GSM Architecture
1
GSM SubSystems
GSM architecture is mainly divided into three
Subsystems
1. Base Station Subsystem (BSS)
2. Network & Switching Subsystem (NSS)
3. Operations & Support Subsystem (OSS)
Mobile Station sometimes included in BSS
2
GSM Network Architecture
4
Simplified GSM Architecture
HLR
A-bis
I/F
Um I/ F
MS
B
S
C
TC
A
I/F
A-ter
I/F
AUC
PSTN
MSC
BTS
VLR
EIR
5
6
7
Mobile Station (MS)
The MS consists of two parts
1. Mobile Equipment (ME)
2. Subscriber Identity module (SIM)
8
Mobile Station
Mobile Station
=
SIM Card
Handset
Battery
Global GSM Mobility
Card
The Smart Card to use
GSM
battery
+
+
f153454
2W
jmhfod
kgdjipj
SIM-Card and GSM Mobile
Equipment
SIM-Card
Global GSM Mobility
Card
=
The Smart Card to use
+
Calling line
0609225831
GSM
Contains:
- IMSI
Subscriber knows
- Called party number = MS-ISDN
- PIN
Handset
The SIM-Card Functions
Credit Card Size
µ SIM-Card
Global GSM Mobility
Card
15 mm
The Smart Card to use
25 mm
Permanent data:
- Unique mobile subscriber identity
through IMSI number,
- Authentication parameter Ki,
- Authentication algorithm A3,
- Generating encryption key Kc
algorithm A8.
GSM
Microchip with stored
user information
Removable data:
- Temporary Mobile Subscriber Number,
- Location Area Identification.
Subscriber Identification
IMSI
Nature
International Mobile Subscriber Identity
Mobile Station Integrated Services Digital Network Nb
Conformity with E212
Similar to ISDN,
Conformity with E164/E213
Identify a PLMN
worldwide
MCC
MNC
Meaning
Mobile
Country
Code
Mobile
Network
Code
Nb. digits
3
2
Format
MS - ISDN
Identify the subscriber
of a PLMN
MSIN
H1 H2
x x x ......... x x x
Mobile Subscriber
Ident. Nb
H1 H2 = Identity of HLR
within the home PLMN
max 10
National Significant Mobile Number
CC
NDC
SN
M1 M2
xx xx xx xx
Country
National
Mobile Subscriber
Code
(where Destination (national definition)
subscription Code * M1 M2 = nbr of logical HLR
has been made)
1 to 3
2 to 4
total max 15
*This code does not identify a geographical area
but an operator
Mobile Identification
TAC
Type Approval
Code
FAC
SNR
Serial number
Final Assembly
Code
SP
(SPare)
Trends in Mobile Station
Pocket
Fax
Hands-free
Organizer
Booster
2W
5W
2W
8W
PC
Data
Dual-band
900-1800
900-1900
Java
Mobile Equipment (ME)
• The ME is the only part of the GSM network
which the subscriber will really see.
• There are three main types of ME, these are
listed below:
1. Vehicle Mounted
2. Portable Mobile Unit
3. Hand portable Unit
15
Subscriber Identity module (SIM)
 The SIM is a card which plugs into the ME.
 This card identifies the MS subscriber and also provides
other information regarding the services that subscriber
should receive.
 The SIM card, and the high degree of inbuilt system security,
provides protection of the subscriber’s information and
protection of networks against fraudulent access.
 The SIM can be protected by use of Personal Identity
Number (PIN) password, similar to bank/credit charge cards,
to prevent unauthorized use of the card.
 SIM cards are designed to be difficult to duplicate.
 By making a distinction between the subscriber identity and
the ME identity, GSM can route calls and perform billing
based on the identity of the ‘subscriber’ rather than the
equipment or its location.
16
Subscriber Identity module Cntd….
The SIM contains several pieces of information:
1.
2.
3.
4.
5.
International Mobile Subscriber Identity (IMSI)
Temporary Mobile Subscriber Identity (TMSI)
Location Area Identity (LAI)
Subscriber Authentication Key (Ki)
Mobile Station Integrated Services Digital
Network (MSISDN)
The SIM is capable of storing additional information
such as accumulated call charges.
