSS↓
MSS↑
MSS↑
cdma2000W-CDMAPHS
PCS rsv.
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 58
IMT-2000 family
IMT-DS(Direct Spread)
UTRA FDD(W-CDMA)
3GPP
IMT-TC(Time Code)UTRA TDD(TD-CDMA);TD-SCDMA
3GPP
IMT-MC(Multi Carrier)
cdma2000
3GPP2
IMT-SC(Single Carrier)
UWC-136(EDGE)
UWCC/3GPP
IMT-FT(Freq. Time)
DECT
ETSI
GSM(MAP)
ANSI-41(IS-634) IP-Network
IMT-2000Core NetworkITU-T
IMT-2000Radio AccessITU-R
Interface for Internetworking
Flexible assignment of Core Network and Radio Access
Initial UMTS(R99 w/ FDD)
IS-634: define the messaging interface between TDMA, BS, and MSC
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 59
GSM and UMTS Releases
19923.x.yPh1-Phase 1
19954.x.yPh2-Phase 2
early 19975.x.yR96-Phase 2+ Release 1996
early 19986.x.yR97-Phase 2+ Release 1997
early 19997.x.yR98-Phase 2+ Release 1998
8.x.y-Phase 2+ Release 1999March 2000
3.x.yR99
Release 1999-
9.x.y-Phase 2+ Release 2000Renaming…
4.x.yR00
Release 2000-
March 20014.x.yRel-4Release 4Phase 2+ Release 4
March - June 20025.x.yRel-5Release 5Phase 2+ Release 5
December 2004 -March 20056.x.yRel-6Release 6Phase 2+ Release 6
Freeze date(indicative only)
Spec versionnumberAbbreviated name3G ReleaseGSM/EDGE Release
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 60
GSM and UMTS Releases (Definitions)
Release 99new radio access technologies
Release 4introduces QoS in fixed network plus several execution environments and new service architectures
Release 5radically different core (all-IP) network
Release 6comprises the use of MIMO antennas, enhanced MMS, security enhancements, WLAN/UMTS interworking, broadcast/multicast services, enhanced IMS, IP emergency calls, and many more management features
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 61
Licensing Example: UMTS in Germany, 18. August 2000
Sum: 50.81 billion €
UTRA-FDD: Uplink 1920-1980 MHzDownlink 2110-2170 MHzduplex spacing 190 MHz 12 channels, each 5 MHz
UTRA-TDD: 1900-1920 MHz, 2010-2025 MHz; 5 MHz channels
Coverage of the population 25% until 12/200350% until 12/2005
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 62
UMTS architecture (Release 99 used here!)
UTRANUE CN
IuUu
UTRAN (UTRA Network)handles cell level mobilityRadio Network Subsystem (RNS)
radio channel ciphering and deciphering, handover control, radio resource management
Encapsulation of all radio specific tasksUE (User Equipment)
comprises all the functions needed to access UMTS servicesCN (Core Network)
Inter system handovergateways to other networks (fixed or wireless)
Location management if there is no dedicated connection between UE and UTRAN
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 63
UMTS domains and interfaces I
User Equipment DomainAssigned to a single user in order to access UMTS services
Infrastructure DomainShared among all usersOffers UMTS services to all accepted users
USIMDomain
MobileEquipment
Domain
AccessNetworkDomain
ServingNetworkDomain
TransitNetworkDomain
HomeNetworkDomain
Cu Uu Iu
User Equipment Domain
ZuYu
Core Network Domain
Infrastructure Domain
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 64
UMTS domains and interfaces II
Universal Subscriber Identity Module (USIM)Functions for encryption and authentication of usersLocated on a SIM inserted into a mobile device
Mobile Equipment DomainFunctions for radio transmission User interface for establishing/maintaining end-to-end connections
Access Network DomainAccess network dependent functions
Core Network DomainAccess network independent functionsServing Network Domain
Network currently responsible for communicationHome Network Domain
Location and access network independent functions
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 65
Spreading and scrambling of user dataConstant chipping rate of 3.84 Mchip/sDifferent user data rates supported via different spreading factors
higher data rate: less chips per bit and vice versaUser separation via unique, quasi orthogonal scrambling codes
users are not separated via orthogonal spreading codesspreading codes: separate different data streams of a sender
much simpler management of codes: each station can use the same orthogonal spreading codesprecise synchronisation not necessary as the scrambling codes stay quasi-orthogonal
data1 data2 data3
scramblingcode1
spr.code3
spr.code2
spr.code1
data4 data5
scramblingcode2
spr.code4
spr.code1
sender1 sender2
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 66
OSVF (Orthogonal Variable Spreading Factor) coding
1
1,1
1,-1
1,1,1,1
1,1,-1,-1
X
X,X
X,-X 1,-1,1,-1
1,-1,-1,11,-1,-1,1,1,-1,-1,1
1,-1,-1,1,-1,1,1,-1
1,-1,1,-1,1,-1,1,-1
1,-1,1,-1,-1,1,-1,1
1,1,-1,-1,1,1,-1,-1
1,1,-1,-1,-1,-1,1,1
1,1,1,1,1,1,1,1
1,1,1,1,-1,-1,-1,-1
SF=1 SF=2 SF=4 SF=8
SF=n SF=2n
...
