GSM ARCHITECTURE

                              GSM  ARCHITECTURE

 

INTRODUCTION

A GSM system is basically designed as a combination of three major subsystems: the network subsystem, the radio subsystem, and the operation support subsystem. In order to ensure that network operators will have several sources of cellular infrastructure equipment, GSM decided to specify not only the air interface, but also the main interfaces that identify different parts. There are three dominant interfaces, namely, an interface between MSC and the base Transceiver Station (BTS), and an Um interface between the BTS and MS.

GSM NETWORK STRUCTURE

Every telephone network needs a well-designed structure in order to route incoming called to the correct exchange and finally to the called subscriber. In a mobile network, this structure is of great importance because of the mobility of all its subscribers [1-4]. In the GSM system, the network is divided into the following partitioned areas.

·         GSM service area;

·         PLMN service area;

·         MSC service area;

·         Location area;

·         Cells.

The GSM service is the total area served by the combination of all member countries where a mobile can be serviced. The next level is the PLMN service area. There can be several within a country, based on its size. The links between a GSM/PLMN network and other PSTN, ISDN, or PLMN network will be on the level of international or national transit exchange. All incoming calls for a GSM/PLMN network will be routed to a gateway MSC. A gateway MSC works as an incoming transit exchange for the GSM/PLMN. In a GSM/PLMN network, all mobile-terminated calls will be routed to a gateway MSC. Call connections between PLMNs, or to fixed networks, must be routed through certain designated MSCs called a gateway MSC. The gateway MSC contains the interworking functions to make these connections. They also route incoming calls to the proper MSC within the network. The next level of division is the MSC/VLR service area. In one PLMN there can be several MSC/VLR service area. MSC/VLR is a role controller of calls within its jurisdiction. In order to route a call to a mobile subscriber, the path through  links to the MSC in the MSC area where the subscriber is currently located. The mobile location can be uniquely identified since the MS is registered in a VLR, which is generally associated with an MSC.

           

             The next division level is that of the LA’s within a MSC/VLR combination. There are several LA’s within one MSc/VLR combination. A LA is a part of the MSC/VLR service area in which a MS may move freely without updating location information to the MSC/VLR exchange that control the LA. Within a LA a paging message is broadcast in order to find the called mobile subscriber. The LA can be identified by the system using the Location Area Identity (LAI). The LA is used by the GSM system to search for a subscriber in a active state.

            Lastly, a LA is divided into many cells. A cell is an identity served by one BTS. The MS distinguishes between cells using the Base Station Identification code (BSIC) that the cell site broadcast over the air.

MOBILE STATION

The MS includes radio equipment and the man machine interface (MMI) that a subscribe needs in order to access the services provided by the GSM PLMN. MS can be installed in Vehicles or can be portable or handheld stations. The MS may include provisions for data communication as well as voice. A mobile transmits and receives message to and from the GSM system over the air interface to establish and continue connections through the system .

            Different type of MSs can provide different type of data interfaces. To provide a common model for describing these different MS configuration, ”reference configuration” for MS, similar to those defined for ISDN land stations, has been defined.

            Each MS is identified by an IMEI that is permanently stored in the mobile unit. Upon request, the MS sends this number over the signaling channel to the MSC. The IMEI can be used to identify mobile units that are reported stolen or operating incorrectly.

            Just as the IMEI identities the mobile equipment, other numbers are used to identity the mobile subscriber. Different subscriber identities are used in different phases of call setup. The Mobile Subscriber ISDN Number (MSISDN) is the number that the calling party dials in order to reach the subscriber. It is used by the land network to route calls toward an appropriate MSC. The international mobile subscribe identity (IMSI) is the primary function of the subscriber within the mobile network and is permanently assigned to him. The GSM system can also assign a Temporary Mobile Subscriber Identity (TMSI) to identity a mobile. This number can be periodically changed by the system and protect the subscriber from being identified by those attempting to monitor the radio channel.

Functions of MS

      The primary functions of MS are to transmit and receive voice and data over the air interface of the GSM system. MS performs the signal processing function of digitizing, encoding, error protecting, encrypting, and modulating the transmitted signals. It also performs the inverse functions on the received signals from the BS.

