2. ADV1.1.11.03.03 Smart Wireless Engineering Education Program (SWEEP) GSM Systems Training (SYSTRA)

3. ADV1.1.11.03.03 Course Outline I.Introduction to GSM II.Traffic Management III.Signalling IV.Transmission V.Network Planning VI.Nokia Implementation VII.Next Step

4. ADV1.1.11.03.03 Expectations to the training

5. ADV1.1.11.03.03 Introduction to GSM

6. ADV1.1.11.03.03 Objectives  Describe the evolution of GSM network  List four advantages of GSM over analogue networks  Name and describe two open interfaces of GSM networks

7. ADV1.1.11.03.03 Analog Mobile Phone System Nordic Mobile Telephone System (Sweden, Finland, Denmark & Norway) (450Mhz & 900Mhz) Advanced Mobile Phone System (800Mhz) Total Access Communication System (900Mhz) 1 st Generation of Mobile Phone Systems

8. ADV1.1.11.03.03 In 1982, CEPT formed a committee known as the Groupe Special Mobile. Its purpose was to define a mobile system that could be introduced across Europe in the 90’s. It must meet the following criteria : There should be several network operator in each country The system must be an open system – containing well defined interfaces between different system parts It must not cause any major changes to the already existing Public Switched Telephone Networks (PSTN)

9. ADV1.1.11.03.03 Pan European Good Speech Quality Efficient use of radio frequencies High capacity Compatible with ISDN (Integrated Services Digital Network) Compatible with other data communication specifications Maintain good security for subscriber and transmitted info Other considerations

10. ADV1.1.11.03.03 1986CEPT tested 8 experimental systems in Paris 1987MoU Association was established with 13 members from 12 countries (GSM World). Allocation of frequencies for GSM900 1989GSM becomes an ETSI (European Telecom Standard Institute) Technical Group. Final recommendations and specifications were submitted for GSM Phase 1 1991First GSM networks launched 1992 New frequency allocation: GSM 1800 1995The GSM Phase 2 was completed including the adaptation of GSM 1900 1998A total of 120million GSM 900/1800/1900 users worldwide Development highlights 2004A total of 1, 058,672,908 GSM 900/1800/1900 users worldwide (28 April 04 1000H)

11. ADV1.1.11.03.03 GSM MoU (Memorandum of Understanding)  Was set-up in 1987, comprising of licensed mobile operator and national regulatory authorities throughout western Europe.  The GSM MoU works in a number of areas: - Roaming and Charging Policy - Free circulation of MSs - Type approval of MSs(MoU Type Approval Advisory Board) - Security Administration  Popularly known as the GSMWorld Association (www.gsmworld.com)

12. ADV1.1.11.03.03 Subscriptions by Technology Refers to the current market share of active digital mobile subscriptions worldwide Source : World Cellular Information Service 4,052,513,768 Global GSM and 3GSM Mobile Connections, estimated from market data collected by Wireless Intelligence Source : GSM World (www.gsmworld.com)

13. ADV1.1.11.03.03 GSM Phases (UMTS) Universal Mobile Telecommunications System (UMTS)

14. ADV1.1.11.03.03 GSM Phases  Telephony  112 (Emergency Call)  SMS  Fax  Asynchronous / Synchronous Data  Call Forwarding and Barring  International Roaming Phase 1 Services

15. ADV1.1.11.03.03 GSM Phases  Enhanced SMS  Enhanced SIMs  Calling line identification and presentation  Call Waiting  Call Hold  Multiparty communication  Closed group user  Advise of charge Phase 2 Services

16. ADV1.1.11.03.03 GSM Phases  Introduction of Half-rate Channels  Extended frequency band for GSM900  Provision of Microcell environments  General technical improvements of the operation of MS, handover procedures, signalling, etc. Phase 2 improvements of Phase 1

17. ADV1.1.11.03.03 GSM Phases  There are about 90 new services being specified  HSCSD, GPRS and EDGE are one of these services  Phase2+ also include some general technical improvements of previous phases Phase 2+

