1. GSM

2. What is GSM?
If you are in Europe, Asia or Japan and using a mobile phone then most probably you must be using GSM technology in your mobile phone.
GSM stands for Global System for Mobile Communication and is an open, digital cellular technology used for transmitting mobile voice and data services.
The GSM emerged from the idea of cell-based mobile radio systems at Bell Laboratories in the early 1970s.
The GSM is the name of a standardization group established in 1982 to create a common European mobile telephone standard
The GSM standard is the most widely accepted standard and is implemented globally.
The GSM is a circuit-switched system that divides each 200kHz channel into eight 25kHz time-slots. GSM operates in the 900MHz and 1.8GHz bands in Europe and the 1.9GHz and 850MHz bands in the US.

3. Cont…
The GSM is owning a market share of more than 70 percent of the world's digital cellular subscribers.
The GSM makes use of narrowband Time Division Multiple Access (TDMA) technique for transmitting signals.
The GSM was developed using digital technology. It has an ability to carry 64 kbps to 120 Mbps of data rates.
Presently GSM support more than one billion mobile subscribers in more than 210 countries throughout of the world.
The GSM provides basic to advanced voice and data services including Roaming service. Roaming is the ability to use your GSM phone number in another GSM network

4. Why GSM?
The GSM study group aimed to provide the followings through the GSM:
Improved spectrum efficiency.
International roaming.
Low-cost mobile sets and base stations (BSs)
High-quality speech
Compatibility with Integrated Services Digital Network (ISDN) and other telephone company services.
Support for new services

5. GSM Brief History:
1982CEPT establishes a GSM group in order to develop the standards for a pan-European cellular mobile system.
2000General Packet Radio Service(GPRS) came into existence.
2001As of May 2001, over 550 million people were subscribers to mobile telecommunications

6. Architecture of GSM

7. Advertisements
A GSM network consists of several functional entities whose functions and interfaces are defined. The GSM network can be divided into following broad parts.
The Mobile Station(MS)
The Base Station Subsystem (BSS)
The Network Switching Subsystem (NSS)
The Operation Support Subsystem(OSS)

8. 1) Mobile Station
The MS consists of the physical equipment, such as the radio transceiver, display and digital signal processors, and the SIM card. It provides the air interface to the user in GSM networks. As such, other services are also provided, which include:
Voice tele services
Data bearer services
The features' supplementary services

9. 2)The Base Station Subsystem
The BSS is composed of two parts:
1. The Base Transceiver Station (BTS)
2. The Base Station Controller(BSC)

10. The BTS and the BSC communicate across the specified Abis interface, enabling operations between components that are made by different suppliers. A BSS may have one or more base stations. The BSS uses the Abis interface between the BTS and the BSC. A separate high-speed line (T1 or E1) is then connected from the BSS to the Mobile MSC.

11. a) The Base Transceiver Station (BTS):
The BTS houses the radio transceivers that define a cell and handles the radio link protocols with the MS. In a large urban area, a large number of BTSs may be deployed.

12. 1.Encoding, encrypting, multiplexing, modulating, and feeding the RF signals to the antenna. 2.Transcoding and rate adaptation 3.Time and frequency synchronizing 4.Voice through full- or half-rate services 5.Decoding, decrypting, and equalizing received signals 6.Random access detection Timing advances Uplink channel measurements

13. B)The Base Station Controller (BSC):
The BSC manages the radio resources for one or more BTSs. It handles radio channel setup, frequency hopping, and handovers. The BSC is the connection between the mobile and the MSC. The BSC also translates the 13 Kbps voice channel used over the radio link to the standard 64 Kbps channel used by the Public Switched Telephone Network (PSDN) or ISDN.

14. 3) The Network Switching Subsystem (NSS)
The Network switching system (NSS), the main part of which is the Mobile Switching Center (MSC), performs the switching of calls between the mobile and other fixed or mobile network users, as well as the management of mobile services such as authentication.

