Mobile Computing

1. Mobile Computing GSM

2. GSM: System Architecture

3. Overview of GSM Network Infrastructure Um A-bis A SS 7 BTS BSC MSC/VLR PSTN/ISDN X.25 MS HLR/AUC OMC Data Terminal Operations Terminal Mobile Stations Radio sub-system Network sub-system PSTN/ISDN

4. Network Interfaces • “Um” radio interface MSBTS • Mechanism for radio transmission (FDMA, TDMA) • A-bis interface – Wired PCM BTSBSC • Contains 16 to 64 connections • A interface – Wired PCM • Circuit switched PCM-carrying 30 64 kbps connectionsBSC MSC • O interface - X.25 link BSC OMC • Uses SS7MSC PSTN/ISDN

5. GSMSub-Systems • Radio Sub System (RSS) • RSS = MS + BSS • BSS = BTS+ BSC • Network Sub System (NSS) • NSS = MSC+ HLR + VLR + GMSC • Operation Sub System • OSS = EIR + AuC

6. GSM System Hieararchy GSM Network . . . . MSC R. MSC Region (PLMN) Location Area LocationArea BSC BSC . . . . . . . . LocationArea MSC R.

7. Mobile Station (MS) • MS consists of following two components • Mobile Equipment (ME) • Mobile Subscriber Identity Module (SIM) • Removable plastic card • Stores Network Specific Data such as list of carrier frequencies and current LAI. • Stores International Mobile Subscriber Identity (IMSI) + ISDN • Stores Personal Identification Number (PIN) & Authentication Keys. • Also stores short messages, charging information, telephone book etc. • Allows separation of user mobility from equipment mobility

8. Base Transceiver Station (BTS) • One per cell • Consists of high speed transmitter and receiver • Its transmit power decides size of cell • Function of BTS • Provides two channels • Signalling and Data Channel • Performs error protection coding for the radio channel

9. Base Station Controller (BSC) • Controls multiple BTS • Functions of BSC • Performs radio resource management • Assigns and releases frequencies and time slots for all the MSs in its area • Reallocation of frequencies among cells • Hand over protocol is executed here • Time and frequency synchronization signals to BTSs • Time Delay Measurement and notification of an MS to BTS • Power Management of BTS and MS

10. Mobile Switching Center (MSC) • Switching node of a PLMN • Registration, Authentication, location updating, handovers and call routing • Mobility of subscribers • Location registration of subscriber • There can be several MSCs in a PLMN

11. Gateway MSC (GMSC) • Connects mobile network to a fixed network • Entry point to a PLMN • Usually one per PLMN • Request routing information from the HLR and routes the connection to the local MSC

12. HLR/VLR • HLR - Home Location Register • For all users registered with the network, HLR keeps user profile. Logically only one HLR per PLMN • Persistent storage of user data • MSCs exchange information with HLR • When MS registers with a new GMSC, the HLR sends the user profile to the new MSC • Includes information like • Current location of user • Authentication data • Service provisioning information • Power on status

13. HLR/VLR • VLR - Visitor Location Register • VLR is responsible for a group of location areas, typically associated with an MSC • Contains temporary information needed for call control typically copied from HLR. • When subscriber enters a new MSC, VLR associated with that MSC requests user info from corresponding HLR

14. AuC/EIR/OSS • AuC: Authentication Center • is accessed by HLR to authenticate a user for service • Contains authentication and encryption keys for subscribers • EIR: Equipment Identity Register • allows stolen or fraudulent mobile stations to be identified • Operation subsystem (OSS): • Operations and maintenance center (OMC), network management center (NMC), and administration center (ADC) work together to monitor, control, maintain, and manage the network

15. GSM Protocol Stack CC SMS SS CC SMS SS MM MM RR RR RR LAPDm LAPD LAPD LAPD LAPD LAPD radio A-law PCM A-law PCM A-law PCM A-law PCM radio MS MSC BTS BSC

