1. 1 Cellular Communications

2. First telephone (photophone) – Alexander Bell, 1880 The first car mounted radio telephone – 1921 Old days

3. 1946 – First commercial mobile radio- telephone service by Bell and AT&T in Saint Louis, USA. Half duplex (PTT) 1973 – First handheld cellular phone – Motorola. First cellular net Bahrein 1978 Going further

4. But what’s cellular? HLR, VLR, AC, EIR MSC PSTN BS

5. Frequency reuse – same frequency in many cell sites Cellular expansion – easy to add new cells Handover – moving between cells Roaming between networks Cellular principles

6. 6 possible radio coverage of the cell idealized shape of the cell cell segmentation of the area into cells Cell of Cellular network Use of several carrier frequencies Not the same frequency in adjoining cells Cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc. Hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) If a mobile user changes cells, handover of the connection to the neighbor cell

7. Evolution of Mobile Network Fourth Generation Third Generation Second Generation (Digital) First Generation (Analog) Future Network

8. 1G: Analog [routines for sending voice] All systems are incompatible No international roaming Little capacity – cannot accommodate masses of subscribers First Generation (1G)

9. 2G – digital [voice encoding] Increased capacity More security Compatibility Can use TDMA or CDMA for increasing capacity Second Generation (2G)

10. Time Division Multiple Access Each channel is divided into timeslots, each conversation uses one timeslot. Many conversations are multiplexed into a single channel. Used in GSM TDMA

11. Code Division Multiple Access All users share the same frequency all the time! To pick out the signal of specific user, this signal is modulated with a unique code sequence. CDMA

12. 2.5 G – packet-switching Connection to the internet is paid by packets and not by connection time. Connection to internet is cheaper and faster [up to 56KBps] The service name is GPRS – General Packet Radio Services Enhanced Data rates for GSM Evolution (EDGE): 2.75G 2.5 G

13. Permanent web connection at 2Mbps Internet, phone and media: 3 in 1 The standard based on GSM is called UMTS. The EDGE standard is the development of GSM towards 3G. Third Generation (3G)

14. High Speed Packet Access (HSPA) extends and improves the performance of existing 3G Most common deployment –HSPA: upgrades to the original W-CDMA standard and offers speeds of 14.4 Mbit/s (down) and 5.76 MBit/s up. –HSPA+: further upgrade of HSPA, can provide theoretical peak data rates up to 168 Mbit/s (downlink) and 22 Mbit/s (uplink) Use of Wideband CDMA: 3G

15. 4G system provides mobile ultra-broadband Internet access Through USB wireless modems, to laptops or smartphones, etc. 4G applications include amended mobile web access, IP telephony, gaming services, HD mobile TV, video conferencing Two 4G systems are commercially deployed: Mobile WiMAX Long Term Evolution (LTE) Fourth Generation (4G)

16. GSM 16

17. GSM Overview GSM stand for Global System for Mobile Communication The GSM makes use of narrowband Time Division Multiple Access(TDMA) technique for transmitting signals. Ability to carry 64 kbps to 120 kbps of data rates. Presently GSM supports more than one billion mobile subscribers in more than 210 countries throughout the world. The GSM provides basic to advanced voice and data services including Roaming service. 17

18. Why GSM? Improved spectrum efficiency. International roaming. Low-cost mobile sets and base stations. High-quality speech. Compatibility with Integrated Services Digital Network (ISDN) and other telephone company services. Support for new services.

