2. GSM Architecture 1

3. GSM SubSystems GSM architecture is mainly divided into three Subsystems 1.Base Station Subsystem (BSS) 2.Network & Switching Subsystem (NSS) 3.Operations & Support Subsystem (OSS) Mobile Station sometimes included in BSS 2

4. GSM Network Architecture

5. 4

6. Um I/ F MS BTS BSCBSC T C MSC PSTN VLR HLRAUC EIR A-bis I/F A-ter I/F A I / F Simplified GSM Architecture 5

7. 6

8. 7

9. Mobile Station (MS) The MS consists of two parts 1.Mobile Equipment (ME) 2.Subscriber Identity module (SIM) 8

10. + G S M Global GSM Mobility Card The Smart Card to use SIM Card + Battery Handset battery 2W jmhfod kgdjipj f153454 Mobile Station =

11. G S M Global GSM Mobility Card The Smart Card to use + SIM-Card Handset Subscriber knows - Called party number = MS-ISDN - PIN Contains: - IMSI = Calling line 0609225831 SIM-Card and GSM Mobile Equipment

12. 25 mm 15 mm Microchip with stored user information Credit Card Size Permanent data: -Unique mobile subscriber identity through IMSI number, -Authentication parameter Ki, -Authentication algorithm A3, -Generating encryption key Kc algorithm A8. Removable data: - Temporary Mobile Subscriber Number, - Location Area Identification. µ SIM-Card G S M Global GSM Mobility Card The Smart Card to use The SIM-Card Functions

13. Nature International Mobile Subscriber Identity Conformity with E212 Mobile Station - Integrated Services Digital Network Nb Similar to ISDN, Conformity with E164/E213 Nb. digits 32max 101 to 32 to 4total max 15 * This code does not identify a geographical area but an operator MS - ISDN Format MCCMNC MSIN H1 H2 x x x......... x x x CCNDC SN M1 M2 x x x x x x x x Meaning Mobile Country Code Mobile Network Code Mobile Subscriber Ident. Nb H1 H2 = Identity of HLR within the home PLMN Country Code (where subscription has been made) National Destination Code * Mobile Subscriber (national definition) M1 M2 = nbr of logical HLR IMSI National Significant Mobile Number Identify a PLMN worldwide Identify the subscriber of a PLMN Subscriber Identification

14. Type Approval Code TACFACSNR SP Final Assembly Code Serial number(SPare) TYPE APPROVED Mobile Identification

15. Pocket Hands-free Data Booster 2 W 5 W 2 W 8 W FaxOrganizer PC Dual-band 900-1800 900-1900 Java Trends in Mobile Station

16. Mobile Equipment (ME) The ME is the only part of the GSM network which the subscriber will really see. There are three main types of ME, these are listed below: 1.Vehicle Mounted 2.Portable Mobile Unit 3.Hand portable Unit 15

17.  The SIM is a card which plugs into the ME.  This card identifies the MS subscriber and also provides other information regarding the services that subscriber should receive.  The SIM card, and the high degree of inbuilt system security, provides protection of the subscriber’s information and protection of networks against fraudulent access.  The SIM can be protected by use of Personal Identity Number (PIN) password, similar to bank/credit charge cards, to prevent unauthorized use of the card.  SIM cards are designed to be difficult to duplicate.  By making a distinction between the subscriber identity and the ME identity, GSM can route calls and perform billing based on the identity of the ‘subscriber’ rather than the equipment or its location. Subscriber Identity module (SIM) 16

18. The SIM contains several pieces of information: 1.International Mobile Subscriber Identity (IMSI) 2.Temporary Mobile Subscriber Identity (TMSI) 3.Location Area Identity (LAI) 4.Subscriber Authentication Key (Ki) 5.Mobile Station Integrated Services Digital Network (MSISDN) The SIM is capable of storing additional information such as accumulated call charges. The SIM also executes the Authentication Algorithm. Subscriber Identity module Cntd…. 17

