Chap 5
2G: GSM System
Outlines
z Introduction
z GSM Architecture
z Air Interface
z Location Tracking and Call Setup
z HandOff
z Security
z Summary
Introduction
Introduction
z Global System for Mobile Communications
(GSM) is a digital wireless network standard.
z It was developed by Group Special Mobile of
Conference Europeenne des Postes et
Telecommunications (CEPT) and European
Telecommunications Standards Institute
(ETSI).
z GSM Phases 1 and 2 define digital cellular
telecommunications system.
z GSM Phase 2+ targets on Speech Codec
and Data Service.
The Basic Requirements of
GSM
Basic Requirements set out by GSM
z
z
z
z
z
z
z
Original text as written by the committee in 1985
Services
Quality of Services and Security
Radio Frequency Utilization
Network
Cost
GSM Architecture
GSM System Structure
AUC
PSTN
PSTN
GMSC
ILR
SS
HLR
EIR
DTI
MSC/
VLR
MS
BSS
RBS
BSC
OMC
GSM Architecture
BTS
BTS
ME
EIR
BSC
HLR VLR
AUC
BTS
Cloud
SIM
MS
Abis interface
Um interface
Cloud
BTS
BTS
GMSC
MSC
BSC
BTS
Base Station
Subsystems (BSS)
A interface
Network
Network and
and Switching
Switching
Subsystem
Subsystem
(NSS)
PSTN Cloud
Cloud
Mobile Station (MS)
z Also called Mobile Terminal (MT)
z The MS consists of two parts:
Subscriber Identity Module (SIM)
z Mobile Equipment (ME)
z
SIM
z A SIM contains subscriber-related information
A list of abbreviated and customized short dialing
numbers
z Short message
z Names of preferred Networks to provide service
z
z Personal Identity Number (PIN) .
SIM
z
SIM contains important information including
z
z
z
z
z
z
z
IMSI
Ki
TMSI
Access Control Code
Kc
LAI
SIM information can be modified:
z
z
By the subscriber either by keypad or a PC using an
RS232 connection
By sending codes through short messages (network
operators)
Mobile Equipment (ME)
z ME: non-customer-related hardware and
software specific to the radio interface
z ME can not be used if no SIM is on the MS.
z
Except for emergency calls
z The SIM-ME design supports portability:
The MS is the property of the subscriber.
z The SIM is the property of the service provider.
z
Base Station System (BSS)
z The Base Station System (BSS) connects the
MS and NSS.
z BSS contains
Base transceiver station (BTS)
z Base station controller (BSC)
z
BTS
z Base Transceiver Station (BTS) contains
Transmitter
z Receiver
z Signaling equipment specific to the radio
interface in order to contact the MSs.
z Transcoder/Rate Adapter Unit (TRAU)
z
z GSM-specific speech encoding/decoding and rate
adaptation in data transmission
Omni-directional Antenna
GSM 1800
GSM 900
Lightning
conductor
Directional Antenna
Lightning
conductor
GSM 900
GSM 1800
Directional Antenna
BSC (1/2)
z Base Station Controller (BSC)
Radio channel assignment
z Handoff management
z Connect to an MSC
z Connect to several BTSs
z
z Maintain cell configuration data of these BTSs.
z The BSC communicates with the BTSs via the A-bis.
BSC (2/2)
z The processor load of a BSC:
Call activities (around 20-25%)
z Paging and short message service (around 1015%)
z Mobility management (handoff and location
update, around 20-25%
z Hardware checking/network-triggered events
(around 15-20%)
z
z When a BSC is overloaded, it first rejects
location update, next MS originating calls,
then handoff.
NSS (1/2)
z Network and Switching Subsystem (NSS)
Telephone switching functions
z Subscriber profiles
z Mobility management
z
z Components in NSS:
MSC: provide basic switching function
z Gateway MSC (GMSC): route an incoming call to
an MSC by interrogating the HLR directory.
z
NSS (2/2)
z Components in NSS (continuous):
HLR and VLR maintain the current location of the
MS.
z Authentication Center (AuC) is used in the
security management.
z Equipment Identity Register (EIR) is used for
the registration of MS equipment.
z
GSM Interfaces
BTS
BTS
ME
EIR
BSC
HLR VLR
AUC
BTS
MAP interface
SIM
MS
Abis interface
Um interface
Cloud
BTS
BTS
GMSC
MSC
BSC
BTS
Base Station
Subsystems (BSS)
A interface
Network
Network and
and Switching
Switching
Subsystem
Subsystem
(NSS)
Cloud
PSTN Cloud
Cloud
Air Interface
Radio Interface－Um (1/3)
z The GSM radio link uses TDMA/FDD
technology.
