GSM Architecture 1 GSM Sub Systems GSM architecture

GSM Architecture 1

GSM Sub. Systems GSM architecture is mainly divided into three Subsystems 1. Base Station Subsystem (BSS) 2. Network & Switching Subsystem (NSS) 3. Operations & Support Subsystem (OSS) Mobile Station sometimes included in BSS 2

GSM Network Architecture

4

Simplified GSM Architecture HLR A-bis I/F Um I/ F MS B S C A-ter I/F TC A I/F AUC PSTN MSC BTS VLR EIR 5

6

7

Mobile Station (MS) The MS consists of two parts 1. Mobile Equipment (ME) 2. Subscriber Identity module (SIM) 8

Mobile Station SIM Card Global GSM Mobility Card The Smart Card to use GSM = Handset Battery battery + + f 153454 2 W jmhfod kgdjipj

SIM-Card and GSM Mobile Equipment SIM-Card = Global GSM Mobility Card The Smart Card to use + Calling line 0609225831 GSM Contains: - IMSI Subscriber knows - Called party number = MS-ISDN - PIN Handset

The SIM-Card Functions Credit Card Size µ SIM-Card Global GSM Mobility Card 15 mm The Smart Card to use 25 mm Permanent data: - Unique mobile subscriber identity through IMSI number, - Authentication parameter Ki, - Authentication algorithm A 3, - Generating encryption key Kc algorithm A 8. GSM Microchip with stored user information Removable data: - Temporary Mobile Subscriber Number, - Location Area Identification.

Subscriber Identification IMSI Nature International Mobile Subscriber Identity Mobile Station Integrated Services Digital Network Nb Conformity with E 212 Similar to ISDN, Conformity with E 164/E 213 Identify a PLMN worldwide MCC MNC Meaning Mobile Country Code Mobile Network Code Nb. digits 3 2 Format MS - ISDN Identify the subscriber of a PLMN H 1 H 2 MSIN x x x. . x x x Mobile Subscriber Ident. Nb H 1 H 2 = Identity of HLR within the home PLMN max 10 National Significant Mobile Number CC NDC M 1 M 2 SN xx xx Country National Mobile Subscriber Code Destination (national definition) (where subscription Code * M 1 M 2 = nbr of logical HLR has been made) 1 to 3 2 to 4 total max 15 *This code does not identify a geographical area but an operator

Mobile Identification PE VED Y T RO P AP TAC Type Approval Code FAC SNR Serial number Final Assembly Code SP (SPare)

Trends in Mobile Station Pocket Fax Hands-free Organizer Booster 2 W 5 W 2 W 8 W PC Data Dual-band 900 -1800 900 -1900 Java

Mobile Equipment (ME) • The ME is the only part of the GSM network which the subscriber will really see. • There are three main types of ME, these are listed below: 1. Vehicle Mounted 2. Portable Mobile Unit 3. Hand portable Unit 15

Subscriber Identity module (SIM) q The SIM is a card which plugs into the ME. q This card identifies the MS subscriber and also provides other information regarding the services that subscriber should receive. q The SIM card, and the high degree of inbuilt system security, provides protection of the subscriber’s information and protection of networks against fraudulent access. q The SIM can be protected by use of Personal Identity Number (PIN) password, similar to bank/credit charge cards, to prevent unauthorized use of the card. q SIM cards are designed to be difficult to duplicate. q By making a distinction between the subscriber identity and the ME identity, GSM can route calls and perform billing based on the identity of the ‘subscriber’ rather than the equipment or its location. 16

Subscriber Identity module Cntd…. The SIM contains several pieces of information: 1. 2. 3. 4. 5. International Mobile Subscriber Identity (IMSI) Temporary Mobile Subscriber Identity (TMSI) Location Area Identity (LAI) Subscriber Authentication Key (Ki) Mobile Station Integrated Services Digital Network (MSISDN) The SIM is capable of storing additional information such as accumulated call charges. The SIM also executes the Authentication Algorithm. 17

