GSM NETWORK OVERVIEW

Slide 1

BSCBTS

BTS

Mobile

Station

Access Network:Base Station Subsystem

HLR VLR EIR AuC

MSCPSTN

Um Abis A

Core Network:GSM CS network

SS7

GSM NETWORK ARCHITECTURE

MS: Mobile Station BSS: Base Station Subsystem MSC: Mobile Switching Center O&M: Operations and Maintenance Center VLR, HLR, AuC, EiR … CGSN

Slide 2

Prepared by E.Stambolliu, M.Koci & E.Kola

MOBILE STATION (MS)

Mobile Equipment (ME) SIM: Subscriber Identity Module While subscriber roams or is stationary, the

MS transmits a radio signal to one of the many BTS using a radio-link protocol via the Um interface

Slide 3

THE BASE STATION SYSTEM (BSS) All radio-related functions performed in BSS The Base Station Controller (BSC)

Is a high-capacity switch Provides all control functions and physical links

between the MSC and the BTS A group of BSCs is served by an MSC

The Base Transceiver Station (BTS) Handles the radio interface to the mobile unit Consists of transceivers and cell antennas A group of BTSs is controlled by a BSC

Slide 4

BSS (BASE STATION SUBSYSTEM)

BSC handles (through the Abis interface): Radio-channel setup Frequency hopping Handovers

BSC also connects MSto MSC usingA interface

Slide 5

BSS (BASE STATION SUBSYSTEM) Sometimes a Transcoder Rate Unit (TRAU) is placed on BTS

to perform transcoding between 64 KbpsA-law and 13 Kbps RPE/LTP(Regular Pulse Excited Long Term Prediction) speech channels

Slide 6

BSCBTS

BTS

HLR VLR EIR AuC

MSCPSTN

Um Abis A

SS7

TRAU

MOBILE SERVICES SWITCHING CENTER The MSC performs the telephony switching

functions of the network Controls calls to and from other telephone and

data systems Interface between radio system and fixed

networks (PSTN and ISDN) Connected to BSS through A interface; usually an

E-1,either wireline or microwave

Also performs functions such as: Toll ticketing Network interfacing Common channel signaling

Slide 7

MSC (MOBILE SWITCHING CENTER) (2)

Each MSC covers several cells (BSSs)

Slide 8MSC

BTS

BTS

BTS

BTS

BTS

BTS

BTS

BSC BSC

MSC (MOBILE SWITCHING CENTER) (3)

Also performs signaling between MSC and other functional entities using SS7: Registration Authentication Location updating Handovers Call routing to a roaming subscriber

Slide 9

OTHER GSM NETWORK ENTITIES

HLR: Home Location Register VLR: Visitor Location Register EIR: Equipment Identity Register AuC: Authentication Center

Slide 10

HOME LOCATION REGISTER

The HLR is the most important database Storage and management of subscriptions Permanent data includes

Subscriber’s service profile Subscriber’s location information Subscriber’s activity status

Subscribing to a particular provider’s service registers you in the HLR of that provider

Slide 11

HLR (HOME LOCATION REGISTER)

Central database for all subscribers: Identity of the subscriber Services accessible to the subscriber Current location of the subscriber

Given a Mobile Subscriber ISDN number (MS-ISDN), call is routed to IMSI number-VLR

Each subscriber appears only once in database

HLR might be physically distributed in several sites (e.g., using first two digits to identify physical HLR) Slide

12

Slide 13

HLR TYPES

Slide 14

HLR CONNECTIONS

Slide 15

GSM-GPRS

GPRS SERVICES ACCORDING TO THE BANDWIDTH AND BURSTINESS

Slide 16

GPRS(1)

Slide 17

GPRS(2)

Slide 18

GPRS(3)

Slide 19

GPRS(4)

Slide 20

GPRS(5)

Slide 21

GPRS-HLR

Slide 22

GPRS-MSC

Slide 23

GPRS-BSC

Slide 24

GPRS-BTS

Slide 25

GPRS PROTOCOL WITH BSS

Slide 26

VISITOR LOCATION REGISTER The VLR contains temporary data about visiting (roaming)

subscribers It’s always integrated with the MSC When a roamer enters the service area the VLR queries the

appropriate HLR If a roamer makes a call the VLR will already have the

information it needs for call setupDatabase with information on MS within area served by MSC:

MS Roaming number TMSI if applicable Location area in which was last registered Supplementary services

Used by an MSC to retrieve information for various purposes: Handling of calls to or from a roaming mobile station currently located

in its area Typically part of MSC

Slide 27

AUC (AUTHENTICATION CENTER)

Entity associated to HLR for authentication: allow International Mobile Subscriber Identity (IMSI) to be authenticated

Allows ciphering of communication over radio path between mobile station and network ciphered

Transmits data needed for authentication and ciphering via HLR to VLR, MSC and SGSN which need to authenticate a mobile station (SIM validation)

Slide 28

Ki is stored in SIM card and AUC

Generate RANDAUC MS

RAND+Ki=SRES using A3AUC MS

If the SRES in MS is equal with SRES in AUC the subs is authenticated.

