gsm system architecture

DGM(BSS), BSNL 15-Feb-06 1

Cellular Mobile Communication System


GSM Global System

for Mobile Communication


PART-I : Brief History of GSM

PART-II : GSM Architecture


History of GSMDate Activities of development of Mobile Communication 1982

– 1985

Conference Europeenne des postes et Telecommunication (CEPT)began specifying a European digital telecommunications standard in the 900 MHz frequency band. This standard later became known as Global System for Mobile Communication (GSM)

1986 Field tests were held in Paris to select which digital transmissiontechnology to use. The choice was TDMA or FDMA

1987 A combination of TDMA and FDMA was selected as the transmission technology for GSM Operation from 12 countries signed a Memorandum of understanding committing themselvesto introducing GSM by 1991.

1988 CEPT began producing GSM specifications for a phased implementation.Another five countries signed the MOU


HistoryDate Activity 1989 European Telecommunication Standards Institute (ETSI) took

over responsibility for GSM 1990 Phase 1 specifications were frozen to allow manufacturers to

develop network equipment. 1991 The GSM 1800 standard was released. An addendum was

added to the MoU allowing Countries outside CEPT to sign.

1992 Phase 1 specifications were completed. First commercial Ph-I GSM networks were launched. The first international roaming agreement was established between Finland & Vodafone in UK.

1993 Australia becomes the first non-European country to sign the MoU. The first commercial DCS 1800 system was launched in UK


HistoryDate Activity 1995 The specification for Personal Communication Services (PCS)

was developed in USA. This version of GSM operates at 1900MHz

1996 The first GSM 1900 system became available. These comply with the PCS 1900 standerd.

1998 At the beginning of 1998 the MoU has a total of 253 members in over 100 countries and there are over 70 million GSM subscribers worldwide. GSM subscribers account for 31% of the world’s mobile market


GSM Specifications

• Designed to be Platform- Independent• Specify Network functions & Interfaces in

details, not Actual Hardware requirements• Allows hardware manufacturers to be

creative in providing actual functionality.• Allows operators to buy equipment from

different suppliers.


GSM SPECIFICATIONS

System P-GSM 900 Frequecies: UP Link : 890-915 MHz, Down Link : 935-960 MHz

Wave Length ~ 33 cm Bandwidth 25 MHz

Duplex Distance 45 MHz Carrier Separation 200 KHz Radio Channels 125

Transmission Rate 270 Kbits/s (Over Air Interface) Modulation Method GMSK (Gaussian Minimum Shift Keying)

Recommended by Groups organized by ETSI


GSM Architecture

BTS

GMSC/VLR

PSTNISDN

DataNetworks

Air interface

OSS

BTS

BTS MSC

BSCBSC

SSOMC

BSS

EIR

AUC

HLR


PART - II :GSM ArchitectureIt Includes following Subsystems:

1. Switching Subsystem(SS) is responsible for performing switching functions related to call processing & Subscriber related functions.

2. Radio Subsystem includes the equipments and functions related to the management of the connections on the radio path. It performs all radio related functions

3. Operations and Maintenance subsystemincludes the operation and maintenance of GSM equipment for the radio and network interface.


Network Architecture

BTS

GMSC/VLR

PSTNISDN

DataNetworks

Air interface

OSS

BTS

BTS MSC

BSCBSC

SSOMC

BSS

EIR

AUC

HLR

MS


Architecture of the GSM system• Several providers setup mobile networks

following the GSM standard within each country• Components

– MS (mobile station)– BS (base station)– MSC (mobile switching center)– LR (location register)

• Subsystems– RSS (radio subsystem): covers all radio aspects

• Base station subsystem– NSS (network and switching subsystem): call

forwarding, handover, switching– OSS (operation subsystem): management of the

Um

Abis

ABSS

radiosubsystem

MS MS

BTSBSC

BTS

BTSBSC

BTS

network and switching subsystem

MSC

MSC

Fixed partner networks

IWFISDNPSTN

PDN

SS

7

EIR

HLR

VLR

ISDNPSTN

GSM: system architecture

Radio subsystem

• Components– MS (Mobile Station)– BSS (Base Station Subsystem):

consisting of• BTS (Base Transceiver Station):

sender and receiver• BSC (Base Station Controller):

controlling several transceivers

• Interfaces– Um : radio interface– Abis : standardized, open interface

with 16 kbit/s user channels

– A: standardized, open interface with 64 kbit/s user channels

Um

Abis

A

BSS

radiosubsystem

network and switchingsubsystem

MS MS

BTSBSC MSCBTS

BTSBSC

BTSMSC


Network Subsystems

1. Network Subsystem(NSS) includes the equipments and functions related to end-to-end call.

2. Base Subsystem(BSS) includes the equipments and functions related to the management of the connections on the radio path.

