CCM 4300 Lecture 15Computer Networks, Wireless and Mobile

Communication Systems

1

GSM, GPRS & UMTS

Dr S Rahman

Lesson objectives� To acquire a basic understanding of GSM, GPRS,

EDGE and UMTS, and you will be able:

- to make informative decision regarding

which technology to use and why

2

- explore the history and architecture of such

technologies

- identify some of the advantages and

disadvantages of using these technologies.

Session Content

� Introduction – what is GSM?

� GSM and GPRS Components

� Why the interest in 2G, 3G and 4G technologies?

3

� UMTS

Wide Area mobile connectivity-GSM

• Circuit-switched

• Second generation (2G):

• digital

• GSM (2G):

• digital

• secure (?)

• SMS:

• up to 160 chars of text

• GSM flavours:

• GSM900 – vanilla GSM

• GSM1800, PCN,

(Europe)

4

• secure (?)

• international roaming

• 13Kb/s voice

• 2.4kb/s - 9.6Kb/s data (uses FEC)

(Europe)

• GSM1900, PCS (US)

• GPRS (2.5G)

• UMTS (3G)

• 4G systems:

• 20Mb/s – 100Mb/s

GSM: An overview IGSM

�formerly: Groupe Spéciale Mobile (founded 1982)

�now: Global System for Mobile Communication

�Pan-European standard (ETSI, European Telecommunications Standardisation

Institute)

�simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations (Germany: D1 and D2), seamless

5

the European telecommunication administrations (Germany: D1 and D2), seamless roaming within Europe possible

�today many providers all over the world use GSM (more than 214 countries in Asia,

Africa, Europe, Australia, America)

�more than 2 billion subscribers

�more than 70% of all digital mobile phones use GSM

�Countries which are using GSM networks on larger scales are Russia, China,

Pakistan, United States, India.

�over 360 billion SMS per year worldwide

• A GSM network consists of several

functional entities and can be divided into

following four main parts:

• Mobile station (MS)

• Base-station subsystem (BSS)

Introduction to GSM

• Network and Switching Subsystem

(NSS)

• Operation and Support Subsystem

(OSS)

6

Introduction to GSM......cont

7

• Mobile stations (MS) or known as cell or mobile phones -section of a GSM cellular network that the user sees and operates.

• Two main elements - main hardware and the SIM.

• The hardware - the main elements of the mobile phone including the display, case, battery, and the electronics.

• Hardware used to generate the signal, and process the data receiver and to be transmitted.

Mobile Station (MS)

receiver and to be transmitted.

• Also contains International Mobile Equipment Identity (IMEI) number - installed in the phone at manufacture and "cannot" be changed.

• It is accessed by the network during registration to check whether the equipment has been reported as stolen.

• The SIM (Subscriber Identity Module) contains the information that provides the identity of the user to the network.

• Also contains other information including a number known as the International Mobile Subscriber Identity (IMSI). 8

• BSS - associated with communicating with the mobiles on the network, consists of two elements: BTS and BSC.

• Base Transceiver Station (BTS) - used in a GSM network comprises the radio transmitter receivers, and their associated antennas that

Base Station Subsystem (BSS)

transmit and receive to directly communicate with the mobiles.

• Base Station Controller (BSC) - controls a group of BTSs. It manages the radio resources and controls items such as handover within the group of BTSs, allocates channels, etc.

