No Slide Title
Download
Report
Transcript No Slide Title
GSM NETWORK OVERVIEW
Access Network:
Base Station Subsystem
Core Network:
GSM CS network
HLR
BTS
Mobile
VLR
BSC
EIR
AuC
SS7
MSC
Station
PSTN
BTS
Um
Abis
A
Slide
1
GSM NETWORK ARCHITECTURE
MS: Mobile Station
BSS: Base Station Subsystem
MSC: Mobile Switching Center
O&M: Operations and Maintenance Center
VLR, HLR, AuC, EiR …
CGSN
Slide
2
Prepared by E.Stambolliu, M.Koci & E.Kola
MOBILE STATION (MS)
Mobile Equipment (ME)
SIM: Subscriber Identity Module
While subscriber roams or is stationary, the MS
transmits a radio signal to one of the many BTS
using a radio-link protocol via the Um interface
Slide
3
THE BASE STATION SYSTEM (BSS)
All radio-related functions performed in BSS
The Base Station Controller (BSC)
Is a high-capacity switch
Provides all control functions and physical links between
the MSC and the BTS
A group of BSCs is served by an MSC
The Base Transceiver Station (BTS)
Handles the radio interface to the mobile unit
Consists of transceivers and cell antennas
A group of BTSs is controlled by a BSC
Slide
4
BSS (BASE STATION SUBSYSTEM)
BSC handles (through the Abis interface):
Radio-channel setup
Frequency hopping
Handovers
BSC also connects MS
to MSC using
A interface
Slide
5
BSS (BASE STATION SUBSYSTEM)
Sometimes a Transcoder Rate Unit (TRAU) is placed on BTS to
perform transcoding between 64 Kbps
A-law and 13 Kbps RPE/LTP(Regular Pulse Excited Long Term
Prediction) speech channels
HLR
BTS
VLR
BSC
EIR
AuC
SS7
MSC
PSTN
BTS
Um
Abis
A
TRAU
Slide
6
MOBILE SERVICES SWITCHING CENTER
The MSC performs the telephony switching
functions of the network
Controls calls to and from other telephone and data
systems
Interface between radio system and fixed networks
(PSTN and ISDN)
Connected to BSS through A interface; usually an E1,
either wireline or microwave
Also performs functions such as:
Toll ticketing
Network interfacing
Common channel signaling
Slide
7
MSC (MOBILE SWITCHING CENTER) (2)
Each MSC covers several cells (BSSs)
Slide
8
MSC (MOBILE SWITCHING CENTER) (3)
Also performs signaling between MSC and other
functional entities using SS7:
Registration
Authentication
Location updating
Handovers
Call routing to a roaming subscriber
Slide
9
OTHER GSM NETWORK ENTITIES
HLR: Home Location Register
VLR: Visitor Location Register
EIR: Equipment Identity Register
AuC: Authentication Center
Slide
10
HOME LOCATION REGISTER
The HLR is the most important database
Storage and management of subscriptions
Permanent data includes
Subscriber’s service profile
Subscriber’s location information
Subscriber’s activity status
Subscribing to a particular provider’s service
registers you in the HLR of that provider
Slide
11
HLR (HOME LOCATION REGISTER)
Central database for all subscribers:
Identity of the subscriber
Services accessible to the subscriber
Current location of the subscriber
Given a Mobile Subscriber ISDN number
(MS-ISDN), call is routed to IMSI number-VLR
Each subscriber appears only once in database
HLR might be physically distributed in several
sites (e.g., using first two digits to identify
physical HLR)
Slide
12
HLR TYPES
Slide
13
HLR CONNECTIONS
Slide
14
GSM-GPRS
Slide
15
GPRS SERVICES ACCORDING TO THE
BANDWIDTH AND BURSTINESS
Slide
16
GPRS(1)
Slide
17
GPRS(2)
Slide
18
GPRS(3)
Slide
19
GPRS(4)
Slide
20
GPRS(5)
Slide
21
GPRS-HLR
Slide
22
GPRS-MSC
Slide
23
GPRS-BSC
Slide
24
GPRS-BTS
Slide
25
GPRS PROTOCOL WITH BSS
Slide
26
VISITOR LOCATION REGISTER
The VLR contains temporary data about visiting (roaming)
subscribers
It’s always integrated with the MSC
When a roamer enters the service area the VLR queries the
appropriate HLR
If a roamer makes a call the VLR will already have the information