RAND+Ki=Kc using A8AUC MS

A3 This is an algorithm used to generate the Signed Response (SRES). A8 This is an algorithm used to generate the Ciphering Key (Kc). A3A8 This is an algorithm used to generate Signed Response (SRES) and Ciphering Key (Kc). A4 This is an algorithm used for encryption/decryption of Ki.

Slide 29

EIR (EQUIPMENT IDENTITY REGISTER)

Logical entity responsible for storing International Mobile Equipment Identities (IMEIs) in network used in GSM system

Equipment classified as "white listed", "grey listed” and "black listed”

Ensures that MEs being used are valid and authorized to function on the Public Land Mobile Network (PLMN)

Slide 30

OPERATION AND SUPPORT CENTER

Operation and Maintenance Center (OMC) is connected with all the equipment in the

switching center and to the BSC Network operation monitors and controls the

system Provides centralized cost-effective support Provides a network overview at any moment Supports maintenance and operational activities

for different organizations and groups

Slide 31

OTHER FUNCTIONAL ELEMENTS

Message Center (MXE) – handles voice, fax, and data messaging

Mobile Service Node (MSN) – handles mobile intelligent network (IN) services

Gateway Mobile Services Switching Center (GMSC) – an MSC with a gateway that interconnects two networks

GSM Interworking Unit (GIWU) – hardware and software that enables both voice and data

Slide 32

CALL ROUTING

Slide 33

7.When the new MSC/VLR receives the information from theHLR, it sends a location updating confirmation message to theMS.

6. The HLR also orders the old serving MSC/VLR to cancel allinformation for the subscriber because the mobile subscriber isnow served by another MSC/VLR.

5. The HLR sends the subscriber data to the new MSC/VLR

4 .The HLR stores the address of the new MSCIVLR

3. The new MSC/VLR requests the subscriber information for theMS from the HLR

2. In the new MSC/VLR, an analysis of the IMSI number is carriedout. The result of this analysis is a modification of the IMSI to aMobile Global Title (MGT) which is used to address the HLR.

1. The MS requests a location update to be carried out in thenew MSC/VLR. The IMSI is used to identify the MS.

Slide 34

NORMAL LOCATION UPDATE

3. In the VLR, an IMSI detach flag is set for the subscriber. This is used to reject incomingcalls to the MS.

4. The VLR returns an acknowledgment to the MS.

3. The MSC/VLR sets the IMSI attach in the VLR. The mobile is now ready fornormal call handling

2. The MSC/VLR receives the IMSI attach message from the MS.

IMSI attach is the respective to the IMSI detach procedure when turning on the mobile terminal.So it is used by the MS to inform the network that it has re-entered an active state and is still in thesame location area. If the MS changes location area while being switched off, a normal locationupdate takes place.The IMSI attach procedure is as follows :

1. The MS requests a signaling channel.

2. The MS uses this signaling channel to send the IMSI detach message to the MSC/VLR.

1. At power off or when the SIM card is taken out, the MS ask for a signaling channel.

In the system information broadcast on the control channel (BCCH), the MS receivesinformation on whether the IMSI attach/detach function is used or not. If it is used, the MSmust inform the network when it is entering an inactive state (detach)The following steps illustrate the whole procedure:

IMSI detach (switching off the terminal)

IMSI attach (swithing on the terminal)

Slide 35

GSM SPECIFICATIONS

Combination of FDMA and TDMA to send information

Frequencies: 800, 900, 1800, 1900 MHzFor example, GSM 900: Uplink = 890-915 MHz Downlink = 935-960 MHz

Each 25 MHz bandwidth is divided into 124 carrier frequencies spaced 200 KHz with one or more frequencies allocated to each base station

Transmission rate: 270 kbps over the air Speech coder: Linear Predictive Coding (LPC)

at 13 kbps – filter reduces the bit rate

Slide 36

GSM SPECIFICATIONS

Frequency range: 1,850 to 1,990 MHz Duplex distance: 80 MHz Channel separation: 200 kHz Modulation: Gaussian minimum shift keying Transmission rate: 270 kbps over the air Access method: Time Division Multiple Access Speech coder: Linear Predictive Coding (LPC) at 13

kbps – filter reduces the bit rate

Slide 37

GSM Band Information

Slide 38

GSM NETWORK AREAS In order of increasing geographic size:

Cell – the area covered by one BTS – a number of these make up a:

Location Area (LA) – a group of cells – a group of LAs makes up an:

