1. Global System for Mobile Communication (GSM)
Also known as: "Global System for Mobile Communications", "Groupe Special Mobile" to describe protocols for second generation (2G) digital cellular networks circuit-switched network optimized for full duplex voice telephony. It is used by mobile phones and a replacement for first generation (1G) analog cellular networks.
GSM is a TDMA based wireless network technology developed in Europe that is used throughout most of the world.
GSM phones make use of a SIM card to identify the user's account. The use of the SIM card allows GSM network users to quickly move their phone number from one GSM phone to another by simply moving the SIM card.
Currently GSM networks operate on the 850MHz, 900MHz, 1800MHz, and 1900MHz frequency bands.

2. Global System for Mobile Communication (GSM)
Why GSM?
The GSM study group aimed to provide the followings through the GSM:
Improved spectrum efficiency.
International roaming.
Low-cost mobile sets and base stations (BSs).
High-quality speech.
Compatibility with Integrated Services Digital Network (ISDN) and other telephone company services.
Support for new service

3. GSM characteristics
previous standard in cellular communication were restrictive
GSM – global digital standard for cellular phones that offered roaming facility
first named Groupe Special Mobile and used in Europe; then usage extended to other continents
GSM operate in frequency bands: 900MHz, 1800 MHz, 1900 MHz
GSM provides voice and data services

4. The GSM Architecture SIM Subscriber Identity Module
HLR Home Location Register
MS Mobile Station VLR Visitor Location Register
BTS Base Transceiver Station EIR Equipment Identity Register
BSC Base Station Controller
AC Authentication Centre
MSC Mobile services Switching Centre PSTN Public Switched Telecomm Network
VLR Visitor Location Register ISDN Integrated Services Digital Network
PLMN Public land mobile Network

5. The GSM Architecture

6. The GSM Architecture-Working
The GSM network can be divided into three broad parts.
The Mobile Station is carried by the subscriber.
Base Station Subsystem controls the radio link with the Mobile Station.  
The Network Subsystem, the main part of which is the Mobile services Switching Center, performs the switching of calls between the mobile and other fixed or mobile network users, as well as management of mobile services, such as authentication. 
The Mobile Station and the Base Station Subsystem communicate across the Um interface, also known as the air interface or radio link.  
The Base Station Subsystem communicates with the Mobile service Switching Center across the A interface.

7. Subscriber Identity Module (SIM) card
SIM – a memory card (integrated circuit) holding identity information, phone book etc.
GSM system support SIM cards
other systems, like CDMA do not support SIM cards, but have something similar called Re-Usable Identification Module (RUIM)

8. International Mobile Equipment Identity (IMEI) key
IMEI – a unique 15 digit number identifying each phone, is incorporated in the cellular phone by the manufacturer
IMEI ex.:
when a phone tries to access a network, the service provider verifies its IMEI with a database of stolen phone numbers; if it is found in the database, the service provider denies the connection
the IMEI is located on a white sticker/label under the battery, but it can also be displayed by typing *#06# on the phone

9. International Mobile Subscriber Identity (IMSI) key
IMSI – a 15-digit unique number provided by the service provider and incorporated in the SIM card which identifies the subscriber
IMSI enables a service provider to link a phone number with a subscriber
first 3 digits of the IMSI are the country code

10. Temporary Mobile Subscriber Identity (TMSI) key
TMSI – is a temporary number, shorter than the IMSI, assigned by the service provider to the phone on a temporary basis
TMSI key identifies the phone and its owner in the cell it is located; when the phone moves to a different cell it gets a new TMSI key
as TMSI keys are shorter than IMSI keys they are more efficient to send
TMSI key are used for securing GSM networks

11. HLR, VLR and EIR registers
Home Location Register (HLR) - is a database maintained by the service provider containing permanent data about each subscriber (i.e. location, activity status, account status, call forwarding preference, caller identification preference)
Visitor Location Register (VLR) – database that stores temporary data about a subscriber; it is kept in the MSC of the of the area the subscriber is located in; when the subscriber moves to a new area the new MSC requests this VLR from the HLR of the old MSC
Equipment Identity Register (EIR) – database located near the MSC and containing information identifying cell phones

12. Authentication Center (AuC)
1st level security mechanism for a GSM cellular network
is a database that stores the list of authorized subscribers of a GSM network
it is linked to the MSC and checks the identity of each user trying to connect
also provides encryption parameters to secure a call made in the network

