1 | 49

Communication Systems11th lecture

Chair of Communication SystemsDepartment of Applied Sciences

University of Freiburg2008

2 | 49

Communication SystemsLast lecture – digital telephony networks

Please be reminded: End of registration period for the exam in Communication Systems is the 27th June both for Master and Bachelor students

We will decide from the number of registrants on oral/written for Master students

Signaling in large scale digital networks Primary Rate Interface (PRI) to connect large organizations PBX

Global call setup and routing with signaling system #7 (which is loosely modeled after OSI stack)

Several protocols to handle different services

Special protocol QSIG for inter-connecting PBX (in private, corporate telephony networks)

3 | 49

Communication SystemsLast lecture – introduction to mobile telephony networks

Interfaces in the telephony world are the standards equivalent to protocols in the TCP/IP world

Major difference: TCP/IP is rather open to everyone and not restricted to an exclusive club of telephony equipment manufacturers and telcos (which has major implications for security issues)

Introduction to mobile telephony networks from the analogous world to cell based infrastructure to second generation interoperable digital mobile phone networks

Standardization process started middle of 80s

First deployment in 1991, 92

Fast growth till then – more then 500 million subscribers by 2005

GSM – Global System for Mobile communication is a worldwide standard by now, available everywhere with few exceptions

4 | 49

Communication SystemsLast lecture – first introduction to GSM structure

GSM consists of radio, network and operation and maintenance subsystems

Radio subsystem is comprised of Mobile Stations (MS, end user equipment), Base Transceiver Stations (BTS, covering a certain Location Area)

BTS are handled by Base Station controllers (BSC), which are controlled by MSC:

5 | 49

Communication SystemsPlan for this lecture

Extension of GSM overview GSM interfaces

GSM network components

Mobile switching center,visitor location register, home location register, authentication center, mobile stations, SIM, radio subsystem...

Radio interface Um

Control channels

Network control, SS7

Call setup

Authentication, Authorization, Access

Security issues

6 | 49

Communication SystemsGSM interfaces and components

7 | 49

Communication SystemsGSM interfaces and components

Like in the digital telephony network interfaces between the different components are defined

Um is the radio interface (m for mobile) between the mobile stations

and the base station transceiver, modeled after the user interface in the ISDN world (U

k0 , U

G2)

Abis

is the interface between BTS and BSC

A the interface of the BSC to the MSC

The network subsystem defines the following interfaces B between MSC and visitor location register (VLR)

C between MSC and home location register (HLR)

8 | 49

Communication SystemsGSM interfaces and components

The several MSC are interconnected via E interfaces, this is the interface to Gateway MSC too

F defines the interface to the equipment identifier register (EIR)

The different VLR talk to each other (needed when hand-overs between different MSC occur) via G interface

Operation & Maintenance Subsystem (OSS) is the whole systems management layer

Network measurement and control functions

Monitored and initiated from the OMC (Operation and Maintenance Center)

Network Administration

9 | 49

Communication SystemsGSM interfaces and components

OMC keeps track of configuration, operation, performance management, statistics

Collection and analysis, network maintenance

Commercial operation & charging

Accounting & billing

Security Management, e.g. Equipment Identity Register (EIR) management

10 | 49

Communication SystemsGSM network components

Network and radio subsystem are supervised by OMC

Many BSCs are controlled by Mobile Switching Center (MSC), which is part of Network subsystem

Somewhere in between is the TRAU (Transcoding and Rate adaption Unit)

11 | 49

Communication SystemsGSM components – network operation, MSC

A provider network has in general many distributed MSCs Thus the MSC is a typical ISDN switching center with additional

components for mobility management Many standards and interfaces discussed in last lecture apply here

too

Controls the access and authorization of mobile subscribers

Gets the user data from HLR and copies it to the VLR of all MS in range

12 | 49

Communication SystemsGSM components - MSC

To convert 13kbit/s (from MS), 16kbit/s (from BSC because of some added in-band information) to 64kbit/s ISDN data rate a TRAU is typically included in between MSC and BSC