3. Operations and Maintenance subsystem(OMC)includes the operation and maintenance of GSM equipment for the radio and network interface.


SS Components:

• Mobile Services switching Center (MSC)• Home Location Register (HLR)• Visitor Location Register (VLR)• Authentication Center(AUC)• Equipment Identity Register(EIR)


BSS Components:

• Base Station Controller (BSC)

• Base Transceiver (BTS)


GSM Network Structure

• GSM Service Area• PLMN Service Area• MSC Service Area• Location Area• Cells


GSMPLMN Service Area

MSC

MSC

MSC

MSC

VLR

VLRVLR

II

IVIII

I

VLR


GSMMSC Service Area

MSCVLRLA1

LA2LA3

LA6LA4 LA5


GSMCells

LA1

LA2LA3

LA6

LA4LA5

C1

C2

C3 C6

C5C4C=CELL

MSC/VLR C7


GSMRelation between areas in GSM

Location AreaCellArea served by a BTS

Location AreaMSC Service AreaPLMN Service AreaGSM Service Area


Typical Engineering Groups and Activities

RF Planning

Core Design

Site Planning

RF Design& Planning

Implementing Changes

Databse Management

Statitics Generation

Faults Management

OMC/NMC

Air InterfaceTroubleshooting

BTS Maintenance

O & M

RF and Parametric Tuning

RF Tests

Statistics Analysis

Optimization

Benchmarking

Performance Verification

Quality Assurance

Value Added Services

Transmission

Planning

Maintenance

Switching Operations

Engineering Customer CareMarketing


Search Area Selection

Site Physical Qualification

Coverage Prediction

Band Clearance

Test Transmission

Reject

Acquire

Action Steps Site Planning

RF Planning and Design – Site Planning


RF Planning and Design – Frequency PlanningGSM uses concept of cellsOne cell covers small part of networkNetwork has many cellsFrequency used in one cell can be usedin another cellsThis is known as Frequency Re-use

F=1

F=2F=3

F=4,8F=5,9

F=6,10

F=7

F=1

F=2F=3

F=4,8F=5,9

F=6,10

F=7F=1

F=2F=3

F=4,8F=5,9

F=6,10

F=7

ClustersF= 1,2,3,4,5,6,7,8,9,10

Co-Channel ( Re-use ) Cells

F1

F2

F3

F4

F1

F2

F3

F4

F2

F1

F2


Interference in GSM systems are classified into three major categories .

Co-Channel Interference

Adjacent Channel Interference

External Interference

Interference


Interference on a channel caused by another cell/mobile using the same frequency.C/Ic is the measure of co-channel interferenceGSM specifies the C/Ic threshold of 9dB for a service quality of 0.4% BER.9db also includes 2db implementation margin9db is decided considering the implementation of SynthesisedFrequency HoppingWithout SFH, the preferred threshold is 12 dB.

C / Ic 9 db

CIc

Co - Channel interference


CausesDistant Cells due to tight frequency re-use patterns.Distant Cells due to errors in frequency planning.Mulitpath from Distant cells( strong reflector, Water).C/Ic will degrade the Ec/No, so if Noise floor itself is high, then even a high value of C/Ic can deteriorate quality.

C Ic

Noise

ARFCN "N" ARFCN "N"

Co-Channel Interference


Interference caused when wanted and unwanted GSM RF channels co-exist.

C

Ia

GSM receivers are designed for an Adjacent Channel Suppression of minimum 18db at an offset of 200 Khz, 50db at 400 Khz and 58db at 600 Khz.

Adjacent Channel Interference


GSMLA Coding

MCC

LAI

LACMNC

3 digit 3 digit 2 Octets


GSMFunctions of Mobile Station

• Voice and data transmission• Frequency and time synchronization• Monitoring of power and signal quality

of the surrounding cells • Provision of location updates even

during inactive state• Equalization of multi path distortions


GSMMobile Station

• Portable, vehicle mounted, hand held• MS identified by unique IMEI (*#06#)• Shall display at least last ten received, dialled

and missed calls• Minimum talk time of 1hr 30 min. and standby

time of 80 hrs• 160 characters long SMS


GSMMobile Station - Power Levels

PowerClass

Max. PeakPower

Tolerance (dB)Normal Extreme

1 20W(43 dBm)

