Southern Methodist University Fall 2003
EETS 8316/NTU CC745-N
Wireless Networks
Lecture 4: GSM
Instructor: Jila Seraj
email: jseraj@engr.smu.edu
http://www.engr.smu.edu/~jseraj/
tel: 214-505-6303
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#1
Review
In the last meeting we discussed
Handoff, challenges, solutions
Anchor MSC, path optimization
North American Numbering Plan
Numbers in GSM network
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#2
Review, Handoff
Movement into a different cell requires
MTSO to automatically transfer call to
another base station without interruption
Two types of handoff, hard handoff and soft
handoff
BSC decides on handoff in the first
generation of mobile network
BSC together with handset decides on
handoff, MAHO
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#3
Review, Handoff, cont..
Phases of handoff are: handoff decision,
resource reservation, execution, clearing
resources.
Handoff challenges are: Performing handoff
before signal strength becomes too low, do
not perform unnecessary handoff, resource
allocation, inter-MSC/inter-system handoff,
handset capabilities
Anchor MSC remains in the call
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#4
Review, Handoff, cont..
BS
BS
PSTN
New Serving MSC
Anchor MSC
• What happens if we go back to the anchor MSC?
• IS-41 has handoff back facility
• What if a third MSC gets involved?
• Path minimization process
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#5
Review, Handoff, cont..
6
BS
7
BS
BS
Serving MSC
PSTN
Anchor MSC
4
HANDTHIRD
2
Target MSC
1
FACDIR
FACDIRR
5
HANDTHIRDR
MSONCH
9
FACREL
FACRELR
EETS 8316/NTU TC 745, Fall 2003
3
SMU
8
10
ENGINEERING
#6
Review, Handoff, cont..
BS
BS
BS
MSC
PSTN
Anchor MSC
New Serving MSC
Call Path after path minimization process
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#7
Review, Registration, cont..
Registration, Power up/down, periodical,
New system, Call origination
MS Service Qualification
—validation information (billing)
—Service profile information, features, restrictions…
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#8
Review, Roaming, cont..
MS Location Update occurs at registration,
deregistration, new location area, new
system
Deregistration is either triggered by mobile
(power down registration), by MSC for
inactivity, by HLR at registration in another
MSC.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#9
Review, Border Case
If registration happens in several MSC, HLR
decides which one is valid.
If registration happens in several BS, MSC
determines which one is valid
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#10
Review, Paging
Paging is used when there is a terminating
call to a mobile station.
A termination call is routed towards
gateway MSC, Gateway MSC consults HLR,
HLR request paging from visiting MSC,
visiting MSC pages the handset, when page
response is received HLR is informed, HLR
send the visiting MSC address to gateway
MSC that routes the call to visiting MSC and
the terminating call is established.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#11
Review, Paging, cont..
If multiple MSC responds to the page
request, HLR chooses the valid page
response
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#12
Review, North American Numbering Plan
North American Numbering Plan consists of
10 digits, NPA-NXX-XXXX
There is no way for a switch to identify that
a number belongs to a mobile subscriber,
nor can it identify the network provider.
Mobile network provider “buy” a certain
number series in each area for their users.
Therefore we can not bill a caller to a
mobile user for the air usage. They do it in
other countries!
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#13
Review, Primer on RF
The radio frequencies are grouped into
bands.
Each set of bands are dedicated to different
purposes by FCC
Each frequency is logically divided into
time slots for communication between
mobile station and the base station.
Some time slots are reserved for user
traffic, such as voice and data and other for
signaling purposes.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#14
Review, Cellular DCCH Structure
DCCH
Reverse
RACH
PCH
ARCH
EETS 8316/NTU TC 745, Fall 2003
Forward
SPACH
BCCH
SMSCH
FBCCH
SMU
ENGINEERING
SCF
EBCCH
Reserved
SBCCH
#15
GSM General Architecture
PSTN
VLR
GSM Public
land mobile
network
(PLMN)
MSC
HLR
OMC
AUC
A
EIR
Abis
BSC
BTS
BSS
BSS
ADC
BTS
OSS
Um
MT
TE
MS
EETS 8316/NTU TC 745, Fall 2003
NMC
OSS: operation subsystem
BSS: base station subsystem
MS: mobile station
MS
SMU
ENGINEERING
#16
GSM
Several first generation analog cellular
systems in Europe but incompatible limited roaming
1987-1989 ETSI standards for pan-European
Global System for Mobile Communications
(GSM, originally Group Special Mobile) at
900 MHz
— 1992 GSM is launched
— 1990-1993 Standards for Digital Cellular System at
1800 MHz (DCS 1800, recently renamed GSM
1800; US version is PCS 1900)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#17
GSM, cont..
