Wireless WANs:

Cellular Networks
NES440 Wireless Networks

Dr. Fahed Awad

Department of Network Engineering & Security
Jordan University of Science and Technology

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 1

 Cellular Telephone Systems
 Cellular telephone systems were originally designed to provide voice
communications services to/from mobile stations (MS)
 A MS can communicate to another MS or to a landline stationary station
 The cellular structure is designed such that:
 The service area is divided into small regions called “cells”
 Each cell has a base station (BS) that provides the first hop access for the MS
 Each BS is connected to a call switching office called the Mobile Switching Center (MCS)
 The MSC connects the BS with other BS’s and to the Public Switched Telephone Network (PSTN)
 The cellular service provider must be able to:
 Track and locate the MS within its coverage (or service) area
 Assign a channel to each call from or to the MS
 Maintain the call as the MS moves around

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 2

Components of the Cellular Network Architecture
MSC
Connects the cells to the wide area network
 Manages call setup (more later!)
 Handles mobility (more later!)

Mobile
Switching
Cell Center (MSC)
 Covers a geographical region Public Switched
 Base Station (BS): analogous Telephone Network
(PSTN), and the
to the IEEE 802.11 AP Internet
 Mobile Station (MS): attaches
to the network through the BS Mobile
Switching
 Air-interface: the physical and Center (MSC)
link layer protocols between the
MS and the BS

Wired Network

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 3

Characteristics of the Cellular Architecture
 Advantages:
 Provides relatively high user capacity (i.e.; the number of concurrent users)
 Reduces the transmit power needed by the MS and BS
 Provides decentralized access to the network resources, which improves the reliability
 Provides good potential for scalability by controlling the cell coverage area and antenna
types and directionality
 Disadvantages:
 Backhaul network connections to BS’s
 Rural area BS’s require very long-distance connections, which is costly in terms of money and time
 Wireless alternative (e.g.; microwave)
 Mobility management
 Handoff between adjacent BS’s and possibly between different MSC’s
 Roaming into a foreign network
 Potential frequency co-channel and adjacent-channel interference
 Design Issues:
 Network engineering: backhaul and interconnect
 Switch engineering: internal resources of the MCS
 RF engineering: cell positioning and optimization, BS resource sizing; channel allocation and
frequency reuse

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 4

The Shape & Size of the Cell Coverage Area
 The cell coverage area has no regular or permanently fixed shape or size
 The shape of the cell coverage area depends on:
 The terrain around the BS (e.g.; hills, forest, desert, etc.)
 The time of the year (e.g.; fall with no leaves, falling snow, rain, etc.)
 The type and orientation of the BS antenna
 The size of the cell coverage area is controlled by:
 The transmit power of the BS antenna
 The population density of the coverage area
 Highly-dense areas need larger number of smaller cells than lightly-dense areas

 The ideal shape of the cell coverage area is:

 A circle if an Omni-directional antenna is used
 A sector, with a certain angle, if a directional antenna is used (typically 120-degree sectors)
 To facilitate the theoretical analysis of the cellular systems, a hexagonal
shape is usually used
 A typical range of cell coverage area is:
 Tens of meters (e.g.; in-building Pico-cells)
 Hundreds of meters (e.g.; urban area Micro-cells)
 Tens of kilometers (e.g.; suburban or rural area Macro-cells)

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 5

The Shape & Size of the Cell Coverage Area
 The cell coverage area has no regular or permanently fixed shape or size
 The shape of the cell coverage area depends on:
 The terrain around the BS (e.g.; hills, forest, desert, etc.)
 The time of the year (e.g.; fall with no leaves, falling snow, rain, etc.)
 The type and orientation of the BS antenna
 The size of the cell coverage area is controlled by:
 The transmit power of the BS antenna
 The population density of the coverage area
 Highly-dense areas need larger number of smaller cells than lightly-dense areas

 The ideal shape of the cell coverage area is:

 A circle if an Omni-directional antenna is used
 A sector, with a certain angle, if a directional antenna is used (typically 120-degree sectors)
 To facilitate the theoretical analysis of the cellular systems, a hexagonal
shape is usually used
 A typical range of cell coverage area is:
 Tens of meters (e.g.; in-building Pico-cells)
 Hundreds of meters (e.g.; urban area Micro-cells)
 Tens of kilometers (e.g.; suburban or rural area Macro-cells)

