IT 351 Mobile Wireless Computing Telecommunication Systems Objectives

IT 351: Mobile & Wireless Computing Telecommunication Systems Objectives: – To provide a detailed study of the GSM system architecture and operation – To introduce the Universal Mobile Telecommunications System (UMTS) and discuss its particulars

Outline • Introduction to telecommunication systems • The cellular concept (Recap) • The cellular architecture – Design issues • The GSM system – – Overview Services Architecture Protocols • UMTS system

Overview of the main chapters Chapter 10: Support for Mobility Chapter 9: Mobile Transport Layer Chapter 8: Mobile Network Layer Chapter 4: Telecommunication Systems Chapter 5: Satellite Systems Chapter 6: Broadcast Systems Chapter 3: Medium Access Control Chapter 2: Wireless Transmission Chapter 7: Wireless LAN

Mobile phone subscribers worldwide approx. 1. 7 bn 1600 2009: >4 bn! 1400 Subscribers [million] 1200 GSM total 1000 TDMA total CDMA total PDC total 800 Analogue total W-CDMA 600 Total wireless Prediction (1998) 400 200 0 1996 1997 1998 1999 2000 2001 2002 2003 2004 year

Introduction to Mobile Telecommunications • Telecommunications – Wide area (global) communications – Collection of 'internetworked' local networks – Centralised infrastructure / backbone • Mobile telecommunications – Mobile phones – Wireless edge is 'cellular' – Interoperable with fixed telecommunications

Cellular Networks: Recap • Radio Spectrum – – Spectrum = media used by wireless, a. k. a ‘Air Interface’ Each network is assigned radio spectrum Spectrum assigned to users for data channels Spectrum may be licensed by international agreement • Cellular Concept – Divide the spectrum by physical area, i. e. ‘cell’ – Spectrum Reuse through non-interfering cells – Can be split on many levels • Picocells, Microcells, Macrocells, Satellite cells

The cellular system: cell structure (Recap) • Channel allocation: Implements space division multiplexing (SDM) – frequency reuse – base station covers a certain transmission area (cell) – Cellular concept: channel reuse across the network prevents interference, improves the likelihood of a good signal in each cell • Mobile stations communicate only via the base station • Advantages of cell structures – – f 4 6 higher capacity, higher number of users f 1 f 3 f 7 less transmission power needed f 2 more robust, decentralized base station deals with interference, transmission area etc. locally • Problems – – f f 5 f 3 Expensive fixed network needed for the base stations handover (changing from one cell to another) necessary interference with other cells f 2 f 4 f 5 f 1

Cellular System Overview

Cellular Architecture M/S Internetwork M/S

Cellular Networks • Operation – Initialisation: when handset is turned on it selects a channel and connects to the switch – Paging: switch must locate a mobile by broadcasting requests from base stations – Handoff: switches must be able to move calls between cells when mobile moves – Blocking/Dropping: calls may be blocked or dropped if conditions in a cell change – Interworking: calls may be placed to other networks or may allow users to roam into other networks

CT 0/1 AMPS NMT CT 2 IS-136 TDMA D-AMPS GSM PDC TDMA FDMA Development of mobile telecommunication systems IMT-FT DECT EDGE GPRS IMT-SC IS-136 HS UWC-136 IMT-DS UTRA FDD / W-CDMA HSPA IMT-TC CDMA UTRA TDD / TD-CDMA IMT-TC TD-SCDMA 1 G IS-95 cdma. One cdma 2000 1 X 2 G 2. 5 G IMT-MC cdma 2000 1 X EV-DO 1 X EV-DV (3 X) 3 G

Mobile Telecommunication Systems • First Generation (analog) – – – Advanced Mobile Phone Service (AMPS) Developed by AT&T in late 1970’s Still (just about!) in use in some countries Spectrum use and signal quality are poor Security is non-existent – Calls could be overheard using cheap scanners

Mobile Telecommunication Systems • Second Generation (digital) – GSM is best known example (covers all of Europe and much of Asia) – Developed by ETSI (, European Telecommunications Standardisation Institute) – Advantages: – – Digital traffic channels: allows data applications Encryption: scanners can’t hear your calls Error detection: better voice quality Channel access: more users per cell

Mobile Telecommunication Systems • Third Generation (3 G) – Intended capabilities – Voice quality as good as landline – 144 kbps (vehicles), 384 kbps (pedestrians), and 2. 048 Mbps to offices – Symmetric/Asymmetric data rates – Packet and Circuit-Switched Data – Interface to the Internet – Efficient use of spectrum – Wider variety of terminal equipment – Flexibility to allow new services to flourish • ‘Any Service, Anywhere, Anytime’ – Martini Principle

GSM Global System for Mobile (GSM) is a second generation cellular standard developed to cater voice services and data delivery using digital modulation

