Transcript No Slide Title

GSM NETWORK OVERVIEW
Access Network:
Base Station Subsystem
Core Network:
GSM CS network
HLR
BTS
Mobile
VLR
BSC
EIR
AuC
SS7
MSC
Station
PSTN
BTS
Um
Abis
A
Slide
1
GSM NETWORK ARCHITECTURE
MS: Mobile Station
 BSS: Base Station Subsystem
 MSC: Mobile Switching Center
 O&M: Operations and Maintenance Center
 VLR, HLR, AuC, EiR …
 CGSN

Slide
2
Prepared by E.Stambolliu, M.Koci & E.Kola
MOBILE STATION (MS)
Mobile Equipment (ME)
 SIM: Subscriber Identity Module
 While subscriber roams or is stationary, the MS
transmits a radio signal to one of the many BTS
using a radio-link protocol via the Um interface

Slide
3
THE BASE STATION SYSTEM (BSS)
All radio-related functions performed in BSS
 The Base Station Controller (BSC)

Is a high-capacity switch
 Provides all control functions and physical links between
the MSC and the BTS
 A group of BSCs is served by an MSC


The Base Transceiver Station (BTS)
Handles the radio interface to the mobile unit
 Consists of transceivers and cell antennas
 A group of BTSs is controlled by a BSC

Slide
4
BSS (BASE STATION SUBSYSTEM)

BSC handles (through the Abis interface):
Radio-channel setup
 Frequency hopping
 Handovers


BSC also connects MS
to MSC using
A interface
Slide
5
BSS (BASE STATION SUBSYSTEM)

Sometimes a Transcoder Rate Unit (TRAU) is placed on BTS to
perform transcoding between 64 Kbps
A-law and 13 Kbps RPE/LTP(Regular Pulse Excited Long Term
Prediction) speech channels
HLR
BTS
VLR
BSC
EIR
AuC
SS7
MSC
PSTN
BTS
Um
Abis
A
TRAU
Slide
6
MOBILE SERVICES SWITCHING CENTER

The MSC performs the telephony switching
functions of the network
Controls calls to and from other telephone and data
systems
 Interface between radio system and fixed networks
(PSTN and ISDN)
 Connected to BSS through A interface; usually an E1,
either wireline or microwave
 Also performs functions such as:

Toll ticketing
 Network interfacing
 Common channel signaling

Slide
7
MSC (MOBILE SWITCHING CENTER) (2)

Each MSC covers several cells (BSSs)
Slide
8
MSC (MOBILE SWITCHING CENTER) (3)

Also performs signaling between MSC and other
functional entities using SS7:





Registration
Authentication
Location updating
Handovers
Call routing to a roaming subscriber
Slide
9
OTHER GSM NETWORK ENTITIES
HLR: Home Location Register
 VLR: Visitor Location Register
 EIR: Equipment Identity Register
 AuC: Authentication Center

Slide
10
HOME LOCATION REGISTER

The HLR is the most important database
Storage and management of subscriptions
 Permanent data includes

Subscriber’s service profile
 Subscriber’s location information
 Subscriber’s activity status


Subscribing to a particular provider’s service
registers you in the HLR of that provider
Slide
11
HLR (HOME LOCATION REGISTER)

Central database for all subscribers:
Identity of the subscriber
 Services accessible to the subscriber
 Current location of the subscriber

Given a Mobile Subscriber ISDN number
(MS-ISDN), call is routed to IMSI number-VLR
 Each subscriber appears only once in database
 HLR might be physically distributed in several
sites (e.g., using first two digits to identify
physical HLR)

Slide
12
HLR TYPES
Slide
13
HLR CONNECTIONS
Slide
14
GSM-GPRS
Slide
15
GPRS SERVICES ACCORDING TO THE
BANDWIDTH AND BURSTINESS
Slide
16
GPRS(1)
Slide
17
GPRS(2)
Slide
18
GPRS(3)
Slide
19
GPRS(4)
Slide
20
GPRS(5)
Slide
21
GPRS-HLR
Slide
22
GPRS-MSC
Slide
23
GPRS-BSC
Slide
24
GPRS-BTS
Slide
25
GPRS PROTOCOL WITH BSS
Slide
26
VISITOR LOCATION REGISTER

