GSM/GPRS

Dr. Anil Kumar Intel Corporation

1/17/2013AK
R

slide 1

OVERVIEW
INTRODUCTION GSM/GPRS SYSTEM ARCHITECTURE PROTOCOL ARCHITECTURE SERVICES GPRS MOBILITY MANAGEMENT (GMM) SESSION MANAGEMENT (SM) AIR INTERFACE SUMMARY

1/17/2013AK
R

slide 2

GSM SYSTEM ARCHITECTURE

BTS

BSC
BSS

OSS

HLR VLR AUC EIR

. . .

MSC

BTS

GSM networks have hierarchical structure

BSC
BSS

GMSC
PSTN ISDN PDN

1/17/2013AK
R

slide 3

BASE TRANSCEIVER SYSTEM (BTS)

BTS comprises of radio transmission and reception devices Each BTS serves as a single cell Functions of BTS
Message scheduling (paging, BCCH/CCCH) Random access detection on RACH Detect HO access burst sent by MS Uplink Radio channel measurements Channel coding/decoding and rate adaptation in case of data (TRAU)

Transcoder and Rate Adaptation Unit (TRAU)

Takes 13 Kbps speech or 3.6/6/12 Kbps data, makes up to 16 kbps by adding sync data, multiplexes four of them to convert to standard 64 Kbps required for A-bis interface
1/17/2013AK
R

slide 4

BASE STATION CONTROLLER (BSC)

Each BSC controls a group of cells (cluster) Functions of BSC
Radio Resource (RR) management Inter-cell Hand-Off (HO) Relocation of frequencies among BTSs Power management of BTSs Provide interface to O&M to BSS

1/17/2013AK
R

slide 5

MOBILE SWITCHING CENTER (MSC)

MSC performs telephony switching functions
Network interfacing, common channel signaling, toll ticketing, etc.

MSC controls calls to/from other telephone and data systems MS traffic from several BSCs are routed through a switch in MSC Each MSC serves several cell groups or clusters which is referred as location area (LA)

1/17/2013AK
R

slide 6

DATABASES IN GSM NETWORK

Databases are used for call control and network management Home Location Register (HLR)
Stores permanent (users profile) as well as temporary data (current location of user) of all users registered with a network operator

Visitor Location Register (VLR)

Stores parts of permanent as well as temporary data of current users Assigns TMSI which has only local significance

Authentication Center (AUC)

Generates and stores security related data such as keys used for authentication and encryption

Equipment Identity Register (EIR)

Stores equipment data rather than MS data
1/17/2013AK
R

slide 7

MS IDENTITY IN GSM
International Mobile Station Equipment Identity (IMEI)
Identifies an MS internationally Assigned by equipment manufacturer and registered by network operator in the Equipment Identity Register (EIR)

International Mobile Subscriber Identity (IMSI)

Uniquely identifies a registered user Stored in the Subscriber Identity Module (SIM)

Mobile Subscriber ISDN (MSISDN)

Real Telephone number of the MS MS can have several MSISDNs depending on the SIM

Temporary Mobile Subscriber Identity (TMSI)

Assigned by VLR which is responsible for current location of the subscriber Stored by VLR and not passed to HLR Has local significance only
1/17/2013AK
R

slide 8

GPRS SYSTEM ARCHITECTURE

BTS

BSC

GGSN SGSN

BTS

BSC
HLR VLR EIR

GGSN

PDN
1/17/2013AK
R

slide 9

SERVING GPRS SUPPORT NODE (SGSN)

SGSN is responsible for the delivery of data packets from and to MS within its service area SGSN functions include
Packet routing and transfer Mobility Management (Attach/Detach, Location Management) Logical Link Management Authentication and charging functions

Location register of SGSN stores location information (e.g., current cell, current VLR) and user profiles of all GPRS users registered with the SGSN
1/17/2013AK
R

slide 10

GATEWAY GPRS SUPPPORT NODE (GGSN)

GGSN acts as interface between GPRS backbone and external Packet Data Network (PDN) GGSN converts GPRS packets coming from SGSN into appropriate Packet Data Protocol (PDP) format (e.g., IP or PPP) and sends them to corresponding PDN PDP addresses of incoming data packets are converted to GSM address of the destination user GGSN stores the current SGSN address of the user as well as user profile in its location register GGSN also performs charging and authentication functions
1/17/2013AK
R

slide 11

GSM/GPRS NETWORK
CGF
PSTN

E
GMSC

Ga

Ga Gn

Gs

MSC /VLR

D A
HLR/VLR AUC, EIR

Gr
Packet Switched Network (Frame Relay)

