Praktikum Mobile und Verteilte Systeme

GSM & UMTS

Prof. Dr. Claudia Linnhoff-Popien

Peter Ruppel

WS 2006 / 2007

Slides adopted from the lecture “Mobile Communications II”,

by courtesy of Dr. Axel Küpper, 2006

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 1
 Agenda

• GSM - Global System for Mobile Communication

– System Architecture
– Numbering
– Air interface

• UMTS - Universal Mobile Telecommunications System

– System Architecture
– Wideband CDMA

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 2
 GSM: System Architecture
Main Infrastructure Components -
Overview

OMC
BSC ISC
BTS
4

MSC
BTS GMSC
BTS BSC

EIR
4

BTS
AUC
HLR
VLR
AUC: Authentication Center MSC: Mobile Switching Center
BSC: Base Station Controller OMC: Operation and Maintenance Center
EIR: Equipment Identity Register PLMN: Public Land Mobile Network
GMSC: Gateway Mobile Switching Center VLR: Visitor Location Register
HLR: Home Location Register
ISC: International Switching Center
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 3
 GSM: System Architecture
GSM System Hierarchy

GSM
GSM network
network MSC
MSC region
region Location
Location Area
Area BSC
BSC Controller
Controller Cell
Cell
ƒ GSM network consists of
at least one administrative .....
region, which is assigned
to a Mobile Switching Cell
Cell
Center (MSC)
ƒ Administrative domain is BSC
BSC Controller
Controller
made up of at least one
location area (LA)
BSC
BSC Controller
Controller
ƒ An LA consists of several
Location
Location Area
Area
cell groups
BSC
BSC Controller
Controller
ƒ A cell group is assigned to
Base Station Controller .....
(BSC) .....
ƒ For each LA there exists
Location
Location Area
Area BSC
BSC Controller
Controller
at least one BSC, but cells
of one BSC may belong to
different LAs. MSC
MSC region
region

.....

MSC
MSC region
region

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 4
 Addressing and Location Management

• Permanent numbering
– Numbering of subscribers
• IMSI International Mobile Subscriber Identity
• MSISDN Mobile Subscriber ISDN
– Numbering of devices
• IMEI International Mobile Station Equipment Identity

• Temporal Numbering
• MSRN Mobile Station Roaming Number
• TMSI Temporary Mobile Subscriber Identity
• LAI Location Area Identifier
• CI Cell Identifier

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 5
 Addressing and Location Management
Permanent Subscriber Addresses

International Mobile Subscriber Identity (IMSI)

ƒ Uniquely identifies the subscriber and is
stored in the SIM, HLR, and AuC Mobile Country Mobile Subscriber Identification Number
ƒ Hierarchical addressing (example: Code (MCN) (MSIN)
MCN=262 for Germany, MNC=01,02,03,07
for T-Mobile, Vodafone, Eplus, O2)
ƒ Used, e.g., for billing
Mobile Network Code
(MNC)
Mobile Subscriber ISDN Number (MSISDN)
ƒ Real telephone number of a subscriber Country Code Subscriber Number
ƒ Subscriber can have several MSISDNs, (CCN), max. 3 places (MSIN), max. 10 places
e.g., to distinguish several services
(voice, data, fax,...)
ƒ Thus, automatic activation of service-
specific resources is already possible
during setup of connection National Destination Code
(NDC), max. 3 places
ƒ Stored centrally in the HLR and in the
SIM

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 6
 Addressing and Location Management
Temporary Subscriber Addresses

Mobile Station Roaming Number Temporary Mobile Subscriber Identity

(MSRN) (TMSI)
ƒ Temporary location-dependent ISDN number ƒ Used in place of the IMSI for the definite
ƒ Required to make routing decisions and to identification and addressing of the mobile
identify the responsible MSC station
ƒ Assigned by the locally responsible VLR to ƒ Avoids to determine the identity of the
each mobile station in its area and passed to subscriber by listening to the radio channel
the HLR ƒ Assigned during the mobile station’s presence
ƒ Generated at each registration or when the in the area of one VLR (by that VLR) and can
HLR requests it for call setup (on a call-by- be changed during this period (ID hopping)
call basis) ƒ Is stored by the mobile station on the SIM card
ƒ Is stored on the network side only in the VLR,
CCN NDC MSIN not in the HLR
ƒ Is assigned in an operator specific way and
consists of 4x8 Bits
ƒ Subscriber can be uniquely identified; IMSI is
replaced by (TMSI, LAI)
Addresses Addresses
the the
responsible subscriber
MSC

