1. #1EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Southern Methodist University Fall 2003 EETS 8316/NTU CC745-N Wireless Networks Lecture 3: Mobility Management, Air Interface Instructor : Jila Seraj email: jseraj@engr.smu.edu http://www.engr.smu.edu/~jseraj/ tel: 214-505-6303

2. #2EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Review In the last meeting we discussed  Basic Structure of PSTN  SS7 as an application of OSI model and its significance in PSTN  Basic structure of a wireless networks  Basic functionalities of wireless networks

3. #3EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Access Network

4. #4EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Access Network

5. #5EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Why SS7 SCP SS7 STP

6. #6EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU OSI Model for SS7 TCAP MAP ISUP INAP MUP OMAP Layer 4-7 SCCP MTP Layer 3 Signaling link function, Signaling link physical requirement Layer 1-2

7. #7EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU HLR TDMA Network Structure PSTN Base station Air interface Base station GMSC/MSC /VLR BSC Base station controller Mobile station AUC EIC

8. #8EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Basic Functions  Registration —Power Up/Power Down Registration —Location Area Update Registration —Periodical Registration  Initiating a call  Receiving a call —Paging is the process of searching for an MS in the network. Location Areas are needed to make paging efficient

9. #9EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Location Area, MSC border MSC-1 LA-1 MSC-1 LA-2 MSC-1 LA-3 MSC-2 LA-1 MSC-2 LA-2

10. #10EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff  Movement into a different cell requires MTSO to automatically transfer call to another base station without interruption  Hard handoff: “break before make”, connection is broken then re-established  Soft handoff: temporarily connected to two or more base stations simultaneously before dropping all but one

11. #11EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff, (cont)  Initiation: Base station detects measured signal strength drops below threshold (first generation) or mobile station detects signal from another base station is stronger than current base station (second generation)  Resource reservation: frequencies are reserved with new base station  Execution: actual handoff of connection  Completion: unneeded resources are cleared

12. #12EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff Challenge  Measured signal strength drop is caused by momentary fading  Handoff must be completed before signal strength drops below a minimum acceptable level  No channels are free at nearby base stations, causing call connection problems, dropped calls.  If mobile station moves to another cellular system (controlled by different MTSO), an intersystem handoff is required - more complicated

13. #13EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff, Cont.  There are three type of handoffs —MS controlled handoff —Network controlled handoff —Mobile assisted handoff (MAHO)  D-AMPS and CDMA use MAHO, AMPS uses network controlled handoff.  Capabilities required for the MS are taken into account.

14. #14EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff, Cont. BS Serving MSC Target MSC #2 Target MSC #1 BS PSTN HANDMREQ HANDMREQR

15. #15EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff, Cont. BS Serving MSC Target MSC #1 PSTN FACDIR FACDIRR MSONCH

16. #16EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Handoff, Cont. BS Anchor MSC New Serving MSC PSTN What happens if we go back to the anchor MSC? IS-41 has handoff back facility What if a third MSC gets involved? Path minimization process

17. #17EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Path Optimization Process BS Anchor MSC Target MSC Serving MSC BS PSTN HANDTHIRD FACDIR FACRELR FACDIRR 1 3 2 4 HANDTHIRDR 6 5 7 MSONCH 10 8 FACREL 9

18. #18EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Path Optimization Process, (cont) BS Anchor MSC MSC BS PSTN Call Path after path minimization process New Serving MSC

19. #19EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU More On Roaming  Registration —Power up/down —periodical —New system —Call origination  MS Service Qualification —validation information (billing) —Service profile information, features, restrictions…

20. #20EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU More On Roaming, cont..  MS Location Update Process —Location update at registration —Location cancellation, AKA de-registration MSC triggered –MSINACT with or without De-registration parameter –Bulkdereg, remove all mobiles associated with the MSC HLR triggered –Location update in another switch –Administrative actions –Data failure in HLR

21. #21EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU MS Location Management, Border Case  Multiple access problem  IS-41 revision C has a procedure for HLR to determine the best serving system based on the signal quality information received from each system  MSC uses the signal quality information to accept or deny registration cancellation.21

22. #22EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging  Paging is used when there is a terminating call to a mobile station.  Finding a mobile subscriber requires some work, since its location is not known  The call towards the mobile subscriber is routed towards gateway MSC.  Gateway MSC consults HLR to find the mobiles location

23. #23EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging, cont..  HLR looks up in its directory to find the current MSC of the mobile  The address of the current MSC is sent back to the gateway MSC.  Based on that information gateway MSC routes the call to the visiting MSC.  Visiting MSC checks with VLR to find the Location Area for the mobile. All cells in that Location Area are pages simultaneously.

24. #24EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging, cont..  Mobile station hears the page and respond to it.  Several base stations in the area might hear the page response. They all report to MSC that the mobile is in their coverage area together with signal level data  MSC filters between these reports and chooses the one that has the strongest signal.

25. #25EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging, cont..  MSC chooses an idle voice channel in the chosen Base Station and prepares to set up a voice channel connection.  MSC send a message to HLR informing that the mobile is found together with other useful information such as signal strength, Location Area, etc.  HLR updates its database and forwards the visiting MSC address to the gateway MSC.

