Mobile Communications Chapter 4: Wireless Telecommunication Systems

Transcription

1 Mobile Communications Chapter 4: Wireless Telecommunication Systems Market GSM Overview Services Sub-systems Components GPRS DECT Not a part if this course! TETRA Not a part if this course! w-cdma (rel 99), IMT2000 Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.1

2 It all started like this The first car mounted radio telephone First commercial mobile radio-telephone service by Bell and AT&T in Saint Louis, USA. Half duplex 1973 First handheld cellular phone Motorola First cellular net in Bahrein 1979 NMT at 450MHz (Scandinavian countries) 1992 Start of GSM Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.2

3 Basic Definitions Forward Link, Downlink, Downstream The path from the network or base station to the mobile GSM terminology uses Downlink CDMA, AMPS and TDMA use Forward Link Most wireline technologies use Downstream Reverse Link, Uplink, Upstream The path from the mobile to the network or base station GSM terminology uses Uplink CDMA, AMPS and TDMA use Reverse Link Most wireline technologies use Upstream Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.3

4 Duplex Techniques Frequency Division Duplex (FDD), Time Division Duplex (TDD) time Reverse Link Forward Link GSM UMTS FDD Reverse Link time Forward Link TDD Reverse Link Forward Link Frequency channels Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.4

5 GSM 1982 The GSM group was formed 1986 Field trials in France 1987 TDMA was chosen as access method 1988 Memorandum of understanding -18 countries 1991 Phase I specifications published 1990 GSM specifications ported to DCS Official commercial launch of GSM in Europe 1995 GSM specifications ported to PCS Responsibility for GSM Standard transferred to 3GPP (3rd Generation Partnership Project) Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.5

6 GSM frequency bands 900 MHz 2*25 MHz Bands 45 MHz Duplex Spacing 125 carriers 1800 MHz 2*75 MHz Bands 95 MHz Duplex Spacing 375 carriers 1900 MHz 2*60 MHz Bands 80 MHz Duplex Spacing 300 carriers MHz Uplink MHz Downlink MHz Uplink MHz Downlink MHz Uplink MHz Downlink North America Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.6

7 SYSTEM ARCHITECTURE GSM is a PLMN (Public Land Mobile Network) PSTN GMSC HLR AUC EIR ISDN MS MSC PLMN VLR BSC BSC BTS BTS MSC OMC VLR AUC: OMC: BTS: BSC: EIR: GMSC: HLR: MS: MSC: VLR: AUthentication Center Operation and Managing Center Base Tranciver Staition Base Station Controller Equipment Identity Register Gateway MSC Home Location Register Mobile Station Mobile Switching Center Visiting Location Register Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.7

8 GSM: elements and interfaces The Radio Station Subsystem (RSS) - The Wireless Part U m radio cell MS MS radio cell Base Transceiver Station (BTS), cell coverage, comprises radio specific functions RSS BTS MS BTS Base Station Controller (BSC) controls several BTSs, the switching center for radio channels NSS OSS A bis Functions BTS BSC BSC BSC Management of radio channels X A Frequency hopping (FH) X X Management of terrestrial channels X MSC MSC Mapping of terrestrial onto radio channels X Channel coding and decoding X signaling VLR VLR Rate adaptation X ISDN, PSTN Encryption and decryption X X HLR GMSC PDN Paging X X IWF Uplink signal measurements X O Traffic measurement X EIR AUC OMC Authentication X Location registry, location update X Handover management X Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.8

9 GSM: elements and interfaces MS radio cell MS BSS U m radio cell RSS BTS MS A bis BTS Network Switching SubSystem NSS A BSC VLR MSC HLR O BSC VLR MSC GMSC IWF signaling ISDN, PSTN PDN NSS is the main component of the public mobile network GSM switching, mobility management, interconnection to other networks, system control OSS EIR AUC OMC Prof. Dr.-Ing. Jochen Schiller, MC SS02 4.9

10 GSM: elements and interfaces The Network Switching Subsystem (NSS) - U m radio cell MS MS BSS radio cell The Mobile Switching Centre (MSC) manages a large number of BSCs RSS BTS MS BTS Gateway Mobile Switching Centre (GMSC) is the gateway to other networks A bis Various Registers (data bases) A BSC MSC BSC MSC Signalling messages and data base accesses are transported by the Signalling System Nr. 7 (SS7) using the Mobile Application Part (MAP) NSS VLR HLR O VLR GMSC IWF signaling ISDN, PSTN PDN OSS EIR AUC OMC Prof. Dr.-Ing. Jochen Schiller, MC SS