16. a)Home Location Register (HLR)
The HLR is a database used for storage and management of subscriptions. The HLR is considered the most important database, as it stores permanent data about subscribers, including a subscriber's service profile, location information, and activity status. When an individual buys a subscription in the form of SIM then all the information about this subscription is registered in the HLR of that operator

17. B)Mobile Services Switching Center (MSC)
The central component of the Network Subsystem is the MSC. The MSC performs the switching of calls between the mobile and other fixed or mobile network users, as well as the management of mobile services such as such as registration, authentication, location updating, handovers, and call routing to a roaming subscriber. It also performs such functions as toll ticketing, network interfacing, common channel signaling, and others. Every MSC is identified by a unique ID

18. c)Visitor Location Register (VLR)
The VLR is a database that contains temporary information about subscribers that is needed by the MSC in order to service visiting subscribers. The VLR is always integrated with the MSC. When a mobile station roams into a new MSC area, the VLR connected to that MSC will request data about the mobile station from the HLR. Later, if the mobile station makes a call, the VLR will have the information needed for call setup without having to interrogate the HLR each time

19. d)Authentication Center (AUC)
The Authentication Center is a protected database that stores a copy of the secret key stored in each subscriber's SIM card, which is used for authentication and ciphering of the radio channel. The AUC protects network operators from different types of fraud found in today's cellular world.

20. e)Equipment Identity Register (EIR)
The Equipment Identity Register (EIR) is a database that contains a list of all valid mobile equipment on the network, where its International Mobile Equipment Identity (IMEI) identifies each MS. An IMEI is marked as invalid if it has been reported stolen or is not type approved

21. 4)The Operation Support Subsystem(OSS)
The operations and maintenance center (OMC) is connected to all equipment in the switching system and to the BSC. The implementation of OMC is called the operation and support system (OSS).
Here are some of the OMC functions:
Administration and commercial operation (subscription, end terminals, charging and statistics).
Security Management.
Network configuration, Operation and Performance Management.
Maintenance Tasks.

23. Following is the simple architecture diagram of GSM Network

24. Cont..
The operation and Maintenance functions are based on the concepts of the Telecommunication Management Network (TMN) which is standardized in the ITU-T series M.30. Following is the figure which shows how OMC system covers all the GSM elements.

25. GSM

26. Componant
The added components of the GSM architecture include the functions of the databases and messaging systems:
Home Location Register (HLR)
Visitor Location Register (VLR)
Equipment Identity Register (EIR)
Authentication Center (AuC)
SMS Serving Center (SMS SC)
Gateway MSC (GMSC)
Chargeback Center (CBC)
Transcoder and Adaptation Unit (TRAU)

27. Following is the diagram of GSM Netwrok alongwith added elements

28. GSM network areas:
Cell: Cell is the basic service area: one BTS covers one cell. Each cell is given a Cell Global Identity (CGI), a number that uniquely identifies the cell.
Location Area: A group of cells form a Location Area. This is the area that is paged when a subscriber gets an incoming call. Each Location Area is assigned a Location Area Identity (LAI). Each Location Area is served by one or more BSCs.
MSC/VLR Service Area: The area covered by one MSC is called the MSC/VLR service area.
PLMN: The area covered by one network operator is called PLMN. A PLMN can contain one or more MSCs.

29. The GSM Specifications
Modulation
Modulation is a form of change process where we change the input information into a suitable format for the transmission medium. We also changed the information by demodulating the signal at the receiving end.
The GSM uses Gaussian Minimum Shift Keying (GMSK) modulation method.

30. Access Methods:
Because radio spectrum is a limited resource shared by all users, a method must be devised to divide up the bandwidth among as many users as possible.
GSM chose a combination of TDMA/FDMA as its method. The FDMA part involves the division by frequency of the total 25 MHz bandwidth into 124 carrier frequencies of 200 kHz bandwidth.
One or more carrier frequencies are then assigned to each BS. Each of these carrier frequencies is then divided in time, using a TDMA scheme, into eight time slots. One time slot is used for transmission by the mobile and one for reception. They are separated in time so that the mobile unit does not receive and transmit at the same time.

31. Transmission Rate:
The total symbol rate for GSM at 1 bit per symbol in GMSK produces K symbols/second. The gross transmission rate of the time slot is 22.8 Kbps.
GSM is a digital system with an over-the-air bit rate of 270 kbps

32. Frequency Band:
The uplink frequency range specified for GSM is MHz (basic 900 MHz band only). The downlink frequency band  MHz (basic 900 MHz band only).