18. ADV1.1.11.03.03 Open Interfaces of GSM MSBSSNSS NMS AirA O&M SS7 Due to this openness, the operator may obtain different parts of the network from different GSM network suppliers. Air & A interface GSM specification define two truly open interfaces: Air & A interface PSTN

19. ADV1.1.11.03.03 I.GSM uses radio frequencies efficiently, and, due to the digital radio path, the system tolerates more inter cell disturbances. II.The average speech quality achieved is better than in existing analogue systems III.Data transmission is supported throughout the system IV.Speech is encrypted and subscriber information security is guaranteed

20. ADV1.1.11.03.03 V.Due to the ISDN compatibility, new services are offered compared to analogue systems VI.International roaming is technically possible with all countries concerned VII.The large market toughens the competition and lowers the prices for both investment and usage

21. ADV1.1.11.03.03 Traffic Management

22. ADV1.1.11.03.03 Objectives  Name the three subsystems of GSM  Explain the mobility concept (e.g. handover, location update, paging)  Describe how mobile originated and mobile terminated calls are handled in GSM  Describe the concept of charging and security  Know the different services in GSM

23. ADV1.1.11.03.03 THE GSM NETWORK AC Base Station Subsystem (BSS)Network Subsystem (NSS) Network Management Subsystem (NMS) Base Transceiver Station (BTS) Mobile Station Base Station Controller (BSC) Transcoder (TCSM) To other networks Authentication Center Equipment Identity Register Visitor Location Register Mobile Switching Center HLR VLREIR MSC Air I/F Abis I/F A I/F Ater I/F

24. ADV1.1.11.03.03 Where is the subscriber? Who is the subscriber? What does the subscriber wants?

25. ADV1.1.11.03.03 HOTEL RECEPTION DESK REGISTRATION Records the visitor data EMBASSY Records the latest info about his location

26. ADV1.1.11.03.03 Hotel Services

27. ADV1.1.11.03.03 GSM Databases Subscriber Identity Module (SIM) - Subscriber Identity Data - Network Authentication Data - Local Authentication Data - Register Data Home Location Register (HLR) - Permanent Data - Regular update of subscriber’s current VLR Visitor Location Register (VLR) - Temporary Data - Kept as long as subscriber is within it’s coverage area - Updated from HLR - Always associated with a MSC

28. ADV1.1.11.03.03 Databases in a GSM Network VLR HLR MS

29. ADV1.1.11.03.03 Loc Up HLR MSC VLR 2 MSC BSC1 BTS1 LAI1 B VLR 1 IMSI Request IMSI HLR DB MSISDN IMSI VLR Address Sub. Data 63+919+220xxxx 515+03+1234567890 vlr2 services Authen Loc Up + TMSI Location Update First Time Location Update

30. ADV1.1.11.03.03 Location Update Generic Location Update The Mobile Station continues to monitor the broadcast information If the Location Area Identity (LAI) being broadcast by the network is other the one stored in the SIM, the mobile station starts the location update procedure LAI = MCC + MNC + LAC Mobile Country Code = 515 Mobile Network Code = 03 Location Area Code = 40002

31. ADV1.1.11.03.03 VLR HLR MSC (OLD) MSC (NEW) Elements involved in a Location Update

32. ADV1.1.11.03.03 LA 1 LA 4 LA 3 LA 2 MSC/VLR Area PLMN Area Paging is done in all cells of the LA where the subscriber is currently located It can cross BSC boundaries. LA design is arbitrary. The idea is to have a small paging area that could accommodate the most number of subscribers Location Areas

33. ADV1.1.11.03.03 MS BSS MSC VLR new HLR Generic Location Update Procedure VLR old 1. channel assignment 2. location update request 3. Request subscriber identity 4. Answer subscriber identity 5. Request subscriber data 6. Answer subscriber data 7. Security procedures 8. update location 9. update HLR 10. update acknowledgement 11. Cancel old location 12. location canceling accepted

34. ADV1.1.11.03.03 other types of Location Update Note: Location update is always initiated by the Mobile station Power On Also known as “IMSI Attach” and location registration Done every time the mobile is switched on Periodic Location Update Performed after a preset timer expires, since the last transaction with the network Timer value is dependent on the network operator (defined in the BSC)