Some press news… • 16 th April 2008: The GSMA, the global trade group for the mobile industry, today announced that total connections to GSM mobile communications networks have now passed the 3 Billion mark globally. The third billion landmark has been reached just four years after the GSM industry surpassed its first billion, and just two years from the second billionth connection. The 3 Billion landmark has been surpassed just 17 years after the first GSM network launch in 1991. Today more than 700 mobile operators across 218 countries and territories of the world are adding new connections at the rate of 15 per second, or 1. 3 million per day. • 11 February 2009: The GSMA today announced that the mobile world has celebrated its four billionth connection, according to Wireless Intelligence, the GSMA’s market intelligence unit. This milestone underscores the continued strong growth of the mobile industry and puts the global market on the path to reach a staggering six billion connections by 2013. • Check out www. gsmworld. com for more!

GSM Statistics • Summary GSM statistics (Sep 2009) • • • Total mobile subscriptions → 4. 3 bn Total GSM subscriptions → 3. 45 bn (>80% market) Operates in 220+ countries Original market was Europe-centric (1990 s) Usage rates approach 100% in some countries Expanding rapidly in South America, Asia, Africa

GSM: Overview • GSM – formerly: Groupe Spéciale Mobile (founded 1982) – now: Global System for Mobile Communication – Pan-European standard (ETSI, European Telecommunications Standardisation Institute) – Aim : to replace the incompatible analog system – simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations seamless roaming within Europe possible • Today many providers all over the world use GSM (219 countries in Asia, Africa, Europe, Australia, America) – more than 4, 2 billion subscribers in more than 700 networks – more than 75% of all digital mobile phones use GSM – over 29 billion SMS in Germany in 2008, (> 10% of the revenues for many operators) [be aware: these are only rough numbers…] – See e. g. www. gsmworld. com/newsroom/market-data/index. htm

Characteristics of GSM Standard • Fully digital system using 900, 1800 MHz frequency band (in US 1900 MHz). • TDMA over radio carriers(200 KHz carrier spacing. • User/terminal authentication for fraud control. • Encryption of speech and data transmission over the radio path. • Full international roaming capability. • Low speed data services (upto 9. 6 Kb/s). • Compatibility with ISDN. • Support of Short Message Service (SMS).

Advantages of GSM over Analog system • Capacity increases • Reduced RF transmission power and longer battery life. • International roaming capability. • Better security against fraud (through terminal validation and user authentication). • Encryption capability for information security and privacy. • Compatibility with ISDN, leading to wider range of services

Performance characteristics of GSM (wrt. analog sys. ) • Communication – mobile, wireless communication; support for voice and data services • Total mobility – international access, chip-card enables use of access points of different providers • Worldwide connectivity – one number, the network handles localization • High capacity – better frequency efficiency, smaller cells, more customers per cell • High transmission quality – high audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e. g. , from cars, trains) • Security functions – access control, authentication via chip-card and PIN

Disadvantages of GSM • There is no perfect system!! – no end-to-end encryption of user data – no full ISDN bandwidth of 64 kbit/s to the user • • • reduced concentration while driving electromagnetic radiation abuse of private data possible roaming profiles accessible high complexity of the system several incompatibilities within the GSM standards

GSM Specifications-1 • RF Spectrum GSM 900 Mobile to BTS (uplink): 890 -915 Mhz BTS to Mobile(downlink): 935 -960 Mhz Bandwidth : 2* 25 Mhz GSM 1800 Mobile to BTS (uplink): 1710 -1785 Mhz BTS to Mobile(downlink) 1805 -1880 Mhz Bandwidth : 2* 75 Mhz

GSM Specification-II • • • Carrier Separation : 200 Khz Duplex Distance : 45 Mhz No. of RF carriers : 124 Access Method : TDMA/FDMA Modulation Method : GMSK (Gaussian Minimum Shift Keying – PSK) • Modulation data rate : 270. 833 Kbps

GSM 900 - FDD/FDMA GSM (Recap) f 960 MHz 935. 2 MHz 124 200 k. Hz 1 20 MHz 915 MHz 890. 2 MHz 124 1 • Frequency division duplex: Simultaneous access to the medium in both directions, uplink andt down link ( from mobile station to base station and vice versa • Ex (GSM): Fu = 890 + n*0. 2 Fd = Fu + 45 = 935 + n*0. 2

GSM: Mobile Services • GSM offers – several types of connections • voice connections, data connections, short message service – multi-service options (combination of basic services) • Three service domains – Bearer Services – Tele Services – Supplementary Services

