Chapter 4: Wireless Telecommunication Systems, GSM

1. Chapter 4: Wireless Telecommunication Systems, GSM (Book: Mobile Communications, Schiller)

2. GSM: Overview • GSM • formerly: Groupe Spéciale Mobile (founded 1982) • now: Global System for Mobile Communication • Pan-European standard (ETSI, European Telecommunications Standardisation Institute) • today many providers all over the world use GSM (more than 200 countries in Asia, Africa, Europe, Australia, America)

3. GSM status (end 2006) • 2.18 billion connections in 212 countries • 82 % market share globally • An incredible industry success!

4. GSM – The idea of a common European mobile communications system • 1982: A Nordic group is considering the next generation of mobile telephone. – NMT (Nordisk Mobil Telefon), the analogue first generation system has only just been started • These ideas are presented to CEPT (European Conference of Postal and Telecommunications Administrations) in June 1982 • September 1982: The first meeting in CEPT GSM – Groupe Spécial Mobile • In 1988 ETSI (European Telecommunications Standards Institute) is established and the work is continued under a new name: SMG – Special Mobile Group

5. GSM - Specifications • Original specifications for the GSM system: • Good subjective voice quality • Low terminal and service cost • Support for international roaming • Support for handheld terminals • Support for new services • Spectrum efficient • Compatible with ISDN

7. GSM - Growth • 1991: First operational GSM network in Finland: Radiolinja • 1993: Tele-mobil (later: Telenor Mobil) and NetCom GSM open their networks in Norway • 1998: GSM 1800 is deployed to increase capacity in cities and other densely populated areas

8. Performance characteristics of GSM (wrt. analog sys.) • Communication • mobile, wireless communication; support for voice and data services • Total mobility • international access, chip-card enables use of access points of different providers • Worldwide connectivity • one number, the network handles localization • High capacity • better frequency efficiency, smaller cells, more customers per cell • High transmission quality • high audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e.g., from cars, trains) • Security functions • access control, authentication via chip-card and PIN

9. Disadvantages of GSM • There is no perfect system!! • no end-to-end encryption of user data • no full ISDN bandwidth of 64 kbit/s to the user • reduced concentration while driving • electromagnetic radiation • abuse of private data possible • roaming profiles accessible • high complexity of the system • several incompatibilities within the GSM standards

10. Architecture of the GSM system • GSM is a PLMN (Public Land Mobile Network) • several providers setup mobile networks following the GSM standard within each country • subsystems • RSS (radio subsystem): covers all radio aspects • NSS (network and switching subsystem): call forwarding, handover, switching • OSS (operation subsystem): management of the network

11. Ingredients 1: Mobile Phones, PDAs & Co. The visible but smallest part of the network!

12. Some GSM terminals Development.. Sony Ericsson W950i ”the Walkman phone” HTC P4350 Pocket computer running Windows

13. Some more GSM terminals Nokia N95 with ”everything”, e.g. GPS built in iPhone – Apple’s Mobile phone initiative Samsung Blackjack

14. Ingredients 2: Antennas Still visible – cause many discussions…

15. Ingredients 3: Infrastructure 1 Base Stations Cabling Microwave links

16. Ingredients 3: Infrastructure 2 Not „visible“, but comprise the major part of the network (also from an investment point of view…) Management Data bases Switching units Monitoring

17. GSM System Architecture Mobile Station (MS) Mobile Equipment (ME) Subscriber Identity Module (SIM) Base Station Subsystem (BSS) Base Transceiver Station (BTS) Base Station Controller (BSC) Network Switching Subsystem(NSS) Mobile Switching Center (MSC) Home Location Register (HLR) Visitor Location Register (VLR) Authentication Center (AUC) Equipment Identity Register (EIR)

18. GSM: overview OMC, EIR, AUC fixed network HLR GMSC NSS with OSS VLR MSC VLR MSC BSC BSC RSS

19. Voice Channels Coverage area Forward path Reverse path Or control channels MS Lines to BSC A RADIO CELL

21. Location Areas and Base Station SubSystems PSTN MSC BSC 1 BSC 1 Location Area 2 BTS BTS BTS BTS BTS Location Area 1

22. MSC Areas and Location Areas To PSTN MSC 1 MSC 2 MSC Area 2 MSC Area 1 Location Area 3 Location Area 1 Cell Area Cell Area Location Area 4 Location Area 2 Cell Area Cell Area

25. Mobile Station • The mobile station (MS) is the starting point of a mobile wireless network. The MS can contain thefollowing components: • • Mobile terminal (MT)—GSM cellular handset • • Terminal equipment (TE)—PC or personal digital assistant (PDA) • The MS can be two interconnected physical devices (MT and TE) with apoint-to-point interface or asingle device with both functions integrated.

