MC Unit 2 Lecture Slides

UNIT II
MOBILE TELECOMMUNICATION SYSTEM
By
N.Gopinath
AP/CSE
2.1 Introduction to Cellular Systems
 Cellular systems implements Space Division
Multiplexing Technique (SDM).
 Each transmitter is called a base station and can
cover a fixed area called a cell.
 This area can vary from few meters to few
kilometres
 The shape of cells are never perfect circles or
hexagons, but depend on the environment (buildings,
mountains, valleys etc.), on weather conditions, and
sometimes even on system load..
 Typical systems using this approach are mobile
telecommunication systems
CS8601 MC - N.Gopinath AP/CSE 2

Mobile network providers install several thousands of base stations each with a
smaller cell instead of using power full transmitters with large cells because,
when the cell size is small we can have the following advantages:
1. Higher capacity
Smaller the size of the cell more the number of concurrent users i.e. huge cells
do not allow for more concurrent users.
2. Less transmission power
Huge cells require a greater transmission power than small cells.
3. Local interference only
For huge cells there are a number of interfering signals, while for small cells there
is limited interference only.
4. Robustness
As cellular systems are decentralized, they are more robust against the failure of
single components.

Disadvantages of Cellular Systems
Some of the disadvantages of cellular systems are:
1. Infrastructure needed
Small cells require a complex infrastructure to connect
all base station. The infrastructure required includes
switches for call forwarding, location registers etc.
2. Handover needed
The mobile station has to perform a handover when
changing from one cell to another very frequently.
3. Frequency planning
To avoid interference, frequency spectrum should be
distributed properly with a very less range of frequency
spectrum.

Frequency Planning:
❖The general goal is never to use the same
frequency at the same time within the
interference range
❖Two possible models to create cell patterns
with minimal interference are shown

 Cells are combined in clusters – on the left
side three cells form a cluster, on the right
side seven cells form a cluster. All cells within
a cluster use disjointed sets of frequencies.
 The hexagonal pattern is chosen as a simple
way of illustrating the model.
 This pattern also shows the repetition of the
same frequency sets.
 The transmission power of a sender has to
be limited to avoid interference with the
next cell using the same frequencies.

 To reduce interference even further
sectorized antennas can be used.
 The figure shows the use of three sectors
per cell in a cluster with three cells.

 The fixed assignment of frequencies to cell
clusters and cells respectively, is not very
efficient if traffic load varies.
 For instance, in the case of a heavy load in
one cell and a light load in a neighbouring
cell, it could make sense to ‘borrow’
frequencies.
 Cells with more traffic are dynamically
allotted more frequencies. This scheme is
known as Borrowing Channel Allocation
(BCA)

 A dynamic channel allocation (DCA)
scheme has been implemented in Digital
Enhanced Cordless Telecommunication
(DECT)
 In this scheme, frequencies can only be
borrowed, but it is also possible to freely
assign frequencies to cells.
 With dynamic assignment of frequencies to
cells, the danger of interference with cells
using the same frequency exists.
 The ‘borrowed’ frequency can be blocked in
the surrounding cells.

2.2 GSM (Global System for Mobile
Communications)
 GSM is the most successful digital mobile
telecommunication system in the world today.
 It is used by over 800 million people in more than
190 countries.
 The Groupe Spéciale Mobile (GSM) was
founded in 1982.
 This system was soon named the Global System
for Mobile communications (GSM)
 The primary goal of GSM was to provide a mobile
phone system that allows users to roam throughout
Europe and provides voice services compatible to
ISDN and other PSTN systems.
 GSM is a typical second generation system, replacing the
first generation Analog systems, but not offering the high
worldwide data rates that the third generation systems,
such as UMTS, are promising.
 GSM has initially been deployed in Europe using 890–915
MHz for uplinks and 935–960 MHz for downlinks
 This system is now also called GSM 900 to distinguish it
from the later versions.
 These versions comprise GSM at 1800 MHz (1710–1785
MHz uplink, 1805–1880 MHz downlink), also called DCS
(digital cellular system) 1800
 The GSM system mainly used in the US at 1900 MHz
(1850–1910 MHz uplink, 1930–1990 MHz downlink), also
called PCS (personal communications service) 1900

 A GSM system that has been introduced in several
European countries for railroad systems is GSM-
Rail (GSM-R, 2002), (ETSI, 2002).
 This system does not only use separate frequencies
but offers many additional services which are
unavailable using the public GSM system.
 GSM-R offers 19 exclusive channels for railroad
operators for voice and data traffic. Special features
of this system are, e.g., emergency calls with
acknowledgements, voice group call service (VGCS),
voice broadcast service (VBS).
 The most sophisticated use of GSM-R is the control
of trains, switches, gates, and signals.

2.3 GSM Services and Architecture:
GSM has defined three different categories of
services:
❖Bearer services,
❖Tele- services,
❖Supplementary services.

