Final gsm1
-
Upload
arun-kumar -
Category
Education
-
view
2.275 -
download
2
description
Transcript of Final gsm1
www.awesomebackgrounds.com
p0101011
010101
01010110101011
GSM
Introduction to GSMIntroduction to GSM
• Problem:Problem: Beginning of 1980s - European countries were using many and different incompatible mobile phone systems. Increased needs for telecommunication services
• Action by CEPTAction by CEPT: founded a group to specify a common mobile system for WESTERN EUROPE
• Name of the Group and System: Name of the Group and System: GSM– “Groupe Speciale Mobile”– Global System for Mobile Communications
•Advantage of GSM:Advantage of GSM:
• Digital Radio Path = system tolerates more inter-cell interference, thus efficient use of RF
• Better Quality of speech• Data transmission is supported• New services offered due to ISDN
compatibility• International Roaming possible• Large market = increased competition and
lower investment for operators and rates for users.
Three Subsystems in GSM Three Subsystems in GSM NetworkNetwork• Network Switching Subsystem (NSS)• Base Station Subsystem (BSS)• Network Management System
Base Station Controller (BSC ) handles allocation of radio channels, receives measurements from the mobile phones, controls handovers from BTS to BTS . A key function of the BSC is to act as a concentrator where many different low capacity connections to BTSs (with relatively low utilisation) become reduced to a smaller number of connections towards the Mobile Switching Center (MSC)
The Base Transceiver Station, or BTS, contains the equipment for transmitting and receiving of radio signals (transceivers), antennas, and equipment for encrypting and decrypting communications with the Base Station Controller (BSC).
TRAU (Transcoder and Rate Adaptation Unit). The transcoding function converts the voice channel coding between the GSM . compress voice channels from the 64 kbit/s PCM standard to the 13 kbit/s rate used on the air interface.
Packet Control UnitIt performs some of the processing tasks of the BSC, but for packet data. The allocation of channels between voice and data is controlled by the base station, but once a channel is allocated to the PCU, the PCU takes full control over that channel.
• How does the network keep track How does the network keep track of the subscribers?of the subscribers?– Through LOCATION UPDATE– Through the help of various
DATABASES
+ =
MobileEquipment
SubscriberIdentityModule Mobile
Station
GSMNetwork
AirInterface
• The Subscriber Identity Module (SIM)– a small memory device mounted on a card that
contains user specific identification– The SIM is a detachable smart card containing the
user's subscription information and phonebook – the SIM + mobile equipment = mobile station (MS), a
device able to access services in a GSM network via the Air interface.
The First DatabaseThe First Database
• The Visitor Location Register (VLR)– database which temporarily keeps record of subscribers
currently located in the service area of the MSC– to inform the HLR that a subscriber has arrived in the
particular area covered by the VLR – to track where the subscriber is within the VLR area
(location area) when no call is ongoing – to allocate roaming numbers during the
processing of incoming calls
The Second The Second DatabaseDatabase
Mobile Switching Center
VisitorLocatio
nRegiste
r
• The Home Location Register (HLR)– The HLR is a database used for storage and
management of subscriptions. – stores permanent data about subscribers,
including a subscriber's service profile, location information, and activity status.
– When an individual buys a subscription he or she is registered in the HLR of that operator.
The Third DatabaseThe Third Database
Home LocationRegister
SECURITY AND AUTHENTICATION
SIM CARDS • SIM cards store network specific information used to
authenticate and identify subscribers on the Network. ICCID IMSI Authentication Key (Ki) Local Area Identity (LAI) Operator-Specific Emergency Number SMSC (Short Message Service Center) number Service Provider Name (SPN) Service Dialing Numbers (SDN) Value Added Service (VAS) applications
• IMSI International Mobile Subscriber Identity is a unique
number stored in the Subscriber Identity Module (SIM) inside the phone and is sent by the phone to the network.
IMSI: 284011234567890
MCC 284 Bulgaria
MNC 01 MobilTel
MSIN 1234567890
IMSI analysis is the process of examining a subscriber's IMSI to identify which network the IMSI belongs to and whether subscribers from that network are allowed to use a given network . If they are not local subscribers, this will
require a roaming agreement.
• AUTHENTICATION CENTER (AUC)— authentication and encryption parameters that verify the
user's identity• ensure the confidentiality of each call. • FUNCTION OF AUC: AUC generates data known as triplets for the MSC to
use during the procedure. The security of the process depends upon a shared secret between the AUC and the SIM called the Ki.
The AUC stores the following data for each IMSI:• the Ki
• Algorithm id (the standard algorithms are called A3 or A8, but
an operator may choose a proprietary one).
