2g mobile communication systems
TRANSCRIPT
2G Mobile Communication Systems2G Review: GSM
ServicesArchitecture ProtocolsCall setupMobility managementSecurity
HSCSD
GPRSArchitectureProtocolsQoS
EDGE
UMTS Networks 2Andreas Mitschele-Thiel 9-May-03
References
Jochen Schiller: Mobile Communications (German and English), Addison-Wesley, 2000(most of the material covered in this chapter is based on the book)
Michel Mouly, Marie-Bernadette Pautet: The GSM System for Mobile Communications. Telecom Pub, Juni 1992
Jörg Eberspaecher, u. a.: GSM Switching, Services and Protocols. John Wiley and Sons Ltd, 2001
Siegmund Redl, u. a.: GSM and Personal Communications Handbook. Artech House, 1998
Gunnar Heine: GSM Networks: Protocols, Terminology, and Implementation. Artech House Mobile Communications Library. Artech House Publishers, 1998
UMTS Networks 3Andreas Mitschele-Thiel 9-May-03
GSM: Overview
formerly: Groupe Spéciale Mobile (founded 1982)
now: Global System for Mobile Communication
Pan-European standard (ETSI, European Telecommunications Standardisation Institute)
simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations
seamless roaming within Europe possible
today many providers all over the world use GSM (more than 170 countries in Asia, Africa, Europe, Australia, America)
more than 700 million subscribers
more than 70% of all digital mobile phones use GSM
in Germany: GSM900 (D1 and D2, 2x25MHz) and DCS1800 (E-plus and O2, 2x75MHz)
over 10 billion SMS per month in Germany, > 200 billion/month worldwide
UMTS Networks 4Andreas Mitschele-Thiel 9-May-03
GSM compared to 1G Systems
Communication mobile, wireless communication; support for voice and data services
Total mobility international access, chip-card enables use of access points of different providers
Worldwide connectivityone number, the network handles localization
High capacity better frequency efficiency, smaller cells, more customers per cell
High transmission qualityhigh audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e.g. from cars, trains, etc.)
Security functions access control, authentication via chip-card (SIM) and PIN
UMTS Networks 5Andreas Mitschele-Thiel 9-May-03
GSM: Mobile Services
GSM offersseveral types of connections
voice connectionsdata connectionsshort message service
multi-service options (combination of basic services)
Three service domainsBearer ServicesTeleservicesSupplementary Services
transitnetwork
(PSTN, ISDN)
source/destination
networkTE
R, S (U, S, R)Um
MT
MSbearer services
GSM-PLMN TE
teleservicesPLMN: Public Land Mobile NetworkPSTN: Public Switched Telephone NetworkISDN: Integrated Services Digital Network
MS: Mobile StationMT: Mobile Termination (radio-specific part)TE: Terminal
UMTS Networks 6Andreas Mitschele-Thiel 9-May-03
Bearer Services
Telecommunication services to transfer data between access points
Specification of services up to the terminal interface (OSI layers 1-3)
Different data rates for voice and data (original standard)
data service (circuit switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s
asynchronous: 300 - 1200 bit/s
data service (packet switched)
synchronous: 2.4, 4.8 or 9.6 kbit/s
asynchronous: 300 - 9600 bit/s
UMTS Networks 7Andreas Mitschele-Thiel 9-May-03
Teleservices
Telecommunication services that enable voice communication via mobile phones
mobile telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz emergency numbercommon number throughout Europe (112); mandatory for all serviceproviders; free of charge; connection with the highest priority (preemption of other connections possible)multinumberingseveral ISDN phone numbers per user possible
Non-Voice Teleservicesgroup 3 faxvoice mailbox (implemented in the GSM network)Short Message Service (SMS)alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS
UMTS Networks 8Andreas Mitschele-Thiel 9-May-03
Supplementary services
Services in addition to the basic services
cannot be offered stand-alone
similar to ISDN services besides lower bandwidth due to the radio link
may differ between different service providers, countries and protocol versions
Important services
identification: forwarding of caller number
suppression of number forwarding
automatic call-back
conferencing with up to 7 participants
locking of the mobile terminal (incoming or outgoing calls)
...
