1 / 60

Wireless Communication GSM Network Architecture Procedures

Wireless Communication GSM Network Architecture Procedures. Tanvir Ahmad Niazi Tanvir.niazi@mail.au.edu.pk Air University, Islamabad. Objectives. Learning the basic procedures, the main call procedures, mobility and roaming features that GSM operates.

ura
Télécharger la présentation

Wireless Communication GSM Network Architecture Procedures

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Wireless CommunicationGSM Network Architecture Procedures Tanvir Ahmad Niazi Tanvir.niazi@mail.au.edu.pk Air University, Islamabad

  2. Objectives • Learning the basic procedures, the main call procedures, mobility and roaming features that GSM operates. • After completing this lesson you will be able to: • List the GSM procedures that can be activated from MS switch-on until MS switch-off • Explain the main procedures: cell selection, location update, call set-up, call release, handover

  3. Descriptors Stored in SIM-Card

  4. Descriptors Stored in SIM-Card • These descriptors are used in different phases of call setup: • International Mobile Subscriber Identity (IMSI) is the proprietary identifier of the mobile subscriber within the GSM network and is permanently assigned to him; it consists of MCC, MNC and MSIN: • - Mobile Country Code (3 digits) is allocated to the operator country, • - Mobile Network Code (2 or 3 digits) is allocated to each operator, • - Mobile Subscriber Identification Number (8 digits) is allocated by the GSM network (HLR). • GSM network can assign a Temporary Mobile Subscriber Identity (TMSI) to identify the mobile on a local basis (within VLR), allocated to visiting mobile subscribers and correlated with IMSI. • Location Area Identity (LAI) defines a part of a MSC/VLR service area in which a MS can move freely without updating location; it consists of MCC, MNC and LAC. • National Mobile Subscriber Identity (NMSI) consists of the MNC and the MSIN.

  5. Descriptors Stored in the Network

  6. Descriptors Stored in the Network • The Mobile Subscriber ISDN Number (MS-ISDN) is the number that the calling party dials in order to reach the GSM subscriber. It is used by the land networks to route calls toward an appropriate GSM network. MSISDN is stored in HLR. • The Mobile Subscriber Roaming Number (MSRN) is allocated on a temporary basis when the MS roams into another numbering area. Thus the MSRN shall have the same structure as international ISDN number in the area in which it is allocated. Visited MSC allocates a MSRN upon the VLR request which in turn was requested by the HLR. Upon reception of the MSRN, HLR sends it to the GMSC, which can now route the call to the MSC/VLR exchange where the called subscriber is currently registered. • HO number is used for inter-MSC Handovers, to establish a circuit from the serving MSC to the new MSC.

  7. Descriptor Embodied in the MS

  8. Descriptor Embodied in the MS • Stored inside the Mobile Equipment. • Used instead of IMSI or TMSI when both are unavailable (example: Emergency calls without SIM card) or when required by the network (for maintenance). • Can be used for EIR database updating (when it exists): • TAC = 6 digits describing the type of equipment. • FAC = 2 digits for identification of the factory. • SNR = 6 digits for the serial number of the device. • IMEI may be temporary stored within MSC/VLR to minimize signaling within the Network.

  9. Cell Selection

  10. Cell Selection • MS scans the whole spectrum and stores the strongest level carriers (30 in GSM 900, 40 otherwise). • MS tunes to the frequency correction channel (FCCH) of the strongest carrier (BTS-1). • MS reads data from the synchronization channel (SCH). • MS reads data from broadcast channel (BCCH). • MS camps on this BCCH if it is suitable for the MS; otherwise it tries selection on the next strongest beacon carrier.

  11. Immediate Assignment

  12. Immediate Assignment • The Immediate Assignment procedure is always initiated by the MS and may be triggered by a Paging Request or by a Mobile Originating Service request. • Procedure • The MS sends a CHANNEL REQUEST message (RACH). • The BTS decodes this message and indicates it to BSC through CHANNEL REQUIRED message. • The BSC asks BTS to activate a dedicated channel: SDCCH or TCH (if no SDCCH available). • Acknowledgement by BTS • The BSC sends an IMMEDIATE ASSIGNMENT COMMAND message to the MS (via the BTS); the MS has to seize the indicated dedicated channel including these values: initial Timing Advance and initial maximum transmission power. • Then the MS can request a service on the dedicated channel through: • SERVICE REQUEST message including the access reason (call setup, paging etc.), • LOCATION UPDATING REQUEST message for location.

