Wireless Network and Mobile Computing, GSM, Gsm architecture, address and Identifiers

1. Global system for
mobile
communication
1

2. Introduction
 It covers around 71% of the market today
 People not only use for business but also personal life
 Used for wireless telephony and messaging through SMS
 Supports facsimile (Fax) and data communication
 GSM is based on set of standards. The proposed GSM had to meet certain business
objectives, these are:
 Support for international roaming
 Good speech quality
 Ability to support handheld terminals
 Low terminal and service cost
 ISDN compatibility
2

3. GSM history timeline 3

4.  Frequency reuse concept led to the development of Cellular
technology by AT&T and Bell Labs in 1947
 Characteristics were:
 The area covered is subdivided into radio zones or cells. Cells can be
of any shape, for convenient it is considered as hexagon. Base
stations are placed at the centre of these cells
 Each cells i receives a subset of frequencies from the total set
assigned to respective mobile network. To avoid any type of
interference, no to neighbouring cells can use same frequency
 Only at distance of D (known as frequency reuse distance) , the
same frequency from the set can be reused.
 When moving from one cell to another during an outgoing
conversation , an automatic channel change occurs. This
phenomenon is called handover
4

5.  Regular repetition of frequencies in cells result in a clustering of cells
 The size of cluster is defined by k, the number of cells in the cluster
 This also defines the frequency reuse distance D
 The following fig is an example of cluster size of 4
5

6. Cell clusters in GSM 6

7. GSM Architecture
 Are structured in hierarchic fashion
 Administrative region assigned to one MSC(mobile switching centre)
 Administrative region is called PLMN i.e. Public Land Mobile Network
 It is subdivided into one or many Location Area (LA).One LA consists of
many cell groups
 Each cell group is assigned to one BSC (base station controller)
 Each LA there will be at least one BSC
 Cells in one BSC can belong to different LA’s
 Cells are formed by the radio areas covered by a BTS (Base Transceiver
Station)
 Several BTs are controlled by one BSC
 Traffic from the MS is routed through MSC
7

8. GSM System hierarchy 8

9. Architecture of GSM
9

10.  All subscribers with cellular network operator , permanent data such
as the service profile is stored in the Home Location Register (HLR)
 Authentication information like International Mobile Subscriber
Identity (IMSI)
 Identification information like name, address etc of the subscriber
 Operator selected denial of service to the subscriber
 Billing information like prepaid or postpaid customer
10

11.  Handling supplementary services like CFU (Call forwarding
Unconditional), CFB (Call Forwarding Busy), CFNR (Call Forwarding
Not Reachable ), CFNR( Call Forwarding Not Reachable)or CFNA
(Call forwarding Not Answered)
 Storage of SMS number in case the mobile not connectable so that
whenever the mobile is connectable , a paging signal is sent to the
SC
11

12. GSM entities
12

13. GSM entities
 The GSM technical specifications define different entities that form
the GSM network by defining their functions and interface
requirements
 Can be divided into five different groups:
 The Mobile Station (MS): Includes the Mobile Equipment (ME) and
the Subscriber Identity Module(SIM)
 The Base Station Subsystem (BSS) : includes the Base Transceiver
Station (BTS) and Base Station Controller (BSC)
13

14.  The Network and Switching Subsystem (NSS) : it includes MSTN,
HLR,VLR, Equipment Identity Register (EIR) , Authentication Centre
(AUC)
 The Operation and Support Subsystem (OSS): includes the
operation and Maintenance Centre (OMC)
 The data infrastructure: include PSTN, ISDN , PDN(Public Data
network)
14

15. Mobile Station
 Technical name for mobile or the cellular phone
 Earlier days , mobile phone were large in size and now they come in
smaller in size
 It has two important components in it
 The mobile equipment or device or phone without SIM
 Subscriber Identity Module (SIM)
 The weight and volume of the mobile phones are decreasing
 Life of Battery charging is also increasing.
15

16.  SIM is installed in every GSM phone, they are smart processor card
 They have a processor and small amount of memory i.e 32K bytes
 By inserting SIM card, user have access to all subscribed services.
 It has International Mobile Subscriber identity used to identify the
subscriber to the system, a secret key for authentication and other
security information
 Applications are developed and stored in SIM cards using SAT (Sim
Application Toolkit)
16