The SIM also executes the Authentication Algorithm.
17
Subscriber Identity module Cntd….
18
Base Station Subsystem (BSS)
19
BSS Architecture
MSC
A Interface
Radio
Interface
TCU
S2000H&L
BTS
NSS
Ater Interface
Public Telephone Network
Abis Interface
BSC
OMC-R
MS
S8000
Outdoor
BTS
Radio
Interface
OMN Interface
Sun
StorEdge A5000
BSS
S8000
Indoor
BTS
MS
Base Station Controller (BSC)
the BSC provides the control for the BSS.
Any operational information required by the BTS will
be received via the BSC.
Likewise any information required about the BTS (by
the OMC for example) will be obtained by the BSC.
The BSC incorporates a digital switching matrix, which
it uses to connect the radio channels on the air interface
with the terrestrial circuits from the MSC.
The BSC switching matrix also allows the BSC to
perform “handovers” between radio channels on BTSs,
under its control, without involving the MSC.
21
22
BSC General Architecture and Functions
BSC
- Radio Resource
management for its BTSs
- Intercell hand-over
Processing
Unit
- Allocation of channels for
communication
- Reallocation of frequencies
among BTSs
X.25
controller
O&M
Switching
matrix
- Time and frequency
synchronization to BTSs
- Controls frequency
hopping
PCM
controller
BTS
Abis interface
PCM
controller
To Network
A interface SubSystem
Base Transceiver Station – BTS
• The BTS provides the air interface connection
with the MS.
• It also has a limited amount of Control
functionality which reduces the amount of
traffic passing between the BTS and BSC.
• Where the BSC and BTS are both shown to
control a function, the control is divided
between the two, or may be located wholly at
one.
24
25
BTS General Architecture and Functions
BTS
Transmission coupler
COUPLING SYSTEM
- Encodes, encrypts, modulates,
feeds the RF signal to the
antenna
- Decrypts and equalizes the
signal then demodulates
Reception coupler
Antenna
Duplexer
- Interface between Antennas
and TRXs of each cell
TRX
(Transceiver-Receiver)
- Mobile call detection
- Uplink channel measurements
- Timing advance
BCF
(Base Common Functions)
- Frequency hopping
Abis
interface
BSC
- Multiplexes speech and user's data channels to BSC.
- Multiplexes signaling channels to BSC.
27
BSS Configurations
• The maximum number
of BTSs which may be
controlled by one BSC is
not specified by GSM.
•The BTSs and BSC may
either be located at the
same cell site “colocated”, or located at
different sites “Remote”.
•Another BSS
configuration is the daisy
chain.
•Problem- transmission
delay through the chain.
28
TRAU Architecture and Functions
Converts the 13 kbps GSM speech frame either
into a 64 kbps T1 PCM µ-law or into an E1 PCM A-law
Routes the users' data stream
to suitable Inter-working function
TRAU
Transcoder
Controller
T1 trunk
up to 92 user's
and
control channels
Transcoder
A
Ater
BSC
interface
E1 trunk
up to 120 user's
channels
T1 trunk = up to
24 user's channels
External PCM
Interface
MSC
interface
E1 trunk = up to
31 user's channels
Transcoder (XCDR)
• The 64 kbit/s PCM circuits from the MSC, if
transmitted on the air interface without
modification, would occupy an excessive
amount of radio bandwidth.
• The Transcoder is to convert the speech or data
output from the MSC into the form suitable for
transmission over the air interface.
• The required bandwidth is therefore reduced by
processing the 64 kbit/s circuits so that the
amount of information required to transmit
digitized voice falls to a gross rate of 16 kbit/s.
30
Transcoder (XCDR) Cntd….
• The transcoding function may be located at the MSC,
BSC, or BTS.
• The content of the 16 kbit/s data depends on the coding
algorithm used.
• There are two speech coding algorithms available.
• The Full Rate speech algorithm is supported by all
mobiles and networks.
• It produces 13 kbit/s of coded speech data plus 3 kbit/s
of control data known as TRAU data (Transcoder Rate
Adaptation Unit).
• TRAU only used by BTS and discarded (not
transmitted on air interface)
31
Transcoder (XCDR) Cntd….