UMTS Networks 9Andreas Mitschele-Thiel 9-May-03
Architecture of the GSM system
GSM is a PLMN (Public Land Mobile Network)several providers setup mobile networks following the GSM standard within each country
GSM system comprises 3 subsystemsRSS (radio subsystem): covers all radio aspects
MS (mobile station)BSS ( base station subsystem)
BTS (base transeiver station)BSC (base station controller
NSS (network and switching subsystem): call forwarding, handover, switching
MSC (mobile switching center)LR (location register): HLR and VLR
OSS (operation subsystem): management of the networkOMC (operation and maintenance centre)AuC (Authentication centre)EIR (Equipment indentity register)
UMTS Networks 10Andreas Mitschele-Thiel 9-May-03
GSM: overview
MSC MSC
GMSC
OMC, EIR, AUC
VLR
HLR
VLR
fixed networkNSSwith OSS
BSC
BSC
RSS
UMTS Networks 11Andreas Mitschele-Thiel 9-May-03
GSM: elements and interfaces
NSS
MS MS
BTS
BSC
GMSC
IWF
OMC
BTS
BSC
MSC MSC
Abis
Um
EIR
HLR
VLR VLR
A
BSS
PDN
ISDN, PSTN
RSS
radio cell
radio cell
MS
AUCOSS
signaling
O
UMTS Networks 12Andreas Mitschele-Thiel 9-May-03
GSM: system architecture
radiosubsystem
Um
Abis
ABSS
BTSBSC
BTS
MS MS
BTSBSC
BTS
network and switching subsystem
fixedpartner networks
MSC
MSCIWF
ISDNPSTN
SS7
EIR
HLR
VLR
ISDNPSTN
PS-PDNCS-PDN
UMTS Networks 13Andreas Mitschele-Thiel 9-May-03
System architecture: radio subsystem
ComponentsMS (Mobile Station)BSS (Base Station Subsystem):consisting of
BTS (Base Transceiver Station):sender and receiverBSC (Base Station Controller):controlling several transceivers
InterfacesUm: radio interfaceAbis: standardized, open interface with 16 kbit/s user channelsA: standardized, open interface with 64 kbit/s user channels
Um
Abis
A
BSS
radiosubsystem
network and switchingsubsystem
MS MS
BTSBSC MSC
BTS
BTSBSC
BTSMSC
UMTS Networks 14Andreas Mitschele-Thiel 9-May-03
System architecture: network and switching subsystem
Components• MSC (Mobile Services Switching
Center):• IWF (Interworking Functions)
• ISDN (Integrated Services Digital Network)
• PSTN (Public Switched Telephone Network)
• PS-PDN (Packet Switched Public Data Network)
• CS-PDN (Circuit Switched Public Data Network)
Databases• HLR (Home Location Register)• VLR (Visitor Location Register)• EIR (Equipment Identity Register)
networksubsystem
MSC
MSC
fixed partnernetworks
IWF
ISDNPSTN
PS-PDNCS-PDN
SS7
EIR
HLR
VLR
ISDNPSTN
UMTS Networks 15Andreas Mitschele-Thiel 9-May-03
Radio subsystem
The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers
ComponentsBase Station Subsystem (BSS):
Base Transceiver Station (BTS) radio components including sender, receiver, antenna one BTS can cover several cells
Base Station Controller (BSC)switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (Um) onto terrestrial channels (A interface)
BSS = BSC + sum(BTS) + interconnectionMobile Stations (MS)
UMTS Networks 16Andreas Mitschele-Thiel 9-May-03
GSM: cellular network
segmentation of the area into cells
cell
possible radio coverage of the cell
idealized shape of the cell
use of several carrier frequenciesnot the same frequency in neighboring cellscell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc.hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)if a mobile user changes cells-> handover of the connection to the neighbor cell
UMTS Networks 17Andreas Mitschele-Thiel 9-May-03
Example coverage of GSM networks (www.gsmworld.com)
Vodafone (GSM-900/1800)T-Mobile (GSM-900/1800) Berlin
e-plus (GSM-1800) O2 (GSM-1800)
UMTS Networks 18Andreas Mitschele-Thiel 9-May-03
Base Transceiver Station and Base Station Controller
Tasks of a BSS are distributed over BSC and BTS
