1. CS1: Wireless Communication and Mobile Programming
Wireless Technologies:
Cellular Systems
Dr. Khaled Mahmud
Laurentian University International Global Experience Program
Summer 2016

2. Agenda Cellular Systems GSM Signalling Evolution Architecture
Call routing
Addresses
Signalling
(c) Khaled Mahmud

3. Reference
Chapter 5 [TEL]
Web references
(c) Khaled Mahmud

4. Wireless Connectivity: Characteristics
Transmission errors
Wireless LANs – IEEE
Cellular wireless
Multi-hop wireless
Satellites
Low bandwidth
WPAN
Long or variable latency
GEO, LEO satellites
WiMAX
Asymmetry in bandwidth, error characteristics
(c) Khaled Mahmud

5. Cellular Wireless Space divided into Cells
A Base Station is responsible to communicate with hosts in its cell
Mobile stations can change cells while communicating
Handover occurs when a mobile host starts communicating via a new base station
Roaming is allowed in different service area BS BS BS BS
(c) Khaled Mahmud

6. Evolution of Cellular Generations
Source: CDMA Development Group,
(c) Khaled Mahmud

7. Convergence of Wireless and Internet
Converged NW
Mobile Computing Environment
(c) Khaled Mahmud

8. Three Main Elements of a Cellular (Mobile) System
Radio Interface
(Air interface)
User
Equipment
Radio
Access
Network (RAN)
Core
Network (CN)
(c) Khaled Mahmud

9. Three Main Elements of a Cellular (Mobile) System
User
Equipment
(C)
(B)
(c) Khaled Mahmud

10. Typical 2G Architecture
PSDN
BSC
BTS
BSC
HLR
SMS-SC
BSC
PLMN
MSC/VLR
MSC/VLR
BSC
BTS Base Transceiver Station
BSC Base Station Controller
GMSC
Tandem
PSTN
Tandem LE LE LE
MSC Mobile Switching Center
VLR Visitor Location Register
HLR Home Location Register
LE Local Exchange
PSDN Packet Switched Data Network
(c) Khaled Mahmud

11. GSM Network Architecture
NSS MS
BTS
BSC
BSS
Abis E
PSTN
PSTN A B C
MSC
GMSC D TE
VLR
SS7 H
HLR
AuC
MS Mobile Station
MT Mobile Terminal
SIM Subscrivber Identity Module
TE Terminal Equipment
OSS
NSS Network Switching Sub-System
MSC Mobile-service Switching Controller
VLR Visitor Location Register
HLR Home Location Register
AuC Authentication Server
GMSC Gateway MSC
BSS Base Station Sub-System
BTS Base Transceiver Station
BSC Base Station Controller
MS Mobile Station
OMC
OSS Operation Support Sub-System
OMC Operaton Maintenance Center
(c) Khaled Mahmud

12. Mobile Station (MS)
The mobile station (MS)
Communicates the information with the user and
Modifies it to the transmission protocols of the air interface to communicate with the BSS
The MS has two elements
Mobile Terminal (MT)
Piece of hardware purchased by the user containing all the components for the implementation of the protocol to
Interface with the user
Air interface to the BSS
Subscriber Identity Module (SIM)
Smart card issued by the service provider identifying the specifications of a user
The calls in a GSM system are directed to the SIM rather than the terminal
(c) Khaled Mahmud

13. Base Station Sub-system (BSS)
Base Station Subsystem (BSS) translates between the air interface and the fixed wired infrastructure protocols
Speech conversion (Transcoding):
From 13 kbps speech signal 64 PCM digitized signal and vice versa
Generates and interprets dialing signal
BSS also separates the packet switch from the PSTN traffic and directs it to the packet switched data networks
BSS consists of two components
Base Transceiver Station (BTS)
Base Station Controller (BSC)
(c) Khaled Mahmud

14. Base Transceiver Station (BTS)
BTS is the counterpart of the MS for physical communication over the air interface
Components include
Transmitter
Receiver
Signaling equipment
to operate over the air interface
Usually located at the center of a cell where the BSS antenna is installed
One BSS may have from one up to several hundred BTS under its control
(c) Khaled Mahmud

15. Base Station Controller (BSC)
A group of BTS is controlled by a BSC
Reduces Burden of MSC
BSC manages radio related functions
BSC is a high capacity switch that provides services such as
Handoff
Radio channel assignment
Transcoding
Several BSCs are controlled by a single MSC
(c) Khaled Mahmud

