**http://gigadom.wordpress.comTinniam.V.Ganesh

AgendaNetwork Architecture, Network ElementsTypical 2G ArchitecturePLMN, CS, PS, AN,CNMSC, HLR, VLRGMSC, AuC, EIR2.5 G ArchitectureSGSN, GGSNRecapSMS ArchitectureSMS Network Elements3G Network ArchitectureFrequency reuseHandoffBluetooth stackWiFIRecapQuiz 3

**

Evolution of Technology**

Typical 2G Architecture**

Signaling in Core NetworkBased on SS7ISUP and specific Application PartsGSM MAP and ANSI-41 servicesMobility, call-handling, O&MAuthentication, supplementary servicesSMS, Location registers for mobility managementHLR: home location register has permanent dataVLR: visitor location register keeps local copy for roamer**

GSM 2G Architecture**

Wireless definitionsPLMN A Public Land Mobile Network (PLMN) is established and operated by an administration or Recognized Private Operating Agency (RPOA)

The PLMN infrastructure is logically divided into Core Network (CN) Access Network (AN)

Access Network (AN)BSS in 2G systems (BTS, BSC)RNS in 3G systems (NodeB, RNC)

The Core Network (CN) is divided intoCircuit Switched domainPacket Switched domain

**

PLMN Circuit Switched (CS) domainAccess Network BTS, BSCCore Network - MSC, VLR, HLR, GMSC, SMSC

Packet Switched (PS) domainAccess Network BTS, BSCCore network - SGSN, GGSN**

GSM ArchitectureAccess NetworkBTSBSC

Core NetworkMSCHLRVLRAuCEIRSMSCGMSC**

GSM- Access Network Mobile Station : The mobile communicates over the air interface with a base transceiver station (BTS) . The handset has 2 parts namely the mobile equipment and the subscriber identity module (SIM)The SIM contains the user specific information, subscriber authentication information and some service info.BTS : The BTS contains the radio transceivers that provide the radio interface to mobile stations. One or more BTS are connected to the Base Station Controller.

BSC The BSC provides a number of functions related toRadio resource (RR) management Mobility management (MM) for subscribers in coverage areas

Together the BTS and BSCs are known as the Base Station System (BSS)**

Mobile Switching Center (MSC)Mobile services switching center (MSC) The MSC performs the telephony switching functions of the system. It controls calls to and from other telephone and data systems. The Mobile-services Switching Centre (MSC) constitutes the interface between the radio system and the fixed networks.

The MSC performs all necessary functions in order to handle the circuit switched services to and from the mobile stations.

The Mobile-services Switching Centre is an exchange which performs all the switching and signalling functions for mobile stations located in a geographical area designated as the MSC area. Does radio resource managementDoes switching, routing of callsIs involved in charging**

Home Location Register (HLR)Home location register (HLR) The HLR is a database used for storage and management of subscriptions. The HLR is considered the most important database,

HLR stores the following informationthe subscription informationsome location information enabling the charging and routing of calls towards the MSC where the MS is registered (e.g. the MS Roaming Number, the VLR Number, the MSC Number, the Local MS Identity)the International Mobile Station Identity (IMSI);one or more Mobile Station International ISDN number(s) (MSISDN);The data base contains other information such asteleservices and bearer services subscription informationservice restrictions (e.g. roaming limitation)a list of all the group IDs a service subscriber is entitled to use to establish voice group or broadcast callssupplementary services; the HLR contains the parameters attached to these services;**

Visitor Location Register (VLR)Visitor location register (VLR) The VLR is a database that contains temporary information about subscribers that is needed by the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC. When a mobile station roams into a new MSC area, the VLR connected to that MSC will request data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR will have the information needed for call setup without having to interrogate the HLR each time.

The VLR stores the following information-the International Mobile Subscriber Identity (IMSI);-the Mobile Station International ISDN number (MSISDN);the Mobile Station Roaming Number (MSRN), the Temporary Mobile Station Identity (TMSI), if applicable;

**

Authentication Center (AuC)Authentication center (AUC) A unit called the AUC provides authentication and encryption parameters that verify the user's identity and ensure the confidentiality of each call. The AUC protects network operators from different types of fraud found in today's cellular world.The Authentication Centre (AuC) is an entity which stores data for each mobile subscriber to allow the International Mobile Subscriber Identity (IMSI) to be authenticated and to allow communication over the radio path between the mobile station and the network to be ciphered.The Authentication Centre (AuC) is associated with an HLR, and stores an identity key for each mobile subscriber registered with the associated HLR. This key is used to generate:data which are used to authenticate the International Mobile Subscriber Identity (IMSI);a key used to cipher communication over the radio path between the mobile station and the network **

Equipment Identification Register (EIR)Equipment identity register (EIR) The EIR is a database that contains information about the identity of mobile equipment that prevents calls from stolen, unauthorized, or defective mobile stations. The AUC and EIR are implemented as stand-alone nodes or as a combined AUC/EIR node.The Equipment Identity Register (EIR) in the GSMsystem is the logical entity which is responsible for storing in the network the International Mobile Equipment Identities (IMEIs), used in the GSM system.

**

Gateway MSC (GMSC)If a network delivering a call to the PLMN cannot interrogate the HLR, the call is routed to an MSC. This MSC will interrogate the appropriate HLR and then route the call to the MSC where the mobile station is located. The MSC which performs the routing function to the actual location of the MS is called the Gateway MSC (GMSC).**

**

2.5G Architectural details**

General Packet Radio Service (GPRS)Core NetworkServing GPRS Support Node (SGSN)Gateway GPRS Support Node (GGSN)**

Serving GPRS Support Node (SGSN)A Serving GPRS Support Node (SGSN) is responsible for the delivery of data packets from and to the mobile stations within its geographical service area. packet routing and transfer, mobility management (attach/detach and location management), logical link management, and authenticationcharging functions.