• AUTHENTICATION PROCESS:
• Ki is a 128-bit value securely burned into the SIM during manufacture and is also securely replicated onto the AUC.
• This Ki is never transmitted between the AUC and SIM
• Each SIM holds a unique Ki assigned to it by the operator during the personalization process.
• When the MSC asks the AUC for a new set of triplets for a particular IMSI, the AUC first generates a random number known as RAND. This RAND is then combined with the Ki to produce two numbers as follows:
The Ki and RAND are fed into the A3 algorithm and a number known as Signed RESponse or SRES is calculated.
The Ki and RAND are fed into the A8 algorithm and a session key called Kc is calculated.
• TRIPLET NUMBER:• The triplets are RAND,SRES,KC. they are stored in the
AUC. They are sent to the mobile switching centre.
• MSC sends the RAND part of the triplet to the SIM. The SIM then feeds this number and the Ki (which is burned onto the SIM) into the A3 algorithm as appropriate and an SRES is calculated and sent back to the MSC .
• If this SRES matches with the SRES in the triplet generated from the authentication center.
• The SIM card is made valid and authenticated.
GSM Security Management AC VLR BTS Air Interface ME SIM
A3
A8A8 A5 A5
A3Authentication
EIR MEIMEI Checking
Ciphering
COMPARING
RAND
KiKiSRES SRES
A3A3
A8Kc Kc
Traffic Traffic
A8A5 A5
Request of IMEI
Provide IMEI
Encrypted DataEncrypted Data
• International Mobile Equipment Identity : The International Mobile Equipment Identity
or IMEI is a number unique to every GSM and UMTS mobile phone
• The IMEI number is used by the GSM network to identify valid devices .
• The IMEI (14 digits plus check digit) or IMEISV (16 digits) includes information on the origin, model, and serial
number of the device
Reporting Body Identifier, indicating the GSMA-approved group that allocated the model TAC
The remainder of the TAC
Serial sequence of the model
Luhn check digit of the entire number (or zero)
Software Version Number (SVN).
AA BBBBBB CCCCCC D EE
• The model and origin comprise the initial 8-digit portion of the IMEI/SV, known as the Type Allocation Code (TAC)
• The remainder of the IMEI is manufacturer-defined, with a Luhn check digit at the end (which is never transmitted).
• The IMEISV drops the Luhn check digit in favour of an additional 2 digits for the Software Version Number (SVN) in the format AA-BBBBBB-CCCCCC-EE
• For example • IMEI code 35-209900-176148-1 IMEISV code 35-209900-176148-23 tells us the following:
TAC: 352099 so it was issued by the BABT and has the allocation number 2099FAC: 00 so it was numbered during the transition phase from the old format to the new format (described below)SNR: 176148 - uniquely identifying a unit of this modelCD: 1 so it is a GSM Phase 2 or higherSVN: 23 - The 'software version number' identifying the revision of the software installed on the phone.
• Retrieving IMEI information from a GSM device• On many devices the IMEI number can be retrieved by
entering *#06#.
• The IMEI can frequently be displayed through phone menus, under a section titled 'System Information', 'Device', 'Phone Info' or similar. Many phones also have the IMEI listed on a label in the battery compartment.
• Retrieving IMEI Information from a Sony or Sony Ericsson handset can be done by entering these keys: Right * Left Left * Left * (Other service menu items will be presented with this key combination).
• The IMEI information can be retrieved from most Nokia mobile phones by pressing *#92702689# (*#WAR0ANTY#), this opens the warranty menu in which the first item is the serial number (the IMEI). The warranty menu also shows other information such as the date the phone was made and the life timer of the phone.
• Blacklisted or Barred Handsets If your phone is lost , report it to your service provider (your network) immediately.
• Add your phones serial number onto a national blacklist database CENTRAL EQUIPMENT IDENTITY REGISTER(CEIR).
• At this point the IMEI number of your handset is cross referenced with the Central Equipment Identity Register. If the IMEI number of your handset
• 1) Refuse to send a signal to your phone (No signal strength at all)
2) OR WILL supply a signal but will not allow any outgoing or incoming calls
• Changing the IMEI number is illegal.
Location UpdateLocation Update• Location Registration (power
on) - IMSI Attach.