19. Subscriber Identity module Cntd…. 18

20. Base Station Subsystem (BSS) 19

21. TCU BSC OMC-R MSC Radio Interface A Interface Ater Interface Abis Interface NSS BSS OMN Interface Public Telephone Network MS S2000H&L BTS S8000 Indoor BTS S8000 Outdoor BTS Sun StorEdge A5000 Radio Interface BSS Architecture

22. Base Station Controller (BSC)  the BSC provides the control for the BSS.  Any operational information required by the BTS will be received via the BSC.  Likewise any information required about the BTS (by the OMC for example) will be obtained by the BSC.  The BSC incorporates a digital switching matrix, which it uses to connect the radio channels on the air interface with the terrestrial circuits from the MSC.  The BSC switching matrix also allows the BSC to perform “handovers” between radio channels on BTSs, under its control, without involving the MSC. 21

23. 22

24. BTS Abis interface A interface -Radio Resource management for its BTSs -Intercell hand-over -Allocation of channels for communication -Reallocation of frequencies among BTSs -Time and frequency synchronization to BTSs -Controls frequency hopping O&M To Network SubSystem PCM controller PCM controller Processing Unit Switching matrix BSC X.25 controller BSC General Architecture and Functions

25. Base Transceiver Station – BTS The BTS provides the air interface connection with the MS. It also has a limited amount of Control functionality which reduces the amount of traffic passing between the BTS and BSC. Where the BSC and BTS are both shown to control a function, the control is divided between the two, or may be located wholly at one. 24

26. 25

27. Transmission coupler Reception coupler Antenna COUPLING SYSTEM BCF (Base Common Functions) BSC TRX (Transceiver-Receiver) Abis interface -Encodes, encrypts, modulates, feeds the RF signal to the antenna -Decrypts and equalizes the signal then demodulates -Mobile call detection -Uplink channel measurements -Timing advance - Frequency hopping - Multiplexes speech and user's data channels to BSC. - Multiplexes signaling channels to BSC. Duplexer - Interface between Antennas and TRXs of each cell BTS BTS General Architecture and Functions

28. 27

29. BSS Configurations The maximum number of BTSs which may be controlled by one BSC is not specified by GSM. The BTSs and BSC may either be located at the same cell site “co- located”, or located at different sites “Remote”. Another BSS configuration is the daisy chain. Problem- transmission delay through the chain. 28

30. External PCM Interface BSC MSC Transcoder Controller Ater interface A interface E1 trunk up to 120 user's channels T1 trunk up to 92 user's and control channels Converts the 13 kbps GSM speech frame either into a 64 kbps T1 PCM µ-law or into an E1 PCM A-law E1 trunk = up to 31 user's channels T1 trunk = up to 24 user's channels Routes the users' data stream to suitable Inter-working function TRAU TRAU Architecture and Functions

31. Transcoder (XCDR) The 64 kbit/s PCM circuits from the MSC, if transmitted on the air interface without modification, would occupy an excessive amount of radio bandwidth. The Transcoder is to convert the speech or data output from the MSC into the form suitable for transmission over the air interface. The required bandwidth is therefore reduced by processing the 64 kbit/s circuits so that the amount of information required to transmit digitized voice falls to a gross rate of 16 kbit/s. 30

32. The transcoding function may be located at the MSC, BSC, or BTS. The content of the 16 kbit/s data depends on the coding algorithm used. There are two speech coding algorithms available. The Full Rate speech algorithm is supported by all mobiles and networks. It produces 13 kbit/s of coded speech data plus 3 kbit/s of control data known as TRAU data (Transcoder Rate Adaptation Unit). TRAU only used by BTS and discarded (not transmitted on air interface) Transcoder (XCDR) Cntd…. 31

