GSM

Global System for Mobile communication

GPRS
General Packet Radio Service

Examples of digital wireless systems

(all originally specified by ETSI) GSM (Global System for Mobile communication) is a cellular mobile system cellular concept high mobility (international roaming) TETRA (TErrestrial Trunked RAdio) is an example of a Professional/Privat Mobile Radio (PMR) system limited access (mainly for professional usage) limited mobility (but other advanced features)

DECT (Digital Enhanced Cordless Telecommunications) is a cordless system low mobility (only within isolated islands)

next lecture

Digital PLMN systems (status 2002)

(PLMN = Public Land Mobile Network) 2nd Generation (2G) GSM
FDD

3rd Generation (3G) IMT-2000 UMTS:

4G

GPRS
Packet services

More radio capacity

UTRA FDD UTRA TDD

EDGE

IS-136 USA IS-95

CDMA 2000

Duplexing
(separation of uplink/downlink transmission directions) FDD (Frequency Division Duplexing)
(GSM/GPRS, TETRA, UTRA FDD)

Uplink
duplex separation

Downlink
frequency

TDD (Time Division Duplexing)

(DECT, UTRA TDD)

...

UL

DL

UL

DL

...
time

FDD vs. TDD

FDD Duplex filter is large and expensive TDD Large MS-BS separation => inefficient Same fading in UL/DL

=> indoor

Different fading in UL/DL Same UL/DL bandwidth

=> effect on power control

asymmetric services

Flexible UL/DL bandwidth allocation

GSM => cellular concept

The GSM network contains a large number of cells with a base station (BS) at the center of each cell to which mobile stations (MS) are connected during a call. If a connected MS (MS in call phase) moves between two cells, the call is not dropped. Instead, the network performs a handover (US: hand-off).

BS

BS MS

BS

BS

GSM => mobility concept

The GSM network is divided into location areas (LA), each containing a certain number of cells. Location Area 1 Location Area 2 As long as an idle MS (idle = switched on) moves within a location area, it can be reached through paging.

Location Area 3

If an idle MS moves between two location areas, it cannot be reached before it performs a location update.

Original GSM system architecture

BSS ME SIM MS BTS BTS MS MS = BS database BSC NSS MSC VLR HLR AuC GMSC

EIR

GSM: circuit switched connections

BSS ME SIM MS BTS NSS GMSC MSC VLR HLR AuC

BSC
TRAU

EIR
Circuit switched connection Signaling Database

GPRS: packet switched connections

BSS TE ME SIM MS BTS NSS GMSC MSC VLR HLR AuC

BSC
PCU

SGSN
Packet switched connection Signaling Database

EIR

IP backbone

GGSN

Upgrading from GSM to GSM/GPRS

BSS TE ME SIM MS BTS NSS GMSC MSC VLR HLR AuC

BSC
PCU

SGSN

EIR

New MS/terminals Packet Control Unit (PCU) SGSN and GGSN routers software updates (BTS, HLR)

IP backbone

GGSN

Task division between MSC and TRAU

(TRAU = Transcoding and Rate Adaptation Unit)
BSS BSC MS BSC for signalling only TRAU Conventional 64 kbit/s PCM signal 13 kbit/s encoded speech is packed into 16 kbit/s frame NSS MSC VLR

MS

BTS

Radio interface - multiple access techniques

frequency

Time division

time

code nr.

Frequency division

Code division

Radio interface - physical channels

TS0 Carrier 0 T S S Typically used for signaling T T T T T T S TS1 S T

Carrier 1

T TS2

TT

Physical channel = time slot TS2 T T T T T T T T

Carrier 2

Carrier 3

Frame of length 8 time slots

Time Slot

Radio interface - logical channels (GSM)

Traffic channels TCH/F Broadcast TCH/H SCH FCCH BCCH RACH PCH AGCH bidirectional downlink uplink SACCH FACCH SDCCH Common control Dedicated Control channels (for signaling)

GSM burst structure

GSM normal burst: 156.25 bits (0.577 ms)
3 57 encrypted bits 1 26 training bits 1 57 encrypted bits 3 8.25

traffic or signaling info in burst?