17. The base station subsystem
 Connects the Mobile station and the NSS (Network and Switching
Subsystem)
 Can be divided into two parts
 The base transceiver station (BTS) or base station
 The base station controller (BSC)
 The base station corresponds to the transceivers and antennas used
in each cell of the network
 Urban areas large number of BTS will be deployed
 Usually placed in the centre of the cell
17

18.  Its transmitting power defines the size of cell
 Each BTS has one to 16 transceivers depending on the density of
users in a cell
 BSC is the connection between the BTS and Mobile service
Switching Centre (MSC)
 It manages the radio resources for one or more BTS
 It handles handovers, radio-channels setup, control of radio
frequency power levels of BTSs, exchange function and frequency
hopping.
18

19. The network and switching
subsystem
 The central component of the network subsystem is the Mobile
Switching Center (MSC)
 Functions are:
 It acts like a normal switching node for mobile subscribers of the same
network
 Acts like a normal switching node for PSTN fixed telephone
 Acts like a normal switching node for ISDN
 Provides all the functionality needed to handle a mobile subscriber such
as registration, authentication, location updating handovers and call
routing.
 It includes databases needed in order to store information to manage
the mobility of a roaming subscriber.
19

20.  The MSC with Home Location Register (HLR) and Visitor Location
Register (VLR) databases, provide the call routing and roaming
capabilities of GSM
 HLR stores the important information of subscribers belonging to the
covering area of a MSC
 It contains all administrative information like current location of the
mobile, authentication data
 HLR is always fixed an stored in the home network and VLR logically
moves with subscriber.
20

21.  VLR considered as temporary copy of some important information
stored in HLR
 VLR is similar to cache, HLR is persistent storage
 It contains the selected administrative information borrowed from
HLR, necessary for control and provisioning of the subscribed
services.
 When a subscriber enters a covering area of new MSC, the VLR
associated with this MSC will request information about the new
subscriber from its corresponding HLR in home network
21

22.  Another component called (GMSC) Gateway MSC that is
associated with MSC
 It is a gateway is node interconnecting two networks
 The GMSC is the interface between the mobile cellular network and
the PSTN
 It is in charge of routing calls from fixed network towards a GSM user
and vice versa
22

23. The operation and support
subsytem
 It controls and monitors the GSM system
 Is connected to different components of the NSS and to the BSC
 Controls the traffic of load of the BSS
 Provisioning information for different services is managed in this subsystem
 Equipment Identity Register (EIR) is a database that contains a list all valid
mobile equipment's within the network, where each mobile station is
identified by its IMEI (international Mobile Equipment identity)
 EIR consists a list of IMEI all valid terminals
23

24.  An IMEI is marked invalid if it reported as stolen or not type
approved.
 EIR allows the MSC to forbid the calls from the stolen or unauthorized
terminals.
 Authentication Center(AUC) is responsible for authentication of
subscribers
 It is a protected database and stores a copy of secret key stored in
each subscribers sim card
 These data help in verifying the user’s identity
24

25. Message centre
 Popular service provided by GSM is SMS i.e. Short Message Service.
 Is a data service and allows a user to enter a text message upto 160
characters in length when 7-bit English characters are used
 Is always ON network
 Message center is also called as Service Center (SC) or SMS
controller
 There are two types of SMS
 SMMT
 SMMO
25

26. 26

27.  SMMT- Short Message Mobile Terminal
 Is an incoming short message from the network
 Terminated in the MS
 SMMO-Short Message Mobile Originated
 Is an outgoing message
 Originated at MS
 Forwarded to network for delivery
27

28. Call routing in GSM
 Human interface is analog
 There are many complex technologies used between the human
analog interface in mobile and digital network
 The following figure is sequence of operation from speech to radio
wave
28

29. 29

30.  Digitizer and source coding
 User speech is digitized at 8 KHz sampling rate using Regular Pulse
Excited-Linear Predictive Coder (RFE-LPC) with a Long Term Predictor
loop
 Here information from previous sample is used to predict the current
sample
 Each sample is then represented in signed 13-bit linear PCM value
 It is then passed to coder with frames of 160 samples
30

