Praktikum Mobile und Verteilte Systeme

GSM & UMTS

Prof. Dr. Claudia Linnhoff-Popien Peter Ruppel WS 2006 / 2007

Slides adopted from the lecture Mobile Communications II, by courtesy of Dr. Axel Kpper, 2006
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 1

Agenda

GSM - Global System for Mobile Communication

System Architecture Numbering Air interface

UMTS - Universal Mobile Telecommunications System

System Architecture Wideband CDMA

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

GSM: System Architecture Main Infrastructure Components Overview

OMC BSC BTS

4

ISC

BTS BTS
4

MSC BSC

GMSC

BTS

EIR

AUC

HLR

VLR

AUC: Authentication Center BSC: Base Station Controller EIR: Equipment Identity Register GMSC: Gateway Mobile Switching Center HLR: Home Location Register ISC: International Switching Center

MSC: OMC: PLMN: VLR:

Mobile Switching Center Operation and Maintenance Center Public Land Mobile Network Visitor Location Register

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

GSM: System Architecture GSM System Hierarchy

GSM GSM network network GSM network consists of at least one administrative region, which is assigned to a Mobile Switching Center (MSC) Administrative domain is made up of at least one location area (LA) An LA consists of several cell groups A cell group is assigned to Base Station Controller (BSC) For each LA there exists at least one BSC, but cells of one BSC may belong to different LAs. MSC MSC region region Location Location Area Area BSC BSC Controller Controller Cell Cell ..... Cell Cell BSC BSC Controller Controller BSC BSC Controller Controller Location Location Area Area BSC BSC Controller Controller ..... .....

Location BSC Controller Controller Location Area Area BSC MSC MSC region region ..... MSC MSC region region

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Addressing and Location Management

Permanent numbering
Numbering of subscribers
IMSI MSISDN IMEI International Mobile Subscriber Identity Mobile Subscriber ISDN International Mobile Station Equipment Identity

Numbering of devices

Temporal Numbering
MSRN TMSI LAI CI Mobile Station Roaming Number Temporary Mobile Subscriber Identity Location Area Identifier Cell Identifier

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Addressing and Location Management Permanent Subscriber Addresses

International Mobile Subscriber Identity (IMSI)

Uniquely identifies the subscriber and is stored in the SIM, HLR, and AuC Mobile Country Mobile Subscriber Identification Number Hierarchical addressing (example: (MSIN) Code (MCN) MCN=262 for Germany, MNC=01,02,03,07 for T-Mobile, Vodafone, Eplus, O2) Used, e.g., for billing Mobile Network Code (MNC)

Mobile Subscriber ISDN Number (MSISDN)

Real telephone number of a subscriber Subscriber can have several MSISDNs, e.g., to distinguish several services (voice, data, fax,...) Thus, automatic activation of servicespecific resources is already possible during setup of connection Stored centrally in the HLR and in the SIM Country Code (CCN), max. 3 places Subscriber Number (MSIN), max. 10 places

National Destination Code (NDC), max. 3 places

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Addressing and Location Management Temporary Subscriber Addresses

Mobile Station Roaming Number (MSRN)

Temporary location-dependent ISDN number Required to make routing decisions and to identify the responsible MSC Assigned by the locally responsible VLR to each mobile station in its area and passed to the HLR Generated at each registration or when the HLR requests it for call setup (on a call-bycall basis) NDC MSIN

Temporary Mobile Subscriber Identity (TMSI)

Used in place of the IMSI for the definite identification and addressing of the mobile station Avoids to determine the identity of the subscriber by listening to the radio channel Assigned during the mobile stations presence in the area of one VLR (by that VLR) and can be changed during this period (ID hopping) Is stored by the mobile station on the SIM card Is stored on the network side only in the VLR, not in the HLR Is assigned in an operator specific way and consists of 4x8 Bits Subscriber can be uniquely identified; IMSI is replaced by (TMSI, LAI)