890-915 MHz (uplink)
z 935-960 MHz (downlink)
z 124 pairs × 200 KHz
z 8 time slots (bursts) per carrier
z A frame consists 8 timeslots (each 0.577 msec for
a time slot).
z The length of GSM frame in a frequency carrier is
4.615 msec.
z
Radio Interface－Um (2/3)
Downlink
FDMA
C0
TS0 TS1 TS2 TS3 TS4
TS5 TS6 TS7
TS0 TS1 TS2
TS3 TS4
892.2 MHz
C1
TS0 TS1 TS2 TS3 TS4
TS5 TS6 TS7
TS0 TS1 TS2
TS3 TS4
892.4 MHz
Frame
MS
Control channel
Traffic channel
Frame (TDMA)
GSM Normal Burst
Tailing
Data
3
57 bits
Flag Training Flag
1
26 bits
1
Data
57 bits
Tailing Guard
3
8.25 bits
Burst (148 bits/0.564 msec)
Time Slot (156.25 bits or 0.577 msec)
z Begin with 3 head bits, and end with 3 bits.
z Two groups are separated by an equalizer
training sequence of 26 bits.
z The flags indicates whether the information
carried is for speech/data, or signaling.
Logical Channels
Traffic Channel (TCH)
z TCHs are intended to carry user information
(speech or data).
z
Full-rate TCH (TCH/F)
z Transmission speed: 13 Kbps for speech
z Transmission speed: 9.6, 4.8 or 2.4 Kbps for data
z
z
Enhanced full-rate (EFR) speech coders for improving
the speech quality
Half-rate TCH (TCH/H)
z Transmission speed: 6.5 Kbps speech
z Transmission speed: 4.8 or 2.4 Kbps of data.
Control Channels (CCH)
z CCHs: to carry signaling information
z Three types of CCHs :
Broadcast channel (BCH)
z Common control channel (CCCH)
z Dedicated control channel (DCCH)
z
Broadcast Channels (BCHs)
z BTS broadcasts system information to the
MSs through BCHs.
z Two types in BCH:
z
Frequency Correction Channel (FCCH) and
Synchronization Channel (SCH)
z The information allows the MS to acquire and stay
synchronized with the BSS.
z
Broadcast Control Channel (BCCH) (downlink)
z Access information for the selected cell
z Information related to the surrounding cells to support
cell selection
z Location registration procedures in an MS
Common Control Channel (CCCH)
z Three types in CCCH:
z
Random Access Channel (RACH) (uplink)
z Used by the MSs for initial access to the network
z Collision may occurs.
z Slotted Aloha protocol is used to resolve access
collision.
z
Access Grant Channel (AGCH) (downlink)
z Used by the network to indicate radio link allocation
upon prime access of an MS
z
Paging Channel (PCH) (downlink)
z
Used by the network to page the destination MS in
call termination
Dedicated Control Channel (DCCH) (1/2)
z DCCH is for dedicated use by a specific MS.
z Four types in DCCH:
z
Standalone Dedicated Control Channel (SDCCH)
(down/uplink)
z used only for signaling and for short message
z
Slow Associated Control Channel (SACCH)
(down/uplink)
z Associated with either a TCH or an SDCCH
z For non-urgent procedures
z Power and time alignment control information
(downlink)
z Measurement reports from the MS (uplink)
Dedicated Control Channel
(DCCH) (2/2)
z Four types in DCCH (continuous):
z
Fast Associated Control Channel (FACCH)
(down/uplink)
z Used for time-critical signaling, such as call-
establishing progress, authentication of subscriber, or
handoff.
z FACCH use TCH during a call.
z May cause user data loss.
z
Cell Broadcast Channel (CBCH) (downlink)
z Carries only the short message service cell broadcast
messages, which use the same time slot as the
SDCCH.
GSM Burst Structure
Tailing
Data
Flag Training Flag
Data
3
57 bits
1
57 bits
26 bits
1
Tailing Guard
3
8.25 bits
Normal Burst
Tailing
Fixed Bits
3
142 bits
Tailing Guard
3
8.25 bits
Frequency Correction Burst
Tailing
Data
Training
Data
3
39 bits
64 bits
39 bits
Tailing Guard
Synchronization Burst
Tailing
3
Synch. Seq.