11 GSM: elements and interfaces The MSC plays a central role in GSM U m MS radio cell MS BSS radio cell controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC RSS A bis BTS MS BTS switching functions additional functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) integration of several databases BSC BSC A MSC MSC Functions of a MSC NSS OSS VLR EIR HLR AUC O OMC VLR GMSC IWF signaling ISDN, PSTN PDN specific functions for paging and call forwarding mobility specific signaling location registration and forwarding of location information support of short message service (SMS) generation and forwarding of accounting and billing information Prof. Dr.-Ing. Jochen Schiller, MC SS

12 GSM: elements and interfaces radio cell MS MS BSS Home Location Register (HLR) Central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR RSS U m BTS radio cell MS BTS * usually one HLR per provider * primarilly a data base for subscriber data. * Subscriber identifiers service profiles, etc. * Localization information (current VLR, MSC) * Is a platform for all kinds of services A bis BSC BSC NSS OSS A VLR EIR MSC HLR AUC O OMC VLR MSC GMSC IWF signaling ISDN, PSTN PDN Visitor Location Register (VLR) local database for a subset of user data, including data about all user currently in the domain of the VLR * usually one VLR per MSC * stores all relevant data of visiting MS Prof. Dr.-Ing. Jochen Schiller, MC SS

13 GSM: elements and interfaces RSS U m radio cell MS MS BTS BSS radio cell MS The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems Components BTS Authentication Center (AUC) A bis NSS A BSC VLR MSC HLR O BSC VLR MSC GMSC IWF signaling ISDN, PSTN PDN Equipment Identity Register (EIR) Operation and Maintenance Center (OMC) different control capabilities for the radio subsystem and the network subsystem OSS EIR AUC OMC Prof. Dr.-Ing. Jochen Schiller, MC SS

14 GSM: elements and interfaces radio cell MS MS BSS Equipment Identification Register (EIR) registers GSM mobile stations and user rights stolen or malfunctioning mobile stations can be locked and sometimes even localized RSS U m BTS radio cell MS stores serial numbers (IMEI) of MS equipment (models, software versions, black list) BTS NSS A bis A BSC VLR MSC HLR O BSC VLR MSC GMSC IWF signaling ISDN, PSTN PDN Authentication Centre (AUC) generates user specific authentication parameters on request of a VLR authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system * stores cryptographic data (keys) OSS EIR AUC OMC Prof. Dr.-Ing. Jochen Schiller, MC SS

15 GSM offers GSM: Mobile Services several types of connections voice connections, data connections, short message service multi-service options (combination of basic services) Three service domains Bearer Services: to transfer data between access points Telematic Services: mobile telephony, SMS, MMS Supplementary Services: conferencing, suppression of number forwarding, etc. MS TE bearer services MT GSM-PLMN transit network source/ destination R, S (PSTN, ISDN) network (U, S, R) U m TE tele services Prof. Dr.-Ing. Jochen Schiller, MC SS

16 Bearer Services Bearer services to transfer data between access points Specification of services up to the terminal interface (OSI layers 1-3) Different data rates for voice and data (original standard) data service (circuit switched) synchronous: 2.4, 4.8 or 9.6 kbit/s asynchronous: bit/s data service (packet switched) synchronous: 2.4, 4.8 or 9.6 kbit/s asynchronous: bit/s Today: data rates of approx. 50 kbit/s possible will be covered later! Prof. Dr.-Ing. Jochen Schiller, MC SS

17 Tele Services I Telecommunication services that enable voice communication via mobile phones All these basic services have to obey cellular functions, security measurements etc. Offered services mobile telephony primary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 khz Emergency number common number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible) Multinumbering several ISDN phone numbers per user possible Prof. Dr.-Ing. Jochen Schiller, MC SS

18 Tele Services II Additional services Non-Voice-Teleservices group 3 fax voice mailbox (implemented in the fixed network supporting the mobile terminals) electronic mail (MHS, Message Handling System, implemented in the fixed network)... Short Message Service (SMS) alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS Prof. Dr.-Ing. Jochen Schiller, MC SS