26. GSM cellular handset SIM ME • GSM cellular handset : • Mobile equipment (ME) + SIM card • Subscriber Identity Module (SIM) contains encryption key and personal data • The user is uniquely identified through ”International Mobile Subscriber Identity” (IMSI) • The mobile equipment is uniquely identified through ”International Mobile Equipment Identity” (IMEI) • Both equipment and user uniquely identified GSM cellular handset

27. International Mobile Subscriber Identification number (IMSI) • It identifies a unique international universal number of a mobile subscriber, which consists of MCC+MNC+MSIN. • 1) MCC: country code, 460 • 2）MNC: network code, 00 or 01 • 3）MSIN: subscriber identification, H1H2H3H4 9XXXXXX, • H1H2H3H4: subscriber registering place • H1H2: assigned by the P&T Administrative Bureau (operator )to different provinces, to each province • H3H4: assigned by each province/city • the IMSI of user will be written into the SIM card by specific device and software and be stored into the HLR with other user information.

28. EXAMPLE: • IMSI: 310150123456789 • MCC310 USA • MNC150 AT&T Mobility • MSIN123456789 • IMSI: 381 01 1234567890MCC: 381 - SerbiaMNC: 01 - Telecom SerbiaMSIN: 1234567890IMSI: 310 150 123456789MCC: 310 - USAMNC: 150 - America TelecomMSIN: 123456789

29. When registering for service with a mobile network operator, each subscriber receives aunique identifier, the International Mobile Subscriber Identity (IMSI). This IMSI is storedin the SIM. A mobile station can only be operated if a SIM with a valid IMSI is insertedinto equipment with a valid IMEI, since this is the only way to correctly bill the associatedsubscriber. The IMSI uses a maximum of 15 decimal digits and consists of three parts: • • Mobile Country Code (MCC), three digits, internationally standardized; • • Mobile Network Code (MNC), two digits, for unique identification of mobile networkswithin a country; • • Mobile Subscriber Identification Number (MSIN), maximum of 10 digits, identificationnumber of the subscriber in their mobile home network.

30. The IMSI is a GSM-specific addressing concept and is different from the ISDN numberingplan. A three-digit MCC has been assigned to each of the GSM countries, and two-digitMNCs have been assigned within countries (e.g., 262 as MCC for Germany; and MNC 01,02 and 07 for the networks of T-Mobile, Vodafone, and O2, respectively).Whereas theMCCis defined internationally, the National Mobile Subscriber Identity (NMSI = MNC + MSIN)is assigned by the operator of the home network.

31. Mobile subscriber ISDN number • The ‘real telephone number’ of a mobile user is called the Mobile Subscriber ISDN Number(MSISDN). It is assigned to the subscriber (their SIM), such that a mobile station can haveseveral MSISDNs depending on the SIM. With this concept, GSM was the first mobilesystem to distinguish between subscriber identity and the number to call. • The separationof call number (MSISDN) and subscriber identity (IMSI) primarily serves to protect theconfidentiality of the IMSI. In contrast to the MSISDN, the IMSI need not be made public. • With this separation, one cannot derive the subscriber identity from the MSISDN, unless theassociation of IMSI and MSISDN as stored in the HLR has been made public. It is the rulethat the IMSI used for subscriber identification is not known, and thus the faking of a falseidentity is significantly more difficult.

32. International Mobile Equipment Identification code (IMEI) • It will uniquely identify a mobile station. It is a decimal number of 15 digits. Its structure is: • TAC+SN+A • TAC=type allocation code, 8 digits • SN=serial no, 6 digits • A=Check Digit, 1 digit

34. Other Addresses • Mobile station roaming number • The Mobile Station Roaming Number (MSRN) is a temporary location-dependent ISDNnumber. It is assigned by the locally responsible VLR to each MS in its area. Calls are routedto theMS by using theMSRN. • Temporary mobile subscriber identity • The VLR responsible for the current location of a subscriber can assign a TemporaryMobileSubscriber Identity (TMSI), which has only local significance in the area handled by theVLR. It is used in place of the IMSI for the definite identification and addressing of the MS. • In this way nobody can determine the identity of the subscriber by listening to the radiochannel, since this TMSI is only assigned during the presence of the MS in the area of oneVLR,

35. Base Transceiver Station • When a subscriber uses the MS to make a call in the network, the MS transmits the call request to thebase transceiver station (BTS). The BTS includes all the radio equipment (i.e., antennas, signalprocessing devices, and amplifiers) necessary for radio transmission within ageographical area called acell. The BTS is responsible for establishing the link to the MS and for modulating and demodulatingradio signals between the MS and the BTS.