Performs all the switching and routing functions of a fixed network switching node and adds specific mobility-related functions, like

Allocation and administration of radio resources Management of mobile users Registration, authentication Manages handover execution and control Does paging (search for MS within the BSCs)

13 | 49

Communication SystemsGSM components – visitor location register (VLR)

MSC looks up users and communication information in VLR VLR is a temporary database dynamically updated when

subscribers enter or leave vicinity of the serving MSC

one database per MSC (or per group of MSCs), typically joint MSC-VLR implementation

Idea: Avoid heavy MSC-VRL signaling load on network links

VLR entries contain the following information:

Every user / MSISDN actually staying in the administrative area of the associated MSC

Entry created when an MS enters the MSC area (registration) May store data for roaming users (subscribed to different

operators)

14 | 49

Communication SystemsGSM components – visitor location register (VLR)

VLR entries contain the following information:

Tracking and routing information Mobile Station Roaming Number (MSRN) Temporary Mobile Station Identity (TMSI) assigned by MSC Location Area Identity (LAI) where MS has registered needed

for paging and call setup

15 | 49

Communication SystemsGSM components – home location register (HLR)

While VLR keeps user data only temporarily, the permanent storage of data takes place in HLR

Each mobile provider keeps such a database to store its subscribers information

Subscriber and subscription data

IMSI, MSISDN Parameters (authorization) for additional services info about user equipment (IMEI) Authentication data

Service setup for call deflection, mobile phone box, ...

16 | 49

Communication SystemsGSM components – authentication center (AUC)

Typically seen as part of OMC Associated to HLR (home location register)

Might be integrated with HLR

Search key: IMSI

Responsible of storing security-relevant subscriber data

Subscriber’s secret key Ki (for authentication)

Shared encryption key on the radio channel (Kc)

Algorithms to compute temporary keys used during authentication process

17 | 49

Communication SystemsGSM components – mobile stations (MS)

GSM separates user mobility from equipment mobility by defining two distinct components

Mobile Equipment (ME) Or Mobile Terminal (MT) – it is the cellular telephone itself (mobile

phone hardware)

It has its own address / identifier: IMEI (International Mobile Equipment Identity)

Composed of the technical components for user interaction: keypad, display, speaker and microphone, may contain

Interfaces for additional services like fax or data (peripheral connections as Bluetooth, IrDA or serial connections might be available too)

18 | 49

Communication SystemsGSM components – mobile stations (MS)

Five transmit power classes defined for MS in 900MHz band 20, 8, 5, 2, 0.8 Watt – normally used are 8W for vehicular and 0.8W

for portable devices

Only two classes for 1800MHz band: 1 and 0.25W

Implementations Early devices were single band for GSM900 or DCS1800 or

PCS1900

Today mostly so called multi-band phones are sold (allow communication in two or all three GSM bands)

Newest devices are multi-mode which could handle both GSM and UMTS (and several data standards like GPRS)

19 | 49

Communication SystemsGSM components – mobile stations (SIM)

Second component is the Subscriber Identity Module (SIM) SIM keeps the following addresses / identifiers:

IMSI (International Mobile Subscriber Identity) – 15-digit composed of Mobile Country Code, Mobile Network Code, Mobile Subscriber Identification Number

Is sent (for security reasons only) when entering network or doing location update

MSISDN (Mobile Subscriber ISDN number) of 15 digits is the telephone number users call, composed of Country Code (Germany 49, US 1), National Destination Code (Provider prefix without the 0), Subscriber Number

20 | 49

Communication SystemsGSM components – mobile stations (SIM)

The MSISDN is used for routing in traditional telephony networks (but not for routing in mobile)

Translated in MSC to TMSI, unique within a certain Location Area (LA), kept in the VLR

TMSI is temporarily stored on SIM Not fixed, regularily changed to avoid outside user tracking

Same applies for MSRN (Mobile Station Roaming Number, GSM internally):

VCC = contry code of visited mobile network

VNDC = location code (place where the user actually is)

