1、Southern Methodist University Fall 2003EETS 8316/NTU CC745-NWireless NetworksLecture 4: GSMInstructor: Jila Serajemail: tel: 214-505-6303ReviewIn the last meeting we discussedHandoff, challenges, solutionsAnchor MSC, path optimizationNorth American Numbering PlanNumbers in GSM networkReview, Handoff

2、Movement into a different cell requires MTSO to automatically transfer call to another base station without interruptionTwo types of handoff, hard handoff and soft handoffBSC decides on handoff in the first generation of mobile networkBSC together with handset decides on handoff, MAHOReview, Handoff

3、, cont.Phases of handoff are: handoff decision, resource reservation, execution, clearing resources.Handoff challenges are: Performing handoff before signal strength becomes too low, do not perform unnecessary handoff, resource allocation, inter-MSC/inter-system handoff, handset capabilitiesAnchor M

4、SC remains in the call Review, Handoff, cont.BSBSAnchor MSCNew Serving MSC PSTN What happens if we go back to the anchor MSC? IS-41 has handoff back facility What if a third MSC gets involved? Path minimization process Review, Handoff, cont.BSBSAnchor MSCTarget MSCServing MSCBSPSTNHANDTHIRDFACDIRFAC

5、RELRFACDIRR1324HANDTHIRDR657MSONCH108FACREL9Review, Handoff, cont.BSBSAnchor MSCMSCBSPSTNCall Path after path minimization processNew Serving MSCReview, Registration, cont.Registration, Power up/down, periodical, New system, Call originationMS Service Qualificationvalidation information (billing)Ser

6、vice pro, features, restrictionsReview, Roaming, cont.MS Location Update occurs at registration, deregistration, new location area, new systemDeregistration is either triggered by mobile (power down registration), by MSC for inactivity, by HLR at registration in another MSC.Review, Border CaseIf reg

7、istration happens in several MSC, HLR decides which one is valid. If registration happens in several BS, MSC determines which one is validReview, PagingPaging is used when there is a terminating call to a mobile station. A termination call is routed towards gateway MSC, Gateway MSC consults HLR, HLR

8、 request paging from visiting MSC, visiting MSC pages the handset, when page response is received HLR is informed, HLR send the visiting MSC address to gateway MSC that routes the call to visiting MSC and the terminating call is established.Review, Paging, cont.If multiple MSC responds to the page r

9、equest, HLR chooses the valid page response Review, North American Numbering PlanNorth American Numbering Plan consists of 10 digits, NPA-NXX-XXXXThere is no way for a switch to identify that a number belongs to a mobile subscriber, nor can it identify the network provider.Mobile network provider “b

10、uy” a certain number series in each area for their users.Therefore we can not bill a caller to a mobile user for the air usage. They do it in other countries!Review, Primer on RFThe radio frequencies are grouped into bands. Each set of bands are dedicated to different purposes by FCC Each frequency

11、is logically divided into time slots for communication between mobile station and the base station.Some time slots are reserved for user traffic, such as voice and data and other for signaling purposes.Review, Cellular DCCH StructureDCCHReverseForwardRACHSPACHBCCHSCFReservedPCHARCHSMSCHFBCCHEBCCHSBC

12、CHGSM General ArchitectureBSSMSCVLRHLREIRAUCMTTEMSUmAPSTNBSCBTSBTSOMCNMCADCOSSBSSMSGSM Public land mobilenetwork (PLMN)OSS: operation subsystemBSS: base station subsystemMS: mobile stationAbisGSMSeveral first generation analog cellular systems in Europe but incompatible - limited roaming1987-1989 ET

13、SI standards for pan-European Global System for Mobile Communications (GSM, originally Group Special Mobile) at 900 MHz1992 GSM is launched1990-1993 Standards for Digital Cellular System at 1800 MHz (DCS 1800, recently renamed GSM 1800; US version is PCS 1900)GSM, cont.Objectives:Broad offering of s

14、peech and data servicesCompatible with wireline networks, eg, ISDNAutomatic roaming and handoffHighly efficient use of frequency spectrumSupport for different types of mobile terminal equipment (eg, cars, portable handsets)GSM, cont.Objectives:Digital signaling and transmissionLow cost infrastructur

15、e and terminal equipmentGSM, cont.13 recommendationsR.00: PreambleR.01: General structure of recommendations, GSM overviewR.02: Service aspects: types of servicesR.03: Network aspects: architecture, call routing, performance objectivesR.04: Mobile/base station interface and protocolsGSM, cont.R.05:

16、Physical layer on radio path: multiple access, channel coding, modulation, transmissionR.06: Speech coding aspectsR.07: Terminal adaptors for mobile stationsR.08: Base station and mobile switching center (MSC) interfaceR.09: Interworking with PSTN and packet data networksGSM, cont.R.10: Service inte

17、rworking, short message serviceR.11: Equipment specificationR.12: Operation and maintenance, tariffs, traffic administrationGSM, cont.Summary of featuresChannel bandwidth200 kHzMultiple accessTDMAUsers/carrier8Speech coding rate13 kb/sFEC coded speech rate22.8 kb/sGSM, cont.Summary of service qualit

18、y requirementsSpeech intelligibility90%Max one-way delay90 msMax handoff gap150 ms if intercellTime to alert mobile ofinbound cell4 sec first attempt, 15 sec final attemptRelease time to callednetwork2 secConnect time to callednetwork4 secGSM General Architecture, cont.Mobile station (MS) communicat

19、es to base stations through radio interface UmMobile termination (MT) supports physical channel between MS and base station (radio transmission, channel coding, speech coding)GSM General Architecture, cont.Terminal equipment (TE), eg, telephone set. Contains terminal/user-specific data in form of sm

20、art card (subscriber identify module or SIM card), plugs into any GSM terminal like credit card and identifies user to network for personal mobility (in addition to terminal mobility) and securityGSM General Architecture, cont.Base station Subsystem (BSS) communicates with mobile switching center th

21、rough network interface ABase Transceiver Station (BTS) handles channel allocation, signaling, frequency hopping, handover initiation, etc. BTS communicates with BSC using Abis interfaceGSM General Architecture, cont.Base station controller (BSC) manages radio channels, paging, handoff for several B

22、TSsBSC communicates with MSC using A interfaceMobile switching center (MSC) is gateway to PSTN and packet data networksPerforms switching, paging functions, MS location updating, handoff control, etc.GSM General Architecture, cont.Home location register (HLR) stores subscriber info and part of MSs l

23、ocation info to route incoming calls to visitor location register (VLR) where mobile is roamingVLR registers users roaming in its area and assigns roaming numbersGSM General Architecture, cont.Authentication center (AUC) is accessed by HLR to authenticate a user for service. It contains authenticati

24、on and encryption keys for subscribersEquipment identity register (EIR) allows stolen or fraudulent mobile stations to be identified GSM General Architecture, cont.Operation subsystem (OSS) contains: operations and maintenance center (OMC), network management center (NMC), and administration center

25、(ADC) . These network elements work together to monitor, control, maintain, and manage the networkGSM Logical and Physical ChannelsUm interface: various logical channels are mapped to physical channelsA physical channel is a timeslot with timeslot number in a sequence of TDMA frames8 physical channe

26、ls mapped onto 8 timeslots within TDMA frame per frequency carrierGSM Physical Channels:Frequency 124Frequency 2Frequency 1Ch 1Timeslot 1Ch 2Ch 3Ch 4Ch 5Ch 6Ch 7Ch 8Ch 1Ch 2Ch 3Ch 4Ch 5Ch 6Ch 7Ch 8Ch 1Ch 2Ch 3Ch 4Ch 5Ch 6Ch 7Ch 8:2345678TDMA frame = 4.615 msGSM Logical Channel StructureCCH TCH/FTCH/

27、HBCHCCCHDCCHFCCHSCHBCCHPCHAGCHRACHTCH CBCHACCHSDCCHFACCHSACCHGSM Logical Channels3 groups of logical channels, TCH, CCH and CBCHTCH is used to carry voice or data trafficCCH is used for control functionsCBCH is used for broadcast functionsGSM Logical Channels, cont.Logical traffic channels = full ra

28、te (TCH/F) at 22.8 kb/s or half rate (TCH/H) at 11.4 kb/sPhysical channel = full rate traffic channel (1 timeslot) or 2 half rate traffic channels (1 timeslot in alternating frames)Full rate channel may carry 13 kb/s speech or data at 12, 6, or 3.6 kb/sHalf rate channel may carry 6.5 kb/s speech or

