2G/3G Mobile Communication Systems

‹ 2G Review: GSM
‹ Services
‹ Architecture
‹ Protocols
‹ Call setup
‹ Mobility management
‹ Security

‹ HSCSD
‹ GPRS
‹ Architecture
‹ Protocols
‹ QoS

‹ EDGE
‹ UMTS
2G to 3G Evolution: GSM - GPRS - UMTS

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller GSM Core
GSM (Circuit
RAN switched)
Base station

HLR
GSM AuC
EIR

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 2

Architecture of the GSM system
GSM is a PLMN (Public Land Mobile Network)
‹ several providers setup mobile networks following the GSM standard
within each country

GSM system comprises 3 subsystems

‹ RSS (radio subsystem): covers all radio aspects
‹ MS (mobile station)
‹ BSS (base station subsystem) or RAN (radio access network)
‹ BTS (base transeiver station)
‹ BSC (base station controller)
‹ NSS (network and switching subsystem): call forwarding, handover,
switching
‹ MSC (mobile services switching center)
‹ LR (location register): HLR and VLR
‹ OSS (operation subsystem): management of the network
‹ OMC (operation and maintenance centre)
‹ AuC (authentication centre)
‹ EIR (equipment identity register)

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 3

GSM: cellular network

segmentation of the area into cells

possible radio coverage of the cell

idealized shape of the cell

cell

‹ use of several carrier frequencies

‹ not the same frequency in neighboring cells
‹ cell radius varies from some 100 m up to 35 km depending on
user density, geography, transceiver power etc.
‹ hexagonal shape of cells is idealized (cells overlap, shapes depend
on geography)
‹ if a mobile user changes cells
-> handover of the connection to the neighbor cell

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 4

 Cellular systems: Frequency planning I
Frequency reuse only with a certain distance between the base stations
Typical (hexagon) model:
f5
f4 f6
f1 f1
reuse-3 cluster: f3 reuse-7 cluster: f3 f7
f2 f5 f2
f1 f1 f4 f6 f5
f3 f3 f1 f4 f6
f2 f2 f3 f7 f1
f2 f3 f7
f2
Other regular pattern: reuse-19
Î the frequency reuse pattern determines the experienced CIR
Fixed frequency assignment:
‹ certain frequencies are assigned to a certain cell
‹ problem: different traffic load in different cells

Dynamic frequency assignment:

‹ base station chooses frequencies depending on the frequencies already used in
neighbor cells
Frequency Hopping (fixed or random sequence of frequencies)
‹ Improves quality for slow moving or stationary users (frequency diversity)
‹ Reduces impact of intercell interference by statistical averaging

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 5

GSM: Air Interface
FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

Uplink Downlink
890 MHz 915 MHz 935 MHz 960 MHz

1 2 3 ... 123124 1 2 3 ... 123124

200 kHz frequency

TDMA (Time Division Multiple Access)

Downlink
1 2 3 4 5 6 7 8

Uplink
1 2 3 4 5 6 7 8

4,615 ms
= 1250 bit time

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 6

GSM: Voice Coding

p s)
s

ps
bp

0,8 s
kb
(27 kbp
ps

kb
4k

kb

,8
-10

,8
22
9,6

33
64
Channel Modulation
Voice coding Framing
coding (GMSK)

114 bit/slot
114 + 42 bit

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 µs
577 µs
Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot)
Training sequence: select the best radio path in the receiver and train equalizer
Tail: needed to enhance receiver performance
Flag S: indication for user data or control data
Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 7
Mobile Terminated Call (MTC)
1: calling a GSM subscriber
2: forwarding call to GMSC 4
3: signal call setup to HLR HLR
5
VLR

4, 5: request MSRN from VLR 8 9

3 6 14 15
6: forward responsible
MSC to GMSC calling PSTN GMSC
7
MSC
station 1
7: forward call to 2

current MSC 10 10 13 10
16
8, 9: get current status of MS
BSS BSS BSS
10, 11: paging of MS
11 11 11
12, 13: MS answers
14, 15: security checks 11 12
16, 17: set up connection 17
MS

