The document provides information on GSM (Global System for Mobile Communication) including: - GSM was developed to standardize cellular networks in Europe and provide compatibility between systems. - It uses TDMA and FDMA to allow multiple users to access the radio spectrum at the same time. Carriers are divided into time slots and frequency channels. - The key components of GSM are the mobile station (phone), base station subsystem including base transceiver stations and base station controllers, switching subsystem including HLR, VLR and MSC, and operation subsystem for network management.

1. GSM(Global System for Mobile Communication)Prepared by:Reynald Susainathan[Unit-3]

2. Need for developmentEurope had numerous coexisting Analog mobile phone system (1G), often based on similar standards, but ran on slightly different carrier frequency, resulting in:Each system was incompatible with other’s equipment and operation.Hence there was a limited market for equipments of this type.

3. Solution“Group Special Mobile” (GSM) was formed to study and develop a pan-European public land mobile system.

4. Features of the Proposed SystemGood subjective speech qualityLow terminal and service costSupport for international roamingAbility to support handheld terminalsSupport for range of new services and facilitiesSpectral efficiencyISDN compatibility

5. Strategies for GSM developmentGSM developers chose “Digital System”, as opposed to then-standard analog cellular systems like AMPS in US and TACS in UK.They had faith in:Advancement in Compression AlgorithmsDigital Signal ProcessorsSince they would allow fulfillment of the original criteria and continual improvement in QoSGSM recommendations allows:Flexibility &Competitive innovationGSM Specification provides enough standardization to:Guarantee proper internetworking between components of the systemThis is done by providing the following for each Functional Entities defined in the system:Functional Description &Interface Description.

6. GSM VersionsGSM 900Uplink : 890-915 MHzDownlink : 935-960 MHzDCS (Digital Cellular System) 1800Uplink : 1710-1785 MHzDownlink : 1805-1880 MHzPCS (Personal Communication Service) 1900Uplink : 1850-1910 MHzDownlink : 1930-1990 MHz

7. GSM VersionsGSM 400 (To replace analog systems in sparsely populated areas)Uplink : 450.4-457.6 / 478.8-486 MHzDownlink : 460.4-467.6 / 488.8-496 MHzGSM-Rail (For rail-road systems [GSM-R])Offers many additional services not available in public GSM.Offers 19 exclusive channels for railroad operators for voice and data traffic.Special features:Emergency calls with acknowledgementsVoice Group Call Service (VGCS)Voice Broadband Service (VBS)Advanced Speech Call Items (ASCI)

8. GSM-RCalls are prioritized:Calls have very short set-up times:Emergency calls less than 2sGroup calls less than 5sCalls can be directedTo all users at a certain locationTo all users with a certain functionTo all users within number spaceTrains going not faster than 160 km/h can control all gates, switches and signals themselves.GSM-R can be still used to maintain control in trains faster than 160 km/h

9. Mobile ServicesSection - 1

10. 3 Categories of GSM ServiceGSM permits the integration of different voice and data services and the inter-working with existing network, offering 3 types of services:Bearer ServiceTele Service &Supplementary Service

11. Bearer and Tele Service ModelMobile Termination (Performs all network specific tasks like TDMA, FDMA, Coding etc). It offers interface for data transmission.Mobile StationAir InterfaceGSM – Public Land Mobile NetworkBearer Service comprises of all services that enable transparent transmission of data between the interfaces to the network. (ie., ‘S’ in case of MS)Interfaces like U, S, R in ISDN have not been defined for all networks, so it depends on specific network, which interface is used for reference for transparent transmission of data.In classical GSM model, bearer services are connection-oriented and circuit- or packet-switched. These services need only lower 3 layers of ISO/OSI reference model.Tele Service are application specific and need all 7 layers of ISO/OSI model

