Mobile Network Evolution Part 1 GSM and UMTS GSM Cell layout Architecture Call setup Mobility management Security GPRS Architecture Protocols QoS EDGE UMTS Architecture Integrated Communication Systems Group Ilmenau University of Technology
2G to 3G Evolution: GSM - GPRS - UMTS Transmission ATM based ISDN GSM RAN controller MSC GSM Core (Circuit switched) GMSC GSM HLR AuC EIR 2
Architecture of the GSM system GSM is a PLMN (Public Land Mobile Network) several providers setup mobile networks following the GSM standard within each country GSM system comprises 3 subsystems Radio Access Network: covers all radio aspects MS (mobile station) BSS (base station subsystem) or RAN (radio access network) BTS (base transeiver station) BSC (base station controller) Core Network: call forwarding, handover, switching MSC (mobile services switching center) LR (location register): HLR and VLR OMC (operation and maintenance centre) AuC (authentication centre) EIR (equipment identity register) 3
GSM: cellular network segmentation of the area into cells possible radio coverage of the cell cell idealized shape of the cell use of several carrier frequencies not the same frequency in neighboring cells cell radius varies from some 100 m up to 35 km depending on user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) if a mobile user changes cells -> handover of the connection to the neighbor cell 4
Cellular systems: Frequency planning I Frequency reuse only with a certain distance between the base stations Typical (hexagon) model: f 4 f 5 f 6 reuse-3 cluster: f 3 f 1 reuse-7 cluster: f 1 f 3 f 2 f 7 f 3 f 1 f 2 f 3 f 1 f 4 f 5 f 1 f 6 f 4 f 5 f 6 f 2 f 2 f 3 f 2 f 7 f 1 f 3 f 2 f 7 Other regular pattern: reuse-19 the frequency reuse pattern determines the experienced SIR Fixed frequency assignment: certain frequencies are assigned to a certain cell problem: different traffic load in different cells Dynamic frequency assignment: base station chooses frequencies depending on the frequencies already used in neighbor cells Frequency Hopping (fixed or random sequence of frequencies) Improves quality for slow moving or stationary users (frequency diversity) Reduces impact of intercell interference by statistical averaging 5
GSM: Air Interface FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex) Uplink 890 MHz 915 MHz 1 2 3... 123124 Downlink 935 MHz 960 MHz 1 2 3... 123124 200 khz frequency TDMA (Time Division Multiple Access) Downlink 1 2 3 4 5 6 7 8 Uplink 1 2 3 4 5 6 7 8 4,615 ms = 1250 bit time 6
GSM: Voice Coding Voice coding Channel coding Framing Modulation (GMSK) 114 bit/slot 114 + 42 bit GSM TDMA frame 1 2 3 4 5 6 7 8 4.615 ms Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot) Training sequence: select the best radio path in the receiver and train equalizer Tail: needed to enhance receiver performance Flag S: indication for user data or control data GSM time-slot (normal burst) guard space tail user data S Training S user data tail 3 bits 57 bits 1 26 bits 1 57 bits 3 guard space 546.5 µs 577 µs 7
Mobile Terminated Call (MTC) 1: calling a GSM subscriber 2: forwarding call to GMSC 3: signal call setup to HLR 4, 5: request MSRN from VLR 6: forward responsible MSC to GMSC 7: forward call to current MSC calling station 8, 9: get current status of MS 10, 11: paging of MS 12, 13: MS answers 14, 15: security checks 16, 17: set up connection PSTN 1 2 BSS HLR 3 6 GMSC 10 7 4 5 BSS VLR 8 9 14 15 10 MSC 11 12 17 MS 13 16 10 BSS 11 11 11 8
Location Management / Mobility Management The issue: Compromise between minimizing the area where to search for a mobile minimizing the number of location updates Solution 1: Large paging area RA RA Solution 2: Small paging area Location RA Update TOTAL Signalling Cost + = Paging Signalling Cost Paging Area Update Signalling Cost RA RA Location RA Update RA Location Update RA Location Update Location Update RA 9
Handover The problem: Change the cell while communicating Reasons for handover: Quality of radio link deteriorates Communication in other cell requires less radio resources Supported radius is exceeded (e.g. Timing advance in GSM) Overload in current cell Maintenance Link quality cell 1 cell 2 cell 1 cell 2 Handover margin (avoid ping-pong effect) Link to cell 1 Link to cell 2 time 10