Data
Tailing
Guard
41 bits
36 bits
3
68.25 bits
Access Burst
3
8.25 bits
Example of Channel Usage
(GSM Call Origination)
Example of Channel Usage
(GSM Call Termination)
Mobility Databases
Mobility Databases
z The hierarchical databases used in GSM.
The home location register (HLR) is a database
used for MS information management.
z The visitor location register (VLR) is the database
of the service area visited by an MS.
z
HLR
VLR 1
MSC 1
MSC 2
VLR 2
Key Terms
z GSM uses some identifiers
Mobile system ISDN (MSISDN)
z Mobile Station Roaming Number (MSRN)
z International Mobile Subscriber Identity (IMSI)
z Temporary Mobile Subscriber Identity (TMSI)
z International Mobile station Equipment Identity
(IMEI)
z Location Area Identity (LAI)
z Cell Global Identity (CAI)
z
MSISDN
z Mobile System ISDN
MSISDN uses the same format as the ISDN
address (based on ITU-T Recommendation
E.164).
z HLR uses MSISDN to provide routing instructions
to other components in order to reach the
subscriber.
z
Total up to 15 digits
Country code
(CC)
National destination
code (NDC)
Subscriber
number (SN)
MSRN
z Mobile Station Roaming Number
z The routing address to route the call to the
MS through the visited MSC.
z
MSRN=CC+NDC+SN
IMSI
z International Mobile Subscriber Identity
Each mobile unit is identified uniquely with an
IMSI.
z IMSI includes the country, mobile network, mobile
subscriber.
z Total up to 15 digits
z
3 digits
1- 2 digits
Up to 10 digits
Mobile country Mobile network Mobile subscriber
code (MCC)
code (MNC)
identification code (MSIC)
TMSI
z Temporary Mobile Subscriber Identify
TMSI is an alias used in place of the IMSI.
z This value is sent over the air interface in place of
the IMSI for purposes of security.
z
IMEI
z International Mobile Station Equipment
Identity
IMEI is assigned to the GSM at the factory.
z When a GSM component passes conformance
and interoperability tests, it is given a TAC.
z Up to 15 digits
z
3 digits
2 digits
Up to 10 digits
Type approval Final assembly
Serial number (MSIC)
code (FAC)
code (FAC)
Spare 1 digit
LAI
z Location Area Identity
LAI identifies a location area (LA).
z When an MS roams into another cell, if it is in the
same LAI, no information is exchanged.
z Total up to 15 digits
z
3 digits
1-2 digits
Up to 10 digits
Mobile country Mobile network Location area code (LAC)
code (MCC)
code (MNC)
CGI
z Cell Global Identity
z CGI = LAI + CI
= MCC + MNC + LAC + CI
z
CI : Cell Identity
Home Location Register (HLR)
z An HLR record consists of 3 types of
information:
z
Mobile station information
z IMSI (used by the MS to access the network)
z MSISDN (the ISDN number－“Phone Number” of the
MS)
z
Location information
z ISDN number of the VLR (where the MS resides)
z ISDN number of the MSC (where the MS resides)
z
Service information
z service subscription
z service restrictions
z supplementary services
Visitor Location Register (VLR)
z The VLR information consists of three parts:
z
Mobile Station Information
z IMSI
z MSISDN
z TMSI
z
Location Information
z MSC Number
z Location Area ID (LAI)
z
Service Information
z A subset of the service Information stored in HLR
Identifiers and Components
號碼
MSISDN
HLR VLR/MSC BSC
BTS
9
MS
9
9
MSRN
9
9
TMSI
9
9
LAI
9
IMSI
9
9
9
CGI
MSC號碼
9
9
Location Tracking
(Mobility Management)
Location Update
BS 1
BS 2
BS 3
Two-level Hierarchical
Strategy
z The current location of an MS is maintained
by a two-level hierarchical strategy with the
HLR and the VLRs.
HLR
VLR 1
MSC 1
MSC 2
VLR 2
Location Area
z Location area (LA) is the basic unit for
location tracking.
MSC
MSC
MSC
LA 2
LA 3
LA 1
GSM Location Area Hierarchy
HLR
VLR1
MSC1
MSC2
LA2
LA1
MS
VLR2
HLR : HOME Location Register
VLR : VISITOR Location Register
MSC : Mobile Switching Center
LA : Location Area
MS : Mobile Station
Location Update Concept
z Registration: the location update procedure
initiated by the MS:
Step 1. BS periodically broadcasts the LA
address.
z Step 2. When an MS finds the LA of BS different
from the one stored in it memory, it sends a
registration message to the network.
z Step 3. The location information is update.
z
Periodically Registration
z The MS periodically send registration
messages to the network.
z The period is 6 minutes to 24 hours.
z Periodic registration is useful for faulttolerance purposes.
