Seminar onSeminar onGSMGSM

Global System for Mobile Global System for Mobile CommunicationCommunication

By:-Bharat Bhushan Gupta 05/IT/11

Introduction to GSMIntroduction to GSM

GSMGSM ((Global System for Mobile communications)Global System for Mobile communications): : originally from originally from Groupe Spécial MobileGroupe Spécial Mobile) is the most ) is the most popular standard for mobile phones in the world. Its popular standard for mobile phones in the world. Its promoter, the GSM Association, estimates that promoter, the GSM Association, estimates that 80%80% of the of the global mobile market uses the standard. global mobile market uses the standard.

Ubiquity makes international roaming very common Ubiquity makes international roaming very common between mobile phone operators.between mobile phone operators.

GSMGSM differs from its predecessors in that both signaling differs from its predecessors in that both signaling and speech channels are digital, thus it is considered a and speech channels are digital, thus it is considered a second generationsecond generation ( (2G2G) mobile phone system.) mobile phone system.

Release ’Release ’9797 of the standard added packet data capabilities, of the standard added packet data capabilities, by means of General Packet Radio Service (by means of General Packet Radio Service (GPRSGPRS). ).

Release 'Release '9999 introduced higher speed data transmission introduced higher speed data transmission using Enhanced Data Rates for using Enhanced Data Rates for GSM GSM Evolution (Evolution (EDGEEDGE). ).

History of GSMHistory of GSM In 1982, the European Conference of Postal and In 1982, the European Conference of Postal and

Telecommunications Administrations (CEPT) created the Telecommunications Administrations (CEPT) created the Groupe Spécial Mobile (GSM) to develop a standard for a Groupe Spécial Mobile (GSM) to develop a standard for a mobile telephone system that could be used across Europe. mobile telephone system that could be used across Europe. In 1987, a memorandum of understanding was signed by 13 In 1987, a memorandum of understanding was signed by 13 countries to develop a common cellular telephone system countries to develop a common cellular telephone system across Europe.Finally the system created by SINTEF lead across Europe.Finally the system created by SINTEF lead by Torleiv Maseng was selected.by Torleiv Maseng was selected.

In 1989, GSM responsibility was transferred to the In 1989, GSM responsibility was transferred to the European Telecommunications Standards Institute (ETSI) European Telecommunications Standards Institute (ETSI) and phase I of the GSM specifications were published in and phase I of the GSM specifications were published in 1990. The first GSM network was launched in 1991 by 1990. The first GSM network was launched in 1991 by Radiolinja in Finland with joint technical infrastructure Radiolinja in Finland with joint technical infrastructure maintenance from Ericsson. By the end of 1993, over a maintenance from Ericsson. By the end of 1993, over a million subscribers were using GSM phone networks being million subscribers were using GSM phone networks being operated by 70 carriers across 48 countries.operated by 70 carriers across 48 countries.

Cellular Radio NetworkCellular Radio Network

GSM is a cellular network, which means that mobile GSM is a cellular network, which means that mobile phones connect to it by searching for cells in the phones connect to it by searching for cells in the immediate vicinity. immediate vicinity.

There are five different cell sizes in a GSM networkThere are five different cell sizes in a GSM network—macro, micro, Pico, femto and umbrella cells. —macro, micro, Pico, femto and umbrella cells.

The The longest distancelongest distance the GSM specification the GSM specification supports in practical use is supports in practical use is 35 kilometers35 kilometers (22 mi). (22 mi).

The modulation used in GSM is The modulation used in GSM is Gaussian minimum-Gaussian minimum-shiftshift keying (GMSK), a kind of continuous-phase keying (GMSK), a kind of continuous-phase frequency shift keying.frequency shift keying.

GSMGSM FrequenciesFrequencies

GSM networks operate in a number of different frequency GSM networks operate in a number of different frequency ranges (separated into GSM frequency ranges for ranges (separated into GSM frequency ranges for 2G2G and and UMTS frequency bands for UMTS frequency bands for 3G3G). ).

The rarer The rarer 400400 and and 450450 MHz frequency bands are assigned MHz frequency bands are assigned in some countries where these frequencies were previously in some countries where these frequencies were previously used for first-generation systems. used for first-generation systems.