SGSN

Gn
GGSN

SGSN

BTS

Gi

Gb

Gi
PDN

Um

Abis

BSC

Abis
1/17/2013AK
R

slide 12

GPRS PROTOCOL ARCHITECTURE

1/17/2013AK
R

slide 13

GPRS PROTOCOL: MS-BSS

Maps a network level protocol (IP, PPP) to LLC; Provides compression, segmentation and multiplexing of network layer messages to a single virtual connection DLL protocol (LAP-Dm). Ensures reliable transfer of user data across wireless network, flow control, sequence control, ARQ. RLC establishes a reliable link between MS and BSS, SAR of LLC frames
LLC Relay
RLC MAC GSM RF

Application IP/X.25 GMM/SM SNDCP LLC RLC MAC GSM RF

Controls access signaling (request and grant) procedures for the radio channel

BTS

LLC Relay BSSGP

Um

Abis

BSC

Nw Service Q.922 (core) PHY

Processes routing and QoS information for BSS. BSSGP uses FR Q.922 core protocol as transport

Abis
1/17/2013AK
R

slide 14

GPRS PROTOCOL: BSS-SGSN

GMM/SM SNDCP LLC BSSGP Nw Service Q.922 (core) PHY MAP BSSAP+ TCAP SCCP MTP3 MTP2 MTP1 GTP TCP/UDP

Paging for voice connection from MSC via SGSN; Location and routing updates CGF

IP
L2 PHY

Ga
Packet Switched Network (Frame Relay)

Ga Gn

Supports signaling between SGSN/GGSN and HLR/AuC/EIR SCCP, MTP3, MTP2 support MAP and BSSAP+ in circuit switched PLMNs
BTS

SGSN

Gn
GGSN

SGSN

Gb
LLC Relay BSSGP Nw Service Q.922 (core) PHY

Um

Abis

Gi

BSC

Abis
1/17/2013AK
R

slide 15

GPRS PROTOCOL: SGSN-GGSN

GMM/SM SNDCP LLC BSSGP Nw Service Q.922 (core) PHY MAP BSSAP+ TCAP SCCP MTP3 MTP2 IP L2 GTP TCP/UDP

CGF

Ga

Ga

MTP1

PHY

Gn
SGSN
GMM/SM MAP TCAP/ SCCP MTP3 MTP2 MTP1 IWF GTP TCP/UDP IP L2 PHY TCP/UDP IP L2 PHY

Gn
GGSN

SGSN

Gi

1/17/2013AK
R

slide 16

GPRS PROTOCOL: MS-GGSN

GMM/SM SNDCP LLC BSSGP Nw Service Q.922 (core) Application IP/X.25 GMM/SM SNDCP LLC RLC MAC GSM RF LLC Relay RLC MAC GSM RF LLC Relay GMM/SM MAP TCAP/ SCCP MTP3 MTP2 MTP1 Packet Switched Network (Frame Relay) PHY MAP BSSAP+ TCAP SCCP MTP3 MTP2 MTP1 IP L2 PHY GTP TCP/UDP

CGF

Ga

Ga
Gn

SGSN

Gn
GGSN

SGSN

Gi
TCP/UDP IP L2 PHY

IWF GTP TCP/UDP IP L2 PHY

BTS

BSSGP Nw Service

Um

Abis

BSC

Q.922 (core) PHY

Abis
1/17/2013AK
R

slide 17

TRANSMISSION PLANE
MS
Application

BSS

SGSN

GGSN

Network Layer (IP)

SNDCP LLC RLC MAC PHY Layer RLC MAC Relay BSSGP Nw Service

Network Layer (IP) Relay

SNDCP
LLC BSSGP

GTP
TCP/UDP IP

GTP TCP/UDP IP Data Link Physical

Nw Service Data Link

Physical Physical

Physical

Physical

Um
1/17/2013AK
R

Gb
slide 18

Gn

Gi

SIGNALING PLANE: MS-SGSN

MS
GMM/SM LLC Relay

BSS

SGSN
GMM/SM LLC BSSGP Nw Service PHY Layer

RLC
MAC PHY Layer

RLC
MAC

BSSGP
Nw Service

Physical Physical

Um

Gb

1/17/2013AK
R

slide 19

Gp/Gn INTERFACE
GTP-C UDP IPsec IP GTP-C UDP IPsec IP Link Physical Gp Gp interface between GSNs in Inter-PLMN GPRS backbone Gn interface is between GSNs in Intra-PLMN GPRS backbone