Objectives:
—Broad offering of speech and data services
—Compatible with wireline networks, eg, ISDN
—Automatic roaming and handoff
—Highly efficient use of frequency spectrum
—Support for different types of mobile terminal
equipment (eg, cars, portable handsets)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#18
GSM, cont..
Objectives:
—Digital signaling and transmission
—Low cost infrastructure and terminal
equipment
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#19
GSM, cont..
13 recommendations
—R.00: Preamble
—R.01: General structure of
recommendations, GSM overview
—R.02: Service aspects: types of
services
—R.03: Network aspects: architecture,
call routing, performance objectives
—R.04: Mobile/base station interface
and protocols
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#20
GSM, cont..
—R.05: Physical layer on radio path:
multiple access, channel coding,
modulation, transmission
—R.06: Speech coding aspects
—R.07: Terminal adaptors for mobile stations
—R.08: Base station and mobile switching
center (MSC) interface
—R.09: Interworking with PSTN and packet
data networks
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#21
GSM, cont..
—R.10: Service interworking, short message
service
—R.11: Equipment specification
—R.12: Operation and maintenance, tariffs,
traffic administration
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#22
GSM, cont..
Summary of features
Channel bandwidth
200 kHz
Multiple access
TDMA
Users/carrier
8
Speech coding rate
13 kb/s
FEC coded speech rate
22.8 kb/s
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#23
GSM, cont..
Summary of service quality requirements
Speech intelligibility
90%
Max one-way delay
90 ms
Max handoff gap
150 ms if intercell
Time to alert mobile of
inbound cell
4 sec first attempt,
15 sec final attempt
Release time to called
network
2 sec
Connect time to called
network
4 sec
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#24
GSM General Architecture, cont..
Mobile station (MS) communicates to base
stations through radio interface Um
Mobile termination (MT) supports physical
channel between MS and base station
(radio transmission, channel coding,
speech coding)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#25
GSM General Architecture, cont..
Terminal equipment (TE), eg, telephone set.
Contains terminal/user-specific data in form
of smart card (subscriber identify module or
SIM card), plugs into any GSM terminal like
credit card and identifies user to network
for personal mobility (in addition to terminal
mobility) and security
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#26
GSM General Architecture, cont..
Base station Subsystem (BSS)
communicates with mobile switching center
through network interface A
Base Transceiver Station (BTS) handles
channel allocation, signaling, frequency
hopping, handover initiation, etc.
BTS communicates with BSC using Abis
interface
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#27
GSM General Architecture, cont..
Base station controller (BSC) manages
radio channels, paging, handoff for several
BTSs
BSC communicates with MSC using A
interface
Mobile switching center (MSC) is gateway
to PSTN and packet data networks
Performs switching, paging functions, MS
location updating, handoff control, etc.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#28
GSM General Architecture, cont..
Home location register (HLR) stores
subscriber info and part of MS’s location
info to route incoming calls to visitor
location register (VLR) where mobile is
roaming
VLR registers users roaming in its area and
assigns roaming numbers
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#29
GSM General Architecture, cont..
Authentication center (AUC) is accessed by
HLR to authenticate a user for service. It
contains authentication and encryption
keys for subscribers
Equipment identity register (EIR) allows
stolen or fraudulent mobile stations to be
identified
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#30
GSM General Architecture, cont..