  13. Registration: the Very First Location Update

  14. Registration: the Very First Location Update • Channel allocation (Connection request procedure): • the MS sends (on RACH) a CHANNEL REQUEST message, • the network responds with IMMEDIATE ASSIGNMENT (on dedicated channel). • The MS sends to BSS a LOCATION UPDATING REQUEST message with IMSI. • The VLR triggers and monitors the Authentication procedure and can also activate Ciphering procedure. • The VLR stores the LA of the MS and informs the HLR which: • stores VLR identity, • downloads the subscriber profile, if the MS is allowed to roam. • The VLR may assign a TMSI and sends it to the MS in the LOCATION UPDATING ACCEPT message. • The MSC releases the connection.

  15. Intra-VLR Location Update

  16. Intra-VLR Location Update • Channel allocation (Connection request procedure). • The MS sends to the BSS a LOCATION UPDATING REQUEST message (with TMSI and old LAI), relayed to the VLR through the MSC. • The VLR stores the new Location Area Identity, then if required assigns a new TMSI and responds to the MS with LOCATION UPDATING ACCEPT message. • The MSC releases the connection.

  17. Inter-VLR Location Update

  18. Inter-VLR Location Update • Channel allocation (connection request procedure). • The MS sends to BSS a LOCATION UPDATING REQUEST message, (with TMSI + old LAI) relayed to the VLR through MSC. • The new VLR asks the old VLR for MS identity and ciphering items. • The old VLR backs new VLR IMSI, RAND, SRES, Kc. • The new VLR assigns a TMSI and sends it to the MS over a LOCATION UPDATING ACCEPT message (with cipher mode if required). • The new VLR informs the HLR which sends subscriber data and asks the old VLR to erase the previous MS data. • The MSC releases connection.

  19. IMSI Attach

  20. IMSI Attach • The IMSI attach procedure is used (if required by the network), to indicate the IMSI as active in the network and is performed by using the Location updating procedure. • Procedure • MS requests (on RACH) a dedicated channel with CHANNEL REQUEST message using a random number. • BSS assigns a dedicated channel (on AGCH) with IMMEDIATE ASSIGNMENT message using this random number. • MS sends (over this dedicated channel) a LOCATION UPDATING REQUEST message including its identity and the IMSI Attach cause. • Authentication procedure (if required by the network). • MSC responds by sending a LOCATION UPDATING ACCEPT message. • In the VLR, a flag is set to indicate that the subscriber is active. • This procedure is used only if the update status is updated and if the stored LAI is the same as the one which is actually broadcast on the BCCH of the current serving cell.

  21. IMSI Detach

  22. IMSI Detach • The IMSI detach procedure may be invoked by a MS: • if the MS is switched off, • if the SIM card is detached. • Procedure • MS requests (on RACH) a dedicated channel with CHANNEL REQUEST message. • BSS assigns a dedicated channel (on AGCH) with IMMEDIATE ASSIGNMENT message. • The MS sends IMSI DETach INDication message to the VLR. • The VLR sets a flag to indicate that this MS is no longer available; no paging will be done to that MS until IMSI ATTach occurs.

  23. Authentication

  24. Authentication • Purpose: authentication of the subscriber, to prevent access of unregistered users: • Authentication is performed by requiring from an algorithm A3 the correct answer to a random number input. • Eavesdropping recording of signaling is inefficient since there is never twice the same request. • A3 algorithm is operator-dependent. • Principle • The NSS transmits a non-predictable number RAND to the MS. • The SIM card and the NSS compute the signature SRESm, using algorithm A3, from the RAND and a secret key Ki. • The MS transmits its signature SRESm to the NSS. • The NSS tests the two SRES for validity. • Each time authentication A3 algorithm runs, concurrently A8 algorithm is used to produce a ciphering key Kc.

  25. Authentication

  26. Authentication • Procedure • The VLR sends a Map Send Parameters message to the HLR which relays this • message to the AUC. • The AUC then generates some RAND numbers and applies algorithms A3 and A8 to provide the authenticated signature SRES and the cipher key Kc. • The AUC returns the triplets (RAND, SRES, Kc) to HLR which relays them to the VLR. • The VLR now sends a Map Authenticate message to the MSC which in turn sends to the MS an AUTHENTICATION REQUEST message containing Rand; the Kc is also sent but stops at the BTS. • The SIM-Card calculates the required response SRESm, using RAND, algorithm A3 and authentication key Ki. • The MS returns SRESm to VLR in AUTHENTICATION RESPONSE. • VLR checks SRES = SRESm, then sends to the MSC a MM Service accept message; otherwise VLR denies access: the MS will receive an AUTHENTICATION REQUEST.