The location register of the SGSN stores location information current cell, currentVLR user profiles (e.g.,IMSI, address(es) used in the packet data network) of all GPRS users registered with this SGSN. **

Gateway GPRS Support Node (GGSN)GGSNThe GGSN is responsible for the interworking between the GPRS network and external packet switched networks, The GGSN hides the GPRS infrastructure from the external network.The GGSN converts the GPRS packets coming from the SGSN into the appropriate packet data protocol (PDP) format **

GSM Evolution for Data Access**

**

SMS ArchitectureSC Service CentreSMS-IWMSC SMS Interworking MSCSMS-GMSC Gateway MSC for SMS**

SMS Network ElementsService Centre (SC): function responsible for the relaying and storeandforwarding of a short message between an SME and an MSGateway MSC For Short Message Service (SMSGMSC): function of an MSC capable of receiving a short message from an SC, interrogating an HLR for routing information and SMS info, and delivering the short message to the VMSC or the SGSN of the recipient MSInterworking MSC For Short Message Service (SMSIWMSC): function of an MSC capable of receiving a short message from within the PLMN and submitting it to the recipient SC**

SMS ServicesShort Message Mobile Terminated

SM MT denotes the capability of the GSM/UMTS system to transfer a short message submitted from the SC to one MS, and to provide information about the delivery of the short message either by a delivery report or a failure report

Short Message Mobile Originated

SM MO denotes the capability of the GSM/UMTS system to transfer a short messagesubmitted by the MS to one SME via an SC, and to provide information about the delivery ofthe short message either by a delivery report or a failure

**

3G Rel 99 Architecture**

3G ArchitectureAccess Network Universal Terrestial Radio Access NetworkRadio Network Systems (RNS) or UTRANNode BRadio Network Controller RNC

Core NetworkMSC Server (UMTS)HLRVLRGMSCSMSC

**

GSM Signaling Protocol Architecture**

Wireless Mobility Data**

TechnologyData capabilityGSM9.6/14.4 kbpsCDMA9.6/14.4 kbpsGPRS128 KbpsEDGE384KbpsWCDMA144 kbps vehicular384 outdoors2 Mbps indoorsCDMA2000144 kbps vehicular384 outdoors2 Mbps indoors

Wireless Technologies**

**Optimizing Frequency reuse

Access NetworkThe network is divided into a number of cells or geographic coverage areasWithin each cell is a base station which contains the radio transmission and reception equipmentsThe coverage area of the base station depends in factors like transmit power of station, the height of the base station the topology of the area.Specific radio frequencies are allocated within each cell The frequencies are reused in other cells that are sufficiently far away to avoid interference**

Problem due to limited spectrumSpectrum allocation at 800 Mhz 25 Mhz1G AMPS systems 30 Khz/channelCapacity = 25 Mhz/30Khz = 833 channelsHence 833 simultaneous users (hardly enough)**

Frequency re-useAssume 832 channels availableDivide into 4 sets = 832/4 = 208 channels per cellFor N cells in the system total capacity = 208N (instead of 832)**

Frequency reuse**

Cell boundariesWant to cover area without gaps or overlaps:squares, triangles, hexagonsWant to have signal strength as large as possible for all points within the cellhexagon is closest to a circleThis is an idealized representation, in the real world, cell boundaries are ill-defined.**

Limitations of Frequency reuseThis is limited by S/I S Signal strength in dbI Co channel interference in db**

Methods of increasing capacityCells are split to add channels**

Method to increase capacity-sectoring**

Methods for increasing capacity- Umbrella cells**

**

BluetoothBluetoothis the name given to a new technology using short-range radio links, intended to replace the cable(s) connecting portable and/or fixed electronic devices. It is envisaged that it will allow for the replacement of the many propriety cables that connect one device to another with one universal radio link. Its key features are robustness, low complexity, low power and low cost. Designed to operate in noisy frequency environments, the Bluetooth radio uses a fast acknowledgement and frequency hopping scheme to make the link robust. Bluetooth radio modules operate in the unlicensed ISM band at 2.4GHz, and avoid interference from other signals by hopping to a new frequency after transmitting or receiving a packet. Compared with other systems in the same frequency band, the Bluetooth radio hops faster and uses shorter packets.**

Bluetooth stack**

Bluetooth stackThe Radio layer defines the requirements for a Bluetooth transceiver operating in the 2.4 GHz ISM band.TheBasebandlayer describes the specification of the Bluetooth Link Controller (LC) which carries out the baseband protocols and other low-level link routines.The Link Manager Protocol (LMP) is used by the Link Managers (on either side) for link set-up and control. The Host Controller Interface (HCI) provides a command interface to the Baseband Link Controller and Link Manager, and access to hardware status and control registers.Logical Link Control and Adaptation Protocol (L2CAP) supports higher level protocol multiplexing, packet segmentation and reassembly, and the conveying of quality of service information. The RFCOMM protocol provides emulation of serial ports over the L2CAP protocol. The protocol is based on the ETSI standard TS 07.10.