12. Bearer ServicesOriginal GSM data rates: up to 9600 bit/s for non-voice services. Bearer service permits data transmission, that may beTransparent and Non-Transparent &Synchronous and Non-Synchronous Transparent Bearer Service (TBS):Uses only the function of the physical layer to transmit data.Data transmission has constant delay and throughput if no transmission error occurs.Transmission quality can be improved by use of Forward Error Correction (FEC), which codes redundancy into data stream and helps reconstruct original data if transmission errors occur.Depending on FEC data rates of 2.4, 4.8 or 9.6 kbit/s is possible.TBS do not try to recover lost data in case of shadowing or interruption due to handover.Non-Transparent Bearer Service (NBS):Uses protocol layers 2 & 3 for error correction and flow control.These services use the TBS, adding a RLP (Radio Link Protocol).RLP comprises mechanisms likeHDLC (High-Level Data Link Control) &Special selective-reject mechanism to trigger retransmission of erroneous dataAchieved bit error rate is less than 10-7, but now throughput and delay may vary depending on transmission quality.

13. Advantages of Bearer ServicesUsing TBS and NBS, GSM specifies several bearer services for internetworking with PSTN, ISDN and Packet Switched Public Data Network like X.25, which is available world-wide.Data transmission can beFull-Duplex, Synchronous with data rates of 1.2, 2.4, 4.8 & 9.6 kbit/sFull-Duplex, Asynchronous from 300 to 9600 bit/sRelatively low data rate reflect the assumption that data services will only constitute small percentage of overall traffic.But this is changing, new developments introduce new data services.

14. Tele-ServicesGSM focuses on Voice-Oriented Tele ServicesThese comprise:Encrypted Voice TransmissionMessage Services &Basic Data Communication with terminals as known from PSTN or ISDNMain service is “Telephony”Hence the primary goal of GSM is “Provision of High-Quality Digital Voice Transmission” offering at least typical bandwidth of 3.1 KHz of analog phone systems.Special codes (coder/decoder) are used for voice transmission, while other codes are used for transmission of analog data for communication with traditional computer modems.“Emergency Number”Same number throughout EuropeMandatory service for all providers and its free of costHighest priority, pre-empting other connections &Will automatically be set-up with the closest emergency center.

15. Tele-ServicesShort Message Service (SMS)Offers transmission of message up to 160 characters.SMS do not use standard data channel of GSMUses unused capacity in signaling channels.Sending / Receiving SMS possible during data / voice transmission.Applications usage – Network Operators – Content Providers – Push ServiceEnhanced Message Service (EMS)Successor of SMS.Large message size (760 characters), concatenating several SMSsFormatted Text Transmission of animated pictures, small images & ring tones in standardized wayMultimedia Message Service (MMS)Allows transmission of large pictures (GIF, JPG, WBMP), short video clips &Comes with mobile phones that integrate small camera.

16. Tele-ServicesGroup 3 FaxNon-Voice Tele ServiceFax data transmitted as Digital Data over Analog Telephone Network according to ITU-standards T.4 and T.30 using modems.Transparent Fax Service is used.Fax Data &Fax Signaling is transmitted using TBSLow transmission quality causes an automatic adaptation of bearer service to lower data rates and higher redundancy for better FEC.

17. Supplementary-ServicesSimilar to ISDN networks, it offers enhancement to standard telephony servicesTypical services offered are:User IdentificationCall Redirection or Forwarding of ongoing callsStandard ISDN features are also available:Closed Group Users &Multi-party Communication

18. System architectureSection - 2

19. Subsystems of GSMRadio Subsystem (RSS)Network and Switching Subsystem (NSS) &Operating Subsystem (OSS)

21. Radio Subsystem (RSS)

22. Radio SubsystemComprises radio specific entities like:MS (Mobile Station)BSS (Base Station Subsystem)RSS and NSS are connected via “A Interface” and connected to OSS via “O Interface”.“A Interface” is based on circuit-switched PCM-30 systems (2.048 Mbit/s), carrying up to 30 64 kbit/s connections.“O Interface” uses Signaling system No. 7 (SS7) based on X.25 carrying management data to/from the RSS.

23. Components of RSSBase Station Subsystem (BSS)Base Transceiver Station (BTS)Base Station Controller (BSC)Mobile Station (MS)

24. Base Station SubsystemA GSM Network comprises many BSSs.BSS is controlled by BSCBSS contains several BTSs.Functions of BSS are:Maintaining radio connections to a MS.Coding / Decoding of voice &Rate adaptation to / from the wireless network part.