Bearer Services • Telecommunication services to transfer data between access points • Specification of services up to the terminal interface (OSI layers 1 -3) • Different data rates for voice and data (original standard) – Transparent bearer service (use only physical layer to transmit data – Forward error correction (FEC) only circuit switched – constant delay and throughput • synchronous: 2. 4, 4. 8 or 9. 6 kbit/s • asynchronous: 300 - 1200 bit/s – Non transparent bearer service (use protocols of layer 2 and 3 to implement error correction and flow control) data service (packet switched) • synchronous: 2. 4, 4. 8 or 9. 6 kbit/s • asynchronous: 300 - 9600 bit/s • Today: data rates of approx. 50 kbit/s possible – (even more with new modulation)

Tele Services I • Telecommunication services that enable voice communication via mobile phones • All these basic services have to obey cellular functions, security measurements etc. • Offered services – mobile telephony primary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3. 1 k. Hz – Emergency number common number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible)

Tele Services II • Additional services – Non-Voice-Teleservices • group 3 fax • voice mailbox (implemented in the fixed network supporting the mobile terminals) • electronic mail (MHS, Message Handling System, implemented in the fixed network) • . . . • Short Message Service (SMS) alphanumeric data transmission to/from the mobile terminal (160 characters) using the signaling channel, thus allowing simultaneous use of basic services and SMS (almost ignored in the beginning now the most successful add-on!) • Multimedia Message Service (MMS)

Supplementary Services • Services in addition to the basic services, cannot be offered stand-alone • Similar to ISDN services besides lower bandwidth due to the radio link • May differ between different service providers, countries and protocol versions • Important services – – – identification: forwarding of caller number suppression of number forwarding call redirection automatic call-back Closer user groups, multi-party communication …

Architecture of The GSM System • GSM is a PLMN (Public Land Mobile Network) – several providers setup mobile networks following the GSM standard within each country – components • • MS (mobile station) BS (base station) MSC (mobile switching center) LR (location register) – subsystems • RSS (radio subsystem): covers all radio aspects • NSS (network and switching subsystem): call forwarding, handover, switching • OSS (operation subsystem): management of the network

GSM System Architecture • Radio Subsystem (RSS) – Mobile Station (MS) • • Mobile Equipment (ME) Subscriber Identity Module (SIM) – Base Station Subsystem (BSS) • • Base Transceiver Station (BTS) Base Station Controller (BSC) • Network Switching Subsystem(NSS) – Mobile Switching Center (MSC) – Home Location Register (HLR) – Visitor Location Register (VLR) • Operation Subsystem (OSS) – Operation and Maintenance Center (OMC) – Authentication Center (AUC) – Equipment Identity Register (EIR)

Ingredients 1: Mobile Phones, PDAs & Co. The visible but smallest part of the network!

Ingredients 2: Antennas Still visible – cause many discussions…

Ingredients 3: Infrastructure 1 Base Stations Cabling Microwave links

Ingredients 3: Infrastructure 2 Not „visible“, but comprise the major part of the network (also from an investment point of view…) Management Data bases Switching units Monitoring

GSM Architecture • Three Subsystems: – The Radio Subsystem – The Network and Switching Sub-system (NSS) – comprising an MSC and associated registers – The Operation Subsystem MS: Mobile Station BSS: Base Station Subsystem BSC: Base Station Controller BTS: Base Transceiver Station TRX: Transceiver MSC: Mobile Switching Centre VLR: Visitor Location Register HLR: Home Location Register Au. C: Authentication Centre EIR: Equipment Identity Register OMC: Operations and Maintenance Centre PSTN: Public Switched Telephone Network

GSM: elements and interfaces radio cell MS BSS MS Um radio cell MS BTS RSS BTS Abis BSC A MSC NSS MSC VLR signaling VLR GMSC HLR IWF O OSS EIR AUC OMC ISDN, PSTN PDN

System Architecture: Radio Subsystem radio subsystem MS network and switching subsystem – MS (Mobile Station) – BSS (Base Station Subsystem): consisting of MS Um BTS Abis BTS BSC BSS MSC • BTS (Base Transceiver Station): sender and receiver • BSC (Base Station Controller): controlling several transceivers • Interfaces A BTS • Components BSC MSC – Um : radio interface – Abis : standardized, open interface with 16 kbit/s user channels – A: standardized, open interface with 64 kbit/s user channels

Radio Subsystem • The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers • Components – Mobile Stations (MS) – Base Station Subsystem (BSS): • Base Transceiver Station (BTS): radio components including sender, receiver, antenna - if directed antennas are used one BTS can cover several cells • Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels • BSS = BSC + sum(BTS) + interconnection

