1. GSM standard (continued)

2. Multiple Access Methods Frequency Division Multiple Access (FDMA) Frequency 1 ch Frequency 2 ch Frequency N ch Time Division Multiple Access (TDMA) TimeTimeTime Slot 1Slot 2Slot N chchch Code Division Multiple Access (CDMA) Code Sequence 1 ch Code Sequence 2 ch Code Sequence N ch

3. MAC Alternatives - FDMA

4. MAC Alternatives - TDMA

5. MAC Alternatives - CDMA Code 1Code 2Code 3 Code 4 All Channels Share Same RF Band Ch 1Ch 2Ch 3Ch 4 Power Freq

6. Physical Channel Structure Used in P-GSM900 Frequency 1ch Slot 0Slot 1 ch Slot 7 Frequency 2ch Frequency 124ch Downlink Frequency 1ch Slot 0Slot 1 ch Slot 7 Frequency 2ch Frequency 124ch Uplink 992 Duplex Physical Channels Available TimeDomain ARFCN 1 Frequency Domain

7. TDMA Operation in GSM Full Rate 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 Frame (Count)Frame (Count + 1) 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 Frame (Count)Frame (Count + 1) MS7MS1 MS5MS0 BS UPLINK DOWNLINK

8. 12 3 4 5 6 78 higher GSM frame structures 935-960 MHz 124 channels (200 kHz) downlink 890-915 MHz 124 channels (200 kHz) uplink frequency time GSM TDMA frame GSM time-slot (normal burst) 4.615 ms 546.5 µs 577 µs tailuser dataTrainingS guard space Suser datatail guard space 3 bits57 bits26 bits 57 bits1 13 GSM - TDMA/FDMA

9. 45 MHz BS Transmission Band : 935 – 960 MHZ MS Transmission Band : 890 – 915 MHZ

10. Channels for Two-Way Communications Frequency Division Duplex Uplink Downlink 123 Uplink RF carrier channels 123 Downlink RF carrier channels frequency Frequency separation between uplink and downlink channel pairs

11. GSM Handover From Frequency 6 Time Slot 3 To Frequency 9 Time Slot 7 MSC Subscriber Set Lanline switched at MSC Frequency and time slot changed at MS MS BSS

12. Mobile Terminated Call PSTN calling station GMSC HLR VLR BSS MSC MS 12 3 4 5 6 7 89 10 1112 13 16 10 11 1415 17 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR 6: forward responsible MSC to GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection

13. Mobile Originated Call PSTN GMSC VLR BSS MSC MS 1 2 65 34 9 10 78 1, 2: connection request 3, 4: security check 5-8: check resources (free circuit) 9-10: set up call

14. MTC/MOC BTSMS paging request channel request immediate assignment paging response authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange BTSMS channel request immediate assignment service request authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange MTCMOC

15. 4 types of handover MSC BSC BTS MS 1 234

16. Handover decision receive level BTS old receive level BTS old MS HO_MARGIN BTS old BTS new

17. Handover procedure HO access BTS old BSC new measurement result BSC old Link establishment MSC MS measurement report HO decision HO required BTS new HO request resource allocation ch. activation ch. activation ack HO request ack HO command HO complete clear command clear complete

18. Security in GSM Security services –access control/authentication user  SIM (Subscriber Identity Module): secret PIN (personal identification number –confidentiality voice and signaling encrypted on the wireless link (after successful authentication) –anonymity temporary identity TMSI (Temporary Mobile Subscriber Identity) newly assigned at each new location update (LUP) encrypted transmission 3 algorithms specified in GSM –A3 for authentication (“secret”, open interface) –A5 for encryption (standardized) –A8 for key generation (“secret”, open interface) “secret”: A3 and A8 available via the Internet network providers can use stronger mechanisms

19. GSM - authentication A3 RANDKiKi 128 bit SRES* 32 bit A3 RANDKiKi 128 bit SRES 32 bit SRES* =? SRES SRES RAND SRES 32 bit mobile network SIM AC MSC SIM K i : individual subscriber authentication keySRES: signed response

20. GSM - key generation and encryption A8 RANDKiKi 128 bit K c 64 bit A8 RANDKiKi 128 bit SRES RAND encrypted data mobile network (BTS) MS with SIM AC BSS SIM A5 K c 64 bit A5 MS data cipher key

21. Location Addresses in GSM

22. Location Areas and Cell Areas Cell Global Identification Number MCCMNCLAC CI Location Area Identification (LAI) Acronyms MCC-Mobile Country Code (Same as in the IMSI) –3 digits. MNC-Mobile Network Code (same as in the IMSI – 2 digits. LAC-Location Area Code used to identify a location area within a GSM PLMN – 2 octets. LAI-Location Area Identification CI-Cell Identity – 2 octets.

