cellular systemsomikron.eit.lth.se/etsn01/etsn01/lectures/cellular.pdf · prof. dr.-ing. jochen...

Cellular SystemsETSN01 Advanced Telecommunications

2015

Prof. Dr.-Ing. Jochen Schiller, http://www.jochenschiller.de/ MC SS02 4.3

1946 – First commercial mobile radio-telephone service by Bell and AT&T in Saint Louis, USA. Half duplex

1973 – First handheld cellular phone

– Motorola.

1978 – First cellular net in Bahrein

1979 – NMT at 450MHz (Scandinavian countries)

1992 – Start of GSM

It all started like this

The first car mounted radio telephone – 1921


Basic Definitions

• Forward Link, Downlink, Downstream

• The path from the network or base station to the mobile

• GSM terminology uses “Downlink”

• CDMA, AMPS and TDMA use “Forward Link”

• Most wireline technologies use “Downstream”

• Reverse Link, Uplink, Upstream

• The path from the mobile to the network or base station

• GSM terminology uses “Uplink”

• CDMA, AMPS and TDMA use “Reverse Link”

• Most wireline technologies use “Upstream”


GSM frequency bands

• 890-915 MHz Uplink

• 935-960 MHz Downlink











• 900 MHz

• 2*25 MHz Bands

• 45 MHz Duplex Spacing

• 125 carriers

• 1800 MHz

• 2*75 MHz Bands


• 375 carriers

• 1900 MHz

• 2*60 MHz Bands


• 300 carriers

North America


SYSTEM ARCHITECTURE

PSTN GMSC

ISDN

PLMNMSC

BSC

BTS BTS

BSC

MSC

HLR

VLR VLR

AUCEIR

MS

AUC: AUthentication CenterOMC: Operation and Managing CenterBTS: Base Tranceiver StationBSC: Base Station ControllerEIR: Equipment Identity RegisterGMSC: Gateway MSCHLR: Home Location RegisterMS: Mobile StationMSC: Mobile Switching CenterVLR: Visiting Location Register

OMC

GSM is a PLMN (Public Land Mobile Network)


GSM: elements and interfaces

NSS

MS MS

BTS

BSC

GMSC

IWF

OMC

BTS

BSC

MSC MSC

Abis

Um

EIR

HLR

VLR VLR

A

BSS

PDN

ISDN, PSTN

RSS

radio cell

radio cell

MS

AUCOSS

signaling

O


GSM Mobile Communications The GSM 1800, DECT and UMTS Bands

1700 1750 1800 1850 1900 1950 200 2050 2100 2150 2200 2250

75 MHz

UMTSGSM 1800

DECT

1: Time Division Duplex (TDD)2: Frequency Division Duplex (FDD)3: Mobile Satellite System (MSS)

Uplink Downlink

Duplex Distance 95 MHz

75 MHz

1 2 3 1 2 3


R cell radius

K cluster size

D repeating distance

GSM Mobile Communications Spatial Frequency Re-use in Cell Clusters

1

23

1

23

1

23

1

23

546

71

23

546

71

235

46

71

23

546

71

23

K = 12D

R

546

71

23

98 10

11

12

546

71

23

98 10

11

12

546

71

23

98 10

11

12

546

71

23

98 10

11

12

K = 7

K = 3


possible radio coverage of the cell

idealized shape of the cellcell

segmentation of the area into cells

GSM: cellular network

use of several carrier frequencies

not the same frequency in adjacent cells

cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc.

hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)

if a mobile user changes cells ➪ handover of the connection to the neighbor cell


MACRO, MICRO AND PICO CELLS

By using small macro cells in combination with Tighter Frequency Reuse and a micro cellular overlay, the capacity of a standard 4/12 reuse cellular network with 7.5 MHz available spectrum can be increased eight-fold. The micro cellular network operates in a segmented frequency and from the nearby macro cells and provides the additional benefit of coverage redundancy.


B = 200 kHz

B

B

B

B

Guard Band

···

f

fN

fk

f2

f1

0

RadioFrequencyChannels

Guard Band fL

fU

FrequencyBand

...

GSM Mobile CommunicationsCombined FDMA / TDMA Scheme

t

...0 1 2 ... 7 0 1

...0 1 2 ... 7 0 1

...0 1 2 ... 7 0 1

...0 1 2 ... 7 0 1

Time Slots

Frame

T

T ≈ 577 µs


GSM Radio Interface Um

Adaptive Frame Alignment

Thanks to the time shift of 3 time slots between the BTS TX and RX TDMA frames, the MS is not required to receive and transmit simultaneously. This simplifies the MS hardware.

