1. GSM standard (continued)

2. Multiple Access Methods
Frequency Division Multiple Access (FDMA)
Frequency ch
Frequency ch
Frequency N ch
Time Division Multiple Access (TDMA)
Time Time Time
Slot 1 Slot 2 Slot N
ch ch ch
Code Division Multiple Access (CDMA)
Code Sequence 1 ch
Code Sequence 2 ch
Code Sequence N ch
The two major access methods used for mobile telephone communications are Frequency Division Multiple Access (FDMA) and Time Division Multiple Access (TDMA). In FDMA, a given spectral allocation is broken into a number of individual radio channels, N, each of which can carry a single information channel.
In TDMA the given allocation is shared in time by a number of users, N, by assigning each to a specified time interval call a time slot.
A third access method is called Code Division Multiple Access (CDMA). Here, each user is assigned a unique digital code which modulates their digital information such that it can be recovered by the receiver even though other users are simultaneously using the same frequency band.
The access method used in GSM is TDMA.

3. MAC Alternatives - FDMA
Frequency Division Multiple Access divides up the available spectrum into a number of discrete radio channels, each carrying one speech channel.
This is the technique used by entertainment radio, you tune your radio to the centre frequency of a channel. The radio station is allowed to use frequencies around that centre frequency and is supposed to not interfere with adjacent frequencies. In practice, a sharp cutoff of frequency at the edge of a channel does not happen and adjacent frequencies are not used by nearly radio stations.
This was the first type of MAC used and is still employed in many radio systems - this is the technique used in analogue cellular systems such as TACS. Each channel has a specified bandwidth (e.g. 25kHz) and a "centre frequency". Channels are then arranged in a contiguous band and if users need to change channel for whatever reason they must retune to a new frequency.
The technique has the advantage of being relatively simple to implement - all that is required is a transceiver which can be easily retuned to each of the available channels.

4. MAC Alternatives - TDMA
Time Division Multiple Access divides the medium in time. Each channel has a discrete "slot" in which to transfer data.
In practice TDMA is combined with FDMA for practical systems. For example GSM uses TDMA in which each radio frequency carrier is divided into 8 timeslots - the bandwidth of one carrier is 200kHz. So the total spectrum is divided up using FDMA into 200kHz carriers, each of which carries 8 TDMA channels. Each slot can carry one voice call.
TDMA only really became viable with the advent of digital electronics and signal processing technology.

5. MAC Alternatives - CDMA
Code 4
All Channels Share
Same RF Band
Ch 1
Ch 2
Ch 3
Ch 4
Power
Freq
Code Division Multiple Access is somewhat more difficult to explain. The medium is shared through the use of certain "codes" applied to each channel when transmitted. These codes have a special property which means that the signal can only be received if the same unique code is applied by the receiver. If the wrong code is used the signal appears as essentially random noise to the receiver. All channels share the same spectrum the only method of distinguishing them is the unique code.
CDMA is very complex to implement and requires a great deal of signal processing. In addition there are a number of significant practical difficulties with such systems. Only very recently has it been possible to develop commercial cellular systems using this technology. However, the technology is potentially very powerful and can make very efficient us of the available spectrum. For these reasons it is to be the basis of the MAC used in third generation systems.
Code 1
Code 2
Code 3

6. Physical Channel Structure Used in P-GSM900
Frequency 1 ch
Slot 0
Slot 1
Slot 7
Frequency 2
Frequency 124
Downlink
Uplink
992 Duplex Physical Channels Available
Time
Domain
ARFCN 1
Frequency
In the P-GSM900* system there are 124 uplink radio channels (labelled 1–124), each containing 8 time slots (labelled 0–7), and 124 downlink radio channels (also labelled 1–124), each containing 8 time slots (labelled 0–7). Since radio channels come in pairs for duplex operation, the method is known as Time Division Multiple Access with Frequency Division Duplex (TDMA/FDD).
A pair of radio channels is called an Absolute Radio Frequency Channel Number (ARFCN).
The combination of an ARFCN and a timeslot number defines a Physical Channel.
(In a frequency hopping system, the physical channel hops over a defined set of ARFCN’s but remains in the same timeslot).
* P-GSM900 = Primary GSM900 Band
In response to a demand for more capacity, the P-GSM spectrum was extended to form E-GSM, representing an extension of the lower end of the two sub-blocks by 10 MHz, thereby giving a further 50 channels.

7. TDMA Operation in GSM Full Rate Full Rate 1 2 3 4 5 6 7 Frame (Count)1 2 3 4 5 6 7
Frame (Count)
Frame (Count + 1)
DOWNLINK
Frame (Count)
Frame (Count + 1) 1 2 3 4 5 6 7 1 2 3 4 5 6 7
UPLINK
Full Rate
The complete set of allocated time slots is called a TDMA frame. Each mobile can transmit only during its assigned timeslot in a frame as shown. Thus, with TDMA, transmission from mobile to base occurs in bursts. In the base to mobile direction, which is usually supported on a different radio frequency channel, transmission is continuous. However, information directed to a given mobile is sent only during the given mobile’s assigned timeslot for that direction.
The use of a frame offset of more than one timeslot simplifies the construction of the mobile station. The mobile station will be using different times to transmit and receive, requiring only a switch rather than a duplexer at the antenna.
A maximum of eight mobiles can share the same radio channel in the case of full-rate operation. If half-rate voice coding is used, each time slot can support two voice channels and 16 mobiles can share the same radio channel.
A Frame has a duration of 4.62 ms (217 frames per second).
A timeslot has a duration of 577 ms. BS
MS1
MS7
MS0
MS5

