UNIT II

MOBILE TELECOMMUNICATION SYSTEM

GSM: Architecture, Protocols, Connection

Establishment, Frequency Allocation, Routing,
Mobility Management, Security, GPRS, UMTS,
Architecture.
Mobile station MS
GSM public land mobile network (PLMN)
Public switched telephone network (PSTN)
terminal TE
Integrated Services Digital Network (ISDN)
Integrated Services Digital Network
 GSM System architecture
• A GSM system consists of three subsystems, the radio sub system (RSS), the
network and switching subsystem (NSS), and the operation subsystem (OSS).

• Generally, a GSM customer only notices a very small fraction of the whole network –
the mobile stations (MS) and some antenna masts of the base transceiver stations
(BTS).
Base station subsystem (BSS): A GSM network comprises many BSSs, each
controlled by a base station controller (BSC). The BSS performs all functions
necessary to maintain radio connections to an MS, coding/decoding of voice, and
rate adaptation to/from the wireless network part. Besides a BSC, the BSS contains
several BTSs.

Base transceiver station (BTS): A BTS comprises all radio equipment, i.e., antennas,
signal processing, amplifiers necessary for radio transmission. A BTS can form a
radio cell or, using sectorized antennas, several cells, and is connected to MS via the
Um interface (ISDN U interface for mobile use), and to the BSC via the A bis interface.
The Um interface contains all the mechanisms necessary for wireless transmission
(TDMA, FDMA etc.). The Abis interface consists of 16 or 64 kbit/s connections. A
GSM cell can measure between some 100 m and 35 km depending on the
environment (buildings, open space, mountains etc.) but also expected traffic.
Base transceiver station (BTS)
Base station controller (BSC)
Mobile station (MS)
Mobile services switching center (MSC)
Home location register (HLR)
Visitor location register (VLR)
Operation and maintenance center (OMC)
Authentication centre (AuC)
Equipment identity register (EIR)
 Radio subsystem
• As the name implies, the radio subsystem (RSS) comprises all radio specific entities,
i.e., the mobile stations (MS) and the base station subsystem (BSS).

• The A interface (solid lines) is the connection between the RSS and the NSS and the
connection to the OSS via the O interface (dashed lines).
Subscriber identity module (SIM)
International mobile equipment identity (IMEI)
 Mobile services switching centre (MSC)
• MSCs are high-performance digital ISDN switches. They set up connections to other
MSCs and to the BSCs via the A interface, and form the fixed backbone network of a
GSM system.
• Typically, an MSC manages several BSCs in a geographical region. A gateway MSC
(GMSC) has additional connections to other fixed networks, such as PSTN and ISDN.
Using additional interworking functions (IWF), an MSC can also connect to public data
networks (PDN) such as X.25.
• An MSC handles all signaling needed for connection setup, connection release and
handover of connections to other MSCs. The standard signaling system No. 7 (SS7) is
used for this purpose.
• Features of SS7 are number portability, free phone/toll/collect/credit calls, call
forwarding, three-way calling etc. An MSC also performs all functions needed for
supplementary services such as call forwarding, multi-party calls, reverse charging etc.
 Home location register (HLR)
• The HLR is the most important database in a GSM system as it stores all user-relevant
information. This comprises static information, such as the mobile subscriber ISDN
number (MSISDN), subscribed services (e.g., call forwarding, roaming restrictions,
GPRS), and the international mobile subscriber identity (IMSI).
• Dynamic information is also needed, e.g., the current location area (LA) of the MS, the
mobile subscriber roaming number (MSRN), the current VLR and MSC.
• As soon as an MS leaves its current LA, the information in the HLR is updated. This
information is necessary to localize a user in the worldwide GSM network. All these
user-specific information elements only exist once for each user in a single HLR, which
also supports charging and accounting.
• HLRs can manage data for several million customers and contain highly specialized data
bases which must fulfill certain real-time requirements to answer requests within
certain time-bounds.
 Visitor location register (VLR)
• The VLR associated to each MSC is a dynamic database which stores all
important information needed for the MS users currently in the LA that is
associated to the MSC (e.g., IMSI, MSISDN, HLR address).

• If a new MS comes into an LA the VLR is responsible for, it copies all

relevant information for this user from the HLR. This hierarchy of VLR and
HLR avoids frequent HLR updates and long-distance signaling of user
information.

• Some VLRs in existence, are capable of managing up to one million

customers.
 Operation subsystem

• The third part of a GSM system, the operation subsystem (OSS), contains
the necessary functions for network operation and maintenance.

• The OSS possesses network entities of its own and accesses other entities
via SS7 signaling.
 Operation and maintenance center (OMC)

• The OMC monitors and controls all other network entities via the O
interface (SS7 with X.25).

• Typical OMC management functions are traffic monitoring, status reports

of network entities, subscriber and security management, or accounting
and billing.

• OMCs use the concept of telecommunication management network (TMN)

as standardized by the ITU-T.
 Authentication centre (AuC)

• As the radio interface and mobile stations are particularly vulnerable, a

separate AuC has been defined to protect user identity and data
transmission.

• The AuC contains the algorithms for authentication as well as the keys for
encryption and generates the values needed for user authentication in the
HLR.

• The AuC may, in fact, be situated in a special protected part of the HLR.
 Equipment identity register (EIR)
• The EIR is a database for all IMEIs, i.e., it stores all device identifications
registered for this network. As MSs are mobile, they can be easily stolen.
With a valid SIM, anyone could use the stolen MS. The EIR has a blacklist of
stolen (or locked) devices.