9

• Base Tranceiver Station (BTS)

• Coding

• Crypting

• Multiplexing

• Modulating

Base Transceiver Station (BTS)

• Modulating

• Synchronizing

10

• Base Station Controller(BSC)

• translates the 13-Kbps voice to the

standard

• 64-Kbps channel (used by PSDN or ISDN)

• frequency hopping

• time and frequency synchronisation

• power management

Base Station Controller (BSC)

Base StationSubsystem(BSS)= BTS + BSC

• power management

• time delay measurements

11

• Provides the main control and interfacing for

the whole mobile network and the main

elements are :

• Mobile Services Switching Centre (MSC)

• Home Location Register (HLR)

• Visitor Location Register (VLR)

Network Switching Subsystem (NSS)

• Visitor Location Register (VLR)

• Equipment Identity Register (EIR)

• Authentication Centre (AuC)

• Gateway Mobile Switching Centre (GMSC)

• SMS Gateway (SMS-G)

12

• Mobile Services Switching Centre (MSC)

• performs the telephony switching functions

• provides an interface to the PSTN for call routing from the mobile network to a phone

• performs other functions like registration, authentication, call location, inter-MSC handovers and call routing to a mobile subscriber

• interfaces to other MSCs to enable calls to be made to

Network Switching Subsystem (NSS)..cont.

• interfaces to other MSCs to enable calls to be made to mobiles on different networks.

• HLR database - contains all the administrative information about each subscriber along with their last known location. GSM network is able to route calls to the relevant base station for the MS.

• Visitor Location Register (VLR) - contains temporary information about subscribers that is needed by HLR in order to service visiting subscribers. It is integrated with MSC.

13

• Equipment Identity Register (EIR) – database that contains the identity of mobile equipment that prevents calls from stolen, unauthorized or defective mobile devices. International Mobile Equipment Identity (IMEI) number is checked and dependent upon the information held in the EIR, the mobile may be allocated one of three states - allowed onto the network, barred access, or monitored in case its problems.

• Authentication Centre (AuC) - a protected database that provides the authentication and encryption parameters that

Network Switching Subsystem (NSS)..cont.

provides the authentication and encryption parameters that verify the user’s identity and ensure the confidentiality of each call.

• Find out more on GMSC and SMS-G (Short Message Services Gateway)

14

• The OSS – functional entity from which the network

operator monitors and control the system.

• An element within the overall GSM network

architecture that is connected to components of the

NSS and the BSC

• Used to control and monitor the overall GSM network

and it is also used to control the traffic load of the

Operation and Support Subsystem (OSS)

and it is also used to control the traffic load of the

BSS

• Other additional functional elements: i) message

centre (MXE), mobile service node (MSN),

Transcoder and Adaptation Unit (TRAU)

15

GSM Architecture Summary

1. Subcribers

carries MOBILE

STATION

2. BSS controls

the radio link

with the

mobile station

3. NETWORK

SUBSYSTEM,

16

SUBSYSTEM,

which main

part is MSC

GSM Architecture Summary...cont..

17

GSM Architecture Summary...cont..

18

• In a GSM network, the following areas are defined:

• Cell: basic service area, one BTS covers one cell.

Each cell is given a Cell Global Identity (CGI), a

number that uniquely identifies the cell.

• Location Area: A group of cells form a Location Area.

This is the area that is paged when a subscriber gets

an incoming call. Each Location Area is assigned a

Location Area Identity (LAI). Each Location Area is

GSM Network Areas

Location Area Identity (LAI). Each Location Area is

served by one or more BSCs.

• MSC/VLR Service Area: The area covered by one

MSC is called the MSC/VLR service area.

• PLMN (public land mobile network): The area covered

by one network operator is called PLMN. A PLMN can

contain one or more MSCs.

19

GSM Specifications

• Modulation - GSM uses Gaussian Minimum Shift Keying

(GMSK) modulation method.

• Access Methods - GSM uses a combination of TDMA/FDMA

as its method.

• FDMA part divides the frequency of the total 25 MHz

bandwidth into 124 carrier frequencies of 200 kHz bandwidth.

• One or more carrier frequencies are then assigned to each

20

• One or more carrier frequencies are then assigned to each

BS.

• Each of these carrier frequencies is then divided in time,

using a TDMA scheme, into eight time slots.

• One time slot is used for transmission by the mobile and one

for reception.

• They are separated in time so that the mobile unit does not

receive and transmit at the same time.