 A mobile station MS is connected to the GSM public land
mobile network (PLMN) via the Um interface.
 This network is connected to transit networks, e.g.,
integrated services digital network (ISDN) or traditional
public switched telephone network (PSTN).
 There might be an additional network, the source/destination
network, before another terminal TE is connected.
 Interfaces like U, S, and R in case of ISDN have not been
defined for all networks, so it depends on the specific network
which interface is used as a reference for the transparent
transmission of data.
 The mobile termination (MT) performs all network specific
tasks (TDMA, FDMA, coding etc.)
Bearer Service:
 It gives the subscribers the capability to send and receive data from remote
computers or mobile phones in both the directions.
 It is also called as Data services.
 For non-voice services GSM allowed data rates from 300 bits/s to 9600 bit/s.
 These services only need the lower three layers of the ISO/OSI reference
model.
 Bearer services allow for both transparent and non-transparent data
transmissions.
 Transparent bearer services use only the functions of the physical layer
(layer 1 ISO/OSI reference model) to transmit data; data transmission
consequently has a constant delay and throughput, that is if no errors occur.
The only mechanism of any use to try and increase the quality of the
transmission is forward error correction (FEC).
 Non-Transparent bearer services use protocols of the layers two and
three to implement error correction and flow control. Non-transparent
bearer services use the transparent bearer services, while adding a radio link
protocol (RLP). This protocol uses mechanisms of high-level data link control
(HDLC) (Halsall, 1996), and special selective-reject mechanisms to trigger
retransmission of erroneous data.

Tele – Services:
• GSM provides both voice and non-voice oriented tele
services.
• The main service is telephony, the primary goal of GSM
was to provide high-quality digital voice transmission,
offering at least the typical audio bandwidth of 3.1 kHz.
Special codecs (coder/decoder) are used for voice
transmission.
• Another tele services is the emergency number and this
is the same number all over the GSM network in Europe
and is also the same as the national emergency number.
This is a mandatory service that all the network operators
have to provide and is free of charge to the user.
• A useful additional service that is offered is the short
message service (SMS), which is a simple text message
transfer service, offering transmission of messages up to
about 160 characters.

Supplementary Services:
 Further to bearer and tele services, GSM
network operators can also offer supplementary
services. These services offer enhancements to
the standard telephony service and may differ
from operator to operator, though typical
services available to the user are caller location
identifier (CLI), call forwarding, or redirection.

GSM Architecture:
 GSM comes with a
hierarchical, complex
system architecture
comprising many
entities, interfaces, and
acronyms.
 A GSM system consists
of three subsystems, the
radio sub system
(RSS), the network
and switching
subsystem (NSS), and
the operation
subsystem (OSS).
1. Radio Subsystem (RSS): comprises all radio specific entities, i.e., the
mobile stations (MS) and the base station subsystem (BSS). The
figure shows the connection between the RSS and the NSS via the A
interface (solid lines) and the connection to the OSS via the O interface
(dashed lines).
❖ Base station subsystem (BSS): A GSM network comprises many BSSs,
each controlled by a base station controller (BSC). The BSS performs all
functions necessary to maintain radio connections to an MS,
coding/decoding of voice, and rate adaptation to/from the wireless
network part. Besides a BSC, the BSS contains several BTSs.
❖ Base station controllers (BSC): The BSC provides all the control
functions and physical links between the MSC and BTS. It is a high capacity
switch that provides functions such as handover, cell configuration data,
and control of radio frequency (RF) power levels in BTS.
❖ Base transceiver station (BTS): The BTS handles the radio interface
to the mobile station. A BTS can form a radio cell or, using sectorized
antennas, several and is connected to MS via the Um interface, and to
the BSC via the Abis interface. A group of BTS’s are controlled by an
BSC.

2. Network Switching Subsystem: The NSS is responsible for performing
call processing and subscriber related functions. The switching system
includes the following functional units:
❖ Home location register (HLR): It is a database used for storage and
management of subscriptions. HLR stores permanent data about
subscribers, including a subscribers service profile, location information
and activity status.
❖ Visitor location register (VLR): It is a database that contains
temporary information about subscribers that is needed by the MSC in
order to service visiting subscribers. VLR is always integrated with the
MSC.
 Authentication center (AUC): A unit called the AUC provides
authentication and encryption parameters that verify the users identity and
ensure the confidentiality of each call.
 Equipment identity register (EIR): It is a database that contains
information about the identity of mobile equipment that prevents calls
from stolen, unauthorized or defective mobile stations.
 Mobile switching center (MSC): The MSC performs the telephony
switching functions of the system. It controls calls to and from other
telephone and data systems.

3. Operation and Support system:
• The operations and maintenance center (OMC) is connected to all
equipment in the switching system and to the BSC. Implementation of
OMC is called operation and support system (OSS).
• The purpose of OSS is to offer the customer cost-effective support for
centralized, regional and local operational and maintenance activities that
are required for a GSM network.
• The mobile station (MS) consists of the mobile equipment (the terminal)
and a smart card called the Subscriber Identity Module (SIM). The
SIM provides personal mobility, so that the user can have access to
subscribed services irrespective of a specific terminal. By inserting the SIM
card into another GSM terminal, the user is able to receive calls at that
terminal, make calls from that terminal, and receive other subscribed
services.
• The mobile equipment is uniquely identified by the International Mobile
Equipment Identity (IMEI). The SIM card contains the International
Mobile Subscriber Identity (IMSI) used to identify the subscriber to
the system, a secret key for authentication, and other information. The IMEI
and the IMSI are independent, thereby allowing personal mobility. The SIM
card may be protected against unauthorized use by a password or personal
identity number.

2.4 GSM Protocols:
 GSM architecture is a
layered model designed
for allowing
communications between
two different systems.
 Lower layers will assure
services of the upper-
layer protocols.
 Each layer will pass
appropriate notifications
to make sure that the
transmitted data is
formatted, transmitted
and received accurately.