19 Supplementary services Services in addition to the basic services, cannot be offered stand-alone Similar to ISDN services besides lower bandwidth due to the radio link May differ between different service providers, countries and protocol versions Important services identification: forwarding of caller number suppression of number forwarding automatic call-back conferencing with up to 7 participants locking of the mobile terminal (incoming or outgoing calls)... Prof. Dr.-Ing. Jochen Schiller, MC SS

20 GSM Mobile Communications The GSM 900 MHz Frequency Band *) P-GSM E-GSM R-GSM 25 MHz MHz Uplink Downlink *) several other Systems: - Cordless Telephone CT1, CT1+, CT2 - Telemetry / Telecommand - Terrestrial Trunked Radio (TETRA) - Digital Satellite System Receiver (DSSR) Duplex Distance 45 MHz Prof. Dr.-Ing. Jochen Schiller, MC SS

21 GSM Mobile Communications The GSM 1800, DECT and UMTS Bands DECT 1: Time Division Duplex (TDD) 2: Frequency Division Duplex (FDD) 3: Mobile Satellite System (MSS) GSM MHz 75 MHz UMTS Uplink Downlink Duplex Distance 95 MHz Prof. Dr.-Ing. Jochen Schiller, MC SS

22 GSM Mobile Communications Spatial Frequency Re-use in Cell Clusters K = 12 D R K = 7 1 R cell radius K cluster size D repeating 1 distance K = D R 3K Prof. Dr.-Ing. Jochen Schiller, MC SS

23 GSM: cellular network segmentation of the area into cells possible radio coverage of the cell cell idealized shape of the cell use of several carrier frequencies not the same frequency in adjacent cells cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) if a mobile user changes cells handover of the connection to the neighbor cell Prof. Dr.-Ing. Jochen Schiller, MC SS

24 MACRO, MICRO AND PICO CELLS By using small macro cells in combination with Tighter Frequency Reuse and a micro cellular overlay, the capacity of a standard 4/12 reuse cellular network with 7.5 MHz available spectrum can be increased eightfold. The micro cellular network operates in a segmented frequency and from the nearby macro cells and provides the additional benefit of coverage redundancy. Prof. Dr.-Ing. Jochen Schiller, MC SS

25 GSM Mobile Communications Combined FDMA / TDMA Scheme f Guard Band f U f N B Frame f k B T Time Slots Frequency Band f 2 B f 1 Radio Frequency Channels B Guard Band 0 t Prof. Dr.-Ing. Jochen Schiller, MC SS B = 200 khz T 577 s f L

26 TDMA: FRAME ms bit/s ms A slot lasts for a duration of bit times The slot lasts 15/26 ms=579.9 micro s so a frame takes ms Prof. Dr.-Ing. Jochen Schiller, MC SS

27 GSM Radio Interface U m Bursts Power p(t) f f useful part t Tail Bits: Set to zero Can be used to Enhance the receiver performance Bits in s ( s/bit) 3 Tail Bits 26 Training Bits 3 Tail Bits 2 x 58 Encrypted Bits 8.25 Bits Guard Period Prof. Dr.-Ing. Jochen Schiller, MC SS

28 GSM Radio Interface U m Types of Burst Structure of Normal Burst 2 x 3 Tail Bits (TB) 2 x 58 Encrypted Bits (Payload for Traffic and Control Channels) 2 x 1 Stealing Flag (Switch between Traffic / Control Payload) 2 x 57 Payload Bits 26 Bits Training Sequence (Midamble) Fixed bit sequence used for channel estimation allowing optimum channel equalization Five Different Types of Burst Normal Burst - Traffic and Control Payload Frequency Correction Burst - All Zeroes Sequence Synchronization Burst - Special Fixed Sequence Access Burst - Extended Guard Period of Bits (252 s) Dummy Burst Prof. Dr.-Ing. Jochen Schiller, MC SS

29 GSM Radio Interface U m Adaptive Frame Alignment BTS TX t = s / c MS RX RX TX 0 0 TA = 2 t Thanks to the time shift of 3 time slots between the BTS TX and RX TDMA frames, the MS is not required to receive and transmit simultaneously. This simplifies the MS hardware. The MS continuously aligns its TX frame start based on the Timing Advance (TA) measurements received from the BTS The extended guard period of the access burst (252 s) allows a maximum range between MS and BTS of 35 km. Prof. Dr.-Ing. Jochen Schiller, MC SS