VMSN = ID of the visited MSC

VSN = subscriber ID, assigned by VLR

21 | 49

Communication SystemsGSM components – mobile stations (SIM)

MSRN is similarily composed to MSISDN, but location dependent

SIM itself is piece of hardware, a plug-in-module, a so-called smartcard (or fixed chip within the phone – only on special devices)

Usually provided in the ID-000 format, which is about 0,76mm thick plastic with cast-in chip

It contains: a CPU, internal bus system connecting RAM and EEPROM and an electrical interface (contact pads on the upper side)

22 | 49

Communication SystemsGSM components - radio subsystem (BTS)

Radio interface functions (MS <-> BTS) GMSK modulation-demodulation

channel coding, encryption/decryption

burst formatting, interleaving

signal strength measurements

interference measurements

23 | 49

Communication SystemsGSM components - radio subsystem (BSC)

Functions of a BSC One BSC may control up to 40

BTS (kept in database)

switch calls from MSC to correct BTS and conversely

Protocol and coding conversion for traffic (voice) & signaling (GSM-specific to ISDN-specific)

Manage mobility of MS (handover between different BTS)

Enforce power control

24 | 49

Communication SystemsGSM – the radio interface Um

Lets start with the physical layer of the beloved OSI model Um defines the communication of MS with the GSM infrastructure The bandwidth is 270,833kbit/s (bit rate not integer because

derived from time slots as explained later) Because of the limited frequency band multiplex access is used

25 | 49

Communication SystemsGSM – Um: FDM & TDM

Frequency Division Multiplexing two 25MHz bands Uplink (MS to BTS) = 890 – 915MHz.

Downlink (BTS to MS) = 935 – 960MHz

Each defined channel has a 200kHz bandwidth

Duplex spacing: 45MHz

Thus 124 bearer frequency pairs possible, suggested to use only 122 to keep additional guard top and bottom

In practice, due to power control and shadowing, adjacent channels cannot be used within the same cell…

Additionally in each frequency channel Time Division Multiplexing (TDM) is applied

26 | 49

Communication SystemsGSM – Um: FDM & TDM

8 periodic time slots - 0,577ms each TDM frame composed of 8 time slots equals to 4,615ms Every time slot a so called “burst” - succession of 148bit is

transmitted

Between the bursts a “security buffer” of 8,25bit/burst is put in between

27 | 49

Communication SystemsGSM – Um: FDM & TDM

Through FDM/TDM hybrid in GSM 992 channels available

In DCS1800 more channels: 75MHz band split into 200kHz channels allows a total of 374 carriers

Thus 2992 physical channels available in E-GSM

28 | 49

Communication SystemsGSM – Um: burst types / dummy burst

Five different burst types defined Normal Burst

Access Burst

Frequency Correction Burst

Synchronization Burst

Dummy Burst to fill in inactive bursts in Broadcast Control Channel (BCCH, direction from BTS to MS) to have most power on this channel (helpful, when MS needs to find BCCH)

29 | 49

Communication SystemsGSM – Um: fequency hopping

Not all channels in a given cell are of equal quality and multi path reception / adjacent channels may disrupt communication

Thus frequency hopping is introduced avoid frequency-selective fading, co-channel interference

30 | 49

Communication SystemsGSM – Um: GMSK modulation

Split single bits into odd and even

Double the time period of each bit

Four cases

Bg=Bu=0 use f2 inverted

Bg=1,Bu=0 use f1 inv.