+/- 2 +/- 2.5

2 8W(39 dBm)

+/- 2 +/- 2.5

3 5W(37 dBm)

+/- 2 +/- 2.5

4 2W(33 dBm)

+/- 2 +/- 2.5

5 0.8W(29 dBm)

+/- 2 +/- 2.5


GSMSIM Card

• SIM Module• Unique Subscriber’s ID IMSI and ISDN• PIN• Key Ki, Kc and A3,A5 and A8 algorithms• SIM has CPU, ROM, RAM and EPROM


GSMMobile Identification Numbers• IMEI• MSISDN• IMSI• TMSI• MSRN


GSMMSISDN• Mobile Subscriber’s ISDN Number• The MSISDN is registered in the

telephone directory and used by the calling party for dialing.

CC=+91 NDC=94170 SN=12345

1 to 3 digits Variable Variable

MSISDN : not more than 15 digitsN(S)N


GSMIMSI• International mobile subscriber’s

Identity• The IMSI is an unique identity which is used

internationally and used within the network to identify the mobile subscribers.

• The IMSI is stored on the subscriber identity module (SIM), the HLR, VLR and AC database.


GSMIMSI

MCC MNC MSIN

3 digits 2 digits Not more than 9 digits

NMSI

IMSI : Not more than 15 digits

MSC in HLR Area (1); Pre/Post (1); Vendor ID (1); Running Counter=6


GSMTMSI• Temporary Mobile subscriber’s

Identity• The TMSI is an identity which guarantees

the integrity of the mobile subscribers on the radio interface.

• The VLR assigns a TMSI to each mobile subscribers entering the VLR area.


GSMMSRN

Mobile Station Roaming Number

• The MSRN is used in the GMSC to set up a connection to the visited MSC/VLR.


GSMIMEI• International Mobile Equipment Identity• The IMEI is an unique code allocated to each

mobile equipment. It is checked in the EIR.• IMEI check

•White List•Grey List•Black List


n BTS n BTS

BSC

BSC

BSC

MSC/VLR

RSSRSS

RADIO SUB SYSTEM (RSS)


GSMFUNCTION OF BTS -I

• Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna

• Transcoding and rate adaption Functionality

• Time and frequency synchronisation signals transmission.

• 11 power classes from .01 watts (Micro cell) to 320 watts (Umbrella cell)


GSMFUNCTIONS OF BSC-I

• It is connected to BTS and offloads MSC

• Radio resource management • Inter-cell handover • Reallocation of frequencies• Power control


GSMFUNCTION OF BTS -II• Frequency hopping

• Random access detection

• Uplink radio channel measurements

• BTS mainly consists of a set of transceivers (TRX). Can accommodate 1 to 7 TRX per Sector


GSMFUNCTIONS OF BSC-II• Time delay measurement of the received signals

from MS with respect to BTS clock.

• Performs traffic concentration to reduce the number of lines from BSC to MSC.

• Provide interface TCP/IP X.25 to the OMS


GSMMSC-BSS Configurations

BTSBTS

BTS

BTS BTS

BTS

A-bisBSC

BSS

Configuration -6 Multi - cell site = multi--BTS site

Many single cell sites

BSS

MSC

BTS

AA

A

Single - cell siteConfiguration -1

Multi - cell site (sector CellsConfiguration -5

MCC: Mobile Switching Centre

BSS: Base Station System

BSC: Base Station Controller

BTS: Base Transceiver Station

A-bis


Network and Switching Subsystem (NSS)

MSC

(PSTN)

VLR

HLR AUC

EIR

D

C

SS7 Signalling

Traffic Path

F

(BSS)

A

EOtherMSC


GSMMSC ( MOBILE SWITCHING CENTRE)• Manages communication between GSM & other

network .

• Call setup functions, basic switching are done.

• MSC takes into account the RR allocation in addition to normal exchange functions.

• MSC does gateway function while its customers roams to other network by using HLR /VLR .


GSMMSC Functions - I• Paging, specifically call handling

• Location updation.

• Handover management.

• Billing for all subscribers based in its area.

• Reallocation of frequencies to BTSs in its area to meet heavy demands.


GSMMSC Functions - II• Echo canceller operation control

• Signaling interface to databases like HLR, VLR.

• Gateway to SMS between SMS centers and subscribers

• Handle interworking function while working as GMSC


GSMVISITOR LOCATION REGISTER (VLR)-I• It controls those mobiles roaming in its area.

• VLR reduces the number of queries to HLR

• One VLR may be incharge of one or more LA.