• the 13 kbit/s of speech data is processed at the
BTS to form a gross rate of 22.8 kbit/s on the air
interface which includes forward error correction.
• In the uplink direction the BTS adds in TRAU
data which will be used by the transcoder.
• Enhanced Full Rate is an improved speech coding
algorithm and is only supported by Phase 2+
mobiles.
• It produces 12.2 kbit/s from each 64 kbit/s PCM
channel and TRAU data of 3.8 kbits/s
32
33
Network Switching System (NSS)
34
NSS Architecture
Site 1
Site 2
AUC
H
HLR
D
D
BSS
BSS
VLR
VLR
G-interface
B-interface
A-interface
B-interface
C-interface
MSC
GMSC
Other GSM,
PSTN, ISDN
Other GSM,
PSTN, ISDN
E-interface
F
E
F
EIR
IWF
Billing
Server
SMS-SC
A-interface
E
IWF
Billing
Server
Network Switching System (NSS)
• The Network Switching System includes the main
switching functions of the GSM network.
• It also contains the databases required for subscriber
data and mobility management.
• The components of the Network Switching System are
listed below:
1.
2.
3.
4.
5.
6.
7.
Mobile Services Switching Centre – MSC
Home Location Register – HLR
Visitor Location Register – VLR
Equipment Identity Register – EIR
Authentication Centre – AUC
Interworking Function – IWF
Echo Canceller – EC
36
37
Mobile Switching Centre (MSC)
 MSC is the heart of the system, controlling the
Switching & Billing.
 The MSC can carry out different functions depending
upon its position in the network.
 When provides interface between PSTN & BSS in GSM
network then known as a Gateway MSC
 provides service to MSs located within a defined
geographic coverage area.
 The network typically contains more than one MSC.
 One MSC is capable of supporting a regional capital
with approximately one million inhabitants.
38
MSC’s Functionalities
• Call Processing
1. control of data/voice call setup
2. inter-BSS and inter-MSC handovers
3. control of mobility management (subscriber validation
and location).
• Operations and Maintenance Support
1. database management
2. traffic metering and measurement
3. A Man–machine interface.
• Internetwork Interworking
1. Interface between the GSM network and the PSTN.
• Billing
1. Collects call billing data.
39
Home Location Register
HLR
Subscriber
Management
Center
Permanent records
- MSISDN
- IMSI
- Subscriber's service provision
Temporary records
- VLR address
- Ciphering items
(Kc, Sres, Rand)
Home Location Register (HLR)
 The HLR is the master database which contains
each user’s service profile.
 Various identification numbers and addresses are
stored, as well as authentication parameters.
 The data it contains is remotely accessed by all the
MSCs and the VLRs in the network.
 Although the network may contain more than one
HLR, there is only one database record per
subscriber .
 The subscriber data may be accessed by either the
IMSI or the MSISDN number.
41
Visitor Location Register
VLR
LA1
Permanent records
- IMSI
- Subscriber’s service provision
LA3
LA2
LA4
Temporary records
- Ciphering items
(Kc, Sres, Rand)
- LAI - TMSI
Visitor Location Register (VLR)
 VLR is a temporary database for all user
currently located in the system including roamers
& non-roamers.
 The data exists for only as long as the subscriber is
“active” in the particular area covered by the
VLR.
 The VLR database will therefore contain some
duplicate data as well as more precise data
relevant to the subscriber.
 This function eliminates the need for excessive
and time-consuming references to the “home”
HLR database.
43
Visitor Location Register Cntd….
The additional data stored in the VLR is listed
below:
1.
2.
3.
4.
Mobile status (busy/free/no answer etc.).
Location Area Identity (LAI).
Temporary Mobile Subscriber Identity (TMSI).
Mobile Station Roaming Number (MSRN).
• MSC updates VLR with HLR information.
• Each MSC has VLR which resides with the MSC
& each G-MSC has a HLR which usually resides
with the G-MSC
44
Equipment Identity Register
EIR
IMEI
Black list
(barred ME)
White list
(valid ME)
Mobile
Equipment
Gray list
(faulty ME)
Equipment Identity Register (EIR)
• The EIR contains a centralized database for
validating the IMEI.