30 GSM Radio Interface U m Logical Channels Control Channels (CCH) Traffic Channels (TCH) Broadcast Channels Common Control Channels Dedicated Control Channels Full Rate (TCH/F) Half Rate (TCH/H) Slow Associated Control Channel (SACCH) Fast Associated Control Channel (FACCH) Stand Alone Dedicated Control Channel (SDCCH) Random Access Channel (RACH) Access Grant Channel (AGCH) Paging Channel (PCH) Notification Channel (PCH) Downlink (DL) Synchronization Channel (SCH) Frequency Control Channel (FCCH) Broadcast Control Channel (BCCH) Uplink (UL) Prof. Dr.-Ing. Jochen Schiller, MC SS

31 GSM Radio Interface U m Broadcast Channels Broadcast Channels are used for synchronisation purposes and broadcasting of cell-specific information in the downlink from BTS to MS Broadcast Channels Frequency Correction Channel (FCCH) carries information for frequency correction of the MS Control Channels (CCH) Common Control Channels Synchronization Channel (SCH) carries information for frame synchronization of the MS (e.g. TDMA frame number FN) and for identification of the BTS (e.g Base Station Identity Code BSIC) Broadcast Control Channel (BCCH) broadcasts general information on the BTS as well as cellspecific information like control channel organisation, frequency hopping sequences, cell identification, etc. Dedicated Control Channels Prof. Dr.-Ing. Jochen Schiller, MC SS

32 GSM Radio Interface U m Common Control Channels Common Control Channels are point-to-multipoint channels used mainly for access control Paging Channel (PCH) - downlink only used by the BTS for paging and localizing the MS Random Access Channel (RACH) - uplink only used by any MS to request allocation of a signalling channel (SDCCH). A slotted Aloha protocol is used, so collisions among concurring MS are quite possible. Access Grant Channel (AGCH) - downlink only used to allocate a SDCCH or directly a TCH Broadcast Channels Control Channels (CCH) Common Control Channels Notification Channel (NCH) - downlink only used to notify MS of voice group and voice broadcast calls (ASCI feature) Dedicated Control Channels Prof. Dr.-Ing. Jochen Schiller, MC SS

33 GSM Radio Interface U m Dedicated Control Channels Dedicated Control Channels are bidirectional point-to-point channels, that allow authentication, signalling, handover and the exchange of measurement values. Broadcast Channels Stand Alone Dedicated Control Channel (SDCCH) used for call setup (authentication, signalling, assignment of actual TCH), localisation updates and SMS Slow Associated Control Channel (SACCH) is always coupled with a SDCCH or TCH and is used for the exchange of measurement values and control parameters Control Channels (CCH) Common Control Channels Downlink : Control of MS Power Level and MS Timing Advance Uplink : Measurement reports (MS reception levels) used by the BTS for its handover-decisions Fast Associated Control Channel (FACCH) is activated in case of increased signalling demand e.g. during handover. Bandwidth is stolen from associated TCH Dedicated Control Channels Prof. Dr.-Ing. Jochen Schiller, MC SS

34 GSM Radio Interface U m Traffic Channels (TCH) Traffic Channels are used for bidirectional transmission of circuit switched voice or data. Full Rate (TCH/F) Traffic Channels (TCH) Half Rate (TCH/H) Full Rate Traffic Channel (TCH / F) Speech Codec 13 kbps (TCH / FS) Full Rate 12.2 kbps (TCH / EFS) Enhanced Full Rate 14.4 kbps (TCH / F14.4) 9.6 kbps (TCH / F9.6) 4.8 kbps (TCH / F4.8) 2.4 kbps (TCH / F2.4) Half Rate Traffic Channel (TCH / H) Speech Codec 6.5 kbps (TCH / HS) Half Rate 4.8 kbps (TCH / H4.8) 2.4 kbps (TCH / H2.4) Prof. Dr.-Ing. Jochen Schiller, MC SS

35 GSM Radio Interface U m Call Setup (MS terminating) MS Paging Request Channel Request Channel Assignment Paging Response PCH RACH AGCH BTS PCH RACH Paging Channel Random Access Ch. Authentication / Cipher Mode Setup Call Confirmation Assign Command Assign Completion SDCCH AGCH Access Grant Ch. SDCCH Stand-alone Dedicated Control Channel Alert Connect Connect Acknowledge FACCH FACCH Fast Associated Control Channel Voice or Data PCH TCH Traffic Channel Prof. Dr.-Ing. Jochen Schiller, MC SS