The Service Discovery Protocol (SDP) provides a means for applications to discover which services are provided by or available through a Bluetooth device. It also allows applications to determine the characteristics of those available services.**

**Bluetooth stack vs OSI

Bluetooth Features **

**Blue tooth target devices

**

Why WiFi ?Setup Cost Reduced cabling requiredFlexibility Quick and easy to setup in temporary or permanent spaceScalable Can be expanded with growthFreedom You can work from any location that you can get a signalLower total cost of ownership Because of affordability and low install costMobile Users Can access the Corporate network from any public hotspot using VPN**

802.11b

Been around the longest, well-supported, stable, and cost effective, but runs in the 2.4 GHz range that makes it prone to interference from other devices (microwave ovens, cordless phones, etc) and also has security disadvantagesHas 11 channels, with 3 non-overlapping, and supportsrates from 1 to 11 Mbps, but realistically about 4-5 MbpsUses direct-sequence spread-spectrum technology**

802.11gExtension of 802.11b, with the same disadvantages (security and interference)Has a shorter range than 802.11bIs backwards compatible with 802.11b so it allows or a smooth transition from 11b to 11gFlexible because multiple channels can be combined for faster throughput, but limited to one access pointRuns at 54 Mbps, but realistically about 20-25 Mbps and about 14 Mbps when b associatedUses frequency division multiplexing technology**

802.11aCompletely different from 11b and 11g.

Flexible because multiple channels can be combined for faster throughput and more access points can be collocatedShorter range than 11b and 11gRuns in the 5 GHz range, so less interference from other devicesHas 12 channels, 8 non-overlapping, and supports rates from 6 to 54 Mbps, but realistically about 27 Mbps maxUses frequency division multiplexing technology**

Security in WiFi

Data Security/EncryptionThird Party solution - FortressWi-Fi Protected Access (WPA)Wired Equivalent Privacy (WEP)-Shared key

AccessWPA/WEPMAC Authentication MAC address control

Attack Denial of ServiceClient ProtectionAntivirus/Firewall**

**

Questions ?**

Quiz 31. The Core Network (CN) consists of CS domain and PS domaina. True b. False2. The Access Network in 2G does not includeBSC b. BTS c. MSC d. RNC3. The 2G CS domain does not includea. MSC b. HLR c. AuC d. SGSN4.Which is not true of the HLR a. It is a Database b. It stores IMSI, features and services c. It is involved routing of calls from PSTN d. Does switching and routing5. Which is not true of EIR a. Stores IMEI b. Used to determine if equipment is stolen c. Is a database d. Does radio resource management6. A GMSC a. Will query HLR for call from PSTN b. Does switching and routing c. Connected to PSTN d. All of the above7. Which is true SGSN a. Does packet routing & transfer b. Does mobility management c. Does charging d. all of the above

**

Quiz 3Which is not true of the speedsGSM 64 Kbps b. GPRS 115 kbps c. EDGE - 384 Kbps d. 3 G 2 MbpsA SC in a SMS network is used for storing and forwarding SMS messagesTrue b. FalseThe Access Network of a 3G Architecture consists of MSC, HLR, VLR b. RNC, Node B c. SGSN, GGSN d. AUC, EIRAssume spectrum is 30 Mhz and channel bandwidth is 30 Khz then number of users is833 b. 1000 c. 500 d. Cannot sayWhich is not true of BluetoothUses 2.4 GHz b. Uses TDMA with TDD c. Range 1 Km d. Gross Data rate of 1 km.L2CAP is not used forQoS b. Segmentation c.Reassembly d. Link serup and tear downSecurity in WiFi networks uses a. WPA b. WEP c. MAC Authentication d. All of the aboveMSCs use packet switching technologya. True b. False

**Call flows and Advanced wireless concepts

Agenda Session 4Call flows and Advanced wireless concepts

GSM Air interfaceGSM air interface channelsLocation Updating Sequence FlowsMobile origination to PSTNPSTN origination to MobileGPRS call flowSMS call FlowRecapInter BSC Handoff scenarioUMTSSoftswitchIMS Architecture3.5 GMobile data explosionThe evolution of LTERecapQuiz 4

**

Basic Network ArchitectureMSCHLRBSCBTSBTSBTS**

Air Interface Access techniquesRadio spectrum is a finite resourceThe radio access method is either Frequency division duplex (FDD) or Time Division Duplex (TDD). The protocol method is TDMA, FDMA or CDMAFrequency Division Duplex (FDD) : Two separate radio channels are used for communicating to the base stationOne radio channel for , f1, for downlinkOne radio channel, f2, for uplinkf1 - downlinkf2 - uplinkFDD**

TDDTime Division Duplex (TDD)One radio channel for communicating to base station. Duplexing is done on time**

Mobile radio propagation effectsSignal strengthMust be strong enough between base station and mobile unit to maintain signal quality at the receiverMust not be so strong as to create too much co-channel interference with channels in another cell using the same frequency bandFadingSignal propagation effects may disrupt the signal and cause errors

**

GSM ArchitectureThe interface between the BTS and BSC is known as the A-bis interfaceMSC One or more BSCs are connected to MSC. The MSC is a switch the node that controls call setup, call routing and many of the functions provided by the standard telecommunication switchVLR is a database that contains subscriber related information for the duration that a subscriber is in the coverage area of an MSC. The MSC and VLR are in the same platform,

The interface between the BSC and MSC is known as A-interfaceThis is a SS7 based interface using the SCCP. Above this is the BSS Application Part (BSSAP) which is the protocol for communicating between the BSC and the MSC.Since the MSC communicated with the BSC and the MS the BSSAP is divided into two parts the BSSMAP (BSS Management Application Part) and the Direct Transfer Application Part (DTAP)BSSMAP are messages to BSSDTAP messages are passed transparently thro the BSS to the NS`**