The MS continuously aligns its TX frame start based on the Timing Advance (TA) measurements received from the BTS

The extended guard period of the access burst (252 µs) allows a maximum range between MS and BTS of 35 km.

0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7

BTS

RX

TX

0

MS

0 TA = 2·∆t

0 1 2 3 4 5 6 7 TX

0 1 2 3 4 5 6 7 RX∆t = s / c

Layer 1: Synchronization: The distance between the MS and the BTS

An MS 35 km from the BTS has a round trip time (RTT) of 0.23 ms

The BTS sends the current RTT to the MS, which then adjusts its access time

Adjusting the access is controlled by the variable timing advance, where a burst can be shifted up to 63 bit times earlier => 0.23 ms. (each bit is 3.69 micro seconds long).

Max 35 km between a BTS and a MS

0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7

BTS

RX

TX

0

MS

0 TA = 2·∆t

0 1 2 3 4 5 6 7 TX

0 1 2 3 4 5 6 7 RX∆t = s / c


GSM Radio Interface Um Logical Channels

ControlChannels

(CCH)

TrafficChannels

(TCH)

Full Rate(TCH/F)

Half Rate(TCH/H)

DedicatedControl

Channels

Stand Alone Dedicated Control Channel (SDCCH)Fast Associated Control Channel (FACCH)

Slow Associated Control Channel (SACCH)

CommonControl

Channels

Paging Channel (PCH)

Random Access Channel (RACH)Access Grant Channel (AGCH)

Notification Channel (PCH)

BroadcastChannels

Synchronization Channel (SCH)Frequency Control Channel (FCCH)

Broadcast Control Channel (BCCH)

Downlink (DL)

Uplink (UL)


PCH Paging Channel

RACH Random Access Ch.

AGCH Access Grant Ch.

SDCCH Stand-alone Dedicated Control Channel

FACCH Fast AssociatedControl Channel

TCH Traffic Channel

GSM Radio Interface Um Call Setup (MS terminating)

MS BTSPaging RequestPCH

Paging Response

Call Confirmation

Assign Command

Setup

Authentication / Cipher Mode

SDCCH

Voice or Data PCH

Channel AssignmentAGCH

Channel RequestRACH

Assign Completion

Connect Acknowledge

Alert

ConnectFACC

H


GSM Mobile CommunicationsNumbers and Identifiers I

International Mobile Equipment Identifier (IMEI) Unique serial number assigned by equipment manufacturer

International Mobile Subscriber Identifier (IMSI) Unique subscriber identification number, stored on SIM-card

Mobile Subscriber ISDN Number (MSISDN) Actual phone number structured according to ITU-T E.164

Country Code (CC) up to 3 digitsNational Destination Code (NDC) 2 to 3 digitsSubscriber Number (SN) with a maximum of 10 digits

Strict separation of subscriber identification (IMSI)and phone number (MSISDN)

Several MSISDN numbers can be assigned to a single IMSI(used for service selection)

The mapping between MSISDN and IMSI is not public


Mobile Terminated Call

PSTNcallingstation

GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

1: calling a GSM subscriber

2: forwarding call to GMSC

3: signal call setup to HLR

4, 5: request MSRN (Mobile Station Roaming Number) from VLR

6: forward responsible MSC to GMSC

7: forward call to

current MSC

8, 9: get current status of MS

10, 11: paging of MS

12, 13: MS answers

14, 15: security checks

16, 17: set up connection


Mobile Originated Call

PSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

1, 2: connection request

3, 4: security check

5-8: check resources (free circuit)

9-10: set up call


Handover decision

receive levelBTSold

receive levelBTSold

MS MS

HO_MARGIN

BTSold BTSnew


Handover procedure

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decisionHO required

BTSnew

HO request

resource allocationch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete


Security in GSM

Security services access control/authentication

user ➳ SIM (Subscriber Identity Module): secret PIN (personal identification number)

SIM ➳ network: challenge response method

confidentialityvoice and signaling encrypted on the wireless link (after successful authentication)

anonymitytemporary identity TMSI

(Temporary Mobile Subscriber Identity)newly assigned at each new location update (LUP)encrypted transmission

3 algorithms specified in GSM A3 for authentication (“secret”, open interface)

