Mobile Network

What is GSM ?

Global System for Mobile (GSM) is a second generation cellular standard developed to cater voice services and data delivery using digital modulation

GSM Services

Tele-services Bearer or Data Services Supplementary services

Tele Services

• Telecommunication services that enable voice communication

via mobile phones

• Offered services

- Mobile telephony

- Emergency calling

Bearer Services

Include various data services for information transfer between GSM and other networks like PSTN, ISDN etc at rates from 300 to 9600 bps

Short Message Service (SMS) –up to 160 character alphanumeric data transmission to/from the mobile terminal

Unified Messaging Services(UMS) Group 3 fax Voice mailbox Electronic mail

Supplementary Services

Call related services :

• Call Waiting- Notification of an incoming call while on the handset

• Call Hold- Put a caller on hold to take another call

• Call Barring- All calls, outgoing calls, or incoming calls

• Call Forwarding- Calls can be sent to various numbers defined by the user

• Multi Party Call Conferencing - Link multiple calls together

• CLIP – Caller line identification presentation

• CLIR – Caller line identification restriction

• CUG – Closed user group

GSM System Architecture

BSC

BSC

MSC

MS

MS

MS BTS

BTS

BTS

GMSC

PSTNISDNPDN

EIRAUC

HLR

VLR

GSM System Architecture-I

Mobile Station (MS)

Mobile Equipment (ME)

Subscriber Identity Module (SIM) Base Station Subsystem (BSS)

Base Transceiver Station (BTS)

Base Station Controller (BSC) Network Switching Subsystem(NSS)

Mobile Switching Center (MSC)

Home Location Register (HLR)

Visitor Location Register (VLR)

Authentication Center (AUC)

Equipment Identity Register (EIR)

System ArchitectureMobile Station (MS)

In 2G it is known as MS. In 3G systems, It is referred as User Equipment (UE). The Mobile Station is made up of two entities:

– Mobile Equipment (ME)– Subscriber Identity Module (SIM)

System Architecture- Mobil Station (MS)

In GSM, the Mobile Station consists of four main components:– Mobile Terminal (MT)- offers common functions that are used by all

the service the Mobile Station offers. It is equivalent to the network termination of an ISDN access and is also the end-point of the radio interface.

– Terminal Equipment (TE) - is a peripheral device of the Mobile Station and offers services to the user. It does not contain any functions specific to GSM.

– Terminal Adapter (TA) - hides radio-specific characteristics. – Subscriber Identity Module (SIM) - is a personalization of the Mobile

Station and stores user specific parameters (such as mobile number, contacts etc).

System ArchitectureMobile Station (MS) -Mobile Equipment

Portable,vehicle mounted, hand held device Uniquely identified by an IMEI (International Mobile Equipment Identity) IMEI can be displayed on most phones by dialing the code *# 06 #. It is not stored in SIM. It is stored in the phone If a mobile handset is lost or stolen, CEIR (Central Equipment Identity

Register) can be contacted. CERI will blacklist the device in all currently operating switches. This makes the lost or stolen handset unusable. Blacklisting stolen mobile handsets is seen as a deterrent to crime. It is possible, however, to change an IMEI with special tools. Certain mobile networks that do not automatically blacklist handsets

registered with the CEIR. Approximately 10% of IMEI's in use today are not unique or have been

reprogrammed (hacked).

Format of IMEI

Mainly two types– 15 Digits or 17 Digits

The IMEI (14 decimal digits plus a check digit) or IMEISV (16 digits)

The structure of the IMEI/SV are specified in 3GPP TS 23.003 The model and origin comprise the initial 8-digit portion of the

IMEI/SV, known as the Type Allocation Code (TAC). Format of the IMEI is AA-BBBBBB-CCCCCC-D AA: Reporting Body Identifier, indicating the GSMA-approved

group that allocated the model TAC. BBBBBB: The remainder of the TAC (Type Approval Code) CCCCCC: Serial sequence of the model D: Luhn check digit of the entire number (or zero) EE: Software Version Number (SVN)

Example: Format of IMEI

35-209900-176148-1 What is the meaning of it. 352099 so it was issued by the BABT (British Approvals

Board for Telecommunications) and has the allocation number 2099.

