Telecommunication Systems

Slides:



Advertisements
Similar presentations
Introduction to Public Land Mobile Network (PLMN)
Advertisements

GSM infrastructure MSC, BSC, BTS, VLR, HLR, GSGN, GSSN
Mario Čagalj University of Split 2013/2014. Security of Cellular Networks: Man-in-the Middle Attacks ‘Security in the GSM system’ by Jeremy Quirke, 2004.
GSM Network. GSM-Introduction Architecture Technical Specifications Frame Structure Channels Security Characteristics and features Applications Contents.
GSM Adapted from Acoe 422. History of GSM  During the 80s, analog cellular systems experienced rapid growth in Europe, yet they were incompatible.
By Neha choudhary Asst.Professor CSE/IT LHST-A.  GSM-Introduction  Architecture  Technical Specifications  Characteristics and features  Applications.
GSM standard (continued)
Modes Mobile Station ( MS )
Wireless Telecommunication Systems Lec 04 14/03/2010 ECOM 6320.
Cellular Mobile Communication Systems Lecture 7
Mobile Handset Cellular Network Basics + GSM. Cellular Network Basics There are many types of cellular services; before delving into details, focus on.
MOBILE PHONE ARCHITECTURE & TECHNOLOGY. HISTORY  The idea of the first cellular network was brainstormed in 1947  Disadvantages  All the analogue system.
TEL 355: Communication and Information Systems in Organizations
 The GSM network is divided into two systems. each of these systems are comprised of a number of functional units which are individual components of the.
GSM: Overview Formerly: Groupe Spéciale Mobile (founded 1982) Now: Global System for Mobile Communication Pan-European standard (ETSI, European Telecommunications.
GSM Continued.
Wireless Telecommunication System. Contd.. AMPS: Advanced Mobile Phone System DECT: Digital Enhanced Cordless Telephone NMT : Nordic Mobile Telephone.
 Global System for Mobile Communications (GSM) is a second generation (2G) cellular standard developed to cater voice services and data delivery using.
GSM: The European Standard for Mobile Telephony Presented by Rattan Muradia Requirement for course CSI 5171 Presented by Rattan Muradia Requirement for.
GSM,GPRS & CDMA Technology
Cellular Mobile Communication Systems Lecture 8
Yschen, CSIE, CCU1 Chapter 9: Existing Wireless Systems: 2G, GSM System Associate Prof. Yuh-Shyan Chen Dept. of Computer Science and Information Engineering.
GSM – formerly: Groupe Spéciale Mobile (founded 1982) – now: Global System for Mobile Communication – Pan-European standard (ETSI, European Telecommunications.
GSM Mobile Computing IT644.
4.1 Architecture of the GSM system GSM is a PLMN (Public Land Mobile Network) – several providers setup mobile networks following the GSM standard within.
Communication Protocol Engineering Lab. Hyoung Joo. Nam. 1 GSM System Overview Wireless and Mobile Network Architecture Nam Hyoung-Joo
C OMMUNICATION S ECURITY L ECTURE 4: I NTRODUCTION T O GSM Dr. Shahriar Bijani Shahed University Spring 2016.
1 Lecture 19 EEE 441 Wireless And Mobile Communications.
GLOBAL SYSTEM FOR MOBILE COMMUNICATION
1 Lecture 20 EEE 441 Wireless And Mobile Communications.
Mobile Communications: Wireless Telecommunication Systems  Market  GSM  Overview  Services  Sub-systems  Components.
Bitwali1 Wireless Communication Introduction to Mobile Communication and Cellular System Lecture 3-4.
9 Transmission and Switching Mohamed Ashour, German University in Cairo Mohamed Ashour Lecture Fall 2011 AC = authentication center BSS = base station.
Mobile Communications Chapter 4: Wireless Telecommunication Systems
Overview of the GSM for Cellular System
IT351: Mobile & Wireless Computing
Communication Security Lecture 4: Introduction To GSM
Wireless Network PMIT- By-
GLOBAL SYSTEM FOR MOBILE COMMUNICATION
Cellular Networks Wireless Transmission Cellular Concept
GSM Training for Professionals
3G architecture and protocols
Third Generation (3G) Cellular Network 3G System
Global System for Mobile Communications
GSM SECURITY AND ENCRYPTION
GSM,GPRS & CDMA Technology
CALL & MOBILITY MANAGEMENT
GSM.
Mobile Communications
Mobile Computing Chapter 3 : Telecommunication Systems (Part I)
Coding Methods in CDMA.
Unit II Mobile Communication Systems
Name:Shivalila A H,Shima
GSM (GLOBAL SYSTEM FOR MOBILE COMMUNICATION). It all started like this First telephone (photophone) – Alexander Bell, 1880 First telephone (photophone)
Subject Name: GSM Subject Code: 10EC843
GPRS GPRS stands for General Packet Radio System. GPRS provides packet radio access for mobile Global System for Mobile Communications (GSM) and time-division.
Prepared By: GOPIKA D K/SHRUTHI N Department: ECE Date:
CSE 4215/5431: Mobile Communications Winter 2010
Subject Name : Wireless Communication Subject Code:10EC81
Mobile Communications Chapter 3 : Media Access
Introduction to GSM: Mobile Phone Subscribers Worldwide
Global system for Mobile Communications
GLOBAL SYSTEM FOR MOBILE COMMUNICATION (GSM) ARCHITECTURE Vivek E.B.
Chapter 7 The 2nd Generation Cellular Systems
Master in progettista di servizi radiomobili Web Based Overview
GPRS Architecture Ayan Ganguly Bishakha Roy Akash Dutta.
Mario Čagalj University of Split 2013/2014. Security of Cellular Networks: Man-in-the Middle Attacks ‘Security in the GSM system’ by Jeremy Quirke, 2004.
Mobile Computing Chapter 3 : Telecommunication Systems (Part I)
Dept. of Business Administration
GSM Architecture.
Presentation transcript:

Telecommunication Systems

Mobile phone subscribers worldwide Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Mobile phone subscribers worldwide approx. 1.7 bn 1600 2009: >4 bn 2013: >6 bn! 1400 1200 GSM total 1000 TDMA total CDMA total Subscribers [million] 800 PDC total Analogue total W-CDMA 600 Total wireless Prediction (1998) 400 200 1996 1997 1998 1999 2000 2001 2002 2003 2004 year Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Development of mobile telecommunication systems Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Development of mobile telecommunication systems CT0/1 FDMA AMPS CT2 NMT IMT-FT DECT IS-136 TDMA D-AMPS EDGE IMT-SC IS-136HS UWC-136 TDMA GSM GPRS PDC IMT-DS UTRA FDD / W-CDMA HSPA IMT-TC UTRA TDD / TD-CDMA CDMA IMT-TC TD-SCDMA IS-95 cdmaOne IMT-MC cdma2000 1X EV-DO cdma2000 1X 1X EV-DV (3X) 1G 2G 2.5G 3G Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM: Overview GSM formerly: Groupe Spéciale Mobile (founded 1982) now: Global System for Mobile Communication Today many providers all over the world use GSM (219 countries in Asia, Africa, Europe, Australia, America) more than 4.2 billion subscribers in more than 700 networks more than 75% of all digital mobile phones use GSM over 29 billion SMS in Germany in 2008, (> 10% of the revenues for many operators) [be aware: these are only rough numbers…] Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM: Mobile Services GSM offers several types of connections voice connections, data connections, short message service multi-service options (combination of basic services) Three service domains Bearer Services Tele Services Supplementary Services bearer services MS GSM-PLMN transit network (PSTN, ISDN) source/ destination network TE MT TE R, S Um (U, S, R) tele services Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Bearer Services Telecommunication services to transfer data between access points Specification of services up to the terminal interface (OSI layers 1-3) Different data rates for voice and data (original standard) data service (circuit switched) synchronous: 2.4, 4.8 or 9.6 kbit/s asynchronous: 300 - 1200 bit/s data service (packet switched) asynchronous: 300 - 9600 bit/s Today: data rates of approx. 50 kbit/s possible – will be covered later! (even more with new modulation) Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Tele Services Telecommunication services that enable voice communication via mobile phones Offered services Telephonic-Voice FAX, SMS, MMS, Email Emergency number common number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible) Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Supplementary services Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Supplementary services Services in addition to the basic services, cannot be offered stand-alone May differ between different service providers, countries and protocol versions Important services Call forwarding, caller line identification Call holding, barring calls from specified numbers Providing information regarding call charges, remaining balance automatic call-back conferencing with up to 7 participants locking of the mobile terminal (incoming or outgoing calls) ... Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Architecture of the GSM system Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Architecture of the GSM system GSM is a PLMN (Public Land Mobile Network) several providers setup mobile networks following the GSM standard within each country components MS (mobile station) BS (base station) MSC (mobile switching center) LR (location register) subsystems RSS (radio subsystem): covers all radio aspects NSS (network and switching subsystem): call forwarding, handover, switching OSS (operation subsystem): management of the network Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Ingredients 1: Mobile Phones, PDAs & Co. The visible but smallest part of the network!