35. ADV1.1.11.03.03 Call Set-up in a GSM Network (PSTN originated call) PSTN MSISDN +639192205071  Dialed number is Mobile Subscriber International ISDN Number (MSISDN) MSISDN = CC + NDC + SN Country Code = 63 (Philippines) National Destination Code = 919 (Smart) Subscriber Number = 2205071

36. ADV1.1.11.03.03 VLR MSC PSTN MSISDN HLR HLR Inquiry HLR MSISDN IMSI VLR ADDRESS SERVICES +639192205071 515030012205071 VLR15...... PSTN routes the call to GSM network GMSC analyses the received MSISDN GMSC requests the HLR for routing information to know where to route the call (HLR Inquiry) HLR looks up its database for the corresponding International Mobile Subscriber Identity (IMSI) IMSI = MCC + MNC + MSIN Mobile Country Code = 515 Mobile Network Code = 03 Mobile Subscriber Identification Number = 1234567

37. ADV1.1.11.03.03 VLR15 MSC Request for routing info HLR takes the address of the subscriber from it’s database and sends a routing info request to the target MSC/VLR Target MSC/VLR allocates a Mobile Subscriber Roaming Number (MSRN) MSRN = CC + NDC + SN VLR MSC HLR PSTN MSISDN

38. ADV1.1.11.03.03 VLR15 MSC MSRN to HLR VLR MSC HLR PSTN MSRN Target MSC forwards the MSRN to HLR HLR forwards the MSRN to the originating MSC Originating MSC analyses the MSRN and routes it to the target MSC

39. ADV1.1.11.03.03 Call Set-up in a GSM Network (PSTN originated call) VLR MSC VLR MSC HLR PSTN BSC HLR ENQ MSRN Hello Billy! MSRN Request +639192205071

40. ADV1.1.11.03.03 Simplified steps of a call set up in GSM Network A SubscriberPSTNGMSCHLRMSC/VLR Call set up (MSISDN) Analyze number Call set up (MSISDN) MSISDN IMSI MSRN Call set up (MSRN) Paging

41. ADV1.1.11.03.03 Simplified steps of a Mobile Originated call EXCGMSCHLRMSCVLRBSSMS 1. Channel assignment 2. Security procedures 3. Call set up 4. Check services 5. Call ok 6. Call is proceeding 7. Traffic channel allocated 8. Set up the call 9. Call set up complete 10. Alert 11. B answers

42. ADV1.1.11.03.03 NSS Subsystem Functions MSBSSNSS NMS AirA O&M VLR MSC VLR MSC HLR Call Control (End-to-End supervision, connect-supervise-terminate) Charging Mobility Management Signalling with other networks and the BSS Subscriber Data Handling (Refers to subscriber data available in the network, ex. IMSI, Authentication Keys, temporary data in the VLRs)

43. ADV1.1.11.03.03 BTS BSC TC BSS Subsystem Functions Radio Path Control (Frequencies to be used) BTS and TC Control (O&M functions) Synchronization (Master & Slave hierarchy, Primary Reference Clock (PRC) Air and A Interface Signalling Connection Establishment between MS and NSS Mobility Management and Speech Transcoding Collection of Statistical Data

44. ADV1.1.11.03.03 NMS Subsystem Functions Fault Management Configuration Management Performance Management

45. ADV1.1.11.03.03Handover Handover: Changing the traffic channel that MS is using Handover: occurs during the subscriber is making a call In GSM, MS station helps the network in doing handover by sending signal measurement reports to its BSC Uses the hard handover principle (release and connect)

46. ADV1.1.11.03.03 Handover due to traffic reasons  When capacity of cells nears maximum, MS in the periphery of the cell maybe handed over to neighboring cell with lower traffic load.  MSC starts the procedure Handover due to signal quality and strength  When the quality or the strength of the radio signal falls below certain parameters specified in the BSC  The BSC controlling the current cell makes the decision  There are four types of this handover

