GSM Architecture

1. GSM Architecture

2. GSM SubSystems GSM architecture is mainly divided into three Subsystems • Base Station Subsystem (BSS) • Network & Switching Subsystem (NSS) • Operations & Support Subsystem (OSS) Mobile Station sometimes included in BSS

3. GSM Network Architecture

5. HLR AUC A-bis I/F B S C A I / F T C MSC PSTN A-ter I/F Um I/ F MS BTS EIR VLR Simplified GSM Architecture

8. Mobile Station (MS) The MS consists of two parts • Mobile Equipment (ME) • Subscriber Identity module (SIM)

9. Global GSM Mobility Card The Smart Card to use G S M Mobile Station Mobile Station = SIM Card Handset Battery battery + + f153454 2W jmhfod kgdjipj

10. Global GSM Mobility Card The Smart Card to use Calling line 0609225831 G S M SIM-Card and GSM Mobile Equipment SIM-Card = + Contains: - IMSI Subscriber knows - Called party number = MS-ISDN - PIN Handset

11. Global GSM Mobility Card The Smart Card to use G S M The SIM-Card Functions Credit Card Size µ SIM-Card 15 mm 25 mm • Permanent data: • - Unique mobile subscriber identitythrough IMSI number, • - Authentication parameter Ki, • - Authentication algorithm A3, • - Generating encryption key Kc algorithm A8. Microchip with stored user information • Removable data: • - Temporary Mobile Subscriber Number, • - Location Area Identification.

12. IMSI MS - ISDN Subscriber Identification Mobile Station - Integrated Services DigitalNetwork Nb Similar to ISDN, Conformity with E164/E213 International Mobile Subscriber Identity Conformity with E212 Nature Identify the subscriber of a PLMN Identify a PLMN worldwide National Significant Mobile Number MCC MNC MSIN H1 H2 x x x ......... x x x CC NDC SN M1 M2 x x x x x x x x Format Country Code (where subscription has been made) Mobile Country Code Mobile Network Code Mobile Subscriber Ident. Nb H1 H2 = Identity of HLR within the home PLMN National Destination Code * Mobile Subscriber (national definition) M1 M2 = nbr of logical HLR Meaning 3 2 max 10 1 to 3 2 to 4 total max 15 Nb. digits * This code does not identify a geographical area but an operator

13. TYPE APPROVED Mobile Identification TAC FAC SNR SP Type Approval Code Serial number (SPare) Final Assembly Code

14. Booster 2 W 5 W 2 W 8 W Trends in Mobile Station Dual-band 900-1800 900-1900 Hands-free Data Pocket PC Java Fax Organizer

15. Mobile Equipment (ME) • The ME is the only part of the GSM network which the subscriber will really see. • There are three main types of ME, these are listed below: • Vehicle Mounted • Portable Mobile Unit • Hand portable Unit

16. Subscriber Identity module (SIM) • The SIM is a card which plugs into the ME. • This card identifies the MS subscriber and also provides other information regarding the services that subscriber should receive. • The SIM card, and the high degree of inbuilt system security, provides protection of the subscriber’s information and protection of networks against fraudulent access. • The SIM can be protected by use of Personal Identity Number (PIN) password, similar to bank/credit charge cards, to prevent unauthorized use of the card. • SIM cards are designed to be difficult to duplicate. • By making a distinction between the subscriber identity and the ME identity, GSM can route calls and perform billing based on the identity of the ‘subscriber’ rather than the equipment or its location.

17. Subscriber Identity module Cntd…. The SIM contains several pieces of information: • International Mobile Subscriber Identity (IMSI) • Temporary Mobile Subscriber Identity (TMSI) • Location Area Identity (LAI) • Subscriber Authentication Key (Ki) • Mobile Station Integrated Services Digital Network (MSISDN) The SIM is capable of storing additional information such as accumulated call charges. The SIM also executes the Authentication Algorithm.