TDMA frame (4.615 ms):

TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1

TDMA multiframe:
1 2 3 4 5 6 7 8 9 10 11 12

SACCH 13 14 15 Idle 23 24 25 26

= 26 TDMA frames (in case of TCH)

GSM speech encoding

Voice coding: 260 bits in 20 ms blocks (13 kbit/s) MS - TRAU

260 bits

260 bits

Channel coding: 456 coded bits (22.8 kbit/s) MS - BTS

456 bits bits 4, 12, 20, 28, 36, 44, etc. from the 456 bit frame

Interleaving: 8 x 57 bits (22.8 kbit/s)

57 bits

57 bits

57 bits

GSM signaling message encoding

Signaling message is segmented into blocks of 184 bits:

184 bits

Each block is coded into 456 bits (22.8 kbit/s)

456 bits bits 4, 12, 20, 28, 36, 44, etc. from the 456 bit frame

Interleaving: 8 x 57 bits (22.8 kbit/s)

57 bits

57 bits

57 bits

Task Management in GSM/GPRS

Radio Resource Management (RM)
Number refers to the remaining slides

1 Random access and channel reservation

Handover management 3 Ciphering (encryption) over radio interface

Mobility Management (MM)

IMSI/GPRS Attach (switch on) and Detach (switch off) Location updating (MS moves to other Location/Routing Area) 2 Authentication

Call Control (CC) in GSM Session Management (SM) in GPRS

MOC, MTC
PDP Context

5
6

Who is involved in what?

MS BTS BSC RR MSC/VLR SGSN

MM CM / SM

Random access in GSM/GPRS (1)

Communication between MS and network is not possible before going through a procedure called random access. Random access must consequently be used in network originated activity paging, e.g. for a mobile terminated call in GSM

MS originated activity IMSI attach, IMSI detatch GPRS attach, GPRS detach location updating in GSM or GPRS mobile originated call in GSM SMS (short message service) message transfer

Random access in GSM/GPRS (2)

1. MS sends a short access burst over the Random Access CHannel (RACH) in uplink using Slotted Aloha (collision possibility retransmission) 2. After detecting the access burst, the network (BSC) returns an immediate assignment message which includes the following information: - allocated physical channel (frequency, time slot) in which the assigned signalling channel is located - timing advance (for correct time slot alignment) 3. The MS now sends a message on the dedicated signalling channel assigned by the network, indicating the reason for performing random access.

Four security measures in GSM

1) PIN code (authentication of SIM = local security measure, network is not involved) 2) User authentication (performed by network) 3) Ciphering of information sent over air interface 4) Usage of TMSI (instead of IMSI) over air interface IMSI = International Mobile Subscriber Identity (globally unique identity) TMSI = Temporary Mobile Subscriber Identity (local and temporary identity)

Basic principle of user authentication

SIM (in terminal) Air Interface RAND Network

Challenge

Random number

algorithm
Authentication key Ki

Response SRES

algorithm
Authentication key Ki

The same? If yes, authentication is successful

3 MS

Ciphering in GSM
Cipher command (time info...) Kc BTS Kc Time info Ciphering key

Time info

Ciphering key

Data

algorithm algorithm

Ciphered data

algorithm algorithm

Data

For each call, a new ciphering key (Kc) is generated during authentication both in MS and MSC (in same way as authentication response).

Three security algorithms in GSM

(in UMTS many more )

Mobile Station (MS)

Ki A3

Network

RAND (from network) SRES (to network)

A8 Kc Data Time info (from network)

A5

Ciphered data

Three security algorithms in GSM

at the network side ...

MS
Ki SRES ?

Serving MSC
RAND SRES Kc Kc A5 Data SRES

AuC
RAND A3

Time info Ciphered data

A8

Ki

Authentication vector

Algorithm considerations

Using output and one or more inputs, it is in practice not possible to calculate backwards other input(s) brute force approach, extensive search Key length in bits (N) is important (in case of brute force approach 2N calculation attempts may be needed) Strength of algorithm is that it is secret => bad idea! security through obscurity

Better: open algorithm can be tested by engineering community (security through strong algorithm)

3
MS

Usage of TMSI in GSM

Random access TMSI Network

Authentication Start ciphering IMSI is never sent over air interface if not absolutely necessary! New TMSI allocated by network