MS Protocols
 Based on the interface, GSM signalling protocol will be assembled into
three general layers:
 Layer 1 : Physical layer. It makes use of the channel structures over the
air interface.
 Layer 2 : Data-link layer. Across the Um interface, data-link layer is a
tailored version of Link access protocol for D channel (LAP-D)
protocol used in ISDN, called Link access protocol on the Dm channel
(LAP-Dm). Across the A interface, the Message Transfer Part (MTP),
Layer 2 of SS7 is used.
 Layer 3 : GSM signalling protocol’s third layer can be divided into three
sub layers:
❖ Radio Resource Management (RR),
❖ Mobility Management (MM), and
❖ Connection Management (CM).

MS to BTS Protocols
 The RR layer is the lower layer that manages a link, both radio and
fixed, between the MS and the MSC. For this formation, the main
components involved are the MS, BSS, and MSC. The responsibility of
the RR layer is to manage the RR-session, the time when a mobile is in
a dedicated mode, and the radio channels including the allocation of
dedicated channels.
 The MM layer is stacked above the RR layer. It handles the functions
that arise from the mobility of the subscriber, as well as the
authentication and security aspects. Location management is
concerned with the procedures that enable the system to know the
current location of a powered-on MS so that incoming call routing can
be completed.
 The CM layer is the topmost layer of the GSM protocol stack. This
layer is responsible for Call Control, Supplementary Service
Management, and Short Message Service Management. Each of these
services are treated as individual layer within the CM layer. Other
functions of the CC sublayer include call establishment, selection of
the type of service (including alternating between services during a
call), and call release.

BSC Protocols
 The BSC uses a different set of protocols after receiving the data from
the BTS. The Abis interface is used between the BTS and BSC. At this
level, the radio resources at the lower portion of Layer 3 are changed
from the RR to the Base Transceiver Station Management (BTSM). The
BTS management layer is a relay function at the BTS to the BSC.
 The RR protocols are responsible for the allocation and reallocation
of traffic channels between the MS and the BTS. These services include
controlling the initial access to the system, paging for MT calls, the
handover of calls between cell sites, power control, and call
termination. The BSC still has some radio resource management in
place for the frequency coordination, frequency allocation, and the
management of the overall network layer for the Layer 2 interfaces.
 To transit from the BSC to the MSC, the BSS mobile application part
or the direct application part is used, and SS7 protocols is applied by
the relay, so that the MTP 1-3 can be used as the prime architecture.

MSC Protocols
 At the MSC, starting from the BSC, the information is mapped across
the A interface to the MTP Layers 1 through 3. Here, Base Station
System Management Application Part (BSS MAP) is said to be the
equivalent set of radio resources. The relay process is finished by the
layers that are stacked on top of Layer 3 protocols, they are BSS
MAP/DTAP, MM, and CM. This completes the relay process. To find and
connect to the users across the network, MSCs interact using the
control-signalling network. Location registers are included in the MSC
databases to assist in the role of determining how and whether
connections are to be made to roaming users.
 Each GSM MS user is given a HLR that in turn comprises of the user’s
location and subscribed services. VLR is a separate register that is used
to track the location of a user. When the users move out of the HLR
covered area, the VLR is notified by the MS to find the location of the
user. The VLR in turn, with the help of the control network, signals the
HLR of the MS’s new location. With the help of location information
contained in the user’s HLR, the MT calls can be routed to the user.

2.5 GSM Connection Establishment
Localization and Calling:
 The fundamental feature of the GSM system is the
automatic, worldwide localization of users for which, the
system performs periodic location updates.
 The HLR always contains information about the current
location and the VLR currently responsible for the MS
informs the HLR about the location changes.
 Changing VLRs with uninterrupted availability is called
roaming. Roaming can take place within a network of one
provider, between two providers in a country and also
between different providers in different countries.

 To locate and address an MS, several numbers are needed:
Mobile station international ISDN number
(MSISDN):- This number consists of the country
code (CC), the national destination code (NDC) and the
subscriber number (SN).
International mobile subscriber identity (IMSI): IMSI
consists of a mobile country code (MCC), the mobile
network code (MNC), and finally the mobile subscriber
identification number (MSIN).
Temporary mobile subscriber identity (TMSI): GSM
uses the 4 byte TMSI for local subscriber identification.
Mobile station roaming number (MSRN): MSRN
contains the current visitor country code (VCC), the
visitor national destination code (VNDC), the
identification of the current MSC together with the
subscriber number. The MSRN helps the HLR to find a
subscriber for an incoming call.
Mobile Terminated Call (MTC):

Mobile Originated Call (MOC):

Handover
 Cellular systems require handover procedures, as
single cells do not cover the whole service area.
 The smaller the cell size and the faster the movement
of a mobile station through the cells
 The more handovers of ongoing calls are required.
 A handover should not cause a cut-off, also called call
drop.
 GSM aims at maximum handover duration of 60ms.
 2 Basic Reasons for a Handover
1. The mobile station moves out of the range of a BTS
of a certain antenna of a BTS respectively.
2. The received signal level decreases continuously
until it alls below the minimal requirements or
communication.
Types of Handover in GSM 4 Possible Handover Scenarios in GSM
1. Intra-Cell Handover
Narrow band interference could make transmission at a certain
frequency impossible. The BSC could then decide to change the
carrier frequency.
2. Inter-Cell Intra BSC Handover
The mobile station moves from one cell to another, but stays within
the control of the same BSC. The BSC then performs a handover,
assigns a new radio channel in the new cell and releases the old
one .
3. Inter BSC Intra-MSC Handover
BSC controls a limited number of cells; GSM also has to perform
handovers between cells controlled by different BSCs. o This
handover then has to be controlled by the MSC.
4. Inter MSC Handover
A handover could be required between two cells belonging to
different MSCs. Now both MSCs perform the handover together.