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 7
 Addressing and Location Management
Other Addresses

International Mobile Station Equipment Identity (IMEI)

ƒ Uniquely identifies mobile stations internationally
ƒ Allocated by the manufacturer, registered by the
Type Approval Code (TAC), Serial Number (SNR),
network operator and stored in the EIR
centrally assigned assigned by the man.
ƒ Characterizes a mobile station and gives clues
about the manufacturer and the date of
manufacturing Finally Assembly Code (FAC), Spare (SP),
assigned by the manufacturer not used
Location Area Identity (LAI)
ƒ Internationally unique identification of a location area Country Code Location Area Code
ƒ Regularly broadcasted by the base station (CC) (LAC)
ƒ “Heard” by the mobile station in order to decide whether or
not a new LA has been entered Mobile Network Code
(MNC)
Cell Identifier (CI)
• Uniquely identification of cells within an LA
• Length of CI: 2x8 bits
• Internationally unique identification with the Global Cell
Identity (LAI+CI)

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 8
 Addressing and Location Management
Overview of Addresses

EIR
IMEI IMSI RAND SRES Ki Kc
AUC
BTS
CI, LAI MSRN IMSI TMSI MSISDN LAI
4

VLR
IMEI

IMSI, MSISDN, TMSI HLR

IMSI MSISDN MSRN

BSIC Base Transceiver Station Identity Code MSRN Mobile Station Roaming Number
CI Cell Identifier LAI Location Area Identifier
IMEI International Mobile Station Equipment Identity RAND Random Number
IMSI International Mobile Subscriber Identity SPC Signaling Point Code
Kc Cipher/Decipher Key SRES Session Key
Ki Subscriber Authentication Key TMSI Temporary Mobile Subscriber Identity
MSISDN Mobile Subscriber ISDN Number
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 9
 Addressing and Location Management
Mobile Terminated Call (MTC)

Request and
HLR delivery of
HLR routing address
Forwarding to MSRN Forwarding to
the local MSC 3 MSISDN responsible GMSC
SS7 2 MSISDN 1 (based on CC and
NDC of MSISDN)
MSC
VLR MSRN 4
TMSI 5 GMSC ISDN
TMSI 7 6 VLR
7 MSC
VLR
BSC 7 Request and
TMSI delivery of
TMSI
BTS 8 TMSI for
paging
BTS Paging request
4

Paging response

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 10
 Logical and Physical Channels
Carrier Frequencies, Duplexing, and
TDMA Frames
960 MHz
959,8 MHz
124
124
123
123
200 kHz ...
... Downlink
...
...
...
... 00 11 22 33 44 55 66 77
22
11
935,2 MHz
935 MHz
915 MHz Data
Data burst,
burst, 156.25
156.25 bit
bit periods
periods == 15/26
15/26 ms
ms 576.9
576.9 ss
914,8 MHz
124
124
123
123
200 kHz ...
... 00 11 22 33 44 55 66 77
...
...
45 MHz ...
... Uplink
separation 22 Delay: 3 time slots
890,2 MHz
11 MS does not need a full duplex transmitter, a simpler half-
890 MHz duplex transmitter switching between receiving and sending
is sufficient
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 11
 Security Functions
Cryptographic Algorithms

A3 A8 A5
ƒ Authentication algorithm ƒ Key generation algorithm ƒ Stream cipher used to
ƒ Calculates SRES based on the needed to calculate the encrypt over-the-air-
Ki key (stored on the SIM and session key Kc transmissions
in the HLR) and the RAND ƒ Calculation of Kc depends ƒ Ciphering is based on Kc and
sent by the MSC on Ki and RAND the frame number
ƒ Not standardized; can be ƒ Not standardized; can be ƒ Specified at international
chosen independently by chosen independently by level to enable roaming
each operator each operator

Ki RAND Ki RAND Kc Frame number

(128 bit) (128 bit) (128 bit) (128 bit) (64 bit) (22 bit)

Kc Bitstream
SRES
(32 bit) (64 bit) (114 bit)
A3 A8 A5

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 12
 UMTS: System Architecture
Releases of UMTS System Architecture

3GPP R99 (R3) 3GPP R4 (Vision) ƒ 3GPP R5 (Vision)