GSM Basic Location Update
Procedure
z In GSM, registration or location update
occurs when an MS moves from one LA to
another.
z Three cases of location update:
Case 1. Inter-LA Movement
z Case 2. Inter-MSC Movement
z Case 3. Inter-VLR Movement
z
Inter-LA Registration
Inter-LA Movement (1/2)
z Two LAs belong to the same MSC.
z Four major steps:
z
Step 1. MS sends a location update request
message (MS→BTS→MSC) .
z Parameters included: TMSI, Previous LA, target LA,
previous MSC and previous VLR.
z IMSI (International Mobile Subscriber Identity) is used
to identify MS.
z However, the MS identifies itself by the Temporary
Mobile Subscriber Identity (TMSI).
z TMSI is used to avoid sending the IMSI on the radio
path.
z TMSI is temporary identity is allocated to an MS by
the VLR at inter-VLR registration.
Inter-LA Movement (2/2)
z The Process continues:
z
Step 2. The MSC forwards the location update
request to the VLR by a TCAP message,
MAP_UPDATE_LOCATION_AREA.
z Parameter includes:
Address of the MSC, TMSI,
previous Location Area Identification (LAI), target LAI,
Other related information
z
Steps 3 and 4.
z Part I. The VLR find that both LA1 and LA2 belong to
the same MSC.
z Part II. The VLR updates the LAI field of the MS.
z Part III. The VLR replies an ACK to the MS through
the MSC.
Inter-MSC Registration
Inter-MSC Movement (1/2)
z The two LAs belong to different MSCs of the
same VLR.
z The process is:
Steps 1 and 2. MS sends a location update
request message (MS→BTS→MSC) .
z Step 3.
z
z Part I. VLR1 finds that the LA1 and LA2 belong to
MSC1 and MSC2, respectively. Two MSCs are
connected to VLR1.
z Part II. VLR1 updates the LAI and MSC fields of MS.
z Part III. The VLR1 derives the HLR address of the MS
from the MS’s IMSI.
Inter-MSC Movement (2/2)
z The process continues:
z
Step 3.
z Part IV. The VLR1 sends the
MAP_UPDATE_LOCATION to the HLR.
z Parameter includes: IMSI, previous MSC Address,
target MSC Address, VLR Address, other related
information
Step 4. HLR updates the MSC number field of
the MS. An acknowledgement is sent to VLR1.
z Steps 5 and 6. The acknowledgement is
forwarded to the MS.
z
Inter-VLR Registration
Message Flow
f
5
HLR
7
g
VLR2
4
VLR1
8
3
h
c
1
2
6
MSC2
MSC1
6
1
LA2
LA1
MS
MSC2
VLR2
HLR
VLR2
1. MAP_UPDATE_LOCATION_AREA
2. MAP_SEND_IDENTIFICATION
3. MAP_SEND_IDENTIFICATION_ack
4. MAP_UPDATE_LOCATION
5. MAP_UPDATE_LOCATION_ack
6. MAP_UPDATE_LOCATION_AREA_ack
7. MAP_CANCEL_LOCATION
8. MAP_CANCEL_LOCATION_ack
MS Registration Process (2/2)
HLR
deregistration
消除VLR內資料
5
Old
VLR
認證成功後向
HLR進行
3 location update
TMSI
New
VLR
2
MS’s IMSI 及其他認證資料
1
TMSI
4
new TMSI
Inter-VLR Movement (1/2)
z Two LAs belong to MSCs connected to
different VLRs.
z The process is:
Step 1. MS sends a location update request.
MSC2 sends MAP_UPDATE_LOCATION_AREA
to VLR 2 with MS’s TMSI.
z Steps 2 and 3.
z
z VLR2 does not have the record of MS.
z VLR2 identifies the address the VLR1 and sends
MAP_SEND_IDENTIFICATION (with TMSI) to VLR1.
z VLR1 sends IMSI to VLR2.
Inter-VLR Movement (2/2)
z The process continues:
z
Steps 4 and 5.
z VLR2 creates a VLR record for the MS.
z VLR2 sends a registration message to HLR.
z HLR updates the record of the MS.
z HLR sends an acknowledge back to VLR2.
z
Step 6.
z VLR2 generates a new TMSI and sends it to the MS.
z
Steps 7 and 8.
z The obsolete record of the MS in VLR1 is deleted.