19. 19 Architecture of the GSM system GSM is a PLMN (Public Land Mobile Network) –several providers setup mobile networks following the GSM standard within each country GSM subsystems RSS (radio subsystem): covers all radio aspects NSS (network and switching subsystem): call forwarding, handover, switching OSS (operation subsystem): management of the network

20. Interfaces in GSM Network The interfaces defined sub-systems include:  ’A’ interface between NSS and BSS  ‘Abis’ interface between BSC and BTS (within the BSS)  ‘Um’ air interface between the BSS and the MS

22. TRX – TransceiverAuC – Authentication Center MS – Mobile StationEIR – Equipment Identity Register OMC – Operations and Maintenance Center PSTN – Public Switched Telephone Network BSS – Base Station Sub- system BSC – Base Station Controller HLR – Home Location RegisterBTS – Base Transceiver Station MSC – Mobile Switching CenterVLR – Visitor Location Register GSM Network Component Terminology

23. 23 Ingredients 1: Mobile Phones, PDAs... The visible but smallest part of the network! Consists of  Mobile Equipment (ME)  Subscriber Identity Module (SIM)

24. 24 Ingredients 2: Antennas Still visible – cause many discussions…

25. 25 Ingredients 3: Infrastructure 1 Base Stations Cabling Microwave links

26. Base Station Subsystem (BSS) Consist of Base Transceiver Station (BTS): - Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna. - Communicates with Mobile station and BSC - Consists of Transceivers (TRX) units Base Station Controller (BSC): - Manages Radio resources for BTS - Assigns Frequency and time slots for all MS’s in its area - Handles call set up - Handover for each MS - It communicates with MSC and BTS

27. 27 Ingredients 3: Infrastructure 2 Switching units Data bases Management Monitoring Not visible, but comprise the major part of the network (also from an investment point of view…)

28. Network Switching Subsystem(NSS) Consist Of - Mobile Switching Center (MSC): Heart of the network which manages communication between GSM and other networks - Home Location Register (HLR): Stores information about each subscriber and update the information in HLR as soon as the subscriber leaves its current local area. - Visitor Location Register (VLR): Controls mobiles roaming by updating VLR Database. - Authentication Center (AUC) Contains the algorithms for authentication and prevent fraud operation. - Equipment Identity Register (EIR) Stores all devices identifications registered for this network

29. Call from Mobile Phone to PSTN The MSC/VLR receives the message of a call request. The MSC/VLR checks if the mobile station is authorized to access the network. If so, the mobile station is activated. If the mobile station is not authorized, service will be denied. MSC/VLR analyzes the number and initiates a call setup with the PSTN. MSC/VLR asks the corresponding BSC to allocate a traffic channel (a radio channel and a time slot). The BSC allocates the traffic channel and passes the information to the mobile station. The called party answers the call and the conversation takes place. The mobile station keeps on taking measurements of the radio channels in the present cell and neighboring cells and passes the information to the BSC. The BSC decides if handover is required, if so, a new traffic channel is allocated to the mobile station and the handover is performed. If handover is not required, the mobile station continues to transmit in the same frequency.

30. 30 GSM Architecture fixed network BSC MSC GMSC OMC, EIR, AUC VLR HLR NSS with OSS RSS VLR

31. Call from PSTN to Mobile Phone The Gateway MSC receives the call and queries the HLR for the information needed to route the call to the serving MSC/VLR. The GMSC routes the call to the MSC/VLR. The MSC checks the VLR for the location area of the MS. The MSC contacts the MS via the BSC through a broadcast message, that is, through a paging request. The MS responds to the page request. The BSC allocates a traffic channel and sends a message to the MS to tune to the channel. The MS generates a ringing signal and, after the subscriber answers, the speech connection is established. Handover, if required, takes place, as discussed in the earlier case.

32. GSM comes in three flavors(frequency bands): 900, 1800, 1900 MHz. Voice is digitized using Full-Rate coding. 20 ms sample => 260 bits. 13 Kbps bitrate GSM frequency bands

33. 33 GSM frequency bands (examples) TypeChannelsUplink [MHz]Downlink [MHz] GSM 850128-251824-849869-894 GSM 900 classical Extended 0-124, 955-1023 124 channels +49 channels 876-915 890-915 880-915 921-960 935-960 925-960 GSM 1800512-8851710-17851805-1880 GSM 1900512-8101850-19101930-1990 GSM-R exclusive 955-1024, 0-124 69 channels 876-915 876-880 921-960 921-925 - Additionally: GSM 400 (also named GSM 450 or GSM 480 at 450-458/460-468 or 479-486/489-496 MHz) - Please note: frequency ranges may vary depending on the country! - Channels at the lower/upper edge of a frequency band are typically not used