26. #26EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging, cont..  Gateway MSC has now sufficient information to connect to the visiting MSC.  Gateway MSC send call set up request to the visiting MSC, which sets up the call  What happens when more than one MSC report to GMC that the mobile is its coverage area?

27. #27EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Paging, cont..  When HLR receives more than one response, it chooses the MSC with strongest signal.  It send the address of the chosen VMSC to the gateway MSC and informs other MSC that the call is off.  How does HLR know it has received response from all MSCs? Internal timer

28. #28EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Primer on RF  The radio frequencies are grouped into bands.  Each set of bands are dedicated to different purposes by FCC  Each frequency is logically divided into time slots for communication between mobile station and the base station.  Some time slots are reserved for user traffic, such as voice and data and other for signaling purposes.

29. #29EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Cellular DCCH Structure DCCH Reverse Forward RACH SPACH BCCHSCFReserved PCHARCHSMSCHFBCCHEBCCHSBCCH

30. #30EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Cellular DCCH Structure, cont..  RACH = Random Access Channel  SPACH = SMS, Paging and Access response Channel  PCH = Paging Channel  ARCH =Access Response Channel  SMSCH = SMS Channel

31. #31EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Cellular DCCH Structure, cont..  BCCH= Broadcast Channel  F-BCCH = Fast Broadcast Control Channel  E-BCCH = Extended Broadcast Control Channel  S-BCCH = SMS Broadcast Control Channel  SCF = Shared Channel Feedback  Reserved!

32. #32EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Cellular DCCH Structure, cont..  DCCH Structure: sent on F-BCCH, indicates the structure of DCCH  Access Parameters: sent on F-BCCH, provides data necessary to access RACH. Power level, maximum number of attempts, authentication information  Control Channel Selection parameters: sent on F-BCCH, provides channel reselection parameters

33. #33EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Cellular DCCH Structure, cont..  Registration Parameters: sent on F-BCCH, indicates type of registration, power up, power down, new system, location area, forced and periodic. Also indicates options for de-registration, foreign system registration  System Identity: sent on F-BCCH, identity and type of system (public, private, residential), protocol version, mobile country code. System identity is 15 characters long text.

34. #34EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU BCCH Message Set  Neighbor Cell: sent on E-BCCH. Included is also reselection criteria for each neighbor cell. Up to 24 neighbor cells can be defined

35. #35EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU SPACH Message Set  Analog voice channel designation: sent on ARCH, contains channel number, power level, SAT, and protocol version  Digital traffic channel designation: sent on ARCH, contains DTC channel number, etc.  Directed retry, sent on ARCH, forces the mobile to access another DCCH from its neighbor list. Used when resources are not available.

36. #36EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU SPACH Message Set, cont…  Message Waiting: sent on PCH, inform mobile a message is waiting. The message can be a voice message, SMS message or fax message.  R-DATA: sent on SMSCH, conveys point-to- point teleservice layer message.  R-DATA Accept: sent on SMSCH to acknowledge reception of R-DATA, may include a delay data.

37. #37EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU SPACH Message Set, cont…  Registration Accept: sent on ARCH, informs mobile that registration is complete, may include paging frame class, current location area, and other system related information.  SPACH Notification: Sent on PCH, informs mobile that the network intends to deliver a message to it on the ARCH or SMSCH and what type of the information mobile should expect.

38. #38EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU RACH Message Set  Capability Report: Informing the system of mobile’s capability, protocol version, etc.  Origination: is sent when a mobile wants to initiate a voice or data call. Includes calling party number, type of service etc.  Page Response: is sent in response to page, includes essentially the same information as in origination message, except for calling party number.

39. #39EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU RACH Message Set, cont..  R-DATA: is used to send point-to-point teleservice layer messages  R-DATA Accept: is sent to acknowledge reception of R-DATA  Registration: request registration with the network  SPACH Confirmation: is sent to network to confirm reception of SPACH notification message.

40. #40EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU DTC Supervision  DTC has two associated control channels for supervision of the DTC link on layer 3.  FACCH: Fast Associated Control Channel  SACCH: Slow Associated Control Channel  These associated control channels are used in the connection phase to send and receive information.

41. #41EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU FACCH Message Set, Forward  Alert with Info: sent on FACCH, causes audible or visual signal, may include calling name and number.  Base Station Ack: sent on FACCH. Acknowledges the mobile that certain message is received, such as connect, release. In the case of release message, DCCH information element might be sent to mobile.

42. #42EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU FACCH Message Set, Forward, cont..  Dedicated DTC Handoff: sent on FACCH, order mobile to change from one DTC to another DTC.  Flash with Info: sent of FACCH, used to send message waiting information or calling party number to mobile  Flash with Info Ack: sent on FACCH.