RSS: The Mobile Station (MS) • The mobile station consists of: – Mobile Equipment (ME) – Subscriber Identity Module (SIM) • The SIM stores all specific data that is relevant to GSM permanent and temporary data about the mobile, the subscriber and the network, including: – – – The International Mobile Subscriber Identity (IMSI) MS ISDN number of subscriber (phone number) Authentication key and algorithms for authentication check Charging information, list of subscribed services Personal identity number (PIN), and PIN unblocking key (PUK) – Temporary location information while logged onto GSM system • Temporary mobile subscriber identity (TMSI) • Location area identification (LAI)

RSS: The Mobile Station (MS) • The mobile equipment has a unique International Mobile Equipment Identity (IMEI), which is used for theft protection • Without the SIM, only emergency calls are possible • For GSM 900, MS transmits power of up to 2 W, for GSM 1800 1 W due to smaller cell-size • MS can also have other components and services for the user (display, loudspeaker, Bluetooth interface, Ir. DA, . . . etc). These are non GSM features.

RSS: The Base Station Sub-System (BSS) • A GSM network comprises many BSSs. • The BSS performs all the functions necessary to maintain radio connection to an MS (coding/decoding of voice, rate adaptation, …) • Base Station Subsystem is composed of two parts that communicate across the standardized Abis interface allowing operation between components made by different suppliers: – Base Station Controller (BSC) – One or more Base Transceiver Stations (BTSs) • BTS contains: – Radio Transmitter/Receiver (TRX) – Signal processing and control equipment – Antennas and feeder cables

RSS: The Base Station Sub-System (BSS) • The purpose of the BTS is to: – Provide radio access to the mobile stations – Manage the radio access aspects of the system – Encode, encrypt, multiplex, modulate and feed the RF signals to the antenna. – Frequency hopping – Communicates with Mobile station and BSC • The BSC: – Allocates a channel for the duration of a call – Maintains the call: • Monitoring quality • Controlling the power transmitted by the BTS or MS • Generating a handover to another cell when required • BTSs can be linked to parent BSC by microwave, optical fiber or cable

Network and switching subsystem (NSS) • NSS is the main component and the heart of the GSM system – Connects the wireless network with standard public networks (manages communication between GSM and other networks) – Performs handover between different BSSs – Supports roaming of users between different providers in different countries – Performs functions for worldwide localization of users – Charging and billing information, accounting information In summary switching, mobility management, interconnection to other networks, system control are the main functions of NSS

NSS- components • Components – Mobile Services Switching Center (MSC) • Gateway Mobile Switching Center – Databases (important: scalability, high capacity, low delay) • Home Location Register (HLR) • Visitor Location Register (VLR) • All components connect using the SS 7 signaling system HLR GMSC fixed network NSS VLR MSC BSC

NSS - Mobile Services Switching Center • MSCs are high-performance digital ISDN switches • They set-up and control connections to other MSCs and to BSCs via the A-interface • They form the backbone network of a GSM system • Typically, an MSC manages several BSCs in a geographical region • Controls all connections via a separated network to/from a mobile terminal within the domain of the MSC

NSS - Mobile Switching Centre (MSC) • Functions of the MSC: – – – Switching calls, controlling calls and logging calls specific functions for paging and call forwarding termination of SS 7 (signaling system no. 7) mobility specific signaling Mobility management over the radio network and other networks. Radio Resource management – handovers between BSCs Billing Information location registration and forwarding of location information provision of new services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing information Interface with PSTN, ISDN, PSPDN - interworking functions via Gateway MSC (GMSC)

NSS - MSC- Gateway Mobile Switching Centre (GMSC) • A particular MSC can be assigned to act as a GMSC (Gateway Mobile Switching Centre) • • A GMSC is a device which routes traffic entering a mobile network to the correct destination • The GMSC accesses the network’s HLR to find the location of the required mobile subscriber • The operator may decide to assign more than one GMSC

NSS- Home Location Register (HLR) • Most important database in GSM system, stores all userrelevant information permanent and semi-permanent – Static information such as mobile subscriber ISDN number, subscribed services (e. g call forwarding, roaming restrictions), and the International mobile subscriber identity (IMSI)) – Dynamic information such as the current location area (LA) of the MS, the temporary mobile subscriber identity (TMSI) the mobile subscriber roaming number (MSRN), the current VLR and MSC. As soon as an MS leaves its current LA, the information in the HLR is updated. This information is necessary to localize a user in the worldwide GSM network • All these user-specific information elements only exist once for each user in a single HLR which also supports charging and accounting.