GSM-900 GSM-900 uses uses 890–915 890–915 MHz to send information from the MHz to send information from the mobile station to the base station (uplink) and mobile station to the base station (uplink) and 935–960 935–960 MHz for the other direction (downlink), providing 124 RF MHz for the other direction (downlink), providing 124 RF channels (channel numbers 1 to 124) spaced at 200 kHz. channels (channel numbers 1 to 124) spaced at 200 kHz. Duplex spacing of 45 MHz is used. Duplex spacing of 45 MHz is used.

In some countries the GSM-900 band has been extended In some countries the GSM-900 band has been extended to cover a larger frequency range. This 'extended GSM', E-to cover a larger frequency range. This 'extended GSM', E-GSM, uses GSM, uses 880–915880–915 MHz (uplink) and MHz (uplink) and 925–960 925–960 MHz MHz (downlink), adding 50 channels (channel numbers 975 to (downlink), adding 50 channels (channel numbers 975 to 1023 and 0) to the original GSM-900 band. 1023 and 0) to the original GSM-900 band. Cont….

GSM FrequenciesGSM Frequencies

Time division multiplexing is used to allow eight full-Time division multiplexing is used to allow eight full-rate or sixteen half-rate speech channels per radio rate or sixteen half-rate speech channels per radio frequency channel. There are eight radio timeslots frequency channel. There are eight radio timeslots (giving eight burst periods) grouped into what is (giving eight burst periods) grouped into what is called a called a TDMATDMA frame. Half rate channels use frame. Half rate channels use alternate frames in the same timeslot. The channel alternate frames in the same timeslot. The channel data rate for alldata rate for all 8 8 channels is channels is 270.833270.833 kbit/s, and the  kbit/s, and the frame duration is frame duration is 4.6154.615 ms. ms.

The transmission power in the handset is limited to The transmission power in the handset is limited to a maximum of 2 watts in a maximum of 2 watts in GSM850/900GSM850/900 and 1 watt in and 1 watt in GSM1800/1900GSM1800/1900..

Network StructureNetwork Structure

The network behind the The network behind the GSMGSM seen by the customer is seen by the customer is large and complicated in order to provide all of the large and complicated in order to provide all of the services which are required. It is divided into a number of services which are required. It is divided into a number of sections and these are each covered in separate sections and these are each covered in separate articles.articles.

The Base Station Subsystem (the base stations and their The Base Station Subsystem (the base stations and their controllers). controllers).

The Network and Switching Subsystem (the part of the The Network and Switching Subsystem (the part of the network most similar to a fixed network). This is network most similar to a fixed network). This is sometimes also just called the core network. sometimes also just called the core network.

The The GPRS Core NetworkGPRS Core Network (the optional part which allows (the optional part which allows packet based Internet connections). packet based Internet connections).

All of the elements in the system combine to produce All of the elements in the system combine to produce many GSM services such as many GSM services such as voice callsvoice calls and and SMSSMS. .

Voice CodecsVoice Codecs

GSM has used a variety of voice GSM has used a variety of voice codecscodecs to to squeeze 3.1 kHz audio into between 5.6 and squeeze 3.1 kHz audio into between 5.6 and 13 kbit/s. Originally, two codecs, named after the 13 kbit/s. Originally, two codecs, named after the types of data channel they were allocated, were types of data channel they were allocated, were used, called used, called Half RateHalf Rate (5.6 kbit/s) and (5.6 kbit/s) and Full RateFull Rate (13 kbit/s). These used a system based upon (13 kbit/s). These used a system based upon linear predictive codinglinear predictive coding (LPC). In addition to (LPC). In addition to being efficient with bitrates, these codecs also being efficient with bitrates, these codecs also made it easier to identify more important parts of made it easier to identify more important parts of the audio, allowing the air interface layer to the audio, allowing the air interface layer to prioritize and better protect these parts of the prioritize and better protect these parts of the signal. signal.

Cont….