The VLR contains temporary data about visiting (roaming)
subscribers
It’s always integrated with the MSC
 When a roamer enters the service area the VLR queries the
appropriate HLR
 If a roamer makes a call the VLR will already have the information
it needs for call setupDatabase with information on MS within area served

by MSC:
MS Roaming number
 TMSI if applicable
 Location area in which was last registered
 Supplementary services
Used by an MSC to retrieve information for various purposes:
 Handling of calls to or from a roaming mobile station currently located in its
area
Typically part of MSC



Slide
27
AUC (AUTHENTICATION CENTER)
Entity associated to HLR for authentication:
allow International Mobile Subscriber Identity
(IMSI) to be authenticated
 Allows ciphering of communication over radio
path between mobile station and network
ciphered
 Transmits data needed for authentication and
ciphering via HLR to VLR, MSC and SGSN
which need to authenticate a mobile station (SIM
validation)

Slide
28
Ki is stored in SIM card and AUC
Generate RAND
AUC
MS
RAND+Ki=SRES using A3
AUC
MS
If the SRES in MS is equal with SRES in AUC the subs is authenticated.
RAND+Ki=Kc using A8
AUC
MS
A3
This is an algorithm used to generate the Signed Response (SRES).
A8
This is an algorithm used to generate the Ciphering Key (Kc).
A3A8
This is an algorithm used to generate Signed Response (SRES) and Ciphering Key (Kc).
A4
This is an algorithm used for encryption/decryption of Ki.
Slide
29
EIR (EQUIPMENT IDENTITY REGISTER)
Logical entity responsible for storing
International Mobile Equipment Identities
(IMEIs) in network used in GSM system
 Equipment classified as "white listed", "grey
listed” and "black listed”
 Ensures that MEs being used are valid and
authorized to function on the Public Land Mobile
Network (PLMN)

Slide
30
OPERATION AND SUPPORT CENTER

Operation and Maintenance Center (OMC)





is connected with all the equipment in the switching
center and to the BSC
Network operation monitors and controls the system
Provides centralized cost-effective support
Provides a network overview at any moment
Supports maintenance and operational activities for
different organizations and groups
Slide
31
OTHER FUNCTIONAL ELEMENTS
Message Center (MXE) – handles voice, fax, and
data messaging
 Mobile Service Node (MSN) – handles mobile
intelligent network (IN) services
 Gateway Mobile Services Switching Center (GMSC)
– an MSC with a gateway that interconnects two
networks
 GSM Interworking Unit (GIWU) – hardware and
software that enables both voice and data

Slide
32
CALL ROUTING
Slide
33
NORMAL LOCATION UPDATE
1. The MS requests a location update to be carried out in the
new MSC/VLR. The IMSI is used to identify the MS.
2. In the new MSC/VLR, an analysis of the IMSI number is carried
out. The result of this analysis is a modification of the IMSI to a
Mobile Global Title (MGT) which is used to address the HLR.
3. The new MSC/VLR requests the subscriber information for the
MS from the HLR
4 .The HLR stores the address of the new MSCIVLR
5. The HLR sends the subscriber data to the new MSC/VLR
6. The HLR also orders the old serving MSC/VLR to cancel all
information for the subscriber because the mobile subscriber is
now served by another MSC/VLR.
7.When the new MSC/VLR receives the information from the
HLR, it sends a location updating confirmation message to the
MS.
Slide
34
IMSI detach (switching off the terminal)
In the system information broadcast on the control channel (BCCH), the MS receives
information on whether the IMSI attach/detach function is used or not. If it is used, the MS
must inform the network when it is entering an inactive state (detach)
The following steps illustrate the whole procedure:
1. At power off or when the SIM card is taken out, the MS ask for a signaling channel.
2. The MS uses this signaling channel to send the IMSI detach message to the MSC/VLR.
3. In the VLR, an IMSI detach flag is set for the subscriber. This is used to reject incoming
calls to the MS.
IMSI attach (swithing on the terminal)
IMSI attach is the respective to the IMSI detach procedure when turning on the mobile terminal.
So it is used by the MS to inform the network that it has re-entered an active state and is still in the
same location area. If the MS changes location area while being switched off, a normal location
update takes place.
The IMSI attach procedure is as follows :
1. The MS requests a signaling channel.
2. The MSC/VLR receives the IMSI attach message from the MS.
3. The MSC/VLR sets the IMSI attach in the VLR. The mobile is now ready for
normal call handling
4. The VLR returns an acknowledgment to the MS.
Slide
35
GSM SPECIFICATIONS
Combination of FDMA and TDMA to send
information
 Frequencies: 800, 900, 1800, 1900 MHz
For example, GSM 900:

Uplink = 890-915 MHz
 Downlink = 935-960 MHz

Each 25 MHz bandwidth is divided into 124
carrier frequencies spaced 200 KHz with one or
more frequencies allocated to each base station
 Transmission rate: 270 kbps over the air
 Speech coder: Linear Predictive Coding (LPC) at
13 kbps – filter reduces the bit rate

Slide
36
GSM SPECIFICATIONS
Frequency range: 1,850 to 1,990 MHz
 Duplex distance: 80 MHz
 Channel separation: 200 kHz
 Modulation: Gaussian minimum shift keying
 Transmission rate: 270 kbps over the air
 Access method: Time Division Multiple Access
 Speech coder: Linear Predictive Coding (LPC) at 13 kbps
– filter reduces the bit rate

Slide
37
GSM Band Information
Slide
38
GSM NETWORK AREAS

In order of increasing geographic size:
Cell – the area covered by one BTS – a number of these
make up a:
 Location Area (LA) – a group of cells – a group of LAs makes
up an:
 MSC/VLR service area – area covered by one MSC – a
number of these make up the:
 Public Land Mobile Network (PLMN) service area– one
operator’s network

Slide
39
Slide
40
CGI- Cell Global Identification
MCC-MNC-LAC-CI where:
MCC Mobile country code
MNC Mobile network code
LAC Location area code
CI Cell identity
Slide
41
Base Station Identity Code
Expressed as nccbcc where:
ncc
bcc
PLMN colour code
BS colour code
Slide
42
HANDOVER

Four types of handovers:
Channels (time slots) in same cell
 Between cells within same BSC
 Between BSCs, within same MSC
 Between MSCs

Slide
43
Slide
44
Slide
45
Slide
46
Addressing of managed objects
MO
MO class
MO type
Addressing Limit
TG
Transceiver Group
RXOTG
0 <= tg <= 511
CF
Central Function
RXOCF
0 <= tg <= 511
TF
Timing Function
RXOTF
0 <= tg <= 511
IS
Interworking Switch
RXOIS
0 <= tg <= 511
DP
Digital Path
RXODP
0 <= dp <= 1
TRXC
Transceiver Controller
RXOTRX
0 <= trxc <= 15
RX
Receiver
RXORX
0 <= trxc <= 15
TX
Transmitter
RXOTX
0 <= trxc <= 15
TS
Time Slot
RXOTS
0 <= ts <= 7
Slide
47
DXU - Distribution Switch Unit functions
•CF
Central Function, is the control part of a TG. It is a SW function, handling common
control functions within a TG.
The BSC communicates with the CF using layer 2 LAPD, and is
addressed by its TEI = 62.
•CON
LAPD Concentrator, is used by the optional feature LAPD Concentration for RBS 2000. It is
connected to DCP 64&&87.
•IS
Interworking Switch, provides a system interface to the 2 Mbit/s link and cross connects
individual time slots to certain transceivers.
•TF
Timing Function, extracts synchronization information from the PCM link and generates a
timing reference for the RBS.
•DP
Digital Path, Layer 1 reception and transmission are not part of the BTS logical model.
However, each of the PCM systems terminating in TG has an associated supervision
Slide
object, the DP.
48
TRU - Transceiver Unit functions
TRXC The transceiver controller is controlling all the functions for Signal
processing, Radio receiving and Radio Transmitting.
Each TRX corresponds to one TRU unit.
The BSC currently supports a maximum of 1020 TRXs.
RX The receiver is an application object. It provides the radio frequency
reception functionality for one transceiver.
TX The transmitter is an application object. It provides the radio frequency
transmission functionality on a time slot basis for eight TSs using different time
slot numbers.
Slide
49
Managed Object Hierarchy
Slide
50
GSM INTERFACES
Um Interface
Mobile station and base station subsystem
communicate across Um interface, also known as
air interface or radio link
 Abis interface
Base transceiver station (BTS) and base station
controller (BSC) communicate across Abis
interface
 A interface
Base station subsystem communicates with
mobile service switching center across A interface