HLR Implementation • There is logically one HLR in a Network, although it may consist of several separate computers • May be split regionally • HLRs can manage data for several million customers • Contain highly specialised databases to fulfill realtime requirements and answer requests within certain time bounds. • Stand alone computer – no switching capabilities • May be located anywhere on the SS 7 network • Combine with Au. C

NSS- Visitor Location Register (VLR) • Each MSC has a VLR • VLR is a dynamic local database which stores all important information needed for MS users currently in the LA (location area) associated to the MSC (the domain of the VLR) • If a new MS comes into the LA of the VLR, it copies all relevant information for this user from the HLR, and stores this data temporarily. • Information stored includes: – – International Mobile Subscriber Identity (IMSI) Mobile Station ISDN Number (MSISDN) Mobile Station Roaming Number (MSRN) Temporary Mobile Station Identity (TMSI) • Local Mobile Station Identity – The location area where the mobile station has been registered – Supplementary service parameters

Operation Subsystem (OSS) • The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems. It accesses other components via SS 7 signaling. It consists of the following three components: – Operation and Maintenance Center (OMC) – Authentication Center (Au. C) – Equipment Identity Register (EIR) • Operation and Maintenance Center (OMC) – different control capabilities for the radio subsystem and the network subsystem via the O-interface (SS 7) • Traffic monitoring, status reports of network entities, subscriber and security management, or accounting and billing

OSS – Authentication Center (Au. C) • Authentication Center (Au. C) – A separate Au. C is defined to protect user identity and data transmission (wireless part) – authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system – generates user specific authentication parameters on request of a VLR – Situated in a special protected part of the HLR

OSS – Equipment Identity Register (EIR) • EIR is a database for all IMEI (International Mobile Equipment Identity). It stores all device identifications registered for this network • The EIR controls access to the network by returning the status of a mobile in response to an IMEI query • Possible status levels are: – White-listed - The terminal is allowed to connect to the network – Grey-listed - The terminal is under observation by the network for possible problems – Black-listed - The terminal has either been reported stolen, or is not a type approved for a GSM network. The terminal is not allowed to connect to the network.

GSM Operation: Localization & Calling • One fundamental feature of GSM is the automatic worldwide localization of users • The system always know where a user currently is, and the same phone number is valid worldwide. • To provide this service, GSM performs periodic location updates even if a user doesn’t use the MS (still logged in GSM and not switched off). • The HLR always contain information about the current location (the LA, not the precise geographical location) • The VLR responsible for the MS informs the HLR about location changes. • As soon as an MS moves into the range of a new VLR, the HLR sends all user data needed to the new VLR • Changing VLRs with uninterrupted availability of all services is called handover - roaming

Localization & Calling (cont) • To locate the MS and to address it several numbers are needed: – Mobile station international ISDN number (MSISDN). This number consists of the country code, the address of network provider and the subscriber number – International mobile subscriber identity (IMSI). This number is used for internal unique identification of a subscriber – Temporary mobile subscriber identity (TMSI): to hide the IMSI which would give away the exact identity of the user. TMSI is a four byte number selected by the current VLR and is only valid temporarily within the location area of the VLR. – Mobile station roaming number (MSRN). This is another temporary address that hides the identity and location of a subscriber. The VLR generates this address on request from the MSC. This address contains the current visitor country code, the visitor network provider, identification of current MSC with the subscriber number. This number is also saved in the HLR and helps the HLR to find a subscriber for an incoming call.

Localization & Calling (cont) • All these numbers are needed to find a subscriber and to maintain the connection with a mobile station • To describe how the calling process works we will consider two main cases for a call: – Outgoing call – Mobile Originated Call (MOC) • A GSM Mobile station calls a station outside the GSM network – Incoming Call - Mobile Terminating Call (MTC) • A station outside the GSM network calls a GSM mobile station.

Mobile Originated Call (MOC) - outgoing call • 1, 2: connection request VLR – MS sends dialled number to BSS – BSS sends dialled number to MSC 3 4 6 • 3, 4: security check – MSC checks VLR if MS is allowed the requested service. If so, MSC asks BSS to allocate resources for call. PSTN 5 GMSC 7 MSC 8 2 9 MS 1 10 BSS • 5 -8: check resources (free circuit) – MSC routes the call to GMSC – GMSC routes the call to local exchange of called user • 9 -10: set up call – Answer back(ring back) tone is routed from called user to MS via GMSC, BSS

Mobile Terminated Call (MTC) – incoming call • • • 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR calling 6: forward responsible station MSC to GMSC 7: forward call to current MSC who will be responsible from now 8, 9: get current status of MS 10, 11: paging of MS (too much signaling but searching for the correct cell is time consuming) 12, 13: MS answers 14, 15: security checks 16, 17: set up connection HLR 4 5 3 6 1 PSTN 2 GMSC 10 7 VLR 8 9 14 15 MSC 10 13 16 10 BSS BSS 11 11 12 17 MS

MOC/MTC MS MOC BTS MS MTC BTS paging request channel request immediate assignment service request paging response authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect acknowledge data/speech exchange