In order to transmit voice and data signals, the mobile must be in synchronization with the system so that the messages are the transmitted and received by the mobile at the correct instant. To achieve this, the MS automatically tunes and synchronizes to the frequency and TDMA timeslot specified by the BSC. This message is received over a dedicated timeslot several times within a multiframe period of 51 frames. We shall discuss the details of this in the next chapter. The exact synchronization will also include adjusting the timing advance to compensate for varying distance of the mobile from the BTS.

      The MS monitors the power level and signal quality, determined by the BER for known receiver bit sequences (synchronization sequence), from both its current BTS and up to six surrounding BTSs. This data is received on the downlink broadcast control channel. The MS determines and send to the current BTS a list of the six best-received BTS signals. The measurement results from MS on downlink quality and surrounding BTS signal levels are sent to BSC and processed within the BSC. The system then uses this list for best cell handover decisions.

      MS keeps the GSM network informed of its location during both national and international roaming, even when it is inactive. This enables the System to page in its present LA.

      The MS includes an equalizer that compensates for multi-path distortion on the received signal. This reduces inter-symbol interface that would otherwise degrade the BER.

      Finally, the MS can store and display short received alphanumeric messages on the liquid crystal display (LCD) that is used to show call dialing and status information. These messages are limited to 160 characters in length.

    Power Levels

These are five different categories of mobile telephone units specified by the European GSM system: 20W, 8W, 5W, 2W, and 0.8W. These correspond to 43-dBm, 39-dBm, 37-dBm, 33-dBm, and 29-dBm power levels. The 20-W and 8-W units (peak power) are either for vehicle-mounted or portable station use.

            The MS power is adjustable in 2-dB steps from its nominal value down to 20mW (13 dBm). This is done automatically under remote control from the BTS, which monitors the received power and adjusts the MS transmitter to the minimum power setting necessary for reliable transmission.

         SIM Card

·            As described in the first chapter, GSM subscribers are provided with a SIM card with its unique identification at the very beginning of the service. By divorcing the subscriber ID from the equipment  ID, the subscriber may never own the GSM mobile equipment set. The subscriber is identified in the system when he inserts the SIM card in the mobile equipment. This provides an enormous amount of flexibility to the subscribers since they can now use any GSM-specified mobile equipment. Thus with a SIM card the idea of “Personalize” the equipment currently in use and the respective information used by the network (location information) needs to be updated. The smart card SIM is portable between Mobile Equipment (ME) units. The user only needs to take his smart card on a trip. He can then rent a ME unit at the destination, even in another country, and insert his own SIM. Any calls he makes will be charged to his home GSM account. Also, the GSM system will be able to reach him at the ME unit he is currently using.

The SIM is a removable SC, the size of a credit card, and contains an integrated circuit chip with a microprocessor, random access memory (RAM), and read only memory (ROM). It is inserted in the MS unit by the subscriber when he or she wants to use the MS to make or receive a call. As stated, a SIM also comes in a modular from that can be mounted in the subscriber’s equipment.

      When a mobile subscriber wants to use the system, he or she mounts their SIM card and provide their Personal Identification Number(PIN), which is compared with a PIN stored within the SIM. If the user enters three incorrect PIN codes, the SIM is disabled. The PIN can also be permanently bypassed by the service provider if requested by the subscriber. Disabling the PIN code simplifies the call setup but reduces the protection of the user’s account in the event of a stolen SIM.

International Mobile Subscriber Identity.

An IMSI is assigned to each authorized GSM user. It consists of a mobile country code (MSC), mobile network code (MNC), and a PLMN unique mobile subscriber identification number (MSIN). The IMSI is not hardware-specific. Instead, it is maintained on a SC by an authorized subscriber and is the only absolute identity that a subscriber has within the GSM system. The IMSI consists of the MCC followed by the NMSI and shall not exceed 15 digits.

Temporary Mobile Subscriber Identity

A TMSI is a MSC-VLR specific alias that is designed to maintain user confidentiality. It is assigned only after successful subscriber authentication. The correlation of a TMSI to an IMSI only occurs during a mobile subscriber’s initial transaction with an MSC (for example, location updating). Under certain condition (such as traffic system disruption and malfunctioning of the system), the MSC can direct individual TMSIs to provide the MSC with their IMSI.