Voice CodecsVoice Codecs

GSM was further enhanced in GSM was further enhanced in 19971997 with the with the Enhanced Full Rate (EFR) codec, a Enhanced Full Rate (EFR) codec, a 12.212.2 kbit/s  kbit/s codec that uses a full rate channel. Finally, with codec that uses a full rate channel. Finally, with the development of UMTS, EFR was refactored the development of UMTS, EFR was refactored into a variable-rate codec called AMR-into a variable-rate codec called AMR-Narowband, which is high quality and robust Narowband, which is high quality and robust against interference when used on full rate against interference when used on full rate channels, and less robust but still relatively high channels, and less robust but still relatively high quality when used in good radio conditions on quality when used in good radio conditions on half-rate channels. half-rate channels.

Structure of GSMStructure of GSM Network Network

The BSSThe BSSThe Base Station Subsystem is shown containing the Base The Base Station Subsystem is shown containing the Base Station Controller (BSC) and the Base Transceiver Station Station Controller (BSC) and the Base Transceiver Station (BTS) connected together on the A-bis interface. The Packet (BTS) connected together on the A-bis interface. The Packet Control Unit (PCU) is also shown connected to the BTS Control Unit (PCU) is also shown connected to the BTS although the exact position of this depends on the vendor’s although the exact position of this depends on the vendor’s architecture. architecture. The BSS is connected by the Air Interface or Um to the mobile The BSS is connected by the Air Interface or Um to the mobile & is connected by the A interface to the NSS.& is connected by the A interface to the NSS.

The NSSThe NSSThe Network and Switching Subsystem is shown containing The Network and Switching Subsystem is shown containing the MSC connected via the SS7 network to the HLR. The AUC the MSC connected via the SS7 network to the HLR. The AUC and EIR, although technically separate functions from the HLR and EIR, although technically separate functions from the HLR are shown together since combining them is almost standard are shown together since combining them is almost standard in all Vendor’s networks. The NSS is connected by the A in all Vendor’s networks. The NSS is connected by the A interface to the BSS. It has direct connection to the PSTN from interface to the BSS. It has direct connection to the PSTN from the MSC. There is also a connection to the Packet Core (called the MSC. There is also a connection to the Packet Core (called the Gs) although this is optional and not always implemented.the Gs) although this is optional and not always implemented.

The GPRS Core NetworkThe GPRS Core NetworkThe GPRS Core Network shown here is simplified to just have The GPRS Core Network shown here is simplified to just have the SGSN. The two are connected together by a private IP the SGSN. The two are connected together by a private IP network called the GPRS backbone shown as the Gn Reference network called the GPRS backbone shown as the Gn Reference Point.Point.

Packet Control UnitPacket Control Unit

The Packet Control Unit (PCU) is a late addition to the The Packet Control Unit (PCU) is a late addition to the GSM standard. It performs some of the processing tasks GSM standard. It performs some of the processing tasks of the BSC, but for packet data. The allocation of of the BSC, but for packet data. The allocation of channels between voice and data is controlled by the channels between voice and data is controlled by the base station, but once a channel is allocated to the PCU, base station, but once a channel is allocated to the PCU, the PCU takes full control over that channel.the PCU takes full control over that channel.

The PCU can be built into the base station, built into the The PCU can be built into the base station, built into the BSC or even, in some proposed architectures, it can be BSC or even, in some proposed architectures, it can be at the SGSN site. In most of the cases, the PCU is a at the SGSN site. In most of the cases, the PCU is a separate node communicating extensively with the BSC separate node communicating extensively with the BSC on the radio side and the SGSN on the Gb side.on the radio side and the SGSN on the Gb side.

BSS interfacesBSS interfaces

UmUm – The air interface between the – The air interface between the MS MS (Mobile Station) (Mobile Station) and the and the BTS.BTS. This interface uses This interface uses LAPDm protocolLAPDm protocol for for signaling, signaling, to conduct call control, measurementto conduct call control, measurement reporting, Handover, Power control, Authenticationreporting, Handover, Power control, Authentication, , Authorization, Location UpdateAuthorization, Location Update and so on. Traffic and and so on. Traffic and Signaling are sent in bursts of 0.577 ms at intervals of Signaling are sent in bursts of 0.577 ms at intervals of 4.615 ms, to form data blocks each 20 ms. 4.615 ms, to form data blocks each 20 ms.