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 6

The Shape & Size of the Cell Coverage Area
 The cell coverage area has no regular or permanently fixed shape or size
 The shape of the cell coverage area depends on:
 The terrain around the BS (e.g.; hills, forest, desert, etc.)
 The time of the year (e.g.; fall with no leaves, falling snow, rain, etc.)
 The type and orientation of the BS antenna
 The size of the cell coverage area is controlled by:
 The transmit power of the BS antenna
 The population density of the coverage area
 Highly-dense areas need larger number of smaller cells than lightly-dense areas

 The ideal shape of the cell coverage area is:

 A circle if an Omni-directional antenna is used
 A sector, with a certain angle, if a directional antenna is used (typically 120-degree sectors)
 To facilitate the theoretical analysis of the cellular systems, a hexagonal
shape is usually used
 A typical range of cell coverage area is:
 Tens of meters (e.g.; in-building Pico-cells)
 Hundreds of meters (e.g.; urban area Micro-cells)
 Tens of kilometers (e.g.; suburban or rural area Macro-cells)

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 7

Frequency Reuse Principles
 Neighboring cells usually have coverage overlap
 This facilitate the call handoff for the MS as it moves from one cell to another
 However, neighboring cells cannot use the same set of frequency channels
 Because this causes interference to MS’s within the areas covered by both cells
 The number of available channels is usually limited
 Therefore, the channels need to be reused in order to increase the system call capacity
 The frequency reuse pattern is a configuration of N cells (called a cluster)
 N is called the reuse factor, in which each cell uses a unique set of channels
 When the pattern is repeated, the channels can be reused
 As N increases, co-channel interference is reduced, but less call capacity is achieved

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 8

Cellular Standards – First Generation
 First-generation (1G): Analog cellular systems
 The first mobile networks was in the early 1980s such as:
 AMPS (Advanced Mobile Phone System) in the USA
 TACS (Total Access Communications System) in the UK
 C-Netz in Germany
 Radiocom 2000 in France
 NMT in Scandinavia
 Designed for analog voice communications using Frequency Modulation
(FM)
 Control (or signaling) channels used Frequency Shift Keying (FSK)
 Bandwidth was shared using Frequency Division Multiple Access (FDMA)
for the air interface
 For data communication, Cellular Digital Packet Data (CDPD) was used
by AMPS
 CDPD used the unused voice channels in the AMPS system for data transmission
 The 1G networks were planned to achieve maximum coverage with as few
antennas as possible
NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 9
First Generation Problems
 Problems with the 1G analog systems included:
 Limited capacity:
 The systems could not cope with the continuous growth in the
number of subscribers
 Bulky equipment:
 The mobile phone unit was relatively very big and heavy
 Poor reliability:
 Analog signals are prone to noise and interference
 Lack of security:
 Analog signals can be easily intercepted
Dr. Martin Cooper, Motorola
 Incompatibility between different systems: First Mobile Phone prototype:
 No roaming was possible between different neighboring • 1.1 kg
• 23x13x4.5cm
countries (e.g.; in Europe) • 30 minutes talk time
• 10 hour recharge time

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 10

Cellular Standards – Second Generation
 Second-generation (2G): Digital cellular systems
 Designed for digital voice communications via digital-to-analog conversion:
 Provided better voice transmission quality and security compared to 1G
 Provided increased service capacity per cell site (i.e.; more efficient use of radio spectrum)
 Provided advanced services such as caller ID, call forwarding, voice mail, etc.
 Provided possibilities of data transmission
 Very Large Scale Integrated (VLSI) components allowed for smaller and cheaper handsets
 Bandwidth was shared using a combination of FDMA and either Time Division
Multiple Access (TDMA) or Code Division Multiple Access (CDMA)
 Examples:
 Global System for Mobile Communications (GSM) in Europe (late1980’s)
 Replaced the non-compatible European analog standards
 Uses FDMA/TDMA for the air interface
 Interim Standard-136 or IS-136 or Digital AMPS (D-AMPS) in the US (early 1990’s)
 Evolved form AMPS
 Uses FDMA/TDMA for the air interface
 Interim Standard-95 or IS-95 (mid 1990’s)
 Uses FDMA/CDMA for the air interface
 Deployed mostly in the US and Korea