  27. Ciphering

  28. Ciphering • Radio path ciphering, in particular ciphering of all subscriber information, aims to prevent third party tapping (eavesdropping). • What is encrypted?: • Signaling (Subscriber Id.). • Speech or data. • The encryption of signaling and user speech or data, is performed at the MS as well as at the BTS (symmetric encryption) using the same Kc and the A5 algorithm. • Each time a Mobile Station is authenticated, this MS and the Network also compute the ciphering key Kc (algorithm A8) with the same inputs RAND and Ki as for the SRES (algorithm A3). The Frame Number FN of the current TDMA frame (within a hyperframe) is another input for the A5 besides the Kc. • The output of Encryption algorithm A5 is a ciphering sequence of 114 bits. Exclusive OR operation is applied between data to be ciphered and the ciphering sequence in order to produce either ciphered or deciphered data. • Algorithm A5 is not operator dependent to achieve international roaming between any Mobile Station and BSS infrastructure whatever the operator.Two types of ciphering algorithms are available: A5/1 et A5/2, but only one ciphering algorithm A5 is supported at a time in a BTS. • The BSC checks the availability of the A5 algorithms in the MS. If the BSS does not support the same ciphering algorithm as the MS, the calls will be unencrypted. The ciphering BSS capability is an O&M parameter defined for all the BTS of the BSC.

  29. Ciphering

  30. Ciphering • Ciphering is normally required for all user transactions over the RF link when the subscriber has been authenticated by the system. It is worth noting that this is an optional feature and it is dependent of the operator. • Procedure • Ciphering begins with the VLR sending the MSC a SET CIPHER MODE (MAP message) containing the value of Kc. • The MSC sends the ciphering key to the BSS (actually the BTS) in a CIPHER MODE COMMAND (BSSMAP message). • The BSS in turn sends an CIPHERING MODE COMMAND (RR message) to the MS. • The MS switches to encrypted transmission and reception, then sends back to BSS an CIPHERING MODE COMPLETE (RR message). • After the BSS receives this message, it switches to encrypted transmission and reception for subsequent burst. • The BSS then sends a CIPHER MODE COMPLETE (BSSMAP message) to the MSC.

  31. Mobile Originating Call

  32. Mobile Originating Call • The MS originates the call by sending a CHANNEL REQUEST message (on RACH). • Immediate assignment: channel allocation with TCH / FACCH or SDCCH. • The VLR launches authentication (if required) and completes ciphering. • The MS initiates call establishment by sending a SETUP message (called party number) to the MSC. • The MSC in turn checks mobile subscriber capabilities with VLR for desired service. • If it agrees, the MSC relays the called number over an ISUP Initial Address Message. • The MSC also sends a CALL PROCEEDING message to the MS (assigning TCH / FACCH EA in case of Early Assignment). • Recipient PSTN switch rings the land telephone and returns an ISUP Address Complete Message to the MSC. • Upon receiving this message, the MSC alerts the MS with an ALERTING message. • Called party goes off hook, thus PSTN sends to the MSC an ISUP ANswer Message. MSC then connects MS (assigning a TCH in case of OACSU). • Call is accepted (CONNECT/CONNECT ACK) and the conversation starts. In case of Emergency MO Call, the SETUP message (basic call) is replaced by the EMERGENCY one.

  33. Mobile Terminating Call

  34. Mobile Terminating Call • Main difference with MO Call procedure is the Paging of the Mobile Station. • When the MS is in Idle mode, the network do not knows the cell but only the Location Area where the MS is located. Since RR sessions are only established at the initiative of the MS, the role of the Paging procedure is to trigger that operation. Principle • Call from the fixed network (PSTN) is switched to the Gateway MSC (GMSC). • The GMSC reads in the HLR the identity of the MSC/VLR (or Visitor MSC) handling the Location Area of the Mobile Station. • The GMSC routes the call to the VMSC. • The VMSC reads the LA where the MS is located, into its VLR. • The VMSC sends instructions to one or several BSC (BSC1 and BSC2) to page the MS in the different cells of LA1. • BSC1 and BSC2 page the MS in the BTSs of the Location Area LA1. (BTS11, BTS12, BTS21).