...
...
...
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 67
UMTS FDD frame structure
W-CDMA• 1920-1980 MHz uplink• 2110-2170 MHz downlink• chipping rate:
3.840 Mchip/s• soft handover• QPSK• complex power control
(1500 power control cycles/s)
• spreading: UL: 4-256; DL:4-512
0 1 2 12 13 14...
Radio frame
Pilot FBI TPC
Time slot
666.7 µs
10 ms
Data
Data1
uplink DPDCH
uplink DPCCH
downlink DPCHTPC TFCI Pilot
666.7 µs
666.7 µs
DPCCH DPDCH
2560 chips, 10 bits
2560 chips, 10*2k bits (k = 0...6)
TFCI
2560 chips, 10*2k bits (k = 0...7)
Data2
DPDCH DPCCHFBI: Feedback InformationTPC: Transmit Power ControlTFCI: Transport Format Combination IndicatorDPCCH: Dedicated Physical Control ChannelDPDCH: Dedicated Physical Data ChannelDPCH: Dedicated Physical ChannelSlot structure NOT for user separation
but synchronisation for periodic functions!
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 68
Typical UTRA-FDD uplink data rates
481664Spreading
15151515DPCCH [kbit/s]
96048024060DPDCH [kbit/s]
3841446412.2 (voice)User data rate [kbit/s]
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 69
UMTS TDD frame structure (burst type 2)
TD-CDMA• 2560 chips per slot• spreading: 1-16• symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction)• tight synchronisation needed• simpler power control (100-800 power control cycles/s)
0 1 2 12 13 14...
Radio frame
Data1104 chips
Midample256 chips
Data1104 chips
Time slot
666.7 µs
10 ms
Traffic burstGP
midample: training and channel estimation
GP: guard period96 chips
2560 chips
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 70
UTRAN architecture
UTRAN comprises severalRNSs
Node B can support FDD orTDD or both
RNC is responsible for handoverdecisions requiringsignalingto the UE
Cell offers FDD or TDD
RNC: Radio Network ControllerRNS: Radio Network Subsystem
Node B
Node B
RNC
Iub
Node B
UE1
RNS
CN
Node B
Node B
RNC
Iub
Node B
RNS
Iur
Node B
UE2
UE3
Iu
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 71
UTRAN architecture
RNC
Iub
RNS
CN
RNC
Iub
RNS
Iur
Iu
Node B
Node BNode B
Node BNode B
Node B
Node B
UTRAN comprises several RNSsNode B can support FDD or TDD
or both
RNC is responsible for handoverdecisions requiring signalingto the UE
Cell offers FDD or TDD
RNC: Radio Network ControllerRNS: Radio Network SubsystemUE
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 72
UTRAN functions
Admission controlCongestion controlSystem information broadcastingRadio channel encryptionHandoverSRNS movingRadio network configurationChannel quality measurementsMacro diversityRadio carrier controlRadio resource controlData transmission over the radio interfaceOuter loop power control (FDD and TDD)
minimize interference between neighbouring cells or control the size of a cellChannel codingAccess control
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 73
Core network: protocols
MSC
RNS
SGSN GGSN
GMSC
HLR
VLR
RNS
Layer 1: PDH, SDH, SONET
Layer 2: ATM
Layer 3: IPGPRS backbone (IP)
SS 7
GSM-CSbackbone
PSTN/ISDN
PDN (X.25),Internet (IP)
UTRAN CN
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 74
Core network: architecture
BTS
Node B
BSC
Abis
BTS
BSS
MSC
Node B
Node B
RNC
Iub
Node BRNS
Node BSGSN GGSN
GMSC
HLR
VLR
IuPS
IuCS
Iu
CN
EIR
GnGi
PSTN
AuC
GR
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 75
Core network
The Core Network (CN) and thus the Interface Iu, too, are separated into two logical domains:Circuit Switched Domain (CSD)
Circuit switched service incl. signalingResource reservation at connection setupGSM components (MSC, GMSC, VLR)IuCS
Packet Switched Domain (PSD)GPRS components (SGSN, GGSN)IuPS
Release 99 uses the GSM/GPRS network and adds a new radio access!Helps to save a lot of money …Much faster deploymentNot as flexible as newer releases (5, 6)
GSM circuit switched part replaced by all-IP core
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 76
UMTS protocol stacks (user plane)
apps. &protocols
MAC
radio
MAC
radio
RLC SAR
Uu IuCSUE UTRAN 3GMSC
RLC
AAL2
ATM
AAL2
ATM
SAR
apps. &protocols
MACradio
MACradio
PDCP GTP
Uu IuPSUE UTRAN 3GSGSN
RLCAAL5ATM
AAL5ATM
UDP/IPPDCP
RLC UDP/IP UDP/IP
Gn
GTP GTP
L2L1
UDP/IPL2L1
GTP
3GGGSN
IP, PPP,…
IP, PPP,…
IP tunnel
Circuitswitched
Packetswitched
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 77
UMTS protocol stacks (user plane): Definitions
AAL2Connection-oriented, synchronous VBR traffic
Packet data convergence protocol (PDCP)perform header compression to avoid redundant data transmission using scarce radio resources
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 78
Support of mobility: macro diversity