The Reporting Body Identifier is allocated by the Global Decimal Administrator;

FAC (Finally Assembly Code): 00 so it was numbered during the transition phase from the old format to the new format

SNR: 176148 - uniquely identifying a unit of this modelCD: 1 so it is a GSM Phase 2 or higher

Mobile Equipment Identifier

There are two administrators: – the Global Decimal Administrator (GDA) for IMEIs – Global Hexadecimal Administrator (GHA).

Manufacturer code

Serial number CD

R R X X X X X X Z Z Z Z Z Z C

CDMA Format

An MEID is 56 bits long (14 hex digits). It consists of three fields, including an 8-bit regional code (RR), a 24-bit manufacturer code, and a 24-bit manufacturer-assigned serial number. The check digit (CD) is not considered part of the MEID.

As of August 2006, the TIA acts as the Global Hexadecimal Administrator (GHA) to assign MEID, and the GSM Association acts as the Global Decimal Administrator

Luhn algorithm

The check digit is validated in three steps: Starting from the right, double a digit every two digits

(e.g., 7 → 14). Sum the digits (e.g., 14 → 1 + 4). Check if the sum is divisible by 10. Conversely, one can calculate the IMEI by choosing

the check digit that would give a sum divisible by 10. For the example IMEI 49015420323751?,

Luhn algorithm

IMEI 4 9 0 1 5 4 2 0 3 2 3 7 5 1  ?

Double every other 4 18 0 2 5 8 2 0 3 4 3 14 5 2  ?

Sum digits 4 + (1 + 8) + 0 + 2 + 5 + 8 + 2 + 0 + 3 + 4 + 3 + (1 + 4) + 5 + 2 + ? = 52 + ?

To make the sum divisible by 10, we set ? = 8, so the IMEI is 490154203237518

CEIR Classification of Handsets

Color Meaning

White Valid Mobile Station

Grey Mobile Station to be tracked

Black Barred Mobile Station

System ArchitectureMobile Station (MS) - Mobile Equipment

Voice and data transmission Monitoring power and signal quality of surrounding cells for

optimum handover Power level : 0.8W – 20 W 160 character long SMS.

What is an IMSI?

The IMSI (International Mobile Subscriber Identity) is a unique 15-digit code used to identify an individual user on a GSM network.

The IMSI consists of three components:– Mobile Country Code (MCC) – Mobile Network Code (MNC) – Mobile Subscriber Identity Number (MSIN)

The IMSI is stored in the Subscriber Identity Module (SIM).

System ArchitectureMobile Station (MS) contd.

Subscriber Identity Module (SIM)

Smart card contains the International Mobile Subscriber Identity (IMSI)

Allows user to send and receive calls and receive other subscribed services

Encoded network identification details - Key Ki,Kc and A3,A5 and A8 algorithms Protected by a password or PIN Can be moved from phone to phone – contains key

information to activate the phone

New Trends

In random order Mega-trends of Mobile Industry are:1. The threat and possibilities of the Discount Mobile Service Providers,2. Falling profit margins on basic mobile services (voice, SMS) as a result of

competition,3. The use of outsourcing - to minimize OPEX,4. Controlled investment in infrastructure - to reduce CAPEX,5. The use of micro-segmentation (Mobile operators will use sub-brands and producers

of mobile terminals will introduce a wide range of different terminal models),6. Higher marketing expenses – partly because of the use of micro-segmentation,7. Stock Rotation Risk – the result of the terminal producers larger product portfolio,8. New business models in the mobile value chain – the existing business models are an

impediment on economic growth,9. A more complex value chain – a growing number of different players seek the place

in the mobile value chain,10. Mobile penetration vs. SIM-penetration – there is an important difference.