AbisAbis – The interface between the Base Transceiver – The interface between the Base Transceiver Station and Base Station Controller. Generally carried by Station and Base Station Controller. Generally carried by a a DS-1, ES-1DS-1, ES-1, or , or E1 TDME1 TDM circuit. Uses TDM circuit. Uses TDM subchannels for traffic (TCH), LAPD protocol for BTS subchannels for traffic (TCH), LAPD protocol for BTS supervision and telecom signaling, and carries supervision and telecom signaling, and carries synchronization from the BSC to the BTS and MS. synchronization from the BSC to the BTS and MS.

Cont….

BSS interfacesBSS interfaces AA – The interface between the – The interface between the BSCBSC and Mobile Switching and Mobile Switching

Center. It is used for carrying Traffic channels and the Center. It is used for carrying Traffic channels and the BSSAPBSSAP user part of the user part of the SS7 SS7 stack. Although there are stack. Although there are usually transcoding units between BSC and MSC, the usually transcoding units between BSC and MSC, the signaling communication takes place between these two signaling communication takes place between these two ending points and the transcoder unit doesn't touch the ending points and the transcoder unit doesn't touch the SS7 information, only the voice or CS data are transcoded SS7 information, only the voice or CS data are transcoded or rate adapted. or rate adapted.

AterAter – The interface between the Base Station Controller – The interface between the Base Station Controller and Transcoder. It is a proprietary interface whose name and Transcoder. It is a proprietary interface whose name depends on the vendor (for example Ater bydepends on the vendor (for example Ater by Nokia Nokia), it ), it carries the A interface information from the BSC leaving it carries the A interface information from the BSC leaving it untouched. untouched.

GbGb – Connects the BSS to the Serving – Connects the BSS to the Serving GPRS SupportGPRS Support Node Node (SGSN) in the (SGSN) in the GPRS Core NetworkGPRS Core Network. .

Subscriber Identity Module Subscriber Identity Module [[SIMSIM]]

One of the key features of GSM is the One of the key features of GSM is the SubscriberSubscriber Identity ModuleIdentity Module ( (SIMSIM), commonly known as a ), commonly known as a SIMSIM cardcard.. The SIM is a detachable Smart Card The SIM is a detachable Smart Card containing the user's subscription information and containing the user's subscription information and phone book. This allows the user to retain his or her phone book. This allows the user to retain his or her information after switching handsets. information after switching handsets.

Alternatively, the user can also change operators Alternatively, the user can also change operators while retaining the handset simply by changing the while retaining the handset simply by changing the SIM. Some operators will block this by allowing the SIM. Some operators will block this by allowing the phone to use only a single SIM, or only a SIM phone to use only a single SIM, or only a SIM issued by them; this practice is known as issued by them; this practice is known as SIMSIM lockinglocking, and is illegal in some countries. , and is illegal in some countries.

GSM securityGSM security

The system was designed to authenticate the The system was designed to authenticate the subscriber using a pre-shared key and challenge-subscriber using a pre-shared key and challenge-response.response.

Communications between the subscriber and the Communications between the subscriber and the base station can be encrypted. base station can be encrypted.

The development ofThe development of UMTS UMTS introduces an optional introduces an optional USIMUSIM, that uses a longer authentication key to give , that uses a longer authentication key to give greater security, as well as mutually authenticating greater security, as well as mutually authenticating the network and the user - whereas the network and the user - whereas GSM GSM only only authenticates the user to the network authenticates the user to the network ((and not vice and not vice versaversa)). .

The security model therefore offers confidentiality The security model therefore offers confidentiality and authentication, but limited authorization and authentication, but limited authorization capabilities, and no non-repudiation. capabilities, and no non-repudiation.

Cont….

GSM securityGSM security

GSM uses several cryptographic algorithms for security. GSM uses several cryptographic algorithms for security. The The A5/1A5/1 and and A5/2A5/2 stream ciphersstream ciphers are used for ensuring are used for ensuring over-the-air voice privacy. A5/1 was developed first and over-the-air voice privacy. A5/1 was developed first and is a stronger algorithm used within Europe and the is a stronger algorithm used within Europe and the United States; A5/2 is weaker and used in other United States; A5/2 is weaker and used in other countries. countries.