Handover procedure (change of BSC) Make-before-break strategy MS measurement report BTS old measurement result BSC old MSC BSC new BTS new HO decision HO required HO request resource allocation ch. activation HO command HO command HO command HO access HO request ack ch. activation ack make Link establishment clear command clear complete clear command clear complete HO complete HO complete break 11
GSM - authentication K i RAND 128 bit 128 bit AuC A3 Challenge-Response: Authentication center provides RAND to Mobile AuC generates SRES using Ki of subscriber and RAND via A3 Mobile (SIM) generates SRES using Ki and RAND Mobile transmits SRES to network (MSC) network (MSC) compares received SRES with one generated by AuC SRES* 32 bit RAND mobile network Authentication Request (RAND) RAND K i 128 bit 128 bit A3 SIM SRES 32 bit MSC SRES* =? SRES Authentication Response (SRES 32 bit) SRES K i : individual subscriber authentication key SRES: signed response 12
GSM - key generation and encryption Ciphering: Data sent on air interface ciphered for security A8 algorithm used to generate cipher key A5 algorithm used to cipher/decipher data Ciphering Key is never transmitted on air MS with SIM K i RAND RAND RAND K i AuC 128 bit 128 bit 128 bit 128 bit SIM A8 A8 cipher key K c 64 bit mobile network (BTS) K c 64 bit BTS A5 data encrypted data SRES data A5 MS 13
2G to 3G Evolution: GSM - GPRS - UMTS Transmission ATM based ISDN GSM RAN controller MSC GSM Core (Circuit switched) GMSC GSM+GPRS HLR AuC EIR SGSN GPRS Core (Packet Switched) GGSN Internet 14
GPRS (General Packet Radio Service) Introducing packet switching in the network Using shared radio channels for packet transmission over the air: multiplexing multiple MS on one time slot flexible (also multiple) allocation of timeslots to MS (scheduling by PCU Packet Control Unit in BSC or BTS) using free slots only if data packets are ready to send (e.g., 115 kbit/s using 8 slots temporarily) standardization 1998, introduction 2001 advantage: first step towards UMTS, flexible data services GPRS network elements GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN) interworking unit between GPRS and PDN (Packet Data Network) SGSN (Serving GSN) supports the MS (location, billing, security) HLR (GPRS Register GR) maintains location and security information 15
GPRS: Multiplexing and multislot allocation Multiplexing TS 0 1 2 3 4 5 6 7 carrier Multislot capability 0 1 2 3 4 5 6 7 16
GPRS services End-to-end packet switched traffic (peak channel rates) 28 kbps (full use of 3 time slots, CS-1: FEC) 171.2 kbps (full use of 8 time slots, CS-4: no FEC) Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002) 95 kbps (for both up and downlink) Assumptions: 4/12 reuse, realistic RF conditions, random traffic Worse figures for individual TCP traffic Adaptive Coding Schemes (adaptive Forward Error Control FEC) CS 1: 9.05 Kbps/slot CS 2: 13.4 Kbps/slot CS 3: 15.6 Kbps/slot CS 4: 21.4 Kbps/slot (no FEC) Problems and limits IP-based network => high latency, no guarantees Limited data rate: 28 kbps (3 slot/cs-1) - 64.2 kbps (3 slot/cs-4) Latency/flow control problems with TCP 17
EDGE (Enhanced Data Rates for GSM Evolution) Enhanced spectral efficiency depends on: Size of frequency band Duration of usage Level of interference with others (power) Near-far problem EDGE Technology: EDGE can carry data speeds up to 236.8 kbit/s for 4 timeslots (theoretical maximum is 473.6 kbit/s for 8 timeslots) Adaptation of modulation depending on quality of radio path GMSK (GSM standard 1 bit per symbol) 8-PSK (3 bits per symbol) Adaptation of coding scheme depending on quality of radio path (9 coding schemes) Gain: data rate (gross) up to 69,2kbps (compare to 22.8kbps for GSM) complex extension of GSM! NodeB UE 1 UE 2 18
EDGE Adaptive Modulation and Coding Schemes Schem e Modulation Maximum rate [kb/s] Code Rate Family MCS-9 8PSK 59.2 1.0 A MCS-8 54.4 0.92 A MCS-7 44.8 0.76 B M CS-6 29.6 / 27.2 0.49 A MCS-5 22.4 0.37 B MCS-4 GM SK 17.6 1.0 C M CS-3 14.8 / 13.6 0.80 A MCS-2 11.2 0.66 B MCS-1 8.8 0.53 C 19
Payload for GPRS and EDGE 20
2G to 3G Evolution: GSM - GPRS UMTS R99/R3 GSM RAN controller MSC ATM based GSM Core (Circuit switched) GSM+GPRS+UMTS R99 HLR AuC EIR GMSC ISDN UTRAN Radio network controller SGSN GPRS Core (Packet Switched) GGSN Internet 21
2G to 3G Evolution: GSM - GPRS - UMTS R5 - IMS GERAN GSM RAN controller GERAN + UMTS R5 + IMS UTRAN Radio network controller SGSN IP based GPRS 3G Core Core (Packet Switched) GGSN Internet 22