23. Registration Sequence Source: An Introduction to GSM Redl, Weber and Oliphant

24. Paging a Mobile Station BSS PSTN - Location Area - Mobile ID DN Location Area Mobile Switching Centre Mobile Station

25. Mobile Station Identification Numbers Used in GSM International Mobile Equipment Identity (IMEI) Uniquely identifies mobile station equipment Burnt in by the equipment manufacturer TAC – Type Approval Code (6 digits) FAC – Final Assembly Code (2 digits) SNR – Serial Number (6 digits) SP – Spare (1 digit) International Mobile Subscriber Identity (IMSI) IMSI is assigned to a MS at subscription time IMSI uniquely identifies a given MS IMSI is transmitted over the radio path only when necessary MCC – Mobile Country Code [3 digits] (home country) MNC – Mobile Network Code [2 digits] (home GSM PLMN) MSIN – Mobile Subscriber Identification Number (10 digits) NMSI – National Mobile Subscriber Identity Temporary Mobile Subscriber Identity (TMSI) or (TIMSI) TMSI is assigned to a MS by the VLR TMSI uniquely identifies a MS within the area controlled by a given VLR TMSI (32 bits max) MCCMNCMSIN IMSI (15 digits) NMSI TACFACSNR SP IMEI (15 digits)

26. Subscriber Identity Module (SIM) Contains: International Mobile Subscriber Identity (IMSI) Authentication key (Ki) Personal Identification Number (PIN) Subscriber information Access control class Cipher key (Kc)* Temporary Mobile Station Identification (TMSI)* Additional GSM services* Location Area Identity (LAI)* Forbidden Public Land Mobile Numbers (PLMNs)* *Updateable by network GSM Test SIM 2To 92316 005

27. Subscriber Identity Module (SIM) Hardware Spec GSM Test SIM 2To 92316 005 Highly Secure Processor Contact Type - Smart Card Communication via serial IO Data Rate 1MHz Contains ROM, RAM and EPROM

28. SIM Security Functions Pin Code to unlock the mobile station. 3 wrong attempts at PIN and SIM is blocked. SIM may be unblocked with PIN Unblock Code (PUK). 10 attempts at PUK and SIM is permanently disabled. Second PIN and second PUK available in Phase 2 to support Closed User Groups and Fixed Dial Numbers. SIM and Phase 2+ SIM Application Toolkit allows user applications (e.g. electronic banking) to be run on the SIM

29. Routing Calls Automatically To Mobile Stations

30. MSC Directory Number Allocation PSTN MSC Local Exchange MSISDN MSRN Directory Number Spectrum in MSC Trunks Used to reference home subscribers Used to reference visiting subscribers

31. Land to Mobile Call Routing Mobile Located in Non-Home MSC Area BSS 1 BSS 2 Home MSC BSS 1 BSS 2 Visited MSC HLR VLR PSTN TMSI & LACMSRN TMSI MSRN MSISDN MSRN TMSI Signalling Voice Path 1 2 5 34 6 78 9 10

32. Land to Mobile Call Routing Mobile in Home MSC Area PSTN VLR HLR Home MSC TMSI & LACMSRN MSISDNMSRN MSISDN BSS 1 BSS 2 TMSI MSISDN

33. Land to Mobile Call Routing Intelligent PSTN Routing PSTN VLR HLR TMSI & LACMSRN MSISDN MSRN MSISDN BSS 3 BSS 4 Visited MSC MSISDN TMSI BSS 1 BSS 2 Home MSC

34. Land to Mobile Call Routing Routing Via a Gateway MSC PSTN VLR HLR TMSI & LACMSRN MSISDN MSRN MSISDN BSS 1 BSS 2 Visited MSC MSISDN TMSI BSS 1 BSS 2 Home MSC Gateway MSC MSRN Signalling Voice Path