16. GSM Protocol Stack • Radio sublayer • Multiplexing of bursts into TDMA frames • Synchronization with BTS • Modulation and encryption/decryption of data • Error detection/correction • Special Functions: VAD and CNG • LAPDm • Signaling between GSM entities need upper layer • Light weight Link Access Procedure for D channel • Offers reliable data transfer over connections, re-sequencing of frames, flow control

17. GSM Protocol Stack • Radio resource management (RR) sublayer • Establishment, maintenance, and termination of radio channel connections • Mobility management (MM) sublayer • Registration, authentication, and location tracking, Assignment of TMSI • Call control (CC) sublayer • Establishment, maintenance, and termination of circuit-switched calls • SMS • Allows message transfer • SS • Supplementary Services like call forwarding, call redirection, multi party communication etc

18. Discontinuous Transmission • On an average speech actually lasts only 50% of the time. • So transmitter is kept off whenever there is no speech. • This reduces co-channel interference and saves battery power. • Voice Activity Detector (VAD) is used at the transmitter, and Comfort Noise Generation (CNG) is used at the receiver.

19. VAD • Background noise is stationary over relatively long periods. • Measure the deviations from the spectral characteristics of • the background noise. • CNG • Comfort noise characteristics are matched to the transmitted • noise.

20. Air Interface: MS to BTS • Uplink/Downlink of 25MHz • 890 -915 MHz for Up link • 935 - 960 MHz for Down link • Combination of frequency division and time division multiplexing • FDMA • 124 channels of 200 kHz • TDMA • Burst • Modulation used • Gaussian Minimum Shift Keying (GMSK)

21. Number of channels in GSM • Freq. Carrier: 200 kHz • TDMA: 8 time slots per freq carrier • No. of carriers = 25 MHz / 200 kHz = 125 • Max no. of user channels = 125 * 8 = 1000 • Considering guard bands = 124 * 8 = 992 channels

23. TDMA Bursts in GSM • The normal burst (NB): Used to carry information on traffic and control channels, except for RACH. It contains 116 encrypted bits. • The frequency correction burst (FB): Used for frequency synchronization of the mobile. The contents of this burst are used to calculate an unmodulated, sinusoidal oscillation, onto which the synthesizer of the mobiles is clocked. • The synchronization burst (SB): Used for time synchronization of the mobile. It contains a long training sequence and carries the information of a TDMA frame number. • The access burst (AB): Used for random access and characterized by a longer guard period (256 ms) to allow for burst transmission from a mobile that does not know the correct timing advance at the first access to a network (or after handover). • The dummy burst (DB): Transmitted as a filler in unused timeslots of • the carrier; does not carry any information but has the same format as • a normal burst (NB).

24. TDMA Bursts in GSM 3 39 data 64 bit Training seq 39 data 3 8.25 142 fixed bits 3 3 8.25 FB SB Dummy Burst 3 26 bit Training seq 3 8.25 8 41 bit Training seq 36 data 3 68.25 Access Burst

25. Normal Burst Tail bit 3 57 Data bits 26 bit Training seq 57 Data bits 3 8.25 Bit GP Stealing Flags Fig.

27. Logical Channels Note: These logical channels are then mapped onto Physical channels. A GSM Physical channel comprises a particular timeslot on a given freq. Channel.

28. Signalling channel contd. .... • BCH : • Broadcast Control Channel (BCCH) • Frequency Correction Channel (FCCH) • Synchronization Channel (SCH) • CCH : • Random Access Channel (RACH) • Paging Channel (PCH) • D/ACCH • Stand-alone Dedicated Control Channel (SDCCH) • Slow Associated Control Channel (SACCH)

29. 1 1 2 2 3 3 4 4 5 5 6 6 7 7 8 8 Reasons for Simple Transceiver Hardware 1) Uplink and downlink are separated in frequency 2) Gap of 3 slots in uplink and downlink slots Downlink Delay Uplink So the MS does not have to Transmit and Receive at the same time instance!