Subscriber Identity module Cntd…. 18

Base Station Subsystem (BSS) 19

BSS Architecture MSC A Interface Radio Interface TCU S 2000 H&L BTS NSS Ater Interface Public Telephone Network BSC OMC-R Abis Interface MS S 8000 Outdoor BTS Radio Interface OMN Interface Sun Stor. Edge A 5000 BSS S 8000 Indoor BTS MS

Base Station Controller (BSC) q the BSC provides the control for the BSS. q Any operational information required by the BTS will be received via the BSC. q Likewise any information required about the BTS (by the OMC for example) will be obtained by the BSC. q The BSC incorporates a digital switching matrix, which it uses to connect the radio channels on the air interface with the terrestrial circuits from the MSC. q The BSC switching matrix also allows the BSC to perform “handovers” between radio channels on BTSs, under its control, without involving the MSC. 21

22

BSC General Architecture and Functions BSC - Radio Resource management for its BTSs - Intercell hand-over Processing Unit - Allocation of channels for communication - Reallocation of frequencies among BTSs X. 25 controller O&M Switching matrix - Time and frequency synchronization to BTSs - Controls frequency hopping PCM controller BTS Abis interface PCM controller To Network A interface Sub. System

Base Transceiver Station – BTS • The BTS provides the air interface connection with the MS. • It also has a limited amount of Control functionality which reduces the amount of traffic passing between the BTS and BSC. • Where the BSC and BTS are both shown to control a function, the control is divided between the two, or may be located wholly at one. 24

25

BTS General Architecture and Functions BTS Transmission coupler COUPLING SYSTEM - Encodes, encrypts, modulates, feeds the RF signal to the antenna - Decrypts and equalizes the signal then demodulates Reception coupler Antenna Duplexer - Interface between Antennas and TRXs of each cell TRX (Transceiver-Receiver) - Mobile call detection - Uplink channel measurements - Timing advance - Frequency hopping BCF (Base Common Functions) Abis interface BSC - Multiplexes speech and user's data channels to BSC. - Multiplexes signaling channels to BSC.

27

BSS Configurations • The maximum number of BTSs which may be controlled by one BSC is not specified by GSM. • The BTSs and BSC may either be located at the same cell site “colocated”, or located at different sites “Remote”. • Another BSS configuration is the daisy chain. • Problem- transmission delay through the chain. 28

TRAU Architecture and Functions Converts the 13 kbps GSM speech frame either into a 64 kbps T 1 PCM µ-law or into an E 1 PCM A-law Routes the users' data stream to suitable Inter-working function TRAU Transcoder Controller T 1 trunk up to 92 user's and control channels Ater BSC interface E 1 trunk up to 120 user's channels Transcoder T 1 trunk = up to 24 user's channels A External PCM Interface MSC interface E 1 trunk = up to 31 user's channels

Transcoder (XCDR) • The 64 kbit/s PCM circuits from the MSC, if transmitted on the air interface without modification, would occupy an excessive amount of radio bandwidth. • The Transcoder is to convert the speech or data output from the MSC into the form suitable for transmission over the air interface. • The required bandwidth is therefore reduced by processing the 64 kbit/s circuits so that the amount of information required to transmit digitized voice falls to a gross rate of 16 kbit/s. 30

Transcoder (XCDR) Cntd…. • The transcoding function may be located at the MSC, BSC, or BTS. • The content of the 16 kbit/s data depends on the coding algorithm used. • There are two speech coding algorithms available. • The Full Rate speech algorithm is supported by all mobiles and networks. • It produces 13 kbit/s of coded speech data plus 3 kbit/s of control data known as TRAU data (Transcoder Rate Adaptation Unit). • TRAU only used by BTS and discarded (not transmitted on air interface) 31