31.  Channel coding
 Introduces redundancy information into the data for error detection
 Gross bit rate after channel coding is 22.8 kbps
 456 bits are divided into eight 57-bit blocks, and result is interleaved
among eight successive time slots bursts for protection against burst
transmission.
 Interleaving
 Rearranges a group of bits in a particular way
 Improves performance of the error correction mechanisms
 Decreases possibility of whole bursts during the transmission
31

32.  Ciphering
 Encrypts block of user data using a symmetric key shared by the mobile station
and BTS
 Burst formatting
 Adds some binary information to the ciphered block
 Is used for synchronization and equalization of the received data
 Modulation
 Technique chosen for the GSM system is Gaussian Minimum Shift Keying(GMSK)
 The binary data is converted back into analog signal to fit the frequency and
time requirements for multiple access rules
32

33.  Multipath and equalization
 GSM frequency bands gets reflected from buildings, hills etc, so not only
the right signal received by an antenna but many reflected signals
which corrupt the information are also received
 An equalizer is responsible for extracting the right signal from the
received signal
 It estimates the channel impulse response of the GSM system and then
constructs an invers filter
33

34.  Synchronization
 For successful operation of a mobile, time and frequency
synchronization is needed.
 Frequency synchronization is needed so that transmitter and receiver
frequency match
 Time synchronization is necessary to identify the frame boundary and
bits within the frame
34

35. An example
 Assume that a party called a GSM directory number +919845052534
 The directory number dialled to reach a mobile subscriber is called the
Mobile Subscriber ISDN (MSISDN)
 It includes country code and national destination code which indicated
subscriber’s operator
 MSISDN number of subscriber in Bangalore associated with Airtel network is
+919845XYYYYY
 + means the prefix for international dialling like 00 in UK / India or 011 in USA
35

36.  91 is the country code for India
 98 is the network operator code, here Airtel
 X is the level number managed by the network operator ranging
from 0 to 9
 YYYYY is the subscriber code managed by operator
36

37. Call routing for mobile terminating
call
37

38.  Call first goes to local PSTN exchange
 PSTN exchange looks at the routing table and determines that is a
call to mobile network
 It forwards call to Gateway MSC of the mobile network
 It decides whether to route this call or not
 If the user has not paid the bills, the call may not be routed
 If the phone is powered off then , a message may be played or call is
forwarded to voice mail
38

39.  If MSC finds that the call can be processed, it will find out address of
the VLR where mobile is expected to be present
 If the VLR is of different PLMN , it will forward the call to foreign PLMN
through gateway MSC
 If VLR is in the home network, it will determine the location Area (LA)
 Within the LA it will page and locate the phone and connect the
call
39

40. PLMN interfaces
 Basic configuration of PLMN consists of a central HLR and central
VLR
 Contains all security, provisioning and subscriber-related information
 MSC needs subscriber parameter for successful call set-up
40

41. Configuration
of GSM PLMN
41

42. GSM addresses and identifiers
 To manage all complex functions, GSM deals with many address and
identifiers, they are
 IMEI
 IMSI
 MSISDN
 LAI
 MSRN
 TMSI
 LMSI
 Cell identifier
 Identification of MSCs and location registers
42

43. International Mobile Station
Equipment Identity (IMEI)
 Every mobile equipment in this world has a unique identifier, called as
IMEI
 Allocated by the manufacturer and registered by the network operator
in Equipment Identity Register (EIR)
 To see your IMEI number, type *#06# on the phone
43

44. International Mobile Subscriber
Identity (IMSI)
 When registered with a GSM operator, each subscriber is assigned with
a unique identifier
 IMSI is stored in SIM card and secured by the operator
 A mobile station can operate only when it has a valid IMSI
 There are several parts in IMSI, which are as follows
44

45.  Three decimal digits of Mobile Country Code(MCC), for India it is 404
 Two decimal digits of Mobile Network Code (MNC)
 Uniquely identifies a mobile operator within a country
 For airtel in Delhi it is 10
 Maximum 10 digits of Mobile Subscriber Identification Number (MSIN)
 This is unique number of the subscriber within a home network
45