25. Base Transceiver StationBTS comprises all radio equipments like:AntennasSignal ProcessingAmplifiersA BTS can form a radio cell, or several cells using sectorized antennas.BTS is connected to MS via Um Interface.BTS is connected to BSC via Abis Interface.Um contains all mechanisms necessary for wireless transmission (TDMA, FDMA etc)Abis consists of 16 or 64 kbit/s connections.A GSM cell can measure between some 100m and 35km depending on the environment.

26. Base Station ControllerManages BTSsIts functionality include:Reserves radio frequenciesHandles the handover from one BTS to another within BSSPerforms paging of the MSMultiplexes radio channel onto the fixed network connections at the A interface.

27. Mobile StationMS comprises of below for communication with GSM NetworkUser equipment User independent Hardware & Software Subscriber Identity Module (SIM)Stores user specific data relevant to GSMWithout SIM only emergency call are possibleUser can personalize MS using SIMContains many identifiers and tables such as:Card-typeSerial numberA list of subscribed servicesPersonal Identity Number (PIN)PIN Unblocking Key (PUK)An Authentication Key Ki&International Mobile Subscriber Identity (IMSI)A MS can be identified via the International Mobile Equipment Identity (IMEI), helps in theft protection.

28. Mobile StationMS stores dynamic information while logging onto the GSM System, such as:Cipher Key Kc &Location Information containing:Temporary Mobile Subscriber Identity (TSMI) &Location Area Identification (LAI).Transmit power of MS:GSM 900 : 2WGSM 1800 : 1WOther types of interfaces in MS:DisplayLoudspeaker & MicrophoneProgrammable soft keysComputer ModemsIrDA or Bluetooth

29. Network and Switching Subsystem (NSS)

30. Functionalities of NSSNSS connects the Wireless Network with standard public networks.Performs handover between different BSSs.Comprises function for worldwide localization of usersSupports charging, accounting and roaming of users between different providers in different countries

31. NSS Switches and DatabasesMobile Service Switching Center (MSC)Home Location Register (HLR)Visitor Location Register (VLR)

32. Mobile Service Switching CenterHigh performance digital ISDN Switches.Forms the fixed backbone of a GSM system:Sets up connection to other MSC and to BSC via “A” interface.MSC manages several BSCs in a geographical region.Gateway MSC (GMSC) has additional connections to other fixed networks like PSTN & ISDN.Using Internetworking Functions (IWF), a MSC can connect to a Public Data Network (PDN) like X.25

33. Mobile Service Switching CenterMSC handles all signaling needed for:Connection setupConnection release &Handover of connections to other MSCsThe Standard Signaling System No. 7 (SS7) is used.Aspects of SS7:Reliable routing and delivery of control messagesEstablishing and monitoring of callsFeatures of SS7:Number portability,Free phone/toll/collect/credit calls,Call forwarding,Three-way callingMSC functions for supplementary services:Call Forwarding,Multi-party calls,Reverse charging etc.

34. Home Location Register (HLR)An important database in GSM system.Stores user-relevant information like:Mobile Subscriber ISDN number (MSISDN)Subscribed Services (Eg: call forwarding, roaming restrictions, GPRS) &International Mobile Subscriber Identity (IMSI)Dynamic Information is also needed:Current Location Area (LA) of MSMobile Subscriber Roaming Number (MSRN)Current Visitor Location Register (VLR) &Current MSC

35. Home Location Register (HLR)Functional Aspects:As soon as MS leaves its LA HLR is updatedThis is needed to localize a user within a worldwide GSM Network.Supports charging and accountingHLR can manage data for several millions of customersMaintains highly specialized databases that fulfills real-time requirements to answer requests within time-bound.

36. Visitor Location Register (VLR)VLR is associated with each MSCVLR is a dynamic databaseFunctional aspects of VLR:Stores all important information needed for MS users currently in LA that is associated to the MSCIMSIMSISDNHLR AddressIf a new MS comes into an LA, VLR copies relevant information for this user from HLR.This hierarchy of VLR and HLR avoids frequent HLR updates and long-distant signaling from the user.Typically used for localization like HLR.