Link Physical

1/17/2013AK
R

slide 20

GPRS BACKBONE NETWORK

PDN
Gi Gp Inter PLMN Backbone Gp Gi

GGSN
Gn

BGW

BGW

GGSN
Gn

Intra PLMN Backbone

Gn

Intra PLMN Backbone

Gn

SGSN
PLMN 1
1/17/2013AK
R

SGSN
slide 21

PLMN 2

GPRS-INTERNET CONNECTION
Service provider network
Gi

DNS

DHCP

Firewall

GGSN
Gn

BGW

External PDN

Intra PLMN Backbone

Gn

Router
LAN

SGSN
PLMN 1
1/17/2013AK
R

slide 22

GSN ADDRESS
GSN Address Address Type Address Length Address

2 bits

6 bits

4 to 16 octets

Address Type Length IPv4 0 4

Ipv6

16

Domain Name Server (DNS) function resolves logical GSN names to GSN addresses

1/17/2013AK
R

slide 23

GSM/GPRS SERVICES

1/17/2013AK
R

slide 24

TELECOM SERVICES
Telecommunication Services

Basic Services Tele Service Bearer Service

1/17/2013AK
R

Supplementary Services

Provides complete capability including terminal equipment functions

Provides the capability of transmission of signals between access points Does not include TE functions Defined by set of measurable parameters Point-to-Point (PTP) or Point-to-Multipoint (PTM) Connection oriented or connectionless modes

slide 25

PACKET & CIRCUIT SWITCHED SERVICES

MS Class
Class A

Operation
MS is attached to both GPRS and other GSM services, and supports simultaneous operation of GPRS and GSM services MS is attached to both GPRS and other GSM services, but can support only one set of services at a time MS is exclusively attached to GPRS services

Class B Class C

1/17/2013AK
R

slide 26

SHORT MESSAGING SERVICE (SMS)

SMS enables transmission of alphanumeric messages (up to 190 characters) between MS and external systems such as email, voice mail and paging systems Unlike alphanumeric paging, SMS guarantees delivery of text messages to the destination Registered MS can send or receive SMS anytime, irrespective of a call (voice or data) in progress Using SMS Center (SMSC), which acts as a store and forward entity, network guarantees delivery of messages SMS integrates number of services including 2-way messaging, email, fax, paging, interactive banking and information services such as stock quotes, weather reports etc.
1/17/2013AK
R

slide 27

GPRS MOBILITY MANAGEMENT SESSION MANAGEMENT (GMM/SM)

1/17/2013AK
R

slide 28

GMM/SM
GPRS Mobility Management (GMM) and Session Management (GMM/SM) protocol between MS and SGSN addresses MM functionality
GPRS Attach/ GPRS Detach Security RA Update / Location Update PDP Context Activation/De-activation

At GPRS Attach, SGSN establishes a MM context containing mobility and security information of MS At PDP context activation, SGSN establishes a PDP context to be used for routing purposes with GGSN
1/17/2013AK
R

slide 29

GPRS ATTACH/DETACH
MS registers with the SGSN by sending GPRS attach message SGSN checks if the MS is a authorized user, and copies user profile information from the HLR to SGSN SGSN assigns a Packet Temporary Mobile Subscriber Identity (P-TMSI) to the user Disconnection from the GPRS network is called GPRS detach Either MS or the network (SGSN or HLR) can initiate a GPRS detach
1/17/2013AK
R

slide 30

LOCATION MANAGEMENT (LM)

MS in IDLE state

IDLE
STANDBY Timer expired GPRS Attach GPRS Detach

No location updates

MS in READY state

READY

Informs SGSN of movement to a new cell

MS in STANDBY state
SGSN will be informed when the MS moves into a new Routing Area (RA) RA Cell

STANDBY
READY timer expired or forced to STANDBY Transmission of a packet

LA
1/17/2013AK
R

slide 31

LM PROCEDURES FOR GPRS

Three conditions for Cell Update Procedure
MS is in READY state MS enters new cell RA has not changed

Two conditions for RA Update Procedures

MS is in STANDBY state MS enters new RA

Types of RA Update Procedures

Intra SGSN RA Update Inter SGSN RA Update

1/17/2013AK
R

slide 32

LM PROCEDURES FOR GPRS

Intra SGSN RA Update for GPRS
SGSN handles OLD RA as well as NEW RA Only cell within RA has changed Periodic RA updates fall under this No need to inform GGSN or HLR about new location