it needs for call setupDatabase with information on MS within area served
by MSC:
MS Roaming number
TMSI if applicable
Location area in which was last registered
Supplementary services
Used by an MSC to retrieve information for various purposes:
Handling of calls to or from a roaming mobile station currently located in its
area
Typically part of MSC
Slide
27
AUC (AUTHENTICATION CENTER)
Entity associated to HLR for authentication:
allow International Mobile Subscriber Identity
(IMSI) to be authenticated
Allows ciphering of communication over radio
path between mobile station and network
ciphered
Transmits data needed for authentication and
ciphering via HLR to VLR, MSC and SGSN
which need to authenticate a mobile station (SIM
validation)
Slide
28
Ki is stored in SIM card and AUC
Generate RAND
AUC
MS
RAND+Ki=SRES using A3
AUC
MS
If the SRES in MS is equal with SRES in AUC the subs is authenticated.
RAND+Ki=Kc using A8
AUC
MS
A3
This is an algorithm used to generate the Signed Response (SRES).
A8
This is an algorithm used to generate the Ciphering Key (Kc).
A3A8
This is an algorithm used to generate Signed Response (SRES) and Ciphering Key (Kc).
A4
This is an algorithm used for encryption/decryption of Ki.
Slide
29
EIR (EQUIPMENT IDENTITY REGISTER)
Logical entity responsible for storing
International Mobile Equipment Identities
(IMEIs) in network used in GSM system
Equipment classified as "white listed", "grey
listed” and "black listed”
Ensures that MEs being used are valid and
authorized to function on the Public Land Mobile
Network (PLMN)
Slide
30
OPERATION AND SUPPORT CENTER
Operation and Maintenance Center (OMC)
is connected with all the equipment in the switching
center and to the BSC
Network operation monitors and controls the system
Provides centralized cost-effective support
Provides a network overview at any moment
Supports maintenance and operational activities for
different organizations and groups
Slide
31
OTHER FUNCTIONAL ELEMENTS
Message Center (MXE) – handles voice, fax, and
data messaging
Mobile Service Node (MSN) – handles mobile
intelligent network (IN) services
Gateway Mobile Services Switching Center (GMSC)
– an MSC with a gateway that interconnects two
networks
GSM Interworking Unit (GIWU) – hardware and
software that enables both voice and data
Slide
32
CALL ROUTING
Slide
33
NORMAL LOCATION UPDATE
1. The MS requests a location update to be carried out in the
new MSC/VLR. The IMSI is used to identify the MS.
2. In the new MSC/VLR, an analysis of the IMSI number is carried
out. The result of this analysis is a modification of the IMSI to a
Mobile Global Title (MGT) which is used to address the HLR.
3. The new MSC/VLR requests the subscriber information for the
MS from the HLR
4 .The HLR stores the address of the new MSCIVLR
5. The HLR sends the subscriber data to the new MSC/VLR
6. The HLR also orders the old serving MSC/VLR to cancel all
information for the subscriber because the mobile subscriber is
now served by another MSC/VLR.
7.When the new MSC/VLR receives the information from the
HLR, it sends a location updating confirmation message to the
MS.
Slide
34
IMSI detach (switching off the terminal)
In the system information broadcast on the control channel (BCCH), the MS receives
information on whether the IMSI attach/detach function is used or not. If it is used, the MS
must inform the network when it is entering an inactive state (detach)
The following steps illustrate the whole procedure:
1. At power off or when the SIM card is taken out, the MS ask for a signaling channel.
2. The MS uses this signaling channel to send the IMSI detach message to the MSC/VLR.
3. In the VLR, an IMSI detach flag is set for the subscriber. This is used to reject incoming
calls to the MS.