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 8

Location Management / Mobility Management
The issue: Compromise between
Solution 1: Solution 2:
‹ minimizing the area where Large paging area Small paging area
to search for a mobile
‹ minimizing the number of
location updates
RA RA Location
RA
Update
TOTAL
Signalling Cost
=

∑ Signalling
Paging
Cost
RA RA Location
Update
RA

+∑ Paging Area Update

Signalling Cost

RA RA RA
Location
Update
Location
Update
Location
Update
Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 9
Handover
The problem:
Change the cell while
communicating

Reasons for handover:

‹ Quality of radio link cell 2
cell 1
deteriorates
‹ Communication in other cell
requires less radio resources
‹ Supported radius is

Link quality
exceeded (e.g. Timing cell 1
advance in GSM) Handover margin
(avoid ping-pong
‹ Overload in current cell effect)
‹ Maintenance
cell 2

Link to cell 1 Link to cell 2 time

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 10

Handover procedure (change of BSC)

„Make-before-break“ strategy

MS BTSold BSCold MSC BSCnew BTSnew

measurement measurement
report result

HO decision
HO required HO request

resource allocation
ch. activation

HO command HO request ack ch. activation ack make

HO command HO command
HO access
Link establishment

HO complete HO complete
clear command clear command

clear complete break

clear complete

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 11

 GSM - authentication Challenge-Response:
• Authentication center provides RAND to Mobile
• AuC generates SRES using Ki of subscriber and
RAND via A3
Ki RAND
• Mobile (SIM) generates SRES using Ki and RAND
• Mobile transmits SRES to network (MSC)
128 bit 128 bit
AuC • network (MSC) compares received SRES with one
generated by AuC
A3

SRES* 32 bit RAND RAND Ki

mobile network
128 bit 128 bit
Authentication Request (RAND)
SIM
A3

SRES 32 bit

MSC Authentication Response (SRES 32 bit)

SRES* =? SRES SRES

Ki: individual subscriber authentication key SRES: signed response

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 12

GSM - key generation and encryption
Ciphering:
• Data sent on air interface ciphered for security
• A8 algorithm used to generate cipher key
• A5 algorithm used to cipher/decipher data
• Ciphering Key is never transmitted on air
MS with SIM

RAND
Ki RAND RAND Ki
AuC 128 bit 128 bit SIM
128 bit 128 bit

A8 A8

cipher Kc
key 64 bit mobile network (BTS) Kc
64 bit
data encrypted SRES
data
BTS data MS
A5 A5

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 13

GSM Evolution – Overview

adaptive EDGE
modulation
Macro diversity
space
Spectral
efficency diversity Intelligent antennas

time Equalizer
adaptive
interference redundancy HSCSD
GPRS

continuous
Dynamic bursty
Frequency Interference
channel cancelation
hopping
allocation (multi-user Data
detection)
traffic

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 14

HSCSD (High-Speed Circuit Switched Data)

‹ continuous use of multiple time slots for a single user

(on a single carrier frequency)
‹ asynchronous allocation of time slots between DL and UL
‹ gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)

Downlink
1 2 3 4 5 6 7 8 1 2

Uplink
1 2 3 4 5 6 7 8 1 2

‹ mainly software update

‹ additional HW needed if more than 3 slots are used

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 15

2G to 3G Evolution: GSM - GPRS - UMTS

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller GSM Core
GSM (Circuit
RAN switched)
Base station

HLR
AuC
EIR
GSM+GPRS
SGSN
Inter-
net
GPRS Core GGSN
(Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 16

GPRS (General Packet Radio Service)
‹ Introducing packet switching in the network
‹ Using shared radio channels for packet transmission over the air:
‹ multiplexing multiple MS on one time slot
‹ flexible (also multiple) allocation of timeslots to MS
(scheduling by PCU Packet Control Unit in BSC or BTS)
‹ using free slots only if data packets are ready to send
(e.g., 115 kbit/s using 8 slots temporarily)
‹ standardization 1998, introduction 2001
‹ advantage: first step towards UMTS, flexible data services

GPRS network elements

‹ GSN (GPRS Support Nodes): GGSN and SGSN
‹ GGSN (Gateway GSN)
‹ interworking unit between GPRS and PDN (Packet Data Network)
‹ SGSN (Serving GSN)
‹ supports the MS (location, billing, security)

‹ HLR (GPRS Register – GR)

‹ maintains location and security information

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 17

GPRS: Multiplexing and multislot allocation

Multiplexing

TS
0 1 2 3 4 5 6 7 carrier

Multislot capability

0 1 2 3 4 5 6 7

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 18

GPRS protocol architecture

MS BSS SGSN
Um Gb Gn GGSN Gi

appl.