BTS comprises radio specific functions
BSC is the switching center for radio channels
Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X
UMTS Networks 19Andreas Mitschele-Thiel 9-May-03
Mobile station
Terminal for the use of GSM servicesA mobile station (MS) comprises several functional groups
MT (Mobile Termination):offers common functions used by all services the MS offerscorresponds to the network termination (NT) of an ISDN accessend-point of the radio interface (Um)
TA (Terminal Adapter):terminal adaptation, hides radio specific characteristics
TE (Terminal Equipment):peripheral device of the MS, offers services to a userdoes not contain GSM specific functions
SIM (Subscriber Identity Module):personalization of the mobile terminal, stores user parameters
R S UmTE TA MT
UMTS Networks 20Andreas Mitschele-Thiel 9-May-03
Network and switching subsystem
NSS is the main component of the public mobile network GSMswitching, mobility management, interconnection to other networks, system control
ComponentsMobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSCDatabases (important: scalability, high capacity, low delay)
Home Location Register (HLR)central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs)Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR
UMTS Networks 21Andreas Mitschele-Thiel 9-May-03
Mobile Services Switching Center (MSC)
The MSC plays a central role in GSMswitching functionsadditional functions for mobility supportmanagement of network resourcesinterworking functions via Gateway MSC (GMSC)integration of several databases
Functions of a MSC
specific functions for paging and call forwardingtermination of SS7 (signaling system no. 7)mobility-specific signalinglocation registration and forwarding of location informationprovision of new services (fax, data calls)support of short message service (SMS)generation and forwarding of accounting and billing information
UMTS Networks 22Andreas Mitschele-Thiel 9-May-03
Operation subsystem
The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems
Components
Authentication Center (AUC)generates user specific authentication parameters on request of a VLR
authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system
Equipment Identity Register (EIR)registers GSM mobile stations and user rights
stolen or malfunctioning mobile stations can be locked and sometimes even localized
Operation and Maintenance Center (OMC)different control capabilities for the radio subsystem and the network subsystem
UMTS Networks 23Andreas Mitschele-Thiel 9-May-03
GSM: Air Interface
FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)
1 2 3 123124. . .
890 MHz 915 MHz
1 2 3 123124. . .
935 MHz 960 MHz
200 kHz
Uplink Downlink
frequency
TDMA (Time Division Multiple Access)
time
Downlink
87654321
4,615 ms = 1250 bit
Uplink
87654321
UMTS Networks 24Andreas Mitschele-Thiel 9-May-03
GSM: Voice Coding
Voice coding Framing Modulation(GMSK)
64-1
04 k
bps
9,6
kbps
Channelcoding
22,8
kbp
s
Framing
33,8
kbp
s
(270
,8 k
bps)
Modulation(GMSK)
114 + 42 bit
Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot)Training sequence: select the best radio path in the receiver and train equalizerTail: needed to enhance receiver performanceFlag S: indication for user data or control data
1 2 3 4 5 6 7 8GSM TDMA frame
GSM time-slot (normal burst)
4.615 ms
546.5 µs577 µs
tail user data TrainingSguardspace S user data tail
guardspace
3 bits 57 bits 26 bits 57 bits1 1 3
114 bit/slot
UMTS Networks 25Andreas Mitschele-Thiel 9-May-03
GSM hierarchy of frames
slot
superframe
120 ms
6.12 s
traffic multiframe
0 1 24 25...
0 1 2 48 49 50... 235.4 mscontrol multiframe
0 1 24 25...