Slide
51
Slide
52
Slide
53
SIGNALING SYSTEM #7
54
SS#7 SIGNALING MEETS THESE NEEDS



Efficiency
 Out-of-band links at 64 Kbps
 Shorter information transfer time
 Ability to fall back to the originating end of the call (e.g., busy)
Service enabling
 Free phone (0-800) services
 Automatic call back & calling number delivery
 Automatic calling card services
 Wireless services such as roaming
Network reliability
 Carries extensive network management messages
 Network architecture
 Security
Slide
55
SS#7 DEFINITION
Common channel signaling system number 7
(SS#7)
 Out-of-band signaling system
 Facilitates exchange of call control information
between network switching offices
 Voice and non-voice services

Slide
56
SS#7 BASICS
Voice and signaling are separated
 Control messages (packets) are routed through
the network for call management
 Network elements are connected via signaling
links
 Each element capable of SS#7 control messages,
is called a signaling point (SP)
 All SPs in an SS7 network are identified by a
unique code known as point code (PC)

Slide
57
SS#7 NETWORKS
Slide
58
SS#7 SIGNALING POINTS (1)

Service switching point (SSP)
Capable of controlling voice circuits via a voice switch
 The switch can originate, terminate, or tandem calls
 An SSP sends signaling messages to other SSPs to
set up, manage, and release voice circuits required to
complete a call
 An SSP can also send a query message to a
centralized database (SCP) to determine how to route
a call (e.g., toll free 1-800 number)

Slide
59
SS#7 SIGNALING POINTS (2)

Signaling transfer point (STP)
Routes each incoming message to an outgoing
signaling link, based on routing information
contained in the SS#7 message and a pre-defined
route table
 Does not offer termination services
 STPs are paired to ensure redundancy

Slide
60
SS#7 SIGNALING POINTS (3)

Service control point (SCP)
Provides access to databases
 Accepts a query for information from a subsystem at
another node
 Used by STP to perform a function called global title
translation
 The database may not reside in the same location as
the SCP

Slide
61
COMMON CHANNEL SIGNALING (1)
2 separate signaling links
using 2 time slots
Switch
SP
Switch
SP
E1 31 voice channels
using 31 time slots
Slide
62
COMMON CHANNEL SIGNALING (2)
1 signaling link and 30
voice channels
Switch
SP
Switch
SP
E1 31 voice channels
using 31 time slots
Slide
63
SIGNALING NETWORK TERMS
Voice trunks
Signaling Links
SP
SP
SP
STP
Associate Mode


Quasi-Associate Mode
Associate mode: signaling links follow the same path as the voice trunks
Quasi-associate mode: signaling links follows a different route than the voice
trunks
Slide
64
LINKSETS





Groups of links that connect two adjacent nodes
Ensure traffic load sharing
Combined linksets between STPs ensures load sharing
Consist of up to 16 links in ANSI protocol and up to 8 in ITU protocol
Signaling link code (SLC) is uniquely assigned to each link
Slide
65
ROUTES
Virtual path that a message takes to a destination node
 Comprised of one or more linksets