16. Network Switching Sub-system (NSS)
The NSS is responsible for network operation
It provides communication with other wired and wireless networks
It is a wireless specific switch that
Communicates with other switches in the PSTN
Supports functionalities needed for a cellular mobile environment
The NSS is the most elaborate element of the GSM network comprising of one hardware and four software components
Mobile Switching Center (MSC)
Visitor Location Register (VLR)
Home Location Register (HLR)
Authentication Center (AUC)
Equipment Identification Register (EIR)
(c) Khaled Mahmud

17. Mobile Switching Centre (MSC)
Hardware part of the wireless switch that can communicate with PSTN switches as well as other MSCs
Employs Signaling System 7 (SS-7) protocol for this
MSC that communicates with the PSTN switches is often referred as the Gateway MSC (GMSC)
Provides the network the specific information on the status of the MSs
Other functions of the MSC includes
Charging for billing
Handling supplementary services like SMS
Communication with the databases
Controlling of the BSC
(c) Khaled Mahmud

18. Home Location Register (HLR)
A database that handles the management of all the subscribers’ account of a particular operator
Permanent store of a subscriber's information until the subscription is cancelled
HLR stores information like
ID (IMSI-International Mobile Subscriber Identity)
Subscriber's address
Current location
Forwarding address
Authentication keys
Billing information
Other function of an HLR includes communication with MSCs/ GMSCs, AUCs and VLRs
There can be multiple HLRs for an operator
Capacity exceeded by the number of subscribers and/or
Redundancy
(c) Khaled Mahmud

19. Visitor Location Register (VLR)
Temporary database identifying the subscribers visiting the coverage area of an MSC
There is one VLR for every MSC
The MSC do not have to contact the HLR every time the MS uses a service or changes status
Facilitates roaming between different MSCs
Facilitates paging since it stores the current LA
Assigns temporary ID (TMSI)
Also contains the status of the MS (e.g. idle)
Deletes the record when the MS leaves the coverage area of the corresponding MSC (upon instruction from the HLR)
(c) Khaled Mahmud

20. Authentication Centre (AUC) & Equipment Register (EIR)
Main function of the AUC is to authenticate the user trying the access the network
AUC holds algorithms used for authentication and encryption
Different SIMs have different algorithms
EIR contains MT identity information
International Mobile Equipment Identity (IMEI)
Identifies manufacturer, country of production, terminal type
Blocks call from stolen/unauthorized/defective ME
Implementation is not mandatory
(c) Khaled Mahmud

21. GSM (with Packet Network) Interfaces
(c) Khaled Mahmud

22. Some Basic Link Definitions
(c) Khaled Mahmud

23. GSM Radio Interface Specification Summary for GSM Cellular System
Multiple access technology
FDMA / TDMA
Duplex technique
FDD
Downlink frequency band
MHz = 25 MHz (basic 900 MHz band only)
Uplink frequency band
MHz = 25 MHz (basic 900 MHz band only)
Channel spacing
200 kHz
Modulation
GMSK
Speech coding
Various - original was RPE-LTP/13
Speech channels per RF channel 8
Channel data rate
kbps
Frame duration
4.615 ms
(c) Khaled Mahmud

24. GSM Radio Interface (cont…)
Duplex separation is 45 MHz
25 MHz is divided in to 124 (not 125) radio frequency channels
Each frequency channel is 200 kHz wide
8 time slots per frequency channel
8 slots (4.615 ms)
TS 0
TS 1
TS 2
TS 3
TS 4
TS 5
TS 6
TS 7
(c) Khaled Mahmud

25. Sequence of Operation Speech Speech Digitizing and source coding
Source decoding and D/A conversion
Channel coding
Channel decoding
Interleaving
Deinterleaving
Burst formatting
Burst formatting (reassembly)
Ciphering
deciphering
Physical Channel
Modulation
Demodulation
(c) Khaled Mahmud

26. GSM Protocol Architecture
Layer 1: Bursts and wired links
Layer 2 (DLL): Primarily based on ISDN
Layer 3 (Networking layer): RRM, MM, CM
Radio
LAPDm
RRM MM
64 kbps
LAPD
SCCP
MTP CM
BTS MS
BSC
MSC Um
Abis A
CM: Connection Management
MM: Mobility Management
RRM: Radio Resource Management
SCCP: Signalling Connection Control Part
MTP: Message Tranfer Part
LAPD: Link Access Protocol - D
(c) Khaled Mahmud