GSM Protocol stack**

GSM ArchitectureHLR The Home Location register contains subscriber data such has the details the subscriber has subscribed to . Associated with the HLR ios the authentication center (AuC). This is the network element that contains the subscriber specific authentication data such as the secret keyFor a given subscriber using a random number generated by the AuC and passed to the SIM via the HLR., MSC and ME. The SIM performs the calculation using the Ki and the authentication algorithm. If the result os the calculation by the SIM matches that in AuC then the subscriner has been authenticated**

GMSCWhen a call from a PSTN it arrives at a type of MSC known as the GMSC.The GMSC queries the HLR to determine the location of the subscriberThe response from the HLR indicates to the GMSC when the subscriber may be foundThe call is forwarded by the GMSC to the MSC serving the subscriber

**

The GSM Air interfaceGSM uses TDMA with Frequency Division duples (FDD) GSM has been deployed in 900 Mhz, 1800 Mhz, 1900 MhzIn GSM a given band is divided into 200 Khz carries or RF channels in both uplink and downlink directionsFor eg. In standard 900 Mhz band the first uplink is 890.2 Mhz and the last uplink is 914.8 allowing a total of 124 carriers914.8 Mhz 890.2 Mhz = 24.6 Mhz/200 Khz = 123+ 1 carriers or channelsEach RF carrier is divided into 8 time slots . The 8 time slots are used to carry user traffic and also control traffic**

Types of Air Interface channelsThere are 3 types of channelsBroadcast channels Control channelsTraffic channels

Broadcast ChannelsFrequency correction channel (FCCH) used for frequency correction of the MSSynchronization channel (SCH) Broadcast by BTS and is used for mobile station for frame synchronizationBroadcast Control Channel (BCCH) Broadcast general information

Common Control Channel (CCCH) Paging channel used for paging of the mobilesRandom Access Channel (RACH) Only used in uplink. It is used to allocate to MS a Stand alone dedicated Control Channel (SDCCH) or directly to a Traffic Channel (TCH)Access Grant Channel (AGCH) used in the downlink in responswe to a access request received on the RACH

**

Air interface channelsNotification Channel used to notify MSStandalone dedicated control channel (SDCCH) Used towards MS when it is not used for TCH. Used for SMS. Call establishment signaling prior to allocation of TCHSlow Associated Control Channel (SACCH) Power Control messages from BTS to MS are sent on this channel. In the uplink the MS sends measurement reports to the BTSFast Associated Control Channel (FACCH) Used to transmit non voice information to and from the MS**

Air interface channel structureCertain time slots in a given RF carrier are allocated to control channel whereas the remaining are for traffic channels. For eg. Time slot 0 us for BCCH /CCCH . It may also carry 4 SDCCHBCCH/CCCH/SDCCHTCHTCHTCHTCHTCHTCHTCH**

How does the cellular network know the mobiles position?The cell phone keeps the cellular operator informed about your location.**

Location AreaLocation Area (LA)A GSM network is divided into cells. A group of cells is considered a location area. A mobile phone in motion keeps the network informed about changes in the location area. If the mobile moves from a cell in one location area to a cell in another location area, the mobile phone should perform a location area update to inform the network about the exact location of the mobile phone.Home Location Register (HLR)The HLR maintains a database for the mobile subscribers. At any point of time, the HLR knows the address of the MSC VLR that control the current location area of the mobile. The HLR is informed about a location area update only if the location area change has resulted in a change of the MSC VLR.Mobile Switching Center - Visitor Location Register (MSC VLR)The MSC VLR is responsible to switching voice calls and it also keeps track of the exact location area where the mobile user is present. Note that a typical MSC VLR will service several location areas.**

Location UpdateWhen the MS is switched on it must camp on a suitable cell. This involves scanning the air interface to select a cell with a suitably strong signal and decoding the informationbroadcast by the BTS on the BCCHThe MS makes a channel request on the RACH with a cause as Location UpdatingThe BSS allocates an SDCCH for the MS to use. It instructs the MS to move to the SDCCH by sending an immediate assignment message on the AGCHThe MS then moves the SDCCH and send the location updating message. This contains the location area identity and the mobile identity. The mobile identity is either the International Mobile Subscriber Identity (IMSI) or the Temporary Mobile Subscriber Identity (TMSI).This is sent through the BSS to the NSC On receipt of the IMSI the NSC.VLR attempt to authenticate the subscriber.If the MSC does not have authentication information then it request the HLR using the MAP operation Send Authetication Info.The HLR AuC sends the MAP Return Result with up to five authentication vectors

**

Location UpdateKnown as triplets. Each triplet contains a random number (RAND) and a signed response (SRES)The MSC sends an Authentication request to the MS. This contains the RAND.The MS performs the same calculations as were performed by the HLR/AuC and send the Authentication response containing the SRES parameter.The MSC/VLR check rto make sure that the SRES from the MS matches the SRES from HLR/AuCIf a match is made then the MS is authenticatedAt this point the MSC/VLR use te MAP Operation Update Location to inform the HLR of the subscriber location.The HLR immediately sends a Cancel Location message to the VLR to remove anty previous locationVLR deletes any previous dataHLR uses a MAP operation to Insert Subscriber data to VLRVLR acknowledges receipt of informationHLR sends a return result of the MAP Update Location**

Location UpdateOn receipt of the return result the MSC sends a DTAP message Location Updating Accept to the MS**

Location Update Sequence flowChannel RequestImmediate Channel AssignmentLocation Updating RequestLocation Updating RequestSend Authentication InfoSend Authentication Info RR Authentication RequestBSSMSC/VLRHLR/AuCMSC/VLRPrevious Authentication ResponseUpdate LocationCancel LocationCancel Location RR**

Location Update Sequence flowInsert Subscriber data RRBSSMSC/VLRHLR/AuCMSC/VLRPreviousInsert Subscriber dataUpdate Location RRLocation Update AcceptClear CommandClear CompleteChannel release**

Mobile Originated Call to PSTNRequest AccessThe MS sends aChannel Request(CHAN_REQ) message on the RACH. The BSS responds with a radio resource assignment (IMM_ASS_CMD) on the AGCH. The MS sends aService Request(CM_SERV_REQ) message to the BSS on the SDCCH.