Ingredients 2: Antennas Still visible – cause many discussions…

Ingredients 3: Infrastructure 1 Base Stations Cabling Microwave links

Ingredients 3: Infrastructure 2 Not „visible“, but comprise the major part of the network (also from an investment point of view…) Management Data bases Switching units Monitoring

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM: overview OMC, EIR, AUC fixed network HLR GMSC NSS with OSS VLR MSC VLR MSC BSC BSC RSS Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GSM: elements and interfaces Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM: elements and interfaces radio cell BSS MS MS Um radio cell MS RSS BTS BTS Abis BSC BSC A MSC MSC NSS VLR VLR Signaling system no. 7 HLR ISDN, PSTN GMSC PDN IWF O OSS EIR AUC OMC Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GSM: system architecture Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM: system architecture radio subsystem network and switching subsystem fixed partner networks MS MS ISDN PSTN Um MSC Abis BTS BSC EIR BTS SS7 HLR VLR BTS BSC ISDN PSTN BTS A MSC BSS IWF PSPDN CSPDN Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

System architecture: radio subsystem Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 System architecture: radio subsystem radio subsystem network and switching subsystem Components MS (Mobile Station) BSS (Base Station Subsystem): consisting of BTS (Base Transceiver Station): sender and receiver BSC (Base Station Controller): controlling several transceivers Interfaces Um : radio interface Abis : standardized, open interface with 16 kbit/s user channels A: standardized, open interface with 64 kbit/s user channels MS MS Um Abis BTS BSC MSC BTS A BTS MSC BSC BTS BSS Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

System architecture: network and switching subsystem Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 System architecture: network and switching subsystem network subsystem fixed partner networks Components MSC (Mobile Services Switching Center): IWF (Interworking Functions) ISDN (Integrated Services Digital Network) PSTN (Public Switched Telephone Network) PSPDN (Packet Switched Public Data Net.) CSPDN (Circuit Switched Public Data Net.) Databases HLR (Home Location Register) VLR (Visitor Location Register) EIR (Equipment Identity Register) ISDN PSTN MSC EIR SS7 HLR VLR ISDN PSTN MSC IWF PSPDN CSPDN Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Radio subsystem The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers Components Base Station Subsystem (BSS): Base Transceiver Station (BTS): radio components including sender, receiver, antenna - if directed antennas are used one BTS can cover several cells Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (Um) onto terrestrial channels (A interface) BSS = BSC + sum(BTS) + interconnection Mobile Stations (MS) Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik GSM: cellular network Mobilkommunikation SS 1998 segmentation of the area into cells cell possible radio coverage of the cell idealized shape of the cell use of several carrier frequencies not the same frequency in adjoining cells cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) if a mobile user changes cells handover of the connection to the neighbor cell Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GSM frequency bands (examples) Type Channels Uplink [MHz] Downlink [MHz] GSM 850 128-251 824-849 869-894 GSM 900 classical extended 0-124, 955-1023 124 channels +49 channels 876-915 890-915 880-915 921-960 935-960 925-960 GSM 1800 512-885 1710-1785 1805-1880 GSM 1900 512-810 1850-1910 1930-1990 GSM-R exclusive 955-1024, 0-124 69 channels 876-880 921-925 Additionally: GSM 400 (also named GSM 450 or GSM 480 at 450-458/460-468 or 479-486/489-496 MHz) Please note: frequency ranges may vary depending on the country! Channels at the lower/upper edge of a frequency band are typically not used

