1

Objectives
NamethethreesubsystemsofGSM. Explainthemobilityconcept(handover,location update,paging). Describehowmobileoriginatedandmobile terminatedcallsarehandledinGSM. Explaintheconceptofsecurity.

preparedby:Engr.ArisCondino

Base Transceiver Station

BaseStation Subsystem

NetworkSwitching Subsystem GatewayMSC

Visitor Location Register

AirInterface

Abis Interface

MobileSwitchingCenter AInterface

HomeLocation Register

Mobile Station
preparedby:Engr.ArisCondino

BaseStation Controller

Network Management Subsystem

Short Message Service Center

3

GSM subsystems
GMSC HLR

NSS

NSSFunctions: 1.MobilityManagement 2.SubscriberDataHandling 3.Signalling (towardsother networkelements) 4.CallControl 5.Charging 6.Locatingasubsformobile terminatedcalls.

MSC VLR
A O&M

BSS

BSC

A-bis

Air

NMS MS

preparedby:Engr.ArisCondino

GSM subsystems
GMSC HLR

NSS

BSSFunctions: 1.RadioPathControl,BTSand TCcontrol,SyncwithMSC. 2.AirandAinterfacesignalling, Connectionestablishment. 3.Mobilitymanagement, SpeechTranscoding 4.CollectionofStatisticaldata

MSC VLR
A O&M

BSS

BSC

A-bis

Air

NMS MS

preparedby:Engr.ArisCondino

GSM subsystems
GMSC HLR

NSS

NMSFunctions: 1.FaultManagement 2.ConfigurationManagement 3.PerformanceManagement

MSC VLR
A O&M

BSS

BSC

A-bis

Air

NMS MS

preparedby:Engr.ArisCondino

MobileStation
Whatisamobilestation?
AdeviceabletoaccessservicesinaGSMnetworkvia theAirinterface.

+
Mobile Equipment
preparedby:Engr.ArisCondino

=
Subscriber Identity Module Mobile Station

Air Interface GSM Network

7

MobileEquipment
IMEI(InternationalMobileEquipmentIdentification)

preparedby:Engr.ArisCondino

SubscriberIdentificationModule
IMSI
InternationalMobileSubscriberIdentity

ICCID
InternationalCompactCardIdentification UniqueSIMmanufacturingnumber

preparedby:Engr.ArisCondino

MSISDN = CC +NDC +SN CC = Country Code NDC = National Destination Code SN = Subscriber # IMSI = MCC + MNC + MSIN ( fixed 15 digits ) MCC = Mobile Country Code MNC = Mobile Network Code MSIN = Mobile Subscriber Identification # LAI = MCC + MNC + LAC MCC = Mobile Country Code (of visiting country) MNC = Mobile Network Code(of serving PLMN) LAC = Location Area Code

preparedby:Engr.ArisCondino

10

FirsttimeLocationUpdate(1)
HLRDB
MSISDN IMSI VLRAddressSub.Data 62+898+8983725310+02+1234567890vlr2services

HLR IMSIRequest MSC VLR1 MSC VLR2 Authen BSC 1 BTS 1

LocUp
IMSI
MS

LocUp+TMSI LAI1

11

MS

BSS

MSC

VLR

HLR

LOCATION UPDATE REQUEST REQUEST SUBS ID SEND SUBS ID REQUEST SUBS INFO SEND SUBS INFO AUTHENTICATION AUTHENTICATION RESPONSE HLR UPDATE

preparedby:Engr.ArisCondino

12

CallEstablishment(PSTNOMT)
HLRDB
MSISDN IMSI VLRAddressSub.Data 62+898+8983725310+02+1234567890vlr2services

HLR
HLR Enquiry
MSISDN

IMSI=MCC+MNC+MSIN

IMSI MSC VLR2 VLR1 BSC 1

DATA services

PSTN MSISDN

MSC

BTS 1

MS

B B

VLRDB
IMSI MSRN LAI 310+02+1234567890 1 MSRN POOL

LAI1

A
MSISDN(B) CC+NDC+SN 639189499247

MSRN=CC+NDC+SN

13

CallEstablishment(MOPSTNT)
HLR
MSISDN(A) CC+NDC+SN 6325113580

MSISDN

PSTN

MSC VLR1

MSC VLR2

BSC 1

BTS 1

MS

LAI1 A

14

CallEstablishment(MOMT)
HLRDB
MSISDN IMSI VLRAddressSub.Data 62+898+8983725310+02+1234567890vlr1services

HLR
IMSI=MCC+MNC+MSIN

IMSI MSC VLR1 VLRDB

IMSIMSRNLAIServices 2 Speech

HLREnquiry MSISDN

MSISDN BSC 1 BTS 1

MS

MSC VLR2

B B

LAI1 BTS 2 C
MSISDN(C) CC+NDC+SN 639189499247

MSRN MSRN=CC+NDC+SN

BSC 2

MS

LAI2
15

GenericLocationUpdate
HLR
Delold data Update TMSI SubscriberInfo TMSI+LAI

MSC VLR1

MSC

IMSI SecurityInfo

BTS BSC Authentication 1 VLR2 1 LocUp+newTMSI

MS

LAI1

16

Handover(1)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 MeasurementReport BTS2 BTS3 BTS4