37. Operation Subsystem

38. OSSContains necessary functions for:Network Operation &MaintenanceOSS contains Network EntitiesOSS accesses other entities via SS7 signaling

39. OSS EntitiesOperation and Maintenance Centre (OMC)Authentication Center (AuC)Equipment Identity Register (EIR)

40. Operation & Maintenance Centre (OMC)OMC monitors & controls all other Network Entities via “O interface” (SS7 with X.25)OMC uses concepts of TMN (Telecommunication Management Network)OMC’s management functions:Traffic monitoringStatus reports of network entitiesSubscriber Management Accounting and Billing &Security Management

41. Authentication Centre (AuC)Defined to protectUser Identity &Data TransmissionAuC contains algorithms for:AuthenticationKey for encryption &Values needed for user authentication in HLR.AuC is situated in a special protected part of the HLR

42. Equipment Identity Register (EIR)EIR is a Database for all IMEIsStores all device identifications registered for this network.Entries in EIRWhite-listList of valid IMEIsGrey-listList of malfunctioning devices

43. Radio interfaceSection 4.1.3

44. Um InterfaceUm is a Radio InterfaceIt comprises of mechanisms needed for:Multiplexing GSM implements SDMA using cells with BTS and assigns an MS to a BTS.FDD is used to separate downlink and uplink.Media access.Combines TDMA and FDMA.

45. GSM - FDMAGSM 900:124 channels, each 200 KHz wideChannel 1 & Channel 124 are not use for technical reasons.32 channels are reserved for organizational dataRemaining 90 are used for customersGSM 1800:374 channelsEach BTS manages a single channel for organizational data and up to 10 channels for user data.

46. GSM - TDMA

47. GSM - TDMAEach of 248 channels is additionally separated in time via a GSM TDMA Frame.Each 200 KHz carrier is subdivided into frames that are repeated continuously.Duration of a frame is 4.615msA frame is again subdivided into 8 GSM Time SlotsEach slot represents a physical TDM channel and lasts for 577μs.Each TDM channel occupies the 200 KHz carrier for 577μs every 4.615ms.

48. Data TransmissionData is transmitted in small portions called bursts. Normal burst is shown in the previous picture.A Burst is only: 546.5μs long and Contains 148 bitsThe remaining 30.5μs is used as Guard Space.Avoids overlapping with other burst, due to:Different path delays &Give transmitter time to turn on and off.Filling the whole slot with data allows for transmission of 156.25 bit with 577μs.Each physical TDM channel has a raw data rate of about 33.8 kbit/s.Each radio carrier transmits approximately 270 kbit/s over Um interface.

49. Normal Bursttail is set to zero; can be used to enhance receiver performance.Training sequence is used to:Adapt the parameters f the receiver to the current path propagation characteristics &Select the strongest signal in case of Multi-path propagation.S flag indicates whether the data field contains user or network control data.

50. Other types of BurstsFrequency correction burstAllows MS to correct the local oscillator to avoid interference with neighboring channels.Synchronization burstWith an extended training sequence synchronizes MS with BTS in time.Access burstUsed for the initial connection setup between MS and BTSDummy burstUsed if no data is available for a slot.

51. Simple Transmitter HardwareTwo factors allow its use:The slot for uplink and downlink of a physical TDM channel are separated in frequencyGSM 900 – 45 MHzGSM 1800 – 95 MHz uses FDD.TDMA frames are shifted in time for 3 slots:If BTS sends data at time t0 in slot one on the downlink.MS accesses slot one on uplink at time t0+3.577μs.An MS does not need a full-duplex transmitter, a simpler half-duplex transmitter switching between receiving and sending is enough.

52. Slow Frequency HoppingGSM specifies an optimal slow frequency hopping:To avoid frequency selective fadingMS and BTS may change the carrier frequency after each frame based on a common hopping sequence.An MS changes its frequency between up and downlink slots respectively.