A5 for encryption (standardized)

A8 for key generation (“secret”, open interface)

“secret”:• A3 and A8 available via the Internet• network providers can use stronger mechanisms


GSM - authentication

A3

RANDKi

128 bit 128 bit

SRES* 32 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

SRES32 bit

mobile network SIM

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response


GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc

64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS) MS with SIM

AC

BSS

SIM

A5

Kc

64 bit

A5

MSdata data

cipherkey

7

Towards 3G

11

Network Elements from UMTS

UMTS differs from GSM Phase 2+ (GSM +GPRS) mostly in the new principles for the air interface transmission

WCDMA instead of TDMA/FDMA

Therefore a new RAN (Radio Access Network) called:

UTRAN (UMTS Terrestrial Radio Access Network) must be introduced with UMTS

Only minor modifications are needed in the CN (Core Network) to accommodate the change

12

UTRA: UMTS Terrestrial Radio Access

The most significant change in REL. ´99 was the “UTRAN”, a W-CDMA radio interface for land-based communications.

UTRAN supports time (TDD) and frequency division duplex (FDD).

The TDD mode is optimized for public micro and pico cells and unlicensed cordless applications.

The FDD mode is optimized for wide-area coverage, i.e. public macro and micro cells.

Both modes offer flexible and dynamic data rates up to 2 Mbps.

13

UMTS architecture

UTRAN (UTRA NETWORK)

• Radio Network Subsystem (RNS)

UE (User Equipment)

CN (Core Network)

Uu Iu

CNUTRANUE

UTRAN architecture

UTRAN comprises several RNSs

Node B can support FDD or TDD or both

RNC is responsible for handover decisions requiring signaling to the UE

Cell offers FDD or TDD

RNC: Radio Network Controller

RNS: Radio Network SubsystemNode B

Node B

RNC

Iub

Node B

UE1

RNS

CN

Node B

Node B

RNC

Iub

Node B

RNS

Iur

Node B

UE2

UE3

Iu

16

UTRAN functions

• Admission control• Congestion control• Radio channel encryption• Handover• Radio network configuration• Channel quality measurements• Radio resource control• Data transmission over the radio interface• Outer loop power control (FDD and TDD)• Channel coding

Core network

BTS

Node B

BSC

Abis

BTS

BSS

MSC

Node B

Node B

RNC

Iub

Node BRNS

Node BSGSN GGSN

GMSC

HLR

VLR

IuPS

IuCS

Iu

CN

EIR

GnGi

PSTN

AuC

GR

The Core Network (CN) and the Interface Iu, are separated into two logical domains:

Circuit Switched Domain (CSD)• Circuit switched service incl. signaling• Resource reservation at connection setup• GSM components (MSC, GMSC, VLR)• IuCS

Packet Switched Domain (PSD)• GPRS components (SGSN, GGSN)• IuPS

Support of mobility: macro diversity

• Multicasting of data via several physical channels–Enables soft handover–FDD mode only

• Uplink–simultaneous reception of UE data at several Node Bs

• Downlink–Simultaneous transmission of data via different cells

CNNode B RNC

Node BUE

34

A case of 3 cell repetitions

Frequency Allocation

f1

f1

f1 f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f1

f2 f2

f3

f1

f1

f3

f2

f1

f3

f1

f3

f2

f2

f1

f3

f3

f2

f3

f2

FDMA / TDMA CDMA

Same frequency in all cells.

LTE

• LTE stands for Long Term Evolution

• Standard finalised in 2008 and first publicly available servicelaunched in 2009

• Main goals:• Increase speed and capacity• Simpler, IP-based network architecture

• Radio interface incompatible with previous 2G and 3Gnetworks

Lund University Slide 2 of 5

E-UTRAN

Evolved UMTS Terrestrial Radio Access Network:


E-UTRAN

• Only enodeBs: perform functions of both nodeBs and RNCsfrom UMTS

• Reduced latency of all radio interface operations

• enodeBs then connect to the packet-switched core network• No longer two separate paths as in UMTS: only

packet-switched


Future Cellular Systems

• Continue to increase capacity and speed

• Increased focus on QoS

• More integration between different types of systems• Femto and pico cells• WiFi offloading

• Possible future trends• Cognitive radio• Peer-to-peer


cellular systemsomikron.eit.lth.se/etsn01/etsn01/lectures/cellular.pdf · prof. dr.-ing. jochen...

Documents