CCN

Addresses the responsible MSC

Addresses the subscriber

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Addressing and Location Management Other Addresses

International Mobile Station Equipment Identity (IMEI)

Uniquely identifies mobile stations internationally Allocated by the manufacturer, registered by the Type Approval Code (TAC), Serial Number (SNR), network operator and stored in the EIR centrally assigned assigned by the man. Characterizes a mobile station and gives clues about the manufacturer and the date of Spare (SP), manufacturing Finally Assembly Code (FAC), not used assigned by the manufacturer Internationally unique identification of a location area Regularly broadcasted by the base station Heard by the mobile station in order to decide whether or not a new LA has been entered Country Code Location Area Code (CC) (LAC) Mobile Network Code (MNC)

Location Area Identity (LAI)

Cell Identifier (CI)

Uniquely identification of cells within an LA Length of CI: 2x8 bits Internationally unique identification with the Global Cell Identity (LAI+CI)
8

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Addressing and Location Management Overview of Addresses

EIR
IMEI IMSI RAND SRES Ki Kc

AUC CI, LAI BTS

MSRN IMSI TMSI MSISDN LAI

IMEI IMSI, MSISDN, TMSI

VLR HLR

BSIC Base Transceiver Station Identity Code CI Cell Identifier IMEI International Mobile Station Equipment Identity IMSI International Mobile Subscriber Identity Kc Cipher/Decipher Key Ki Subscriber Authentication Key MSISDN Mobile Subscriber ISDN Number

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

IMSI MSISDN MSRN

MSRN LAI RAND SPC SRES TMSI

Mobile Station Roaming Number Location Area Identifier Random Number Signaling Point Code Session Key Temporary Mobile Subscriber Identity
9

Addressing and Location Management Mobile Terminated Call (MTC) Request and delivery of routing address Forwarding to MSISDN responsible GMSC (based on CC and 1 NDC of MSISDN)

HLR
Forwarding to the local MSC MSRN

HLR 3 2 MSISDN 5 GMSC VLR

SS7
MSC VLR
TMSI MSRN 4

TMSI

7 BSC 7

ISDN

7
TMSI

6 MSC VLR

BTS

8 BTS

Request and TMSI delivery of TMSI for paging Paging request Paging response

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

10

Logical and Physical Channels Carrier Frequencies, Duplexing, and TDMA Frames
960 MHz 959,8 MHz

200 kHz

935,2 MHz 935 MHz 915 MHz

124 124 123 123 ... ... ... ... ... ... 2 2 1 1

Downlink 0 0 1 1 2 2 3 3 4 4 5 5 6 6 7 7

Data Data burst, burst, 156.25 156.25 bit bit periods periods = = 15/26 15/26 ms ms 576.9 576.9 s s

914,8 MHz 200 kHz 45 MHz separation 890,2 MHz 890 MHz

124 124 123 123 ... ... ... ... ... ... 2 2 1 1

0 0 1 1 2 2

3 3 4 4 5 5 6 6 7 7 Uplink

Delay: 3 time slots MS does not need a full duplex transmitter, a simpler halfduplex transmitter switching between receiving and sending is sufficient
11

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Security Functions Cryptographic Algorithms A3

Authentication algorithm Calculates SRES based on the Ki key (stored on the SIM and in the HLR) and the RAND sent by the MSC Not standardized; can be chosen independently by each operator

A8
Key generation algorithm needed to calculate the session key Kc Calculation of Kc depends on Ki and RAND Not standardized; can be chosen independently by each operator

A5
Stream cipher used to encrypt over-the-airtransmissions Ciphering is based on Kc and the frame number Specified at international level to enable roaming

Ki RAND (128 bit) (128 bit) SRES (32 bit)

Ki RAND (128 bit) (128 bit) Kc (64 bit)

Kc Frame number (64 bit) (22 bit) Bitstream (114 bit)