Operation subsystem (OSS) contains:
operations and maintenance center (OMC),
network management center (NMC), and
administration center (ADC) . These
network elements work together to monitor,
control, maintain, and manage the network
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#31
GSM Logical and Physical Channels
Um interface: various logical channels are
mapped to physical channels
A physical channel is a timeslot with
timeslot number in a sequence of TDMA
frames
8 physical channels mapped onto 8
timeslots within TDMA frame per frequency
carrier
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#32
GSM Physical Channels
TDMA frame = 4.615 ms
Timeslot 1
2
3
4
5
6
7
8
Frequency 1
Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
Frequency 2
Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
:
:
:
:
Frequency 124
Ch 1 Ch 2 Ch 3 Ch 4 Ch 5 Ch 6 Ch 7 Ch 8
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#33
GSM Logical Channel Structure
TCH/F
TCH/H
BCH
FCCH SCH
CBCH
CCH
TCH
CCCH
BCCH
DCCH
PCH AGCH RACH
SACCH
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
ACCH
SDCCH
FACCH
#34
GSM Logical Channels
3 groups of logical channels, TCH, CCH and
CBCH
TCH is used to carry voice or data traffic
CCH is used for control functions
CBCH is used for broadcast functions
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#35
GSM Logical Channels, cont..
Logical traffic channels = full rate (TCH/F) at
22.8 kb/s or half rate (TCH/H) at 11.4 kb/s
Physical channel = full rate traffic channel
(1 timeslot) or 2 half rate traffic channels (1
timeslot in alternating frames)
Full rate channel may carry 13 kb/s speech
or data at 12, 6, or 3.6 kb/s
Half rate channel may carry 6.5 kb/s speech
or data at 6 or 3.6 kb/s
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#36
GSM Logical Channels, cont..
CCH consists of 3 groups of logical control
channels, BCH, CCCH and DCCH
BCH (broadcast channel): point-tomultipoint downlink only. Contains three
sub-channels, BCCH, FCCH and SCH
—BCCH (broadcast control channel): send
cell identities, organization info about
common control channels, cell service
available, etc
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#37
GSM Logical Channels
—FCCH (frequency correction channel): send
a frequency correction data burst containing
all zeros to effect a constant frequency shift
of RF carrier
—SCH (synchronization channel): send TDMA
frame number and base station identity
code to synchronize MSs
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#38
GSM Logical Channels, cont…
CCCH (common control channel): Consists
of three sub-channels, PCH, AGCH and
RACH. This channels is used for paging
and access
—PCH (paging channel): to page MSs
—AGCH (access grant channel): to assign
MSs to stand-alone dedicated control
channels for initial assignment
—RACH (random access channel): for MS to
send requests for dedicated connections
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#39
GSM Logical Channels, cont…
DCCH (dedicated control channel): bidirectional point-to-point -- main signaling
channels. Consist of two sub-channels,
SDCCH and ACCH
—SDCCH (stand-alone dedicated control
channel): for service request, subscriber
authentication, equipment validation,
assignment to a traffic channel
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#40
GSM Logical Channels, cont…
—SACCH consist of two sub-channels,
SACCH and FACCH
• SACCH (slow associated control
channel): for out-of-band signaling
associated with a traffic channel, eg,
signal strength measurements
• FACCH (fast associated control channel):
for preemptive signaling on a traffic
channel, eg, for handoff messages
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#41
OSI Model for SS7
Layer 4-7
MUP
TCAP
ISUP
MAP
INAP
OMAP
SCCP
Layer 3
Layer 1-2
MTP
Signaling link function, Signaling link physical requirement
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#42
GSM Interfaces, cont..
Air Interface
Um
Abis
A
CM
CM
MM
MM
LAPD
RF
RRM
RRM
RRM
LAPD LAPD
RF
EETS 8316/NTU TC 745, Fall 2003
RF
SCCP
SCCP
LAPD LAPD
LAPD
RF
SMU
RRM
ENGINEERING
RF
RF
#43
GSM Protocol Layers
RF : Physical Layer
LAPD: Link Layer, ISDN protocol based
SCCP: Signal Connection Control Layer,
part of link layer
RR: Radio Resource
MM: Mobility Management
CC: Call Control
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#44
GSM Network Layer
Network layer consists of 3 sublayers
Radio resource management (RR) sublayer
— Establishment, maintenance, and termination of
radio channel connections
Mobility management (MM) sublayer
— Registration, authentication, and location tracking
Call control (CC) sublayer
— Establishment, maintenance, and termination of
circuit-switched calls
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#45
GSM Interfaces
VLR
Switching
System
AUC
MAP
VLR
MAP HLR
MAP
MSC
BSSAP
EETS 8316/NTU TC 745, Fall 2003
EIR
MAP
Base Station
Subsystem
BSS
SMU
ENGINEERING
#46
GSM Interfaces, cont…
Switching
System
BSSAP
BSC
LAPD
Base Station Subsystem
BSS
BTS
MS
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#47
GSM Numbers
International mobile station equipment
identity (IMEI). IMEI= TAC + FAC + SNR + SP
— TAC = Type Approval Code, 6 decimals
— FAC = Final Assembly Code, 6 decimals, assigned
by manufacturer
— SNR = Serial Number, 6 decimals, assigned by
manufacturer
— SP = Spare, 1 decimal place
EIR has while, black and optionally grey
list.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#48
GSM Numbers
International mobile station equipment
identity (IMEI). IMEI= TAC + FAC + SNR + SP
— TAC = Type Approval Code, 6 decimals
— FAC = Final Assembly Code, 6 decimals,
assigned by manufacturer
— SNR = Serial Number, 6 decimals, assigned by
manufacturer
— SP = Spare, 1 decimal place
EIR has while, black and optionally grey list
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#49
GSM Numbers, cont…
International mobile Subscriber Identity
(IMSI). Stored on the SIM (Subscriber
Identity Module) card. IMSI is obtained at
the time of subscription. IMSI is not made
public.