Inter SGSN RA Update for GPRS

Forwards RA request to new SGSN Old SGSN sends un-ciphered RA update message to new SGSN

Combined RA/LA Update Procedures

Occur in Network operation mode I, (i.e., Gs interface between SGSN and VLR present) when MS enters new RA or GPRS attached MS performs IMSI attach SGSN forwards the LA update to VLR
1/17/2013AK
R

slide 33

INTER SGSN RA/LA UPDATE

MS New SGSN Old SGSN GGSN New MSC/VLR HLR Old MSC/VLR

RA update Req SGSN Context Req

SGSN Context Resp

SGSN Context Ack Forward Packets Update PDP Context Req Update PDP Context Res Update Location Cancel Location
1/17/2013AK
R

slide 34

INTER SGSN RA/LA UPDATE

MS New SGSN Old SGSN GGSN New MSC/VLR HLR Old MSC/VLR
Cancel Location Ack Insert MS data Insert MS data Ack

Update Location Ack

Location Update Req Update Location Cancel Location Cancel Location Ack

Insert MS data
Insert MS data Ack Update Location Ack Location Update Ack
1/17/2013AK
R

slide 35

ENCAPSULATION & TUNNELING

Encapsulation is the addition of address and control information to a PDU for routing within PLMNs. Two different schemes used
Between SGSN and GGSN PDP PDU is encapsulated with GTP Between MS and BSS PDP PDU is encapsulated with SNDCP

Tunneling is transfer of encapsulated data between PLMNs from point of encapsulation to point of decapsulation

1/17/2013AK
R

slide 36

ENCAPSULATION & TUNNELING

BSC
SGSN Addr TEID

SGSN
GGSN Addr BSC Addr TEID

GGSN
PDP Addr SGSN Addr TEID

IP IP UDP GTP HDR IP IP UDP GTP HDR IP UDP DATA UDP DATA

UDP DATA

Downlink

DATA UDP IP GTP HDR

UDP IP

Uplink
1/17/2013AK
R

DATA UDP IP GTP HDR UDP IP

DATA UDP IP

slide 37

GTP HEADER
TEID 1

SGSN

TEID 2 TEID 3

GGSN

GTP Header includes protocol type (IPv4, IPv6), TEID and message type (signal or data) GTP path is identified by UDP/IP Socket ID (UDP port = 3386) Tunnel Endpoint Identifier (TEID) : Parameter in PDP context that is used by GTP to identify the bearer stream described by the context
1/17/2013AK
R

slide 38

SESSION MANAGEMENT (SM) & PACKET DATA PROTOCOL (PDP) CONTEXT

1/17/2013AK
R

slide 39

GPRS SUBSCRIPTION
GPRS subscription contains one or more PDP addresses A GPRS user with an IMSI can subscribe to zero, 1 or more static and dynamic PDP address per PDP type (IPv4, IPv6, PPP) Each PDP address is described by one or more PDP contexts in MS, SGSN, GGSN PDP context contains mapping and routing information for transferring PDP PDUs for a given PDP address between MS and GGSN
Set of parameters that uniquely distinguish one bearer stream from another on the same path Parameters include protocol type, source and destination address, serving GGSN address, and QoS for bearer stream

1/17/2013AK
R

slide 40

TRAFFIC FLOW TEMPLATE

PDP Address
Multiple associations

PDP Context

Null

TFT

When multiple PDP context exist for same PDP address of an MS, GGSN routes downlink N-PDUs to different GTP tunnels based on TFTs assigned to the PDP contexts Each PDP context may be associated at most with a Traffic Flow Template (TFT) At most one PDP context with no TFT assigned to it can exist for a given PDP address TFT can be modified by MS initiated PDP modification procedures

1/17/2013AK
R

slide 41

PDP CONTEXT STATE TRANSITIONS

ACTIVE PDP State
MM state of MS is either STANDBY or READY That is, MS is GPRS attached

INACTIVE

PDP Context Activation PDP Context De-activation

INACTIVE PDP State

MM state of MS is IDLE That is, MS is not registered or GPRS attached

ACTIVE

INACTIVE to ACTIVE state transition

MS or GGSN can initiate a PDP Context Activation procedure to move into ACTIVE PDP state