18. Subscriber Identity module Cntd….

19. Base Station Subsystem (BSS)

20. MSC TCU Public Telephone Network BSC Sun StorEdge A5000 BSS Architecture Radio Interface A Interface S2000H&L BTS NSS Ater Interface MS Abis Interface S8000 Outdoor BTS OMC-R Radio Interface OMN Interface S8000 Indoor BTS BSS MS

21. Base Station Controller (BSC) • the BSC provides the control for the BSS. • Any operational information required by the BTS will be received via the BSC. • Likewise any information required about the BTS (by the OMC for example) will be obtained by the BSC. • The BSC incorporates a digital switching matrix, which it uses to connect the radio channels on the air interface with the terrestrial circuits from the MSC. • The BSC switching matrix also allows the BSC to perform “handovers” between radio channels on BTSs, under its control, without involving the MSC.

23. PCM controller PCM controller BTS BSC General Architecture and Functions BSC - Radio Resource management for its BTSs - Intercell hand-over - Allocation of channels for communication - Reallocation of frequencies among BTSs - Time and frequency synchronization to BTSs - Controls frequency hopping Processing Unit X.25 controller O&M Switching matrix To Network SubSystem A interface Abis interface

24. Base Transceiver Station – BTS • The BTS provides the air interface connection with the MS. • It also has a limited amount of Control functionality which reduces the amount of traffic passing between the BTS and BSC. • Where the BSC and BTS are both shown to control a function, the control is divided between the two, or may be located wholly at one.

26. BSC BTS General Architecture and Functions BTS Antenna - Interface between Antennas and TRXs of each cell Transmission coupler COUPLING SYSTEM Duplexer - Encodes, encrypts, modulates, feeds the RF signal to the antenna - Decrypts and equalizes the signal then demodulates - Mobile call detection - Uplink channel measurements - Timing advance - Frequency hopping Reception coupler TRX (Transceiver-Receiver) BCF (Base Common Functions) Abis interface - Multiplexes speech and user's data channels to BSC. - Multiplexes signaling channels to BSC.

28. BSS Configurations The maximum number of BTSs which may be controlled by one BSC is not specified by GSM. The BTSs and BSC may either be located at the same cell site “co-located”, or located at different sites “Remote”. Another BSS configuration is the daisy chain. Problem- transmission delay through the chain.

29. Transcoder Controller External PCM Interface TRAU Architecture and Functions Converts the 13 kbps GSM speech frame either into a 64 kbps T1 PCM µ-law or into an E1 PCM A-law Routes the users' data stream to suitable Inter-working function TRAU T1 trunk up to 92 user's and control channels T1 trunk = up to 24 user's channels Transcoder A interface Ater interface MSC BSC E1 trunk up to 120 user's channels E1 trunk = up to 31 user's channels

30. Transcoder (XCDR) • The 64 kbit/s PCM circuits from the MSC, if transmitted on the air interface without modification, would occupy an excessive amount of radio bandwidth. • The Transcoder is to convert the speech or data output from the MSC into the form suitable for transmission over the air interface. • The required bandwidth is therefore reduced by processing the 64 kbit/s circuits so that the amount of information required to transmit digitized voice falls to a gross rate of 16 kbit/s.

31. Transcoder (XCDR) Cntd…. • The transcoding function may be located at the MSC, BSC, or BTS. • The content of the 16 kbit/s data depends on the coding algorithm used. • There are two speech coding algorithms available. • The Full Rate speech algorithm is supported by all mobiles and networks. • It produces 13 kbit/s of coded speech data plus 3 kbit/s of control data known as TRAU data (Transcoder Rate Adaptation Unit). • TRAU only used by BTS and discarded (not transmitted on air interface)

32. Transcoder (XCDR) Cntd…. • the 13 kbit/s of speech data is processed at the BTS to form a gross rate of 22.8 kbit/s on the air interface which includes forward error correction. • In the uplink direction the BTS adds in TRAU data which will be used by the transcoder. • Enhanced Full Rate is an improved speech coding algorithm and is only supported by Phase 2+ mobiles. • It produces 12.2 kbit/s from each 64 kbit/s PCM channel and TRAU data of 3.8 kbits/s