8. GSM - TDMA/FDMA higher GSM frame structures GSM TDMA frame 1 2 3 4 5 6
MHz
124 channels (200 kHz)
downlink
frequency
MHz
124 channels (200 kHz)
uplink
higher GSM frame structures
time
GSM TDMA frame 1 2 3 4 5 6 7 8
4.615 ms
GSM time-slot (normal burst)
guard
space
guard
space
tail
user data S
Training S
user data
tail
3 bits
57 bits 1
26 bits 1
57 bits 3
546.5 µs
577 µs

9. MS Transmission Band : 890 – 915 MHZ
BS Transmission Band : 935 – 960 MHZ
45 MHz

10. Channels for Two-Way Communications
Frequency Division Duplex
Frequency separation
between uplink and
downlink channel pairs 1 2 3 1 2 3
frequency
Uplink RF carrier channels
Downlink RF carrier channels
Frequency Division Duplex
In GSM the RF channels come in pairs to support duplex communications. The term Frequency Division Duplex (FDD) is used to describe this system.
Downlink
Uplink

11. GSM Handover Lanline switched at MSCTo
Frequency 9 Time Slot 7
MSC
From
Frequency 6 Time Slot 3
BSS MS
As the Mobile Station moves from one cell area to another, an active call must undergo a “hot” switch from one channel to another. This process is called a handover or handoff. In GSM, a handover usually involves both a change of carrier frequency and time slot. It also may require a reconfiguration of the landline facilities by dropping the connection to the old BSS and switching to a connection going to the new BSS as shown. In this example, the mobile tunes from carrier frequency 6 on time slot 3 served by the old BSS to carrier frequency 9 on time slot 7 served by the new BSS. At the same time, the MSC switches the call from the old BSS to the new BSS. All this may take less than 150 ms and go unnoticed by the subscriber.
Subscriber
Set
BSS
Lanline switched at MSC
Frequency and time slot changed at MS

12. Mobile Terminated Call4
1: calling a GSM subscriber
2: forwarding call to GMSC
3: signal call setup to HLR
4, 5: request MSRN from VLR
6: forward responsible MSC to GMSC
7: forward call to
current MSC
8, 9: get current status of MS
10, 11: paging of MS
12, 13: MS answers
14, 15: security checks
16, 17: set up connection
HLR
VLR 5 8 9 3 6 14 15
PSTN 7
calling
station
GMSC
MSC 1 2 10 13 10 10 16
BSS
BSS
BSS 11 11 11 11 12 17 MS

13. Mobile Originated Call
VLR
1, 2: connection request
3, 4: security check
5-8: check resources
(free circuit)
9-10: set up call 3 4
PSTN 6 5
GMSC
MSC 7 8 2 9 1 MS
BSS 10

14. MTC/MOC MTC MOC BTS MS paging request channel request
immediate assignment
paging response
authentication request
authentication response
ciphering command
ciphering complete
setup
call confirmed
assignment command
assignment complete
alerting
connect
connect acknowledge
data/speech exchange
service request
MTC
MOC

15. 4 types of handover 1 2 3 4 MS MS MS MS BTS BTS BTS BTS BSC BSC BSC
MSC
MSC

16. Handover decision receive level BTSold receive level BTSold HO_MARGINMS MS
BTSold
BTSnew

17. Handover procedure HO access MS BTSold BSCold MSC BSCnew BTSnew
measurement
report
measurement
result
HO decision
HO required
HO request
resource allocation
ch. activation
ch. activation ack
HO request ack
HO command
HO command
HO command
HO access
Link establishment
HO complete
HO complete
clear command
clear command
clear complete
clear complete

18. Security in GSM
Security services
access control/authentication user  SIM (Subscriber Identity Module): secret PIN (personal identification number
confidentiality
voice and signaling encrypted on the wireless link (after successful authentication)
anonymity
temporary identity TMSI (Temporary Mobile Subscriber Identity)
newly assigned at each new location update (LUP)
encrypted transmission
3 algorithms specified in GSM
A3 for authentication (“secret”, open interface)
A5 for encryption (standardized)
A8 for key generation (“secret”, open interface)
“secret”:
A3 and A8 available via the Internet
network providers can use stronger mechanisms

19. GSM - authentication SIM mobile network RAND Ki RAND RAND Ki 128 bitAC A3 A3
SIM
SRES* 32 bit
SRES bit
SRES* =? SRES
SRES
MSC
SRES
32 bit
Ki: individual subscriber authentication key SRES: signed response

20. GSM - key generation and encryption
mobile network (BTS)
MS with SIM
RAND Ki
RAND
RAND Ki AC
SIM
128 bit
128 bit
128 bit
128 bit A8 A8
cipher
key Kc
64 bit Kc
64 bit
data
encrypted data
SRES
data
BSS MS A5 A5