13. Mobile Station
The mobile station (MS) consists of the physical equipment, such as the radio transceiver, display and digital signal processors, and a smart card called the Subscriber Identity Module (SIM). The SIM provides personal mobility, so that the user can have access to all subscribed services irrespective of both the location of the terminal and the use of a specific terminal. By inserting the SIM card into another GSM cellular phone, the user is able to receive calls at that phone, make calls from that phone, or receive other subscribed services.
The mobile equipment is uniquely identified by the International Mobile Equipment Identity (IMEI). The SIM card contains the International Mobile Subscriber Identity (IMSI), identifying the subscriber, a secret key for authentication, and other user information. The IMEI and the IMSI are independent, thereby providing personal mobility. The SIM card may be protected against unauthorized use by a password or personal identity number.

14. Base Station Subsystem
The Base Station Subsystem is composed of two parts, the Base Transceiver Station (BTS) and the Base Station Controller (BSC). These communicate across the specified bits interface, allowing (as in the rest of the system) operation between components made by different suppliers.
The Base Transceiver Station houses the radio transceivers that define a cell and handles the radio-link protocols with the Mobile Station. In a large urban area, there will potentially be a large number of BTSs deployed. The requirements for a BTS are ruggedness, reliability, portability, and minimum cost.
The Base Station Controller manages the radio resources for one or more BTSs. It handles radio-channel setup, frequency hopping, and handovers, as described below. The BSC is the connection between the mobile and the Mobile service Switching Centre (MSC).

15. Network Substation
The central component of the Network Subsystem is the Mobile services Switching Centre (MSC). It acts like a normal switching node of the PSTN or ISDN, and in addition provides all the functionality needed to handle a mobile subscriber, such as registration, authentication, location updating, handovers, and call routing to a roaming subscriber. These services are provided in conjunction with several functional entities, which together form the Network Subsystem. The MSC provides the connection to the public fixed network (PSTN or ISDN), and signalling between functional entities uses the ITU Signalling System Number 7 (SS7), used in ISDN and widely used in current public networks.

16. Network Substation (Cont..)
The Home Location Register (HLR) and Visitor Location Register (VLR), together with the MSC, provide the call routing and (possibly international) roaming capabilities of GSM. The HLR contains all the administrative information of each subscriber registered in the corresponding GSM network, along with the current location of the mobile. The current location of the mobile is in the form of a Mobile Station Roaming Number (MSRN) which is a regular ISDN number used to route a call to the MSC where the mobile is currently located. There is logically one HLR per GSM network, although it may be implemented as a distributed database.

17. Network Substation (Cont..)
The Visitor Location Register contains selected administrative information from the HLR, necessary for call control and provision of the subscribed services, for each mobile currently located in the geographical area controlled by the VLR. Although each functional entity can be implemented as an independent unit, most manufacturers of switching equipment implement one VLR together with one MSC, so that the geographical area controlled by the MSC corresponds to that controlled by the VLR, simplifying the signalling required. Note that the MSC contains no information about particular mobile stations - this information is stored in the location registers.

18. GSM Access Scheme and Channel Structure
GSM uses FDMA and TDMA to transmit voice and data
the uplink channel between the cell phone and the BTS uses FDMA and a specific frequency band
the downlink channel between the BTS and the cell phone uses a different frequency band and the TDMA technique
there is sufficient frequency separation between the uplink freq. band and the downlink freq. band to avoid interference
each uplink and downlink frequency bands is further split up as Control Channel (used to set up and manage calls) and Traffic Channel (used to carry voice)

19. GSM uplink/downlink frequency bands used
GSM Frequency band
Uplink/BTS Transmit
Downlink/BTS Receive
900 MHz
MHz
MHz
1800 MHz
MHz
MHz
1900 MHz
MHz
MHz

20. GSM uplink/downlink frequency bands
uplink and downlink take place in different time slots using TDMA
uplink and downlink channels have a bandwidth of 25 MHz
these channels are further split up in a 124 carrier frequencies (1 control channels and the rest as traffic channels); each carrier frequency is spaced 200 KHz apart to avoid interference
these carrier frequencies are further devided by time using TDMA and each time slot lasts for ms.