2045 2046hyperframe 3 h 28 min 53.76 s0 1 2 ... 2047
0 1 2 ... 48 49 50
frame 4.615 ms0 1 ... 6 7
577 µsburst
traffic multiframe: 24 frames (22.8 kbps) used for traffic channel (user data), or fast signaling
1 frame (950 bps) used for slow signaling, 1 frame unused
UMTS Networks 26Andreas Mitschele-Thiel 9-May-03
GSM protocol layers for signaling
CM
MM
RR
MM
LAPDm
radio
LAPDm
radio
LAPD
PCM
RR’ BTSM
CM
LAPD
PCM
RR’BTSM
16/64 kbit/s
Um Abis A
SS7
PCM
SS7
PCM
64 kbit/s /2.048 Mbit/s
MS BTS BSC MSC
BSSAP BSSAP
CM: call managementMM: mobility managementRR: radio resource managmentLAPDm: link access procedure for D-channel (HDLC variant – reliable transport)
UMTS Networks 27Andreas Mitschele-Thiel 9-May-03
Mobile Terminated Call (MTC)
PSTNcallingstation GMSC
HLR VLR
BSSBSSBSS
MSC
MS
1 2
3
4
5
6
7
8 9
10
11 12
1316
10 10
11 11 11
14 15
17
1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible
MSC to GMSC7: forward call to
current MSC8, 9: get current status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection
UMTS Networks 28Andreas Mitschele-Thiel 9-May-03
Mobile Originated Call (MOC)
PSTN GMSC
VLR
BSS
MSC
MS1
2
6 5
3 4
9
10
7 8
1, 2: connection request3, 4: security check5-8: check resources (free circuit)9-10: set up call
UMTS Networks 29Andreas Mitschele-Thiel 9-May-03
MS-BTS signaling details (MTC/MOC)
BTSMS
paging request
channel request
immediate assignment
paging response
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
BTSMS
channel request
immediate assignment
service request
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
MTC MOC
UMTS Networks 30Andreas Mitschele-Thiel 9-May-03
4 types of handover
MSC MSC
BSC BSCBSC
BTS BTS BTSBTS
MS MS MS MS
12 3 4
UMTS Networks 31Andreas Mitschele-Thiel 9-May-03
Handover decision
receive levelBTSold
receive levelBTSnew
MS MS
HO_MARGIN
BTSold BTSnew
UMTS Networks 32Andreas Mitschele-Thiel 9-May-03
Handover procedure (change of BSC)
„Make-before-break“ strategy
HO access
BTSold BSCnew
measurementresult
BSCold
Link establishment
MSCMSmeasurementreport
HO decisionHO required
BTSnew
HO request
resource allocationch. activation
ch. activation ackHO request ackHO commandHO commandHO command
HO completeHO completeclear commandclear command
clear complete clear complete
make
break
UMTS Networks 33Andreas Mitschele-Thiel 9-May-03
Security in GSM
Security servicesaccess control/authentication
user ⌫ SIM (Subscriber Identity Module): secret PIN (personal identification number)SIM ⌫ network: challenge response methodno authentication of network!
confidentialityvoice and signaling encrypted on the wireless link (after successful authentication)
anonymitytemporary identity TMSI (Temporary Mobile Subscriber Identity)newly assigned at each new location update (LUP)encrypted transmission
3 algorithms specified in GSMA3 for authentication (“secret”, open interface)A5 for encryption (standardized)A8 for key generation (“secret”, open interface)
“secret”:• A3 and A8
available via the Internet
• network providers can use stronger mechanisms
UMTS Networks 34Andreas Mitschele-Thiel 9-May-03
GSM - authentication
SIMmobile network
A3
RANDKi
128 bit 128 bit
A3
RAND Ki
128 bit 128 bit
SRES 32 bit
SRES* =? SRES SRES
RAND
32 bit
AuC
SIMSRES* 32 bit
SRESMSC
Ki: individual subscriber authentication key SRES: signed response
UMTS Networks 35Andreas Mitschele-Thiel 9-May-03
GSM - key generation and encryption
MS with SIMmobile network (BTS)
A8
RANDKi
128 bit 128 bit
A8
RAND Ki
128 bit 128 bit
RAND
AuC SIM
A5
data
Kc64 bit
SRES
A5
data
cipherkey Kc
64 bit
encrypteddataBTS MS
UMTS Networks 36Andreas Mitschele-Thiel 9-May-03
GSM Evolution – Overview
adaptivemodulation
EDGE
diversity
space
time
Macro diversity
Intelligent antennas
Equalizer
adaptiveredundancyinterference GPRS
aperiodic
HSCSD
continuous
Interference cancelation (multi-user detection)
Spectraleffiency
Dynamicchannel
allocation
Frequencyhopping
Datatraffic
UMTS Networks 37Andreas Mitschele-Thiel 9-May-03
2G+: GSM Evolution