34. 34 12 3 4 5 6 78 higher GSM frame structures 935-960 MHz 124 channels (200 kHz) downlink 890-915 MHz 124 channels (200 kHz) uplink frequency time GSM TDMA frame GSM time-slot (normal burst) 4.615 ms 546.5 µs 577 µs tailuser dataTrainingS guard space Suser datatail guard space 3 bits57 bits26 bits 57 bits1 13 GSM - TDMA/FDMA

35. GSM uses TDMA and FDMA to let everybody talk. FDMA: 25MHz freq. is divided into 124 carrier frequencies. Each base station gets few of those. TDMA: Each carrier frequency is divided into bursts [0.577 ms]. 8 bursts are a frame. Sharing

36. The physical channel in GSM is the timeslot. The logical channel is the information which goes through the physical channel Both user data and signaling are logical channels. Channels

37. User data is carried on the traffic channel (TCH), which is defined as 26 TDMA frames. There are lots of control channels for signaling, base station to mobile, mobile to base station (“aloha” to request network access) Traffic Channel

38. Signaling protocol for networks Packet switching [like IP] For communication between HLR and VLR (allowing roaming) and other advanced capabilities. GSM’s protocol which sits on top of SS7 is MAP – mobile application part SS7

39. 39 To locate an MS and to address it, several numbers are needed: Mobile station international ISDN number (MSISDN) International mobile subscriber identity (IMSI) Temporary mobile subscriber identity (TMSI) Mobile station roaming number (MSRN) Localizing and Calling

40. 40 Mobile Subscriber Integrated Services Digital Network- Number MSISDN is a number uniquely identifying a subscription in a GSM or a UMTS mobile network. It is the telephone number to the SIM card in a mobile/cellular phone. For a GSM user, Phone number is not associated with a certain device but with the SIM, which is personalized for a user MSISDN number (e.g., +49 179 1234567) consists of country code (CC): 49 for Germany national destination code (NDC): network provider 179 subscriber number (SN): 1234567 Mobile station international ISDN number

41. 41 GSM uses the IMSI for internal unique identification of a subscriber. IMSI consists of a Mobile country Code (MCC) (e.g., 240 for Sweden) Mobile Network Code (MNC) Mobile Subscriber Identification Number (MSIN). International Mobile Subscriber Identity (IMSI)

42. 42

43. 43 To hide IMSI (which gives away the exact identity), GSM uses 4- byte TMSI for local subscriber identification. TMSI is selected by the current VLR and is only valid temporarily and within the location area of the VLR TMSI and LAI are sufficient to identify a user for an ongoing communication; the IMSI is not needed). A VLR may change the TMSI periodically. Temporary Mobile Subscriber Identity (TMSI)

44. 44 Another temporary address that hides the identity and location of a subscriber is MSRN. The VLR generates this address on request from the MSC, and the address is also stored in the HLR. MSRN contains the current visitor country code (VCC), the visitor national destination code (VNDC), the identification of the current MSC together with the subscriber number. The MSRN helps the HLR to find a subscriber for an incoming call. Mobile Station Roaming Number (MSRN)

45. 45 Mobile Terminated Call PSTN calling station GMSC HLR VLR BSS MSC MS 12 3 4 5 6 7 89 10 1112 13 16 10 11 1415 17 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR 6: forward responsible MSC to GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection

46. 46 Mobile Originated Call 1, 2: connection request 3, 4: security check 5-8: check resources (free circuit) 9-10: set up call PSTN GMSC VLR BSS MSC MS 1 2 65 34 9 10 78

47. 47 4 types of handover MSC BSC BTS MS 1 234 1.Intra-cell 2.Inter-cell, intra-BSC 3.Inter-BSC, Intra-MSC 4.Inter-MSC