36. Base Station Controller • Base Station Controller • A Base Station Controller (BSC) is a high-capacity switch with radio communication and mobility control capabilities. Thefunctions of a BSC include radio channel allocation, location update, handover, timing advance, power control and paging.

38. Base Station Subsystem • A GSM network is comprised of many base station subsystems (BSSs), each controlled by a BSC. TheBSS performs the necessary functions for monitoring radio connections to the MS, coding and decodingvoice, and rate adaptation to and from the wireless network. A BSS can contain several BTSs.

39. Mobile Switching Center • The mobile switching center (MSC) is a digital ISDN switch that sets up connections to other MSCs andto the BSCs. The MSCs form the wired (fixed) backbone of a GSM network and can switch calls to thepublic switched telecommunications network (PSTN). An MSC can connect to a large number of BSCs.

40. The mobile switching center (MSC) performs the telephony switching function. A mobile station must be attached to a singleMSC at a time (either homed or visitor), if it is currently active (not switched off). The visitor location register (VLR) is adatabase attached to an MSC to contain information about its currently associated mobile stations.

41. • Information of currently attached mobile stations • IMSI/TMSI numbers • MSISDN/MSRN numbers • Security triple (authentication and encryption information) • Location Area Identity (where the mobile station is currently located) • • List of base stations that belong to this MSC/VLR (by their BSIC or Base Station Identity Code) • • List of location areas that belong to this MSC/VLR (by their LAI or Location Area Identity code)

42. Equipment Identity Register • The equipment identity register (EIR) is a database that stores the international mobile equipmentidentities (IMEIs) of all the mobile stations in the network. The IMEI is an equipment identifier assigned • by the manufacturer of the mobile station. The EIR provides security features such as blocking calls fromhandsets that have been stolen.

43. Home Location Register • The home location register (HLR) is the central database for all users to register to the GSM network. Itstores static information about the subscribers such as the international mobile subscriber identity • (IMSI), subscribed services, and a key for authenticating the subscriber. The HLR also stores dynamicsubscriber information (i.e., the current location of the mobile subscriber).

44. The home location register (HLR) is a database used for storing and managing subscriptions. When an individual buys asubscription from one of the GSM operators, he or she is registered in the HLR of that operator.

45. HLR Data Elements • • Mobile Station’s Identities: • IMSI (International Mobile Subscriber Identity) (the primary Key), • Current TMSI (Temporary IMSI) • IMEI (International Mobile Equipment Identity) • • Mobile Station’s Telephone number • MSISDN (Mobile Stations ISDN number) • Current MSRN (Mobile Station Roaming Number), if assigned • • Name and address of the subscriber • • Current service subscription profile • • Current location (MSC/VRL address) • • Authentication and encryption keys • Individual Subscriber Authentication Key (KI) • • Mobile Country Code (MCC) and MNC (Mobile Network Code) • • List of MSC/VLR that belongs to this HLR

46. Authentication Center • Associated with the HLR is the authentication center (AuC); this database contains the algorithms forauthenticating subscribers and the necessary keys for encryption to safeguard the user input forauthentication.

47. Visitor Location Register • The visitor location register (VLR) is a distributed database that temporarily stores information aboutthe mobile stations that are active in the geographic area for which the VLR is responsible. A VLR is • associated with each MSC in the network. When a new subscriber roams into a location area, the VLRis responsible for copying subscriber information from the HLR to its local database. This relationshipbetween the VLR and HLR avoids frequent HLR database updates and long distance signaling of theuser information, allowing faster access to subscriber information.

49. GSM: elements and interfaces radio cell BSS MS MS Um radio cell MS RSS BTS BTS Abis BSC BSC A MSC MSC NSS VLR VLR signaling HLR ISDN, PSTN GMSC PDN IWF O OSS EIR AUC OMC

50. GSM: system architecture radiosubsystem network and switching subsystem fixedpartner networks MS MS ISDNPSTN MSC Um Abis BTS BSC EIR BTS SS7 HLR VLR BTS ISDNPSTN BSC BTS MSC A IWF BSS PSPDNCSPDN