2.6 Frequency Allocation
 The most interesting
interface in a GSM system
is Um, the radio interface,
as it comprises various
multiplexing and media
access mechanisms.
 GSM implements SDMA
using cells with BTS and
assigns an MS to a BTS.

 Each of the 248 channels is additionally separated in
time via a GSM TDMA frame, i.e., each 200 kHz
carrier is subdivided into frames that are repeated
continuously.
 The duration of a frame is 4.615 ms. A frame is again
subdivided into 8 GSM time slots, where each slot
represents a physical TDM channel and lasts for 577 μs.
 Each TDM channel occupies the 200 kHz carrier for
577 μs every 4.615 ms.
 Data is transmitted in small portions, called bursts.
 The burst is only 546.5 μs long and contains 148 bits.
 The remaining 30.5 μs are used as guard space to
avoid overlapping with other bursts due to different
path delays and to give the transmitter time to turn on
and off.

 The first and last three bits of a normal burst (tail) are all set
to 0 and can be used to enhance the receiver performance.
 The training sequence in the middle of a slot is used to
adapt the parameters of the receiver to the current path
propagation characteristics and to select the strongest signal
in case of multi-path propagation.
 A flag S indicates whether the data field contains user or
network control data.
 Apart from the normal burst 4 other different types of bursts
are also available:
1. Frequency correction – used to avoid interference
2. Synchronization burst – used to synchronize MS with BTS
in time.
3. Access burst – used to setup initial connection between MS
and BTS
4. Dummy burst – used if no data is available.

Logical channels and frame hierarchy
Two types of channels, namely physical channels

and logical channels are present.
Physical channel: channel defined by specifying
both, a carrier frequency and a TDMA timeslot
number.
Logic channel: logical channels are multiplexed
into the physical channels. Each logic channel
performs a specific task. Consequently the data
of a logical channel is transmitted in the
corresponding timeslots of the physical channel.
 There are two different
types of logical channel
within the GSM system:
1.Traffic channels (TCHs),
2. Control channels
(CCHs).

Traffic Channels: Traffic channels carry user
information such as encoded speech or user
data. Traffic channels are defined by using a 26-frame
multiframe.Two general forms are defined:
 Full rate traffic channels (TCH/F), at a gross bit rate
of 22.8 kbps (456bits / 20ms)
 Half rate traffic channels (TCH/H), at a gross bit
rate of 11.4 kbps.
Control Channels: Control channels carry system
signaling and synchronization data for control
procedures such as location registration, mobile
station synchronization, paging, random access etc.
between base station and mobile station.
 Three categories of control channel are defined:
Broadcast, Common and Dedicated.
 Broadcast control channel (BCCH):
A BTS uses this channel to signal
information to all MSs within a cell. The
BTS sends information for frequency
correction via the frequency
correction channel (FCCH) and
information about time synchronization
via the synchronization channel
(SCH), where both channels are sub
channels of the BCCH.

 Common control channel (CCCH):
All information regarding connection
setup between MS and BS is exchanged
via the CCCH. For calls toward an MS,
the BTS uses the paging channel
(PCH) for paging the appropriate MS. If
an MS wants to set up a call, it uses the
random access channel (RACH) to
send data to the BTS. The BTS uses the
access grant channel (AGCH) to
signal an MS that it can use a TCH or
SDCCH for further connection setup.

 Dedicated control channel (DCCH): While
the previous channels have all been
unidirectional, the following channels are
bidirectional. , it uses the stand-alone
dedicated control channel (SDCCH)
with a low data rate (782 bit/s) for signalling.
Each TCH and SDCCH has a slow associated
dedicated control channel (SACCH)
associated with it, which is used to exchange
system information, such as the channel quality
and signal power level. Finally, if more signaling
information needs to be transmitted and a TCH
already exists, GSM uses a fast associated
dedicated control channel (FACCH). The
FACCH uses the time slots which are
otherwise used by the TCH.
Frame Hierarchies
 TDMA frames are grouped into two types of multi
frames:
1. 26-frame multi frame (4.615ms x 26 = 120 ms)
comprising of 26 TDMA frames. This multi frame is
used to carry traffic channels and their associated
control channels.
2. 51-frame multi frame (4.615ms x 51 235.4 ms)
comprising 51 TDMA frames. This multi frame is
exclusively used for control channels.
 The multi frame structure is further multiplexed into
a single super frame of duration of 6.12sec. This
means a super frame consists of
1. 51 multi frames of 26 frames.
2. 26 multi frames of 51 frames.
 The last multiplexing level of the frame hierarchy,
consisting of 2048 super frames (2715648 TDMA
frames), is a hyper frame. This long time period is
needed to support the GSM data encryption
mechanisms.The frame hierarchy is shown below:

2.7 GSM – Routing:
2.7.1 Mobile-originated Sequence:
The steps to establishing a GSM voice call are
illustrated below.
 To initiate a call, the MS sends a request for
radio resource allocation to the BSS, which
mediates further connection to the Mobile
Switching Center (MSC). The BSS assigns
the MS a channel with a given frequency and
time slot, which constitutes the
communication route between the MS and
the BSS.
 once the MS confirms the established
channel, the BSS can initiate the connection
to the MSC.
 once the MS has connected to the network,
the subscriber needs to be authenticated.
This can be done using the IMSI number
stored in the SIM card, which allows the
Authentication Center in the core network
to verify the subscriber’s identity. After this
step, the MS and the MSC can start
communicating.