53. Logical Channels and Frame Hierarchy

54. [Background Reading]Co-dec:Stands for "compressor / decompressor" and "code/decode".It helps speed up data transfer.Mathematical codecs are built to encode (“shrink”) a signal for transmission and then decode it for viewing or edition.Voice Co-dec:an application of data compression of digital audio signals containing speech. Coding uses voice-specific parameter estimation using audio signal processing techniques to model the speech signal, combined with generic data compression algorithm to represent the resulting modeled parameters in a compact bitstream

55. Two groups of logical channelsTraffic channels &Control channels

56. Traffic Channel (TCH)GSM uses TCH to transmit user data (Voice, fax, etc… )Two basic categories of TCH:Full-Rate TCH (TCH/F)Data Rate : 22.8 kbit/sHalf-Rate TCH(TCH/H)Data Rate : 11.4 kbit/sWith voice codecs available at beginning of GSM standardization, 13 kbit/s was required, remaining capacity of TCH/F is used for error-correction (TCH/FS)Improved codecs allow for better voice coding and can use TCH/H.Using TCH/HS doubles the capacity of the GSM system for voice transmission.However, speech quality reduces with use of TCH/HSMany providers are trying to avoid them.

57. Traffic Channel (TCH)Standard codecs for voice are called:Full Rate (FR) : 13 kbit/sHalf Rate (HR) : 5.6 kbit/sEnhanced Full Rate (EFR) : 12.2 kbit/sProvides better quality than FR as long as transmission error rate is low.Adaptive Multi-Rate (AMR)New codesAutomatically chooses best mode of operation depending on the error rate, will be used together with 3G systems.Tandem-Free Operation (TFO):An additional increase in voice quality is providedThis mode can be used if two MSs are exchanging voice data:In this case, coding to and from PCM encoded voice can be skipped &GSM encoded voice data is directly exchanged.

58. Traffic Channel (TCH)Data transmission in GSM is possible at different rates:TCH/F4.8 for 4.8 kbit/sTCH/F9.6 for 9.6 kbit/sTCH/F14.4 for 14.4 kbit/sThese logical channels differ in terms of their:Coding schemes and Error correction capabilities.

59. Control Channel (CCH)Many different CCHs are used in a GSM system to control:Medium AccessAllocation of traffic channels orMobility Management

60. 3 Groups of CCHBroadcast Control Channel (BCCH)Common Control Channel (CCCH)Dedicated Control Channel (DCCH)

61. Broadcast Control Channel (BCCH)BTS uses this channel to signal information to all MSs within a cell.Information transmitted in the channel is:The Cell identifierOptions available within this cell and in neighboring cells &Frequencies available within this cell and in neighboring cellsSub-channels of BCCH:Frequency Correction Channel (FCCH): BTS sends information for frequency correction via this channel.Synchronization Channel (SCH): BTS sends information about time synchronization via this channel.

62. CommonControl Channel (CCCH)All information regarding the connection setup between MS and BS is exchanged via CCCH.Sub-channels:Paging Channel (PCH): BTS uses this channel for calls towards an MS.Random Access Channel (RACH): If an MS wants to set up a call, it uses RACH to send data to BTS.RACH implements multiple access using slotted ALOHA.All MSs within a cell may access this channel.Access Grant Channel (AGCH):BTS uses it to signal an MS that it can use a TCH or SDCCH for further connection setup.

63. DedicatedControl Channel (DCCH)Previous channels are unidirectional; DCCH is bidirectional.Sub-channels of DCCH:Stand-alone Dedicated Control Channel (SDCCH):As long as an MS has not established a TCH with BTS, it uses SDCCH with a low data rate of 782 bit/s for signaling.This can comprise authentication, registration or other data needed for setting up a TCH.Slow Associated Dedicated Control Channel (SADCCH):Each TCH and SDCCH has a SADCCH associated with it for exchanging system information, such as Channel Quality &Signal Power LevelFast Associated Dedicated Control Channel (FADCCH):If more signaling information needs to be transmitted and a TCH already exists, GSM uses FADCCH.FADCHH uses Time Slots which are otherwise used by the TCH:This is necessary in case of handovers where BTS and MS have to exchange large amount of data in less time.