Transcoder (XCDR) Cntd…. • the 13 kbit/s of speech data is processed at the BTS to form a gross rate of 22. 8 kbit/s on the air interface which includes forward error correction. • In the uplink direction the BTS adds in TRAU data which will be used by the transcoder. • Enhanced Full Rate is an improved speech coding algorithm and is only supported by Phase 2+ mobiles. • It produces 12. 2 kbit/s from each 64 kbit/s PCM channel and TRAU data of 3. 8 kbits/s 32

33

Network Switching System (NSS) 34

NSS Architecture Site 1 Site 2 AUC H HLR D BSS D VLR BSS VLR G-interface B-interface A-interface B-interface C-interface MSC GMSC Other GSM, PSTN, ISDN E-interface F E IWF Billing Server F EIR SMS-SC A-interface E IWF Billing Server

Network Switching System (NSS) • The Network Switching System includes the main switching functions of the GSM network. • It also contains the databases required for subscriber data and mobility management. • The components of the Network Switching System are listed below: 1. 2. 3. 4. 5. 6. 7. Mobile Services Switching Centre – MSC Home Location Register – HLR Visitor Location Register – VLR Equipment Identity Register – EIR Authentication Centre – AUC Interworking Function – IWF Echo Canceller – EC 36

37

Mobile Switching Centre (MSC) q MSC is the heart of the system, controlling the Switching & Billing. q The MSC can carry out different functions depending upon its position in the network. q When provides interface between PSTN & BSS in GSM network then known as a Gateway MSC q provides service to MSs located within a defined geographic coverage area. q The network typically contains more than one MSC. q One MSC is capable of supporting a regional capital with approximately one million inhabitants. 38

MSC’s Functionalities • Call Processing 1. control of data/voice call setup 2. inter-BSS and inter-MSC handovers 3. control of mobility management (subscriber validation and location). • Operations and Maintenance Support 1. database management 2. traffic metering and measurement 3. A Man–machine interface. • Internetwork Interworking 1. Interface between the GSM network and the PSTN. • Billing 1. Collects call billing data. 39

Home Location Register HLR Subscriber Management Center Permanent records - MSISDN - IMSI - Subscriber's service provision Temporary records - VLR address - Ciphering items (Kc, Sres, Rand)

Home Location Register (HLR) § The HLR is the master database which contains each user’s service profile. § Various identification numbers and addresses are stored, as well as authentication parameters. § The data it contains is remotely accessed by all the MSCs and the VLRs in the network. § Although the network may contain more than one HLR, there is only one database record per subscriber. § The subscriber data may be accessed by either the IMSI or the MSISDN number. 41

Visitor Location Register VLR LA 1 Permanent records - IMSI - Subscriber’s service provision LA 3 LA 2 LA 4 Temporary records - Ciphering items (Kc, Sres, Rand) - LAI - TMSI

Visitor Location Register (VLR) § VLR is a temporary database for all user currently located in the system including roamers & nonroamers. § The data exists for only as long as the subscriber is “active” in the particular area covered by the VLR. § The VLR database will therefore contain some duplicate data as well as more precise data relevant to the subscriber. § This function eliminates the need for excessive and time-consuming references to the “home” HLR database. 43

Visitor Location Register Cntd…. The additional data stored in the VLR is listed below: 1. 2. 3. 4. Mobile status (busy/free/no answer etc. ). Location Area Identity (LAI). Temporary Mobile Subscriber Identity (TMSI). Mobile Station Roaming Number (MSRN). • MSC updates VLR with HLR information. • Each MSC has VLR which resides with the MSC & each G-MSC has a HLR which usually resides with the G-MSC 44

Equipment Identity Register EIR IMEI Black list (barred ME) White list (valid ME) Mobile Equipment Gray list (faulty ME)