33. Channel Spacing:
This indicates separation between adjacent carrier frequencies. In GSM, this is 200 kHz.

34. Speech Coding:
GSM uses linear predictive coding (LPC). The purpose of LPC is to reduce the bit rate. The LPC provides parameters for a filter that mimics the vocal tract. The signal passes through this filter, leaving behind a residual signal. Speech is encoded at 13 kbps.

35. Duplex Distance:
The duplex distance is 80 MHz. Duplex distance is the distance between the uplink and downlink frequencies. A channel has two frequencies, 80 MHz apart.

36. GSM - Addresses and Identifiers
GSM distinguishes explicitly between user and equipment and deals with them separately. Besides phone numbers and subscriber and equipment identifiers, several other identifiers have been defined; they are needed for the management of subscriber mobility and for addressing of all the remaining network elements. The most important addresses and identifiers are presented in the following

37. (IMEI):
The international mobile station equipment identity (IMEI) uniquely identifies a mobile station internationally. It is a kind of serial number. The IMEI is allocated by the equipment manufacturer and registered by the network operator and registered by the network operator who stores it in the EIR. By means of IMEI one recognizes obsolete, stolen or nonfunctional equipment.
There are following parts of an IMEI:
Type Approval Code (TAC): 6 decimal places, centrally assigned.
Final Assembly Code (FAC): 6 decimal places, assigned by the manufacturer.
Serial Number (SNR): 6 decimal places, assigned by the manufacturer.
Spare (SP): 1 decimal place.
Thus, IMEI = TAC + FAC + SNR + SP. It uniquely characterizes a mobile station and gives clues about the manufacturer and the date of manufacturing

38. International Mobile Subscriber Identity ( IMSI):
Each registered user is uniquely identified by its international mobile subscriber identity (IMSI). It is stored in the subscriber identity module (SIM) A mobile station can only be operated if a SIM with a valid IMSI is inserted into equipment with a valid IMEI.
There are following parts of an IMSI:
Mobile Country Code (MCC): 3 decimal places, internationally standardized.
Mobile Network Code (MNC): 2 decimal places, for unique identification of mobile network within the country.
Mobile Subscriber Identification Number (MSIN): Maximum 10 decimal places, identification number of the subscriber in the home mobile network

39. Mobile Subscriber ISDN Number ( MSISDN):
The real telephone number of a mobile station is the mobile subscriber ISDN number (MSISDN). It is assigned to the subscriber (his or her SIM, respectively), such that a mobile station set can have several MSISDNs depending on the SIM.
The MSISDN categories follow the international ISDN number plan and therefore have the following structure.
Country Code (CC) : Up to 3 decimal places.
National Destination Code (NDC): Typically 2-3 decimal places.
Subscriber Number (SN): Maximum 10 decimal place

40. Mobile Station Roaming Number ( MSRN):
The Mobile Station Roaming Number ( MSRN) is a temporary location dependent ISDN number. It is assigned by the locally responsible VLR to each mobile station in its area. Calls are also routed to the MS by using the MSRN.
The MSRN has same structure as the MSISDN.
Country Code (CC) : of the visited network.
National Destination Code (NDC): of the visited network.
Subscriber Number (SN): in the current mobile network.

41. Location Area Identity (LAI):
Each LA of an PLMN has its own identifier. The Location Area Identifier (LAI) is also structured hierarchically and internationally unique as follows:
Country Code (CC) : 3 decimal places.
Mobile Network Code (MNC): 2 decimal places.
Location Area Code (LAC): maximum 5 decimal places or, maximum twice 8 bits coded in hexadecimal

42. Temporary Mobile Subscriber Identity (TMSI):
The VLR, which is responsible for the current location of a subscriber, can assign a temporary mobile subscriber identity (TMSI) which has only local significance in the area handled by the VLR. It is stored on the network side only in the VLR and is not passed to the HLR.
Together with the current location area, TMSI allows a subscriber to be identified uniquely and it can consist of upto 4x8 bits

43. Local Mobile Subscriber Identity (LMSI):
The VLR can assign an additional searching key to each mobile station within its area to accelerate database access. This unique key is called the Local Mobile Subscriber Identity (LMSI). The LMSI is assigned when the mobile station registers with the VLR and is also sent to the HLR.
An LIMSI consists of four octets ( 4 x 8 bits).