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 11

Features of Digital Cellular Systems
 Low bit-rate speech coding and compression (no more than 13 kbps)
 Increases the number of users per MHz (i.e.; improves the spectral
efficiency)
 However, it degrades the overall voice quality
 Some systems (like CDMA) make use of speech inactivity periods in
order to:
 Reduce interference and background noise
 Improve the battery life of the handset
 High-complexity digital signal processing (DSP)
 For speech coding and de-modulation
 Fixed Channel Allocation
 Channels are allocated to cell-sites statically
 Dynamic channel allocation was hard to do (solved later)
 Mobile handset power control
 Decreases the co-channel interference
 Hence increases the service capacity
NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 12
 2G Technologies: Comparison
IS-95 GSM IS-136
Uplink Frequencies 824-849 MHz (US Cellular) 890-915 MHz (Eurpe) 824-849 MHz (US Cellular)
1850-1910 MHz (US PCS) 1850-1910 MHz (US PCS) 1850-1910 MHz (US PCS)

Downlink Frequencies 869-894 MHz (US Cellular) 935-960 MHz (Europe) 869-894 MHz (US Cellular)
1930-1990 MHz (US PCS) 1930-1990 MHz (US PCS) 1930-1990 MHz (US PCS)

Duplexing FDD FDD FDD

Multiple Access CDMA TDMA TDMA

Carrier Seperation 1.25 MHz 200 KHz 30 KHz

Channel Data/Chip Rate 1.2288 Mchips/sec 270.833 Kbps 48.6 Kbps

Voice Channels per carrier 64 8 3

Speech Coding CELP at 13Kbps RPE-LTP at 13 Kbps VSELP at 7.95 Kbps

EVRC at 8Kbps

NES440: Wireless Networks

CPE595 Copyright © Dr. Fahed H. Awad 13
GSM and CDMA Coverage Map Worldwide

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 14

Cellular Standards – 2.5G
 2G systems were optimized for voice services and not well adapted for data
 Upcoming 3G systems were designed for both voice and data communication
 3G protocol development and standardization was taking a very long time
 2.5G: for those who cannot wait for 3G standards
 Interim standards developed to provide data communications over the 2G systems
 High Speed Circuit-Switched Data (HSCSD)
 Evolved from GSM
 Uses circuit switching with data rates up to 60 kbps using multiple channels (if available)
 General Packet Radio Service (GPRS)
 Also evolved from GSM
 Uses packet switching with data rates up to 140 kbps
 Enhanced Data for GSM Evolution (EDGE)
 Also evolved from GSM
 Uses enhanced modulation technique to provide higher bit rate
 Can be applied to HSCSD (ECSD) &GPRS (EGPRS) with date rates up to 384 kbps
 IS95B (or CDMA-2000 phase 1)
 Evolved from IS-95
 Uses circuit switching with data rates up to 64 kbps

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 15

Cellular Standards – 3G
 3G goals:
 Simultaneous Voice and Data Transmission
 Multi-megabit Internet access with Interactive web sessions
 Multimedia Content such as live video calls

 3G systems were mandated to provide the following data rates:

 144 kbps data rate at driving speed
 384 kbps data rate for outside stationary or walking speeds
 2 Mbps data rates indoors

 There are two major competing standards for 3G systems:

 Universal Mobile Telecommunications Service (UMTS)
 An evolution of GSM to support 3G capabilities using Direct Sequence Wideband CDMA
(DS-WCDMA)
 Adopted mainly in Europe
 CDMA-2000 (phase 2)
 An evolution of IS-95 and is backward compatible with IS-95
 Adopted in North America and parts of Asia

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 16

Emerging Applications of Cellular Systems

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 17

Cellular Standards – 4G
 4G was designed to provide smooth and
ubiquitous low-cost global roaming
 Theoretically, 4G is set to provide:
 100Mbps to a roaming mobile devices globally
 1Gbps to a stationary device
 Video conferencing, streaming picture perfect video
(i.e.; tele-medicine, tele-geo processing; etc.)
 4G should bring almost perfect real world
wireless or what is so called “WWWW: World
Wide Wireless Web