ƒ First phase of UMTS ƒ Minor changes of the ƒ So far, R5 is rather a
ƒ Mainly concerns the access network; remarkable vision than a specification
access part of the mobile extensions of the core of the future UMTS
network network network
ƒ Introduction of WCDMA ƒ Full integration of both ƒ Access as well as core
and reuse of existing
GSM and GSM/EDGE network are completely IP
GSM/EDGE
implementations networks based
ƒ Integration of GSM ƒ Separation of connection, ƒ Traffic is always packet-
mobile switching its control and services switched (real-time or
network, operation and ƒ Implementation of first non-real-time)
maintenance, and GPRS multimedia services (where ƒ Dissolution of the circuit-
extensions at least two media switched domain
ƒ Same bearer, tele, and components are combined) ƒ Interfaces for various radio
supplementary services,
but with different ƒ Beginning conversion of access technologies (GSM,
implementations (not the network to be EDGE, CDMA2000,
visible to the subscriber) completely IP-based WCDMA, Wireless Local
Area Network (WLAN)

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 13
 UMTS: System Architecture
Radio Network Subsystem

Node B (NB) CRNC for NB1 and NB2

ƒ UTRAN radio element or base SRNC for connection of UE1
station NB1

Radio Network Controller (RNC) RNC

ƒ Main difference to BSC: support of
macro diversity (softer handover)
NB2
ƒ Different roles of RNCs (with
regard to topology and radio Macro diversity point
connections):
ƒ Controlling RNC (CRNC):
control of several NBs
ƒ Serving RNC (SRNC): Control UE1
of a specific connection NB3
between UE and UTRAN
ƒ Drifting RNC (DRNC): Used RNC
when radio resources of a
connection need to use cell(s)
controlled by another but the Radio NB4
SRNC itself Network
Subsystem CRNC for NB3 and NB4
DRNC for connection of UE1
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 14
 UTRA-FDD & UTRA-TDD

1 frame = 10 ms
• UTRA-FDD
– Uplink: 1920 – 1980 MHz Power
Frequency
– Downlink: 2110 – 2170 MHz
5.0 MHz
– Data rates: up to 384 kbit/s

• UTRA-TDD
– For hot-spot and urban areas
– Data rates: up to 2 Mbit/s
– Support of asymmetric data Power
flows Frequency
– Not yet widely-used
4.4-5.0 MHz

Time

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 15
 UMTS: Physical Channels
Principles of Wideband-CDMA

Principle of WCDMA
ƒ All users are simultaneously
transmitting in the same frequency
bands
ƒ Each user interferes with each
other Guard Guard
3,84 MHz
ƒ Cluster size is 1, i.e., adjacent cells
use the same frequencies
ƒ Cells, users (terminals), and
physical channels are separated by
code
Codes f
5 MHz
ƒ Channelization codes for
separation of physical channels in
the uplink and separation of users
in the downlink
ƒ Scrambling codes for separation of
users/terminals in the uplink and
cells/sectors in the downlink

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 16
 UMTS: Physical Channels
WCDMA Frame Structure

WCDMA frame 10 ms
t
3,84 MHz Middlepoint of
WCDMA carrier

f
15 slots, each of them 2/3 ms

ƒ Frame structure for timing, ƒ Unlike GSM, no super-, hyper, or

synchronization arrangements, multiframe-structures
transmission assurance between
ƒ WCDMA frames are numbered by a
network and mobile station
System Frame Number (SFN) used
ƒ Frame length is 10 ms and frame
for internal synchronization of
consists of 15 slots, each of length
2/3 ms UTRAN and timing of signaling
ƒ One WCDMA frame is able to ƒ FDD: bit rate can be varied on
handle frame basis
0.010 s ƒ TDD: bit rate can be varied on slot
≈ 38400 Chips
0.00000026041 s basis
and thus 2560 Chips per slot
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 17
 UMTS: Physical Channels
OVSF: Channelization Codes