33. the 13 kbit/s of speech data is processed at the BTS to form a gross rate of 22.8 kbit/s on the air interface which includes forward error correction. In the uplink direction the BTS adds in TRAU data which will be used by the transcoder. Enhanced Full Rate is an improved speech coding algorithm and is only supported by Phase 2+ mobiles. It produces 12.2 kbit/s from each 64 kbit/s PCM channel and TRAU data of 3.8 kbits/s Transcoder (XCDR) Cntd…. 32

34. 33

35. Network Switching System (NSS) 34

36. MSC AUC GMSC BSS Other GSM, PSTN, ISDN G-interface IWF Site 2 C-interface A-interface B-interface E F E F H D D BSS Other GSM, PSTN, ISDN E-interface Site 1 NSS Architecture VLR HLR VLR EIR SMS-SC Billing Server Billing Server

37. Network Switching System (NSS) The Network Switching System includes the main switching functions of the GSM network. It also contains the databases required for subscriber data and mobility management. The components of the Network Switching System are listed below: 1. Mobile Services Switching Centre – MSC 2. Home Location Register – HLR 3. Visitor Location Register – VLR 4. Equipment Identity Register – EIR 5. Authentication Centre – AUC 6. Interworking Function – IWF 7. Echo Canceller – EC 36

38. 37

39. Mobile Switching Centre (MSC)  MSC is the heart of the system, controlling the Switching & Billing.  The MSC can carry out different functions depending upon its position in the network.  When provides interface between PSTN & BSS in GSM network then known as a Gateway MSC  provides service to MSs located within a defined geographic coverage area.  The network typically contains more than one MSC.  One MSC is capable of supporting a regional capital with approximately one million inhabitants. 38

40. Call Processing 1.control of data/voice call setup 2.inter-BSS and inter-MSC handovers 3.control of mobility management (subscriber validation and location). Operations and Maintenance Support 1.database management 2.traffic metering and measurement 3.A Man–machine interface. Internetwork Interworking 1.Interface between the GSM network and the PSTN. Billing 1.Collects call billing data. MSC’s Functionalities 39

41. Subscriber Management Center HLR Permanent records - MSISDN - IMSI - Subscriber's service provision Temporary records -VLR address -Ciphering items (Kc, Sres, Rand) Home Location Register

42. Home Location Register (HLR)  The HLR is the master database which contains each user’s service profile.  Various identification numbers and addresses are stored, as well as authentication parameters.  The data it contains is remotely accessed by all the MSCs and the VLRs in the network.  Although the network may contain more than one HLR, there is only one database record per subscriber.  The subscriber data may be accessed by either the IMSI or the MSISDN number. 41

43. VLR Permanent records -IMSI -Subscriber’s service provision Temporary records -Ciphering items (Kc, Sres, Rand) -LAI - TMSI Visitor Location Register

44.  VLR is a temporary database for all user currently located in the system including roamers & non-roamers.  The data exists for only as long as the subscriber is “active” in the particular area covered by the VLR.  The VLR database will therefore contain some duplicate data as well as more precise data relevant to the subscriber.  This function eliminates the need for excessive and time-consuming references to the “home” HLR database. Visitor Location Register (VLR) 43

45. The additional data stored in the VLR is listed below: 1.Mobile status (busy/free/no answer etc.). 2.Location Area Identity (LAI). 3.Temporary Mobile Subscriber Identity (TMSI). 4.Mobile Station Roaming Number (MSRN). MSC updates VLR with HLR information. Each MSC has VLR which resides with the MSC & each G-MSC has a HLR which usually resides with the G-MSC Visitor Location Register Cntd…. 44

46. EIR Black list (barred ME) Gray list (faulty ME) White list (valid ME) Mobile Equipment IMEI Equipment Identity Register

47. The EIR contains a centralized database for validating the IMEI. This database is concerned solely with MS equipment and not with the subscriber who is using it to make or receive a call. The EIR database consists of lists of IMEIs (or ranges of IMEIs) organized as follows: 1.White List 2.Black List 3.Grey List Equipment Identity Register (EIR) 46