Limits of GSMlimited capacity at the air interface:data transmission standardized with only 9.6 kbit/s
advanced coding allows 14,4 kbit/snot enough for Internet and multimedia applications
=> EDGEinappropriateness for aperiodic and non-symmetrical data traffic
=> GPRS
ExtensionsHSCSD (High-Speed Circuit Switched Data)GPRS (General Packet Radio Service)EDGE (Enhanced Data Rate for GSM Evolution)EGPRS (EDGE und GPRS)GERAN (GSM Interface to UMTS)
UMTS Networks 38Andreas Mitschele-Thiel 9-May-03
HSCSD (High-Speed Circuit Switched Data)
continuous use of multiple time slots
asynchronous allocation of time slots
gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)
mainly software update
additional HW needed if more than 3 slots are used
Downlink
71 2 3 84 5 6 1 2
Uplink
71 2 3 84 5 6 1 2
UMTS Networks 39Andreas Mitschele-Thiel 9-May-03
GPRS (General Packet Radio Service)
packet switchingusing free slots only if data packets are ready to send (e.g., 115 kbit/s using 8 slots temporarily)standardization 1998, introduction 2001advantage: first step towards UMTS, flexible data services
GPRS network elementsGSN (GPRS Support Nodes): GGSN and SGSNGGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)SGSN (Serving GSN)
supports the MS (location, billing, security)HLR (GPRS Register – GR)
maintains location and security information
UMTS Networks 40Andreas Mitschele-Thiel 9-May-03
GPRS architecture and interfaces
connection-orientedpacket switched core
MS BSS GGSNSGSN
MSC
Um
EIR
HLR/GR
VLR
PDN
Gb Gn Gi
SGSN
Gn
UMTS Networks 41Andreas Mitschele-Thiel 9-May-03
GPRS protocol architecture
appl.
IP/X.25
LLC
GTP
MAC
radio
MAC
radioFR
RLC BSSGP
IP/X.25
FR
Um Gb Gn
L1/L2 L1/L2
MS BSS SGSN GGSN
UDP/TCP
Gi
SNDCP
RLC BSSGP IP IP
LLC UDP/TCPSNDCP GTP
UMTS Networks 42Andreas Mitschele-Thiel 9-May-03
GPRS services
Quality-of-Service Parametersreliabilitydelay (delay class 1: 95%-delay < 1.5-7 sec. depending on packet size)throughputservice priority
Reliabilityclass
Lost SDUprobability
DuplicateSDU
probability
Out ofsequence
SDUprobability
Corrupt SDUprobability
1 10-9 10-9 10-9 10-9
2 10-4 10-5 10-5 10-6
3 10-2 10-5 10-5 10-2
Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile
1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified
UMTS Networks 43Andreas Mitschele-Thiel 9-May-03
GPRS services
End-to-End packet switched traffic (peak channel rates)28 kbps (full use of 3 time slots, CS-1: FEC) 171.2 kbps (full use of 8 time slots, CS-4: no FEC)
Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002)
95 kbps (for both up and downlink)Assumptions: 4/12 reuse, realistic RF conditions, random traffic
Worse figures for individual TCP traffic
Adaptive Coding Schemes (adaptive Forward Error Control – FEC)CS 1: 9.05 Kbps/slotCS 2: 13.4 Kbps/slotCS 3: 15.6 Kbps/slotCS 4: 21.4 Kbps/slot (no Forward Error Correction)
(current systems implement CS1 and 2 only)
Problems and limitsIP-based network => high latency, no guaranteesLimited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4)Latency/flow control problems with TCP
UMTS Networks 44Andreas Mitschele-Thiel 9-May-03
EDGE (Enhanced Data Rates for GSM Evolution)
Spectral efficiency depends on:Size of frequency bandDuration of usageLevel of interference to others (power)
EDGE:
Adaptation of modulation depending on quality of radio path
GMSK (GSM standard – 1 bit per symbol)8-PSK (3 bits per symbol)
Adaptation of coding scheme depending on quality of radio path (9 coding schemes)
Gain: data rate (gross) up to 69,2kbps (compare to 22.8kbps for GSM)
complex extension of GSM!
Near-far problem
NodeBNodeB
UE 1UE 1
UE 2UE 2
UMTS Networks 45Andreas Mitschele-Thiel 9-May-03
Preview: UMTS system architectur (Release 3)
GSM Radio Access Network(circuit switched)
f1
f2
f4
f3
f6
f5
f7BSC
BTS
BSC
3G GMSC
BTS
3G MSC
HLR VLR AC EIR
ISDN
ISP
ISP
Core Network (packet switched)
3G SGSN
3G SGSN
3G GGSN
c4
c3
c5
c1
c2
UMTS Radio Access Network
RNCnodeB
RNCnodeB
Core Network(circuit switched)
3G MSC