• Transmission Rate - The total symbol rate for GSM at 1 bit per symbol in GMSK produces 270.833 K symbols/second. The gross transmission rate of the time slot is 22.8 Kbps.

• Frequency Band: The uplink frequency range specified for GSM is 933 - 960 MHz (basic 900 MHz band only). The downlink frequency band 890 - 915 MHz (basic 900 MHz band only).

GSM Specifications ….cont….

• Channel Spacing: This indicates separation between adjacent carrier frequencies. In GSM, this is 200 kHz.

• Speech Coding: GSM uses linear predictive coding (LPC). The purpose of LPC is to reduce the bit rate. The LPC provides parameters for a filter that mimics the vocal tract. The signal passes through this filter, leaving behind a residual signal. Speech is encoded at 13 kbps.

21

GSM Physical layer• Phy:

• 900MHz (1.8GHz, 1.9GHz)

• 2x25Mhz bands

890-915MHz uplink

935-960MHz downlink

• 124 carriers per band

• 200KHz bandwidth per

0

0

7frame

(8 bursts)

tail bits

data bits

stealing bit (S)

training sequence

S indicates user or network control data

22

• 200KHz bandwidth per

carrier

• Channel allocation:

• TDMA/FDMA

• multiple frequency channels

• TDMA in each channel

• (slow FH possible)

25multi-frame (26 frames)

(120ms)

frame 12 for signalling

frame 25 unused

(8 bursts)

(~4.615ms)

tail: 3 bits

stealing: 1 bit

data: 57 bits

training: 26 bits

guard: 8.25 bits

Stealing bits

data bits

guard bits

Tail bits

GSM Network Structure

• Digital mobile service:

• data/voice

• extendable network

• allows international

roaming

• Network topology:

23

• Network topology:

• cells

• base-transceiver station

(BTS)

• GSM cell clusters

• 4, 7, 12, 21 cells

• pattern repeats to cover area

• BTS network:

• interconnected by a

terrestrial network

base-transceiver station (BTS)

GSM network structure..cont.

•MS:

• sends beacon to BTS

• BSC:

• talks to all BTS in an area

• assigns channels

• performs authentication

• Hand-off:

• BTS ⇔ BTS (same BSC)

• BSC ⇔BSC (same MSC)

• MSC ⇔ MSC

24

• performs authentication

• sends updates for VLR

• communicates with other

BSCs and a single MSC

• Roaming:

• updates to VLR via MSC

• MSC ⇔ MSC

• Location information:

• mobile is tracked

• location registers kept

updated

MS Mobile station, EIR equipment identity register

BSC base-station controller

BTS base-transceiver station

HLR home location register

MSC mobile switching centre

VLR visitor location register

OMC Operation and maintenance systems

GSM cell typesHot spots:

• cell-within-a-cell

• Macro-cells:

• large, sparsely populated areas

• Micro-cells:

• densely populated areas. By splitting the existing

areas into smaller cells, the number of channels

available is increased as well as the capacity of the

cells. The power level of the transmitters used in these

fast-moving MS,

many-hand-offs

e.g. car, train, etc

Umbrella

25

cells. The power level of the transmitters used in these

cells is then decreased, reducing the possibility of

interference between neighbouring cells.

• Selective cells:

• not-360° coverage

• special antenna give “shape” , e.g. Cells that may be

located at the entrances of tunnels where a selective cell

with a coverage of 120 degrees is used.

• Umbrella cells:

•covers several micro-cells

• used for “high-speed” MS

Umbrella cell

Umbrella

cell

Handoff for Wireless Systems

• Handoff!!

• The process of transferring a mobile user from one

channel or base station to another.