MSC/VLR service area – area covered by one MSC – a number of these make up the:

Public Land Mobile Network (PLMN) service area– one operator’s network

Slide 39

Slide 40

CGI- Cell Global Identification

MCC-MNC-LAC-CI where:

CI Cell identity

LAC Location area code

MNC Mobile network code

MCC Mobile country code

Slide 41

Base Station Identity Code

Expressed as nccbcc where:

bcc BS colour code

ncc PLMN colour code

Slide 42

HANDOVER

Four types of handovers: Channels (time slots) in same cell Between cells within same BSC Between BSCs, within same MSC Between MSCs

Slide 43

PSTN

BTS

BTS

BTS

BTS

BTS

BTS

BTS

BSC BSC

MSC

BTS

BTS

BTS

BTS

BTS

BTS

BTS

BSC BSC

MSC

Slide 44

Slide 45

Slide 46

Addressing of managed objects

TS Time Slot RXOTS 0 <= ts <= 7

TX Transmitter RXOTX 0 <= trxc <= 15

RX Receiver RXORX 0 <= trxc <= 15

TRXC Transceiver Controller RXOTRX 0 <= trxc <= 15

DP Digital Path RXODP 0 <= dp <= 1

TF Timing Function RXOTF 0 <= tg <= 511

CF Central Function RXOCF 0 <= tg <= 511

TG Transceiver Group RXOTG 0 <= tg <= 511

MO MO class MO type Addressing Limit

IS Interworking Switch RXOIS 0 <= tg <= 511

Slide 47

DXU - Distribution Switch Unit functions

•CF Central Function, is the control part of a TG. It is a SW function, handling common control functions within a TG. The BSC communicates with the CF using layer 2 LAPD, and is addressed by its TEI = 62.

•CON LAPD Concentrator, is used by the optional feature LAPD Concentration for RBS 2000. It is connected to DCP 64&&87.

•IS Interworking Switch, provides a system interface to the 2 Mbit/s link and cross connects individual time slots to certain transceivers.

•TF Timing Function, extracts synchronization information from the PCM link and generates a timing reference for the RBS.

•DP Digital Path, Layer 1 reception and transmission are not part of the BTS logical model. However, each of the PCM systems terminating in TG has an associated supervision object, the DP.

Slide 48

TRU - Transceiver Unit functions

TRXC The transceiver controller is controlling all the functions for Signal processing, Radio receiving and Radio Transmitting. Each TRX corresponds to one TRU unit.The BSC currently supports a maximum of 1020 TRXs.

RX The receiver is an application object. It provides the radio frequency reception functionality for one transceiver.

TX The transmitter is an application object. It provides the radio frequency transmission functionality on a time slot basis for eight TSs using different time slot numbers.

Slide 49

Managed Object Hierarchy

Slide 50

GSM INTERFACES

Um InterfaceMobile station and base station subsystem communicate across Um interface, also known as air interface or radio link

Abis interfaceBase transceiver station (BTS) and base station controller (BSC) communicate across Abis interface

A interfaceBase station subsystem communicates with mobile service switching center across A interface Slide

51

Slide 52

Slide 53

SIGNALING SYSTEM #7

54

SS#7 SIGNALING MEETS THESE NEEDS

Efficiency Out-of-band links at 64 Kbps Shorter information transfer time Ability to fall back to the originating end of the call (e.g., busy)

Service enabling Free phone (0-800) services Automatic call back & calling number delivery Automatic calling card services Wireless services such as roaming

Network reliability Carries extensive network management messages Network architecture Security

Slide 55

SS#7 DEFINITION

Common channel signaling system number 7 (SS#7)

Out-of-band signaling system Facilitates exchange of call control

information between network switching offices

Voice and non-voice services

Slide 56

SS#7 BASICS

Voice and signaling are separated Control messages (packets) are routed

through the network for call management Network elements are connected via

signaling links Each element capable of SS#7 control

messages, is called a signaling point (SP) All SPs in an SS7 network are identified by a

unique code known as point code (PC)

Slide 57

SS#7 NETWORKS

Slide 58

SS#7 SIGNALING POINTS (1)

Service switching point (SSP) Capable of controlling voice circuits via a voice

switch The switch can originate, terminate, or tandem

calls An SSP sends signaling messages to other SSPs

to set up, manage, and release voice circuits required to complete a call

An SSP can also send a query message to a centralized database (SCP) to determine how to route a call (e.g., toll free 1-800 number)

Slide 59

SS#7 SIGNALING POINTS (2)

Signaling transfer point (STP) Routes each incoming message to an outgoing

signaling link, based on routing information contained in the SS#7 message and a pre-defined route table

Does not offer termination services STPs are paired to ensure redundancy

Slide 60

SS#7 SIGNALING POINTS (3)