64. Accessing Time SlotsChannels cannot use time slots arbitrarily:GSM specifies multiplexing schemes that integrate several hierarchies of frames.If a simple TCH/F is used for Data Transmission:Each TCH/F will have an associated SACCH.If fast signaling is required, the FACCH uses the time slots for the TCH/F.Typical usage pattern of a physical channel for data transmission looks like this:With T indicating the User Traffic in the TCH/F and S indicating the signaling traffic in SACCHTTTTTTTTTTTTSTTTTTTTTTTTTxTTTTTTTTTTTTSTTTTTTTTTTTTx12 slots of user data followed by a signalling slot, again 12 slots with user data follow, then an unused slot.This pattern of 26 slots is repeated over and over again.Only 24 out of 26 physical slots are used for TCH/F.As each normal burst for data transmission carries 114 bit user data and is repeated every 4.615ms.This results in data rate of 24.7 kbit/s.As TCH/F uses only 24/26 slots, final data rate is 22.8 kbit/s as specified.SACCH thus has capacity of 950 bit/s.

65. Traffic Multi-frameThe periodic pattern of 26 slots occurs in all TDMA frames with a TCH. The combination of these frames is called Traffic Multi-Frame.

66. GSM structuring of time using a frame hierarchy

67. ProtocolsSection - 4

68. Protocol Architecture for SignallingBSS ApplicationCall ManagementMobility ManagementBTS ManagementRadio Resource ManagementLink Access Procedure for D-Channel (Light-weight)Signalling System No. 7Pulse Code Modulation

69. Layer-1 Physical LayerHandles all radio-specific functions:Creation of bursts according to the five different formats,Multiplexing of bursts into a TDMA Frame,Synchronization with BTS,Detection of Idle channels &Measurement of Channel Quality on the downlink.Physical layer at Um interface:Uses GMSK for digital modulation &Performs encryption / decryption of dataEncryption is not performed end-to-end but only between MS and BSS over the Air Interface (Um)

70. Layer-1 Physical LayerSynchronization includes:Correction of individual path delay between an MS and BTS.As all MSs within a cell use the same BTS and thus needs to be synchronized to this BTS.BTS generates time structure of frames, slots, etc.Here, the problematic aspect are different round-trip times (RTT)Adjusting Access Time for Synchronization for long distant MS.Maximum distance between MS and BSS is 35 km:MS 35 km away has RTT of around 0.23msIf this MS used the slot structure without correction, large guard spaces would be required, as 0.23 ms, As already 0.23 ms is 40% of 0.577ms available for each slot.Hence, BTS sends the current RTT to MS, which then adjusts its access time to that all burst reach BTS within time limits.This mechanism reduces guard space to 30.5μs / 5%.Adjusting the access is controlled via:The variable Timing Advance, where a burst can be shifted up 63 bit earlier time, with each bit having a duration of 3.69 μs As the variable timing advance cannot be extended a burst cannot be shifted earlier than 63 bit timesThis results in 35 km maximum distance between an MS and a BTS.It might be possible to receive the signal over long distance;To avoid collision at the BTS, the access cannot be allowed!!.

71. Layer-1 Physical LayerImportant tasks of Physical Layer:Channel Coding Makes use of FECDifferent logical channels of GSM use different coding schemes with different correction capabilities.Speech channel needs additional coding of voice data after analog to digital conversion, to achieve data rate of 22.8 kbit/sError Detection / Correction.GSM Physical layer does it. It does not deliver erroneous data to the higher layers.Voice service is main to GSM, the physical layer contain special functions like:Voice Activity Detection (VAD)Transmits voice data only when there is a voice signal.This helps to decrease interference as a channel might be silent approximately 60% of the timeDuring periods of silence the physical layer generates a Comfort Noise to fake a connection, but no actual transmission takes place.The noise is even adapted to the current background noise at the communication partner’s location.

72. Layer-1 Physical LayerDelay Handling:Interleaving of data for a channel to minimize interference due to burst errors and the recurrence pattern of a logical channel generates a delay for transmission.Delay is about:TCH/FS – 60msTCH/F9 – 100msThese times have to be added to transmission delay if communicating with an MS instead of a standard fixed station.This influences the performance of the higher layer protocols.