26

Power Management

Hand-off

• Quality vs. power

• Maintain quality:

• mobile increases transmit

power

• maintains quality

Silence suppression

• DTX (Discontinuous transmission a

method of momentarily powering-down)

• No “speech” for ~40% of

call duration:

• perhaps more for data

• Background noise at MS:

27

• maintains quality

• hand-off when quality is

low

• Conserve power:

• set transmit power

threshold

• hand-off when threshold

reached

• Background noise at MS:

• not easy to detect …

• detect “no speech”

• Switch off transmission:

• when “no speech”detected

• saves power

• Receiver:

• comfort noise

Security

Terminal

• SIM:

• subscriber identity

module

• IMSI(International Mobile Subscriber Identity):

• subscriber identity (on

Network

• EIR:

• stores known IMEI numbers

• AuC:

• uses IMSI and IMEI (plus

28

• subscriber identity (on

SIM)

• IMEI(International Mobile Equipment Identity):

• MS identity (in MS)

• Stream cipher used:

• key+algorithm from SIM

• random number XOR’d

with data/voice bits

(plus

interaction with EIR)

• authenticates user

• checks service subscription

• (updates VLR and other

location information)

Security in GSM• Security services

– access control/authentication

• user � SIM (Subscriber Identity Module): secret PIN (personal identification number)

• Security services

– access control/authentication

• user � SIM (Subscriber Identity Module): secret PIN (personal identification

number)

• SIM � network: challenge response method

- one party presents a question ("challenge") and another party

must provide a valid answer ("response") to be authenticated.• SIM � network: challenge response method

– confidentiality

“between you and I”:

• A3 and A8 available via

the Internet

• network providers can – confidentiality

• voice and signaling encrypted on the wireless

link (after successful authentication)

– anonymity

• temporary identity TMSI (Temporary Mobile Subscriber Identity)

• newly assigned at each new location update (LUP)

• encrypted transmission

• 3 algorithms specified in GSM

– A3 for authentication (“secret”, open interface)

– A5 for encryption (standardised)

– A8 for key generation (“secret”, open interface)

• network providers can

use stronger mechanisms

RANDKi

128 bit 128 bit

RAND Ki

128 bit 128 bit

RAND

mobile network SIM

AC

GSM - authentication

30

A3

128 bit 128 bit

SRES* 32 bit

A3

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRESSRES

32 bit

AC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response

RANDKi

128 bit 128 bit

RAND Ki

128 bit 128 bit

RAND

mobile network (BTS) MS with SIM

AC SIM

GSM - key generation and encryption

31

A8

128 bit 128 bit

Kc

64 bit

A8

128 bit 128 bit

SRESencrypted

dataBSS

A5

Kc

64 bit

A5

MSdata data

cipher

key

Beyond 2G systems: GPRS I

General Packet Radio Service

(GPRS)• Packet radio service:

• “always on”

• shared media access

Point-to-point (PTP) service:

•Uses existing GSM infrastructure:

• requires some changes to

support new signalling

• Same RF spectrum as GSM• multiple bursts per user• one frame could carry voice

32

Point-to-point (PTP) service:

internetworking with the Internet (IP

protocols) and X.25 networks.

Point-to-multipoint (PT2MP) service:

point-to-multipoint multicast and point-

to-multipoint group calls

• one frame could carry voiceand data

• On demand allocation:• user signals network forchannel/burst(s) allocation

• Requires new terminal:• mobile phones may need to be

upgraded or replaced (done)

GPRS Structure

33

• GPRS - not a completely separate network to GSM, devices such as the base transceiver stations and base transceiver station controllers are still used.

• Two new functional elements - Serving GPRS Support Node (SGSN) and the Gateway GPRS support node (GGSN).

• SGSN – supports routing, handover and IP address assignment. GTP – GSM tunneling protocol is used.