4. in order to initiate the call setup, the MSC verifies that
the requested service is allowed for the subscriber. This
information is available in the Virtual Location Register,
which maintains temporary subscriber data (location,
preferences, allowed services). Once the VLR confirms
the service requested by the originating MS, the MSC
starts the call setup.
5. for the call to take place, the MSC allocates a voice
channel between the MSC and the BSS. The BSS notifies
the MS about the change to voice mode, and the MS
returns a confirmation message. The MSC routes the
call to the dialled number. When the call is received in
the PSTN, the MSC is notified that the called subscriber
is being alerted, at which point the originating MS
receives a ring notification.
 To disconnect the call by either party, a disconnect
message is sent to the MSC, which releases the
communication channels created with the PSTN and
the BSS.

2.7.2 Mobile-terminated Sequence:
 when a call is placed from the PSTN
towards a given phone number, the
PSTN uses the information in the phone
number (country and if available,
operator) to locate gateway MSC
leading to the MSC where the
subscriber is registered.
 the GMSC can request information
about the subscriber’s core network
and current location by interrogating
the HLR (Home Location Register).
 the HLR constantly updates locations of
the MS stored in the VLRs of the
networks the MS visits. In the HLR, the
subscriber MSISDN (phone number) is
associated with the IMSI number of the
SIM card, which was used to
authenticate the subscriber in the
visited network as they registered. Since
authentication is communicated to the
MSC, the HLR is aware of the visited
MSC/VLR of the MS at a given time.

 In order for the GMSC to pass the call to the MSC, the HLR asks a
temporary roaming phone number from the MSC (Mobile Station
Roaming Number – MSRN).
 the MSRN is sent back from the HLR to the GMSC.
 the GMSC forward the call to the MSC using the assigned MSRN.
 having received the call, the MSC pages all the BSCs in the area that
it serves.
 the BSC, in turn, page the BTSs assigned to them.
 the called MS responds to the paging from the BTS, asking to
establish a radio channel to the BTS.
 the response is forwarded to the MSC, which, once notified,
authenticates the MS and initiates the ciphering of the call using the
same procedure as in MO calls.
 when the MSC sends back to the radio network the call
confirmation message, the called MS starts to ring.
 At the other end, the MSC notifies the GMSC, which notifies the
PSTN that the destination number is being alerted.

2.7.3 Mobile to mobile Long distance call:
 to communicate to the network, the MS
establishes the connection to the radio
network, and sends a location update
request to the current BSS. The BSS
forwards the request to the MSC, which
finds that the device was registered to a
different MSC/VLR.
 the current MSC contacts the previous MSC
to get information about the MS, by sending
it the Temporary Mobile Subscriber Identity.
 in the old MSC, the IMSI is associated with
the TMSI, so that the IMSI parameter is be
sent to the new MSC. Once it reaches the
MSC, the current location of the device is
updated in the HLR; having the IMSI number,
the HLR will be able to provide information
about the subscriber (services allowed,
preferences etc) to the new MSC.
 the new VLR location is updated in the HLR.
Information from the previous MSC/VLR is
deleted.
 once the updates are communicated by the
HLR to the new MSC, authentication is
performed using the SIM card IMSI. After
authentication, the MSC initiates ciphering
and allocates a new temporary identity that
will be used to update the subscriber’s next
location. CS8601 MC - N.Gopinath AP/CSE 48
 A handover may also be requested between 2 different MSCs. This
case scenario is illustrated in the diagram above in green color.
 when the BSC is informed of the location change and finds that the
new location is not in its area, it forwards the handover request to
the MSC, which acknowledges that the subscriber has roamed to a
different MSC. The MSC has access to the LACs of neighboring
MSCs, therefore it can determine the network in which the
subscriber has roamed.
 the old MSC sends the request to the target MSC, which asks the
corresponding BSC to establish the speech channel to the MS.
 the MS receives handover request via the initially established
channel;
 communication is moved to the new created channel of the second
MSC. The MSC that initially assigned the MSRN for setting up the
call is called an anchor MSC and is responsible for all the inter-MSC
handover procedures that may occur during a call.
 in the case of a handover between different MSCs, a new
authentication of the MS will also be performed in the new
network.

2.7.4 Mobile in international roaming:
 An international transit network allows the
exchanging of data between different
operators, and its services are usually
regulated by a clearing house, which acts as
an intermediary between networks.
 It stores usage and call data records
generated in the visited network, that are
used for billing in the subscriber’s home
network.
 This way, an international roaming subscriber
is allowed to use the services of the visited
network but is charged by the home
network.

2.8 Mobility Management:
 Mobility management is a functionality

that facilitates mobile device operations in
Universal Mobile Telecommunications
System (UMTS) or Global System for
Mobile Communications (GSM)
networks.
 Mobility management is used to trace
physical user and subscriber locations to
provide mobile phone services, like calls
and Short Message Service (SMS).

2.8.1 Location Update Procedure:
 A GSM or UMTS network, like all cellular

networks, is basically a radio network of
individual cells, known as base stations.
 Each base station covers a small geographical
area which is part of a uniquely
identified location area.
 For GSM, a base station is called a base
transceiver station (BTS), and for UMTS it is
called a Node B.
 A group of base stations is named a location
area, or a routing area.