AuthenticationBefore the network will provide any services to the MS, the network will require the MS to authenticate itself. The BSS sends anAuthentication Request(AUTH_REQ) message to the MS. The RAND serves as the "challenge" for authentication.The MS calculates the proper SRES based on the RAND that was given and sends the SRES to the BSS in an Authentication Response(AUTH_RESP) message.The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed access to the network. The BSS will send aService Accept(CM_SERV_ACC) message letting the MS know that the service request was received and processed.Once authenticated, the BSS orders the MS to switch to cipher mode with the CIPH_MOD_CMD message.**

Mobile Originated Call to PSTNInitial Call SetupThe MS will immediately switch to cipher mode and send a Cipher Mode Complete (CIPH_MOD_COM) message.The MS then sends a Call Setup (SETUP) message to the BSS. The message includes the address information (MSISDN) of the called party.The BSS assigns a TCH to the MS by sending an Assignment Command (ASS_CMD) message. This message includes which Transceiver (TRX) and which Time Slot (TS) to use.The BSS does not actually assign a TCH to the MS until the MSC sends a Call Proceeding (CALL_PROC) message to the BSS indicating that the IAM has been sent.The MS immediately switches to the assigned TCH. The MS sends an Assignment Complete (ASS_COM) message back to the BTS on the FACCH.**

Mobile Originated Call to PSTNCall SetupThe MSC sends an Initial Address Message (IAM) to the GMSC. The IAM contains the MSISDN of the called party as the MS dialed it.The MSC will also send a Call Proceeding (CALL_PROC) message down to the BSS and this is when the BSS would assign a TCH to the MS, as described in step 10 above.Based on the dialed number, the GMSC decides where to route the IAM within the PSTN.The PSTN will continue to route the IAM until it reaches the correct Switching Center and the call routing is complete. The PSTN will then establish the call circuit and send an Address Complete Message (ACM) back to the GMSC.The GMSC then forwards the ACM back to the responsible MSC indicating that the call circuit has been established**

Mobile Originated Call to PSTNCall EstablishmentOnce the MSC receives the ACM, it sends an ALERT message to the MS indicating that the call is going through. The BSS sends the ALERT message on the FACCH. Once the MS receives the ALERT, it will generate the ringing sound in the earpiece. The BSS sends an alerting message the subscriber will hear the line ringing.Once the called party answers the phone, the PSTN will send an Answer message to the MSC. The MSC forwards this to the MS in a Connection (CON) message.Once the MS receives the CON message, it switches over to voice and begins the call. All voice traffic occurs on the assigned TCH.**

Mobile Originated Call to PSTNCall TerminationWhen either the caller or the called party hangs up, the call will be disconnected. Either party can initiate the disconnect. In this example, the MS initiates the disconnect. The MS sends a Disconnect (DISC) message to the BTS on the FACCH.The BSS forwards the DISC to the MSC. Once the MSC receives the DISC message, it sends a Release (REL) message through the GMSC to the PSTN as well as down through the BSS to the MS.The MS responds by sending a Release Complete (REL_COM) message to the BSS on the FACCH. The BSS forwards the REL_COM message up to the MSC. Once the MSC receives the REL_COM message the call is considered ended from the call control perspective.Although the call has ended, the BSS still has a TCH allocated to the MS. The MSC sends a Channel Release (CHAN_REL) message to the BSS. The BSS forwards the CHAN_REL message to the MS.The MS responds with a DISC (LAPDm) message and returns to an idle mode. The BSS reallocates the channel for other call or releases the TRX.**

Mobile Originated Call to PSTNCM Service RequestService request MO call

BSSMSC/VLRPSTNComplete Layer 3Authentication RequestAuthentication ResponseCipher Mode CommandCiphering Mode CommandCiphering Mode CompleteCipher Mode CompleteCall ProceedingSetupAssignment RequestAssignment CommandAssignment CompleteAssignment Complete**

Mobile Originated Call to PSTNIAMBSSMSC/VLRPSTNACMAlertingANMANMConnect Acknowledge**

PSTN to Mobile call flowMobile Terminated CallRoute Establishment to find the MSC/VLRThe calling party dials the MSISDN for the mobile subscriber. The PSTN identifies the network (PLMN) that the dialed MSISDN belongs to and will locate a GMSC for that network. The PSTN sends anInitial Addressmessage to the GMSC.The GMSC forwards the MSISDN to the HLR and requests routing information for it. The HLR looks up the MSISDN and determines the IMSI and theSS7address for the MSC/VLR that is servicing the MS.The HLR then contacts the servicing MSC/VLR and asks it to assign a Mobile Station Routing Number (MSRN) to the call.The MSC/VLR allocates the MSRN and forwards it to the HLR. Note: It is important to remember that the MSC/VLR assigns a MSRN to thecallnot to the MS itself.The HLR forwards the MSRN as well as routing information for the servicing MSC/VLR to the GMSC.The GMSC sends an Initial Addressing message to the servicing MSC/VLR and uses the MSRN to route the call to the MSC/VLR. Once the servicing MSC/VLR receives the call, the MSRN can be released and may be made available for reassignment.**