GSM- Logical channels • GSM specifies two basic groups of logical channels: – Traffic channels (TCH): to transmit user data (e. g. , voice, fax, SMS, . . ) – Control Channel (CCH): many different CCHs are used in GSM system to control medium access, allocation of traffic channels, or mobility management. The following three groups of CCH have been defined: • Broadcast control channel (BCCH) : A BTS used this channel to signal information to all MSs within a cell (e. g. Cell identifier) • Common control channel (CCCH): All information regarding connection setup between MS and BS is exchanged via the CCCH (e. g. paging request) – random access scheme (ALOHA) • Dedicated control channel (DCCH): Before establishing a TCH, an MS and BTS uses this bidirectional channel for signalling (e. g. authentication)

Security in GSM • Security services – access control/authentication • user �SIM (Subscriber Identity Module): secret PIN (personal identification number) • SIM �network: challenge response method – confidentiality • voice and signaling encrypted on the wireless link (after successful authentication) – anonymity • temporary identity TMSI (Temporary Mobile Subscriber Identity) • newly assigned at each new location update “secret”: • encrypted transmission • 3 algorithms specified in GSM – A 3 for authentication (“secret”, open interface) – A 5 for encryption (standardized) – A 8 for cipher key generation used in A 5(“secret”, open interface) • A 3 and A 8 available via the Internet • network providers can use stronger mechanisms • Algorithms A 3, A 8 are located on the SIM and the Au. C and can be proprietary. A 5 is implemented in device and should be identical for all providers.

GSM - authentication SIM mobile network Ki Au. C 128 bit RAND Ki 128 bit A 3 SIM SRES* 32 bit MSC SRES* =? SRES 32 bit Ki: individual subscriber authentication key 32 bit SRES: signed response

GSM - key generation and encryption MS with SIM mobile network (BTS) Ki Au. C 128 bit RAND 128 bit A 8 cipher key SIM Kc 64 bit data A 5 128 bit A 8 Kc 64 bit BSS Ki encrypted data SRES data MS A 5

Authentication & Encryption 1 4 3 7 4 5 7 5 2 6

Handover • Cellular systems require handover procedure as single cells do not cover the whole service area – Only up to 35 Km around each antenna on the countryside and some hundred meters in cities • The smaller the cell-size and the faster the movement of a MS (up to 250 Km/h for GSM), the more handovers are required • A handover should not cause a cut-off (call-drop) • GSM aims at maximum handover duration of 60 ms

Handover Causes • Handover can be initiated by either MS or MSC • Two basic reasons for a handover: – Mobile initiated handover: the MS moves out of the range of a BTS or a certain antenna of a BTS. • The received signal decreases continuously until it falls below the minimal requirements for communication • The error rate grow due to interference • The quality of the radio link is not suitable for the near future – Network Initiated handover: the wired infrastructure (MSC, BSC) may decide that the traffic in one cell is too high and shift some MS to other cells with a lower load; i. e. ; for load balancing

Handover Types • There are four different types of handover in the GSM system, which involve transferring a call between: – Internal: • Channels (time slots) in the same cell • Cells within the same BSS (same BSC) – External: • Cells in different BSSs (different BSCs) but under the control of the same MSC • Cells under the control of different MSCs

4 types of handover 1 1. 2. 3. 4. 2 3 4 MS MS BTS BTS BSC BSC MSC Intra-cell handover (channels, time-slots within the same cell – e. g. because of narrow band interference with some frequencies) Inter-cell, intra-BSC handover (cells within the same BSS, BSC) Inter-BSC, intra-MSC handover (cells in different BSS but under control of same MSC) Inter MSC handover (cells under control of different MSCs)

Handover Decision • Handover decision is based on the following parameters (in priority order): – – Received signal quality (signal level + bit-error rate) Received signal strength Distance of MS from BTS Drops below power budget margin • Each operator has a operator-defined threshold and handover decisions can be based on one or a combination of the parameters • Handover metrics: – – Call blocking/dropping/completion probability Probability of successful handoff Handoff rate/delay Interruption duration

Handover decision receive level BTSold receive level BTSnew HO_MARGIN MS MS BTSold BTSnew Too high HO_Margin cause a cut-off, too low cause too many handover

Handover procedure MS BTSold BSCold measurement report result MSC BSCnew BTSnew HO decision HO required HO request resource allocation ch. activation HO command HO request ack ch. activation ack HO access Link establishment clear command clear complete HO complete

Roaming • Allows subscriber to travel to different network areas, different operator’s networks, different countries – keeping the services and features they use at home • Billing is done through home network operator, who pays any other serving operator involved • Requires agreements between operators on charge rates, methods of payment, etc • Clearing house companies carry out data validation on roamer data records, billing of home network operations and allocation of payments

Roaming process • Each mobile network has its own HLR and VLRs. When an MSC detects a mobile user’s presence in the area covered by its network, it first checks the HLR database to determine if the user is in his/her home area or is roaming, i. e. , the user is a visitor. – User in Home Area: HLR has the necessary information for initiating, terminating, or receiving a call. – User is Roaming: VLR contacts the user’s HLR to get the necessary information to set up a temporary user profile. • When a user receives a call while roaming within another network MSC – Home GMSC contacts the HLR to determine the appropriate switch in the roaming area to handle the arriving call and then transfers the call to the roaming area MSC.