 The location update procedure allows
a mobile device to inform the cellular
network, whenever it moves from one
location area to the next.
 Mobiles are responsible for detecting
location area codes (LAC).
 When a mobile finds that the location area
code is different from its last update, it
performs another update by sending to the
network, a location update request, together
with its previous location, and its Temporary
Mobile Subscriber Identity (TMSI).
2.8.2 Temporary Mobile Subscriber
Identity (TMSI):
 The Temporary Mobile Subscriber Identity (TMSI) is the
identity that is most commonly sent between the mobile and
the network.
 TMSI is randomly assigned by the VLR to every mobile in the
area, the moment it is switched on.
 The number is local to a location area, and so it has to be
updated each time the mobile moves to a new geographical
area.
 A key use of the TMSI is in paging a mobile. "Paging" is the one-
to-one communication between the mobile and the base
station.
 The most important use of broadcast information is to set up
channels for "paging". Every cellular system has
a broadcast mechanism to distribute such information to a
plurality of mobiles.

2.8.3 Roaming:
 Roaming is one of the fundamental mobility
management procedures of all cellular networks.
 Roaming is defined as the ability for a cellular
customer to automatically make and receive voice
calls, send and receive data, or access other services,
including home data services, when travelling outside
the geographical coverage area of the
home network, by means of using a visited network.
 This can be done by using a communication terminal
or else just by using the subscriber identity in the
visited network.
 Roaming is technically supported by a mobility
management, authentication, authorization and billing
procedures.

2.8.4 Types of Area:
2.8.4.1. Location Area
A "location area" is a set of base stations that are
grouped together to optimize signalling. Typically, tens or
even hundreds of base stations share a single Base
Station Controller (BSC) in GSM
2.8.4.2. Routing Area
The routing area is the packet-switched domain
equivalent of the location area. A "routing area" is
normally a subdivision of a "location area". Routing areas
are used by mobiles which are GPRS-attached
2.8.4.3.Tracking Area
The tracking area is the LTE counterpart of the location
area and routing area. A tracking area is a set of cells.
Tracking areas can be grouped into lists of tracking areas
(TA lists), which can be configured on the User
Equipment (UE).
2.9 GSM – Security:
 GSM offers several security services using

confidential information stored in the AuC
and in the individual SIM.
 The SIM stores personal, secret data and is
protected with a PIN against unauthorized
use.
 Three algorithms have been specified to
provide security services in GSM.
Algorithm A3 is used for authentication,
A5 for encryption, and A8 for the
generation of a cipher key.
2.9.1 Access control and Authentication:
 The first step includes the authentication of a
valid user for the SIM.
 The user needs a secret PIN to access the SIM.
 Authentication is based on the SIM, which stores
the individual authentication key Ki, the
user identification IMSI, and the algorithm
used for authentication A3.
 The AuC performs the basic generation of
random values RAND, signed responses SRES,
and cipher keys Kc for each IMSI, and then
forwards this information to the HLR.
 The current VLR requests the appropriate values
for RAND, SRES, and Kc from the HLR.
 For authentication, the VLR sends the random
value RAND to the SIM.
 Both sides, network and subscriber module,
perform the same operation with RAND and
the key Ki, called A3.
 The MS sends back the SRES generated by the
SIM; the VLR can now compare both values.
 If they are the same, the VLR accepts the
subscriber, otherwise the subscriber is rejected.

2.9.2 Confidentiality:
 All user-related data is encrypted.
 After authentication, BTS and MS
apply encryption to voice, data, and
signaling as shown.
 To ensure privacy, all messages
containing user-related information
are encrypted in GSM over the air
interface.
 After authentication, MS and BSS can
start using encryption by applying the
cipher key Kc, which is generated
using the individual key Ki and a
random value by applying the
algorithm A8.
 Note that the SIM in the MS and the
network both calculate the same Kc
based on the random value RAND.
 The key Kc itself is not transmitted
over the air interface. MS and BTS can
now encrypt and decrypt data using
the algorithm A5 and the cipher key
Kc.

2.9.3 Anonymity:
 To provide user anonymity, all data is

encrypted before transmission, and user
identifiers are not used over the air.
 Instead, GSM transmits a temporary
identifier (TMSI), which is newly assigned
by the VLR after each location update.
 Additionally, the VLR can change the TMSI
at any time.

2.10 GPRS (General Packet Radio Services):
 General packet radio service (GPRS) is a

packet-based wireless data communication
service designed to replace the current
circuit-switched services available on the
second-generation global system for mobile
communications (GSM) and time division
multiple access (TDMA) IS-136 networks.

2.10.1 GPRS Architecture:
 GPRS architecture works on

the same procedure like GSM
network, but, has additional
entities that allow packet data
transmission.
 GPRS attempts to reuse the
existing GSM network
elements as much as possible,
but to effectively build a
packet-based mobile cellular
network, some new network
elements, interfaces, and
protocols for handling packet
traffic are required.

GPRS Mobile Stations
 New Mobile Stations (MS) are required to use GPRS
services because existing GSM phones do not handle
the enhanced air interface or packet data.
 A variety of MS can exist, including a high-speed
version of current phones to support high-speed data
access.
 A new PDA device with an embedded GSM phone,
and PC cards for laptop computers.
Base Station Subsystem:
 Each BSC requires the installation of Packet Control
Units in addition to software upgrade.
 They provide physical and logical data interface to
BSS to estimate packet data traffic.
 BTS too require a software upgrade but typically
does not involve hardware enhancements.