27. RRM, MM, CM Radio Resource Management (RRM) Mobility Management
Controls the setup, maintenance, and termination of radio and fixed channels, including handovers
Mobility Management
Manages location updating and registration procedures as well as security and authentication
Connection Management
Handles general call control (Q.931), manages Supplementary Services and Short Message Service
(c) Khaled Mahmud

28. GSM Frequencies GSM-900 (Primary) EGSM-900 (extended) DCS-1800
UL: MHz (25 MHz)
DL: MHz (25 MHz)
Duplex separation: 45 MHz
ARFCN: (124 channels)
EGSM-900 (extended)
UL: 880–915
DL: 925–960
ARFCN: 975–1023, (174 channels)
DCS-1800
UL: 1710–1785 (75 MHz)
DL: 1805–1880 (75 MHz)
ARFCN: 512–885 (374 channels)
Duplex separation : 95 MHz
PCS-1900
UL: 1850–1910 (60 MHz)
DL: 1930–1990 (60 MHz)
ARFCN: 512–810 (299 channels)
Duplex separation: 80 MHz
There are also other bands being used by different countries
(c) Khaled Mahmud

29. ARFCN - Absolute Radio Frequency Channel Number
Within the spectrum allocated for cellular mobile communications, the radio channels are identified by ARFCN
If the system is operating in FDD (Frequency Division Duplex) mode then the channel number is associated with both the uplink and downlink radio channels
(c) Khaled Mahmud

30. ARFCN Mapping
(c) Khaled Mahmud

31. Identity Numbers in GSM
PSTN/ISDN uses E.164 numbering plan
Mobile Station ISDN Number (MSISDN): Directory Number
MSISDN is a number which uniquely identifies a mobile telephone subscription in the public switched telephone network numbering plan. Max 15 digits
MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number
International access prefix
Country code
National Destination code
Subscriber number
011 1
416 00 91 45
12345
(c) Khaled Mahmud

32. Identity Numbers in GSM (cont…)
International Mobile Subscriber Identity (IMSI)
IMSI is the information which uniquely identifies a subscriber in a GSM/PLMN
Stored in SIM, HLR and VRL
Max length is 15 digits
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code (3 digits)
MNC = Mobile Network Code (2 digits)
MSIN = Mobile Subscriber Identification Number (max 10 digits)
(c) Khaled Mahmud

33. Identity Numbers in GSM (cont…)
Mobile Station Roaming Number (MSRN)
HLR knows in what MSC/VLR Service Area the subscriber is located. In order to provide a temporary number to be used for routing, the HLR requests the current MSC/VLR to allocate and return a Mobile Station Roaming Number (MSRN) for the called subscriber
MSRN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number
(c) Khaled Mahmud

34. Identity Numbers in GSM (cont…)
Temporary Mobile Subscriber Identity (TMSI)
TMSI is a temporary number used instead of the IMSI to identify an MS
It raises the subscriber’s confidentiality and is known within the serving MSC/VLR-area and changed at certain events or time intervals
The structure of the TMSI may be chosen by each administration but should have a maximum length of four octets (8 digits)
(c) Khaled Mahmud

35. Identity Numbers in GSM (cont…)
International Mobile station Equipment Identity (IMEI)
The IMEI is used for equipment identification. An IMEI uniquely identifies a mobile station as a piece or assembly of equipment
15 digits
Type *#61# to see you mobile’s IMEI
(c) Khaled Mahmud

36. Identity Numbers in GSM (cont…)
Location Area Identity (LAI)
LAI is used for location updating of mobile subscribers
LAI = MCC + MNC + LAC
MCC = Mobile Country Code (3 digits)
Identifies the country
Follows the same numbering plan as MCC in IMSI
MNC = Mobile Network Code (2 digits)
Identifies the GSM/PLMN in that country
Follows the same numbering plan as the MNC in IMSI
LAC = Location Area Code
Identifies a location area within a GSM PLMN network
Maximum length of LAC is 16 bits, enabling different location areas to be defined in one GSM PLMN
(c) Khaled Mahmud