The Radio Interface • The most interesting interface in GSM is Um the radio interface. • GSM implements SDMA using cells with BTS and assigns an MS to a BTS • FDD is used to separate uplink and downlink • TDM is also used and media access combines TDMA & FDMA • In GSM 900, 124 channels uplink + 124 channels downlink, each 200 KHz wide, are used for FDMA • Each of the 248 channels is further divided into frames that are repeated continuously. The duration of the frame is 4. 615 ms • Each frame is subdivided into 8 GSM timeslots, where each slot represents a physical channel and lasts for 577 µsec. Each TDM channel occupies the 200 KHz carrier for 577 µsec every 4. 615 ms • Data is transmitted in small portions called bursts, the burst is only 546. 5 µsec long and contains 148 bits. The remaining 30. 5 µsec are used as guard space to avoid overlapping with other bursts.

GSM - TDMA/FDMA qu en cy 935 -960 MHz 124 channels (200 k. Hz) downlink fre 890 -915 MHz 124 channels (200 k. Hz) uplink higher GSM frame structures time GSM TDMA frame 1 2 3 4 5 6 7 8 4. 615 ms GSM time-slot (normal burst) guard space tail 3 bits user data S Training S user data 57 bits 1 26 bits 1 57 bits guard tail space 3 546. 5 µs 577 µs

GSM protocol layers for signaling Um Abis MS A BTS BSC MSC CM CM MM MM = RR’ RR RR’ BTSM LAPDm LAPD radio PCM 16/64 kbit/s CM MM RR LAPD = Connection Management = Mobility Management = Radio Resource Management = Link Access Procedure BSSAP SS 7 PCM 64 kbit/s / 2. 048 Mbit/s BTSM = BTS Management BSSAP = BSS application PCM = Pulse Code Modulation

Functions Provided by Protocols • Protocols above the link layer of the GSM signaling protocol architecture provide specific functions: – – – Radio resource management Mobility management Connection management Mobile application part (MAP) BTS management

Evolution Of GSM • 2 nd Generation – GSM -9. 6 Kbps (data rate) • 2. 5 Generation – HSCSD (High Speed Circuit Switched Data) • Data rate : 76. 8 Kbps (9. 6 x 8 kbps) – GPRS (General Packet Radio Service) • Data rate: 14. 4 - 115. 2 Kbps – EDGE (Enhanced Data rate for GSM Evolution) • Data rate: 547. 2 Kbps (max) • 3 rd Generation – UMTS - WCDMA(Wide band CDMA) • Data rate : 0. 348 – 2. 0 Mbps

Data services in GSM • Data transmission standardized with only 9. 6 kbit/s. Advanced coding allows 14. 4 kbit/s – not enough for Internet and multimedia applications • GSM is circuit switching connected-oriented mechanism. This is not suitable for data transmission which is bursty in nature and requires higher bandwidth – Web-browsing leaves the channel idle most of the time, so allocation of channel permanently waste too much resources – Billing is based upon time allocation of channels which is not suitable for data services • Two basic approaches have been proposed: – HSCSD (High-Speed Circuit Switched Data) – GPRS (General Packet Radio Service)

HSCSD (High-Speed Circuit Switched Data) – 2. 5 Generation • Higher data are achieved by bundling several TCHs • An MS requests one or more TCHs from the GSM network, i. e. , it allocates several TDMA slots within a TDMA frame– the allocation could be asymmetrical (more slots on downlink than in uplink) • Mainly software update in MS and MSC • An MS can use up to 8 slots within the frame to achieve up to 115. 2 Kbit/s • advantage: ready to use, constant quality, simple • disadvantage: Still circuit switching same problems, high price and wasting of resources- channels blocked for voice transmission

General Packet Radio Service- GPRS (2. 5 G) • General Packet Radio Service (GPRS) is a new bearer service for GSM that greatly improves and simplifies wireless access to packet data networks, • It uses the existing GSM network to transmit and receive TCP/IP based data to and from GPRS mobile devices. • GPRS is a non-voice service added to existing TDMA time division multiple • access networks, one of the 2. 5 G technology upgrades. TDMA is the underlying transport mechanism used by GSM networks.