A3

A8

A5

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

12

UMTS: System Architecture Releases of UMTS System Architecture 3GPP R99 (R3) First phase of UMTS Mainly concerns the access part of the mobile network Introduction of WCDMA and reuse of existing GSM/EDGE implementations Integration of GSM mobile switching network, operation and maintenance, and GPRS extensions Same bearer, tele, and supplementary services, but with different implementations (not visible to the subscriber)

3GPP R4 (Vision) Minor changes of the access network; remarkable extensions of the core network Full integration of both GSM and GSM/EDGE networks Separation of connection, its control and services Implementation of first multimedia services (where at least two media components are combined) Beginning conversion of the network to be completely IP-based

3GPP R5 (Vision) So far, R5 is rather a vision than a specification of the future UMTS network Access as well as core network are completely IP based Traffic is always packetswitched (real-time or non-real-time) Dissolution of the circuitswitched domain Interfaces for various radio access technologies (GSM, EDGE, CDMA2000, WCDMA, Wireless Local Area Network (WLAN)
13

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

UMTS: System Architecture Radio Network Subsystem

CRNC for NB1 and NB2 SRNC for connection of UE1

Node B (NB) UTRAN radio element or base station Radio Network Controller (RNC) Main difference to BSC: support of macro diversity (softer handover) Different roles of RNCs (with regard to topology and radio connections): Controlling RNC (CRNC): control of several NBs Serving RNC (SRNC): Control of a specific connection between UE and UTRAN Drifting RNC (DRNC): Used when radio resources of a connection need to use cell(s) controlled by another but the SRNC itself

NB1 RNC NB2

Macro diversity point

UE1

NB3 RNC

Radio Network Subsystem

NB4
CRNC for NB3 and NB4 DRNC for connection of UE1
14

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

UTRA-FDD & UTRA-TDD

UTRA-FDD
Uplink: 1920 1980 MHz Downlink: 2110 2170 MHz Data rates: up to 384 kbit/s
Power

1 frame = 10 ms

Frequency 5.0 MHz

UTRA-TDD
For hot-spot and urban areas Data rates: up to 2 Mbit/s Support of asymmetric data flows Not yet widely-used

Power Frequency 4.4-5.0 MHz

Time

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

15

UMTS: Physical Channels Principles of Wideband-CDMA Principle of WCDMA All users are simultaneously transmitting in the same frequency bands Each user interferes with each other Cluster size is 1, i.e., adjacent cells use the same frequencies Cells, users (terminals), and physical channels are separated by code Codes Channelization codes for separation of physical channels in the uplink and separation of users in the downlink Scrambling codes for separation of users/terminals in the uplink and cells/sectors in the downlink

Guard

3,84 MHz

Guard

f
5 MHz

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

16

UMTS: Physical Channels WCDMA Frame Structure WCDMA frame 10 ms 3,84 MHz

t Middlepoint of WCDMA carrier

f 15 slots, each of them 2/3 ms Frame structure for timing, synchronization arrangements, transmission assurance between network and mobile station Frame length is 10 ms and frame consists of 15 slots, each of length 2/3 ms One WCDMA frame is able to handle 0.010 s 38400 Chips 0.00000026041 s and thus 2560 Chips per slot Unlike GSM, no super-, hyper, or multiframe-structures WCDMA frames are numbered by a System Frame Number (SFN) used for internal synchronization of UTRAN and timing of signaling FDD: bit rate can be varied on frame basis TDD: bit rate can be varied on slot basis
17

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

UMTS: Physical Channels OVSF: Channelization Codes C8,1 C8,1 1,1,1,1,1,1,1,1 C8,2 C8,2 1,1,1,1,-1,-1,-1,-1 C8,3 C8,3 1,1,-1,-1,1,1,-1,-1 C8,4 C8,4 1,1,-1,-1,-1,-1,1,1 C8,5 C8,5 1,-1,1,-1,1,-1,1,-1 C8,6 C8,6 1,-1,1,-1,-1,1,-1,1 C8,7 C8,7 1,-1,-1,1,1,-1,-1,1 C8,8 C8,8 1,-1,-1,1,-1,1,1,-1
18