Multicasting of data via several physical channels
Enables soft handoverFDD mode only
Uplinksimultaneous reception of UE data at several Node BsReconstruction of data at Node B, SRNC or DRNC
DownlinkSimultaneous transmission of data via different cellsDifferent spreading codes in different cells
CNNode B RNC
Node BUE
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 79
Support of mobility: handover
From and to other systems (e.g., UMTS to GSM)This is a must as UMTS coverage will be poor in the beginning
RNS controlling the connection is called SRNS (Serving RNS)RNS offering additional resources (e.g., for soft handover) is called Drift
RNS (DRNS)End-to-end connections between UE and CN only via Iu at the SRNS
SRNC relocation: hard handoverChange of SRNS requires change of IuInitiated by the SRNSControlled by the RNC and CN
SRNC
UE
DRNC
Iur
CN
IuNode B
Iub
Node BIub
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 80
Example handover types in UMTS/GSM
RNC1
UE1
RNC2
Iur
3G MSC1
IuNode B1
IubNode B2
Node B3 3G MSC2
BSCBTS 2G MSC3
AAbis
UE2
UE3
UE4
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 81
UMTS/GSM Handover
Intra-node-B, intra-RNCUE moves from one antenna of node B to another antennasofter handover: node B performs combining and splitting of data streams
Inter-node-B, intra-RNCUE moves from one node B to another controlled by the same RNCRNC combines and splits data
Inter-RNCUE moves from one node B to another controlled by different RNCsinternal: not visible for the CNexternal: relocation of controlling RNC => hard handover
Inter-MSChard handover of the connection
Inter-systemUE moves from a 3G UMTS network into a 2G GSM networkhard handover
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 82
Breathing Cells
GSMMobile device gets exclusive signal from the base station Number of devices in a cell does not influence cell size
UMTSCell size is closely correlated to the cell capacitySignal-to-nose ratio determines cell capacityNoise is generated by interference from
other cellsother users of the same cell
Interference increases noise levelDevices at the edge of a cell cannot further increase their output power (max. power limit) and thus drop out of the cell
no more communication possibleLimitation of the max. number of users within a cell required
Cell breathing complicates network planning
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 83
Breathing Cells: Example
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 84
UMTS services (originally)
Data transmission service profiles
Virtual Home Environment (VHE)Enables access to personalized data independent of location, access network, and deviceNetwork operators may offer new services without changing the networkService providers may offer services based on components which allow the automatic adaptation to new networks and devicesIntegration of existing IN services
Circuit switched16 kbit/sVoiceSMS successor, E-MailPacket switched14.4 kbit/sSimple Messaging
Circuit switched14.4 kbit/sSwitched Dataasymmetrical, MM, downloadsCircuit switched384 kbit/sMedium MMLow coverage, max. 6 km/hPacket switched2 Mbit/sHigh MMBidirectional, video telephoneCircuit switched128 kbit/sHigh Interactive MM
Transport modeBandwidthService Profile
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 85
Example 3G Networks: Japan
FOMA (Freedom Of Mobile multimediaAccess) in Japan
Examples for FOMA phones
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 86
Example 3G networks: Australia
cdma2000 1xEV-DO in Melbourne/Australia
Examples for 1xEV-DO devices
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 87
Isle of Man – Start of UMTS in Europe as Test
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 88
UMTS in Monaco
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 89
UMTS in Europe
Vodafone/Germany
Orange/UK
Dr. Ka-Cheong Leung CSIS 7304 The Wireless Internet and Mobile Computing 90
Some current enhancements
GSMEMS/MMS
EMS: 760 characters possible by chaining SMS, animated icons, ring tones, was soon replaced by MMS (or simply skipped)MMS: transmission of images, video clips, audio
– see WAP 2.0 / chapter 10
EDGE (Enhanced Data Rates for Global [was: GSM] Evolution)8-PSK instead of GMSK, up to 384 kbit/snew modulation and coding schemes for GPRS EGPRS
– MCS-1 to MCS-4 uses GMSK at rates 8.8/11.2/14.8/17.6 kbit/s– MCS-5 to MCS-9 uses 8-PSK at rates 22.4/29.6/44.8/54.4/59.2 kbit/s
UMTSHSDPA (High-Speed Downlink Packet Access)
initially up to 10 Mbit/s for the downlink, later on 20 Mbit/s using MIMO- (Multiple Input Multiple Output-) antennasuses 16-QAM instead of QPSK