29、data at 6 or 3.6 kb/sGSM Logical Channels, cont.CCH consists of 3 groups of logical control channels, BCH, CCCH and DCCHBCH (broadcast channel): point-to-multipoint downlink only. Contains three sub-channels, BCCH, FCCH and SCHBCCH (broadcast control channel): send cell identities, organization info

30、 about common control channels, cell service available, etcGSM Logical ChannelsFCCH (frequency correction channel): send a frequency correction data burst containing all zeros to effect a constant frequency shift of RF carrierSCH (synchronization channel): send TDMA frame number and base station ide

31、ntity code to synchronize MSsGSM Logical Channels, contCCCH (common control channel): Consists of three sub-channels, PCH, AGCH and RACH. This channels is used for paging and access PCH (paging channel): to page MSsAGCH (access grant channel): to assign MSs to stand-alone dedicated control channels

32、for initial assignmentRACH (random access channel): for MS to send requests for dedicated connections GSM Logical Channels, contDCCH (dedicated control channel): bi-directional point-to-point - main signaling channels. Consist of two sub-channels, SDCCH and ACCHSDCCH (stand-alone dedicated control c

33、hannel): for service request, subscriber authentication, equipment validation, assignment to a traffic channelGSM Logical Channels, contSACCH consist of two sub-channels, SACCH and FACCHSACCH (slow associated control channel): for out-of-band signaling associated with a traffic channel, eg, signal s

34、trength measurementsFACCH (fast associated control channel): for preemptive signaling on a traffic channel, eg, for handoff messagesOSI Model for SS7TCAPMAPISUPINAPMUPOMAPLayer 4-7SCCPMTPLayer 3Signaling link function, Signaling link physical requirementLayer 1-2GSM Interfaces, cont.RFLAPDMMRRMCMRRM

35、RFLAPDLAPDRFRRMRFLAPDLAPDRFSCCPRFLAPDMMRRMCMSCCPAir InterfaceUmAbisA GSM Protocol LayersRF : Physical LayerLAPD: Link Layer, ISDN protocol basedSCCP: Signal Connection Control Layer, part of link layerRR: Radio ResourceMM: Mobility ManagementCC: Call ControlGSM Network LayerNetwork layer consists of

36、 3 sublayersRadio resource management (RR) sublayerEstablishment, maintenance, and termination of radio channel connectionsMobility management (MM) sublayerRegistration, authentication, and location trackingCall control (CC) sublayerEstablishment, maintenance, and termination of circuit-switched cal

37、lsGSM InterfacesMSCAUCBase Station SubsystemBSSSwitching SystemBSSAPVLRHLREIRMAPMAPMAPVLRMAPGSM Interfaces, contMSBTSBSCLAPDBase Station SubsystemBSSSwitching SystemBSSAPGSM Numbers International mobile station equipment identity (IMEI). IMEI= TAC + FAC + SNR + SP TAC = Type Approval Code, 6 decimal

38、s FAC = Final Assembly Code, 6 decimals, assigned by manufacturer SNR = Serial Number, 6 decimals, assigned by manufacturer SP = Spare, 1 decimal placeEIR has while, black and optionally grey list.GSM NumbersInternational mobile station equipment identity (IMEI). IMEI= TAC + FAC + SNR + SP TAC = Typ

39、e Approval Code, 6 decimals FAC = Final Assembly Code, 6 decimals, assigned by manufacturer SNR = Serial Number, 6 decimals, assigned by manufacturer SP = Spare, 1 decimal placeEIR has while, black and optionally grey listGSM Numbers, contInternational mobile Subscriber Identity (IMSI). Stored on th

40、e SIM (Subscriber Identity Module) card. IMSI is obtained at the time of subscription. IMSI is not made public.IMSI = MCC + MNC + MSINMCC = Mobile Country Code, 3 decimalsMNC = Mobile Network Code, 2 decimalsGSM Numbers, contMSIN = Mobile Subscriber Identification Number, maximum 10 decimal digitsMo

41、bile Station ISDN number (MSISDN), is the real phone number of the subscriber. Stored in HLR and on SIM cardMSISDN = CC + NDC + SNCC = Country Code, up to 3 decimalsGSM Numbers, contNDC = National Destination Code, typically 2-3 decimals SN = Subscriber Number, maximum 10 decimals.Mobile Station Roa