• Generic - every time MS detects a change in Location
Area• Periodic - location updates at
regular intervals set by the operator. (default 7 hours)
BTS1BSC
1
MSC
VLR1
MSC
VLR2
LAI 1
MSB
First time Location Update (1)
Loc Up
HLR
IMSI RequestIMSI
Loc Up + TMSI
Authen
VLR DBIMSI MSRN LAI DATA310+02+1234567890 1
HLR DBMSISDN IMSI VLR Address Sub. Data63+918+9499247 310+02+1234567890 vlr 2 services
BTS1BSC
1
MSC
VLR1
MSC
VLR2
LAI 1
MSB
Generic Location Update
TMSI + LAIHLR
Loc Up + new TMSI
TMSI
IMSISecurity Info
Subscriber Info
UpdateDel olddata
Authentication
VLR 1DBIMSI MSRN LAI
310+02+1234567890 x
HLR DBMSISDN IMSI VLR Address Sub. Data63+918+9499247 310+02+1234567890 vlr1 services
VLR2 DBIMSI MSRN LAI DATA310+02+1234567890 1 services
HLR DBMSISDN IMSI VLR Address Sub. Data63+918+9499247 310+02+1234567890 vlr 2 services
Call Establishment (PSTNO-MT)
PSTNBTS
1BSC1MSC 1
VLR1
MSC 2VLR2
HLRHLR Enquiry
HLR DBMSISDN IMSI VLR Address Sub. Data63+918+9499247 310+02+1234567890 vlr2 services
VLR DBIMSI MSRN LAI DATA310+02+1234567890 1services
LAI 1
MSRNPOOL
MSB
IMSI
A
B
MSISDN
MSISDN (B)CC+ NDC + SN 63 918 9499247
IMSI = MCC+MNC+MSIN
MSRN = CC+NDC+SN
MSISDN
Paging Paging • What the network does to locate the
called subscriber.• Service Area of VLR is divided into
smaller areas called Location Areas (LA)• LAI - Location Area Identity
– LAI = MCC + MNC +LAC
• VLR knows the LA of the subscriber• VLR2 DB• IMSI MSRN LAI DATA• 310+02+1234567890 1 services
• All the BTSs within that LA is paged for the subscriber.
PSTNBTS
1BSC 1
MSC
VLR1
MSC
VLR2
LAI 1
MS
A
B
Call Establishment (MO-PSTNT)
MSISDN
MSISDN (A)CC+ NDC + SN 63 2 5113580HLR
VLR DBIMSI MSRN LAI Services 2 Speech
BTS1
BTS2BSC
2
BSC 1
MSC
VLR1
MSC
VLR2
HLR
HLR Enquiry
LAI 1
LAI2
MSRN
MS
MSB
IMSIB
C
Call Establishment (MO-MT)
MSISDN
MSISDN (C)CC+ NDC + SN 63 918 9499247
IMSI = MCC+MNC+MSIN
MSRN = CC+NDC+SN
MSISDN
HLR DBMSISDN IMSI VLR Address Sub. Data63+918+9499247 310+02+1234567890 vlr1 services
HandoverHandover• The process by which an ongoing call
handled by one cell is transferred to another cell.
• Two reasons for Handover:– Handover due to Measurements– Handover due to Traffic Reasons
• Four Types of Handover:– Intra cell - Intra BSC Handover– Inter cell - Intra BSC Handover– Inter cell - Inter BSC Handover– Inter MSC Handover
Handover (1)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
A
BMeasurement Report
Handover (2)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
I am OK
Handover (3)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
Measurement Report
Handover (4)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
I am OK
Handover (5)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
Measurement Report
Handover (6)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
I am OK
Handover (7)
MSC/VLR 1 MSC/VLR 2
BSC1 BSC2 BSC3
BTS4BTS3BTS2BTS1
PSTN
HLR
B
A
TransmissionTransmission
AIR INTERFACEFrequency Allocation
Radio Channel
DOWNLINK935 - 960 MHz1805-1880 MHz
UPLINK890-915 MHz1710-1785 MHz
Air Interface
Cell SiteMobile
TerminologiesTerminologies• Uplink - signal flow from MS to BTS• Downlink - signal flow from BTS to MS• Transceivers (TRX) - devices in the BTS
that transmit and receive radio signals in each of the GSM channels.
• Implementation of Digital Radio Transmission in GSM:– FDMA (Frequency Division Multiple Access)– TDMA (Time Division Multiple Access)
LOGICAL CHANNELS
• Common Channels - used for broadcasting different info to MS and setting up of signaling channels between MSC/VLR and the MS
• Dedicated Channels - used to facilitate the discussions between the MS and the BTS, BSC and MSC/VLR.
