GSM: system architecture

Transcription

1 SS7 GSM: system architecture radio subsystem network and switching subsystem fixed partner networks MS MS U m MSC ISDN PSTN BTS BTS A bis BSC EIR HLR BTS BTS BS S BSC A MSC IWF VLR ISDN PSTN PSPDN CSPDN

2 System architecture: radio subsystem radio subsystem MS BTS BTS BTS BTS BSS MS U m A bis BSC BSC A network and switching subsystem MSC MSC Components MS (Mobile Station) BSS (Base Station Subsystem): consisting of BTS (Base Transceiver Station): sender and receiver BSC (Base Station Controller): controlling several transceivers Interfaces U m : radio interface A bis : standardized, open interface with 16 kbit/s user channels A: standardized, open interface with 64 kbit/s user channels

3 SS7 System architecture: network and switching subsystem MSC network subsystem EIR fixed partner networks ISDN PSTN Components MSC (Mobile Services Switching Center): IWF (Interworking Functions) ISDN (Integrated Services Digital Network) PSTN (Public Switched Telephone Network) PSPDN (Packet Switched Public Data Net.) CSPDN (Circuit Switched Public Data Net.) MSC IWF HLR VLR ISDN PSTN PSPDN CSPDN Databases HLR (Home Location Register) VLR (Visitor Location Register) EIR (Equipment Identity Register)

4 Radio subsystem The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers Components Base Station Subsystem (BSS): Base Transceiver Station (BTS): radio components including sender, receiver, antenna - if directed antennas are used one BTS can cover several cell-areas Base Station Controller (BSC): switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (U m ) onto terrestrial channels (A interface) BSS = BSC + sum(bts) + interconnection Mobile Stations (MS) Page 4

5 GSM: cellular network possible radio coverage of the cell cell idealized shape of the cell use of several carrier frequencies not the same frequency in adjoining cells cell sizes vary from some 100 m up to max 35 km (due to time advance restriction of 6 bit) depending on user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) if a mobile user changes cells handover of the connection to the neighbor cell

6 Example coverage of GSM networks ( T-Mobile (GSM-900/1800) Berlin Vodafone (GSM-900/1800) e-plus (GSM-1800) O 2 (GSM-1800) Page 6

7 Base Transceiver Station and Base Station Controller Tasks of a BSS are distributed over BSC and BTS BTS comprises radio specific functions BSC is the switching center for radio channels Functions BTS BSC Management of radio channels X Frequency hopping (FH) X X Management of terrestrial channels X Mapping of terrestrial onto radio channels X Channel coding and decoding X Rate adaptation X Encryption and decryption X X Paging X X Uplink signal measurements X Traffic measurement X Authentication X Location registry, location update X Handover management X Page 7

8 Mobile station 1 Terminal for the use of GSM services A mobile station (MS) comprises several functional groups MT (Mobile Termination): offers common functions used by all services the MS offers corresponds to the network termination (NT) of an ISDN access end-point of the radio interface (U m ) TA (Terminal Adapter): terminal adaptation, hides radio specific characteristics TE (Terminal Equipment): peripheral device of the MS, offers services to a user does not contain GSM specific functions SIM (Subscriber Identity Module): personalization of the mobile terminal, stores user parameters TE TA MT R S Page 8 U m

9 Mobile station 2 Each MS contains an International Mobile Equipment Identity (IMEI) The SIM personalizes a MS Contains Information for: authentication Key Accounting data Personal numbers Contract and service details PIN PUK International Mobile Subscriber Identity (IMSI) after being connected: Key for data encryption Temporary Mobile Subscriber Identity (LMSI) Location Area Identity (LAI) Transmit power for GSM 900 2W for GSM1800 1W Page 9

10 Network and switching subsystem NSS is the main component of the public mobile network GSM switching, mobility management, interconnection to other networks, system control; inter BSS Handover; inter MSC Handover, international location of terminals; roaming between network-operators Components Mobile Services Switching Center (MSC) controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC Has mainly same task as ISDN switch Databases (important: scalability, high capacity, low latency) Home Location Register (HLR) central master database containing all user data, permanent and semipermanent data of all subscribers assigned to the HLR (one provider can have several HLRs, but consider virtually as a distributed system) Visitor Location Register (VLR) local database for a subset of user data, including data about all user currently in the domain of the VLR Page 10

11 Mobile Services Switching Center The MSC (mobile switching center) plays a central role in GSM switching functions additional functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) access to several databases Functions of a MSC specific functions for paging and call forwarding termination of SS7 (signaling system no. 7) mobility specific signaling location registration and forwarding of location information provision of (new) services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing information Page 11