42、ming Number (MSRN), same format as MSISDN. A temporary location dependent ISDN number.Is assigned in two cases, at registration or at call set up.GSM Numbers, contLocation Area Identity (LAI). Regularly sent on BCCH LAI = CC + MNC + LAC, LAC = Location Area Code, max 5 decimals (FFFFhex).Temporary M

43、obile Subscriber Identity (TMSI). Stored only in the VLR and SIM card. Consists of 4*8 bits excluding value FFFF FFFFhexGSM Numbers, contTMSI has only local meaning and can be defines according to operators specifications.LAI + TMSI uniquely identifies the user, I.e. IMSI is no longer needed for ong

44、oing communicationGSM Numbers, cont.Local Mobile Subscriber Identity (LMSI). Created in VLR and stored in HLR. Like TMSI is operator defined. Used in communication with VLR to speed the search for mobile records.Speed is essential to achieve short call setup times.GSM Numbers, contGlobal Cell Id = L

45、AI + CICI = Cell id, unique id within the LAI. Maximum 2*8 bitsBase Transceiver Station Identity Code (BSIC) = NCC + BCCGSM Numbers, contBSIC is broadcast periodically by the base station on the synchronization channel. NCC = Network Color Code, 3 bitsBCC = Base Station Color Code, 3 bitsGSM Roaming

46、 From Another PLMNVLR registers users roaming in its areaRecognizes mobile station is from another PLMNIf roaming is allowed, VLR finds the mobiles HLR in its home PLMNVLR constructs a global title from IMSI to allow signaling from VLR to mobiles HLR via public telephone networkGSM Roaming, cont.VLR

47、 registers users roaming in its areaVLR generates a mobile subscriber roaming number (MSRN) used to route incoming calls to mobile stationMSRN is sent to mobiles HLRGSM Roaming, contVLR containsMSRNTMSILocation area where mobile station has registeredInfo for supplementary services (if any)IMSIHLR o

48、r global titleLocal identity for mobile station (if any)GSM Security 3 security problems: unauthorized access, privacy from eavesdropping, protection of subscriber identity/locationUnauthorized (fraudulent) accessGSM handsets must be presented with a subscriber identity module (SIM)SIM must be valid

49、ated with personal identification number (PIN)GSM Security, cont Unauthorized (fraudulent) accessSIM also stores subscriber authentication key, authentication algorithm, cipher key generation algorithm, encryption algorithmDuring registration (when roaming), mobile station receives “challenge” and u

50、ses authentication key and authentication algorithm to generate “challenge response” to verify users identityGSM Security, contPrivacy from eavesdroppingTemporary encryption key is used for privacy of data, signaling, and voiceInfo is encrypted before transmissionGSM Security, contAnonymity of users

51、Supported by temporary mobile subscriber ID (TMSI)When registered, mobile station sends globally-unique international mobile subscriber ID (IMSI) to networkNetwork assigns TMSI for use during call - IMSI is not sent over radio linkGSM Security, contAnonymity of usersOnly network and mobile station k

52、now true identityNew TMSI is assigned when roam into new areaGSM Security, cont.Fetched triplets are stored in VLREvery call uses up one triplet (discarded)Another set must be fetched when exhaustedVisited systemRegistration requestIMSI/TMSI identifies user, LAI points to old VLR,requests data toaut

53、henticate user IMSI/TMSI + LAISubscriber dataOld VLRAssignmentWireless personal communications, Chapter 7Rappaport what pagesGSM Security, cont.Visited systemChallengeRequests tripletsfrom home system,chooses a tripletCalculatesresponseby authen-ticationalgorithmChallenge responseCompares to storedr

54、esponse in triplet, registration successfulif matchesNew TMSIAcknowledgeAssigns new TMSIGSM Security, cont.Visited systemRegistrationcancelLocation updateAcknowledgeHLROld VLRGSM Handoffs3 types of handoffsIntra-BSS: if old and new BTSs are attached to same base stationMSC is not involvedIntra-MSC:

55、if old and new BTSs are attached to different base stations but within same MSCInter-MSC: if MSCs are changedGSM Intra-MSC HandoffMobile station monitors signal quality and determines handoff is required, sends signal measurements to serving BSSServing BSS sends handoff request to MSC with ranked list of qualified target BSSsMSC determines that best candidate BSS is under its control (assumed here)MSC reserves a trunk to target BSSGSM Intra-MSC Handoff, cont.Target BSS selects and reserves radio channels for new connection, sends Ack to MSCMSC notifies serving BSS to begin handoff, includi