Example coverage of GSM networks (www.gsmworld.com) Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Example coverage of GSM networks (www.gsmworld.com) T-Mobile (GSM-900/1800) Germany O2 (GSM-1800) Germany AT&T (GSM-850/1900) USA Vodacom (GSM-900) South Africa Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Base Transceiver Station and Base Station Controller Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Base Transceiver Station and Base Station Controller Tasks of a BSS are distributed over BSC and BTS BTS comprises radio specific functions BSC is the switching center for radio channels Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Mobile station Terminal for the use of GSM services A mobile station (MS) comprises several functional groups MT (Mobile Terminal): offers common functions used by all services the MS offers corresponds to the network termination (NT) of an ISDN access end-point of the radio interface (Um) TA (Terminal Adapter): terminal adaptation, hides radio specific characteristics TE (Terminal Equipment): peripheral device of the MS, offers services to a user does not contain GSM specific functions SIM (Subscriber Identity Module): personalization of the mobile terminal, stores user parameters R S Um TE TA MT Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Network and switching subsystem Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Network and switching subsystem NSS is the main component of the public mobile network GSM switching, mobility management, interconnection to other networks, system control Components Mobile Services Switching Center (MSC) controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC Databases (important: scalability, high capacity, low delay) Home Location Register (HLR) central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs) Visitor Location Register (VLR) local database for a subset of user data, including data about all user currently in the domain of the VLR Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Mobile Services Switching Center Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Mobile Services Switching Center The MSC (mobile services switching center) plays a central role in GSM switching functions additional functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) integration of several databases Functions of a MSC specific functions for paging and call forwarding termination of SS7 (signaling system no. 7) mobility specific signaling location registration and forwarding of location information provision of new services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing information Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Operation subsystem The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems Components Authentication Center (AUC) generates user specific authentication parameters on request of a VLR authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system Equipment Identity Register (EIR) registers GSM mobile stations and user rights stolen or malfunctioning mobile stations can be locked and sometimes even localized Operation and Maintenance Center (OMC) different control capabilities for the radio subsystem and the network subsystem Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

List of mobile network operators http://en.wikipedia.org/wiki/List_of_mobile_network_operators

Localization and calling Automatic, worldwide localization of users Roaming - Changing VLRs with uninterrupted availability of all services GSM – one device, over 190 countries

To locate an MS and to address the MS, we need Mobile station international ISDN number(MSISDN) (e.g. +91 944 1234567) Country code 91 , national destination code 944 (address of the network provider), 1234567 subscriber number International mobile subscriber identity (IMSI) - internal unique identification of a subscriber - Mobile country code, mobile network code, mobile subscriber identification number Temporary mobile subscriber identity (TMSI) - 4 byte number selected by VLR Mobile station roaming number (MSRN) VLR generates this address on request from the MSC and the address is stored in HLR Visitor country code, Visitor national destination code, identification of current MSC with subscriber number

Difference between IMSI and MSISDN IMSI is used to identify a subscriber by the operator. MSISDN is the number which is used for dialing. When you call your friend/a mobile, you call the MSISDN number of the mobile, not the IMSI. For Eg: Consider 2 subscriber's A & B. IMSI (A) : 987123111111111 IMSI (B) : 987124111111111 MSISDN (A) : 9448012121 MSISDN (B) : 9448121212 When A would like to call B, A dials the MSISDN number of B, i.e, 9448121212. And same is true for vice-versa. Whereas IMSI is used to identify and authenticate the subscriber with the network

Mobile Terminated Call Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Mobile Terminated Call 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR 6: forward responsible MSC to GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection 4 HLR VLR 5 8 9 3 6 14 15 PSTN 7 calling station GMSC MSC 1 2 10 13 10 10 16 BSS BSS BSS 11 11 11 11 12 17 MS Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Mobile Originated Call Universität Karlsruhe Institut für Telematik Mobile Originated Call Mobilkommunikation SS 1998 1, 2: connection request 3, 4: security check 5-8: check resources (free circuit) 9-10: set up call VLR 3 4 PSTN 6 5 GMSC MSC 7 8 2 9 1 MS BSS 10 Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 MTC/MOC BTS MS paging request channel request immediate assignment paging response authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange service request MTC MOC Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Handover Reasons for a handover MS moves out of the range of a BTS MSC and BSC may decide that the traffic in one cell is too high and shift some MS to other cells

Handover process Important one in any cellular network Must be completed efficiently and without inconvenience to the user Different networks use different types of handover techniques

Two main types of handover Hard handover─ GSM systems Soft handover ─ CDMA systems

Hard Handover Existing radio link must be dropped for a small period of time Then taken over by another base station A call in progress redirected not only from a base station to another base station but also from its current transmit–receive frequency pair to another frequency pair An ongoing call can not exchange data or voice for this duration