12 Operation subsystem The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems Components Authentication Center (AUC) generates user specific authentication parameters on request of a VLR authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system Equipment Identity Register (EIR) registers GSM mobile stations and user rights stolen or malfunctioning mobile stations can be locked and sometimes even localized Operation and Maintenance Center (OMC) different control capabilities for the radio subsystem and the network subsystem using TMN (Telecommunication Management Network) Page 12

13 Air Interface Facts and Figures: Uses many of the introduced Multiplexing technologies SDMA for Cell structure and multi-segment BTS FDD for separation between up and down channel TDMA for more users per radio channel GSM900: 124 carrier frequencies for up and 124 frequencies for down channel, 200 khz/channel; channel 1 and 124 not used; 32 channels used for OAM purposes GSM1800: 2*374 carrier frequencies for up/down with 200KHz ea ch Frame structure: duration 4,615 ms 8 time slots of 577ms each TDMA shift: each logical channel will be shifted be 3 time-slots in up and down direction Data Burst: 546 ms+ 30,5 ms guard time for different path delays; theoretical throughput 33,8 kb/s Page 13

14 GSM - TDMA/FDMA MHz 124 channels (200 khz) downlink GSM TDMA frame MHz 124 channels (200 khz) uplink higher GSM frame structures time ms guard space GSM time-slot (normal burst) tail user data S Training S user data tail 3 bits 57 bits 1 26 bits 1 57 bits 3 guard space µs 577 µs

15 Burst Structure Each data-burst contains: Training sequence of 26 bit 2 data fields of 57 bits + 1control bit each 2 tail sequences of 3 bit each set to 0 for modulation control Other bust types: Access Burst: for connection establishment Synchronization Burst Frequency Correction Burst Dummy Burst Page 15

16 Logical Channels 1 Two different logical channels: Traffic channel (TCH) Control channel (CCH) Traffic Channel Types: Full-Rate (TCH/F) 22,8 kb/s 13kb/s for speech coding Rest for FEC Half-Rate 11,4 kb/s 5,6 kb/s for speech coding Rest for FEC For data transmission TCH/4.8; TCH/9.6; TCH/14.4 (TCH/FS) (TCH/HS) Using different coder and FEC mechanisms Page 16

17 Logical Channels 2 Control Channel Types Used for Media Access und User Mobility 3 types of control channel (with several sub-types): Broadcast Control Channel (BCCH) Data to all MS in a cell Contains Cell-ID; Frequency Hopping type; available frequencies in this cell, adjacent cell frequencies Subtypes: Frequency Correction Channel (FCCH); Synchronization Channel (SCH) Common Control Channel (CCCH) BTS/MS connection establishment data Paging channel (PCH) for BTS to MS call Random Access Channel (RACH) for MS connection request Access Grant Channel (AGCH) for BTS to MS channel association Page 17

18 Logical Channels 3 Dedicated Control Channel (DCCH) Bidirectional Channels Stand Allone DCH (SDCCH) for signalling between MS and BTS Slow Associated Control Channel (SACCH)(for each TCH and SDCCH) Fast Associated Control Channel (FACCH) (uses time slots of regular TCHs) Page 18

19 Frame Structure Not all combinations of frames are permitted: Each TCH/F is associated with a SACCH TTTTTTTTTTTTSTTTTTTTTTTTTXTTTTTTTTTTTTS 12* TCH 12* TCH 12* TCH 26 Slots Data Rate of TCH/F = 24/26*24,7kb/s= 22,8 kb/s Data Rata of SACCH= 1/26*24,7kb/s= 950b/s Page 19

20 GSM hierarchy of frames hyperframe h 28 min s superframe s multiframe slot burst frame 120 ms Traffic multiframe ms Control multiframe ms 577 µs Page 20

21 GSM protocol layers for signaling U m A bis A MS BTS BSC MSC CM CM MM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s CM: Call Management; MM: Mobility Management; RR: Radio Resource LAPD: Line Access Protocol; PCM: Pulse Code Modulation; BSSAP BSS Application Part; BTSM: BTS Management; SS7 Signaling System 7 Page 21