Bg=0,Bu=1 use f1

Bg=1, Bu=1 use f2

31 | 49

Communication SystemsGSM – the Um logical layer

The logical layer could be seen as the equivalent of OSI data link layer

Here are the logical channels mapped into the physical ones

Two distinctions: traffic channels and control channels

The traffic channels carry the user data (voice, SMS, fax, ...) Full rate channel: B

m 22,8kbit/s (TCH/F)

Half rate channel: Lm 13,4kbit/s (TCH/H)

32 | 49

Communication SystemsGSM – control channels

Beside the traffic channels are a group of control channels defined

They handle system information, connection setup and connection control

Broadcast Control Channel (BCCH) group handles beacon signaling, synchronization of MS with the serving BTS, timing advance adjustment, it comprises of BCCH – Broadcast Control Channel

FCCH – Frequency Control Channel

SCH – Synchronization Channel

33 | 49

Communication SystemsGSM – control channels: FCCH, SCH

FCCH is responsible for first part of MS tuning (synchronisation of mobile device to BTS signal)

MS listens on strongest beacon for a pure sine wave (FCCH), first coarse bit synchronization used for fine tuning of oscillator

Immediately after follows a SCH burst SCH: Fine tuning of synchronization (64 bits training sequence)

Read burst content for synchronization data

25 bits (+ 10 parity + 4 tail + ½ convolutional coding = 78bits)

6 bits: BSIC, 19 bits: Frame Number (reduced)

Finally MS is able to read BCCH information

34 | 49

Communication SystemsGSM – control channels: BCCH

BCCH is responsible for Sending out of beacon on one frequency per cell (by BTS)

Contains 16bit Location Area (LA) code

MUST BE on Time Slot #0, following time slots might used by TCH

BCCH provides: Details of the control channel configuration

Parameters to be used in the cell

Random access backoff values

Maximum power an MS may access (MS_TXPWR_MAX_CCCH)

35 | 49

Communication SystemsGSM – control channels: BCCH

BCCH provides: Minimum received power at MS (RXLEV_ACCESS_MIN)

Is cell allowed? (CELL_BAR_ACCESS)

List of carriers used in the cell

Needed if frequency hopping is applied

List of BCCH carriers and BSIC of neighboring cells

36 | 49

Communication SystemsGSM – control channels

Next group Common Control Channel (CCCH) it consists of Random Acces Channel (RACH)

Access Grant Channel (AGCH)

Paging Channel (PCH) Third group is the Dedicated/Associated Control Channel

(DCCH)/ (ACCH) Stand-alone Dedicated Control Channel SDCCH Fast/Slow Associated Control Channel SACCH/FACCH

FACCH used when several signalling information needs to be transmitted

Call setup, Handover

37 | 49

Communication SystemsGSM – the Um logical layer

Channels are grouped into 26-multiframe - payload / voice – summarizes the bursts of TCHs

and associated SACCHs and FACCHs

51-multiframe – signaling data – puts together all bursts of traffic channels without SACCHs and FACCHs

GSM uses certain predefined pattern of channel combinations:CC1: TCH/F + FACCH/F + SACCH/TF

CC2: TCH/H (0,1) + FACCH/H(0,1) + SACCH/TH(0,1)

CC3: TCH/H(0) + FACCH/H(0) + SACCH/TH(0)+TCH/H(1)

CC4: FCCH + SCH + BCCH + CCCH

CC5: FCCH + SCH + BCCH + CCCH + SDCCH/4(0,1,2,3) + SACCH/C4 (0,1,2,3)

CC6: BCCH + CCCH

CC7: SDCCH/8 + SA

38 | 49

Communication SystemsGSM – frames, multiframes, superframes

Why 26, 51:An active call transmits/receive in 25 frames, except the last one

In this last frame, it can monitor the BCCH of this (and neighbor) cell

This particular numbering allows to scan all BCCH slots during a superframe

Important slots while call is active: frequency correction FCCH and sync SCH - needed for handover

Why multiframes - determine how BCCH is constructed, e.g. which specific information transmitted on BCCH during a given multiframe

Superframes are composed of multiframes Used as input parameter by encryption algorithm

39 | 49

Communication SystemsGSM – network control, SS7

• Backend of mobile networks is the same digital telephony network as for ISDN (Intelligent Network – IN)

• Thus Signaling System 7 is used for the network generic and GSM specific tasks

• MAP (Mobile Application Part)

– Located in presentation layer (OSI layer 6)

– communication between different MSCs or MSC and HLR

40 | 49

Communication SystemsGSM – network control, SS7

• DTAP the Direct Transfer Application Part is located on the presentation layer too