GRPS Support Nodes:
SSGN: The Serving GPRS Support Node is responsible for
authentication of GPRS mobiles, registration of mobiles in the
network, mobility management, and collecting information for
charging for the use of the air interface.
GGSN: The Gateway GPRS Support Node acts as an interface
and a router to external networks. The GGSN contains routing
information for GPRS mobiles, which is used to tunnel packets
through the IP based internal backbone to the correct Serving
GPRS Support Node.
Internal Back Network:
The internal backbone is an IP based network which is used to
carry the new packets between different GSN.
Mobility Support:
In a manner similar to GSM and CDPD, there are mechanism in
GPRS to support mobility. There are two types of Mobility
Support in GPRS Network-
 Attachment Procedure
 Location and Handoff Management

2.10.2 GPRS Services:
GPRS extends the GSM Packet circuit switched data capabilities
and makes the following services possible:
 SMS messaging and broadcasting
 "Always on" internet access
 Multimedia messaging service (MMS)
 Push-to-talk over cellular (PoC)
 Instant messaging and presence—wireless village
 Internet applications for smart devices through wireless
application protocol (WAP)
 Point-to-point (P2P) service: inter-networking with the Internet
(IP)
 Point-to-multipoint (P2M) service: point-to-multipoint multicast
and point-to-multipoint group calls
If SMS over GPRS is used, an SMS transmission speed of about
30 SMS messages per minute may be achieved. This is much
faster than using the ordinary SMS over GSM, whose SMS
transmission speed is about 6 to 10 SMS messages per minute.

2.10.3 GPRS Protocol stacks:
 The flow of GPRS

protocol stack and end-to-
end message from MS to
the GGSN is displayed in
the diagram.
 GTP is the protocol used
between the SGSN and
GGSN using the Gn
interface.
 This is a Layer 3 tunnelling
protocol.
 Applications are communicated via standard IP that
GPRS network carries and out through the GPRS
gateway.
 By using tunnelling protocol, packets are transmitted
between the GGSN and the SGSN.
 GTP runs the UDP and IP.
 Sub Network Dependent Convergence Protocol
(SNDCP) and Logical Link Control (LLC) combination
used in between the SGSN and the MS communication.
 To reduce the load on the radio channel, SNDCP
flattens the data.
 During mobile, the user moves to a different place
where new routing area lies under a different SGSN,
then old LLC link is no longer used and new link is
generated with the new Serving GSN X.25. X.25 is used
to provide services on top of TCP/IP in the internal
backbone.

2.11 Universal Mobile Telecommunication Services
(UMTS)
 The Universal Mobile Telecommunications
System (UMTS), based on the GSM
standards, is a mobile cellular system of
third generation that is maintained by
3GPP (3rd Generation Partnership
Project).
 It specifies a complete network system
and the technology described in it is
popularly referred as Freedom of Mobile
Multimedia Access (FOMA).

2.11.1 UMTS Architecture:
 The UMTS Network

architecture has three
main entities:
1) UMTS Core Network
(CN)
2) UMTS Terrestrial Radio
Access Network (UTRAN)
3) User Equipment (UE)

1) Core Network (CN)
• The UMTS network architecture is partly based on existing 2G
network components and some new 3G network components.
• The CN provides circuit switched (CS) functions as well as
packet switched (PS) functions.
i. 3G-MSC
 The 3G-MSC is the main CN element to provide CS services.
 The 3G MSC provides the interconnection to external
networks like PSTN and ISDN.
ii. 3G-SGSN
 The 3G-SGSN is the main CN element for PS services. The
3G-SGSN provides the necessary control functionality both
toward the UE and the 3G-GGSN
iii. 3G-GGSN
 The GGSN provides interworking with the external PS
network. It is connected with SGSN via an IP-based network.

2) UTRAN:
 UMTS terrestrial RAN (UTRAN)
 UTRAN consist of Radio Network Subsystems (RNSs). The RNS has two
main elements: Node B and a Radio Network Controllers (RNC).
i) Radio network controller (RNC):
 An RNC in UMTS has a broad spectrum of tasks as listed in the following:
1. Call admission control
2. Congestion control
3. Encryption / Decryption
4. ATM switching and Multiplexing, Protocol conversion
5. Radio resource control.
6. Radio Bearer setup and release
7. Code allocation
8. Power control
9. Handover control and RNS relocation.
ii) Node B:
 The Node B in UMTS networks provides functions equivalent to the base
transceiver station (BTS) in GSM/GPRS networks.

3) UE:
 The UMTS standard does not restrict the
functionality of the User Equipment in any way.
 UMTS mobile station can operate in one of three
modes of operation:
1. PS/CS mode of operation – MS attached to both PS
and CS domain
2. PS mode of operation – MS attached to only PS
domain
3. CS mode of operation – MS attached to only CS
domain
 UMTS IC card has same physical characteristics as
GSM SIM card.
2.11.2 UMTS – Handover:
UMTS hard handover
 The name hard handover indicates that there is a "hard" change during
the handover process.
 For hard handover the radio links are broken and then re-established.
 The basic methodology behind a hard handover is relatively
straightforward.
 There are a number of basic stages of a hard handover:
1. The network decides a handover is required dependent upon the signal
strengths of the existing link, and the strengths of broadcast channels of
adjacent cells.
2.The link between the existing Node B and the UE is broken.
3.A new link is established between the new Node B and the UE.
 UMTS hard handovers may be used in a number of instances:
1. When moving from one cell to an adjacent cell that may be on a
different frequency.
2. When implementing a mode change, e.g. from FDD to TDD mode, for
example.
3. When moving from one cell to another where there is no capacity on
the existing channel, and a change to a new frequency is required.
UMTS soft handover
 UE can receive signals from up to
three different antennas, which
may belong to different node Bs.
 Towards the UE the RNC splits
the data stream and forwards it
to the node Bs.
 The UE combines the received
data again.
 The RNC combines the data
streams received from the node
Bs.
 The fact that a UE receives data
from different antennas at the
same time makes a handover soft.
 Figure shows a situation where a soft handover
is performed between two node Bs that do not
belong to the same RNC.
 In this case one RNC controls the connection
and forwards all data to and from the CN.
 If the UE moves in the example from the upper
cell to the lower cell, the upper RNC acts as a
serving RNC (SRNC) while the other is the
drift RNC (DRNC).