IMSI attach (swithing on the terminal)
IMSI attach is the respective to the IMSI detach procedure when turning on the mobile terminal.
So it is used by the MS to inform the network that it has re-entered an active state and is still in the
same location area. If the MS changes location area while being switched off, a normal location
update takes place.
The IMSI attach procedure is as follows :
1. The MS requests a signaling channel.
2. The MSC/VLR receives the IMSI attach message from the MS.
3. The MSC/VLR sets the IMSI attach in the VLR. The mobile is now ready for
normal call handling
4. The VLR returns an acknowledgment to the MS.
Slide
35
GSM SPECIFICATIONS
Combination of FDMA and TDMA to send
information
Frequencies: 800, 900, 1800, 1900 MHz
For example, GSM 900:
Uplink = 890-915 MHz
Downlink = 935-960 MHz
Each 25 MHz bandwidth is divided into 124
carrier frequencies spaced 200 KHz with one or
more frequencies allocated to each base station
Transmission rate: 270 kbps over the air
Speech coder: Linear Predictive Coding (LPC) at
13 kbps – filter reduces the bit rate
Slide
36
GSM SPECIFICATIONS
Frequency range: 1,850 to 1,990 MHz
Duplex distance: 80 MHz
Channel separation: 200 kHz
Modulation: Gaussian minimum shift keying
Transmission rate: 270 kbps over the air
Access method: Time Division Multiple Access
Speech coder: Linear Predictive Coding (LPC) at 13 kbps
– filter reduces the bit rate
Slide
37
GSM Band Information
Slide
38
GSM NETWORK AREAS
In order of increasing geographic size:
Cell – the area covered by one BTS – a number of these
make up a:
Location Area (LA) – a group of cells – a group of LAs makes
up an:
MSC/VLR service area – area covered by one MSC – a
number of these make up the:
Public Land Mobile Network (PLMN) service area– one
operator’s network
Slide
39
Slide
40
CGI- Cell Global Identification
MCC-MNC-LAC-CI where:
MCC Mobile country code
MNC Mobile network code
LAC Location area code
CI Cell identity
Slide
41
Base Station Identity Code
Expressed as nccbcc where:
ncc
bcc
PLMN colour code
BS colour code
Slide
42
HANDOVER
Four types of handovers:
Channels (time slots) in same cell
Between cells within same BSC
Between BSCs, within same MSC
Between MSCs
Slide
43
Slide
44
Slide
45
Slide
46
Addressing of managed objects
MO
MO class
MO type
Addressing Limit
TG
Transceiver Group
RXOTG
0 <= tg <= 511
CF
Central Function
RXOCF
0 <= tg <= 511
TF
Timing Function
RXOTF
0 <= tg <= 511
IS
Interworking Switch
RXOIS
0 <= tg <= 511
DP
Digital Path
RXODP
0 <= dp <= 1
TRXC
Transceiver Controller
RXOTRX
0 <= trxc <= 15
RX
Receiver
RXORX
0 <= trxc <= 15
TX
Transmitter
RXOTX
0 <= trxc <= 15
TS
Time Slot
RXOTS
0 <= ts <= 7
Slide
47
DXU - Distribution Switch Unit functions
•CF
Central Function, is the control part of a TG. It is a SW function, handling common
control functions within a TG.
The BSC communicates with the CF using layer 2 LAPD, and is
addressed by its TEI = 62.
•CON
LAPD Concentrator, is used by the optional feature LAPD Concentration for RBS 2000. It is
connected to DCP 64&&87.
•IS
Interworking Switch, provides a system interface to the 2 Mbit/s link and cross connects
individual time slots to certain transceivers.