Service control point (SCP) Provides access to databases Accepts a query for information from a

subsystem at another node Used by STP to perform a function called global

title translation The database may not reside in the same

location as the SCP

Slide 61

COMMON CHANNEL SIGNALING (1)

Slide 62

SwitchSP

SwitchSP

E1 31 voice channels using 31 time slots

2 separate signaling links using 2 time slots

COMMON CHANNEL SIGNALING (2)

Slide 63

SwitchSP

SwitchSP

E1 31 voice channels using 31 time slots

1 signaling link and 30 voice channels

SIGNALING NETWORK TERMS

Associate mode: signaling links follow the same path as the voice trunks Quasi-associate mode: signaling links follows a different route than the voice

trunks

Slide 64

SP SPSP

STP

Voice trunks

Signaling Links

Associate Mode Quasi-Associate Mode

LINKSETS

Groups of links that connect two adjacent nodes Ensure traffic load sharing Combined linksets between STPs ensures load sharing Consist of up to 16 links in ANSI protocol and up to 8 in ITU protocol Signaling link code (SLC) is uniquely assigned to each link

Slide 65

ROUTES

Virtual path that a message takes to a destination node

Comprised of one or more linksets

Slide 66

MEATA

SP=2-901

MEATR

SP=2-903

AMC1

SP=2-272

AMC2

SP=2-256

First priority of signaling route

LS=2-901

LS=2-256

LS=2-903

LS=2-272

Second priority of signaling route

Slide 67

SS#7 PROTOCOL STACK

Slide 68

MTP

Message transfer part: Reliably transfers messages over links or

linksets For correct routing, the signaling point needs

the signaling point code (SPC) of the node at the end of its links

Receives the SPC by destination point code (DPC) in the messages it routes

Needs information about other locations in the network, to select the best link set for routing the message to its destination

Slide 69

MTP LEVEL 3 MANAGEMENT SERVICES (1)

MTP level 3 provides signaling link selection (SLS) Rotates in each session A mechanism to assign traffic to a link in the

linkset Results in load sharing of the links in the linkset SLC rotation stops for duration of message

transfer

Slide 70

MTP LEVEL 3 MANAGEMENT SERVICES (2)

MTP restart Before returning to the network, a node can send

TRW (traffic restart wait) to an adjacent node, indicating not to send traffic

When restarting, if the node is satisfied that enough links are available, it is sends a TRA (traffic restart allowed)

Optional signaling link test message (SLTM) and signaling test acknowledge (SLTA)

Exchanged when a link is in service; ensures agreement on signaling link code Slide

71

SCCPSignaling connection control part: Provides connectionless and connection-

oriented network services Provides global title translation (GTT)

capabilities above MTP level 3; translates numbers to DPCs and subsystem numbers

Provides more detailed addressing information than MTPs

Used as transport layer for TCAP-based services

Slide 72

TCAP

Transaction capabilities applications part: Exchange of non-circuit related data

Between applications across the SS#7 network Using the SCCP connectionless service

Queries and responses sent between SSPs and SCPs

Sends and receives database information Credit card validation Routing information

Slide 73

TUP

Telephone user part: Basic call setup and tear down Analog circuits only In many countries, ISUP has replaced TUP for

call management

Slide 74

ISUP

ISDN user part: Necessary messaging for setup and tear

down of all circuits (voice and digital) Messages follow the paths of voice circuits Messages are sent from a switch, to the

switch where the next circuit connection is required

Call circuits are identified using circuit identification code (CIC) Must be compatible on both sides Followed by each ISUP message Slide

75

ISUP MESSAGES (1)

Initial address message (IAM): contains all necessary information for a switch to establish a connection

Address complete message (ACM): acknowledge to IAM; the required circuit is reserved and the “phone is ringing” (ringback tone)

Answer message (ANM): occurs when the called party picks up the phone

Slide 76

ISUP MESSAGES (2)

Release (REL): sent by the switch sensing that the phone hung up

Release complete (RLC): each exchange that receives REL, sends an RLC message back (this acknowledges receipt of REL)

Slide 77

ISUP NORMAL CALL SCENARIO

Slide 78

Slide 79

Slide 80

Slide 81

Slide 82

GSM SUBSCRIBER SERVICES

There are two basic types of service Telephony (teleservices): mainly voice services

(including terminal equipment) for communicating with other subscribers – includes fax, paging, voice mail, and alphanumeric services

Data (bearer services): capacity to transmit appropriate data signals between two access points creating an interface to the network

Slide 83

SUPPLEMENTARY SERVICES

The following are the usual revenue generators Call forwarding Barring outgoing calls Advice of Charge (AoC) Call hold (for telephony only) Call waiting Multiparty service (for telephony only) Calling line identification presentation/restriction Closed user groups (CUGs)

Slide 84