48. Equipment Identity Register Cntd…. 47

49. AUC Security A3, A8 algorithms Ki 5 SRES, Kc, RAND RAND AUC provides Ciphering Triplets IMSI HLR Request Authentication Center

50. Authentication Centre (AuC) The AuC is a processor system that performs the “authentication” function. It is normally co-located with the HLR as it will be required to continuously access and update, as necessary, the system subscriber records. The authentication process will usually take place each time the subscriber “initializes” on. 49

51. Mobile Switching Center IWF MS BSS PSTN DTE Land-DTE Rate adaptation DTE signaling Modem Data + DTE signals InterWorking Function

52. Interworking Function (IWF) IWF provides the function to enable the GSM system to interface with the various forms of public and private data networks. The basic features of the IWF are 1.Data rate adaptation. 2.Protocol conversion. Some systems require more IWF capability than others, this depends upon the network to which it is being connected. 51

53. Interworking Function (IWF) Cntd… The IWF also incorporates a ‘‘modem bank”, which may be used when for example, the GSM Data Terminal Equipment (DTE) exchanges data with a land DTE connected via an analogue modem. 52

54. Echo Canceler Mobile Switching Center Base Station SubSystem Echo Canceler Switch Land telephone 4w to 2w transformer GSM network 4 wire circuit PSTN Local loop Talker Echo Two wire circuit 4 wire circuit Talker Echo 4 wire circuit (PCM)

55. Echo Canceller (EC) An EC is used on the PSTN side of the MSC for all voice circuits. Echo control is required at the switch because the inherent GSM system delay(180 ms approx) can cause an unacceptable echo condition. This would not be apparent to the MS subscriber, but for the inclusion of a 2-wire to 4-wire hybrid transformer in the circuit. The transformer causes the echo. This does not affect the land subscriber. 54

56. Echo Canceller (EC) cntd…. 55

57. During a normal PSTN land to land call, no echo is apparent because the delay is too short. without the EC, the effect would be very irritating to the MS subscriber. disrupting speech and concentration. EC provides cancellation of up to 68 ms on the “tail circuit”. the tail circuit is the connection between the output of the EC and the land telephone. Echo Canceller (EC) cntd…. 56

58. 57

59. Operations & Support System (OSS) 58

60. Operations & Support System (OSS) The OSS provides the capability to manage the GSM network remotely. This area of the GSM network is not currently tightly specified by the GSM specifications. It is left to the network provider to decide what capabilities they wish it to have. The Operations and Maintenance System comprises of two parts: 1.Network Management Centre (NMC) 2.Operations and Maintenance Centre (OMC) 59

61. Operations & Support System Cntd.... 60

62. Operations & Support System Cntd.... 61

63. Network Management Centre (NMC) 62

64. Operations and Maintenance Centre (OMC)  The OMC provides a central point from which to control and monitor the other network entities (i.e. base stations, switches, database, etc).  It also monitors the quality of service being provided by the network.  There are two types of OMC these are: 1.OMC-R OMC controls specifically the Base Station System. 2. OMC-S OMC controls specifically the Network Switching System. 63

65. The OMC should support the following functions as per ITS–TS recommendations: 1. Event/Alarm Management. 2. Fault Management. 3. Performance Management. 4. Configuration Management. 5. Security Management. Operations and Maintenance Centre Cntd…. 64

66. Operations and Maintenance Centre Cntd…. 65

67. 66

68. Network in Reality In reality a GSM network is much more complicated than we have seen. The diagram in the next slide illustrates how multiple BSS and Network Switching System components will be connected within a network 67

69. 68

70. Practical Example; London City Typical city for example, London will have approximately the following number of network components: 69

71. A typical network (for example, UK) will have approximately the following number of network components. Mobile Network in U.K 70