CM or MM transaction
IMSI detach New TMSI stored in SIM

Connectivity states in GSM/GPRS

GSM Disconnected Idle Connected GPRS Idle Standby Ready MS is switched off (packet mode) location updates on RA basis location updates on cell basis MS is switched off (circuit mode) location updates on LA basis handovers, not location updates

GPRS connectivity state model

No location management, MS not reachable GPRS detach Location update when MS changes cell

Idle
GPRS attach Standby timer expired

Ready
Timer expired

Transmission of packet Location update when MS changes routing area

Standby

MM areas in GSM/GPRS
Cell
Location updating in GPRS (ready state)

Location Area (LA) Routing Area (RA)

Location updating in GPRS (standby state)
Location updating in GSM

Trade-off when choosing LA/RA size

If LA/RA size is very large (e.g. whole mobile network) + location updates not needed very often paging load is very heavy

Affects capacity

If LA/RA size is very small (e.g. single cell)

+ small paging load location updates must be done very often
Affects signalling load

Example: GSM location update (1)

(most generic scenario)
ME

SIM
LAI 1 IMSI TMSI

LAI 1 (in broadcast messages)

MSC
VLR 1

IMSI TMSI

MSC

HLR
IMSI LAI 1

VLR 2

Most recently allocated TMSI and last visited LAI (Location Area ID) are stored in SIM even after switch-off.

After switch-on, MS monitors LAI. If stored and monitored LAI values are the same, no location updating is needed.

GSM location update (2)

ME

SIM
LAI 1 IMSI TMSI

(in broadcast messages)

LAI 2

MSC
VLR 1

IMSI TMSI

MSC

HLR
IMSI LAI 1

VLR 2

Different LAI values => location update required !

GSM location update (3)

ME

MSC
VLR 1
LAI 1, TMSI

SIM
LAI 1 IMSI TMSI

IMSI TMSI

MSC

HLR
No TMSI - IMSI context
IMSI LAI 1

VLR 2

SIM sends old LAI and TMSI to VLR 2. VLR 2 does not recognize TMSI since there is no TMSIIMSI context. Who is this user?

GSM location update (4)

ME

MSC
VLR 1
IMSI

SIM
LAI 1 IMSI TMSI

IMSI TMSI

MSC

VLR 2

IMSI TMSI

address: LAI 1

HLR
IMSI LAI 1

However, VLR 2 can contact VLR 1 (address: LAI 1) and request IMSI.

IMSI is sent to VLR 2.

GSM location update (5)

ME

MSC
VLR 1 MSC
IMSI TMSI

SIM
LAI 1 IMSI TMSI

IMSI TMSI

HLR
LAI 2
IMSI LAI 1 LAI 2

VLR 2

Important: HLR must be updated (new LAI). If this is not done, incoming calls can not be routed to new MSC/VLR. HLR also requests VLR 1 to remove old user data.

GSM location update (6)

ME

MSC
VLR 1 MSC HLR
IMSI TMSI TMSI IMSI LAI 2

SIM
LAI 1 IMSI TMSI LAI 2 TMSI

LAI 2 TMSI

VLR 2

VLR 2 generates new TMSI and sends this to user. User stores new LAI and TMSI safely in SIM. Location update successful !

GSM identifiers (1)

IMSI Globally unique = MSIN GSM internal information

MCC = Mobile Country Code (3 digits) MNC = Mobile Network Code (2 digits) MSIN = Mobile Subscriber Identity Number (10 digits)

LAI Globally unique

LAC

CI

MCC = Mobile Country Code (3 digits) MNC = Mobile Network Code (2 digits) LAC = Location Area Code (10 digits)

LAI + CI = CGI Cell Global Identity

GSM identifiers (2)

for routing to GMSC MSISDN Globally unique = CC SN subscriber database in HLR E.164 numbering format

CC = Country Code (1-3 digits) NDC = National Destination Code (1-3 digits) SN = Subscriber Number for routing to MSC/VLR

temporary subscriber ID E.164 numbering format

MRSN Temporary allocation

CC

TN

CC = Country Code (1-3 digits) NDC = National Destination Code (1-3 digits) TN = Temporary Number

GSM mobile terminated call (1)

Mobile terminated call = MTC
BSC
MSC BTS VLR HLR AuC GMSC

ME SIM MS

EIR
Circuit switched connection (64 kb/s PCM, 16 kb/s between TRAU and BTS, 13 kb/s encoded speech over air interface) Signaling (ISUP, MAP) Database

GSM mobile terminated call (2)

GMSC MSC BTS VLR HLR AuC

ME SIM MS

BSC

EIR

Call is routed to GMSC using MSISDN number of called user (e.g. 040 1234567).