22 Tasks of the different protocol layers 1 Physical Layer: All radio specific functions Generation of Burst-typs; Generation of TDMA-frame; Synchronisation with BTS, Free channel detection; Measurement of channel quality GMSK is used as modulation (Gausscian Minimal Shift Keying) Coding and FEC Voice Activity detection /Comfort Noise generation Interleaving for minimizing burst error influence (scrambling) Coding and Interleaving causes an additional delay of ms. For Internet services that might have bad impact on TCP performance Encryption function for transmission to BTS (no protection between users but only transport protection for all data transmission together) Synchronization: Contains the correction of individual path delays Time advance determines the number of 3,69 ms slots the MS has to send the signal earlier; the time advance value can go up to 63 (Cell-Size max =63*3,69ms*3*10 5 km/s/2=35 km) Allows to reduce Guard Time to 5% of bust-time and increases throughput Page 22

23 Tasks of the different protocol layers 2 LAPD m for signalling on layer 2: Derivate of Link Access Procedure for D-channel of ISDN Reduced LAPD protocol No synchronization and no CRC (already on layer 1 in GSM) Offers reliable data-transport, is connection oriented, preserves the order, conducts flow-control Offers segmentation and reassembly of data-packets as well as confirmed and unconfirmed messaging Network-Layer (switching layer) Contains several sub-layer Radio Resource Management (RR) Controls the use of the radio frequencies; uses the BTSM to access radio quality parameters directly; offers a reliable data transmission service to next higher layer Mobility Management (MM) Contains functions for registration; authentication; deviceidentification; location-update; TMSI management; offers a reliable transmission service to next higher sub-layer Page 23

24 Tasks of the different protocol layers 3 Call Management (CM) Contains functions for Call Control (CC), Short Message Service (SMS) and supplementary services (SS) CC offers point to point service between to terminals; in band signalling using DTMF (Dual Tone Multiple Frequencies). (DTMF cannot be transmitted via ordinary TCH cannels because the speech coding would influence the signalling tones) SMS uses control channels SDCCH and SACCH if no other signalling data has to be transmitted Additional Signalling Protocols Between BTS and BCS A bis Between BCS und MSC A Both protocols use PCM modulation with 64 transparent channels 4*16kb/s channels are co-located in a single PCM channel via A bis From BCS to MSC Primary multiplex channel of 2Mb/s are often available. Often dedicated microwave links are used LAPD is used on layer 2 for signalling Page 24

25 Mobile Terminated Call 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN (Mobile Subscriber Roaming Number) from VLR 6: reply to responsible GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection 18, 19, 20: set-up confirmation calling station HLR PSTN GMSC VLR MSC BSS BSS BSS MS Page 25

26 Mobile Originated Call 1, 2: connection request 3, 4: security check 5-8: check resources (free circuit) 9-10: set up call PSTN 6 5 GMSC 7 8 VLR 3 4 MSC 2 9 MS 1 10 BSS Page 26

27 Information necessary for localization Mobile Subscriber International ISDN Number (MSISDN) Consists of country code (CC); National Destination Code (NDC); Subscriber Number (SN) Is the only number of use for the subscriber International Mobile Subscriber Identity (IMSI) GSM internal unique identification number; consists of Mobile Country Code (MCC); Mobile Network Code (MNC); Mobile Subscriber Identity (MSI) Temporary Mobile Subscriber Identity (TMSI) To hide user identity; TMSI given by VLR; valid only in Local Area (LA); TMSI and LAI can identify a user uniquely Can be changed on demand of either BCS or MS Mobile Station Roaming Number (MSRN) Hide user identity and location; VLR generates MSRN on demand of MSC; is stored as part of the HLR of each active user; MSRN contains Visitor Country Code (VCC); Visitor National Destination Number (VNDC); actual MSC ID and subscriber number Page 27

28 MTC/MOC MS MTC BTS paging request channel request immediate assignment paging response authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange MS MOC BTS channel request immediate assignment service request authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange Page 28

29 4 types of handover MS MS MS MS BTS BTS BTS BTS BSC BSC BSC MSC MSC Page 29

30 Handover decision receive level BTS old receive level BTS old HO_MARGIN MS MS BTS old BTS new Trade-off for HO_Margin If HO_Margin to high the connection can be lost If HO_Margin to low the handover overhead increases dramatically Solution: relative low HO_Margin and defined Hysteresis Value Page 30

31 MS measurement report BTS old measurement result Handover procedure (Make before Brake) BSC old MSC BSC new BTS new HO command HO decision HO required HO command HO command HO access Link establishment clear command clear command clear complete clear complete HO request resource allocation ch. activation HO request ack ch. activation ack HO complete HO complete After the link is established the MS has no further influence on the old resources Page 31