Issues

Environmental Related – About 1.2 billion mobile handsets were sold worldwide. To put

that into context, it means that, on average, more than 3 million new handsets were sold every day last year.

– How to reduce power consumption– How to use solar power– How to reduce CO2 emission.– How to take care of large number of chargers lying with

subscribers. It should be done through regulation It should be done through Innovation Or combination of both Reduction of Hazardous Substances (RoHS) directive Waste Electrical and Electronic Equipment (WEEE) Directive

Statistics

SN Manufacturer Year

2008 2007 2006 2005

1 Nokia 468.3 (39.93%)

436.38(38.98%)

348.0 (34.97)

265.0 (32.70%)

2 Samsung 196.5 (16.76%)

161.10 (14.39%)

118.0 (11.86)

103.0 (12.70%)

3 LG 101.1 (8.62%) 80.50 (7.19%) 66.4 (6.67) 55.0 (6.80%)

4 Motorola 100.1 (8.54%) 159.00 (14.20%)

217.4 (21.85)

146.0 (18.00%)

5 Sony Ericsson 96.6 (8.24%) 103.4 (9.24) 74.5 (7.49) 51.0 (6.30%)

Others 210.1 (17.92%)

179.10 (16.0%)

171.8 (17.16)

191.0 (23.50%)

Total 1172.7 (100%) 1119.48 (100%)

996.1 (100%)

811.0 (100%)

SN Manufacturer September 5, 2005

June 17, 2008

1 Nokia 59.0% 65.2%

2 Sony Ericsson 12.8%

3 Samsung 13.0% 6.2 %

4 L&G 6.2%

5 Motorola 7.0% 5.0%

Indian Statistics

System ArchitectureBase Station Subsystem (BSS)

Base Station Subsystem is composed of two parts that communicate across the standardized Abis interface allowing operation between components made by different suppliers

1. Base Transceiver Station (BTS)

2. Base Station Controller (BSC)

BSS interfaces

Um: The air interface between the mobile station (MS) and the BTS.

Abis: The interface between the BTS and BSC. A: The interface between the BSC and MSC. Ater: The interface between the BSC and

transcoder. Gb: Connects the BSS to the SGSN in the

GPRS core network

System ArchitectureBase Station Subsystem (BSS)

Base Transceiver Station (BTS):

Encodes,encrypts,multiplexes,modulates and feeds the RF signals to the antenna.

Frequency hopping Communicates with Mobile station and BSC Consists of Transceivers (TRX) units

System ArchitectureBase Station Subsystem (BSS)

Base Station Controller (BSC)

Manages Radio resources for BTS Assigns Frequency and time slots for all MS’s in its area Handles call set up Transcoding and rate adaptation functionality Handover for each MS Radio Power control It communicates with MSC and BTS

System ArchitectureNetwork Switching Subsystem(NSS)

Mobile Switching Center (MSC)

Heart of the network Manages communication between GSM and other networks Call setup function and basic switching Call routing Billing information and collection Mobility management

- Registration- Location Updating- Inter BSS and inter MSC call handoff

MSC does gateway function while its customer roams to other network by using HLR/VLR.

System ArchitectureNetwork Switching Subsystem

Home Location Registers (HLR)

- permanent database about mobile subscribers in a large service area(generally one per GSM network operator)

- database contains IMSI,MSISDN,prepaid/postpaid,roaming restrictions,supplementary services.