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 18

Global Cellular Technology Evolution

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 19

1G to 4G Comparison

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 20

Evolution of Current Standards Towards 4G

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 21

 Air Interface Standards

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 22

AMPS Cellular System
 Uses two separate 25 MHz analog bands
 Reverse channel (MS to BS): 824 to 849 MHz
 Forward channel (BS to MS): 869 to 894 MHz
 Each band is divided into 832 channels of 30 KHz each
 Each band is shared by two service providers
 Each service provide has 416 channels, of which 21 channels are used for control
 AMPS has a reuse factor of 7
  each cell site has (416 – 21) / 7 = 56 pairs of channels for voice calls

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 23

AMPS Reverse Communication Band

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 24

IS-136 D-AMPS Cellular System
 Each voice channel is digitized and compressed into a 7.95 kbps digital voice channel
 Three digital voice channels are combined using TDMA into 48.6 kbps digital data
 Each frame has 1944 bits divided into 6 slots with 2 slots per voice channel
 Each slot has 324 bits (159 bits for voice data, 64 bits for control, and 101 bits for error correction)
 The frame rate is 25 frames per second  25 f/s x 6 slot/f x 324 b/slot = 48600 bps
 The frequency reuse factor is also 7  D-AMPS has 3 times the capacity of AMPS

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 25

GSM Bands

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 26

 GSM Cellular System
 GSM allows for a reuse factor as low as 3
 More efficient Gaussian Minimum Shift Keying
(GMSK) modulation scheme
 Very strong error correction mechanism

 Channel Bit Rate =

26 x 8 x 156.25 / 0.120 = 270.8 kbps

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 27

 GSM System Overview

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 28

GSM System Architecture
 The GSM system consists of three subsystems:
 The Mobile Station (MS)
 The Base Station Sub-system (BSS): consists of a Base Station Controller (BSC) and a number Base Transceiver
Stations (BTS).
 The Network and Switching Sub-system (NSS): consists of an MSC and the associated registries
 Different interfaces are defined between different parts of the system:
 'A' interface: between the MSC and the BSC
 'Abis' interface: between the BSC and the BTS
 'Um' air interface: between the BTS (antenna) and the MS

AuC: Authentication Centre

BSC: Base Station Controller
BSS: Base Station Sub-system
BTS: Base Transceiver Station
EIR: Equipment Identity Registry
HLR: Home Location Registry
VLR: Visitor Location Registry
MS: Mobile Station
MSC: Mobile Switching Centre
OMC: Operations and Maintenance Center
PSTN: Public Switched Telephone Network
TRX: Transceiver

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 29

The GSM Mobile Station (MS)
 The GSM mobile station consists of:
 The Mobile Equipment (ME)
 Identifies the actual physical equipment
 The Subscriber Identity Module (SIM)
 Identifies the subscriber using the equipment

 The SIM stores permanent and temporary data about the mobile, the
subscriber, and the network, including:
 The International Mobile Subscribers Identity (IMSI)
 Identifies the subscriber within the GSM network
 The MS ISDN (Integrated Services Digital Network) number of the subscriber
 Identifies the actual telephone number used to reach the subscriber
 An authentication key (Ki) and algorithms used for authentication check
 The ME has a unique International Mobile Equipment Identity (IMEI),
which is used by the EIR
 Used to block certain types of equipment from accessing the network:
 If they are not approved for the GSM network
 If they are stolen equipment

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 30

The Base Station Sub-system (BSS)
 The BSS consists of:
 A Base Station Controller (BSC)
 One or more Base Transceiver Stations (BTS)

 The BSC:
 Allocates a channel (i.e.; a time slot) for the duration of the call
 Maintains the call:
 Monitoring the signal quality

 Controlling the power transmitted by the BTS or the MS

 Generating a handover to another cell when required

 Handover is “hard”: MS loses connection with the old BS before gaining one with the new BS
 The handover decision is made based on the quality and power level of the radio link compared to
neighboring BS’s

 The BTS provides & manages radio access to the mobile stations & contains:
 The Radio Transmitter/Receiver (TRX)
 The Signal processing and control equipment
 The Antennas and the feeder cables