IP/X.25 IP/X.25

SNDCP GTP
SNDCP GTP
LLC LLC UDP UDP

RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio

BSSGP: Base Station Subsystem GPRS Protocol (control plane: routing & QoS)
SNDCP: Subnetwork-Dependent Convergence Protocol (mapping, segmentation,
header compression)
Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 19
GPRS services
End-to-end packet switched traffic (peak channel rates)
‹ 28 kbps (full use of 3 time slots, CS-1: FEC)
‹ 171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002)

‹ 95 kbps (for both up and downlink)
Assumptions: 4/12 reuse, realistic RF conditions, random traffic
‹ Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control – FEC)

‹ CS 1: 9.05 Kbps/slot
‹ CS 2: 13.4 Kbps/slot
‹ CS 3: 15.6 Kbps/slot
‹ CS 4: 21.4 Kbps/slot (no Forward Error Correction)

Problems and limits

‹ IP-based network => high latency, no guarantees
‹ Limited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4)
‹ Latency/flow control problems with TCP

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 20

EDGE (Enhanced Data Rates for GSM Evolution)
Enhanced spectral efficiency depends on:
‹ Size of frequency band
‹ Duration of usage
Near-far problem
‹ Level of interference with others (power)

EDGE Technology:
‹ EDGE can carry data speeds up to 236.8 kbit/s for 4
UE 1
timeslots (theoretical maximum is 473.6 kbit/s for 8
timeslots)
‹ Adaptation of modulation depending
on quality of radio path
‹ GMSK (GSM standard – 1 bit per symbol)
‹ 8-PSK (3 bits per symbol) NodeB
‹ Adaptation of coding scheme depending
on quality of radio path (9 coding schemes)
‹ Gain: data rate (gross) up to 69,2kbps (compare to
22.8kbps for GSM)
UE 2
‹ complex extension of GSM!

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 21

EDGE – Adaptive Modulation and Coding Schemes
Schem e M o d u la t i o n M axim u m C o d e R a te Fam ily
r a t e [ k b /s ]
M C S-9 8 P SK 5 9 .2 1 .0 A
M C S-8 5 4 .4 0 .9 2 A
M C S-7 4 4 .8 0 .7 6 B
M C S-6 2 9 .6 / 2 7 .2 0 .4 9 A
M C S-5 2 2 .4 0 .3 7 B
M C S-4 G M SK 1 7 .6 1 .0 C
M C S-3 1 4 .8 / 1 3 .6 0 .8 0 A
M C S-2 1 1 .2 0 .6 6 B
M C S-1 8 .8 0 .5 3 C
4
x 10
6

MCS−1 (R=1/2)
MCS−2 (R=2/3)
5 MCS−3 (R=6/7)
MCS−4 (R=1)
MCS−5 (R=3/8)
MCS−6 (R=1/2)
4 MCS−7 (R=3/4)
MCS−8 (R=1)
Troughput S [kbps]

0
0 5 10 15 20 25 30
C/I [dB]
Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 22
2G to 3G Evolution: GSM - GPRS – UMTS R99/R3

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller GSM Core
GSM (Circuit
RAN switched)
Base station

GSM+GPRS+UMTS R99 HLR

AuC
EIR

Base station
Base station SGSN
Radio network Inter-
controller net
GPRS Core GGSN
Base station UTRAN (Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 23

2G to 3G Evolution: GSM - GPRS - UMTS R5 - IMS

Base station Base station

Base station
controller
GERAN
GSM
Base station
RAN GERAN + UMTS R5 + IMS

Transmission
Base station IP based
Base station SGSN
Radio network Inter-
controller net
3G Core
GPRS Core GGSN
Base station UTRAN (Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel Jan. 2008 24