  35. Mobile Terminating Call

  36. Mobile Terminating Call Procedure • The caller subscriber access the ISDN by dialing the called MS-ISDN number. • Transmission of MS-ISDN number to GMSC through IAM (Initial Address Message). • Transmission of MS-ISDN number to HLR through SRI (Send Routing Information). • The HLR interrogates the VLR (Visitor MSC) that is currently serving the user. • The VLR returns a routing number (MSRN) to the HLR, which passes it back to the GMSC. • The MSRN is transmitted to GMSC (address of appropriate VMSC). • The GMSC calls VMSC through IAM (with MSRN). • The MSC asks VLR to establish where the called party is located. • The VLR gives location information (LA) to MSC with PAGE message. • The VMSC alerts with PAGING REQUEST message, all BSCs in charge of cells belonging to this LA. • All the BTS page the MS over PCH; depending upon the paging type message, up to four different TMSI may be contained in the page command.

  37. Mobile Terminating Call • There are three types of PAGING REQUEST message: • Type 1: sent on the PCH to up two MSs, to trigger channel by these; MSs are identified by their TMSI or IMSI. • Type 2: sent on the PCH to two or three MS; two of the MS are identified by their TMSI while the third is identified either by its IMSI or its TMSI. • Type 3: sent on the PCH to four MS which are identified by their TMSIs.

  38. Mobile Terminating Call

  39. Mobile Terminating Call Procedure • PSTN sends an IAM (with the MSISDN) to the GMSC. • GMSC sends an IAM (with the MSRN) to the VMSC. • The VMSC sends a PAGING REQUEST MM message to the BSS. • The BSS sends a PAGING REQUEST (with IMSI or TMSI) to the MS. • The MS must request a channel (CHANNEL REQUEST message with paging cause) over the RACH, within 0.5 second. • The BSS complies and assigns (on AGCH) a dedicated channel to the MS with IMMEDIATE ASSIGNMENT message. • The MS sends a PAGING RESPONSE to the VMSC via the BSS. • Authentication and Ciphering procedures (if required). • Setup, Assignment, Alerting procedures (see MS Originating Call). • Alerting is sent to PSTN with an ACM (ISUP message). • CONNECT and ANM messages are sent to the PSTN: call is completed.

  40. Call Release

  41. Call Release • Call release can be initiated by either the PSTN user or the mobile user. BSC is responsible for BSS resources, MSC is responsible for NSS and PSTN connection. Procedure • Call is currently in progress. • The MS initiates the release of a call by sending a DISCONNECT message to the MSC. • The MSC returns to the MS a RELEASE message. • The MS acknowledges with a RELEASE COMPLETE message. • The MSC can send the Release message to the PSTN without waiting for the RELEASE COMPLETE MM message from the MS. • The BSC requests the MS to return to Idle mode with CHANNEL RELEASE message. • The BTS informs the BSC with RELEASE INDICATION that signaling link is disconnected. • BSC requests BTS to de-activate RF Channel (TCH): Channel Release. • The PSTN informs the land terminal with appropriate tone. • Abnormal termination is monitored by a set of timers (operator configurable) to ensure resources are not unused/unavailable.

  42. Call Release

  43. Call Release Procedure • The call is in progress. • The release process starts with an ISUP Release message from the land network. • Upon receiving this message, the MSC initiates the release of the call by sending a DISCONNECT message to the MS. • MS replies by sending a RELEASE CHANNEL message to the MSC. • MSC in turn, backs to the MS a RELEASE COMPLETE message and sends to the PSTN a Release Complete message.

  44. Reasons for Handover

  45. Reasons for Handover Decision criteria • Bad quality. • Weak signal strength. • Cell boundaries (Distance). • Power budget (optimization). • Traffic constraints.

  46. Mobility and Handover

  47. Mobility and Handover • Intra-Cell Handover: the MS is handed over to another channel on the same cell, under the same BTS. • Intra-BTS Handover: the MS is handed over to another channel on a different cell, under the control of the same BTS. • Intra-BSC Handover: the MS is handed over to another channel on a different cell, under the control of a different BTS of the same BSC. • Inter-BSC Handover: the MS is handed over to another channel on a different cell, under the control of a different BSC of the same MSC. • Inter-MSC Handover: the MS is handed over to another channel on different cell, under another MSC of the same PLMN.

  48. Handover Preparation

  49. Handover Preparation • To avoid losing a call in progress, when the Mobile Station leaves the radio coverage of the cell in charge. • Procedure: Three steps: • Handover decision (based on measurements results). • Choice of the target cell. • Handover execution. • Handover topology • Intra BTS (intra and inter cell). • Inter BSC. • Inter MSC including (subsequent). • Microcellular environment.

  50. Handover Decision

More Related