73. Layer 2: LAPDmSignalling between entities in GSM Network requires higher layers.For this purpose LAPDm protocol has been defined at the Um interface for Layer-2.LAPDmis derived from LAPD in ISDN systems, which is a version of HDLC.LAPDm is lightweight LAPD because it does not need synchronization flags or check-summing for error detection (Since GSM Physical layer does).LAPDm offers:Reliable data transfer over connections,Re-sequencing of data frames &Flow control.There is no buffering between layer 1 & 2, LAPDm obeys the frame structures, recurrence patterns etc… defined for Um interface.Further services provided by LAPDm:Segmentation & Re-assembly of data.Acknowledged / Unacknowledged data transfer.

74. Layer 3: Network LayerComprises several sub-layers:Radio Resource Management (RR)Mobility Management (MM)Radio Resource Management (RR):Lowest sub-layerOnly a part of this layer RR’, is implemented in BTS, remainder is situated in BSC.The functions of RR’ are supported by BSC via the BTS Management (BTSM)Main task of RR include:Setup,Maintenance &Release of radio channels.RR also directly accesses the physical layer for radio information and offers a reliable connection to the next higher layers.

75. Layer 3: Network LayerMobility Management (MM):Contains functions for:Registration,Authentication,Identification,Location updating &Provision of a TMSI (Temporary Mobile Subscriber Identity)Replaces IMSI (International Mobile Subscriber Identity) &Hides the real identity of an MS user over an air interface.While IMSI identifies a user, the TMSI is valid only in the current location area of a VLR.MM offers reliable connection to the next higher layer

76. Layer 4: Call Management LayerContains three entities:Call Control (CC)Provides point-to-point connection between two terminals and is used by higher layers for:Call establishmentCall Clearing &Change of call parameters.Short Message Service (SMS) Allows message transfer using:SDCCH &SADCCH (if no signalling data is sent)Supplementary Service (SS)DTMF (Dual Tone Multiple Frequency)Provides functions to send in-band tones over GSM Network.These tones are used for:Remote control of answering machines orThe entry of PINs in electronic banking &Also used for dialing traditional analog telephones systems.These tones can be directly send over the voice codec of a GSM MS, as the codec would distort tones.They are transferred as signals and then converted into tones in the fixed network part of the GSM system.

77. Additional Protocols usedAdditional protocols are used at Abis and A interfaces.Data transmission at physical layer uses PCM (Pulse Code Modulation) system.PCM systems offer transparent 64 kbit/s channels, GSM also allows for sub-multiplexing of four 16kbit/s channel into a single 64 kbit/s channel.Signalling System (SS7):Used for signalling between an MSC and BSC.Transfers management information between:MSCs,HLR,VLRs,AuC,EIR &OMCMSC can also control BSS via a BSS Application (BSSAP).

78. Localization & CALLINGSection - 5

79. RoamingAs soon as the MS moves the range of new VLR, the HLR sends all the user data needed to the new VLR.Changing VLRs with uninterrupted availability of all services is call Roaming.

80. Locating & Addressing a MSWe need several numbers like:MSISDNMobile Station International ISDN NumberIMSIInternational Mobile Subscriber IdentityTMSITemporary Mobile Subscriber IdentityMSRNMobile Station Roaming Number

81. MSISDNThe only important number for a GSM user is the phone number.This is associated with SIM, personalized for a user.MSISDN follows the ITU-T standard E.164 for addresses as it is also used in fixed ISDN Networks.This number consists of:Country Code (CC)National Destination Code (NDC) &Subscriber Number (SN)

82. IMSIGSM uses IMSI for internal unique identification of a subscriber.ISMI consists of:Mobile Country Code (MCC)Mobile Network Code (MNC)Mobile Subscriber Identification Number (MSIN)

83. TMSITo hide IMSI, which would give away the exact identity of the user signalling over the air interface.GSM uses 4 byte TMSI for local subscriber identity.TMSI is selected by the current VLR and is only valid temporarily and within the location area of a VLR.Additionally VLR may change TMSI periodically.

84. Mobile Station Roaming NumberTemporary Address that hides the identity and location of the subscriber.VLR generates this address on request from MSC, and the address is also stored in HLR.MSRN maintains:Current VCC (Visitor Country Code),VNDC (Visitor National Destination Code)The identification of the current MSC together with the subscriber number.MSRN helps the HLR to find a subscriber for an incoming call.

