Integrated Communication Systems Group

Ilmenau University of Technology

Mobile Network Evolution – Part 1 GSM and UMTS

GSM Cell layout Architecture Call setup Mobility management Security

GPRS Architecture Protocols QoS

EDGE

UMTS

Architecture

2

Integrated Communication Systems Group

Advanced Mobile Communication Networks

2G to 3G Evolution: GSM - GPRS - UMTS

GSM RAN

Base station

Base station controller

Base station

Base station

MSC

ISDN

GSM Core (Circuit switched)

HLR AuC EIR

GMSC

TransmissionATM based

GSM

3

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network) several providers setup mobile networks following the GSM standard

within each country

GSM system comprises 3 subsystems

Radio Access Network: covers all radio aspects MS (mobile station) BSS (base station subsystem) or RAN (radio access network)

BTS (base transeiver station) BSC (base station controller)

Core Network: call forwarding, handover, switching MSC (mobile services switching center) LR (location register): HLR and VLR OMC (operation and maintenance centre) AuC (authentication centre) EIR (equipment identity register)

4

Integrated Communication Systems Group

Advanced Mobile Communication Networks

possible radio coverage of the cell

idealized shape of the cell cell

segmentation of the area into cells

GSM: cellular network

use of several carrier frequencies different frequency in neighboring cells cell radius varies from some 100 m up to 35 km depending on

user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend

on geography) if a mobile user changes cells

-> handover of the connection to the neighbor cell

5

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Cellular systems: Frequency planning I Frequency reuse only beyond a certain distance between base stations Typical (hexagon) model: reuse-3 cluster: reuse-7 cluster:

Other regular pattern: reuse-19 Frequency reuse pattern determines the experienced SIR Fixed frequency assignment:

certain frequencies are assigned to a certain cell problem: different traffic load in different cells

Dynamic frequency assignment: base station chooses frequencies depending on the frequencies already used in

neighbor cells Frequency Hopping (fixed or random sequence of frequencies)

Improves quality for slow moving or stationary users (frequency diversity) Reduces impact of intercell interference by statistical averaging

f4 f5

f1 f3

f2

f6

f7

f4 f5

f1 f3

f2

f6

f7

f4 f5

f1 f3

f2

f6

f7 f2

f1 f3

f2

f1 f3

f2

f1 f3

6

Integrated Communication Systems Group

Advanced Mobile Communication Networks

GSM: Air Interface

FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

123 124 . . .

890 MHz 915 MHz

123 124 . . .

935 MHz 960 MHz

200 kHz

Uplink Downlink

frequency

TDMA (Time Division Multiple Access)

time

Downlink

8 7 6 5 4 3 2 1

4,615 ms = 1250 bit

Uplink

8 7 6 5 4 3 2 1

7

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Framing Modulation (GMSK)

GSM: Voice Coding

Voice coding Channel coding

Framing Modulation (GMSK)

114 bit/slot 114 + 42 bit

Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot) Training sequence: select the best radio path in the receiver and train equalizer Tail: needed to enhance receiver performance Flag S: indication for user data or control data

1 2 3 4 5 6 7 8

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs 577 µs

tail user data Training S guard space S user data tail

guard space

3 bits 57 bits 26 bits 57 bits 1 1 3

8

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Mobile Terminated Call (MTC)

PSTN calling station GMSC

HLR VLR

BSS BSS BSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

13 16

10 10

11 11 11

14 15

17

1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR 6: forward responsible

MSC to GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection

9

Integrated Communication Systems Group

Advanced Mobile Communication Networks

RA

RA

RA RA

RA

RA RA

RA

RA

Location Update

Location Update

Location Update

Location Update

Location Update

Location Management / Mobility Management

The issue: Compromise between minimizing the area where

to search for a mobile minimizing the number of

location updates

Solution 1: Large paging area

Solution 2: Small paging area

Paging Signalling Cost

Paging Area Update Signalling Cost

TOTAL Signalling Cost

∑ ∑ +

=

10

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Handover

The problem: Change the cell while communicating

Reasons for handover: Quality of radio link

deteriorates Communication in other cell

requires less radio resources Supported radius is

exceeded (e.g. Timing advance in GSM)

Overload in current cell Maintenance

Link

qua

lity

Link to cell 1 Link to cell 2 time

cell 1

cell 2

Handover margin (avoid ping-pong effect)

cell 1 cell 2

11

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Handover procedure (change of BSC)

HO access

BTSold BSCnew

measurement result

BSCold

Link establishment

MSC MS measurement report

HO decision HO required

BTSnew

HO request

resource allocation ch. activation

ch. activation ack HO request ack HO command HO command HO command

HO complete HO complete clear command clear command

clear complete clear complete

„Make-before-break“ strategy

make

break

12

Integrated Communication Systems Group

Advanced Mobile Communication Networks

GSM - authentication

A3

RAND Ki

128 bit 128 bit

RAND

SRES* =? SRES

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES

Authentication Request (RAND)

Authentication Response (SRES 32 bit)

mobile network

AuC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response

SRES* 32 bit

Challenge-Response: • Authentication center provides RAND to Mobile • AuC generates SRES using Ki of subscriber and

RAND via A3 • Mobile (SIM) generates SRES using Ki and RAND • Mobile transmits SRES to network (MSC) • network (MSC) compares received SRES with one

generated by AuC

13

Integrated Communication Systems Group

Advanced Mobile Communication Networks

GSM - key generation and encryption

A8

RAND Ki

128 bit 128 bit

Kc 64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypted data

mobile network (BTS)