Hard Handover Break in call transmission Handover takes place in a few ms (at best in 60 ms) Interruption is hardly discernible by the user Handover to another cell is required when the signal strength is low and error rate is high. GSM systems perform hard handovers

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 4 types of handover 1 2 3 4 MS MS MS MS BTS BTS BTS BTS BSC BSC BSC Intra-cell handover Inter-cell, Intra-BSC handover Inter-BSC, Intra-MSC handover Inter MSC handover MSC MSC Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Intra-cell Handover Due to interference at certain frequencies, the signal quality poor The BSC can handover the call to another frequency of the cell in such cases

Inter-cell, Intra-BSC Handover When an MS moves to a neighbouring cell and suffers poor signal quality, the BSC can handover the call to a different BTS channel of the same BSC

Inter-BSC, Intra MSC Handover Handover for load balancing when the traffic from the cells and BTSs high The BSCs connect to an MSC A call, which is ongoing in a cell through a BTS, may be handed over to another BSC connected to the same MSC Since the BSCs connect to the MSC interfaces by PCM, the handover is over a wired line

Inter-MSC Handover Handover also takes place for load balancing when the traffic from the cells and BSCs high An ongoing call, which is being handled by a cell, may be handed over to another MSC Since the two MSCs are interfaced through PCM the handover performed over a wired line

Soft handover Mobile station at the boundary of two adjacent cells─ does not suffer call drops due to handover in the boundary region Soft handover does not require breaking of the radio link for cell-to-cell transfer of a call. A mobile device can be simultaneously connected to several base stations

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Handover decision receive level BTSold receive level BTSold HO_MARGIN MS MS BTSold BTSnew Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Handover procedure MS BTSold BSCold MSC BSCnew BTSnew measurement report measurement result HO decision HO required HO request resource allocation ch. activation ch. activation ack HO request ack HO command HO command HO command HO access Link establishment HO complete HO complete clear command clear command clear complete clear complete Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

New generation (3G) networks Ensure mobility by handover not only among the BTSs, BSCs, or MSCs but also among the in-between LANs Ensures seamless (uninterrupted) connectivity to the user

GSM networks various security features A wireless radio based network system quite sensitive to the unauthorized use of resources Designed to protect subscriber privacy Secured network against misuse of resources by unregistered users Controlled access to the network by Mobile station Required to use a PIN before it can access the network through Um interface

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Security in GSM Security services access control/authentication user  SIM (Subscriber Identity Module): secret PIN (personal identification number) SIM  network: challenge response method confidentiality voice and signaling encrypted on the wireless link (after successful authentication) anonymity temporary identity TMSI (Temporary Mobile Subscriber Identity) newly assigned at each new location update (LUP) encrypted transmission Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Security Algorithms 3 algorithms specified in GSM A3 for authentication (“secret”, open interface) A5 for encryption (standardized) A8 for key generation (“secret”, open interface)

Authentication Algorithm The AuC first authenticates the subscriber Mobile station and only then does the MSC provide the switching service to another terminal TE, which is also authenticated in case it is a Mobile station. Use a random number sent by the AuC during the connection set up An authentication key which is already saved in the SIM Authentication algorithm used differs for different mobile service providers

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM - authentication SIM mobile network RAND Ki RAND RAND Ki 128 bit 128 bit 128 bit 128 bit AC A3 A3 SIM SRES* 32 bit SRES 32 bit SRES* =? SRES SRES MSC SRES 32 bit Ki: individual subscriber authentication key SRES: signed response Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Encryption The BTS and the Mobile station perform ciphering before call initiation or before connecting for receiving a call The Mobile station uses a cipher (encryption key) for encryption Only encrypted voice and data traffic and control channel data transmit to the BTS

GSM - key generation and encryption Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM - key generation and encryption mobile network (BTS) MS with SIM RAND Ki RAND RAND Ki AC SIM 128 bit 128 bit 128 bit 128 bit A8 A8 cipher key Kc 64 bit Kc 64 bit data encrypted data SRES data BSS MS A5 A5 Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Radio Interface Um Radio interface SDMA – Each cell (BTS) Assigns an MS to a BTS Media access combines TDMA with FDMA