– Used to send messages from the MS to MSC directly

• BSSMAP (Base Station Subsystem MAP

– Found on session layer (OSI layer 5)

– Handles communication between MSC and radio subsystem

• Additionally SCCP (Signaling Connection and Control Part) on transport layer similar to TCP or UDP, instead of port numbers SubSystemNumbers (SSN) are used

• TCAP (Transaction Capability Application Part) - session layer known from last lecture

41 | 49

Communication SystemsGSM – call setup

• After defining the lower layers we could deal with the important part for the subscribers – receive a call in a mobile phone network

– The called device/user has to be looked up in a given location area (paging)

– To be able to answer the MS has to request a channel

– It gets assigned a control channel by the BSC immediately if cell is not congested

42 | 49

Communication SystemsGSM – call setup – network originated call

• The MS sends out an acknowledgement (subscriber is present)

• Next steps check the authorization of the subscriber

• If check was passed the system changes into encryption mode

• The MS signals which kind of service it wishes to use (voice, data, ...)

• Depending on the preferred service a traffic channel is assigned

• A “call signal” is produced for the calling party and a ring is generated on the MS

43 | 49

Communication SystemsGSM – call setup – network originated call

• The subscriber accepts the call, ack is sent and connection is established

• A full rate traffic channel (for voice) is used

• During call setup and operation several control channels are used: PCH, RACH, AGCH, SDCCH, ...

• Mobile originated calls are mostly similar No paging is needed because the MS activily requests a

channel

A signaling channel is assigned by BSC

44 | 49

Communication SystemsGSM – call setup – mobile originated call

Service request a SDCCH is required

Same authorization and encryption procedure has to be done

Signaling of desired service and assignment of proper payload channel

Signaling of “call signal” to the subscriber at the MS

Call setup if called party answers

45 | 49

Communication SystemsGSM – Authentication, Authorization, Access

• In a public network like GSM the triple-A of authentication, authorisation, access plays a major role

– The subscribers ID has to be kept confidential

– The network access has to be granted or denied to the subscriber

– The integrity and confidentiality of data has to be ensured by the network

• This is achieved by a more or less sophisticated asymmetric and symmetric encryption and authentication process

– Temporary and confidential identities and keys are used

46 | 49

Communication SystemsGSM – Authentication, Authorization, Access

47 | 49

Communication SystemsGSM – Authentication, Authorization, Access

• Sequence of authorization and generation of shared keys for encryption

1. The network sends an authentication request message to MS, conveying a 128-bit random number (RAND).

2. MS uses the RAND, the secret key Ki (stored at SIM), and the encryption algorithm A3, to compute a 32-bit number as a signed response (SRES).

3. MS computes the 64-bit ciphering key Kc using encryption algorithm A8, which will be later used in the ciphering procedure.

4. MS responses with an authentication response message containing SRES.

5. The netwotk uses same parameters and algorithm to computer another SRES.

6. MS SRES and the network SRES are compared with each other. If mactch, the network accepts the user as an authorized subscriber. Otherwise, authentication is rejected.

7. After authentication has been successful, the network transmits a ciphering mode message to MS indicating whether encryption is to be applied.

8. In case ciphering is to be performed, the secret key Kc and encryption algorithm A5 are used for ciphering.

48 | 49

Communication SystemsGSM – stream encryption

49 | 49

Communication SystemsGSM literature, next exercise, lectures

Some of the pictures are taken from text books or online sources

German text books: Jochen Schiller, Mobilkommunikation

Bernhard Walke, Mobilfunknetze und ihre Protokolle, Grundlagen GSM, UMTS, ...

Generally you might want to check the seminar papers of the telephony seminar held in the beginning of 2006:

http://www.ks.uni-freiburg.de/php_veranstaltungsdetail.php?id=9 summary of GSM and UMTS telephony networks and other topics

dealt with in this lecture

Next lecture: Friday, 27th July (next practical course on Tuesday, 24th)