• VLR is updated by HLR on entry of MS its area.

• VLR assigns TMSI which keeps on changing.

• IMSI detach and attach operation


GSMData in VLR• IMSI & TMSI• MSISDN • MSRN.• Location Area• Supplementary service parameters• MS category• Authentication Key


GSMHome Location Register(HLR)-I

• Reference store for subscriber’s parameters, numbers, authentication & Encryption values.

• Current subscriber status and associated VLR.

• Both VLR and HLR can be implemented in the same equipment in an MSC.

• one PLMN may contain one or several HLR.


GSM Home Location Register(HLR)-II• Permanent data in HLR• Data stored is changed only by man-machine.

• IMSI, MS-ISDN number.

• Category of MS ( whether pay phone or not )

• Roaming restriction ( allowed or not ).

• Supplementary services like call forwarding


GSMHome Location Register(HLR)-III

• Temporary data in HLR• The data changes from call to call & is dynamic

• MSRN

• RAND /SRES and Kc

• VLR address , MSC address.

• Messages waiting data used for SMS


GSMAUTHENTICATION CENTRE (AUC )-I

• AUC is a separate entity and physically included in HLR

• Protect against intruders in air interface

• Authentication (Ki) and ciphering (Kc) key are stored in this data base.

• Keys change randomly with each call

• Keys are never transmitted to MS on air Only calculated response are sent.


GSMEQUIPMENT IDENTITY REGISTER ( EIR )

• This data base stores IMEI for all registered mobile equipments and is unique to every ME.

• Only one EIR per PLMN.

• White list : IMEI, assigned to valid ME.• Black list : IMEI reported stolen• Gray list : IMEI having problems like faulty software,

wrong make of equipment etc.


The centralized operation of the various units in the system and functions needed to maintain the subsystems.

Dynamic monitoring and controlling of the network

Separate OMC-S and OMC-R for NSS and RSS

Operations and Maintenance Centre(OMC)


- O&M data function

- Configuration management

- Fault report and alarm handling

- Performance supervision/management

- Storage of system software and data

- Support GUI for operation and Maintenance

Functions of OMC


Mobile Terminated Call

PSTNcallingstation GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

45

6

7

8 9

10 1316

10 10

11 11 11

14 15

17

• 1: calling a GSM subscriber• 2: forwarding call to GMSC• 3: signal call setup to HLR• 4, 5: connect with current VLR• 6: forward responsible

MSC to GMSC• 7: forward call to current MSC• 8, 9: get current status of MS• 10, 11: paging of MS• 12, 13: MS answers• 14, 15: security checks• 16, 17: set up connection

3

11 12


Mobile Originated Call

PSTN GMSC

VLR

BSS

MSC

MS1

10

2

6 53 4

97 8

• 1, 2: connection request

• 3, 4: security check• 5-8: check resources

(free circuit)• 9-10: set up call


MTC/MOCBTSMS

paging requestchannel requestimmediate assignmentpaging responseauthentication requestauthentication responseciphering commandciphering completesetupcall confirmedassignment commandassignment completealertingconnectconnect acknowledgedata/speech exchange

BTSMS

channel requestimmediate assignmentservice requestauthentication requestauthentication responseciphering commandciphering completesetupcall confirmedassignment commandassignment completealertingconnectconnect acknowledgedata/speech exchange

MTC MOC


4 types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4


Handover decisionreceive level

BTSold

receive levelBTSold

MS MS

HO_MARGIN

BTSold BTSnew


GSMSecurity Management• Four basic security services provided by

GSM

• Anonymity : TMSI Assignment• Authentication• Encryption: • PIN


GSMGeneric Authentication Process

A3 A3

Ki KiRAND

RAND

CompareSRES

SRES

Response

IMSI IMSI

Yes/No

Radio Path


GSMEncryption Process

Encryption ProcessKEY

Plain Text

Cipher-text


GSM - authentication

A3

RANDKi

128 bit 128 bit

SRES* 32 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

SRES32 bit

mobile network SIM

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response


GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS) MS with SIM

AC

BTS

SIM

A5

Kc64 bit

A5MS

data data

cipherkey


GSMAUTHENTICATION & ENCRIPTION

• AUCDatabase

Generation of Random

NumberRAND RAND

IMSI1

IMSI3

IMSI2

ki1

ki2ki3

RANDSRESKcAlgorithm for

CipheringA8

Algorithm for AuthenticationA3

Kc64 bits

SRES32 bits

HLR


Thank You

gsm system architecture

Documents