 Positioning of the BTS is crucial to the provision of acceptable radio coverage

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 31
The BSS Network Topologies
 Chain:
 Cheap and easy to implement
 One link failure may isolate several BTSs

 Ring:
 Redundancy gives some protection if a link fails
 More difficult to roll-out and extend as the ring must
be closed
 Star:
 Most popular configuration for GSM systems
 Expensive as each BTS has its own link
 A link failure always results in a loss of one BTS

 The actual physical link can be:

 A regular dedicated cable-based connection (e.g.; T1)
 A point-to-point Microwave link
 An optical fiber connection

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 32

The Network & Switching Sub-system (NSS)
 The NSS consists of:
 One or more Mobile Switching Centers (MSC) each with an associated Visitor
Location Registry (VLR)
 A Gateway MSC (GMSC)
 A Home Location Registry (HLR) with an associated Authentication Centre (AuC)
 An Equipment Identity Registry (EIR)

 These elements are interconnected by a signaling network called the

SS7 (Signaling System Number 7) network

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 33

The Mobile Switching Center (MSC)
 Functions of the MSC:
 Switching, controlling, and logging calls
 Interface with PSTN, ISDN, etc.
 Mobility management over the radio network and other Networks
 Radio Resource management such as handovers between BSC’s
 Logging and providing billing Information
 Each MSC has an associated Visitor Location Registry (VLR)
 The VLR stores temporarily information about the MS’s served by
the MSC such as:
 The IMSI
 The MS ISDN Number
 The MS Roaming Number
 The location area (i.e.; BTS, BSC, etc.), where MS has been registered
 Supplementary service parameters such as call forwarding, caller ID, etc.

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 34

The Gateway MSC (GMSC)
 A Gateway MSC (GMSC) is an MSC that is responsible for:
 Routing the traffic entering the mobile network to the correct destination
 Routing the traffic that is destined out of the mobile network

 A particular MSC can be assigned to act as a GMSC

 The GMSC accesses the network’s HLR to find the current location
of the required MS

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 35

The Equipment Identity Registry (EIR)
 The EIR is a database that stores the unique IMEI
number of each MS in the network
 The EIR controls access to the network by returning the
status of an MS in response to an IMEI query
 The EIR may be optionally used by the cellular provider
 Possible status levels are:
 White-listed
 The terminal is allowed to access the network
 Grey-listed
 The terminal is under observation by the network for possible
problems
 Black-listed
 The terminal is not allowed to access the network
 The terminal has either been reported stolen or is not a type
approved for a GSM network

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 36

The Home Location Registry (HLR)
 Recall that the VLR stores the current location area of the MS
 The HLR stores the MSC/VLR that the MS is currently registered at
 This information is used to page the MS when it has an incoming call
 The HLR stores details about all MS’s in the network, such as:
 Subscription information
 Location information: MS roaming number, VLR, MSC
 International Mobile Subscriber Identity (IMSI)
 MS ISDN number
 Service restrictions
 Supplementary services
 Together with the AuC, the HLR checks the validity and service
profile of subscribers as they enter to the network
 There is logically one HLR/AuC in the network
 However, it may be physically divided among several computers for diversity

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 37

The Authentication Process
 The authentication process is designed to prevent fraudulent use of a subscriber’s account
 The process involves a challenge set by the AuC to which the MS must correctly respond
 There is a secret authentication key Ki for each subscriber, which is stored only in the SIM and AuC
 The AuC generates a random number (RAND), which is passed together with the key to an algorithm known as the A3
This produces a signed result value (SRES)
 The values of RAND and SRES (but not the key) are passed to the MSC
 The MSC sends RAND to the mobile, which uses its key and the A3 algorithm to generate SRES
 The MS returns its SRES value to the MSC, which compares the two values. If they are the same, the mobile is allowed
on the network. Otherwise, it is rejected.
 This system provides fairly good protection against fraud and SIM cloning. However, it can be broken
 The A8 algorithm is used to generate a second key (Kc) to encrypt voice or data being transmitted

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 38

Roaming
 Roaming allows subscribers to travel to different network
areas, different operator’s networks, or different countries
while keeping the services and features they use at home

 Billing is done through the home network operator, who

pays any other serving operator involved

 Requires roaming agreements between operators to

specify the charging rates, methods of payments, etc.