37. Identity Numbers in GSM (cont…)
Cell Global Identity (CGI)
CGI is used for cell identification within the GSM network
Done by adding a Cell Identity (CI) to the location area identity
CGI = MCC + MNC + LAC + CI
CI = Cell Identity
Identifies a cell within a location area
Maximum 16 bits
(c) Khaled Mahmud

38. Identity Numbers in GSM (cont…)
Base Station Identity Code (BSIC)
BSIC allows a mobile station to distinguish between different neighboring base stations
BSIC = NCC + BCC
NCC = Network Colour Code (3 bits)
Identifies the GSM PLMN
Does not uniquely identify the operator
NCC is primarily used to distinguish between operators on each side of border.
BCC = Base Station Colour Code (3 bits)
Identifies the Base Station to help distinguish between BTS using the same BCCH frequencies
(c) Khaled Mahmud

39. Mobility Management
The tetherless nature of the mobile network demands mobility management
In a static network
End terminals are fixed
Identity translates directly to the location of the destination terminal
Two parts of Mobility management
Location Management
Handoff Management
(c) Khaled Mahmud

40. Location Management
In a mobile network the destination terminal may be anywhere within the network
There must be mechanism to locate the terminal in order to deliver the communication to it
Location management refers to the activities performed by the wireless network to keep track of the mobile terminal
In a cellular network it must be determined which BS serves the cell under which the MS is currently located
(c) Khaled Mahmud

41. Location Management Functions
Location management consists of three major parts
Location update
Paging
Location information dissemination
Other functionality
If the destination MS is switched off, the network should be aware of its unavailability and should take appropriate action depending on the service requested
As for example SMS can be stored in a server for later delivery
(c) Khaled Mahmud

42. Location Update
Messages sent by the MS regarding its changing point of access to the fixed network
Each time the MS sends a location update message, a database in the fixed part of the network has to be updated
For most common static location update algorithm, a group of cells are assigned a Location Area (LA) Identifier (LAI)
Each BTS in the LA broadcasts the LA identity over the control channel (BCCH) periodically
An MS continually monitors the LA identity
(c) Khaled Mahmud

43. Location Update (Cont’d)
When the identifier changes, the MS transmits an update message indicating the new identity
Static LA updating is vulnerable to the ping-pong effect
A dwell timer is employed to counter this
LA 2
LA 1
Ping-pong Effect
LA 2
LA 1
Location
Update
No Location
(c) Khaled Mahmud

44. Paging
There is some uncertainty in the location of the MS to something around a group of cells
As a result the network needs to page an MS in such a group of cells
Paging is obviously a broadcast message (PCH)
The paged MS responds through the BS serving the corresponding cell
The response enables the network to identify the cell within which the MS resides and initiate the proper procedure to establish communication
(c) Khaled Mahmud

45. Location Information Dissemination
In order to initiate paging
The calling party or the incoming message must trigger a location request from some fixed network entity
The fixed network entity accesses a database that contains the most current information related to the location of the destination MS
The information of the database is used to
Generate a paging request
Deliver the message or
Set up a channel for voice call
Location information dissemination refers to the procedure required to
store and
distribute
the location information related to the mobile terminals serviced by the network
(c) Khaled Mahmud

46. Databases for Location Information Dissemination
Every MS is associated with a
Home network and
Home database often termed as Home Location Register (HLR)
The home database keeps track of the profile of the MS
Mobile identification
Authentication keys
Subscriber profiles
Accounting
Location
The location of MS is kept in terms of a
Visiting network where the MS is located
Visiting database, often termed as Visitor Location Register (VLR), which keeps track of the MSs in its serving area
The home and visiting databases communicate with each other to authenticate and update each other about the MS (Very important for handoff management)
GSM uses HLR, VLR set
(c) Khaled Mahmud

47. Handoff Management
The MS is moving around during an ongoing communication session
There must be mechanism to switch the connection from one BS to another BS as the MS moves away from one BS to another BS
Handoff management refers to the activities performed by the wireless network to transfer one point of access to the infrastructure to another point as the MS changes location
(c) Khaled Mahmud

48. Handoff Management (Cont’d)
Classification of handoff
Hard handoff: MS breaks the connection with the old BS completely before connecting to the new BS
Seamless handoff: MS sets up a pair of traffic channel with the new BS before breaking off from the old BS
Soft handoff: MS is simultaneously connected to two BS during the handoff (occurs in CDMA systems)
Softer handoff: similar to soft handoff. Here the two BS are serving the same cell but different sectors
(c) Khaled Mahmud