MS with SIM

AuC

BTS

SIM

A5

Kc 64 bit

A5 MS

data data

cipher key

Ciphering: • Data sent on air interface ciphered for security • A8 algorithm used to generate cipher key • A5 algorithm used to cipher/decipher data • Ciphering Key is never transmitted on air

14

Integrated Communication Systems Group

Advanced Mobile Communication Networks

2G to 3G Evolution: GSM - GPRS - UMTS

GPRS Core (Packet Switched)

SGSN

GGSN

Inter-net

GSM RAN

Base station

Base station controller

Base station

Base station

MSC

ISDN

GSM Core (Circuit switched)

HLR AuC EIR

GMSC

TransmissionATM based

GSM+GPRS

15

Integrated Communication Systems Group

Advanced Mobile Communication Networks

GPRS (General Packet Radio Service)

Introducing packet switching in the network Using shared radio channels for packet transmission over the air:

multiplexing multiple MS on one time slot flexible (also multiple) allocation of timeslots to MS

(scheduling by PCU Packet Control Unit in BSC or BTS) using free slots only if data packets are ready to send

(e.g., 115 kbit/s using 8 slots temporarily) standardization 1998, introduction 2001 advantage: first step towards UMTS, flexible data services

GPRS network elements GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN)

interworking unit between GPRS and PDN (Packet Data Network) SGSN (Serving GSN)

supports the MS (location, billing, security) HLR (GPRS Register – GR)

maintains location and security information

16

Integrated Communication Systems Group

Advanced Mobile Communication Networks

carrier TS 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7

Multiplexing

Multislot capability

GPRS: Multiplexing and multislot allocation

17

Integrated Communication Systems Group

Advanced Mobile Communication Networks

GPRS services

End-to-end packet switched traffic (peak channel rates) 28 kbps (full use of 3 time slots, CS-1: FEC) 171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug.

2002) 95 kbps (for both up and downlink) Assumptions: 4/12 reuse, realistic RF conditions, random traffic Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control – FEC) CS 1: 9.05 Kbps/slot CS 2: 13.4 Kbps/slot CS 3: 15.6 Kbps/slot CS 4: 21.4 Kbps/slot (no FEC)

Problems and limits IP-based network => high latency, no guarantees Limited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4) Latency/flow control problems with TCP

18

Integrated Communication Systems Group

Advanced Mobile Communication Networks

EDGE (Enhanced Data Rates for GSM Evolution) Enhanced spectral efficiency depends on: Size of frequency band Duration of usage Level of interference with others (power) EDGE Technology: EDGE can carry data speeds up to 236.8 kbit/s for 4

timeslots (theoretical maximum is 473.6 kbit/s for 8 timeslots)

Adaptation of modulation depending on quality of radio path

GMSK (GSM standard – 1 bit per symbol) 8-PSK (3 bits per symbol)

Adaptation of coding scheme depending on quality of radio path (9 coding schemes) Gain: data rate (gross) up to 69,2kbps (compare to

22.8kbps for GSM) complex extension of GSM!

NodeB

UE 1

UE 2

Near-far problem

19

Integrated Communication Systems Group

Advanced Mobile Communication Networks

EDGE – Adaptive Modulation and Coding Schemes Scheme Modulation Maximum

rate [kb/s]Code Rate Family

MCS-9 59.2 1.0 AMCS-8 54.4 0.92 AMCS-7 44.8 0.76 BMCS-6 29.6 / 27.2 0.49 AMCS-5

8PSK

22.4 0.37 BMCS-4 17.6 1.0 CMCS-3 14.8 / 13.6 0.80 AMCS-2 11.2 0.66 BMCS-1

GMSK

8.8 0.53 C

20

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Payload for GPRS and EDGE

21

Integrated Communication Systems Group

Advanced Mobile Communication Networks

2G to 3G Evolution: GSM - GPRS – UMTS R99/R3

GPRS Core (Packet Switched)

SGSN

GGSN

Inter-net

GSM RAN

Base station

Base station controller

Base station

Base station

UTRAN

Radio network controller

Base station Base station

Base station

MSC

ISDN

GSM Core (Circuit switched)

HLR AuC EIR

GMSC

ATM based

GSM+GPRS+UMTS R99

22

Integrated Communication Systems Group

Advanced Mobile Communication Networks

2G to 3G Evolution: GSM - GPRS - UMTS R5 - IMS

GPRS Core (Packet Switched)

SGSN

GGSN

Inter-net

GSM RAN

Base station

Base station controller

Base station

Base station

UTRAN

Radio network controller

Base station Base station

Base station

IP based

3G Core

GERAN GERAN + UMTS R5 + IMS

23

Integrated Communication Systems Group

Advanced Mobile Communication Networks

Differences of GSM/GPRS Compared to WLAN Systems

Spectrum management and utilization coverage and interference management due to cell planning capacity and load management due to admission control and QoS support flexible cell size simplifies cost-efficient nationwide deployment Mobility management fast, lossless HO due to make-before-break energy efficiency due to paging support, etc. General control structures and control philosophy high reliability and QoS guaranties due to centralized/infrastructure-based

management and control of all resources Energy high energy cost on network side, low cost on mobile due to sleep cycles Customer relations monthly/bi-yearly contracts, pay per service security due to preshared credentials Implementation simpler implementation on SDR, e.g. GNUradio