 Clearing house companies carry out data validation on

roamer data records, billing of home network operators,
and allocation of payments

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 39

Billing (or Call Accounting)
 The MSC/GMSC that originates a call generates a Call Detail Record
(CDR), which contains:
 The subscriber identity
 The number called
 The call length
 The routing details of the call

 The CDR tracks the call on its route through various networks
 The CDR is passed to the home network via the SS7 network
 The CDR’s are used by the billing system to generate bills to the user
 Under international agreements, the home network collects the
charges from the users
 Payment due to other networks based on the roaming agreements
are is settled by money transfer between cellular providers or via
clearing house companies

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 40

GSM Network Operations
 The main operations the GSM network must carry out include:
 Switching the MS on (IMSI attach)
 Switching the MS off (IMSI detach) Mobility Management Operations
 Updating the MS location
 Making a call (mobile originated or outgoing call)
 Receiving a call (mobile terminated on incoming call)
 Cell measurements and handover
 Mobility management refers to the way the network keeps track of
an MS in the idle mode to be located when there is an incoming call

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 41

The IMSI Attach (Switch on)

 The MS camps on to the best serving BTS

 Based on the signal strength and quality
 The MS sends the IMSI to the MSC
 The Subscriber data including the current
location area is added to the local VLR
 The MSC/VLR, in which the MS is being served
is updated in the HLR
 The MSC and HLR carry out the authentication
check of challenge and response using Ki
 Optionally, the EIR checks the status of the MS
(white/grey/black) before granting access

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 42

The IMSI Detach (Switch off)

 The MS informs the MSC it is switching off

 The HLR stores the last location area for the MS
 The VLR records that the MS is no longer available
 The MS powers down

 If the MS is not powered down correctly, the

network loses track of it

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 43

Location Updates
 There are two types of MS location
update:
 Automatic Location Update:
 When the MS moves to a new location area
 Periodic Location Update:
 Checks whether the MS is still in the network

 Both types update the MS location

records in VLR
 If the MS moves to a new MSC/VLR,
then the HLR records are updated

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 44

Mobile Originated Call (Outgoing Call)
 When the MS requests access to the
network to make a call:
 The BSS determines the nature of the call:
 Regular voice call
 Emergency call
 Supplementary service (e.g.; call forwarding, call waiting, etc.)
 It also allocates radio resources to the MS for the call
 The NSS determines the destination of the call:
 Mobile to mobile on the same network
 Mobile to mobile on another network
 Mobile to fixed network (e.g.; PSTN, ISDN)
 The MSC/GMSC routes the call appropriately and
handles the signaling
 If the call is destined for another network, the
originating MSC will route it to the GMSC where it is
passed to the other network’s GMSC

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 45

Mobile Terminated Call (Incoming Call)
 To call a mobile subscriber (whether from within the mobile network
or from outside), its MS ISDN is dialed
 For an external caller:
 The PSTN/ISDN routes the call to GMSC
 The VLR currently serving the MS is found via the HLR
 The Mobile Subscriber Roaming Number is sent to GMSC
 The GMSC routes the call to the correct MSC/VLR

 For an internal caller:

 The HLR provides the originating MSC/VLR with the MSC/VLR the MS is at

 The VLR provides the current location area where the MS is at

 The BSS pages the MS within the location area
 The MS responds and the radio resources are allocated to the MS
by the BSS to complete the call

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 46

Routing of an External Call

1
2 3

11 5 10
7

8 6

12
13

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 47

The Cell Measurements and Handover
 As the MS moves around, it monitors the
signal strength & quality of up to 6 neighboring
cell sites

 The BSS determines when the handover

should occur based on the cell measurements
and traffic loading on the neighboring cell sites

 The Handover may be to:

 Another radio channel in the same cell site
 A new cell site within the same BSC
 A new cell site with a new BSC
 A new cell site with a new MSC/VLR

 The GSM handover is ‘hard’:

 The MS can only communicates with one cell site at a
time

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 48

GSM identifiers
 International mobile subscriber identity (IMSI):
 Unique 15 digits assigned by service provider = home
country code + home GSM network code + mobile
subscriber ID + national mobile subscriber ID