21. GSM Control Channel
is used to communicate management data (setting up calls, location) between BTS and the cell phone within a GSM cell
only data is exchanged through the control channel (no voice)
a specific frequency from the frequency band allocated to a cell and a specific time slot are allocated for the control channel (beacon frequency); a single control channel for a cell
GSM control channels can have the following types:
broadcast channel
common control channel
dedicated control channel

22. Broadcast Channel
type of control channel used for the initial synchronization between the cell phone and the BTS
is composed from:
Frequency Correction Channel (FCCH) – is composed from a sequence of 148 zeros transmitted by the BTS
Synchronization Channel (SCH) – follows the FCCH and contains BTS identification and location information
Broadcast Control Channel (BCCH) – contains the frequency allocation information used by cell phones to adjust their frequency to that of the network; is continuously broadcasted by the BTS

23. Common Control Channels
type of control chan. used for call initiation
is composed of:
Paging Channel (PCH) – the BTS uses this channel to inform the cell phone about an incoming call; the cell phone periodically monitors this channel
Random Access Channel (RACH) – is an uplink channel used by the cell phone to initiate a call; the cell phone uses this channel only when required; if 2 phones try to access the RACH at the same time, they cause interference and will wait a random time before they try again; once a cell phone correctly accesses the RACH, BTS send an acknowledgement
Access Grant Channel (AGCH) – channel used to set up a call; once the cell phone has used PCH or RACH to receive or initiate a call, it uses AGCH to communicate to the BTS

24. Initializing a call
1. when the cell phone is turned on it scans all the available frequencies for the control channel
2. all the BTS in the area transmit the FCCH, SCH and BCCH that contain the BTS identification and location
3. out of available beacon frequencies from the neighboring BTSs, the cell phone chooses the strongest signal
4. based on the FCCH of the strongest signal, the cell phone tunes itself to the frequency of the network
5. the phone send a registration request to the BTS
6. the BTS sends this registration request to the MSC via the BSC
7. the MSC queries the AUC and EIR databases and based on the reply it authenticates the cell phone
8. the MSC also queries the HLR and VLR databases to check whether the cell is in its home area or outside
9. if the cell phone is in its home area the MSC gets all the necessary information from the HLR if it is not in its home area, the VLR gets the information from the corresponding HLR via MSCs
10. then the cell phone is ready to receive or make calls.

25. Making a call
1. when thee phone needs to make a call it sends an access request (containing phone identification, number) using RACH to the BTS; if another cell phone tries to send an access request at the same time the messages might get corrupted, in this case both cell phones wait a random time interval before trying to send again
2. then the BTS authenticates the cell phone and sends an acknowledgement to the cell phone
3. the BTS assigns a specific voice channel and time slot to the cell phone and transmits the cell phone request to the MSC via BSC
4. the MSC queries HLR and VLR and based on the information obtained it routes the call to the receiver’s BSC and BTS
5. the cell phone uses the voice channel and time slot assigned to it by the BTS to communicate with the receiver

26. Receiving a call
1. when a request to deliver a call is made in the network, the MSC or the receiver’s home area queries the HLR; if the cell phone is located in its home area the call is transferred to the receiver; if the cell phone is located outside its home area, the HLR maintains a record of the VLR attached to the cell phone
2. based on this record, the MSC notes the location of the VLR and indicated the corresponding BSC about the incoming call
3. the BSC routes the call to the particular BTS which uses the paging channel to alert the phone
4. the receiver cell phone monitors the paging channel periodically and once it receives the call alert from the BTS it responds to the BTS
5. the BTS communicates a channel and a time slot for the cell phone to communicate
6. now the call is established

27. The Air-Interface of GSM
The Air-interface is the central interface of every mobile system and typically the only one to which a customer is exposed. The physical characteristics of the Air-interface are particularly important for the quality and success of a new mobile standard. For some mobile systems, only the Air-interface was specified in the beginning, like IS-95, the standard for CDMA. Although different for GSM, the Air-interface still has received special attention. Considering the small niches of available frequency spectrum for new services, the efficiency of frequency usage plays a crucial part. Such effi-ciency can be expressed as the quotient of transmission rate (kilobits per second) over bandwidth (kilohertz). In other words, how much traffic data can be squeezed into a given frequency spectrum at what cost?