Call Origination and
Termination
Call Origination Operation
VLR V2
u1
2
3
PC
ST
loN
ud
C lo u d
VLR
M SC
T e r m in a tin g
S w itc h
2 . M A P _ S E N D _ IN F O _ F O R _ O U T G O IN G _ C A L L
3 . M A P _ S E N D _ IN F O _ F O R _ O U T G O IN G _ C A L L _ a c k
4 . IA M
M SC
GSM Basic Call Origination
z The process is
Step 1. MS sends the call origination request to
MSC.
z Step 2. MSC forwards the request to VLR with
message
MAP_SEND_INFO_FOR_OUTGOING_CALL.
z Step 3. VLR checks MS’s profile and sends
MAP_SEND_INFO_FOR_OUTGOING_CALL_ac
k to MSC to grant the call request.
z Step 4. MSC sets up the trunk according to the
standard PSTN call setup procedure.
z
Call Termination Message Flow
Call Termination (1/2)
z Routing information for call termination can
be obtained form the serving VLR.
z The basic call termination process:
Step 1. A MS’s ISDN (MSISDN) number is
dialed by a PSTN user. The call is routed to a
gateway MSC by an SS7 ISUP IAM message.
z Step 2. GMSC sends
MAP_SEND_ROUTING_INFORMATION with
the MSISDN to HLR.
z
Call Termination (2/2)
z The process continues:
z
Step 3. HLR sends a
MAP_PROVIDE_ROAMING_NUMBER to VLR.
z Parameter included: IMSI of the MS, the MSC number.
z
Steps 4 and 5. VLR creates Mobile Subscriber
Roaming Number (MSRN) by using the MSC
number stored in the VLR record.
z MSRN is sent back to the gateway MSC through HLR.
z MSRN provides the address of the target MSC where
the MS resides.
z
Step 6. An SS7 ISUP IAM message is directed
from the gateway MSC to the target MSC to setup
the voice trunk.
The Mobile Call Termination
(Delivery) Procedure
IMSI
MSISDN
1
1
1
MSISDN
IMSI
GMSC
HLR
2
2
MSRN
Cloud
Other
Cloud
Cloud
Switches
1
VLR
MSRN
3
依據PSTN正常
程序建立電話
Cloud
Other
Cloud
Cloud
Switches
3
MSC
3
Handoff (Handover)
Handoff
Two Aspects of Mobility in a
PCS Network
z Handoff
z Link transfer, or Handover
z A mobile user moves from one coverage area of
an old BS to the coverage area of a new BS
during the conversation.
z The radio link to the old BS is disconnected and
a radio link to the new BS should be established
to continue the conversation.
z Roaming
z When a mobile user moves from one system
another, the user location should tell the PCS
system.
to
BS Coverage Area
z BS coverage area：irregular.
z In the cell boundary：
z Signal from a neighboring BS u
z Signal from the serving BS v
z Otherwise: Forced termination
Handoff Cost
z Handoffs are expensive.
z Special for the system with small cell sizes
z Small cell size for
z To increase the capacity of the systems
z To reduce power requirements of MSs.
Issues for Handoff
Management
z Handoff detection
z Who and how
z Channel assignment
z Radio link transfer
Handoff Detection
Strategies for Handoff
Detection
z Who makes a decision for handoff？
z Three handoff detection schemes:
z Mobile-Controlled Handoff (MCHO)
z Network-Controlled Handoff (NCHO)
z Mobile-Assisted Handoff (MAHO)
z Others
Mobile-Controlled Handoff
(MCHO)
z MCHO is used in DECT and PACS.
z Part I. The MS continuously monitors the
signals of the surrounding BSs.
z Part II. The MS initiates the handoff process
when some handoff criteria are met.
Network-Controlled Handoff
(NCHO)
z Used in CT-2+ and AMPS
z Part I. The surrounding BSs measure the
signal from the MS.
z Part II. The network initiates the handoff
process when some handoff criteria are met.
z MSC controls the handoff.
Mobile-Assisted Handoff
(MAHO)
z Used in GSM, IS-136 and IS-95
z Part I. The network asks the MS to measure
the signal from the surrounding BSs.
z Part II. The network makes the handoff
decision based on the reports from the MS.
Channel Assignment for
Handoff Calls
Channel Assignment
z Purpose：to achieve a high degree of
spectrum utilization for a given grade of
service
z Ex：To reduce forced terminations
Forced Terminations
z Blocked call：Initial access requests fail
z For new call
z No available channels on the visited BS
z Forced terminations：Handoff requests fail
z For handoff call
z No available channel on the selected BSs
z Which one is serious, new call blocking or
force terminating?