B
preparedby:Engr.ArisCondino

17

Handover(2)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4

BIamOK
preparedby:Engr.ArisCondino

18

Handover(3)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4

MeasurementReport
preparedby:Engr.ArisCondino

B
19

Handover(4)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4

BIamOK
preparedby:Engr.ArisCondino

20

Handover(5)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4

MeasurementReport
preparedby:Engr.ArisCondino

B
21

Handover(6)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4 IamOK
22

B
preparedby:Engr.ArisCondino

Handover(7)
HLR

PSTN

MSC/VLR1

MSC/VLR2

BSC1

BSC2

BSC3

A
BTS1 BTS2 BTS3 BTS4

B
preparedby:Engr.ArisCondino

23

AC
RAND Ki

VLR

BTS

AirInterface

ME

SIM

A3

SRES

COMPARING

Authentication

SRES

A3

Ki

RequestofIMEI

EIR

IMEIChecking
Traffic

ME
ProvideIMEI

Ciphering
A5

Traffic
Kc

A8

Kc

EncryptedData EncryptedData A5

A8

TDMAFN

TDMAFN
24

Objectives
Differentiatebetweenphysicalandlogical channels. Listanddescribethetwelvedifferenttypesof logicalchannelsandtheirfunctions. Describehowairinterfacepropertiesaffectthe transmissionofspeechbetweenMSandnetwork andexplainGSMsolutionstotheseproblems. List3BSC/BTSconnections.

preparedby:Engr.ArisCondino

25

FRAME STRUCTURE
1 TDMA Frame = 8 TDMA Time Slots 4.615 ms

Basic TDMA frame, timeslot and burst structure Tail

000

Flag Data F Training F 57 1 26 1

Data
Or Speech

Tail 3

57

Burst 148 bits 156.25 bits 0.577 ms

preparedby:Engr.ArisCondino

26

LOGICAL CHANNELS Oneveryphysicalchannel,anumberof logicalchannelsaremapped.Eachlogical channelisusedforaspecificpurpose.

11 LogicalChannels intheGSMsystem:
2 areusedforTraffic 9 areusedforControlSignaling

preparedby:Engr.ArisCondino

27

LOGICALCHANNELS
TRAFFICCHANNELS(TCH) FullRateChannel HalfRateChannel CONTROLCHANNELS(withhorribleabbreviations!) BroadcastChannels(BCH) FrequencyCorrectionChannel(FCCH) SynchronizationChannel(SCH) BroadcastControlChannel(BCCH) CommonControlChannels(CCCH) PagingChannel(PCH) RandomAccessChannel(RACH) AccessGrantChannel(AGCH) DedicatedControlChannels(DCCH) StandaloneDedicatedControlChannel(SDCCH) SlowAssociatedControlChannel(SACCH) FastAssociatedControlChannel(FACCH)

preparedby:Engr.ArisCondino

28

CHANNEL CONFIGURATION :
Time Slots and Frames:
Hyperframe = 2048 Superframes

Superframe=26X51 or 51X26 Multiframes

24 25
26 Multiframe =120 ms

49 50
51 Multiframe =235 ms

7
TDMA frame = 4.615 ms

preparedby:Engr.ArisCondino

29

CHANNEL CONFIGURATION :
Logical Channels, DOWNLINK
COMMON CHANNELS
FCCH SCH BCCH PCH AGCH

BCH CCCH

DEDICATED CHANNELS
SDCCH SACCH FACCH TCH TCH
preparedby:Engr.ArisCondino

DCCH TCH
30

CHANNEL CONFIGURATION :
Logical Channels, UPLINK
COMMON CHANNELS

RACH

CCCH

DEDICATED CHANNELS
SDCCH SACCH FACCH TCH TCH
preparedby:Engr.ArisCondino

DCCH TCH
31

BROADCAST CHANNELS all downlink! Hey. Im a

GSM xmitter!

GSM?

FCCH

GSM!!! SCH TDMA#BSIC...

BCCH LAneigborscell infomax power... Hey! Dont shout at me, lower your power...

Okok

preparedby:Engr.ArisCondino

32

COMMON CONTROL CHANNELS

Hello! You have a call.

PCH downlink only

Hello! I have to set up a call. I need SDCCH.