• This database is concerned solely with MS
equipment and not with the subscriber who is
using it to make or receive a call.
• The EIR database consists of lists of IMEIs (or
ranges of IMEIs) organized as follows:
1. White List
2. Black List
3. Grey List
46
Equipment Identity Register Cntd….
47
Authentication Center
AUC
Ciphering Triplets
Ki
RAND
5
HLR Request
Security
A3, A8 algorithms
IMSI
AUC provides
SRES, Kc, RAND
Authentication Centre (AuC)
• The AuC is a processor system that performs
the “authentication” function.
• It is normally co-located with the HLR as it
will be required to continuously access and
update, as necessary, the system subscriber
records.
• The authentication process will usually take
place each time the subscriber “initializes” on.
49
InterWorking Function
BSS
Mobile
Switching
Center
PSTN
Modem
MS
Data +
DTE signals
Rate
adaptation
Modem
DTE
signaling
IWF
DTE
Land-DTE
Interworking Function (IWF)
• IWF provides the function to enable the GSM
system to interface with the various forms of
public and private data networks.
• The basic features of the IWF are
1. Data rate adaptation.
2. Protocol conversion.
• Some systems require more IWF capability
than others, this depends upon the network to
which it is being connected.
51
Interworking Function (IWF) Cntd…
• The IWF also
incorporates a
‘‘modem bank”,
which may be used
when
• for example, the
GSM Data Terminal
Equipment (DTE)
exchanges data with
a land DTE
connected via an
analogue modem.
52
Echo Canceler
4 wire
circuit
(PCM)
GSM network
4 wire circuit
Mobile
Switching
Center
Echo
Canceler
Talker Echo
Switch
Talker Echo
Base
Station
SubSystem
PSTN
4 wire
circuit
4w to 2w
transformer
Two wire circuit
Local
loop
Land telephone
Echo Canceller (EC)
• An EC is used on the PSTN side of the MSC for
all voice circuits.
• Echo control is required at the switch because
the inherent GSM system delay(180 ms approx)
can cause an unacceptable echo condition.
• This would not be apparent to the MS
subscriber, but for the inclusion of a 2-wire to
4-wire hybrid transformer in the circuit.
• The transformer causes the echo. This does not
affect the land subscriber.
54
Echo Canceller (EC) cntd….
55
Echo Canceller (EC) cntd….
• During a normal PSTN land to land call, no
echo is apparent because the delay is too short.
• without the EC, the effect would be very
irritating to the MS subscriber.
• disrupting speech and concentration.
• EC provides cancellation of up to 68 ms on the
“tail circuit”.
• the tail circuit is the connection between the
output of the EC and the land telephone.
56
57
Operations & Support System (OSS)
58
Operations & Support System (OSS)
• The OSS provides the capability to manage
the GSM network remotely.
• This area of the GSM network is not currently
tightly specified by the GSM specifications.
• It is left to the network provider to decide what
capabilities they wish it to have.
• The Operations and Maintenance System
comprises of two parts:
1. Network Management Centre (NMC)
2. Operations and Maintenance Centre (OMC)
59
Operations & Support System Cntd....
60
Operations & Support System Cntd....
61
Network Management Centre (NMC)
62
Operations and Maintenance Centre
(OMC)
 The OMC provides a central point from which to
control and monitor the other network entities (i.e. base
stations, switches, database, etc).
 It also monitors the quality of service being provided
by the network.
 There are two types of OMC these are:
1. OMC-R
OMC controls specifically the Base Station System.
2. OMC-S
OMC controls specifically the Network Switching
System.
63
Operations and Maintenance Centre Cntd….
The OMC should support the following
functions as per ITS–TS recommendations:
1.
2.
3.
4.
5.
Event/Alarm Management.
Fault Management.
Performance Management.
Configuration Management.
Security Management.
64
Operations and Maintenance Centre Cntd….
65
66
Network in Reality
• In reality a GSM network is much more
complicated than we have seen.
• The diagram in the next slide illustrates how
multiple BSS and Network Switching System
components will be connected within a
network
67
68
Practical Example; London City
• Typical city for example, London will have
approximately the following number of network
components:
69
Mobile Network in U.K
• A typical network (for example, UK) will have
approximately the following number of network
components.
70