Serious weaknesses have been found in both Serious weaknesses have been found in both algorithms: it is possible to break A5/2 in real-time with a algorithms: it is possible to break A5/2 in real-time with a ciphertext-only attackciphertext-only attack, and in February 2008, Pico , and in February 2008, Pico Computing, Inc revealed its ability and plans to Computing, Inc revealed its ability and plans to commercialize commercialize FPGAsFPGAs that allow A5/1 to be broken with that allow A5/1 to be broken with a a rainbow tablerainbow table attack attack [1][1]. The system supports multiple . The system supports multiple algorithms so operators may replace that cipher with a algorithms so operators may replace that cipher with a stronger one. stronger one.

HandoverHandover

In In cellularcellular telecommunicationstelecommunications, the term , the term handoffhandoff refers to the process of transferring an refers to the process of transferring an ongoing call or data session from one channel ongoing call or data session from one channel connected to the core network to another. In connected to the core network to another. In satellite communicationssatellite communications it is the process of it is the process of transferring satellite control responsibility from transferring satellite control responsibility from one one earth stationearth station to another without loss or to another without loss or interruption of service. The interruption of service. The British EnglishBritish English term term for transferring a cellular call is for transferring a cellular call is handoverhandover, , which is the terminology standardized by which is the terminology standardized by 3GPP3GPP within such European originated technologies within such European originated technologies as as GSMGSM and and UMTSUMTS..

Types of HandoffTypes of Handoff A A hard handoffhard handoff is one in which the channel in the source cell is released is one in which the channel in the source cell is released

and only then the channel in the target cell is engaged. Thus the and only then the channel in the target cell is engaged. Thus the connection to the source is broken before the connection to the target is connection to the source is broken before the connection to the target is made -- for this reason such handoffs are also known as made -- for this reason such handoffs are also known as break-before-break-before-makemake. Hard handoffs are intended to be instantaneous in order to . Hard handoffs are intended to be instantaneous in order to minimize the disruption to the call. A hard handoff is perceived by minimize the disruption to the call. A hard handoff is perceived by network engineers as an event during the call. network engineers as an event during the call.

A soft handoff is one in which the channel in the source cell is retained A soft handoff is one in which the channel in the source cell is retained and used for a while in parallel with the channel in the target cell. In this and used for a while in parallel with the channel in the target cell. In this case the connection to the target is established before the connection to case the connection to the target is established before the connection to the source is broken, hence this handoff is called the source is broken, hence this handoff is called make-before-breakmake-before-break. . The interval, during which the two connections are used in parallel, may The interval, during which the two connections are used in parallel, may be brief or substantial. For this reason the soft handoff is perceived by be brief or substantial. For this reason the soft handoff is perceived by network engineers as a state of the call, rather than a brief event. A soft network engineers as a state of the call, rather than a brief event. A soft handoff may involve using connections to more than two cells, e.g. handoff may involve using connections to more than two cells, e.g. connections to three, four or more cells can be maintained by one phone connections to three, four or more cells can be maintained by one phone at the same time. When a call is in a state of soft handoff the signal of at the same time. When a call is in a state of soft handoff the signal of the best of all used channels can be utilised for the call at a given the best of all used channels can be utilised for the call at a given moment or all the signals can be combined to produce a clearer copy of moment or all the signals can be combined to produce a clearer copy of the signal. The latter is more advantageous, and when such combining is the signal. The latter is more advantageous, and when such combining is performed both in the downlink (forward link) and the uplink (reverse link) performed both in the downlink (forward link) and the uplink (reverse link) the handoff is termed as the handoff is termed as softersofter. Softer handoffs are possible when the . Softer handoffs are possible when the cells involved in the handoff have a single cell site. cells involved in the handoff have a single cell site.

Brief Introduction to 2GBrief Introduction to 2G Second generation 2G cellular telecom networks were Second generation 2G cellular telecom networks were

commercially launched on the commercially launched on the GSMGSM standard in standard in FinlandFinland by by RadiolinjaRadiolinja (now part of (now part of Elisa Elisa OyjOyj) in 1991.) in 1991.