Visitor Location Registers (VLR)

- Temporary database which updates whenever new MS enters its area, by HLR database

- Controls those mobiles roaming in its area - Reduces number of queries to HLR - Database contains IMSI,TMSI,MSISDN,MSRN,Location

Area,authentication key

System ArchitectureNetwork Switching Subsystem

Authentication Center (AUC) - Protects against intruders in air interface- Maintains authentication keys and algorithms and

provides security triplets ( RAND,SRES,Kc)- Generally associated with HLR

Equipment Identity Register (EIR)- Database that is used to track handsets using the IMEI

(International Mobile Equipment Identity)- Made up of three sub-classes: The White List, The Black

List and the Gray List- Only one EIR per PLMN

GSM Specifications-1

RF SpectrumGSM 900 Mobile to BTS (uplink): 890-915 Mhz BTS to Mobile(downlink):935-960 Mhz Bandwidth : 2* 25 Mhz

GSM 1800 Mobile to BTS (uplink): 1710-1785 Mhz BTS to Mobile(downlink) 1805-1880 Mhz Bandwidth : 2* 75 Mhz

GSM Specification-II

Carrier Separation : 200 Khz Duplex Distance : 45 Mhz No. of RF carriers : 124 Access Method : TDMA/FDMA Modulation Method : GMSK Modulation data rate : 270.833 Kbps

GSM OperationSpeech decoding

Channel decoding

De-interleaving

Burst Formatting

De-ciphering

DemodulationModulation

Ciphering

Burst Formatting

Interleaving

Channel Coding

Speech coding

Radio Interface

Speech Speech

13 Kbps

22.8 Kbps

22.8 Kbps

33.6 Kbps

33.6 Kbps

270.83 Kbps

Call Routing

Call Originating from MS Call termination to MS

Outgoing Call

1. MS sends dialled number to BSS 2. BSS sends dialled number to

MSC3,4 MSC checks VLR if MS is

allowed the requested service.If so,MSC asks BSS to allocate resources for call.

5 MSC routes the call to GMSC6 GMSC routes the call to local

exchange of called user7, 8,9,10 Answer back(ring back) tone is

routed from called user to MS via GMSC,MSC,BSS

Incoming Call

1. Calling a GSM subscribers2. Forwarding call to GSMC3. Signal Setup to HLR4. 5. Request MSRN from VLR6. Forward responsible MSC to

GMSC7. Forward Call to current MSC8. 9. Get current status of MS10.11. Paging of MS12.13. MS answers14.15. Security checks16.17. Set up connection

Handovers

Between 1 and 2 – Inter BTS / Intra BSC

Between 1 and 3 –

Inter BSC/ Intra MSC Between 1 and 4 –

Inter MSC

Security in GSM

On air interface, GSM uses encryption and TMSI instead of IMSI.

SIM is provided 4-8 digit PIN to validate the ownership of SIM 3 algorithms are specified :

- A3 algorithm for authentication

- A5 algorithm for encryption

- A8 algorithm for key generation

Authentication in GSM

Key generation and Encryption

Characteristics of GSM Standard

Fully digital system using 900,1800 MHz frequency band. TDMA over radio carriers(200 KHz carrier spacing. 8 full rate or 16 half rate TDMA channels per carrier. User/terminal authentication for fraud control. Encryption of speech and data transmission over the radio

path. Full international roaming capability. Low speed data services (upto 9.6 Kb/s). Compatibility with ISDN. Support of Short Message Service (SMS).

Advantages of GSM over Analog system

Capacity increases Reduced RF transmission power and longer battery life. International roaming capability. Better security against fraud (through terminal validation and

user authentication). Encryption capability for information security and privacy. Compatibility with ISDN,leading to wider range of services

GSM Applications

Mobile telephony GSM-R Telemetry System

- Fleet management

- Automatic meter reading

- Toll Collection

- Remote control and fault reporting of DG sets Value Added Services

Future Of GSM

2nd Generation GSM -9.6 Kbps (data rate)

2.5 Generation ( Future of GSM) HSCSD (High Speed ckt Switched data)

Data rate : 76.8 Kbps (9.6 x 8 kbps) GPRS (General Packet Radio service)

Data rate: 14.4 - 115.2 Kbps EDGE (Enhanced data rate for GSM Evolution)

Data rate: 547.2 Kbps (max)

3 Generation WCDMA(Wide band CDMA)

Data rate : 0.348 – 2.0 Mbps

Questions ?