36 GSM Radio Interface U m Enhanced Full Rate Voice Channel Coding every 20 ms 160 Samples 260 bits 267 bits 456 bits RPE-LPC Codec Block Coding Convolutional Coding sensitive (class I) insensitive (class II) 3 bit CRC 4 tail bits Bits 456 bits spread over 8 bursts Interleaving Encryption Prof. Dr.-Ing. Jochen Schiller, MC SS

37 GSM - TDMA/FDMA MHz 124 channels (200 khz) downlink GSM TDMA frame MHz 124 channels (200 khz) uplink higher GSM frame structures time ms GSM time-slot (normal burst) guard space tail user data S Training S user data tail 3 bits 57 bits 1 26 bits 1 57 bits 3 guard space µs 577 µs Prof. Dr.-Ing. Jochen Schiller, MC SS

38 GSM hierarchy of frames hyperframe superframe frames one frame for slow signalling for all the 8 slots SACCH 12 frames 1 empty frame multiframe ms ms frame slot burst ms 577 µs Prof. Dr.-Ing. Jochen Schiller, MC SS

39 GSM hierarchy of frames hyperframe h 28 min s superframe Larger frames for encryption 6.12 s multiframe ms ms frame slot burst ms 577 µs Prof. Dr.-Ing. Jochen Schiller, MC SS

40 GSM protocol layers for signaling U m A bis A MS BTS BSC MSC CM CM MM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s CM: Call management, MM: Mobility management, RR: Radio Resource management Prof. Dr.-Ing. Jochen Schiller, MC SS

41 Protocol Architecture of GSM with signalling protocol intefaces Interfaces: U m A bis A U m is here of main interests A bis A are intefaces from the fixed network U m A bis A MS BTS BSC MSC CM CM Layer 3 Layer 2 Layer 1 MM RR LAPD m radio RR LAPD m radio BTSM LAPD PCM RR BTSM LAPD PCM BSSAP SS7 PCM MM BSSAP SS7 PCM 16/64 kbit/s 64 kbit/s / Mbit/s

42 Layer 1 (physical) : radio Handles all radio specific functions creation of bursts 5 different formats multiplexing of bursts into TDMA frames synchronisation with the BTS (see next slide) detection of idle channels measurements of channel quality at downlink the physical layer at Um uses GMSK modulation MS CM MM U m BTS A bis performs enchryption/decryption of data RR RR BTSM LAPD m LAPD m LAPD radio radio PCM

43 Layer 1: Synchronization: The distance between the MS and the BTS An MS 35 km from the BTS has a round trip time (RTT) of 0.23 ms!!! The BTS sends the current RTT to the MS, which then adjusts its access time!!! Adjusting the access is controlled by the variable timing advance, where a burst can be shifted up to 63 bit times ealier => 0.23 ms. (each bit is 3.69 micro seconds long). Max 35 km between a BTS and a MS!! BTS TX t = s / c MS RX RX TX 0 0 TA = 2 t

44 Layer 1 (physical) : radio Handles all radio specific functions Channel coding and error detection/correction! sensitive (class I) insensitive (class II) bit CRC 4 tail bits MS U m BTS CM MM The physical layer tries to correct errors, but it does not deliver erroneous data to the higher layers. RR RR BTSM The error correction introduses a delay of about 60 ms! LAPD m LAPD m LAPD radio radio PCM

45 Layer 2 (data link) - LAPDm It is said to be a lightweight LAPD protocol as it does not handle error correction/detection. It handles: segmentation and reassembly of data and acknowledges/unacknowledged data transfer re-sequencing of data frames and flow control! MS U m BTS CM Layer 3 MM RR Layer 2 Layer 1 LAPD m radio RR LAPD m radio BTSM LAPD PCM

46 The network layer in GSM comprises several sublayers! The lowest sublayer is the Radio Resource Management (RR)! Just a part of it is implemented in the BTS, the remainder in the BSC! Setup, maintenence and release of radio channels U m A bis A MS BTS BSC MSC CM MM CM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s