48. 48 Handover decision receive level BTS old receive level BTS new MS HO_MARGIN BTS old BTS new

49. 49 Handover procedure HO access BTS old BSC new measurement result BSC old Link establishment MSC MS measurement report HO decision HO required BTS new HO request resource allocation ch. activation ch. activation ack HO request ack HO command HO complete clear command clear complete

50. 50 Security in GSM Security services –access control/authentication user - SIM (Subscriber Identity Module): secret PIN (personal identification number) SIM-network: challenge response method –confidentiality voice and signaling encrypted on the wireless link (after successful authentication) –anonymity temporary identity TMSI newly assigned at each new location update (LUP) encrypted transmission Three algorithms specified in GSM –A3 for authentication (“secret”, open interface) –A5 for encryption (standardized) –A8 for key generation (“secret”, open interface) “secret”: A3 and A8 available via the Internet network providers can use stronger mechanisms

51. 51 GSM - authentication A3 RANDKiKi 128 bit SRES* 32 bit A3 RANDKiKi 128 bit SRES 32 bit SRES* =? SRES SRES RAND SRES 32 bit mobile network SIM AC MSC SIM K i : individual subscriber authentication keySRES: signed response

52. 52 GSM - key generation and encryption A8 RANDKiKi 128 bit K c 64 bit A8 RANDKiKi 128 bit SRES RAND encrypted data mobile network (BTS) MS with SIM AC BSS SIM A5 K c 64 bit A5 MS data cipher key

53. GSM Network Architecture For 2.5G SGSN: Service GPRS Support Node GGSN: Gateway GPRS Support Node

54. 54 GPSR: Data services in GSM GPRS (General Packet Radio Service) –packet switching –using free slots only if data packets ready to send (e.g., 50 kbit/s using 4 slots temporarily) –standardization 1998, introduction 2001 –advantage: one step towards UMTS, more flexible –disadvantage: more investment was needed (new hardware) GPRS network elements –GSN (GPRS Support Nodes): GGSN and SGSN –GGSN (Gateway GSN) interworking unit between GPRS and PDN (Packet Data Network) –SGSN (Serving GSN) supports the MS (location, billing, security) –GR (GPRS Register) user addresses

55. Enhanced Data rates in GSM Environment (EDGE) EDGE is enhancement of GPRS Improved data transmission rate as a backward compatible extension to GSM Also considered as pre-3G technology EDGE delivers higher bit-rate per radio channel resulting increased capacity and performance than GPRS Pick bit-rates up to 1Mbps Typical bit-rates 400 kbps Use high-order PSK or 8-phase shift keying

56. 3G  Third Generation Mobile Communications Technology (IMT-2000)  IMT-2000 standard developed by Third-Generation Partnership Project (3GPP).  In Europe, 3G is called UMTS (Universal Mobile Telecommunications System) 56

57. Why 3G?  In EDGE, Packet transfer air interface behaves like a circuit switch call. Thus, Packet connection efficiency was lost.  Same Network Standard for world wide.  Need a Faster Mobile Technology  3G increased bandwidth, up to  384 Kbps when a device is moving,  128 Kbps in a car &  2 Mbps in fixed applications 57

58. History of 3G Oct 2001: NTT DoCoMo in Japan branded FOMA, based on W- CDMA January 2002, SK Telecom in South Korea on the CDMA2000 1xEV-DO based on CDMA March 2003, Europe(UK & Italy) 3 (Part of Hutchison Whampoa) based on W-CDMA In USA, 1st 3G network was by Monet Mobile Networks & 2 nd was Oct 2003 Verizon Wireless both on CDMA2000 1x EV-DO In South Asia, August 2006, Dialog in Sri Lanka based on W- CDMA In Oct 2012, Teletalk in Bangladesh based on W-CDMA 58

59. 3G Features Wireless voice call and SMS Video calls Video-conferencing Enhanced audio and video streaming Location-based services (GPS) Mobile TV HSPA(High Speed Packet Access)data transmission 14.4 Mbps on the downlink 5.8 Mbps on the uplink 59