C8,1
C8,1
• Orthogonal Variable Spreading 1,1,1,1,1,1,1,1
C4,1
C4,1
Factor (OVSF): method to obtain
variable length orthogonal codes 1,1,1,1 C8,2
C8,2
that preserve orthogonality 1,1,1,1,-1,-1,-1,-1
between different rates and C2,1
C2,1
spreading factors 1,1 C8,3
C8,3
• Recursive generation of variable 1,1,-1,-1,1,1,-1,-1
orthogonal codes using a tree C4,2
C4,2
structure 1,1,-1,-1 C8,4
C8,4
• A node adopts the code from its
predecessor and concatenates it 1,1,-1,-1,-1,-1,1,1
either with a copy of this code 1
(first successor) or with its C8,5
C8,5
inverse (second successor) C1,1
C1,1 C4,3 1,-1,1,-1,1,-1,1,-1
C4,3
• Codes of the same layer are 1,-1,1,-1
orthogonal C8,6
C8,6
• Any two Codes of different 1,-1,1,-1,-1,1,-1,1
layers are orthogonal except for 1,-1
the case that one of the two C8,7
C8,7
codes is a mother code of the C2,2
C2,2 C4,4
C4,4 1,-1,-1,1,1,-1,-1,1
other
1,-1,-1,1 C8,8
C8,8
1,-1,-1,1,-1,1,1,-1
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 18
 UMTS: Physical Channels
OVSF: Channelization Codes(II)

C8,1
C8,1
C4,1
C4,1 1,1,1,1,1,1,1,1
1,1,1,1 C8,2
C8,2 Bit
Bit rate
rate Spreading
Spreading factor
factor Chip
Chip rate
rate
C2,1
C2,1 1,1,1,1,-1,-1,-1,-1
1,1 C8,3
C8,3 960
960 kb/s
kb/s 44 3.84
3.84 Mcps
Mcps
C4,2
C4,2 1,1,-1,-1,1,1,-1,-1 480
480 kb/s
kb/s 88 3.84
3.84 Mcps
Mcps
C8,4
C8,4
1,1,-1,-1 240
240 kb/s
kb/s 16
16 3.84
3.84 Mcps
Mcps
1,1,-1,-1,-1,-1,1,1
1 C8,5
C8,5 120
120 kb/s
kb/s 32
32 3.84
3.84 Mcps
Mcps
C1,1
C1,1 C4,3
C4,3 1,-1,1,-1,1,-1,1,-1
1,-1,1,-1 60
60 kb/s
kb/s 64
64 3.84
3.84 Mcps
Mcps
C8,6
C8,6
1,-1,1,-1,-1,1,-1,1 30
30 kb/s
kb/s 128
128 3.84
3.84 Mcps
Mcps
1,-1 C8,7
C8,7 15
C2,2 15 kb/s
kb/s 256
256 3.84
3.84 Mcps
Mcps
C2,2 C4,4
C4,4 1,-1,-1,1,1,-1,-1,1
1,-1,-1,1 C8,8 7.5
7.5 kb/s
kb/s 512
512 3.84
3.84 Mcps
Mcps
C8,8
Example:
ƒ C4,2 is assigned to a user 1,-1,-1,1,-1,1,1,-1
ƒ Codes C8,3 and C8,4 generated from this
code cannot be assigned to other users bit rate * spreading factor = 3.84 Mcps
requesting lower bit rates
ƒ Mother codes C1,1 and C2,1 cannot be
assigned to users requesting higher rates

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 19
 UMTS: Physical Channels
Drawbacks of Channelization Codes

Example for (2):

Problem 1
ƒ Networks based on WCDMA have ƒ Two users A and B use channelization
usually a cluster size of 1 codes C4,2 and C4,4
ƒ Thus, access to the code tree must ƒ Difference in the distance to the node B is
be coordinated between adjacent 78 m, which is covered by the signal in
cells or each cell needs its own 0,26 s (corresponds to the duration of 1
code tree
Chip)
Problem 2
ƒ Propagation delay of users with x+78 m
different distances to the node B
could destroy the orthogonality of xm
the used codes (see example) User B: NB
ƒ Codes are received asynchronously C4,4
User A: C4,2
Scrambling codes
ƒ Sector and cell separation in the A 1 1 -1 -1 1 1 -1 -1 1 1 -1 -1
downlink
B 1 1 -1 -1 1 1 -1 -1 1 1 -1 -1 t
ƒ Terminal and cell separation in the
uplink Propagation delay
ƒ Codes remain nearly orthogonal if Orthogonality is lost!
received asynchronously
Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 20
 Outlook

• GSM - Global System for Mobile Communication

Mobile Communications II
• UMTS - Universal Mobile Telecommunications System

Next week:

• Focus on Short Message Service in GSM

• WAP/SMS Gateway: Kannel

Prof. Dr. C. Linnhoff-Popien, P. Ruppel, Praktikum Mobile und Verteilte Systeme - WS 2006 / 2007 21