46. Mobile Subscriber ISDN numbers
(MSISDN)
 Real telephone number that is known in this external world
 It is public information where as IMEI is private information to a operator
 The MSISDN categories follow the following international ISDN (Integrated
Systems Data Network) numbering plan as the following
 Country Code (CC): one of three decimal digits of the country code
 Eg: USA-1, India-91, Finland-358
 National Destination Code (NDC) : typically 2 to 3 decimal digits
 In India 94 for BSNL, 98 for all other operators
 Subscriber Number (SN) : Maximum 10 decimal digits
 Eight digit number, consist
 Two decimal digits of operator code
 Followed by one decimal digit level number
 5 digit subscriber number
46

47. Location Area Identity (LAI)
 Each LA in PLMN has its own identifier
 It is unique
 Consists three digits of CC, two digits of Mobile Network Code i.e.
MNC, maximum five digit of Location Area Code.
47

48. Mobile Station Roaming Number
(MSRN)
 When a subscriber is roaming in another network, he is assigned with
a temporary ISDN number
 This ISDN is used by the Local VLR in charge of the mobile station
48

49. Temporary Mobile Subscriber
Identity (TMSI)
 Temporary identifier assigned by the serving VLR
 Used in place of the IMSI for identification and addressing of the
mobile station
 It is never stored in HLR
 Difficult to determine the identity of subscriber by listening to the
radio channel
 Stored in the SIM card
49

50. Location Mobile Subscriber Identity
(LMSI)
 Assigned by the VLR and stored in the HLR
 Used as searching key for faster database access in VLR
50

51. Cell identifier (CI)
 Within a LA , every cell has unique cell identifier
 Together with a Lai a cell can be identified uniquely through Global
Cell Identity
51

52. Identification of MSC and location
registers
 MSC, HLR,VLR,SCs are addressed by ISDN numbers
 They may have Signaling Point Code (SPC) within a PLMN
52

53. Network aspects in GSM
 When a call is in progress and the user is on the move, there will be a
handover mechanism from one cell to another
 Resembles to relay race, where one athlete passes the baton to
another
 Roaming and handover are performed by NSS, mainly using the
Mobile Application Part (MAP) built on the Signalling System #7 (SS7)
protocol
 The signalling protocol is GSM has three layers, shown in the
following figures
53

54. 54

55.  Layer 1 is the physical layer, which uses the channel structures over the air
interface
 Layer 2 is data link layer, called LAPDm i.e. modified version of LAPD
protocol
 Layer 3 is divided into three layers
 Radio Resources Management
 Controls set-up, maintenance, termination of radio and fixed channels including
handovers
 Mobility management
 Manages location updating and registration procedures such as security and
authentication
 Connection Management
 Handles general call control, manages supplementary services, SMS
55

56. Mobility management
 Person travelling on train without GSM phone or wireless
communication device
 If he wants to talk, how will he talk
 If the train stops at a station for a long time, he can try to locate a
public call office in a station and make the call
 He must finish the call before the train departs
 There is no way any person can make a call when they want
56

57.  Using MM , one can make outgoing calls and receive incoming calls while
in motion
 In wired network where device is stationary, the point of attachment to the
network is also fixed
 Address of the device is sufficient to locate the device in routing table and
establish the connection
 Incase of wireless devices, device moves from one location to another
making the old routing table invalid
 Therefore establishing and maintaining a connection is complex
 Paging, location updates, handover and roaming are performed to
provide mobility
57

58. Paging
 For getting a call connected, a MS has to be traced, located and
then call connected
 The MS is traced through a paging process within a location
 Using the BSS signalling channel the paging message for an MS is
sent that includes the IMSI as the identifier of the MS
 A single paging message across the MSC to BSS interface contains
information of the cells in which the page shall be broadcast
 In paging the making a decision is difficult i.e which cell to start
paging from, this is because there is huge number of cells
58

59.  If we cannot locate the mobile quickly, the call cannot be connected
resulting the lost revenue
 Eg: it can start from the centre of the network and keep searching each
and every cell for long time
 Such global paging system is going to cost more and consume lot of time
 To optimize the cost and response time, paging starts at location where the
MS was present last.
 The location of MS is recorded in the HLR and updated through Location
Update
 The MS is searched in these cells where it has the highest probability of
being present
59