Equipment Identity Register (EIR) • The EIR contains a centralized database for validating the IMEI. • This database is concerned solely with MS equipment and not with the subscriber who is using it to make or receive a call. • The EIR database consists of lists of IMEIs (or ranges of IMEIs) organized as follows: 1. White List 2. Black List 3. Grey List 46

Equipment Identity Register Cntd…. 47

Authentication Center AUC Ki Ciphering Triplets RAND 5 HLR Request Security A 3, A 8 algorithms IMSI AUC provides SRES, Kc, RAND

Authentication Centre (Au. C) • The Au. C is a processor system that performs the “authentication” function. • It is normally co-located with the HLR as it will be required to continuously access and update, as necessary, the system subscriber records. • The authentication process will usually take place each time the subscriber “initializes” on. 49

Inter. Working Function BSS Mobile Switching Center PSTN Modem MS Data + DTE signals Rate adaptation DTE signaling DTE Modem IWF Land-DTE

Interworking Function (IWF) • IWF provides the function to enable the GSM system to interface with the various forms of public and private data networks. • The basic features of the IWF are 1. Data rate adaptation. 2. Protocol conversion. • Some systems require more IWF capability than others, this depends upon the network to which it is being connected. 51

Interworking Function (IWF) Cntd… • The IWF also incorporates a ‘‘modem bank”, which may be used when • for example, the GSM Data Terminal Equipment (DTE) exchanges data with a land DTE connected via an analogue modem. 52

Echo Canceler 4 wire circuit (PCM) GSM network 4 wire circuit Mobile Switching Center Echo Canceler Talker Echo Switch Talker Echo Base Station Sub. System PSTN 4 wire circuit 4 w to 2 w transformer Two wire circuit Local loop Land telephone

Echo Canceller (EC) • An EC is used on the PSTN side of the MSC for all voice circuits. • Echo control is required at the switch because the inherent GSM system delay(180 ms approx) can cause an unacceptable echo condition. • This would not be apparent to the MS subscriber, but for the inclusion of a 2 -wire to 4 wire hybrid transformer in the circuit. • The transformer causes the echo. This does not affect the land subscriber. 54

Echo Canceller (EC) cntd…. 55

Echo Canceller (EC) cntd…. • During a normal PSTN land to land call, no echo is apparent because the delay is too short. • without the EC, the effect would be very irritating to the MS subscriber. • disrupting speech and concentration. • EC provides cancellation of up to 68 ms on the “tail circuit”. • the tail circuit is the connection between the output of the EC and the land telephone. 56

57

Operations & Support System (OSS) 58

Operations & Support System (OSS) • The OSS provides the capability to manage the GSM network remotely. • This area of the GSM network is not currently tightly specified by the GSM specifications. • It is left to the network provider to decide what capabilities they wish it to have. • The Operations and Maintenance System comprises of two parts: 1. Network Management Centre (NMC) 2. Operations and Maintenance Centre (OMC) 59

Operations & Support System Cntd. . 60

Operations & Support System Cntd. . 61

Network Management Centre (NMC) 62

Operations and Maintenance Centre (OMC) § The OMC provides a central point from which to control and monitor the other network entities (i. e. base stations, switches, database, etc). § It also monitors the quality of service being provided by the network. § There are two types of OMC these are: 1. OMC-R OMC controls specifically the Base Station System. 2. OMC-S OMC controls specifically the Network Switching System. 63

Operations and Maintenance Centre Cntd…. The OMC should support the following functions as per ITS–TS recommendations: 1. 2. 3. 4. 5. Event/Alarm Management. Fault Management. Performance Management. Configuration Management. Security Management. 64

Operations and Maintenance Centre Cntd…. 65

66

Network in Reality • In reality a GSM network is much more complicated than we have seen. • The diagram in the next slide illustrates how multiple BSS and Network Switching System components will be connected within a network 67

68

Practical Example; London City • Typical city for example, London will have approximately the following number of network components: 69

Mobile Network in U. K • A typical network (for example, UK) will have approximately the following number of network components. 70