LOGICAL CHANNELS
11 Logical Channels in the GSM system:
2 are used for Traffic
9 are used for Control Signaling
LOGICAL CHANNELSTRAFFIC CHANNELS (TCH)
Full Rate ChannelHalf Rate Channel
CONTROL CHANNELS Broadcast Channels (BCH)
Frequency Correction Channel (FCCH)Synchronization Channel (SCH)Broadcast Control Channel (BCCH)
Common Control Channels (CCCH)Paging Channel (PCH)Random Access Channel (RACH)Access Grant Channel (AGCH)
Dedicated Control Channels (DCCH)Stand alone Dedicated Control Channel (SDCCH)Slow Associated Control Channel (SACCH)Fast Associated Control Channel (FACCH)
FCCH = FREQUENCY CORRECTION CHANNEL=> To tell the Mobile that this is the BCCH carrier => To able the Mobile to synchronize to the frequency (Downlink only)
SCH = SYNCHRONISATION CHANNEL=> Used for sending BSIC (Base station Identity Code)=> Give TDMA frame number to the Mobile. (Downlink only)
BCCH = BROADCAST CONTROL CHANNEL=> Used for sending information to the mobile like CGI (Cell Global identity), LAI (Location Area Identity), BCCH carriers of the neighboring cells, maximum output power allowed in the cell. (Downlink only)
BROADCAST CHANNELS
Hey! Don’t shoutat me, lower your
power...
BROADCAST CHANNELSall downlink!
FCCH
SCH TDMA…BSIC...
BCCH
Hey. I’m aGSM emitter!
GSM?
GSM!!!
LA…neighbors…cell info…max power...
Ok…ok
PCH = PAGING CHANNEL=> Used for paging the Mobile. (Downlink only) Reason could be an incoming call or an incoming Short Message. RACH = RANDOM ACCESS CHANNEL=> Used for responding to the paging (terminating), Location updating or to make call access (originating) by asking for a signaling channel. (Uplink only)
AGCH = ACCESS GRANT CHANNEL=> Used to allocate SDCCH to the mobile. (Downlink only)
COMMON CONTROL CHANNELS
COMMON CONTROL CHANNELS
PCH downlink only
Hello! You have a call.
RACH uplink only
Hello! I have to setup a call.
I need SDCCH.
AGCH downlink only
Ok. Use SDCCH.
SDCCH = STAND ALONE DEDICATED CONTROL CHANNEL=> Used for allocating voice channel (TCH) to the mobile (call setup) and Location updating.=> Send Short Text message to Idle Mobile (Uplink & Downlink)
SACCH = SLOW ASSOCIATED CONTROL CHANNEL=> Used for sending information to the mobile like CGI (Cell Global identity), LAI (Location Area Identity), BCCH of all the neighbors cells.=> Send Short Text message to Busy Mobile (Downlink)=> Used for sending signal strength & bit error rate measurement of the serving cell and signal strength of the BCCHs of the neighboring cells. (Uplink)
FACCH = FAST ASSOCIATED CONTROL CHANNEL => Used for handover. (Uplink & Downlink)
DEDICATED CONTROL CHANNELS
DEDICATED CONTROL CHANNELSuplink and downlink
SDCCH
handover
FACCH
On SDCCH:-call set up signaling-location updating-periodic registration-SMSetc…..
On SACCH-used to send signal strength & bit error rate measurement of the serving cell
SACCH
=> SMS messages are short TEXT messages up to 160 characters in length that you can send or receive. The messages are not sent straight to the other mobile but is sent to message centre operated by the Network provider.=> If the mobile was switched off or is at outside of the coverage area, the message is stored in the Message Service Center. The message will be offered to the subscriber when the mobile is switched on again or has reentered the coverage area again.=> If the mobile is in the Idle mode the short message will be send through the SDCCH. If the mobile is Busy the short message will send through the SACCH.
CBCH = CELL BROADCAST CHANNEL=> Used for sending short messages to all the mobiles within a geographic area. Up to 93 characters can be sent. => If the mobile is in the Idle mode then the short message will be send through the CBCH. If the mobile is Busy, it will not be sent.
SMS(SHORT MESSAGE SERVICE)
FUTURE OF GSM
• UMTS Universal Mobile Telecommunications System (UMTS) is one of
the third-generation (3G) cell phone technologies It uses WCDMA access method It is also called as 3GSM
1GB SIM CARD The new 1 GB S-SIM card utilizes System-in-Package
(SiP) technology that enables it to carry the high-capacity NAND flash memory module without increasing the size of the standard SIM card.
CONCLUSION
• What is GSM?• Advantages of GSM• Security and authentication • Location updates• Handover• Channels• Future of GSM
• Google.com• Wikipedia.org• Howstuffworks.com
REFERENCES
www.awesomebackgrounds.com
p0101011
010101
01010110101011
Queries?