47. ADV1.1.11.03.03 Intra Cell – Intra BSC Handover BTS TC BSC NSS Air A Old Channel New Channel

48. ADV1.1.11.03.03 BTS TC BSC NSS Air A Inter Cell – Intra BSC Handover BTS Old Cell New Cell

49. ADV1.1.11.03.03 BTS TC BSC NSS Air A Inter Cell – Inter BSC Handover BTS TC BSC VLR MSC New Cell Old Cell

50. ADV1.1.11.03.03 BTS TC BSC NSS Air A Inter MSC Handover BTS TC BSC VLR MSC New Cell Old Cell VLR MSC

51. ADV1.1.11.03.03 Inter MSC Handover Procedure HON = CC + NDC + SN The source MSC is known as Anchor MSC Call is routed from source MSC to target MSC with the use of Handover Number, HON. Handover number has a similar structure to MSRN.

52. ADV1.1.11.03.03 MS BSS oldMSC oldMSC newBSS newMS (after HO) 1. Measurements reports 2. Handover required 3. Request HON 4. Request radio resources 5. Radio resources reserved 6. Provide HON and target cell info 7. Set up speech connection (HON) 8. Handover command 9. Handover complete 11. connect 10. Handover complete 12. Release old connections

53. ADV1.1.11.03.03CHARGING What to charge? Different charging packages Installation Fee Renting of the service Use of the network

54. ADV1.1.11.03.03Charging Factors affecting the price of the call Type of basic service Duration of the call Time of the call Destination of the call Origin of the Call Use of Networks Type of the supplementary service Use of radio resource Roaming leg

55. ADV1.1.11.03.03 Collection of Charging Data  Charging depends on many factors  The MSC to which handles the call collects all information which could be the basis for charging  This collected information of the call is stored in Charging Data Records (CDR) HLR GMSC PSTN BSC CDR

56. ADV1.1.11.03.03 Transfer of Charging Data  Charging data records are stored in the MSC where they are collected.  CDRs must be kept at the first MSC which manages the call.  When sufficient charging data records have been collected they are transferred in one bulk to the Billing Center.  Billing Center is responsible for producing the bills for the subscribers based on the information contained in the Charging Data Record HLR GMSC PSTN BSC X.25 or Ethernet Billing Center

57. ADV1.1.11.03.03Security Authentication Verification of the subscriber Ciphering Encryption of the user speech in the Air Interface IMEI Checking Verification of the Mobile Equipment by checking the validity of the International Mobile Equipment Identity (IMEI) User Confidentiality Avoidance of the broadcast of user’s IMSI in the air interface

58. ADV1.1.11.03.03Authentication  Each subscriber has authentication keys, Ki, stored in the Authentication center and SIM card.  Comparison of Ki without broadcasting it in the air interface  Authentication always performed by the VLR before call establishment and location update.

59. ADV1.1.11.03.03 VLR MSC NSS AC BSS BSC TC BTS Location of Security Algorithm ME + SIM AirA A5 A3 A8

60. ADV1.1.11.03.03 IMEI Checking  The validity of a mobile phone may be checked to ensure its proper operation as well as presentation against stolen phones.  The Equipment Identity Register, which is implemented as part of the HLR, contains 3 listing of IMEI - White List - Gray List - Black List IMEI IMEI = TAC(6) + FAC(2) + SNR(6) + SP(1)  TAC = Type Approval Code, Identifies the mobile equipment  FAC = Final Assembly Code, Identifies which assembly series the mobile belongs  SNR = Serial Number, Identifies the mobile uniquely as one assembly series  SP = Spare, For future use

61. ADV1.1.11.03.03 User Confidentiality  IMSI is a confidential identity of the subscriber.  After a successful first time location update, a mobile subscriber is allocated a Temporary Mobile Subscriber Identity (TMSI)  The next time a transaction between the GSM network and the MS is initiated, the subscriber is identified by the use of TMSI.