34. Network Switching System (NSS)

35. AUC IWF IWF Billing Server Billing Server NSS Architecture Site 1 Site 2 H HLR D D BSS BSS VLR VLR G-interface B-interface B-interface C-interface A-interface MSC A-interface GMSC Other GSM, PSTN, ISDN Other GSM, PSTN, ISDN E-interface F F EIR E E SMS-SC

36. Network Switching System (NSS) • The Network Switching System includes the main switching functions of the GSM network. • It also contains the databases required for subscriber data and mobility management. • The components of the Network Switching System are listed below: • Mobile Services Switching Centre – MSC • Home Location Register – HLR • Visitor Location Register – VLR • Equipment Identity Register – EIR • Authentication Centre – AUC • Interworking Function – IWF • Echo Canceller – EC

38. Mobile Switching Centre (MSC) • MSC is the heart of the system, controlling the Switching & Billing. • The MSC can carry out different functions depending upon its position in the network. • When provides interface between PSTN & BSS in GSM network then known as a Gateway MSC • provides service to MSs located within a defined geographic coverage area. • The network typically contains more than one MSC. • One MSC is capable of supporting a regional capital with approximately one million inhabitants.

39. MSC’s Functionalities • Call Processing • control of data/voice call setup • inter-BSS and inter-MSC handovers • control of mobility management (subscriber validation and location). • Operations and Maintenance Support • database management • traffic metering and measurement • A Man–machine interface. • Internetwork Interworking • Interface between the GSM network and the PSTN. • Billing • Collects call billing data.

40. Home Location Register HLR Subscriber Management Center Permanent records - MSISDN - IMSI - Subscriber's service provision Temporary records - VLR address - Ciphering items (Kc, Sres, Rand)

41. Home Location Register (HLR) • The HLR is the master database which contains each user’s service profile. • Various identification numbers and addresses are stored, as well as authentication parameters. • The data it contains is remotely accessed by all the MSCs and the VLRs in the network. • Although the network may contain more than one HLR, there is only one database record per subscriber . • The subscriber data may be accessed by either the IMSI or the MSISDN number.

42. LA1 LA3 LA2 LA4 Visitor Location Register VLR Permanent records - IMSI - Subscriber’s service provision Temporary records - Ciphering items (Kc, Sres, Rand) - LAI - TMSI

43. Visitor Location Register (VLR) • VLR is a temporary database for all user currently located in the system including roamers & non-roamers. • The data exists for only as long as the subscriber is “active” in the particular area covered by the VLR. • The VLR database will therefore contain some duplicate data as well as more precise data relevant to the subscriber. • This function eliminates the need for excessive and time-consuming references to the “home” HLR database.

44. Visitor Location Register Cntd…. The additional data stored in the VLR is listed below: • Mobile status (busy/free/no answer etc.). • Location Area Identity (LAI). • Temporary Mobile Subscriber Identity (TMSI). • Mobile Station Roaming Number (MSRN). • MSC updates VLR with HLR information. • Each MSC has VLR which resides with the MSC & each G-MSC has a HLR which usually resides with the G-MSC

45. Black list (barred ME) White list (valid ME) Mobile Equipment Gray list (faulty ME) Equipment Identity Register EIR IMEI

46. Equipment Identity Register (EIR) • The EIR contains a centralized database for validating the IMEI. • This database is concerned solely with MS equipment and not with the subscriber who is using it to make or receive a call. • The EIR database consists of lists of IMEIs (or ranges of IMEIs) organized as follows: • White List • Black List • Grey List

47. Equipment Identity Register Cntd….

48. RAND 5 SRES, Kc, RAND Security A3, A8 algorithms Authentication Center AUC Ciphering Triplets Ki HLR Request IMSI AUC provides

49. Authentication Centre (AuC) • The AuC is a processor system that performs the “authentication” function. • It is normally co-located with the HLR as it will be required to continuously access and update, as necessary, the system subscriber records. • The authentication process will usually take place each time the subscriber “initializes” on.

50. Modem InterWorking Function Mobile Switching Center BSS PSTN MS Data + DTE signals Rate adaptation Modem DTE signaling IWF Land-DTE DTE