General Packet Radio Service- GPRS (2. 5 G) • Fully packet-oriented switching • Standardization 1998, introduction 2001 • Using free slots only if data packets ready to send (e. g. , 50 kbit/s using 4 slots temporarily) • Users are always ON – Charging on volume not on connection time • Advantage: one step towards UMTS, more flexible • Disadvantage: more investment needed (new hardware) • GPRS network elements – GSN (GPRS Support Nodes): GGSN and SGSN (routers) – GGSN (Gateway GSN) • interworking unit between GPRS and PDN (Packet Data Network) – SGSN (Serving GSN) • supports the MS (location, billing, security) – GR (GPRS Register) • user addresses

General Packet Radio Service- GPRS (2. 5 G) • High Speed (Data Rate 14. 4 – 115 kbps) • Efficient use of radio bandwidth (Statistical Multiplexing) • Circuit switching & Packet Switching can be used in parallel • Constant connectivity

GPRS Architecture and Interfaces SGSN Gn BSS MS Um SGSN Gb Gn HLR/ GR MSC VLR EIR PDN GGSN Gi

Towards 3 G: EDGE Technology • EDGE improves the GPRS architecture by employing a new modulation method and link quality control. 8 PSK is a high-level linear modulation method that carries three times more information through an extended signal constellation. • The link quality control dynamically selects the modulation and coding scheme for transmission of data over the air interface. Thus the EDGE user bitrates increase with better quality.

Towards 3 G: CDMA • Capacity is CDMA's biggest asset. It can accommodate more users per MHz of bandwidth than any other technology ( 3 to 5 times more than GSM) • CDMA has no built-in limit to the number of concurrent users. • CDMA do not limit the distance a tower can cover. • CDMA consumes less power and covers large areas so cell size in CDMA is larger. • CDMA is able to produce a reasonable call with lower signal (cell phone reception) levels. • CDMA uses Soft Handoff, reducing the likelihood of dropped calls. • CDMA's variable rate voice coders reduce the rate being transmitted when speaker is not talking, which allows the channel to be packed more efficiently. • Has a well-defined path to higher data rates.

ITU’s View of Third-Generation Capabilities • Voice quality comparable to the public switched telephone network • 144 kbps data rate available to users in high-speed motor vehicles over large areas • 384 kbps available to pedestrians standing or moving slowly over small areas • Support for 2. 048 Mbps for office use • Symmetrical / asymmetrical data transmission rates • Support for both packet switched and circuit switched data services

ITU’s View of Third-Generation Capabilities • An adaptive interface to the Internet to reflect efficiently the common asymmetry between inbound and outbound traffic • More efficient use of the available spectrum in general • Support for a wide variety of mobile equipment • Flexibility to allow the introduction of new services and technologies

UMTS • UMTS – Universal Mobile Telephone System • Most popular 3 G wireless standard. • Combines the infrastructure of the GSM network with superior technology of the CDMA air interface. • UMTS was originally a European standard. • Not just an improvement of 2 G networks. • Requires new equipment and new frequency bandwidths

UMTS Aims • • Broadband access around 2 Mbit/s Mobile or fixed access Service transparency Mass market provision at low (? ) cost – Variety of tariffs in 2011 • Convergence of network types • Global (getting easier!)

UMTS Evolution • Evolution of GSM towards 3 G systems • Main requirement is for increased data rates • Mobile access to: Internet, E-mail, Corporate networks HSCSD: High-Speed Circuit-Switched Data GPRS: General Packet Radio Service EDGE: Enhanced Data rates for GSM Evolution

UMTS Evolution • Service Domains (in addition to location areas) • Separate mobility and service (for convergence) – Common call processing by switching layer – Common service processing by both layers – Generic support for mobility access – Reduction in switch processing (increase utilisation) – Service interaction minimised and simplified • Stronger security for mutual authentication – Needed for increasing value of services

UMTS Evolution • How? – – – GSM won’t completely evolve into UMTS Additional capabilities in GSM Introduce gradually in cities Dual UMTS/GSM terminals Cordless roaming

UMTS Multimedia • Applications – – – Web browsing Push techniques (news etc. ) Messaging & email Real-time audio & video E-commerce applications (banking, shopping) Office applications

UMTS Internet • Decouple infrastructure from applications • Layer IPv 6 over UMTS – – Fully integrated into the system Gateways to existing Internet ATM/IP Core backbone Media Gateways • Quality of Service (e. g. MPLS)

IP over 3 G/UMTS • Key services in 3 G – – Voice (of high quality) Non-Internet Multimedia, e. g. photo/video messaging Location-based Services (LBS) Internet Access – Internet Multimedia Subsystem (IMS) • IP will be a ‘service’ of 3 G – This means IP runs on top of existing layers in parallel to other protocols for other services – Some providers will specialize in IP access to customers, possibly separately to existing providers

Internet Multimedia Subsystem © www. ericsson. com