62. ADV1.1.11.03.03 GSM Security Management AC VLR BTS Air Interface ME SIM A3 A8 A5 A3 Authentication EIR ME IMEI Checking Ciphering COMPARING RAND Ki SRES A3 A8 Kc Traffic TDMA FN A8 A5 Request of IMEI Provide IMEI Encrypted Data

63. ADV1.1.11.03.03 Authentication Triplet Generation AC VLR Random Number Generator Ki A3A8 RANDSRESKc Authentication Triplets RANDSRESKc Authentication Triplets

64. ADV1.1.11.03.03Services Services Basic Services Supplementary Services Teleservices Bearer Services What are services? A subscriber’s action which uses the facilities of the GSM network

65. ADV1.1.11.03.03 Classification of services Teleservices: These services provide the subscriber with necessary capabilities including terminal equipment functions to communicate with other subscribers. Bearer services: A bearer service offer the basic technical capability for transmission of binary data between end to end terminals. TE GSM Network Transit Network End Network Bearer Service Teleservice

66. ADV1.1.11.03.03Teleservices Service DescriptionGSM Specification Code Characteristics Speech (Telephony) T11 The most important service for mobile systems, normal speech service, including emergency calls Speech (Emergency Calls) T12 Emergency calls are automatically possible Short Message Service T21 (Mobile terminated) For reception of short messages Short Message Service T22 (Mobile originated) For sending short messages to another GSM subscriber Short Message Service T23 (Cell Broadcast) For sending short messages to more than one receiver simultaneously within a given cell Group 3 Facsimile transmission T61 (with alternate speech) Presently not supported by NOKIA Group 3 Facsimile transmission T62For sending and receiving facsimile messages

67. ADV1.1.11.03.03 Short Message Service: Mobile Originated and Mobile Terminated VLR MSC Short Message Service Center (SMSC) Air BSS A NSS SMS-MO SMS-MT

68. ADV1.1.11.03.03 BTS BSC NSS BSS NMS AirA SMS-Cell Broadcast Short Message Service: Cell Broadcast

69. ADV1.1.11.03.03 Facsimile Transmission AirA Modems/Rate Adaptation BSS VLR MSC NSS IWF

70. ADV1.1.11.03.03 Bearer Services Circuit Mode unstructured with Unrestricted Digital Capability Transparent Circuit Mode unstructured with Unrestricted Digital Capability Non Transparent PAD (Packet Assembler/Dissembler) service Packet Service  carry only coding- and application-independent information  they represent the services of layers 1, 2 and 3 of the OSI-RM

71. ADV1.1.11.03.03 Supplementary Services Advice of Charge - AOC Alternate Line Service - ALS (personal or business) Barring of all incoming calls - BAIC Baring of all incoming calls when roaming outside the HPLMN Barring of all incoming calls when abroad Barring of outgoing calls Barring of outgoing international calls excluding those directed to the HPLMN country Call forwarding on mobile subscriber busy - CFB Call forwarding on no answer - CFNA Call forwarding unconditional - CFU Call Hold Call waiting - CW Calling line identification presentation - CLIP Calling line identification restriction - CLIR Conference Call Explicit Call

72. ADV1.1.11.03.03 Signalling

73. ADV1.1.11.03.03 Objectives  Explain the needs of signalling  Describe the SS7 protocol stack and their functions in telephone exchanges, and how they differ for GSM, compared to PSTN  Identify the protocol stacks implemented in each GSM network element, e.g., BSC, MSC, and HLR  Explain the specific needs for the GSM network and the additional protocol layers  Explain the SS7 requirements for individual GSM network elements

74. ADV1.1.11.03.03 Signalling in the old days

75. ADV1.1.11.03.03 Calling Party ExchangeCalled Party Request for service Provide address Process information and make connection Alert called party Called party answer Conversation Signalling Operations Request address Disconnection

76. ADV1.1.11.03.03 Channel Associated Signalling (CAS) Exch. AExch. B 21... 1516173031... 21 1516173031... 21 1516173031... 21 1516173031... Good for low traffic Waste of Bandwidth Also known as MFCR2 or R2

77. ADV1.1.11.03.03 Common Channel Signalling (C7 or SS7) Exch. AExch. B 21... 15 16 173031... 21 1516173031... 21 1516173031... 21 1516173031... High capacity Signalling in the absence of call possible

78. ADV1.1.11.03.03 CAS vs. SS7 CASSS7  Signalling in time slot 16  Signalling is associated to a predefined speech TSL  1 signalling time slot per 30 speech connections  No message structure  4 bits/message  Signalling in any time slot except 0  Signalling can anytime be associated to any speech connection, or it can be used for non-call-independent applications  Standardized message structure  Variable message length