35. Dynamic Allocation of MSRN VLR HLR Home MSC PSTN Mobile Registers Update Location. No MSRN, use LMSI Subscriber Data Need MSRN For LMSI MSRN Need MSRN For LMSI MSRN Get Route MSRN Get Route Incoming Call Home GSM system Visited GSM system Landline network

36. Location Updating

37. Phases of a Location Update 1) Request for Service 2) Authentication* 3) Update Location Registers 4) Ciphering* 5) TMSI Reallocation *Phase might not occur

38. Mobile Location Update: Request for Service New VLR B MSCBSSMS AUm 1 2 3 4 5 6 7 8 9 Channel Request (on RACH) Dedicated Signalling Channel Assignment (on AGCH) Location Update Request TMSI, LAI (on SDCCH) Location Update Request Request IMSI IMSI Acknowledge

39. Mobile Location Update : Authentication 1011121314151617 HLR D New VLR MSCMS B Get Authentication Parameters IMSI Get Authentication Parameters IMSI Authentication Parameters Authentication Parameters Authenticate Mobile Station Authenticate Response SRES AUC RAND, SRES, Kc RAND Authenticate Mobile Station RAND Authenticate Response SRES RAND, SRES, Kc

40. Mobile Location Update: Update Location 18 19 20 21 Old VLR HLR New VLR D Update Location MSRN Location Updated Customer Profile De-register Mobile Station De-registered D

41. Mobile Location Update: Ciphering New VLR B MSCBSSMS AUm 22 23 24 25 26 Set Ciphering Kc Encipher Command Kc Cipher Mode Command Cipher Mode Complete Encipher Complete

42. Mobile Location Update: TMSI Reallocation New VLR B MSCBSSMS AUm 27 28 29 30 31 Location Update Accept new TMSI Location Update Complete Clear Signalling Connection Release Radio Signalling Channel 32 Clear Complete Location Update Accept new TMSI

43. Mobile-to-Land Call Scenario

44. Required Facilities for a Mobile-to-Land Call 1.Radio channel between Mobile Station and BTS selected by the BSC 2.BSC – BTS voice trunk selected by the BSC 3.MSC – BSC voice trunk selected by the MSC 4.MSC – PSTN voice trunk selected by the MSC 5.Line from PSTN end switching office to Fixed Station (permanent link) BSC - Base Station Controller BTS-Base Transceiver Station MSC-Mobile Switching Centre PSTN-Public Switched Telephone Network BTS Radio Channel Mobile Station BSC MSC PSTN BSC Voice Trunk Voice Trunk to PSTN Line MSC Voice Trunk Fixed Public Land Network Public Land Mobile Network

45. Phases of a Mobile-to-Land Call Request for Service Authentication* Ciphering* Equipment Validation* Call Set-up Handover(s)* Release * Phase might not occur Note: Detail for authentication and ciphering is not shown. It is the same as in the location registration update scenario.

46. Mobile-to-Land Call Request for Service New VLR B MSCBSSMS AUm 1 2 3 4 5 Channel Request Dedicated Signalling Channel Assignment Service Request TMSI, LAI

47. Mobile-to-Land Call Equipment Validation 6789 EIR MSC MS IMEI Request IMEI Response Check IMEI IMEI Check Results (IMEI)

48. Mobile-to-Land Call Set-up VLR B MSCBSSMS AUm 10 11 12 13 14 Call Setup Request Access Subscriber Data Subscriber Data Call Proceeding Assign Trunk & Radio Trunk No. 15 16 17 Assign Radio Channel TCH Radio Assignment Complete (on TCH) Trunk & Radio Assignment Complete TCH

49. Mobile-to-Land Call Set-up Continued 18 19 20 21 PSTNMSCMS Network Set-up (Dialled DN, Trunk No.) Network Alerting Alerting Connect (answer) 22 23 Connect Connect Acknowledgement Note: Network Set-up, Network Alerting and Connect are generic terms. For SS7, the network set-up message would be Initial Assignment Message (IAM).