PSTN to Mobile call flowPaging the Mobile StationThe MSC/VLR then orders all of its BSCs and BTSs to page the MS. Since the MSC/VLR does not know exactly which BSC and BTS the MS is monitoring, the page will be sent out across the entire Location Area.Initial SetupThe MS receives thePage Request(PAG_REQ) on the PCH. The MS recognizes that the page is intended for it, based on a TMSI or an IMSI.The MS sends aChannel Request(CHAN_REQ) message on the RACH.The BSS responds on the AGCH by sending anImmediate Assignment(IMM ASS) message which assigns an SDCCH to the MS. At this point, the network does not know that the MS is the one that it is paging, it only knows that this MS wants access to the network The MS immediately switches to the assigned SDCCH and sends aPaging Response(PAG_RES) message on the SDCCH. This lets the network know that the MS is responding to its page.**

PSTN to Mobile call flowAuthenticationBefore the network will provide any services to the MS, the network will require the MS to authenticate itself. The BSS sends anAuthentication Request(AUTH_REQ) message to the MS. The RAND serves as the "challenge" for authentication.The MS calculates the proper SRES based on the RAND that was given and sends the SRES to the BSS in anAuthentication Response(AUTH_RESP) message.The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed access to the network.Once the MSC/VLR has authenticated the MS, it will order the BSS and MS to switch to cipher mode using the CIPH_MOD_CMD message. Once the MS in encryption mode, the VLR will normally assign a new TMSI to the MS.**

PSTN to Mobile call flowEstablishing a ChannelOnce the MS is authenticated and in encryption mode, The MSC sends a Setup Message to the BSS, the BSS forwards the SETUP message to the MS on the assigned SDCCH.the assigned SDCCH. The SETUP message may include theCalling Line Identification Presentation(CLIP), which is essentially caller ID.The MS responds by sending aCall Confirmed(CALL_CON) message; which indicates that the MS is able to establish the requested connection. The BSS relays the message up to the MSC.Call SetupThe BSS then sends anAssignment Command(ASS_CMD) message to the MS on the assigned SDCCH. The ASS_CMD message assigns a Traffic Channel (TCH) to the MS.The MS immediately switches to the TCH and responds with anAssignment Complete(ASS_COM) message on the FACCH. The MS begins ringing once it has established the TCH. Remember that all signaling that occurs on the traffic channel actually occurs on a FACCH, which is a time slot that is stolen from the TCH and used for signaling. The MS sends an ALERT message to the MSC on the FACCH. The BSS forwards the ALERT message through the PSTN to the calling party and the caller hears the line ringing.**

PSTN to Mobile call flowCall EstablishmentOnce the user answers the call (by pressing the send button), the MS will send aConnectCON message to the MSC. The Connect message is forwarded back to the caller's switch to activate the call.The MSC sends aConnect AcknowledgeCON_ACK message to the MS and the call is established.Call DisconnectDisconnect happens the same way as for any other call. In this example, the calling party initiates the disconnect.When the calling party hangs up, the calling party's switch initiates aRelease(REL) message. The message is forwarded to the serving MSC, which is then forwarded to the BSS.The BSS will send aDisconnect(DISC) message to the MS on the FACCH.**

PSTN to Mobile call flowThe MS confirms release of the call by sending aRelease(REL) message on the FACCH, which is forwarded to the MSC.The MSC sends eRelease Complete(REL_COM) message through the BSS to the MS. As far as call control (CC) is concerned, the connection has been terminated.The MS still has a TCH assigned to it, so the BSS sends aChannel Release(CHAN_REL) message to the MS. This releases the radio resource on the Air Interface.The MS responds be sending a finalDisconnectmessage and returns to idle.**

PSTN to Mobile call flowBSSMSC/VLRHLRGMSCPSTNIAMSend Routing Info (SRI)Provide Routing Number (PRN)IAM (MSRN)PagingChannel RequestPaging RequestPaging RequestImmediate AssignmentPaging ResponsePaging ResponseCipher mode commandCiphering mode commandCiphering mode response**

PSTN to Mobile call flowBSSMSC/VLRHLRGMSCPSTNCipher mode completeSetupCall confirmedAssignment requestAssignment commandAssignment completeAlertingACMConnectACMANMANMConnect Acknowledge**

PSTN to Mobile Call Flow**

SMS-MO1. The mobile station transfers the short message to the MSC. 2. The MSC queries the VLR to verify that the message transfer does not violate the supplementary services invoked or the restrictions imposed on the subscriber. 3. The MSC sends the short message to the SMSC using theforwardShortMessage operation. 4. The SMSC delivers the short message to the SMC. 5. The SMSC acknowledges the successful outcome of theforwardShortMessage operation to the MSC. 6. The MSC returns the outcome of the short message operation to the mobile station.**

SMS-MO**

SMS-MO**

SMS-MT1.The Short message is transferred from SC to SMS-GMSC2.SMS-GMSC queries the HLR(SRI) and receives the routing information for the mobile subscriber (SRI-ACK).3. The SMS-GMSC sends the short message to the MSC using the forwardShortMessage operation(FSM).4. The MSC retrieves the subscriber information from the VLR. This operation may include an authentication procedure.5. The MSC transfers the short message to the mobile station.`6. The MSC returns the outcome of the forwardShortMessage operation to the SMS-GMSC(FSM-ACK).7. If requested by the SMC, the SMSC returns a status report indicating delivery of the short message.**