MSISDN number in fact points to database in HLR.

HLR is contacted. Under which MSC/VLR is user?

GSM mobile terminated call (3)

GMSC MSC BTS VLR HLR AuC

ME SIM MS

BSC

EIR

HLR knows location of Serving MSC/VLR (when user moves to another VLR, this is always recorded in HLR).

HLR requests MSRN (roaming number) from VLR.

MSRN is forwarded to GMSC.

GSM mobile terminated call (4)

GMSC MSC BTS VLR HLR AuC

ME SIM MS

BSC

EIR

Call can now be routed to Serving MSC/VLR using ISUP (may involve several intermediate switching centers).

MSC/VLR starts paging within Location Area (LA) in which user is located, using TMSI for identification.

GSM mobile terminated call (5)

GMSC MSC BTS VLR HLR AuC

ME SIM MS

BSC

EIR

Only the mobile user with the corresponding TMSI responds to the paging.

Using random access procedure, user requests a channel, e.g. SDCCH, for call control signaling.

GSM mobile terminated call (6)

GMSC MSC BTS VLR HLR AuC

ME SIM MS

BSC

EIR

Signaling channel is set up. After authentication and ciphering procedures, call control signaling continues.

Finally, the circuit switched connection is established up to mobile user.

GPRS attach / PDP session

GPRS attach Separate or combined GSM/GPRS attach MS registers with an SGSN (authentication...) Location update possible PDP context is created MS is assigned PDP (IP) address Packet transmission can take place GPRS detach PDP context terminated Allocated IP address released In case of dynamic address allocation
DHCP RADIUS

PDP context

PDP context describes characteristics of GPRS session (session = always on connection) PDP context information is stored in MS, SGSN and GGSN MS ::: :::
123.12.223.0 123.12.223.9

One user may have several PDP sessions active

PDP type (e.g. IPv4) PDP address = IP address of MS (e.g. 123.12.223.9) Requested QoS (priority, delay ) Access Point Name (GGSN address as seen from MS)

SGSN ::: :::

GGSN ::: :::

PDP context activation

MS SGSN GGSN

Activate PDP context request Security functions Create PDP context request
::: :::

IP address allocated to MS
::: :::

Create PDP context response

::: :::

Activate PDP context accept

Packet transmission (1)

MS (client) SGSN
IP backbone

Server (IP, WAP..) ? GGSN

Dynamic IP address allocation has one problem: it is difficult to handle a mobile terminated transaction (external source does not know IP address of MS) Fortunately, packet services are of client-server type => MS initiates packet transmission

Packet transmission (2)

MS (client) SGSN Server (IP, WAP..)

Packet is tunneled through IP backbone

GGSN Packet is sent to SGSN. SGSN sends packet to GGSN through GTP (GPRS Tunneling Protocol) tunnel.
Tunneling = encapsulation of IP packet in GTP packet IP address ... IP address IP payload

... = APN of GGSN, used for routing through tunnel

Packet transmission (3)

MS (client) SGSN Server (IP, WAP..)
Source IP address: GGSN

GGSN

GGSN sends packet through external IP network (i.e. Internet) to IP/WAP server.
Source IP addr.
GGSN

Dest. IP addr.
Server

IP payload

Packet transmission (4)

MS (client) SGSN Server (IP, WAP..)
Dest. IP address: GGSN

Dest. IP address: MS Dest. tunnel address: SGSN

GGSN

Server sends return packet via GGSN, GTP tunnel and SGSN to MS.

Packets from server to MS are always routed via GGSN (since this node has PDP context information).

Further information on GSM/GPRS

Books:

Many good books available (GSM)

Andersson: GPRS and 3G wireless applications, Wiley, 2001, Chapter 3 (GPRS) Web material: www.comsoc.org/livepubs/surveys/public/4q99issue/ reprint4q.html (GSM system and protocol architecture) www.comsoc.org/livepubs/surveys/public/3q99issue/ bettstetter.html (GPRS basics)
Part of this source is required course material