 International MS equipment identity (IMEI):

 Unique 15 digits assigned by equipment manufacturer
= type approval code + final assembly code + serial
number + spare digit

 Temporary mobile subscriber identity (TMSI):

 32-bitnumber assigned by VLR to uniquely identify an
MS within a VLR’s area
NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 49
 GSM: indirect routing to mobile
home
HLR
network correspondent
2
home
Mobile
home MSC consults HLR, Switching
gets roaming number of Center
mobile in visited network
1 call routed
to home network
3 Public
VLR switched
Mobile
telephone
Switching
network
Center
4
home MSC sets up 2nd leg of call
to MSC in visited network

mobile
user MSC in visited network completes
call through base station to mobile
visited
network
NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 50
GSM: handoff with common MSC
 Handoff goal: route call via new
base station (without interruption)
 Reasons for handoff: VLR Mobile
 Stronger signal to/from the new BSS Switching
Center
(continuing connectivity, less battery
drain)
old new
 Load balance: free up a channel in routing routing
the current BSS old BSS
new BSS
 GSM doesn’t mandate why to
perform handoff (policy), only how
(mechanism)
 Handoff initiated by old BSS

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 51

 GSM: handoff with common MSC
1. Old BSS informs MSC of impending
handoff, provides list of 1+ new BSSs
2. MSC sets up path (allocates resources)
to new BSS
VLR Mobile
3. New BSS allocates radio channel for
Switching
use by mobile Center
2
4. New BSS signals MSC, old BSS: ready 4
1
5. Old BSS tells mobile: perform handoff 7
8
to new BSS 3
6. Mobile signals new BSS to activate old BSS 5 6
new channel new BSS

7. Mobile signals via new BSS to MSC:

handoff complete. MSC reroutes call
8. MSC-old-BSS resources released

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 52

GSM: handoff between MSCs

 Anchor MSC: first MSC

home network
visited during the call
correspondent  Call remains routed through
Home
MSC anchor MSC
 New MSCs add on to end
anchor MSC
PSTN of MSC chain as mobile
MSC
moves to new MSC
MSC MSC

(a) before handoff

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 53

GSM: handoff between MSCs

 Anchor MSC: first MSC

home network
visited during the call
correspondent  Call remains routed through
Home
MSC anchor MSC
 New MSCs add on to end
anchor MSC
PSTN of MSC chain as mobile
MSC
moves to new MSC
MSC MSC

(b) after handoff

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 54

Mobility: GSM versus Mobile IP
GSM element Comment on GSM element Mobile IP element
Home system Network to which the mobile user’s permanent Home network
phone number belongs
Gateway Mobile Switching Home MSC: point of contact to obtain routable Home agent
Center, or “home MSC”. address of mobile user. HLR: database in home
Home Location Register system containing permanent phone number, profile
(HLR) information, current location of mobile user,
subscription information
Visited System Network other than home system where mobile user Visited network
is currently residing
Visited Mobile services Visited MSC: responsible for setting up calls to/from Foreign agent
Switching Center. mobile nodes in cells associated with MSC. VLR:
Visitor Location Record temporary database entry in visited system,
(VLR) containing subscription information for each visiting
mobile user
Mobile Station Roaming Routable address for telephone call segment Care-of-address
Number (MSRN), or between home MSC and visited MSC, visible to
“roaming number” neither the mobile nor the correspondent.

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 55

 Quiz
 Given that:
 A cellular service provider owns a bandwidth of 100MHz
 Each analog voice channel requires 25kHz
 The service area is 1000 km2
 The coverage area of each cell site is 1 km2

 Answer the following:

1. What is the total number of voice channels available? 50M/25k = 4000
2. How many cell sites are needed to cover the service area? 1000/1=1000
3. What is the maximum number of calls that can be served in the whole
service area given that a reuse factor of 4 is used? Assume that FDMA is
only used. (4000/2)/4x1000=500000
4. Repeat part 3 assuming that TDMA is used within each analog channel
with 10 time slots per channel and 1 slot per call. 500000x10=5M

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 56

 1
2

NES440: Wireless Networks Copyright © Dr. Fahed H. Awad 57