 The mentioned Figure gives
an overview of several
common handover types in a
combined UMTS/GSM
network (UMTS specifies ten
different types which include
soft and hard handover).
1. Intra-node B, intra-RNC
2. Inter-node B, intra-RNC
3. Inter-RNC
4. Inter – MSC
5. Inter- system

2.11.3 UMTS – Security:
The main security elements that are from GSM:
 Authentication of subscribers
 Subscriber identity confidentially
 Subscriber Identity Module (SIM) to be removable from
terminal hardware
 Radio interface encryption
Additional UMTS security features:
 Security against using false base stations with mutual
authentication
 Encryption extended from air interface only to include
Node-B to RNC connection
 Security data in the network will be protected in data
storages and while transmitting ciphering keys and
authentication data in the system.
 Mechanism for upgrading security features.

UMTS specification has five security feature
groups:
 Network access security
 Network domain security
 User domain security
 Application domain security
UMTS specification has the following user
identity confidentiality security features:
 User identity confidentiality
 User location confidentiality
 User intractability

MC Unit 2 Lecture Slides

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

MC Unit 2 Lecture Slides

Transféré par

Droits d'auteur :

Formats disponibles

UNIT II

MOBILE TELECOMMUNICATION SYSTEM

CS8601 MC - N.Gopinath AP/CSE 2

CS8601 MC - N.Gopinath AP/CSE 3

CS8601 MC - N.Gopinath AP/CSE 4

CS8601 MC - N.Gopinath AP/CSE 5

CS8601 MC - N.Gopinath AP/CSE 6

CS8601 MC - N.Gopinath AP/CSE 7

CS8601 MC - N.Gopinath AP/CSE 8

CS8601 MC - N.Gopinath AP/CSE 9

CS8601 MC - N.Gopinath AP/CSE 11

CS8601 MC - N.Gopinath AP/CSE 12

CS8601 MC - N.Gopinath AP/CSE 13

CS8601 MC - N.Gopinath AP/CSE 15

CS8601 MC - N.Gopinath AP/CSE 16

CS8601 MC - N.Gopinath AP/CSE 17

CS8601 MC - N.Gopinath AP/CSE 19

CS8601 MC - N.Gopinath AP/CSE 20

CS8601 MC - N.Gopinath AP/CSE 21

CS8601 MC - N.Gopinath AP/CSE 22

CS8601 MC - N.Gopinath AP/CSE 23

CS8601 MC - N.Gopinath AP/CSE 24

CS8601 MC - N.Gopinath AP/CSE 25

CS8601 MC - N.Gopinath AP/CSE 26

CS8601 MC - N.Gopinath AP/CSE 27

CS8601 MC - N.Gopinath AP/CSE 29

CS8601 MC - N.Gopinath AP/CSE 30

CS8601 MC - N.Gopinath AP/CSE 32

CS8601 MC - N.Gopinath AP/CSE 33

CS8601 MC - N.Gopinath AP/CSE 34

CS8601 MC - N.Gopinath AP/CSE 35

Two types of channels, namely physical channels

CS8601 MC - N.Gopinath AP/CSE 37

CS8601 MC - N.Gopinath AP/CSE 39

CS8601 MC - N.Gopinath AP/CSE 40

CS8601 MC - N.Gopinath AP/CSE 43

CS8601 MC - N.Gopinath AP/CSE 44

CS8601 MC - N.Gopinath AP/CSE 45

CS8601 MC - N.Gopinath AP/CSE 46

CS8601 MC - N.Gopinath AP/CSE 47

CS8601 MC - N.Gopinath AP/CSE 49

CS8601 MC - N.Gopinath AP/CSE 50

 Mobility management is a functionality

CS8601 MC - N.Gopinath AP/CSE 51

 A GSM or UMTS network, like all cellular

CS8601 MC - N.Gopinath AP/CSE 52

CS8601 MC - N.Gopinath AP/CSE 54

CS8601 MC - N.Gopinath AP/CSE 55

 GSM offers several security services using

CS8601 MC - N.Gopinath AP/CSE 58

CS8601 MC - N.Gopinath AP/CSE 59

 To provide user anonymity, all data is

CS8601 MC - N.Gopinath AP/CSE 60

 General packet radio service (GPRS) is a

CS8601 MC - N.Gopinath AP/CSE 61

 GPRS architecture works on

CS8601 MC - N.Gopinath AP/CSE 62

CS8601 MC - N.Gopinath AP/CSE 63

CS8601 MC - N.Gopinath AP/CSE 64

CS8601 MC - N.Gopinath AP/CSE 65

 The flow of GPRS

CS8601 MC - N.Gopinath AP/CSE 67

CS8601 MC - N.Gopinath AP/CSE 68