50. Mobile-to-Land Call Mobile Initiated Release PSTN MSCBSSMS AUm 1 2 3 4 5 Disconnect Network Release Release Release Complete Clear Command 6 7 Channel Release Clear Complete

51. Land-to-Mobile Call Scenario

52. Phases of a Land-to-Mobile Call Routing Analysis Paging Authentication* Ciphering* Equipment Validation* Call Set-up Handover(s)* Release *Phase might not occur Note:: Detail for authentication, ciphering and equipment validation is not shown. It is the same as in location registration update and mobile-to-land call scenarios.

53. Land-to-Mobile Call Routing Analysis VLR HLR MSC PSTN C 1 2 3 4 5 Incoming Call MSISDN Get Route MSISDN Routing Information MSRN Incoming Call MSRN Perform Page TMSI, LAI B

54. Land-to-Mobile Call Paging VLR B MSCBSSMS AUm 6 7 8 9 10 Perform Page TMSI Page TMSI (on PCH) Channel Request (on RACH) Dedicated Signalling Channel Assignment (on AGCH) Page Response TMSI, LAI (on SDCH) 11 12 Page Response TMSI, LAI

55. Land-to-Mobile Call Set-up 13141516 MSC BSS MS Call Set-up Call Set-up Confirm Assign Trunk & Radio Channel TRUNK Assign Radio Channel TCH 1718 Radio Assignment Complete Trunk & Radio Assignment Complete U m A

56. Land-to-Mobile Call Set-up Continued 19 20 21 22 PSTNMSCMS Mobile Alerting Network Alerting Connect (off-hook) Connect 23 Connect Acknowledge

57. Land-to-Mobile Call Network Initiated Call Release PSTN MSCBSSMS AUm 1 2 3 4 5 Disconnect Release Release Complete Clear Command 6 7 Channel Release Clear Complete Network Release

58. Mobile-to-Mobile Call Scenario

59. Phases of a Mobile-to-Mobile Call Request for Service Authentication* Ciphering* Equipment Validation* Call Setup Routing Analysis Paging Authentication* Ciphering* Equipment Validation* Call Setup Handover(s)* Release *Phase might not occur Originating Mobile Terminating Mobile

60. Mobile-to-Mobile Call Set-up & Release BSS A’ MSC VLR BSSMS-A A Channel Request MS-B Um’Um Service Request Channel Request Authentication Ciphering Equipment Validation Paging and Response Authentication Ciphering Equipment Validation Call Set-up Handover Release Call Set-up Handover Release Routing Analysis With HLR

61. Handover Overview

62. Handover Maintains Call Continuity. Controlled by BSS. Based on RF subsystem criteria or traffic loading considerations. Both MS and BTS provide RF link measurements to the handover process. Handover causes are prioritised: RXQUAL RXLEV DISTANCE POWER BUDGET

63. Handover Types Four Levels within same Base Transceiver Station (Intra-BTS) between different BTSs served by same BSC (intra-BSS/inter-BTS) between different BSSs within same MSC (intra-MSC/inter-BSS) between different MSCs (inter-MSC)

64. Intra-BTS Handover Global Cell Identification BSC3BSC2BSC1 MSC BMSC A PSTN 234 01 100 53 234 01 100 54 234 01 100 55 234 01 100 51 234 01 100 52 234 01 089 20 234 01 089 21 234 01 089 22 234 01 100 50 Country Code Network Code Location Area Code Cell Identity

65. Intra-BSS/Inter-BTS Handover Location Area Code Global Cell Identification BSC3BSC2BSC1 MSC BMSC A PSTN 234 01 100 53 234 01 100 54 234 01 100 55 234 01 100 51 234 01 100 52 234 01 089 20 234 01 089 21 234 01 089 22 234 01 100 50 Country Code Network Code Cell Identity

66. Intra-MSC, Inter-BSS Handover Global Cell Identification BSC3BSC2BSC1 MSC BMSC A PSTN 234 01 100 53 234 01 100 54 234 01 100 55 234 01 100 51 234 01 100 52 234 01 089 20 234 01 089 21 234 01 089 22 234 01 100 50 Country Code Network Code Location Area Code Cell Identity

67. Intra-BSC, Inter-BTS Handover Global Cell Identification BSC3BSC2BSC1 MSC BMSC A PSTN 234 01 100 53 234 01 100 54 234 01 100 55 234 01 100 51 234 01 100 52 234 01 089 20 234 01 089 21 234 01 089 22 234 01 100 50 Country Code Network Code Location Area Code Cell Identity