Some trade-offs
z Service quality
z Spectrum utilization
z Implementation complexity of the channel
assignment algorithm
z Number of database lookups
Flowchart for Non-prioritized
Scheme
New or
handoff
call arrival
Channel
available?
no
Channel
blocked
Ongoing
call
Channel
released
yes
Channel
assigned
Flowchart for Reserved
Channel Scheme
New
call
arrival
Normal
channel
available?
no
Channel
blocked
yes
Channel
assigned
Ongoing
call
yes
Handoff
call
arrival
Normal
channel
available?
Channel
released
yes
no
Reserved
channel
available?
no
Link Transfer
Link Transfer
z Two operations:
z The radio link is
transferred from the
old BS to the new BS.
z The network bridges
the trunk to the new
BS and drop the trunk
to the old BS.
MSC
Old
BS
New
BS
Five Distinct Link Transfer
Cases (1/3)
1.
2.
3.
4.
5.
Intra-BTS handoff or intra-cell handoff
Inter-BTS handoff or inter-cell handoff
Inter-BSC handoff
Inter-MSC handoff or intersystem handoff
Intersystem handoff between two PCS
networks
Inter-BSC Handoff
(a) Before handoff
(b) After handoff
MSC 1
MSC 1
BSC 1
BSC 1
BSC 2
New
BS
New
BS
Old
BS
BSC 2
Old
BS
Intra-MSC
MS
Serving BSS
MSC
Target BSS
1 STRN_MEAS
2 HAND_REQ
3 HAND_REQ
4 HAND_REQ_ACK
5 HAND_COMM
6 HAND_COMM
7 HAND_ACC
8 CHH_INFO
9 HAND_DET
10 HAND_COMP
11 HAND_COMP
12 REL_RCH
13 REL_RCH_COMP
Inter-MSC Link Transfer
(a) Before handoff
(b) After handoff
PSTN
PSTN
PSTN
PSTN
MSC A
trunk
MSC B
MSC A
BS 2
BS 1
trunk
MSC B
BS 2
BS 1
Inter-MSC (1/2)
MS
Serving
BSS
Serving
MSC
Target
MSC
Target
BSS
1 STRN_MEAS
2 HAND_REQ
3 HAND_PER
4 HAND_NUM
5 HAND_NUM_COMP
6 HAND_REQ
7 HAND_REQ_ACK
8 HAND_PER_ACK
9 NET_SETUP
10 SETUP_COMP
11 HAND_COMM
12 HAND_COMM
Target
VLR
Inter-MSC (2/2)
MS
Serving
BSS
Serving
MSC
Target
MSC
Target
BSS
13 HAND_ACC
14 CHH_INFO
15 HAND_DET
16 HAND_COMP
17 HAND_COMP
18 SEND_ENDING
19 ANSWER
20 REL_RCH
21 REL_RCH_COMP
22 END_SIGNAL
23 NET_REL
24 ERL_HAND_NUM
Target
VLR
Anchor MSC
MSC A
BS 1
MSC B
MSC C
BS 2
BS 3
BS 4
BS 5
4
1
2
3
MSC A is the anchor MSC.
1: inter-BS handoff
2: handoff forward
3: handoff back
4: handoff to the third
Path Minimization
MSCA
MSCB
MSCA
(a) Handoff forwad
(a) Handoff Backwad
MSCB
MSCA
(c) Handoff to the Third
MSCB
MSCB
MSCc
MSCA
(d) Path Minimization
MSCc
Radio Link Transfer
Hard Handoff
Hard Handoff
z MS connects with only one
BS at a time.
z Interruption in the
conversation occurs
z Used in TDMA and FDMA
systems
z We will study the signaling of
handoff:
z MCHO Link Transfer
z MAHO/NCHO Link Transfer
z Subrating MCHO Link Transfer
MSC
Old
BS
New
BS
Hard Handoff Link Transfer for
MCHO
z A handoff request message is initiated by the
MS.
z The network can initiate the handoff.
z But always MS chooses the BS.
z MS selects a new radio channel.
z If a handoff failure occurs, the MS link-quality
maintenance process must decide what to do
next.
Soft Handoff
Soft Handoff
z MS connects to multiple BSs
simultaneously.
z BSs use the same frequency.
z BSs must be synchronized.
z The network must combine
the signals form the multiple
BSs simultaneously.
z Soft handoff is more
complicated than hard
handoff.