•TF
Timing Function, extracts synchronization information from the PCM link and generates a
timing reference for the RBS.
•DP
Digital Path, Layer 1 reception and transmission are not part of the BTS logical model.
However, each of the PCM systems terminating in TG has an associated supervision
Slide
object, the DP.
48
TRU - Transceiver Unit functions
TRXC The transceiver controller is controlling all the functions for Signal
processing, Radio receiving and Radio Transmitting.
Each TRX corresponds to one TRU unit.
The BSC currently supports a maximum of 1020 TRXs.
RX The receiver is an application object. It provides the radio frequency
reception functionality for one transceiver.
TX The transmitter is an application object. It provides the radio frequency
transmission functionality on a time slot basis for eight TSs using different time
slot numbers.
Slide
49
Managed Object Hierarchy
Slide
50
GSM INTERFACES
Um Interface
Mobile station and base station subsystem
communicate across Um interface, also known as
air interface or radio link
Abis interface
Base transceiver station (BTS) and base station
controller (BSC) communicate across Abis
interface
A interface
Base station subsystem communicates with
mobile service switching center across A interface
Slide
51
Slide
52
Slide
53
SIGNALING SYSTEM #7
54
SS#7 SIGNALING MEETS THESE NEEDS
Efficiency
Out-of-band links at 64 Kbps
Shorter information transfer time
Ability to fall back to the originating end of the call (e.g., busy)
Service enabling
Free phone (0-800) services
Automatic call back & calling number delivery
Automatic calling card services
Wireless services such as roaming
Network reliability
Carries extensive network management messages
Network architecture
Security
Slide
55
SS#7 DEFINITION
Common channel signaling system number 7
(SS#7)
Out-of-band signaling system
Facilitates exchange of call control information
between network switching offices
Voice and non-voice services
Slide
56
SS#7 BASICS
Voice and signaling are separated
Control messages (packets) are routed through
the network for call management
Network elements are connected via signaling
links
Each element capable of SS#7 control messages,
is called a signaling point (SP)
All SPs in an SS7 network are identified by a
unique code known as point code (PC)
Slide
57
SS#7 NETWORKS
Slide
58
SS#7 SIGNALING POINTS (1)
Service switching point (SSP)
Capable of controlling voice circuits via a voice switch
The switch can originate, terminate, or tandem calls
An SSP sends signaling messages to other SSPs to
set up, manage, and release voice circuits required to
complete a call
An SSP can also send a query message to a
centralized database (SCP) to determine how to route
a call (e.g., toll free 1-800 number)
Slide
59
SS#7 SIGNALING POINTS (2)
Signaling transfer point (STP)
Routes each incoming message to an outgoing
signaling link, based on routing information
contained in the SS#7 message and a pre-defined
route table
Does not offer termination services
STPs are paired to ensure redundancy
Slide
60
SS#7 SIGNALING POINTS (3)
Service control point (SCP)
Provides access to databases
Accepts a query for information from a subsystem at
another node
Used by STP to perform a function called global title
translation
The database may not reside in the same location as
the SCP
Slide
61
COMMON CHANNEL SIGNALING (1)
2 separate signaling links
using 2 time slots
Switch
SP
Switch
SP
E1 31 voice channels
using 31 time slots
Slide
62
COMMON CHANNEL SIGNALING (2)
1 signaling link and 30
voice channels
Switch
SP
Switch
SP
E1 31 voice channels
using 31 time slots
Slide
63
SIGNALING NETWORK TERMS
Voice trunks
Signaling Links
SP
SP
SP
STP
Associate Mode
Quasi-Associate Mode
Associate mode: signaling links follow the same path as the voice trunks
Quasi-associate mode: signaling links follows a different route than the voice
trunks
Slide
64
LINKSETS
Groups of links that connect two adjacent nodes
Ensure traffic load sharing
Combined linksets between STPs ensures load sharing