RACH uplink only

AGCH downlink only

Ok. Use SDCCH.

preparedby:Engr.ArisCondino

33

DEDICATED CONTROL CHANNELS uplink and downlink On SDCCH:

-call set up signaling -location updating -periodic registration -IMSI attach/detach -SMS -facsimile etc.. On SACCH -mobile transmits signal strength on ncell quality Dont shout at me I cant hear you

SDCCH

SACCH timing advance MS power FACCH handover

preparedby:Engr.ArisCondino

34

4.615ms
TS0TS1TS2TS3TS4TS5TS6TS7

4.615ms
TS0TS1TS2TS3TS4TS5TS6TS7

F=FCCH S=SCH B=BCCH C=PCHor AGCH D=SDCCH A=SACCH T=TCH

FDTTTTTT SDTTTTTT BDTTTTTT BDTTTTTT BDTTTTTT BDTTTTTT CDTTTTTT CDTTTTTT CDTTTTTT CDTTTTTT FDTTTTTT SDTTTTTT CDATATAT CDTTTTTT CDTTTTTT CDTTTTTT
. . . . . . . . . . . . . . . . . . . . . . . .

R=RACH A=SACCH T=TCH

RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDTTTTTT RDAIAIAI RDTTTTTT RDTTTTTT RDTTTTTT
. . . . . . . . . . . . . . . . . . . . . . . .

1Frame (Downlink BTStransmit) 1carrier=200kHz

1Frame (Uplink Mobiletransmit) 1carrier=200kHz

35

CHANNEL CONFIGURATION :

200 KHz 4.615 ms .577 ms

FCCH SCH BCCH PCH RACH AGCH

SDCCH SACCH CBCH

TCH SACCH FACCH

TCH SACCH FACCH

TCH SACCH FACCH

TCH SACCH FACCH

TCH SACCH FACCH

TCH SACCH FACCH

preparedby:Engr.ArisCondino

36

CHANNEL CONFIGURATION :
Configuration of Signaling Channels:
Combined Configuration 0 7

RTSL 0 = BCCH, SDCCH/4, PCH, AGCH

Separated Configuration 0 7

RTSL 1 = SDCCH/8 RTSL 0 = BCCH, PCH, AGCH

preparedby:Engr.ArisCondino

37

CHANNEL CONFIGURATION :
Combined CCCH/SDCCH/4 Multiframe:
Downlink
51 TDMA Frame = 235 ms

f s b b b b c c c cf s c c c cc c c c f s t t t tt t t t f s t t t tt t t t f s s s s ss s s s i

Uplink
t t t t r r s s s ss s s s r rr r r r r r r r r rr r r r r r r r r rr t t t t t t t t rr t t t t

0
Channels:

50

f = FCCH b = BCCH r = RACH i = idle s = SCH/SACCH c = CCCH ( either PCH or AGCH )

preparedby:Engr.ArisCondino

38

CHANNEL CONFIGURATION :
BCCH/CCCH Multiframe:
Downlink
51 TDMA Frame = 235 ms

f s b b b b c c c cf s c c c cc c c c f s c c c cc c c c f s c c c cc c c c f s c c c cc c c c i

Uplink
r r r r r r r r r rr r r r r rr r r r r r r r r rr r r r r r r r r rr r r r r r r r r rr r r r r

0
Channels:

50

f = FCCH s = SCH
preparedby:Engr.ArisCondino

b = BCCH r = RACH i = idle c = CCCH ( either PCH or AGCH )

39

CHANNEL CONFIGURATION :
SDCCH/8 Multiframe:
Downlink
51 TDMA Frame = 235 ms

t t t t t t t t t tt t t t t tt t t t t t t t t tt t t t t t s s s ss s s s s s s s s ss s i i i

1
Uplink

s s s s s s s s s ss s i i i t t t t t t t t t tt t t t t tt t t t t t t t t tt t t t t t t t t t

0
Channels:

50

t = SDCCH

s = SACCH

i = idle

preparedby:Engr.ArisCondino

40

CHANNEL CONFIGURATION :

Full Rate Traffic Channel ( TCH ) Multiframe:

Downlink and Uplink
26 TDMA Frame = 120 ms

tt t t t t t t t t t t t s t t t t t t t t t t t t i

Channels:

t = TCH

s = SACCH

i = idle

preparedby:Engr.ArisCondino

41

42

IdleModeTask
PLMNselection Cellselection Cellreselection Locationupdating.

preparedby:Engr.ArisCondino

43

IDLE MODE

preparedby:Engr.ArisCondino

44

Automatic Mode
PLMNselection Cellselection Cellreselection Locationupdating.

preparedby:Engr.ArisCondino

45

Normal Cell Reselection

CellisconsiderSuitableif: ItbelongtothesameselectedPLMN Cellisnotbarred Itdoesnotbelongtolocationareaincludedinthelistof forbiddenLAforroaming

preparedby:Engr.ArisCondino

46

Cell Selection
SearchAllRFChannels 35sectogetthelist Tunetothecarrierw/highestsignalstrength

Getinfo(BSIC,BCCH)>ex.BAList

CellSelection

preparedby:Engr.ArisCondino

47

Cell Reselection
ContinuousMakeMeasurement (NeighboringBCCH)

BSIC Servingcell Sixneighbours

BCCHdata atleastevery30s

atleastevery30s atleastevery5 min ReselecttothebestCell

preparedby:Engr.ArisCondino

48

49