MSC
BS 1
BS 2
Mobility Management
z Mobility management procedures begin
when a system detects the presence of a
visiting terminal.
z (1) serving base station → serving MSC
(inform MSC the terminal’s action)
z (2) MSC records that the terminal is in its
operating area
z (3) MSC send this information to its VLR.
z (4) VLR notifies the terminal’s HLR.
z (5) HLR notifies the old VLR to erase record.
”
•
VLR
–
HLR
‘
VLR
—
˜
“
’
BS
Power
on
CSS
Visited
MSC
Home
MSC
-------
BS
‘’“: Registration notification invoke,
BS
BS
contains MIN, ECN, SID
”: Registration notification invoke,
contains MIN, ECN, SID, address
of VLR.
•–:Registration cancellation invoke
—: profile request invoke
˜: profile request result
Figure 4.4 Registration of a terminal in a visited service area.
Prior
MSC
Prior
VLR
HLR
Serving
VLR
Figure 4.4 Registration of a terminal in a visited service area
Handoff Categories
z IS-41 specifies three handoff protocols:
z handoff forward, handoff back, and handoff to
third.
z Intersystem handoff requires dedicated
communication links between a pair of
MSCs:
z voice trunks: for carrying user information in
calls handed from one MSC to another
z data links: for carrying control messages
between the two switch.
z Handoff forward:
The terminal moves into
the service area of system
B causing MSC-A and
MSC-B to perform a
handoff.
ƒ MSC-A is the anchor MSC
ƒ MSC-A is responsible for
routing the call to the
remote party.
ƒ MSC-B is the serving
MSC because it currently
has control of the call.
ƒ After handoff, MSC-B is
the target MSC.
ƒ
Figure 4.8 The situation after a handoff
forward from system A(anchor system) to
system B(serving system).
z Handoff Back:
The terminal can return to
the service area of system
A.
ƒ MSC-B recognizes that
the call arrived from
system A and it initiates a
handoff back protocol,
which releases the voice
circuit between MSC-A
and MSC-B.
ƒ Without this protocol, the
systems would tie up two
voice trunks
ƒ one taking the call
from system A to
system B
ƒ the other taking it from
system B to system A.
ƒ
z Handoff forward:
It is possible that the
terminal will move from
system B to a third system C.
ƒ This produces two
possibilities in Figures 4.9
and 4.10.
ƒ In Figure 4.9, MSC-B and
MSC-C perform a handoff
forward procedure the one
that moved the call from
system A to system B.
ƒ System B provides a path
from MSC-A to MSC-C.
ƒ The situation can continue,
adding more and more
MSCs to the chain, up to a
limit established by the
anchor system.
ƒ
Figure 4.9 Call path after handoff forward to
system C
z Handoff to third:
An alternative occurs when
there is a direct connection
between systems A and C.
ƒ IS-41 includes a protocol
referred to as handoff to
third, which establishes a
direct link between MSC-A
and MSC-C and release the
link between A and B.
ƒ
Figure 4.10 If there are circuits connecting MSC-A
and MSC-C, the system performs handoff to third.
Handoff Protocols
z There are two phases to every handoff
procedure.
z Location phase
z the serving MSC collects measurement reports
from cells in the neighborhood of the cell
presently occupied by a terminal.
z When measurements are required from one or
more cells in a system adjacent to the serving
system, the adjacent system becomes a
candidate system.
z The serving MSC and a candidate MSC
exchange handoff measurement request
messages.
z A HANDOFF MEASUREMENT REQUEST
INVOKE message, transmitted by the serving
MSC includes:
information about the terminal (station class mark,
SCM, indicates the capabilities of the terminal)
ƒ information about the serving base station (SAT and
a base station identifier), and
ƒ information about the radio channel carrying the call
(channel number).
ƒ
z Based on the identity of the serving base station,
the candidate MSC selects one or more
candidate cells and transmits a HANDOFF
MEASUREMENT REQUEST RESULT message
to the serving MSC.
z The HANDOFF MEASUREMENT REQUEST
RESULT message contains identities of candidate
cells and associated signal strength measurements.
z The serving MSC selects a target cell for the handoff.
z If the target cell is served by a candidate MSC, this
MSC becomes the target MSC for the handoff.
z The handoff procedure then moves from the location
phase to the handoff phase.
z Handoff phase:
z the serving MSC determines the type of handoff to
initiate (forward, back, or handoff to third).
z Handoff Forward Protocol:
z The serving MSC sends a FACILITIES DIRECTIVE
INVOKE message to the target MSC.
z This message contains:
information about the terminal (SCM, MIN, ESN)
ƒ information about the call:
ƒ billing ID (established by the anchor MSC at the beginning
of the call);
ƒ inter-MSC circuit (voice trunk that will carry the call from
the serving MSC to the target MSC);
ƒ inter-switch count (the total number of MSCs through which
the call will pass after the handoff);
ƒ information about the call status (serving cell, serving channel);
and
ƒ target cell identifier (based on measurement reports from the
get MSC).