Slide
66
First priority of signaling route
Second priority of signaling route
MEATA
AMC1
SP=2-901
LS=2-272
SP=2-272
LS=2-901
LS=2-903
MEATR
SP=2-903
AMC2
LS=2-256
SP=2-256
Slide
67
SS#7 PROTOCOL STACK
Slide
68
MTP
Message transfer part:
 Reliably transfers messages over links or linksets
 For correct routing, the signaling point needs the
signaling point code (SPC) of the node at the end of
its links
 Receives the SPC by destination point code (DPC) in
the messages it routes
 Needs information about other locations
in the network, to select the best link set
for routing the message to its destination
Slide
69
MTP LEVEL 3 MANAGEMENT SERVICES (1)

MTP level 3 provides signaling link selection
(SLS)
Rotates in each session
 A mechanism to assign traffic to a link in the linkset
 Results in load sharing of the links in the linkset
 SLC rotation stops for duration of message transfer

Slide
70
MTP LEVEL 3 MANAGEMENT SERVICES (2)

MTP restart
Before returning to the network, a node can send
TRW (traffic restart wait) to an adjacent node,
indicating not to send traffic
 When restarting, if the node is satisfied that enough
links are available, it is sends a TRA (traffic restart
allowed)


Optional signaling link test message
(SLTM) and signaling test acknowledge
(SLTA)

Exchanged when a link is in service; ensures
agreement on signaling link code
Slide
71
SCCP
Signaling connection control part:
 Provides connectionless and connection-oriented
network services
 Provides global title translation (GTT)
capabilities above MTP level 3; translates
numbers to DPCs and subsystem numbers
 Provides more detailed addressing information
than MTPs
 Used as transport layer for TCAP-based services
Slide
72
TCAP
Transaction capabilities applications part:
 Exchange of non-circuit related data
Between applications across the SS#7 network
 Using the SCCP connectionless service

Queries and responses sent between SSPs and
SCPs
 Sends and receives database information

Credit card validation
 Routing information

Slide
73
TUP
Telephone user part:
 Basic call setup and tear down
 Analog circuits only
 In many countries, ISUP has replaced TUP for
call management
Slide
74
ISUP
ISDN user part:
 Necessary messaging for setup and tear down of
all circuits (voice and digital)
 Messages follow the paths of voice circuits
 Messages are sent from a switch, to the switch
where the next circuit connection is required
 Call circuits are identified using circuit
identification code (CIC)


Must be compatible on both sides
Followed by each ISUP message
Slide
75
ISUP MESSAGES (1)
Initial address message (IAM): contains all
necessary information for a switch to establish a
connection
 Address complete message (ACM): acknowledge
to IAM; the required circuit is reserved and the
“phone is ringing” (ringback tone)
 Answer message (ANM): occurs when the called
party picks up the phone

Slide
76
ISUP MESSAGES (2)
Release (REL): sent by the switch sensing that
the phone hung up
 Release complete (RLC): each exchange that
receives REL, sends an RLC message back (this
acknowledges receipt of REL)

Slide
77
ISUP NORMAL CALL SCENARIO
Slide
78
Slide
79
Slide
80
Slide
81
Slide
82
GSM SUBSCRIBER SERVICES

There are two basic types of service
Telephony (teleservices): mainly voice services
(including terminal equipment) for communicating
with other subscribers – includes fax, paging, voice
mail, and alphanumeric services
 Data (bearer services): capacity to transmit
appropriate data signals between two access points
creating an interface to the network

Slide
83
SUPPLEMENTARY SERVICES

The following are the usual revenue generators








Call forwarding
Barring outgoing calls
Advice of Charge (AoC)
Call hold (for telephony only)
Call waiting
Multiparty service (for telephony only)
Calling line identification presentation/restriction
Closed user groups (CUGs)
Slide
84