Mobile Station ISDN Number

The MS international number must be dialed after the international prefix in order to obtain a mobile subscriber in another country. The MSISDN numbers is composed of the country code (CC) followed by the National Significant Number (N(S)N), which shall not exceed 15 digits.

The Mobile Station Roaming Number (MSRN)

The MSRN is allocated on temporary basis when the MS roams into another numbering area. The MSRN number is used by the HLR for rerouting calls to the MS. It is assigned upon demand by the HLR on a per-call basis. The MSRN for PSTN/ISDN routing shall have the same structure as international ISDN numbers in the area in which the MSRN is allocated. The HLR knows in what MSC/VLR service area the subscriber is located. At the reception of the MSRN, HLR sends it to the GMSC, which can now route the call to the MSC/VLR exchange where the called subscriber is currently registered.

International Mobile Equipment Identity

The IMEI is the unique identity of the equipment used by a subscriber by each PLMN and is used to determine authorized (white), unauthorized (black), and malfunctioning (gray) GSM hardware. In conjunction with the IMSI, it is used to ensure that only authorized usera are granted access to the system. An IMEI is never sent in cipher mode by MS.

BASE STATION SYSTEM

The BSS is a set of BS equipment (such as transceivers and controllers) that is in view by the MSC through a single A interface as being the entity responsible for communicating with MSs in a certain area. The radio equipment of a BSS may be composed of one or more cells. A BSS may consist of one or more BS. The interface between BSC and BTS is designed as an A-bis interface. The BSS includes two types of machines: the BTS in contact with the MSs through the radio interface and the BSC, the latter being in contact with the MSC. The function split is basically between transmission equipment, the BTS, and managing equipment at the BSC. A BTS compares radio transmission and reception devices, up to and including the antennas, and also all the signal processing specific to the radio interface. A single transceiver within BTS supports eight basic radio channels of the same TDM frame. A BSC is a network component in the PLMN that function for control of one or more BTS. It is a functional entity that handles common control functions within a BTS.

            A BTS is a network component that serves one cell and is controlled by a BSC. BTS is typically able to handle three to five radio carries, carrying between 24 and 40 simultaneous communication. Reducing the BTS volume is important to keeping down the cost of the cell sites.

            An important component of the BSS that is considered in the GSM architecture as a part of the BTS is the Transcoder/Rate Adapter Unit (TRAU). The TRAU is the equipment in which coding and decoding is carried out as well as rate adoption in case of data. Although the specifications consider the TRAU as a subpart of the BTS, it can be sited away from the BTS (at MSC), and even between the BSC and the MSC.

            The interface between the MSC and the BSS is a standardized SS7 interface (A-interface) that, as stated before, is fully defined in the GSM recommendations. This allows the system operator to purchase switching equipment from one supplier and radio equipment and the controller from another. The interface between the BSC and a remote BTS likewise is a standard the A-bis. In splitting the BSS functions between BTS and BSC, the main principle was that only such functions that had to reside close to the radio transmitters/receivers should be placed in BTS. This will also help reduce the complexity of the BTS.

           

         Functions of BTS

·          As stated, the primary responsibility of the BTS is to transmit and receive radio signals from a mobile unit over an air interface. To perform this function completely, the signals are encoded, encrypted, multiplexed, modulated, and then fed to the antenna system at the cell site. Trans-coding to bring 13-kbps speech to a standard data rate of 16 kbps and then combining four of these signals to 64 kbps is essentially a part of BTS, though, it can be done at BSC or at MSC. The voice communication can be either at a full or half rate over logical speech channel. In order to keep the mobile synchronized, BTS transmits frequency and time synchronization signals over frequency correction channel (FCCH and BCCH logical channels. The received signal from the mobile is decoded, decrypted, and equalized for channel impairments.

Random access detection is made by BTS, which then sends the message to BSC. The channel subsequent assignment is made by BSC. Timing advance is determined by BTS. BTS signals the mobile for proper timing adjustment. Uplink radio channel measurement corresponding to the downlink measurements made by MS has to be made by BTS.