SMS-MT**

SMS-MT**

HandoverA handover (aka handoff) is the process by which a call in progress is transferred from one radio channel in the same cell or different cell.A handover can occur Within a cellBetween cells of the same BTSBetween cells of diffferent BTS of same BSCBetween cells of different BSC Between cells of different MSCs**

Inter BSC handoverInter BSC handoverThe BSC must involve the MSCOne the serving BSC determines that a handover should take place it sends a message handover required too the NSCThe message contains information about the desired target cell and the the current cellThe MSC analyzes the information and identifies the target BSC associated with the target cellIt then sends a Handover Request to rthe target BSC

**

Inter BSC handoverServing BSSMSC/VLRTarget BSSMeasurement ReportMeasurement ReportHandover RequestHandover RequestHandover Request AckHandover CommandHandover CommandMS tunes to new channelHandover AccessHandover DetectHandover CompleteHandover CompleteClear CommandClear CompleteMeasurement ReportMeasurement ReportMeasurement Report**

Hand-off scenario**

Handoff/handoverHandoff (also known as handover) is the ability of the subscriber to maintain a call while moving within a networkHandoff is used in AMPS, IS-136 and IS-95. In GSM it is called handoverHandover means that subscriber is transitioned from one radio channel and/or time slot) to another.Depending on the two cells in question the handover can be between two sectors on the same station between two BSCs between 2 MSCs or even between networksBase station BBase station ABase station BBase station A**

GPRS call flowAttachThe terminal initiates a attach processThe SGSN authenticates the GPRS mobile by sending a RAND value (a random value).The SIM applies secret GSM algorithms on the RAND and the secret key Ki to obtain the session key Kc and SRES. The computed SRES value is passed to the SGSN.SGSN authenticates the responseSGSN accepts the attach requestActivate PDP contextThe terminal does a PDP Activate PDP contextSGSN does a DNS Query to the DNS server to find the address of the GGSN (Global GPRS Support Node)The DNS server sends the IP Address of the GGSNThe SGSN sends a Create PDP Activate context to the GGSNThe GGSN does a RADIUS authenticate to RADIUS serverThe RADIUS does a authenticate response**

GPRS call flowGGSN request for dynamic IP addressThe DHCP sends back a IP addressThe GGSN sends a Create PDP Context ResponseSGSN sends a PDP Context Accept**

GPRS call flowSGSNDNS ServerGGSNRadius serverDHCPserverAttach requestAuthenticate response (SRES)Authenticate request (RAND)Attach completeCreate PDP ContextRADIUS Authenticate RequestActivate PDP Context AcceptAttach acceptActivate PDP ContextAPNDNS Query (APN)DNS Response (GGSN IP)RADIUS Authenticate ResponseDHCP Address requestDHCP Address responseCreate PDP Context Response**

**

Universal Mobile Telecommunication Service (UMTS)UMTS represents an evolution of GSM to support 3G capabilitiesThe air interface is known as UTRANUMTS uses Wideband CDMA (WCDMA)The air interface consists ofNode BRNCCore NetworkMSC ServerMedia GatewayHLRVLRGMSC**

UTRANUMTS Terrestrial Radio Access Network (UTRAN)The UTRAN consists of the Radio Network Controller (RNC) and Node B which is the base stationThe RNC is analogous to the GSM BSC The Base station is equivalent to the Node B**

MSC Server Mobile Switching Center ServerCS-MGW Core System Media GatewayGMSC Server Gateway Mobile Switching Center ServerGGSN Gateway GPRS Support NodeSGSN Serving GPRS Support NodeVLR Visitor Location RegisterHLR Home Location RegisterEIR Equipment Identification RegisterAuC Authentication CenterBSC Base Station ControllerBTS Base Transceiver SystemRNC Radio Network ControllerRNC Radio Network ControllerPSTN Public Switched Telephone NetworkWireless Network (Release 4)***

Mc

BSS

BSC

RNS

RNC

CN

Nc

PSTN

Node B

Node B

IuPS

Iur

Iub

USIM

ME

MS

Cu

Uu

MSC server

SGSN

Gs

GGSN

GMSC

server

Gn

HLR

Gr

Gc

C

D

Nc

Nb

H

EIR

F

Gf

Gi

PSTN

IuCS

VLR

B

Gp

VLR

G

Nb

BTS

BTS

Um

RNC

AuC

CS-MGW

Abis

CS-MGW

CS-MGW

cell

Mc

SIM

SIM-ME i/f

or

MSC server

B

Mc

PSTN

PSTN

E

A

Gb

3G Rel 4 Architecture - Softswicth**

UMTS Network ArchitectureSoftswitchHLRRNCNode BNode BNode B**

SoftswitchSoftswitch denotes a component in a new architecture designed for migrating from a voice centric world to a data centric world.Separates signaling from the bearer traffic allowing for greater flexibility and efficiencyRepresents a move from the monolithic traditional circuit switches to a more distributed, open architecture and provides for greater degree of flexibility

**

Softswitch vs Legacy SwitchMonolithic(Control + Bearer Integrated)Proprietary InterfacesInefficient Resource UtilizationLimited ScalabilityHigher Operating CostsLong Feature Development IntervalsDisaggregated(Control separated from Bearer)Open InterfacesMost Efficient Resource UtilizationHigh ScalabilityLower Capital / Operating CostsRapid Feature Development / 3rd Party**

IMS ArchitectureIMS is a framework of network nodes that use SIP signaling and an all IP core.Access agnostic. The network can be accessed by Fixed lines, mobiles, PDA etcPromises rich services like voice, data, video conferencing, real time gaming etcUses the GPRS network Uses DIAMETER for AAA and database accessAllows for Fixed Mobile Convergence**