79. ADV1.1.11.03.03 Message Bearers and Managers Message Transfer Part User Part Message Managers Message Bearer Exchange A Message Managers Exchange B

80. ADV1.1.11.03.03 SS7 - Message Transfer Part Layer 1 Physical ConnectionsLayer 2 Data Link ControlLayer 3 Signalling Message Handling Message Transfer Part

81. ADV1.1.11.03.03 Level 1 Level 2 Level 3 TUP NUP ISUP Level 1 Level 2 Level 3 TUP NUP ISUP Call Control Messages Transport of Signalling Messages within one network Data Link Control Physical Connections MTP SS7 - TUP/ NUP/ ISUP

82. ADV1.1.11.03.03 Virtual Connections B Destination Signalling Point A Signalling Point Virtual Connection using SCCP

83. ADV1.1.11.03.03 SS7 - SCCP MTP SCCP TUP NUP ISUP

84. ADV1.1.11.03.03 Message Transfer Part (MTP) is responsible for transferring message from one network element to another within the same signalling network. TUP is the user part of the messages brought by MTP. These messages deal with setting up, supervising and clearing of call connections. It has two variations NUP and ISUP. Signalling Connection and Control Part (SCCP) is used to provide virtual connections and connectionless signalling.

85. ADV1.1.11.03.03 SS7 Analogy MTP Level 1 MTP Level 2 & Level 3 ISUP SCCP TUP/ NUP MAP INAP Cargo

86. ADV1.1.11.03.03 MTP SCCP TUP NUP ISUP SS7 - BSSAP BSSAP

87. ADV1.1.11.03.03 MTP SCCP TUP NUP ISUP SS7 - TCAP and MAP BSSAP TCAP MAP Signalling Protocol Stack

88. ADV1.1.11.03.03 Base Station Subsystem Application Part (BSSAP) Protocol layer responsible for communicating GSM specific messages between MSC and BSC, and MSC and MS. Mobile Application Part (MAP) A GSM specific protocol for non call related applications between NSS elements. Transaction Capabilities and Application Part (TCAP) Protocol layer responsible for providing service to MAP by handling the MAP transaction messages between multiple elements.

89. ADV1.1.11.03.03 MTP SCCP TUP NUP ISUP Protocol Stack in MSC BSSAP TCAP MAP

90. ADV1.1.11.03.03 MTP SCCP Protocol Stack in HLR TCAP MAP

91. ADV1.1.11.03.03 MTP SCCP Protocol Stack in BSC BSSAP

92. ADV1.1.11.03.03 MTPSCCP TUP NUP ISUP BSSAP TCAP MAP MSC MTPSCCP BSSAP BSC MTPSCCP TCAP MAP MTPSCCP TUP NUP ISUP HLR PSTN Exchange

93. ADV1.1.11.03.03 BTS BSC MSC SS#7 PSTN / HLR’s / other MSC’s LAPD LAPDm Signalling in a GSM network

94. ADV1.1.11.03.03 Interconnection of two Signalling Networks SP10, NA0 SP20, NA0 SP60, NA0 SP50, NA0 Signalling Network NA0 SP20, NA1SP10, NA1 Signalling Network NA1 SP40, NA0SP30, NA0

95. ADV1.1.11.03.03 Summary  Signalling is the transfer of information between subscriber interface points and the network and between different network element to help establish a call.  Signalling information is interchanged as standard sets of messages which was developed and standardized into the present SS7.  GSM needs non call related signalling which is possible with SS7.  The SS7 used in PSTN networks is not sufficient to fulfill the signalling requirements of GSM networks, thus new protocols specific to GSM were developed.

96. ADV1.1.11.03.03  MTP is the basis of SS7, and its responsible for transferring of signalling messages from one network element to another within the same signalling network.  TUP/ISUP are the user parts of MTP which handle call control.  SCCP is needed for virtual connections and connectionless signalling.  BSSAP is used for signalling between MSC-BSC and MSC-MS.  MAP is needed for signalling between NSS elements. Summary