28. The Structure of the Air-Interface in GSM
1.The FDMA/TDMA Scheme

29. 1.The FDMA/TDMA Scheme
GSM utilizes a combination of frequency division multiple access (FDMA) and time division multiple access (TDMA) on the Air-interface. That results in a two-dimensional channel structure, which is presented in Figure . Older standards of mobile systems use only FDMA (an example for such a network is the C-Netz in Germany in the 450 MHz range). In such a pure FDMA system, one specific frequency is allocated for every user during a call. That quickly leads to overload situations in cases of high demand. GSM took into account the overload problem, which caused most mobile communications systems to fail sooner or later, by defining a two-dimensional access scheme. In full rate configuration, eight time slots (TSs) are mapped on every frequency; in a hal-frate configuration there are 16 TSs per frequency.

30. 2. Frame Hierarchy and Frame Numbers
In GSM, every impulse on frequency 1, as shown in Figure, is called a burst. Therefore, every burst shown in Figure corresponds to a TS. Eight bursts or TSs, numbered from 0 through 7, form a TDMA frame. f1
Frequency
T1TDMAframe= f2
Transmitted
Power
Time

31. 2. Frame Hierarchy and Frame Numbers
In a GSM system, every TDMA frame is assigned a fixed number, which repeats itself in a time period of 3 hours, 28 minutes, 53 seconds, and 760 milliseconds. This time period is referred to as hyper frame. Multiform and super frame are layers of hierarchy that lie between the basic TDMA frame and the hyper frame. Figure 7.3 presents the various frame types, their periods, and other details, down to the level of a single burst as the smallest unit.

32. 3. Synchronization Between Uplink and Downlink
For technical reasons, it is necessary that the MS and the BTS do not transmit simultaneously. Therefore, the MS is transmitting three timeslots after the BTS. The time between sending and receiving data is used by the MS to perform various measurements on the signal quality of the receivable neighbor cells.

33. GSM - Protocol Stack
The layered model of the GSM architecture integrates and links the peer-to-peer communications between two different systems. The underlying layers satisfy the services of the upper-layer protocols

34. GSM - Protocol Stack
The signalling protocol in GSM is structured into three general layers, depending on the interface.
Layer 1: The physical layer, which uses the channel structures over the air interface.
Layer 2: The data-link layer. Across the Um interface, the data-link layer is a modified version of the Link access protocol for the D channel (LAP-D) protocol used in ISDN, called Link access protocol on the Dm channel (LAP-Dm). Across the A interface, the Message Transfer Part (MTP), Layer 2 of SS7 is used.
Layer 3: The third layer of the GSM signaling protocol is divided into three sublayers:
Radio Resource management (RR)
Mobility Management (MM) and
Connection Management (CM).

35. The MS to BTS Protocol
The RR layer oversees the establishment of a link, both radio and fixed, between the MS and the MSC. The main functional components involved are the MS, the BSS, and the MSC. The RR layer is concerned with the management of an RR-session.
The MM layer is built on top of the RR layer and handles the functions that arise from the mobility of the subscriber, as well as the authentication and security aspects.
The CM layer is responsible for CC, supplementary service management, and Short Message Service (SMS) management. Each of these may be considered as a separate sublayer within the CM layer.

36. BSC Protocols
After the information is passed from the BTS to the BSC, a different set of interfaces is used. The Abis interface is used between the BTS and BSC. At this level, the radio resources at the lower portion of Layer 3 are changed from the RR to the Base Transceiver Station Management (BTSM). The BTS management layer is a relay function at the BTS to the BSC.
The BSC still has some radio resource management in place for the frequency coordination, frequency allocation, and the management of the overall network layer for the Layer 2 interfaces.

37. MSC Protocols
At the MSC, the information is mapped across the A interface to the MTP Layers 1 through 3 from the BSC. Here, the equivalent set of radio resources is called the BSS MAP. The BSS MAP/DTAP and the MM and CM are at the upper layers of Layer 3 protocols.
Each user of a GSM MS is assigned a HLR that is used to contain the user's location and subscribed services. A separate register, the VLR, is used to track the location of a user. As the users roam out of the area covered by the HLR, the MS notifies a new VLR of its whereabouts.