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM - TDMA/FDMA 935-960 MHz 124 channels (200 kHz) downlink frequency 890-915 MHz 124 channels (200 kHz) uplink higher GSM frame structures time GSM TDMA frame 1 2 3 4 5 6 7 8 4.615 ms GSM time-slot (normal burst) guard space guard space tail user data S Training S user data tail 3 bits 57 bits 1 26 bits 1 57 bits 3 546.5 µs 577 µs Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Logical channel Traffic Channel – Transmit user data Traffic Channel(TCH) Control Channel (CCH) Dedicated Control Channel (DCCCH) Full rate TCH (TCH/F) 22.8 Kbit/s Half rate TCH (TCH/H) 11.4 Kbit/s Common Control Channel (CCCH) Broadcast Control Channel (BCCH) Access Grant Channel (AGCH) Paging Channel(PCH) Slow Associated DCCCH (SACCH) Frequency Correction Channel (FCCH) Synchronization Channel (SCH) Random Access Channel (RACH) Traffic Channel – Transmit user data Control channel – control Medium access, Allocation of traffic channel and mobility management DCCCH – Bidirectional channel Standalone Dedicated Control channel (SDCCH) Fast Associated DCCCH (FACCH)

GSM hierarchy of frames Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM hierarchy of frames hyperframe 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s superframe 1 2 ... 48 49 50 6.12 s 1 ... 24 25 multiframe 1 ... 24 25 120 ms 1 2 ... 48 49 50 235.4 ms frame 1 ... 6 7 4.615 ms slot burst 577 µs TTTTTTTTTTTTSTTTTTTTTTTTTx Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GSM protocol layers for signaling Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GSM protocol layers for signaling Um Abis A MS BTS BSC MSC CM CM MM MM RR’ BTSM BSSAP RR BSSAP RR’ BTSM SS7 SS7 LAPDm LAPDm LAPD LAPD radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / 2.048 Mbit/s LAPD – Link access procedure for the D channel RR – Radio resource Management MM – Mobility management CC – Call management BTSM – BTS management BSSAP – BSS Application Part Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Data services in GSM I Data transmission standardized with only 9.6 kbit/s advanced coding allows 14.4 kbit/s not enough for Internet and multimedia applications HSCSD (High-Speed Circuit Switched Data) mainly software update bundling of several time-slots to get higher AIUR (Air Interface User Rate, e.g., 57.6 kbit/s using 4 slots @ 14.4) advantage: ready to use, constant quality, simple disadvantage: channels blocked for voice transmission Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Data services in GSM II GPRS (General Packet Radio Service) packet switching using free slots only if data packets ready to send (e.g., 50 kbit/s using 4 slots temporarily) standardization 1998, introduction 2001 advantage: one step towards UMTS, more flexible disadvantage: more investment needed (new hardware) GPRS network elements GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN) interworking unit between GPRS and PDN (Packet Data Network) SGSN (Serving GSN) supports the MS (location, billing, security) GR (GPRS Register) user addresses Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

Examples for GPRS device classes Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 Examples for GPRS device classes Class Receiving slots Sending slots Maximum number of slots 1 2 3 5 4 8 10 12 Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GPRS user data rates in kbit/s Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GPRS user data rates in kbit/s Coding scheme 1 slot 2 slots 3 slots 4 slots 5 slots 6 slots 7 slots 8 slots CS-1 9.05 18.1 27.15 36.2 45.25 54.3 63.35 72.4 CS-2 13.4 26.8 40.2 53.6 67 80.4 93.8 107.2 CS-3 15.6 31.2 46.8 62.4 78 93.6 109.2 124.8 CS-4 21.4 42.8 64.2 85.6 107 128.4 149.8 171.2 Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GPRS architecture and interfaces Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GPRS architecture and interfaces MS BSS GGSN SGSN MSC Um EIR HLR/ GR VLR PDN Gb Gn Gi Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller

GPRS protocol architecture Universität Karlsruhe Institut für Telematik Mobilkommunikation SS 1998 GPRS protocol architecture MS BSS SGSN GGSN Um Gb Gn Gi apps. IP/X.25 IP/X.25 SNDCP SNDCP GTP GTP LLC LLC UDP/TCP UDP/TCP RLC RLC BSSGP BSSGP IP IP MAC MAC FR FR L1/L2 L1/L2 radio radio Prof. Dr. Dr. h.c. G. Krüger E. Dorner / Dr. J. Schiller