43. #43EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU FACCH Message Set, Forward, cont..  Handoff: sent on FACCH to order mobile from one DTC to another DTC or AVC  Release: sent on FACCH

44. #44EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU FACCH & SACCH Message Set, Reverse  Capability Update Request: sent of FACCH  Capability Update Response: sent on FACCH  Connect, sent on FACCH  Flash with info: sent on FACCH, indicates that the user wishes to initiate a special service.  Flash with Info Ack: sent of FACCH, acknowledge receipt of Flash With Info

45. #45EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU FACCH & SACCH Message Set, Reverse  Mobile Ack: Can be sent on either channel dependent on the type of message it acknowledges. Is sent as response to Alert with info, release, handoff, etc.  Release: sent of FACCH, may contain DCCH information.  Service Request: sent of FACCH, is used when mobile wished to change a service during a call.

46. #46EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU Network Interfaces, TDMA  IS-41 is used for interface between MSC- VLR, MSC-HLR, HLR-VLR, MSC-MSC, MSC- PSTN, HLR-AC, MC-HLR and MC-MSC  IS-41 can be implemented on the top of MTP, X.25, or IP protocols, though MTP is the common one.

47. #47EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU IS-41 Protocol Stack

48. #48EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Network Structure BSS MSC VLR HLR EIR AUC MT TE MS Um A PSTN BSC BTS OMC NMC ADC OSS BSS MS GSM Public land mobile network (PLMN) OSS: operation subsystem BSS: base station subsystem MS: mobile station

49. #49EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU North American Numbering Plan  North American Numbering Plan consists of 10 digits, NPA-NXX-XXXX  All phone numbers follow the same structure.  NPA is the area code  NXX is the switch identifier  XXXX indicates the subscriber in the switch

50. #50EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU North American Numbering Plan, cont…  Due to this structure, there is no way for a switch to identify that a number belongs to a mobile subscriber, nor can it identify the network provider.  Mobile network provider “buy” a certain number series in each area for their users.  Therefore we can not bill a caller to a mobile user for the air usage. They do it in other countries!

51. #51EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Logical Channel Structure CCH TCH/F TCH/H BCHCCCHDCCH FCCHSCH BCCH PCH AGCH RACH TCH CBCH ACCH SDCCH FACCH SACCH

52. #52EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Logical Channels  3 groups of logical control channels —BCH (broadcast channel): point-to- multipoint downlink only BCCH (broadcast control channel): send cell identities, organization info about common control channels, cell service available, etc FCCH (frequency correction channel): send a frequency correction data burst containing all zeros to effect a constant frequency shift of RF carrier

53. #53EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Logical Channels, cont… SCH (synchronization channel): send TDMA frame number and base station identity code to synchronize MSs —CCCH (common control channel): for paging and access PCH (paging channel): to page MSs AGCH (access grant channel): to assign MSs to stand-alone dedicated control channels for initial assignment

54. #54EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Logical Channels, cont… —RACH (random access channel): for MS to send requests for dedicated connections —DCCH (dedicated control channel): bi-directional point-to-point -- main signaling channels SDCCH (stand-alone dedicated control channel): for service request, subscriber authentication, equipment validation, assignment to a traffic channel SACCH (slow associated control channel): for out-of-band signaling associated with a traffic channel, eg, signal strength measurements FACCH (fast associated control channel): for preemptive signaling on a traffic channel, eg, for handoff messages

55. #55EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Logical Channels, cont… FACCH (fast associated control channel): for preemptive signaling on a traffic channel, eg, for handoff messages

56. #56EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers  International mobile station equipment identity (IMEI). IMEI= TAC + FAC + SNR + SP — TAC = Type Approval Code, 6 decimals — FAC = Final Assembly Code, 6 decimals, assigned by manufacturer — SNR = Serial Number, 6 decimals, assigned by manufacturer — SP = Spare, 1 decimal place  EIR has while, black and optionally grey list

57. #57EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers, cont…  International mobile Subscriber Identity (IMSI). Stored on the SIM (Subscriber Identity Module) card. IMSI is obtained at the time of subscription. IMSI is not made public.  IMSI = MCC + MNC + MSIN  MCC = Mobile Country Code, 3 decimals  MNC = Mobile Network Code, 2 decimals

58. #58EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers, cont…  MSIN = Mobile Subscriber Identification Number, maximum 10 decimal digits  Mobile Station ISDN number (MSISDN), is the real phone number of the subscriber. Stored in HLR and on SIM card  MSISDN = CC + NDC + SN  CC = Country Code, up to 3 decimals

59. #59EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers, cont…  NDC = National Destination Code, typically 2-3 decimals  SN = Subscriber Number, maximum 10 decimals.  Mobile Station Roaming Number (MSRN), same format as MSISDN. A temporary location dependent ISDN number.  Is assigned in two cases, at registration or at call set up.

60. #60EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers, cont…  Location Area Identity (LAI). Regularly sent on BCCH LAI = CC + MNC + LAC,  LAC = Location Area Code, max 5 decimals (<FFFF hex ).  Temporary Mobile Subscriber Identity (TMSI). Stored only in the VLR and SIM card. Consists of 4*8 bits excluding value FFFF FFFF hex

61. #61EETS 8316/NTU TC 745, Fall 2003 ENGINEERINGSMU GSM Numbers, cont…  TMSI has only local meaning and can be defines according to operator’s specifications.  LAI + TMSI uniquely identifies the user, I.e. IMSI is no longer needed for ongoing communication