Orthogonal Variable Spreading Factor (OVSF): method to obtain variable length orthogonal codes that preserve orthogonality between different rates and spreading factors Recursive generation of variable orthogonal codes using a tree structure A node adopts the code from its predecessor and concatenates it either with a copy of this code 1 (first successor) or with its C1,1 C1,1 inverse (second successor) Codes of the same layer are orthogonal Any two Codes of different layers are orthogonal except for the case that one of the two codes is a mother code of the other

C4,1 C4,1 1,1,1,1 C2,1 C2,1 1,1 C4,2 C4,2 1,1,-1,-1

C4,3 C4,3 1,-1,1,-1 1,-1 C2,2 C2,2 C4,4 C4,4 1,-1,-1,1

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

UMTS: Physical Channels OVSF: Channelization Codes(II)

C8,1 C8,1 1,1,1,1,1,1,1,1 C8,2 C8,2 1,1,1,1,-1,-1,-1,-1 C8,3 C8,3 1,1,-1,-1,1,1,-1,-1 C8,4 C8,4 1,1,-1,-1,-1,-1,1,1 C8,5 C8,5 1,-1,1,-1,1,-1,1,-1 C8,6 C8,6 1,-1,1,-1,-1,1,-1,1 C8,7 C8,7 1,-1,-1,1,1,-1,-1,1 C8,8 C8,8 1,-1,-1,1,-1,1,1,-1

C4,1 C4,1 1,1,1,1 C2,1 C2,1 1,1 C4,2 C4,2 1,1,-1,-1 C1,1 C1,1 1 C4,3 C4,3 1,-1,1,-1 1,-1

Bit Bit rate rate 960 960 kb/s kb/s 480 480 kb/s kb/s 240 240 kb/s kb/s 120 120 kb/s kb/s 60 60 kb/s kb/s 30 30 kb/s kb/s 15 15 kb/s kb/s 7.5 7.5 kb/s kb/s

Spreading Chip rate rate Spreading factor factor Chip 4 4 8 8 16 16 32 32 64 64 128 128 256 256 512 512 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps 3.84 3.84 Mcps Mcps

C2,2 C2,2

Example: C4,2 is assigned to a user Codes C8,3 and C8,4 generated from this code cannot be assigned to other users requesting lower bit rates Mother codes C1,1 and C2,1 cannot be assigned to users requesting higher rates

C4,4 C4,4 1,-1,-1,1

bit rate * spreading factor = 3.84 Mcps

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

19

UMTS: Physical Channels Drawbacks of Channelization Codes Problem 1 Networks based on WCDMA have usually a cluster size of 1 Thus, access to the code tree must be coordinated between adjacent cells or each cell needs its own code tree Problem 2 Propagation delay of users with different distances to the node B could destroy the orthogonality of the used codes (see example) Codes are received asynchronously Scrambling codes Sector and cell separation in the downlink Terminal and cell separation in the uplink Codes remain nearly orthogonal if received asynchronously Example for (2): Two users A and B use channelization codes C4,2 and C4,4 Difference in the distance to the node B is 78 m, which is covered by the signal in 0,26 s (corresponds to the duration of 1 Chip)

x+78 m User B: C4,4 xm NB

User A: C4,2

A 1 1 -1 -1 1 1 -1 -1 1 1 -1 -1 B 1 1 -1 -1 1 1 -1 -1 1 1 -1 -1 t Propagation delay Orthogonality is lost!

20

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

Outlook

GSM - Global System for Mobile Communication UMTS - Universal Mobile Telecommunications System

Mobile Communications II

Next week: Focus on Short Message Service in GSM WAP/SMS Gateway: Kannel

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007

21