• In theory an MS is useless as soon as the owner has reported a theft.

Unfortunately, the blacklists of different providers are not usually
synchronized and the illegal use of a device in another operator’s network
is possible.

• The EIR also contains a list of valid IMEIs (white list), and a list of
malfunctioning devices (gray list).
 Protocols
• The main interest lies in the Um interface, as the other interfaces occur
between entities in a fixed network.
• Layer 1, the physical layer, handles all radio-specific functions. This
includes the creation of bursts according to the five different formats,
multiplexing of bursts into a TDMA frame, synchronization with the BTS,
detection of idle channels, and measurement of the channel quality on the
downlink.
• The physical layer at Um uses GMSK for digital modulation and performs
encryption/decryption of data, i.e., encryption is not performed
end-to-end, but only between MS and BSS over the air interface.
 Protocols
• Synchronization also includes the correction of the individual path delay
between an MS and the BTS.

• All MSs within a cell use the same BTS and thus must be synchronized to
this BTS. The BTS generates the time-structure of frames, slots etc.

• A problematic aspect in this context are the different round trip times
(RTT). An MS close to the BTS has a very short RTT, whereas an MS 35 km
away already exhibits an RTT of around 0.23 ms.
 Protocols
• The main tasks of the physical layer comprise channel coding and error
detection/correction, which is directly combined with the coding
mechanisms.
• Channel coding makes extensive use of different forward error correction
(FEC) schemes. FEC adds redundancy to user data, allowing for the
detection and correction of selected errors. The power of an FEC scheme
depends on the amount of redundancy, coding algorithm and further
interleaving of data to minimize the effects of burst errors. The FEC is also
the reason why error detection and correction occurs in layer one and not
in layer two as in the ISO/OSI reference model. The GSM physical layer
tries to correct errors, but it does not deliver erroneous data to the higher
layer.
 Protocols
• As voice was assumed to be the main service in GSM, the physical layer
also contains special functions, such as voice activity detection (VAD),
which transmits voice data only when there is a voice signal.
• This mechanism helps to decrease interference as a channel might be
silent approximately 60 per cent of the time (under the assumption that
only one person speaks at the same time and some extra time is needed to
switch between the speakers).
• During periods of silence (e.g., if a user needs time to think before talking),
the physical layer generates a comfort noise to fake a connection
(complete silence would probably confuse a user), but no actual
transmission takes place. The noise is even adapted to the current
background noise at the communication partner’s location.
 Protocols
• Signaling between entities in a GSM network requires higher layers. For
this purpose, the LAPDm protocol has been defined at the Um interface for
layer two.
• LAPDm, as the name already implies, has been derived from link access
procedure for the D-channel (LAPD) in ISDN systems.
• LAPDm offers reliable data transfer over connections, re-sequencing of
data frames, and flow control.
• As there is no buffering between layer one and two, LAPDm has to obey
the frame structures, recurrence patterns etc. defined for the Um
interface. Further services provided by LAPDm include segmentation and
reassembly of data and acknowledged/unacknowledged data transfer.
 Protocols
• The network layer in GSM, layer three, comprises several sublayers. The
lowest sublayer is the radio resource management (RR).

• Only a part of this layer, RR’, is implemented in the BTS, the remainder is
situated in the BSC.

• The functions of RR’ are supported by the BSC via the BTS management
(BTSM).

• The main tasks of RR are setup, maintenance, and release of radio

channels. RR also directly accesses the physical layer for radio information
and offers a reliable connection to the next higher layer.
 Protocols
• Mobility management (MM) contains functions for registration,
authentication, identification, location updating, and the provision of a
temporary mobile subscriber identity (TMSI) that replaces the
international mobile subscriber identity (IMSI) and which hides the real
identity of an MS user over the air interface.

• While the IMSI identifies a user, the TMSI is valid only in the current
location area of a VLR. MM offers a reliable connection to the next higher
layer.
 Protocols
• The call management (CM) layer contains three entities: call control (CC),
short message service (SMS), and supplementary service (SS).
• SMS allows for message transfer using the control channels SDCCH and
SACCH. CC provides a point-to-point connection between two terminals
and is used by higher layers for call establishment, call clearing and change
of call parameters. This layer also provides functions to send in-band
tones, called dual tone multiple frequency (DTMF), over the GSM network.
These tones are used, e.g., for the remote control of answering machines
or the entry of PINs in electronic banking and are, also used for dialing in
traditional analog telephone systems. These tones cannot be sent directly
over the voice codec of a GSM MS, as the codec would distort the tones.
They are transferred as signals and then converted into tones in the fixed
network part of the GSM system.
 Protocols
• Additional protocols are used at the Abis and A interfaces. Data
transmission at the Physical layer typically uses pulse code modulation
(PCM) systems. While PCM systems offer transparent 64 kbit/s channels,
GSM also allows for the submultiplexing of four 16 kbit/s channels into a
single 64 kbit/s channel (16 kbit/s are enough for user data from an MS).
The physical layer at the A interface typically includes leased lines with
2.048 Mbit/s capacity. LAPD is used for layer two at Abis, BTSM for BTS
management.
• Signaling system No. 7 (SS7) is used for signaling between an MSC and a
BSC. This protocol also transfers all management information between
MSCs, HLR, VLRs, AuC, EIR, and OMC. An MSC can also control a BSS via a
BSS application part (BSSAP).