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code, 3 decimals
MNC = Mobile Network Code, 2 decimals
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#50
GSM Numbers, cont…
MSIN = Mobile Subscriber Identification
Number, maximum 10 decimal digits
Mobile Station ISDN number (MSISDN), is
the real phone number of the subscriber.
Stored in HLR and on SIM card
MSISDN = CC + NDC + SN
CC = Country Code, up to 3 decimals
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#51
GSM Numbers, cont…
NDC = National Destination Code, typically
2-3 decimals
SN = Subscriber Number, maximum 10
decimals.
Mobile Station Roaming Number (MSRN),
same format as MSISDN. A temporary
location dependent ISDN number.
Is assigned in two cases, at registration or
at call set up.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#52
GSM Numbers, cont…
Location Area Identity (LAI). Regularly sent
on BCCH LAI = CC + MNC + LAC,
LAC = Location Area Code, max 5 decimals
(<FFFFhex).
Temporary Mobile Subscriber Identity
(TMSI). Stored only in the VLR and SIM
card. Consists of 4*8 bits excluding value
FFFF FFFFhex
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#53
GSM Numbers, cont…
TMSI has only local meaning and can be
defines according to operator’s
specifications.
LAI + TMSI uniquely identifies the user, I.e.
IMSI is no longer needed for ongoing
communication
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#54
GSM Numbers, cont..
Local Mobile Subscriber Identity (LMSI).
Created in VLR and stored in HLR.
Like TMSI is operator defined.
Used in communication with VLR to speed
the search for mobile records.
Speed is essential to achieve short call
setup times.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#55
GSM Numbers, cont…
Global Cell Id = LAI + CI
CI = Cell id, unique id within the LAI.
Maximum 2*8 bits
Base Transceiver Station Identity Code
(BSIC) = NCC + BCC
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#56
GSM Numbers, cont…
BSIC is broadcast periodically by the base
station on the synchronization channel.
NCC = Network Color Code, 3 bits
BCC = Base Station Color Code, 3 bits
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#57
GSM Roaming From Another PLMN
VLR registers users roaming in its area
—Recognizes mobile station is from another
PLMN
—If roaming is allowed, VLR finds the mobile’s
HLR in its home PLMN
—VLR constructs a global title from IMSI to
allow signaling from VLR to mobile’s HLR
via public telephone network
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#58
GSM Roaming, cont...
VLR registers users roaming in its area
—VLR generates a mobile subscriber roaming
number (MSRN) used to route incoming
calls to mobile station
—MSRN is sent to mobile’s HLR
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#59
GSM Roaming, cont…
VLR contains
—MSRN
—TMSI
—Location area where mobile station has
registered
—Info for supplementary services (if any)
—IMSI
—HLR or global title
—Local identity for mobile station (if any)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#60
GSM Security
3 security problems: unauthorized access,
privacy from eavesdropping, protection of
subscriber identity/location
Unauthorized (fraudulent) access
—GSM handsets must be presented with a
subscriber identity module (SIM)
—SIM must be validated with personal
identification number (PIN)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#61
GSM Security, cont…
Unauthorized (fraudulent) access
—SIM also stores subscriber authentication
key, authentication algorithm, cipher key
generation algorithm, encryption algorithm
—During registration (when roaming), mobile
station receives “challenge” and uses
authentication key and authentication
algorithm to generate “challenge response”
to verify user’s identity
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#62
GSM Security, cont…
Privacy from eavesdropping
—Temporary encryption key is used for
privacy of data, signaling, and voice
—Info is encrypted before transmission
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#63
GSM Security, cont…
Anonymity of users
—Supported by temporary mobile subscriber
ID (TMSI)
—When registered, mobile station sends
globally-unique international mobile
subscriber ID (IMSI) to network
—Network assigns TMSI for use during call IMSI is not sent over radio link
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#64
GSM Security, cont…
Anonymity of users
—Only network and mobile station know true
identity
—New TMSI is assigned when roam into new
area
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#65
GSM Security, cont..