**IMS Network

Market conditionsMobile data is growing at an exponential speedMobile data in US & Europe expected to grow at a CAGR of 55% & 42% respectivelyMobile data revenues expected to grow at a rate of 18%Mobile broadband connections will reach 1 billion by 2012 segmented between 3G & 4G technologies

HighlightsAnnual IP traffic will exceed a zettabyte in 4 years by 2012 (10 21)Internet video (Youtube, DVD sharing ,IPTV) account for 30% of IP trafficVideo communication and dynamic video will increase the burden on the networkGlobal IP traffic will double every two years to 2010 and beyond

**

The explosion of mobile dataIn the last 2 years 1 billion new mobile subscriptions added2 billion wireless devices sold

Device range from Mobile phones, Smartphones, Netbooks, PDAs, Wireless dongles and Tablets

Currently there are 3.5 billion subscribers worldwide3G accounts for 350 million with 30 million added every quarterLTE forecast to reach 32.6 million by 2013

**

The rise and rise of data**

Growth in data traffic**

3.5 GHigh Speed Downlink Packet Data Access (HSDPA) Enhanced modulation scheme over WCDMA with throughput of 14.4 MbpsUses 16 QAM in addition QPSK

High Speed Uplink Packet Data Access (HSUPA)Enables uplink of 1.4 Mbps upto 5.76 MbpsGSMGPRSWCDMARel 99HSDPA Rel 5HSUPA Rel 6EDGE**

Elements of the LTE SystemLTE encompasses the evolution of Radio access through E-UTRAN (eNodeB)Non-radio aspects under the term System Architecture Evolution (SAE)

Entire system composed of LTE & SAE is called Evolved Packet System (EPS)

At a high level a LTE network is composed of Access network comprised of E-UTRANCore Network called Evolved Packet Core (EPC)

**

UE User Equipment used to connect to the EPS (Evolved Packet System). This is an LTE capable UE

The LTE network is comprised of a) Access Network b) Core Network

Access network ENB (eNodeB) The evolved RAN consists of single node, the eNodeB that interfaces with UE. The eNodeB hosts the PHY,MAC, RLC & RRC layers. It handles radio resource management & scheduling.

Core Network (Evolved Packet Core-EPC) MME (Mobility Management Entity) Performs paging, chooses the SGW during UE attach

S-GW (Serving Gateway) routes & and forwards user data packets

P-GW (Packet Gateway) provides connectivity between the UE and the external packet networks.

LTE Network Elements**

LTE Network Elements**

LTE TechnologiesLTE uses OFDM (Orthogonal Frequency Division Multiplexing) for lower latency and better spectral efficiency

Uses MIMO (Mulitple In Multiple Out) LTE uses several transmit & receive paths reducing interference with increase in spectral efficiency and throughput.

Flatter architecture Fewer Network elements in the LTE Evolved Packet Core(EPC). This results in lower latency because of lesser number of hops as compared to 3G. Absence of RNC like Network Element(NE).**

2.5G GPRS Network Elements**

The evolution of mobile technology

**

YearStandardsTechnological evolution1.19993GPP Rel 99GSM, GPRS, EDGE, UMTS based(2G, 2.5G, 2.75G, 3G)2.20013GPP Rel 4Minor upgrades to UMTS, radio interface3.2002 3GPP Rel 5HSDPA , IMS architecture (3.5G)4.2005 3GPP Rel 6Higher speeds5.20073GPP Rel 7 HSPA+,PoC, Voice & Video over VOIP6.20083GPP Rel 8EPS (E-UTRAN/LTE) (3.99G/4G)7.20093GPP Rel 9Enhancement to EPS8.20103GPP Rel 10LTE- Advanced (4G)

**

Questions ?**

Quiz 4A call from a PSTN to wireless network comes first to the MSC b. GMSC c. HLR d. VLRThe GMSC determines where to route the call by a. Checking its VLR b. Querying the HLR c. It knows where the mobile is d. none of the aboveGSM has been deployed in800 Mhz b. 1800 Mhz c. 1900 Mhz d. 2.4 GhzWhich is not an Air Interface channel a. Broadcast channel b. Control channel c. Traffic channel d. All of the aboveSDCCH is used for a. SMS b. For call establishment signaling c. both a & b d. None of the abover6. How does a mobile inform its whereabouts a. It is stored in HLR b. By doing a Location Update c. HLR is informed of location changes d. Both b & c7. While doing Location Update, authentication is done at AuC & Mobile a. True b. False8. For Authentication MSC sends the mobile a. RAND b. SRES c. Ki d. All of the above9. MS sends a channel request on a. RACH b. AGCH c. SDCCH d. TCH**

Quiz 4Which of the following is true in a PSTN to mobile call a. GMSC sends MSISDN to HLR b. HLR determines MSC/VLR from MSISDN c. MSC/VLR sends a MSRN d. all of the aboveUMTS uses 1. TDMA with FDD 2. CDMA 3. WCDMA 4. FDMA with FDD12. Softswitch separates bearer from control a. True b. False13. Which is not true for softswitch a. Uses time slot interchange b. uses media gateway c. does packet switching d. none of the above14. Which of the following is true for IMS a. Uses SIP signaling b. Uses an IP Core c. Uses DIAMETER d. all of the above15. LTE is made of the following a. BTS, BSC, MSC b. Node B, RNC, Softswitch c. Node B, RNC, SGSN, GGSN d. eNodeB, MME, SGW, GGW

**

Good luck & thank You !!!**Tinniam V Ganeshtvganesh.85@gmail.comRead my blogs: http://gigadom.wordpress.com/ http://savvydom.wordpress.com/