BTS-BSC Configurations

There are several BTS-BSC configurations: single site; single cell; single site; multicell; and multisite, multicell. These configurations are chosen based on the rular or urban application. These configurations make the GSM system economical since the operation has options to adapt the best layout based on the traffic requirement. Thus, in some sense, system optimization is possible by the proper choice of the configuration. These include omni directional rural configuration where the BSC and BTS are on the same site; chain and multidrop loop configuration in which several BTSs are controlled by a single remote BSC with a chain or ring connection topology; rural star configuration in which several BTSs are connected by individual lines to the same BSC; and sectorized urban configuration in which three BTSs share the same site amd are controlled by either a collocated or remote BSC.

            In rural areas, most BSs are installed to provide maximum coverage rather then maximum capacity.

  Transcoder

Depending on the relative costs of a transmission plant for a particular cellular operator, there may be some benefit, for larger cells and certain network topologies, in having the transcoder either at the BTS, BSC or MSC location. If the trascoder is located at MSC, they are still considered functionally a part of the BSS. This approach allows for the maximum of flexibility and innovation in optimizing the transmission between MSC and BTS.

            The transcoder is the device that takes 13-Kbps speech or 3.6/6/12-Kbps data multiplexes and four of them to convert into standard 64-Kbps data. First, the 13 Kbps or the data at 3.6/6/12 Kbps are brought up to the level of 16 Kpbs by inserting additional synchronizing data to make up the difference between a 13-Kbps speech or lower rate data, and then four of them are combined in the transcoder to provide 64 Kpbs channel within the BSS. Four traffic channel can then be multiplexed on one 64-Kpbs circuit. Thus, the TRAU output data rate is 64 Kpbs. Then, up to 30 such 64-Kpbs channels are multiplexed onto a 2.048 Mpbs if a CEPT1 channel is provided on the A-bis interface. This channel can carry up to 120-(16x 120) traffic and control signals. Since the data rate to the PSTN is normally at 2 Mbps, which is the result of combining 30-Kbps by 64-Kbph channels, or 120- Kbps by 16-Kpbs channels.

   BSC

The BSC, as discussed, is connected to the MSC on one side and to the BTS on the other. The BSC performs the Radio Resource (RR) management for the cells under its control. It assigns and release frequencies and timeslots for all MSs in its own area. The BSC performs the intercell handover for MSs moving between BTS in its control. It also reallocates frequencies to the BTSs in its area to meet locally heavy demands during peak hours or on special events. The BSC controls the power transmission of both BSSs and MSs in its area. The minimum power level for a mobile unit is broadcast over the BCCH. The BSC provides the time and frequency synchronization reference signals broadcast by its BTSs. The BSC also measures the time delay of received MS signals relative to the BTS clock. If the received MS signal is not centered in its assigned timeslot at the BTS, The BSC can direct the BTS to notify the MS to advance the timing such that proper synchronization takes place. The functions of BSC are as follows.

            The BSC may also perform traffic concentration to reduce the number of transmission lines from the BSC to its BTSs, as discussed in the last section.

SWITCHING SUBSYSTEMS: MOBILE SWITCHING CENTER AND GATEWAY SWITCHING CENTER

The network and the switching subsystem together include the main switching functions of GSM as well as the databases needed for subscriber data and mobility management (VLR). The main role of the MSC is to manage the communications between the GSM users and other telecommunication network users. The basic switching function of performed by the MSC, whose main function is to coordinate setting up calls to and from GSM users. The MSC has interface with the BSS on one side (through which MSC VLR is in contact with GSM users) and the external networks on the other (ISDN/PSTN/PSPDN). The main difference between a MSC and an exchange in a fixed network is that the MSC has to take into account the impact of the allocation of RRs and the mobile nature of the subscribers and has to perform, in addition, at least, activities required for the location registration and handover.

                        The MSC is a telephony switch that performs all the switching functions for MSs located in a geographical area as the MSC area. The MSC must also handle different types of numbers and identities related to the same MS and contained in different registers: IMSI, TMSI,ISDN number, and MSRN. In general identities are used in the interface between the MSC and the MS, while numbers are used in the fixed part of the network, such as, for routing.