• GGSN - basically a gateway, router and firewall rolled into one and confirms user details for security

GPRS II• Better network utilisation

Best-effort packet switched

opposed to circuit switching

• Good for general data:

• suits bursty applications

Reliabilityclass

Lost SDUprobability

DuplicateSDU

probability

Out ofsequence

SDUprobability

Corrupt SDUprobability

1 10-9

10-9

10-9

10-9

2 10-4 10-5 10-5 10-6

3 10-2

10-5

10-5

10-2

SDU: Secure Data Units

34

• suits bursty applications

• GPRS + IP integration:

• How to charge?

• volume – per packet?

• flat rate?

Moderate speed data transfer, by using unused (TDMA) channels.

• QoS:

• may not be suitable for real-time

applications

• “real-time extensions” in 3G

Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile

1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified

???

EDGE

Enhanced Data-rates for GSM

Evolution: a new radio interface

technology with enhanced

modulation, increases the

HSCSD and GPRS data rates

by up to three fold.

Requires new RF spectrum:

• 2x50MHz

• 1.9GHz and 2.1GHz bands

being used in some parts of the world

35

by up to three fold.

• builds on GPRS mechanism

• packet interface

• Available worldwide

• “Peak rates” of 384Kb/s:

• “pedestrian” rate

• “Normal rate” of 144Kb/s:

• “high mobility” rate

High-Speed Packet Access

(HSPA). Peak bit-rates of up to

1Mbit/s and typical bit-rates of

400kbit/s can be expected.

Note: HSCSD - High Speed Circuit Switched Data

EDGE...cont...• EDGE provides significantly

higher data rates compared to

200 kHz GSM carrier by

incorporating both EGPRS and

ECSD services.

• EGPRS – Enhanced General

Packet Radio System

• ECSD - Enhanced Circuit

Switched Data

36

Switched Data

• EDGE TRXs (transceivers) carry more data per time slot

• EDGE will boost all existing circuit and packet switched services and enable

completely new high-speed data applications.

EDGETheoretical

Optimal Data

Rates

473 Kbps

CDMA 1xRTT

(Round Trip Time)

EDGE offers data rates of 80-130 Kbps and up to 473 Kbps, upgrade to GPRS.

EDGE employs three advanced techniques

EDGE makes full use of the capacity in the available radio spectrum.

GPRS

Average

Data Rates

30-40 Kbps

80-130 Kbps

30-60 Kbps

153 Kbps

115 Kbps

UMTS: universal mobile telecommunications services

3G –• Voice:

• 2G GSM-like services

• Data:

• 64Kb/s – ~2Mb/s

• ISDN-like services

• WCDMA(Wideband Code

Division Multiple Access)

Needs new RF spectrum!

W-CDMA (wideband CDMA) a

pair of 5MHz frequency band,

for the uplink, 19000 MHz range,

for the downlink, 2100 MHz range.

• Requires new or upgraded

38

Division Multiple Access)

10Mb/s

• Packet and circuit services

• International roaming

• Requires new or upgraded

infrastructure

• Potential for broadband wireless

services

Since 2006, UMTS networks in many

countries have been or are in the

process of being upgraded with High

Speed Downlink Packet Access

(HSDPA), sometimes known as 3.5G.

Up to 21 Mbit/s.

UMTS: Evolution

39

UMTS: Evolution..cont..

40

UMTS Phase 1 Network

41

UTRAN (UMTS Terrestrial Radio AccessNetwork) Architecture

42

The following references have been used to prepare the

lecture notes.

1. UMTS Protocols and Protocol Testing article

2. Enhanced Data Rates for GSM Evolution EDGE –

Nokia article

3. Introduction to GSM article

4. http://www.radio-

References

4. http://www.radio-

electronics.com/info/cellulartelecomms/gsm_technic

al/

5. GPRS tutorial article

6. GSM Networks: Protocols, terminology, and

Implementation - Gunnar Heine

• EDGE - Siddarth Wandre

43

Summary

• GSM

• GSM Architecture

• GSM Network Structure

• Security in GSM

• GPRS and it’s performance

44

• GPRS and it’s performance

• Introduction to UMTS standard