38. Basic Mobility Management Requirements
Support all forms of mobility
Support mobility for all types of applications
real-time and non-real-time data, voice, and multimedia applications
Support mobility across heterogeneous radio systems in the same or different administrative domains
Support session (service) continuity
continue without significant interruptions as the user moves about
Global roaming
the ability for a user to move into and use different operators’ networks

39. Basic Functional Components
Location management
a process that enables the network to determine a mobile’s current location
i.e., the mobile’s current network attachment point where the mobile can receive traffic from the network
Packet delivery to mobiles
a process whereby a network node, mobile terminal, or end-user application uses location information to deliver packets to a mobile terminal

40. Basic Functional Components (cont..)
Handoff and roaming
handoff (or handover)
a process in which a mobile terminal changes its network attachment point
example: a mobile may be handed off from one wireless base station (or access point) to another, or from one router or switch to another
roaming
the ability for a user to move into and use different operators’ networks

41. Network Signals Network access control
a process used by a network provider to determine whether a user is permitted to use a network and/or a specific service provided by the network
main steps
authentication: verify the identity of user
authorization: determine whether a user should be permitted to use a network or a network service
accounting: collect information on the resources used by a user

42. Impact of Naming and Addressing on Mobility Management
A name identifies a network entity, such as a user, a user terminal, a network node, or a service
An address is a special identifier used by the network to determine where traffic should be routed
A terminal’s address typically identifies a network attachment point
a telephone number in a PSTN network
identifies a port on a PSTN switch rather than the telephone set itself
an IP terminal’s IP address
identifies an attachment point to an IP network

43. Impact of Naming and Addressing on Mobility Management(cont..)
Today’s networks, the name of a terminal is often tied with the terminal’s address, example,
an IP terminal has traditionally been named by the Internet Domain Name associated with the terminal’s IP address
mobile terminals that use multiple network addresses are becoming increasingly popular, example,
a mobile terminal may have multiple radio interfaces
each radio interface may use a different type of radio technology
each radio interface may need to have its own IP address

44. Impact of Naming and Addressing on Mobility Management(cont..)
which domain name should be used as the terminal’s name in this case?
solutions
make the IP terminal names independent of the terminal’s addresses
e.g., IETF has defined Network Access Identifier (NAI) that allows a terminal to be identified by a single globally unique NAI regardless of how many IP addresses this terminal may have

45. Impact of Naming and Addressing on Mobility Management(cont..)
Traditional circuit-switched networks, such as the PSTN, typically do not support user names
they assume a static mapping between a terminal and the user responsible to pay for the services used by the terminal
Static mapping of users to terminals could lead to a range of problems in a mobile network
mobile users often have to, or like to, use different types of terminals in different locations depending on what types of terminals are available or best fit their needs
this suggests that a mobile user’s name should not be statically tied to a mobile terminal

46. Impact of Naming and Addressing on Mobility Management(cont..)
Terminal-independent user names have become increasingly common in mobile networks, example,
GSM
each subscriber is identified by a globally unique International Mobile Subscriber Identity (IMSI) that is independent of the terminal used by the user
a Subscriber Identity Module (SIM) carries a mobile’s IMSI and can be ported from one mobile terminal to another to allow a user to use different terminals and still be recognized by the network as the same user

47. Impact of Naming and Addressing on Mobility Management(cont..)
Today’s IP Networks, applications provide their own naming schemes for users, example
users are identified by their addresses
SIP users are identified by their SIP URIs
the NAI may serve as a user’s globally unique and terminal-independent user name

48. Location Management Location update strategies
Location discovery (paging)
Interactions between location update and paging

49. Location Update Strategies
When a mobile should perform location updates and what location-related information the mobile should send to the network?
update the mobile’s precise location every time the mobile changes its network attachment points, example, Mobile IP
knowing a mobile’s precise location allows the network to deliver traffic to the mobile via unicast

50. Location Update Strategies(cont..)
when mobiles change their network attachment points frequently, maintaining precise locations of all mobiles could lead to heavy location update traffic, which wastes limited radio bandwidth
to save scarce resources on the mobile and in the wireless network, a network can group network attachment points into location areas
only keeps track of which location area each mobile is likely in when the user and the network have no traffic to send to each other
the network tries to determine a mobile’s precise location only when it needs to deliver user traffic to the mobile

51. Location Update Time-based update
update periodically at a constant interval (called update interval)
Movement-based update
update whenever it traverses a predefined number of location areas, called movement threshold
most existing wireless networks (e.g., GSM, GPRS, 3GPP, 3GPP2) use movement-based location update strategy in which the movement threshold is one

52. Distance-based update
update whenever it has traveled a predefined distance threshold from the location area in which it performed its last location update
distance may be measured in many different ways, such as physical distance, or cell distance (i.e., distance measured in number of radio cells or location areas)
the physical distance-based strategy is used, for example, as an option in 3GPP2