Consist of up to 16 links in ANSI protocol and up to 8 in ITU protocol
Signaling link code (SLC) is uniquely assigned to each link
Slide
65
ROUTES
Virtual path that a message takes to a destination node
Comprised of one or more linksets
Slide
66
First priority of signaling route
Second priority of signaling route
MEATA
AMC1
SP=2-901
LS=2-272
SP=2-272
LS=2-901
LS=2-903
MEATR
SP=2-903
AMC2
LS=2-256
SP=2-256
Slide
67
SS#7 PROTOCOL STACK
Slide
68
MTP
Message transfer part:
Reliably transfers messages over links or linksets
For correct routing, the signaling point needs the
signaling point code (SPC) of the node at the end of
its links
Receives the SPC by destination point code (DPC) in
the messages it routes
Needs information about other locations
in the network, to select the best link set
for routing the message to its destination
Slide
69
MTP LEVEL 3 MANAGEMENT SERVICES (1)
MTP level 3 provides signaling link selection
(SLS)
Rotates in each session
A mechanism to assign traffic to a link in the linkset
Results in load sharing of the links in the linkset
SLC rotation stops for duration of message transfer
Slide
70
MTP LEVEL 3 MANAGEMENT SERVICES (2)
MTP restart
Before returning to the network, a node can send
TRW (traffic restart wait) to an adjacent node,
indicating not to send traffic
When restarting, if the node is satisfied that enough
links are available, it is sends a TRA (traffic restart
allowed)
Optional signaling link test message
(SLTM) and signaling test acknowledge
(SLTA)
Exchanged when a link is in service; ensures
agreement on signaling link code
Slide
71
SCCP
Signaling connection control part:
Provides connectionless and connection-oriented
network services
Provides global title translation (GTT)
capabilities above MTP level 3; translates
numbers to DPCs and subsystem numbers
Provides more detailed addressing information
than MTPs
Used as transport layer for TCAP-based services
Slide
72
TCAP
Transaction capabilities applications part:
Exchange of non-circuit related data
Between applications across the SS#7 network
Using the SCCP connectionless service
Queries and responses sent between SSPs and
SCPs
Sends and receives database information
Credit card validation
Routing information
Slide
73
TUP
Telephone user part:
Basic call setup and tear down
Analog circuits only
In many countries, ISUP has replaced TUP for
call management
Slide
74
ISUP
ISDN user part:
Necessary messaging for setup and tear down of
all circuits (voice and digital)
Messages follow the paths of voice circuits
Messages are sent from a switch, to the switch
where the next circuit connection is required
Call circuits are identified using circuit
identification code (CIC)
Must be compatible on both sides
Followed by each ISUP message
Slide
75
ISUP MESSAGES (1)
Initial address message (IAM): contains all
necessary information for a switch to establish a
connection
Address complete message (ACM): acknowledge
to IAM; the required circuit is reserved and the
“phone is ringing” (ringback tone)
Answer message (ANM): occurs when the called
party picks up the phone
Slide
76
ISUP MESSAGES (2)
Release (REL): sent by the switch sensing that
the phone hung up
Release complete (RLC): each exchange that
receives REL, sends an RLC message back (this
acknowledges receipt of REL)
Slide
77
ISUP NORMAL CALL SCENARIO
Slide
78
Slide
79
Slide
80
Slide
81
Slide
82
GSM SUBSCRIBER SERVICES
There are two basic types of service
Telephony (teleservices): mainly voice services
(including terminal equipment) for communicating
with other subscribers – includes fax, paging, voice
mail, and alphanumeric services
Data (bearer services): capacity to transmit
appropriate data signals between two access points
creating an interface to the network
Slide
83
SUPPLEMENTARY SERVICES
The following are the usual revenue generators
Call forwarding
Barring outgoing calls
Advice of Charge (AoC)
Call hold (for telephony only)
Call waiting
Multiparty service (for telephony only)
Calling line identification presentation/restriction
Closed user groups (CUGs)
Slide
84