ƒ
z If the target MSC accepts the handoff, it selects a channel
to handle the call in the new cell and then sends a
FACILITIES DIRECTIVE RESULT message to the serving
MSC.
z This message contains information about the new channel:
ƒ
channel number, SAT, and transmit power level (VMAC).
z On receiving this message, the serving MSC sends an
AMPS HANDOFF message to the terminal through the
serving cell.
z When the target base station detects the SAT, it sends a
message to the target MSC which completes the handoff
forward operation by sending a MOBILE ON CHANNEL
INVOKE message to the prior serving MSC.
Figure 4.11 Message sequence and system operations for handoff forward.
Figure 4.11 Message sequence and system operations for handoff forward.
z Handoff Back Protocol:
z If the location phase results in a determination by the
serving MSC(MSC-B) that the call would best be handled
in the system(system A) previously occupied by the
terminal, the serving MSC initiates a handoff back
procedure.
z It (MSC-B) sends a HANDOFF BACK INVOKE message
to the previous MSC (MSC-A), which is now the target
MSC of the handoff protocol.
z The message plays the same role as the FACILITIES
DIRECTIVE INVOKE message.
z The target MSC (MSC-A) sends HANDOFF BACK
RESULT message to the serving MSC (MSC-B).
z This message contains the same information as the
FACILITIES DIRECTIVE RESULT message.
z When the target MSC(MSC-A) learns that the terminal has
arrived on the assigned channel at the target base station,
it sends a FACILITIES RELEASE INVOKE message to the
serving MSC (MSC-B).
z This message identifies the voice trunk that carries the call
between the two MSCs.
z On receiving this message, the serving MSC (MSC-B)
releases the voice trunk and sends a FACILITIES
RELEASE RESULT message to the target MSC.
z Any two MSCs in a chain can perform the handoff back
protocol.
z Handoff to third Protocol:
z Handoff to third protocol is an example of path
minimization procedure, in which the system reduces the
number of voice trunks carrying a call through three or
more systems.
Security
Security
z GSM security is addressed in two aspects:
authentication and encryption.
Authentication avoids fraudulent access by a
cloned MS.
z Encryption avoids unauthorized listening.
z
Parameters
z Parameters:
z
Ki is used to achieve authentication.
z Ki is stored in the AuC and SIM.
z Ki is not known to the subscriber.
z
RAND
z A 128-bit random number generated by the home
system.
SRES is generated by algorithm A3.
z Kc is generated by algorithm A8 for the encryption.
z Frame Number
z
z A TDMA frame number encoded in the data bits.
Algorithms
z Authentication Algorithms:
z
A3.
z Authentication function.
z In AuC and SIM
z Encryption Algorithms:
z
A8.
z To generate the encryption Key
z In AuC and SIM
z
A5.
z An algorithm stored in the MS (handset hardware) and
the visited system.
z Used for the data ciphering and deciphering
Authentication and Encryption
Mobile Station
Home System
RAND
Ki
A8
Ki
A3
reject
A3
A8
No
SRES
Equal
?
SRES
Kc
Yes
authentication
encryption
accept
Visited
System
Kc
Data
A5
Ciphered Data
Frame
Number
A5
Data
Authentication by Triplet
z Triplet: RAND, SRES, Kc
z
AuC→HLR→VLR in advance
z Example: Authentication in registration
New VLR uses LAI to find old VLR.
z Old VLR sends triplets to new VLR.
z New VLR challenges MS by using RAND and
SRES.
z
Encryption
Mobile Station
Home System
RAND
Ki
A8
Ki
A3
reject
A3
A8
No
SRES
Equal
?
SRES
Kc
Yes
authentication
encryption
accept
Visited
System
Kc
Data
A5
Ciphered Data
Frame
Number
A5
Data
Summary
z GSM Architecture
MS, BSS, NSS
z Radio Interface
z
z GSM Radio and Channels
z Location Tracking
z Hand Off
z Security