60. Technologies of 3G W-CDMA :Wideband Code Division Multiple Access. CDMA 2000: Code Division Multiple Access. TD-SCDMA: Time-division Synchronous CDMA 3.5G/3.5G+ is enhancement to 3G. High-Speed Downlink Packet Access (HSDPA) High-Speed Packet Access(HSPA) Evolved High-Speed Packet Access (HSPA+) 60

61. W-CDMA Network Architecture Radio Network Controller RAN (Radio Access Network) CN (Core Network) RNC Node B Packet switch domain Circuit switch domain SGSN GGSN MSCGMSC IMS IP Network Circuit Switched Network Mobile Station Mobile Station MSC: Mobile Switching Center GMSC: Gateway Mobile Switching Center SGSN: Service GPRS Support Node GGSN: Gateway GPRS Support Node IMS: IP Multimedia Subsystem

62. W-CDMA Network Architecture There are 2 major parts to a W-CDMA mobile network:  Radio Access Network (RAN): This is a hierarchical arrangement of cell towers and base stations.  Radio Network Controllers (RNC) :  Controls the Node B  Data encryption / decryption  Radio resource management and some of the mobility management  Node B : Base station transceiver (transmitter and receiver)  Core Network (CN): The core network consists of all the switches, routers, and other network components.  Circuit-switched networks: are used for phone calls  Packet-switched networks: handles data

63. CDMA2000 1xEV-DO (3G) 63 BSC: Base Station Controller MSC: Mobile Switching Center PSTN: Public Switched Telephone Network PDSN: Packet Data Serving Node

64. 3.5G (HSDPA)  High Speed Downlink Packet Access (HSDPA) is a 3.5 G upgrade for existing WCDMA  Maximum downlink data rates to 14.4 Mbps  Reduces latency to 100ms from 180-200 ms  HSDPA introduces a new transport channel High-Speed Downlink Shared channel (HS-DSC)  HSDPA other key features  Adaptive Modulation and Coding (AMC)  Hybrid Automatic Repeat Request (H-ARQ) 64

65. Comparison Technology/ Features 2.5 G/2.5G+3G/3.5G Start19851992 Deployment1999/20032001/2008 Data Bandwidth40-500kbps2Mbps/14.4 Mbps Bandwidth per Carrier200kHz5MHz StandardGPRS/EDGEWCDMA/CDMA2000 1xEVDO TechnologyDigital Cellular TechnologyBoard Bandwidth CDMA, IP Technology ServiceHigher Capacity packet dataIntegrated high quality audio, video and data Multiplexing TDMA/CDMACDMA SwitchingCircuit for Network and air interface ; Packet for Core Network Circuit for air Interface; Packet for all others. Core NetworkPSTN and Packet NetworkPacket Network HandoffHorizontal SecurityA5/1KASUMI

66. Data rate Comparison 66

67. Evolution towards 4G 67

68. 4G 4G is also referred to as LTE (Long Term Evolution) Not a single technology or standard, rather a collection of technologies and protocols –aimed at creating fully packet-switched networks 4G networks are projected to provide speeds of 100 Mbps while moving and 1 Gbps while stationary. 68

69. Evolution in Network Structure 1G/2G: Circuit switching only 2.5G/3G: Both circuit switching and packet switching 4G: Circuit switching eliminated; packet switch only (All-IP) 69 Source: LTE Network Evolution and Technology Overview, White Paper by Tektronix Communications, USA

70. LTE Architecture Two networks: Evolved UTRAN (E- UTRAN) Evolved Packet Core (EPC) No circuit switching element 70 Source: LTE Network Evolution and Technology Overview, White Paper by Tektronix Communications, USA

71. Evolution in Data Rate 71 1 Peak data rate for GSM/GPRS; 2 Peak data rate for HSPA+; 3 Peak data rate for LTE Advanced

72. Thank you 72