Three primary benefits of 2G networks over their Three primary benefits of 2G networks over their predecessors were that phone conversations were predecessors were that phone conversations were digitally encrypted, 2G systems were significantly more digitally encrypted, 2G systems were significantly more efficient on the spectrum allowing for far greater mobile efficient on the spectrum allowing for far greater mobile phone penetration levels; and 2G introduced data phone penetration levels; and 2G introduced data services for mobile, starting with SMS text messages.services for mobile, starting with SMS text messages.

After 2G was launched, the previous mobile telephone After 2G was launched, the previous mobile telephone systems were retrospectively dubbed systems were retrospectively dubbed 1G1G. While radio . While radio signals on 1G networks are signals on 1G networks are analoganalog, and on 2G networks , and on 2G networks are are digitaldigital, both systems use digital signaling to connect , both systems use digital signaling to connect the radio towers (which listen to the handsets) to the rest the radio towers (which listen to the handsets) to the rest of the telephone system.of the telephone system.

Advantage of 2GAdvantage of 2G The lower powered radio signals require less battery power, so The lower powered radio signals require less battery power, so

phones last much longer between charges, and batteries can be phones last much longer between charges, and batteries can be smaller. smaller.

The digital voice encoding allowed digital The digital voice encoding allowed digital error checkingerror checking which which could increase sound quality by increasing could increase sound quality by increasing dynamic rangedynamic range and and lowering the lowering the noise floornoise floor. .

The lower power emissions helped address health concerns. The lower power emissions helped address health concerns. Going all-digital allowed for the introduction of digital data Going all-digital allowed for the introduction of digital data

services, such as services, such as SMSSMS and and emailemail. . Greatly reduced Greatly reduced fraudfraud. With analog systems it was possible to . With analog systems it was possible to

have two or more have two or more "cloned""cloned" handsets that had the same phone handsets that had the same phone number. number.

Enhanced privacy. A key digital advantage not often mentioned Enhanced privacy. A key digital advantage not often mentioned is that digital cellular calls are much harder to is that digital cellular calls are much harder to eavesdropeavesdrop on by on by use of use of radio scannersradio scanners. While the . While the security algorithmssecurity algorithms used have used have proved not to be as secure as initially advertised, 2G phones are proved not to be as secure as initially advertised, 2G phones are immensely more private than 1G phones, which have no immensely more private than 1G phones, which have no protection against eavesdropping. protection against eavesdropping.

Disadvantage of 2GDisadvantage of 2G In less populous areas, the weaker digital signal may not be In less populous areas, the weaker digital signal may not be

sufficient to reach a cell tower. This tends to be a particular problem sufficient to reach a cell tower. This tends to be a particular problem on 2G systems deployed on higher frequencies, but is mostly not a on 2G systems deployed on higher frequencies, but is mostly not a problem on 2G systems deployed on lower frequencies. National problem on 2G systems deployed on lower frequencies. National regulations differ greatly among countries which dictate where 2G regulations differ greatly among countries which dictate where 2G can be deployed. can be deployed.

Analog has a smooth decay curve, digital a jagged steppy one. This Analog has a smooth decay curve, digital a jagged steppy one. This can be both an advantage and a disadvantage. Under good can be both an advantage and a disadvantage. Under good conditions, digital will sound better. Under slightly worse conditions, conditions, digital will sound better. Under slightly worse conditions, analog will experience static, while digital has occasional analog will experience static, while digital has occasional dropoutsdropouts. . As conditions worsen, though, digital will start to completely fail, by As conditions worsen, though, digital will start to completely fail, by dropping calls or being unintelligible, while analog slowly gets dropping calls or being unintelligible, while analog slowly gets worse, generally holding a call longer and allowing at least a few worse, generally holding a call longer and allowing at least a few words to get through. words to get through.

While digital calls tend to be free of While digital calls tend to be free of staticstatic and and background noisebackground noise, , the the lossylossy compression compression used by the codecs takes a toll; the range of used by the codecs takes a toll; the range of sound that they convey is reduced. You'll hear less of the tonality of sound that they convey is reduced. You'll hear less of the tonality of someone's voice talking on a digital cell phone, but you will hear it someone's voice talking on a digital cell phone, but you will hear it more clearly. more clearly.