44. GSM - Operations
The operation of the GSM system can be understood by studying the sequence of events that takes place when a call is initiated from the Mobile Station.

45. Call from Mobile Phone to PSTN:
When a mobile subscriber makes a call to a PSTN telephone subscriber, the following sequence of events takes place:
The MSC/VLR receives the message of a call request.
The MSC/VLR checks if the mobile station is authorized to access the network. If so, the mobile station is activated. If the mobile station is not authorized, service will be denied.
MSC/VLR analyzes the number and initiates a call setup with the PSTN.
MSC/VLR asks the corresponding BSC to allocate a traffic channel (a radio channel and a time slot).
The BSC allocates the traffic channel and passes the information to the mobile station.
The called party answers the call and the conversation takes place.
The mobile station keeps on taking measurements of the radio channels in the present cell and neighboring cells and passes the information to the BSC. The BSC decides if handover is required, if so, a new traffic channel is allocated to the mobile station and the handover is performed. If handover is not required, the mobile station continues to transmit in the same frequenc

46. Call from PSTN to Mobile Phone:
When a PSTN subscriber calls a mobile station, the sequence of events is as follows:
The Gateway MSC receives the call and queries the HLR for the information needed to route the call to the serving MSC/VLR.
The GMSC routes the call to the MSC/VLR.
The MSC checks the VLR for the location area of the MS.
The MSC contacts the MS via the BSC through a broadcast message, that is, through a paging request.
The MS responds to the page request.
The BSC allocates a traffic channel and sends a message to the MS to tune to the channel. The MS generates a ringing signal and, after the subscriber answers, the speech connection is established.
Handover, if required, takes place, as discussed in the earlier case.

47. GSM - User Services Voice Calls: Videotext Short Text Messages
Supplementary Services
Call Waiting
Call Hold
Closed User Groups

48. CALL ROUTING IN GSM

49. Call Routing
Call Originating from MS
Call termination to MS

50. Outgoing Call MS sends dialled number to BSS
BSS sends dialled number to MSC
3,4 MSC checks VLR if MS is allowed the requested service. If so,MSC asks BSS to allocate resources for call.
MSC routes the call to GMSC
GMSC routes the call to local exchange of called user
7, 8,
9,10 Answer back(ring back) tone is routed from called user to MS via GMSC,MSC,BSS

51. Incoming Call Calling a GSM subscribers Forwarding call to GSMC
Signal Setup to HLR
5. Request MSRN from VLR
Forward responsible MSC to GMSC
Forward Call to current MSC
9. Get current status of MS
11. Paging of MS
13. MS answers
15. Security checks
17. Set up connection

52. PLMN INTERFACE (private land mobile network)

54. NETWORK ASPECTS IN GSM

55. For roaming purpose a mobile need registration, authentication, call routing and location update.
The layer dependencies in GSM is structured into three general layers :
Layer 1 is physical layer
Layer 2 is DLL used for interface, LAPD(link access procedure-D) protocol is used.
Layer 3 is used for signaling purpose, it includes
Radio resources Management : setup control, maintenance
Mobility Management : registration procedures
Connection Management : includes services like SMS

57. GSM FREQUENCY ALLOCATION

58. Frequency Resource EGSM900 : up: 880~890MHz down: 925~935MHz
duplex interval: 45MHz
bandwidth: 25MHz，
frequency interval: 200KHz
EGSM900 :
up: 880~890MHz
down: 925~935MHz
duplex interval: 45MHz
bandwidth: 10MHz，
frequency interval: 200KHz
GSM1800 :
up: MHz down: MHz
duplex interval: 95MHz， working bandwidth: 75MHz，
frequency interval: 200KHz
GSM1900MHz:
up:1850~1910MHz
down:1930~1990MHz
duplex interval: 80MHz， working bandwidth: 60MHz，
frequency interval: 200KHz

59. Mobile to base : Ft(n)=890.2 + 0.2(n-1)MHz
Base to mobile : Fr(n)=Fr(n) + 45 MHz
To share bandwidth for multiple users, GSM uses a combination of Time Division Multiplexing and Frequency Division Multiplexing encoding.
One or more carrier frequency is assigned to each base station.
Each of these carrier frequencies divided in time using TDMA scheme.