Functions of MSC

As stated, the main function of the MSC is to coordinate the set up of calls between GSM mobile and PSTN users. Specifically, it performs functions such as paging, resource allocation, location registration, and encryption.

Specifically, the call-handling function of paging is controlled by MSC. MSC coordinates the set up of call to and from all GSM subscribers operating in its areas. The dynamics allocation of access resources is done in coordination with the BSS. More specifically, the MSC decides when and which types of channels should be assigned to which MS. The channel identity and related radio parameters are the responsibility of the BSS, The MSC provides the control of interworking with different networks. It is transparent for the subscriber authentication procedure. The MSC supervises the connection transfer between different BSSs for MSs, with an active call, moving from one call to another. This is ensured if the two BSSs are connected to the same MSC but also when they are not . In this latter case the procedure is more complex, since more then one MSC in involved. The MSC performs billing on calls for all subscribers based in its areas. When the subscriber is roaming elsewhere, the MSC obtains data for the call billing from the visited MSC. Encryption parameters transfers from VLR to BSS to facilitate ciphering on the radio interface are done by MSC. The exchange of signaling  information on the various  interface toward the other network elements and the management of the interface themselves are all controlled by the MSC. Finally, the MSC serves as a SMS gateway to forward SMS messages from Short Message Service Centers (SMSC) to the subscribers and from the subscribers to the SMSCs. It thus acts as a message mailbox and delivery system.

 VLR

The VLR is collocated with an MSC. A MS roaming in an MSC area is controlled by the VLR responsible for that area. When a MS appears in a LA, it starts a registration procedure. The MSC for that area notices this registration and transfers to the VLR the identify of the LA where the MS is situated. A VLR may be in charge of one or several MSC LA’s. The VLR constitutes the databases that support the MSC in the storage and retrieval of the data of subscribers present in its area. When an MS enters the MSC area borders, it signals its arrival to the MSC that stores its identify in the VLR. The information necessary to manage the MS is contained in the HLR and is transferred to the VLR so that they can be easily retrieved if so required.

Data Stored in VLR

·         The data contained in the VLR and in the HLR are more or less the same. Nevertheless the data are present in the VLR only as long as the MS is registered in the area related to that VLR. Data associated with the movement of mobile are IMSI, MSISDN, MSRN, and TMSI. The terms permanent and temporary, in this case, are meaningful only during that time interval. Some data are mandatory, others are optional.

HOME LOCATION REGISTER

The HLR is a database that permanently stores data related to a given set of subscribers. The HLR is the reference database for subscriber parameters. Various identification numbers and addresses as well as authentication parameters, services subscribed, and special routing information are stored. Current subscriber status including a subscriber’s temporary roaming number and associated VLR if the mobile is roaming, are maintained.

            The HLR provides data needed to route calls to all MS-SIMs home based in its MSC area, even when they are roaming out of area or in other GSM networks. The HLR provides the current location data needed to support searching for and paging the MS-SIM for incoming calls, wherever the MS-SIM may be. The HLR is responsible for storage and provision of SIM authentication and encryption parameters needed by the MSC where the MS-SIM is operating. It obtains these parameters from the AUC.

            The HLR maintains record of which supplementary service each user has subscribed to and provides permission control in granting services. The HLR stores the identification of SMS gateways that have messages for the subscriber under the SMS until they can be transmitted to the subscriber and receipt is knowledge.

            Some data are mandatory, other data are optional. Both the HLR and the VLR can be implemented in the same equipment in an MSC (collocated). A PLMN may contain one or several HLRs.

AUTHENTICATION CENTER

The AUC stores information that is necessary to protect communication through the air interface against intrusions, to which the mobile is vulnerable. The legitimacy of the subscriber is established through authentication and ciphering, which protects the user information against unwanted disclosure. Authentication information and ciphering keys are stored in a database within the AUC, which protects the user information against unwanted disclosure and access.