49. Handoff Control
Network Controlled Handoff (NCHO): the handoff control is located in a network entity
Mobile Controlled Handoff (MCHO): the handoff control is located in the MS
Mobile Assisted Handoff (MAHO): the handoff control is located in a network entity but it makes the decision based on the information sent by the MS
(c) Khaled Mahmud

50. Security in GSM Authentication Ciphering
Checks the validity of the SIM
Checks access permission in a particular network
Ciphering
Protects user data and control data
In GSM, 3 security algorithms are used
A3: Used for authentication
A5: Used for encryption
A8: Used to create secrete key
ISMI is never used in the air
TMSI is used
Assignment, administration and update is done by VRL
(c) Khaled Mahmud

51. Quick Overview of Multiple Access
(c) Khaled Mahmud

52. Multiple Access
Most communications systems must support many simultaneous communications links, each composed of a transmitter and receiver.
Multiple access techniques allow many users to share the communications channel without interfering with one another
The multiple access methods for voice oriented and data oriented networks are different because of the nature of the traffic they carry
Fixed Assignment Access methods
for voice networks
Random Access methods
for data networks
(c) Khaled Mahmud

53. Fixed Assignment Access Methods
Used for a voice oriented network (circuit switched):
employed for allocating the traffic channels
Frequency Division Multiple Access (FDMA)
Time Division Multiple Access (TDMA)
Spread Spectrum Multiple Access (SSMA)
CDMA fall here
Traffic is exchanged in both direction for a considerable length of time (usually on the order of minutes)
A signaling (control) channel exchanges short messages between the calling components to
Set up the call: obtains resources like link, switches etc.
Terminate the call: releases the resources
(c) Khaled Mahmud

54. Random Access Methods
Random Access methods are often employed for the control channels
Example: RACH of GSM networks employ slotted ALOHA
Used for data oriented network (packet switched):
Designed for bursts of data
Does not have a separate signaling channel
Each packet contains some signaling information related to the address of the destination and source
Random Access methods, often termed as contention schemes, are employed
(c) Khaled Mahmud

55. Frequency Division Multiple Access (FDMA)
All users transmit at once but each user us assigned it’s own channel around its carrier frequency
Frequency
Time
Amplitude f1 f2 f3 f4
user1
user2
user3
user4
BWuser
(c) Khaled Mahmud
fN=central frequency for user N

56. Time Division Multiple Access (TDMA)
All users share same frequency band but each is user is assigned a unique time slot
Amplitude
Frequency
BWsystem
Time fC
TS1
TS2
TS3
TS4
TS1
TS2
user1
user2
user3
user4
user1
user2
TS=Time slot
(c) Khaled Mahmud

57. Code Division Multiple Access (CDMA)
Employs Direct Sequence Spread Spectrum:
Signals all transmit at the same time
Signals all transmit on the same frequency
Receiver uses code or signature sequence to isolate desired signal
(c) Khaled Mahmud

58. Simple Spread Spectrum: Transmitter
Data
b (t)
B ( f )
Spread Signal
S ( f )
s (t)
Spreading Chip
c (t)
C ( f )
Narrowband data signal spread by wideband chipping sequence
(c) Khaled Mahmud

59. Simple Spread Spectrum: Receiver
Data
B ( f )
b (t)
Spread Signal
S ( f )
s (t)
Spreading Chip
c (t)
C ( f )
Wideband received signal despread with wideband chipping sequence
(c) Khaled Mahmud

60. Random Access System: Slotted ALOHA
Transmission time is divided into time slots
The BS transmits a beacon and all the MSs synchronize to that
When a terminal generates packet of data, the packet is buffered and transmitted at the beginning of the next time slot
collision
rescheduled
User 1
User 2
User 3
Slot
Slot
Slot
Slot
There are many other
variations of ALOHA protocol
(c) Khaled Mahmud

61. Carrier Sense Multiple Access (CSMA)
The throughput of an ALOHA system is not very high because of the packet loss and retransmission process
Efficiency can be increased if the transmitter senses the channel before transmission
If the channel is not busy the transmitter sends the packet
If the channel is busy the transmitter reschedules based on some back-off algorithm
rescheduled
collision
delay
User 1
busy
busy
delay
User 2
busy
delay
User 3
(c) Khaled Mahmud