60. CARRIER FREQUENCIES AND TDMA FRAMES

61. A TCH (traffic channel) carry 26 multiple frames at one instance.
ORGANIZIATION OF BURSTS,TDMA FRAMES
SACCH-slow associated control channel

62. Mobility Management Paging Location Update Handover
Authentication & Security Issues during Handover
Roaming

63. Paging
For a mobile terminated call the MS needs to be traced, located and then the call connected.
The MS is traced through the Paging process within a location.
Mobile call reception is the process of the GSM system sending paging messages on a paging control channel to alert mobile devices that they are receiving a call. Mobile devices listen for paging messages with their identification code on a paging channel.

64. Location Update

65. As a MS moves around it is constantly monitoring the signal strength of its current BTS, as well as neighboring BTS's to determine if the neighbors have a stronger signal.
When the MS is in idle mode (not in a call), it will determine for itself when to move from its current BTS to a more attractive one.
When the MS switches from a BTS in one VLR to a BTS in a different VLR, it must do an location update, so the network knows which MSC/VLR the MS is currently using.

66. Numbering Arrangement
Temporarily Mobile Subscriber Identification Number
(TMSI)
To insure the IMSI security, the VLR will assign an unique TMSI number for the accessed subscriber. It is used locally only and is a 4-byte TMSI number BCD code.

67. Handovers Between 1 and 2 – Inter BTS / Intra BSC Between 1 and 3 –
Inter BSC/ Intra MSC
Between 1 and 4 –
Inter MSC

68. Security in GSM
On air interface, GSM uses encryption and TMSI instead of IMSI.
SIM is provided 4-8 digit PIN to validate the ownership of SIM
3 algorithms are specified :
- A3 algorithm for authentication
- A5 algorithm for encryption
- A8 algorithm for key generation

69. Authentication Concept
Random Number
Generator
Authentication
Algorithm
Secret Data
Response
Yes No =
Mobile Station
Serving Network
Grant
Access
Deny
This is the high-level concept upon which authentication is based. Since the 'random number' and the 'authentication response' are sent on the air link, a different random number must be used for each challenge. Also, the algorithm must be such that the authentication key cannot be deduced given the random number and authentication response.
The authentication key is never sent over the air link and is identical for the serving system and the mobile.

70. Authentication in GSM (A3 Algo.)
During the authentication process the MSC challenges the MS with a random number (RAND).
In SIM the RAND number is stored with a secret key Ki.
Both RAND & Ki are 128 bits long.
Using A3 algorithm with RAND & Ki a 32 bit output is generated by SIM called SRES(signature response).
Using same algorithm AuC also generates a SRES as same as old one, to compare with SIM (SRES & Ki).

71. Authentication in GSM (A3 Algo.)

72. Algorithm for Encryption (A5 Algo.)
Uses same cryptography methods as used in Internet Network.

73. Key generation and Encryption(A8)

74. Characteristics of GSM Standard
Fully digital system using 900,1800 MHz frequency band.
TDMA over radio carriers(200 KHz carrier spacing.
8 full rate or 16 half rate TDMA channels per carrier.
User/terminal authentication for fraud control.
Encryption of speech and data transmission over the radio path.
Full international roaming capability.
Low speed data services (upto 9.6 Kb/s).
Compatibility with ISDN.
Support of Short Message Service (SMS).

75. Advantages of GSM over Analog system
Capacity increases
Reduced RF transmission power and longer battery life.
International roaming capability.
Better security against fraud (through terminal validation and user authentication).
Encryption capability for information security and privacy.
Compatibility with ISDN,leading to wider range of services

76. GSM Applications Mobile telephony GSM-R Telemetry System
- Fleet management
- Automatic meter reading
- Toll Collection
- Remote control and fault reporting of DG sets
Value Added Services

77. Future Of GSM 2nd Generation GSM -9.6 Kbps (data rate)
2.5 Generation ( Future of GSM)
HSCSD (High Speed ckt Switched data)
Data rate : 76.8 Kbps (9.6 x 8 kbps)
GPRS (General Packet Radio service)
Data rate: Kbps
EDGE (Enhanced data rate for GSM Evolution)
Data rate: Kbps (max)
3 Generation
WCDMA(Wide band CDMA)
Data rate : – 2.0 Mbps