30. Adaptive Frame Synchronization • Timing Advance: • MS advances its burst transmission by a time corresponding • to round trip time. • The delay is quantiled as a 6 bit number. • => 64 steps (0-63); each step advances the Timing by one • bit duration ie 3.7 ms. • 64 steps allows compensation over a maximum propagation • time of 31.5 bit periods ie 113.3 ms ( => a maximum distance • of ~ 35 km)

31. Timing Advance : How it works. (Sent by BS on down link) 1 2 3 4 5 6 7 8 ||||| ||||| ||| |||| 8 1 2 3 4 5 6 7 One way Propagation delay ||| (received by BS on up link) Twowaypropagation delay (received by MS on down link) ||||| 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 (Sent by MS on up link)

32. In the GSM cellular mobile phone standard, timing advance value corresponds to the length of time a signal from the mobile phone takes to reach the base station. GSM uses TDMA technology in the radio interface to share a single frequency between several users, assigning sequential timeslots to the individual users sharing a frequency. Each user transmits periodically for less than one-eighth of the time within one of the eight timeslots. Since the users are various distances from the base station and radio waves travel at the finite speed of light, the precise time at which the phone is allowed to transmit a burst of traffic within a timeslot must be adjusted accordingly. Timing Advance (TA) is the variable controlling this adjustment. Technical Specifications 3GPP TS 05.10 and TS 45.010 describe the TA value adjustment procedures. The TA value is normally between 0 and 63, with each step representing an advance of one bit period (approximately 3.69 microseconds). With radio waves traveling at about 300,000,000 meters per second (that is 300 meters per microsecond), one TA step then represents a change in round-trip distance (twice the propagation range) of about 1,100 meters. This means that the TA value changes for each 550-meter change in the range between a mobile and the base station. This limit of 63 × 550 meters is the maximum 35 kilometers that a device can be from a base station and is the upper bound on cell placement distance.

33. GSM: Identification • Identification of Mobile Subscriber • International Mobile Subscriber Identity (IMSI) • Temporary MSI (TMSI) • Mobile Subscriber ISDN number (MSISDN) • Mobile Station Roaming Number (MSRN) • Identification of Mobile Equipment • International Mobile Station Equipment Identification (IMEI) • Identification of Location • Location Area Identifier (LAI) • Cell Identifier (CI)

34. IMSI • International Mobile Subscriber Identity • Stored in SIM, not more than 15 digits • 3 digits for Mobile Country Code (MCC) • 2 digits for Mobile Network Code (MNC) • It uniquely identifies the home GSM PLMN of the mobile subscriber. • Not more than 10 digits for National Mobile Subscriber Identity Number(MSIN) • The first 3 digits identify the logical HLR-ID of the mobile subscriber • MNC+MSIN makes National Mobile Station Identity (NMSI)

35. TMSI and LMSI • Temporary Mobile Subscriber Identity • Has only local and temporal significance • Is assigned by VLR and stored there only • Is used in place of IMSI for security reasons • Together with LAI & TMSI uniquely identifies a subscriber • Local Mobile Subscriber Identity • Is an additional searching key given by VLR • It is also sent to HLR • Both are assigned in an operator specific way

36. MSISDN • “real telephone number” of a MS • It is stored centrally in the HLR • MS can have several MSISDNs depending on SIM • It follows international ISDN numering plan • Country Code (CC): upto 3 decimal places • National Destination Code (NDC): 2-3 decimal places • Subscriber Number (SN) : maximal 10 decimal places • MSISDN = CC + NDC + SN • Example - +91 98 25 6 68888 (CC NDC OPCode Level Code SubId)

37. IMEI & EIR • International Mobile Station Equipment Identity • Uniquely identifies mobile equipment internationally • IMEI = TAC + FAC + SNR + SP • Type Approval Code: 6 decimal places centrally assigned • Final Assembly Code: 6 decimal places assigned by manufacturer • Serial Number: 6 decimal places assigned by manufacturer • Spare : 1decimal place • Is registered by the Network operator and stored in Equipment Identity Register (EIR)