            In the authentication procedure, the key Ki is never transmitted to the mobile over the air path, only a random number is sent. In order to gain access to the system, the mobile must provide the correct Signed Response (SRES) in answer to a random number (RAND) generated by AUC.

            Also, Ki and the cipher key Kc are never transmitted across the air interface between the BTS and the MS. Only the random challenge and the calculated response are transmitted. Thus, the value of Ki and Kc are kept secure. The cipher key, on the other hand, is transmitted on the SS7 link between the home HLR/AUC and the visited MSC, which is a point of potential vulnerability. On the other hand, the random number and cipher key is supposed to change with each phone call, so finding them on one call will not benefit using them on the next call.

            The HLR is also responsible for the “authentication” of the subscriber each time he makes or receives a call. The AUC, which actually performs this function, is a separate GSM entity that will often be physically included with the HLR. Being separate, it will use separate processing equipment for the AUC database functions.

 EQUIPMENT IDENTIFY REGISTER

EIR is a database that stores the IMEI numbers for all registered ME units. The IMEI uniquely identifies all registered ME. There is generally one EIR per PLMN. It interfaces to the various HLR in the PLMN. The EIR keeps track of all ME units in the PLMN. It maintains various lists of message. The database stores the ME identification and has nothing do with subscriber who is receiving or originating call. There are three classes of ME that are stored in the database, and each group has different characteristics.

·         White List: contains those IMEIs that are known to have been assigned to valid MS’s. This is the category of genuine equipment.

·         Black List: contains IMEIs of mobiles that have been reported stolen.

·         Gray List: contains IMEIs of mobiles that have problems (for example, faulty software, wrong make of the equipment). This list contains all MEs with faults not important enough for barring.

INTERWORKING FUNCTION

·         GSM provided a wide range of data services to its subscribers. The GSM system interface with the various forms of public and private data networks currently available. It is the job of the IWF to provide this interfacing capability.

The IWF, which in essence is a part of MSC, provides the subscriber with access to data rate and protocol conversion facilities so that data can be transmitted between GSM Data Terminal Equipment (DTE) and a land-line DTE.

  ECHO CANCELER

  EC is used on the PSTN side of the MSC for all voice circuits. The EC is required at the MSC PSTN interface to reduce the effect of GSM delay when the mobile is connected to the PSTN circuit. The total round-trip delay introduced by the GSM system, which is the result of speech encoding, decoding and signal processing, is of the order of 180 ms. Normally this delay would not be an annoying factor to the mobile, except when communicating to PSTN as it requires a two-wire to four-wire hybrid transformer in the circuit. This hybrid is required at the local switching office because the standard local loop is a two-wire circuit. Due to the presence of this hybrid, some of the energy  at its four-wire receive side from the mobile is coupled to the four-wire transmit side and thus retransmitted to the mobile. This causes the echo, which does not effect the land subscriber but is an annoying factor to the mobile. The standard EC cancels about 70 ms of delay.

                        During a normal PSTN (land-to-land call), no echo is apparent because the delay is too short and the land user is unable to distinguish between the echo and the normal telephone “side tones” However, with the GSM round-trip delay added and without the EC, the effect would be irritating to the MS subscriber.

 OPERATION AND MAINTENANCE CENTER

The OMC provides alarm-handling functions to report and log alarms generated by the other network entities. The maintenance personnel at the OMC can define that criticality of the alarm. Maintenance cover both technical and administrative actions to maintain and correct the system operation, or to restore normal operations after a breakdown, in the shortest possible time.

            The fault management functions of the OMC allow network devices to be manually or automatically removed from or restored to service. The status of network devices can be checked, and tests and diagnostics on various devices can be invoked. For example, diagnostics may be initiated remotely by the OMC. A mobile call trace facility can also be invoked. The performance management functions included collecting traffic statistics from the GSM network entities and archiving them in disk files or displaying them for analysis. Because a potential to collect large amounts of data exists, maintenance personal can select which of the detailed statistics to be collected based on personal interests and past experience. As a result of performance analysis, if necessary, an alarm can be set remotely.

            The OMC provides system change control for the software revisions and configuration data bases in the network entities or uploaded to the OMC. The OMC also keeps track of the different software versions running on different subsystem of the GSM.