1/17/2013AK
R

slide 42

PDP ADDRESS ALLOCATION TO MS

Host PLMN (HPLMN) assigns PDP address to MS permanently (Static PDP address) HPLMN assigns PDP address to MS when a PDP context is activated (Dynamic HPLMN PDP address) Visiting PLMN (VPLMN) assigns PDP address to MS when a PDP context is activated (Dynamic VPLMN PDP address) PDN operator assigns IP address to MS after PDP context activation (External PDN address allocation)

1/17/2013AK
R

slide 43

ADDRESS TRANSLATION
For MS initiated PDP Contexts, SGSN translates
IMSI received from MS to a HLR address through GTT Access Point Name (APN) received from MS into a GGSN IP address through DNS server IMSI received from MS to VLR address through GTT IMSI received from MS to EIR address through GTT P-TMSI to TEID

For Network initiated PDP context activation, GGSN translates

IP address fetched from incoming PDU to IMSI IMSI from above to HLR address through GTT

1/17/2013AK
R

slide 44

PDP CONTEXT ACTIVATION

MS SGSN GGSN

Activate PDP Context Req (PDP type, PDP address, QoS req, APN) Security functions Create PDP Context Req (PDP type, PDP addr, QoS Req,..) Create PDP Context Res (PDP type, QoS negotiated)

Activate PDP Context Resp (PDP type, PDP addr, QoS negotiated..)

1/17/2013AK
R

slide 45

AIR INTERFACE (AI)

1/17/2013AK
R

slide 46

GSM AIR INTERFACE

960 959.8

935.2 935

124 123 2 1

Time slot TDMA frame - Downlink

200 KHz

1 2 3 4 5 6 7 8
Data burst, 156.25 bit periods = 15/26 ms

915 914.8

45 MHz separation between uplink and downlink

890.2 890
1/17/2013AK
R

124 123 2 1

200 KHz

Delay

1 2 3 4 5 6 7 8
TDMA frame -Uplink
Frame period = 15/26 8 = 4.613ms

slide 47

PHYSICAL CHANNELS IN GSM

Each of 200 KHz frequency channels is divided into 8 time slots to carry 8 tdm 8 time slots in these TDMA channels form a TDMA frame Time slot duration = 15/26 ms carrying 156.25 bits of data Duration of TDMA frame = 15/26 x 8 = 4.613 ms Recurrence of a time slot defines a physical channel

1/17/2013AK
R

slide 48

CHANNEL CODING IN GPRS

Channel coding scheme is quite similar to GSM GPRS defines four different channel coding schemes (code rates ~ , 2/3, and 1) Depending on the current radio channel quality, one of the coding schemes can provide high bit rate or forward error correction capability

1/17/2013AK
R

slide 49

AIR INTERFACE CHANNELS

Physical Channel
Transmitted over the air Defined by specific time slot and frequency

Transport Channel
How data is transmitted over the air Dedicated or Common Dedicated implies information is carried PTP, and MS is uniquely identified Common implies information is carried PTM, and MS is not uniquely identified

Logical Channel
What data is transmitted or type of data control or traffic Mapped onto a physical channel

1/17/2013AK
R

slide 50

LOGICAL CHANNELS IN GPRS

Group
Packet data traffic channel Packet Broadcast Control Channel Packet Common Control Channel (PCCCH)

Channel
PDTCH PBCCH PRACH PAGCH PPCH PNCH

Direction
MS BSS MS BSS MS BSS MS BSS MS BSS MS BSS

Function
Transfer of user data PTM channel to broadcast system information MS to request one or more PDTCH To allocate one or more PDTCH to a MS Used by BSS to page a MS Used by BSS to inform MS about incoming PTM messages (multicast or group call)

Packet Dedicated Control Channel (PDCCH)

PACCH

MS BSS

Associated with PDTCHs assigned to a MS. Contains signaling information specific to a MS (e.g., power control)
Used for adaptive frame synchronization

PTCCH
1/17/2013AK
R

MS BSS

slide 51

RADIO RESOURCE ALLOCATION

GSM
# of slots/Frame Channel allocation Single Permanent

GPRS
Multiple (1 to 8) Only during PDU transmission

MS uses same time slot in UL and DL

UL and DL allocated separately --- efficient support for asymmetric data transfer

1/17/2013AK
R

slide 52

SUMMARY
GPRS is an important step in the evolution toward 3G wireless systems GSM/GPRS System architecture Protocols in transmission and control planes GPRS Mobility Management (GMM) Session Management (SM) Air interface

1/17/2013AK
R

slide 53