85. Mobile Terminated Call (MTC)

86. MTC

88. Mobile Originated Call

90. MOC

92. Messages exchanged between MS and BTS

93. HandoverSection-6

94. GSM HandoverAims at a maximum handover duration of 60ms.

95. Reasons for HandoverMobile station moves out of range of a BTS:Received signal level decreases continuously and falls below the minimum requirement for communication:Error rate may grow due to interferenceDiminishing quality of the radio linkLoad BalancingWired infrastructure (MSC, BSC) decides that the traffic in one cell is too high and shifts some MS to other cell with lower load.

96. 4 Possible Handover Scenarios in GSMIntra-cell Handover:Within a cell, Narrow-Band interference could make transmission at certain frequency impossible.BSC decides to change the carrier frequency.Inter-cell, intra-BSC Handover:MS moves from one cell to anotherBut stays in the control of same BSCBSC performs a handover, assigns a new radio channelInter-BSC, intra-MSC Handover:A BSC controls limited number of cellsGSM performs handover between cells controlled by different BSC.This is controlled by MSCInter-MSC Handover:Handover between two cells belonging to different MSCs.Both MSCs performs handover together.

97. Types of Handover in GSM

98. Handover DecisionPeriodic measurement of the downlink and uplink quality respectively:Done by MS and BTS, to provide necessary information for a handover due to a weak link.Link Quality comprises:Signal Level &Bit Error RateMeasurement reports are sent by MS about every half-second; containing:The quality of the current link for transmission; The quality of certain channels in the neighboring cells.

99. Handover Decision depending on Receive LevelHere, handover decision depends on the actual value of the received signal level, but on the average value.BSC collects all values from BTS and MS, calculates the average.This value is compared to the threshold (HO_MARIGIN) which includes some hysteresis to control ping-pong effect, it may even occur sometimes.

100. Intra-MSC Handover

101. securitySection-7

102. Confidential Information StorageConfidential Information is stored in:AuC &Individual SIM, which stores:Personal secret data – this is protected with PIN against unauthorized use.

103. GSM Security ServiceAccess Control and AuthenticationStep 1:Authentication for valid user of a SIMUser needs secret PIN to use SIMStep 2:Subscriber AuthenticationBased on Challenge-response schemeConfidentialityAll user related data is encrypted.After authentication, BTS and MS applies encryption to voice, data and signalling.This confidentiality exists between BTS and MS, not end-to-endAnonymityAll data is encrypted before transmission &User Identifiers are not used over airInstead GSM transmits a temporary identifier (TMSI), which is newly assigned by the VLR after each location update.Additionally VLR can change TMSI periodically.

104. GSM Security AlgorithmsAuthentication – Algorithm A3Encryption – Algorithm A5Generation of Cipher Keys – Algorithm A8Only A5 is publically available; A3 and A8 are secret but standardized with

105. AuthenticationAuthentication is based on SIM, which stores:Authentication Key ki,User Identification IMSI &A3 AlgorithmUses Challenge-Response Method:AC sends RAND to SIM; and SIM replies with SRES.For each IMSI, AuC does:Generation of RANDSigned Response SRES &Cipher Key Kc.AuC sends the above to HLRCurrent VLR requests the appropriate value for RAND, SRES & Kc from HLR.For Auth, VLR sends RAND to SIM.Both Network and Subscriber module performs with Key Ki using A3.VLR compares both values; accepts if both are equal.

106. EncryptionUser-related information are encrypted over the air interface.After auth, MS and BSS starts encryption by cipher key Kc.Kc is generated using individual key Ki and random value by applying A8.Note, SIM and Network both calculate the same Kc on RAND.Kc is not transmitted over Air Interface.MS and BTS can encrypt and decrypt using A5 and Kc.

107. New Data ServiceSection-8

108. ApproachesHSCSD:High Speed Circuit Switched DataAs GSM is based on connection-oriented traffic channel, with 9.6 kbit/s, several such channels could be combined to increase bandwidth.This is called HSCSD.GPRS:Introduction of Packet-Oriented traffic in GSM.Shifts the thinking from Connections / Telephone to Packets / Internet

109. Referenceshttp://www.shoshin.uwaterloo.ca/~jscouria/GSM/gsmreport.htmlJochen Schiller, “Mobile Communications” 2nd Edition