38. MSRN • Mobile Station Roaming Number • Temporary location-dependent on ISDN number • Calls are routed to MS by using MSRN • Is assigned by locally responsible VLR to each MS in its area • Is done either at each registration or when HLR requests it for setting up a connection for incoming call • Is done in such a way that current MSC can be determined from it • Structure same as that of MSISDN

39. LAI • Location Area Identifier of an LA of a PLMN • Based on international ISDN numering plan • Country Code (CC): 3 decimal digits • Mobile Network Code (MNC): 2 decimal digits • Location Area Code (LAC) : maximum 5 decimal digits • Is broadcast regularly by the BTS on broadcast channel

40. Cell Identifier (CI) • Within LA, individual cells are uniquely identified with Cell Identifier (CI). • It is maximum 2*8 bits • LAI + CI = Global Cell Identity

41. Outgoing call setup • User keys in the number and presses send • Mobile transmits request on uplink signaling channel • If network can process the call, BS sends a channel allocation message • Network proceeds to setup the connection • Network activity: • MSC determines current location of target mobile using HLR, VLR and by communicating with other MSCs • Source MSC initiates a call setup message to MSC covering target area

42. Incoming call setup • Target MSC initiates a paging message • BSs forward the paging message on downlink channel in coverage area • If mobile is on (monitoring the signaling channel), it responds to BS • BS sends a channel allocation message and informs MSC • Network activity: • Network completes the two halves of the connection

43. 1. MSISDN LA2 ISDN 4. MSRN BSC MS GMSC/IWF BTS 2. MSISDN MSC 3. MSRN 7. TMSI 7. TMSI EIR BSC AUC HLR VLR BTS LA1 7. TMSI 5. MSRN BTS 6. TMSI MS 8. TMSI GSM call routing

44. Handover and Roaming Roaming Handover MSC MSC HLR HLR VLR AC VLR AC

45. GSM roaming • VLR registers users roaming in its area • Recognizes mobile station is from another PLMN (IMSI Attach) • If roaming is allowed, VLR finds the mobile’s HLR in its home PLMN • Sends location update to new MSC and then to parent HLR. • VLR generates a mobile subscriber roaming number (MSRN) used to route incoming calls to mobile station • MSRN is sent to mobile’s HLR

46. GSM roaming • VLR contains • MSRN • TMSI • Location area where mobile station has registered • Info for supplementary services (if any) • IMSI • HLR or global title • Local identity for mobile station (if any)

47. GSM roaming Example • Assume user’s (A) Mobile No is +919825668990 (Hutch Gujarat) • Case 1 (User roaming in Mumbai) • Somebody from fixed phone dials the above number. • The call will be switched at PSTN network and routed to Hutch network in GJ. The Hutch MSC looks at the HLR and knows that user is in a cellular nw in mumbai. So the call is forwarded to Mumbai. MSC in mumbai will refer the VLR to locate that user. Also informs Hutch MSC/HLR about the MSRN. Charging info is also forwarded once the call is over. Caller Pays for long distance call. • Case 2 (User roaming in Mumbai) • User A wants to call some one in mumbai • The call will be switched at MSC Mumbai network. MSC in mumbai will refer the VLR to locate that user. Charging info is also forwarded once the call is over. But pays for local calling charge.

48. GSM roaming Example • Case 3 (2 Users (‘A’ and ‘B’) roaming in Mumbai) • User ‘A’ wants to call user ‘B’ • The call will be routed to local Hutch MSC in GJ. The Hutch MSC looks at the HLR and knows that user ‘B’ is in a cellular nw in mumbai. So the call is routed back to Mumbai. MSC in mumbai will refer the VLR to locate that user. Charging info for both user is also forwarded once the call is over. Caller and Callee Pays for long distance call. • Optimization is possible.

49. 4 types of handover

50. 4 types of handover 1 2 3 4 MS MS MS MS BTS BTS BTS BTS BSC BSC BSC MSC MSC