47 The network layer in GSM comprises several sublayers! Mobility Management (MM) contains functions for It also provides a temporary mobile subscriber identity (TMSI) that replaces the international mobile subscriber identity (IMSI) which hides the real identity of an MS user over the air interface. registration authentification location update U m A bis A MS BTS BSC MSC CM CM MM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s

48 The network layer in GSM comprises several sublayers! Call Management (CM) contains functions for: call control (CC): point-to point connection between two terminals call establishment, call clearing, etc. short message service (SMS): using control channels SDCCH and SACCH supplementary services (SS): user identification, forwarding, etc. U m A bis A MS BTS BSC MSC CM CM MM MM RR LAPD m RR LAPD m BTSM LAPD RR BTSM LAPD BSSAP SS7 BSSAP SS7 radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / Mbit/s

49 GSM Mobile Communications Numbers and Identifiers I International Mobile Equipment Identifier (IMEI) Unique serial number assigned by equipment manufacturer International Mobile Subscriber Identifier (IMSI) Unique subscriber identification number, stored on SIM-card Mobile Subscriber ISDN Number (MSISDN) Actual phone number structured according to ITU-T E.164 Country Code (CC) up to 3 digits National Destination Code (NDC) 2 to 3 digits Subscriber Number (SN) with a maximum of 10 digits Strict separation of subscriber identification (IMSI) and phone number (MSISDN) Several MSISDN numbers can be assigned to a single IMSI (used for service selection) The mapping between MSISDN and IMSI is not public Prof. Dr.-Ing. Jochen Schiller, MC SS

50 HSCSD: High Speed Circuit Switched Data Chapter: Read yourselves!

51 Mobile Terminated Call 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN (Mobile Station Roaming Number) from VLR 6: forward responsible MSC to GMSC 7: forward call to current MSC 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection calling station PSTN 1 2 HLR 3 6 GMSC VLR MSC BSS BSS BSS MS Prof. Dr.-Ing. Jochen Schiller, MC SS

52 Mobile Originated Call 1, 2: connection request 3, 4: security check 5-8: check resources (free circuit) 9-10: set up call VLR PSTN 6 5 GMSC MSC 2 9 MS 1 10 BSS Prof. Dr.-Ing. Jochen Schiller, MC SS

53 4 types of handover MS MS MS MS BTS BTS BTS BTS BSC BSC BSC MSC MSC Prof. Dr.-Ing. Jochen Schiller, MC SS

54 Handover decision receive level BTS old receive level BTS old HO_MARGIN MS MS BTS old BTS new Prof. Dr.-Ing. Jochen Schiller, MC SS

55 Handover procedure MS measurement report BTS old measurement result BSC old MSC BSC new BTS new HO decision HO required HO request HO command HO command HO command HO access Link establishment clear command clear command clear complete clear complete resource allocation ch. activation HO request ack ch. activation ack HO complete HO complete Prof. Dr.-Ing. Jochen Schiller, MC SS

56 Security in GSM Security services access control/authentication user SIM (Subscriber Identity Module): secret PIN (personal identification number) SIM network: challenge response method confidentiality voice and signaling encrypted on the wireless link (after successful authentication) anonymity temporary identity TMSI (Temporary Mobile Subscriber Identity) newly assigned at each new location update (LUP) encrypted transmission 3 algorithms specified in GSM A3 for authentication ( secret, open interface) A5 for encryption (standardized) A8 for key generation ( secret, open interface) secret : A3 and A8 available via the Internet network providers can use stronger mechanisms Prof. Dr.-Ing. Jochen Schiller, MC SS

57 GSM - authentication mobile network SIM K i RAND RAND RAND K i AC 128 bit 128 bit 128 bit 128 bit A3 SRES* 32 bit SRES A3 32 bit SIM MSC SRES* =? SRES SRES 32 bit SRES K i : individual subscriber authentication key SRES: signed response Prof. Dr.-Ing. Jochen Schiller, MC SS

58 GSM - key generation and encryption mobile network (BTS) MS with SIM K i RAND RAND RAND K i AC 128 bit 128 bit 128 bit 128 bit SIM A8 A8 cipher key K c 64 bit K c 64 bit BSS A5 data encrypted data SRES data A5 MS Prof. Dr.-Ing. Jochen Schiller, MC SS

59 End Prof. Dr.-Ing. Jochen Schiller, MC SS