Fetched triplets are stored in VLR
— Every call uses up one triplet (discarded)
— Another set must be fetched when exhausted
Visited system
IMSI/TMSI
+ LAI
Registration request
IMSI/TMSI identifies user,
LAI points to old VLR,
requests data to
authenticate user
Subscriber data
Old VLR
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#66
Assignment
Wireless personal communications,
Chapter 7
Rappaport what pages
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#67
GSM Security, cont..
Visited system
Calculates
response
by authentication
algorithm
Requests triplets
from home system,
chooses a triplet
Challenge
Challenge response
New TMSI
Compares to stored
response in triplet,
registration successful
if matches
Assigns new TMSI
Acknowledge
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#68
GSM Security, cont..
Visited system
Location update
HLR
Acknowledge
Registration
cancel
Old VLR
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#69
GSM Handoffs
3 types of handoffs
—Intra-BSS: if old and new BTSs are attached
to same base station
• MSC is not involved
—Intra-MSC: if old and new BTSs are
attached to different base stations but within
same MSC
—Inter-MSC: if MSCs are changed
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#70
GSM Intra-MSC Handoff
Mobile station monitors signal quality and
determines handoff is required, sends signal
measurements to serving BSS
Serving BSS sends handoff request to MSC
with ranked list of qualified target BSSs
MSC determines that best candidate BSS is
under its control (assumed here)
MSC reserves a trunk to target BSS
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#71
GSM Intra-MSC Handoff, cont..
Target BSS selects and reserves radio
channels for new connection, sends Ack to
MSC
MSC notifies serving BSS to begin handoff,
including new radio channel assignment
Serving BSS forwards new radio channel
assignment to mobile station
Mobile station re-tunes to new radio channel,
notifies target BSS on new channel
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#72
GSM Intra-MSC Handoff, cont..
Target BSS notifies MSC that handoff is
detected
Target BSS and mobile station exchange
messages to synchronize transmission in
proper timeslot
MSC switches voice connection to target BSS,
which responds when handoff is complete
MSC notifies serving BSS to release old radio
traffic channel
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#73
GSM Inter-MSC Handoff
Mobile station monitors signal quality and
determines handoff is required, sends signal
measurements to serving BSS
Serving BSS sends handoff request to MSC
with ranked list of qualified target BSSs
Serving MSC determines that best candidate
BSS is under control of a target MSC
(assumed here) and calls target MSC through
PSTN
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#74
GSM Inter-MSC Handoff, cont..
Target MSC notifies its VLR to assign a TMSI
Target VLR returns TMSI
Target MSC reserves a trunk to target BSS
Target BSS selects and reserves radio
channels for new connection, sends Ack to
target MSC
Target MSC notifies serving MSC that it is
ready for handoff
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#75
GSM Inter-MSC Handoff, cont..
Serving MSC notifies serving BSS to begin
handoff, including new radio channel
assignment
Serving BSS forwards new radio channel
assignment to mobile station
Mobile station re-tunes to new radio channel,
notifies target BSS on new channel
Target BSS notifies target MSC that handoff is
detected
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#76
GSM Inter-MSC Handoff, cont..
Target BSS and mobile station exchange
messages to synchronize transmission in
proper timeslot
Voice connection is switched to target BSS,
which responds when handoff is complete
Target MSC notifies serving MSC
Old network resources are released
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#77
Reading Suggestion
Wireless Communications: Principles and
Practice, Rappaport, sections 2.1
Wireless personal communications systems,
Goodman, Chapter 7
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#78