60. Location update
 Concerned with procedures that enable the network to know the
current location of powdered on MS so that mobile terminated call
routing can be completed.
 If the location of MS is not known, tracking the MS through the
paging costs in terms of radio and backbone SS7 signalling
bandwidth
 To optimize this, location information is regularly updated within core
network
 The presence and location information is kept up to date within VLR
and HLR
60

61.  Assume the MS is willing to communicate, the MS must be powered
off-on and attached to the network
 If the MS is attached to the network , it must be located through the
paging before successful communication can take place for mobile
terminated calls and mobile terminated SMS
 When MS is powered off, the HLR is updated with an explicit IMSI
detach which indicates that MS is not available and connection
cannot be established.
61

62. Handover
 When the call is going on in a moving vehicle, the relationship
between the radio signals and user is dynamic
 The user movements can make the user to move away from a
wireless tower, causing the radio signals to reduce and ultimately
break
 The user has to be moved to another cell where the signal strength is
higher
 Will result in changing the association of the resources to another
channel within the same cell or different cell altogether, this is called
handover
62

63.  Handover has to be made very fast without any disruption to the service to
the higher layer
 In north America handover is called as “handoff”
 A handover can be initiated by a mobile or network
 A mobile initiated handover is based on radio subsystem criteria of Radio
Frequency (RF), quality of signal or distance from tower
 Network initiated handover is associated by a mobile device is based on traffic
loading per cell, maintenance request etc
63

64.  There are four different types of handover in the GSM system , which
involves transferring call in between
 Channels in the same cell
 Cells under the control of same BSC
 Cells under the control of different BSC, but belonging to same MSC
 Cells under the control of different MSC
 The first two are called internal handovers [handled by BSC]and next
two are called external handovers [handled by MSC]
64

65. Handover procedure 65

66. Authentication and Security issues
during handover
 GSM uses A3,A8 and A5 algorithms for security
 A3 algorithm is used to authenticate the subscriber
 A8 algorithm is used to generate Cipher key Kc
 A5 algorithm is used to cipher everything that is transmitted over the
air that include both signal and traffic
 When handover occurs necessary information is transmitted within
the system infrastructure to enable communication to proceed from
the old BSS to new BSS, synchronization process is resumed
 The key remains unchanged at handover
66

67. Roaming
 When handover happens between one network to another network
is called roaming
 When a mobile is powered off , it performs an IMSI detach to say the
network that is no longer connected.
 When a mobile station is turned on in a new network or the
subscriber moves to different operators PLMN , then the subscriber
must register with the new network to indicate its current location.
 The first location update is called IMSI attach procedure where the
MS indicates its IMSI to the new network.
68

68.  A location update is performed periodically
 A location update message is sent to new MSC/VLR which records
the location area information and then sends this information to the
subscriber’s HLR
 If the mobile station is authenticated and authorized in the new
MSC/VLR the subscriber’s HLR cancels the registration of the mobile
station with the old MSC/VLR
69

69.  Two types of roaming
 Horizontal Roaming
 Roaming between two networks of the same family
 GSM to GSM roaming
 Vertical Roaming
 Roaming between two networks of different families
 When vertical roaming happens without any disruption it is called
seamless roaming.
 GSM to CDMA, GPS to WIFI
70

70. GSM Frequency Allocation
 GSM in general uses 900 MHz band
 890-915 MHz are allocated for uplink i.e. MS to BS
 935-960 MHz are allocated for downlink i.e. BS to MS
 Mobile to Base
 Ft(n)=890.2+0.2(n-1) MHz
 Base to Mobile
 Ft(n)=Fr(n)+45MHz
71

71. 72

72. 73

73.  3 (tail) These tail bits at the start of the GSM burst give time for the
transmitter to ramp up its power
 57 (data): This block of data is used to carry information, and most often
contains the digitised voice data
 1 (steal bit )is bit within the GSM burst indicates the type of data in the
previous field.
 26 (Midamble): This training sequence is used as a timing reference and for
equalisation.
 1 (steal bit ) Again this flag indicates the type of data in the data field.
 57 (data) Again, this block of data within the GSM burst is used for carrying
data.
 3 (tail) These final bits within the GSM burst are used to enable the
transmitter power to ramp down. They are often called final tail bits, or just
tail bits.
 8.25 (guard bits) At the end of the GSM burst there is a guard period. This is
introduced to prevent transmitted bursts from different mobiles overlapping.
74