2G/3G Mobile Communication Systems

Winter 2012/13

Integrated Communication Systems Group

Ilmenau University of Technology
Outline
2G Review: GSM
Services
Architecture
Protocols
Call setup
Mobility management
Security

HSCSD
GPRS
Architecture
Protocols
QoS

EDGE
UMTS
2G to 3G Evolution: GSM - GPRS - UMTS

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller
GSM Core
GSM (Circuit
RAN switched)
Base station

HLR
GSM AuC
EIR

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 3

Architecture of the GSM system
GSM is a PLMN (Public Land Mobile Network)
several providers setup mobile networks following the GSM standard
within each country
GSM system comprises 3 subsystems
RSS (radio subsystem): covers all radio aspects
MS (mobile station)
BSS (base station subsystem) or RAN (radio access network)
BTS (base transeiver station)
BSC (base station controller)
NSS (network and switching subsystem): call forwarding, handover,
switching
MSC (mobile services switching center)
LR (location register): HLR and VLR
OSS (operation subsystem): management of the network
OMC (operation and maintenance center)
AuC (authentication center)
EIR (equipment identity register)

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 4

GSM: cellular network

segmentation of the area into cells

possible radio coverage of the cell

idealized shape of the cell

cell

use of several carrier frequencies

not the same frequency in neighboring cells
cell radius varies from some 100 m up to 35 km depending on
user density, geography, transceiver power etc.
hexagonal shape of cells is idealized (cells overlap, shapes depend
on geography)
if a mobile user changes cells
-> handover of the connection to the neighbor cell

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 5

 Cellular systems: Frequency planning I
Frequency reuse only with a certain distance between the base stations
Typical (hexagon) model:
f5
f4 f6
f1 f1
reuse-3 cluster: f3 reuse-7 cluster: f3 f7
f2 f5 f2
f1 f1 f4 f6 f5
f3 f3 f1 f4 f6
f2 f2 f3 f7 f1
f2 f3 f7
f2
Other regular pattern: reuse-19
the frequency reuse pattern determines the experienced CIR
Fixed frequency assignment:
certain frequencies are assigned to a certain cell
problem: different traffic load in different cells

Dynamic frequency assignment:

base station chooses frequencies depending on the frequencies already used in
neighbor cells
Frequency Hopping (fixed or random sequence of frequencies)
Improves quality for slow moving or stationary users (frequency diversity)
Reduces impact of intercell interference by statistical averaging

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 6

GSM: Air Interface
FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

Uplink Downlink
890 MHz 915 MHz 935 MHz 960 MHz

1 2 3 ... 123 124 1 2 3 ... 123 124

200 kHz frequency

TDMA (Time Division Multiple Access)

Downlink
1 2 3 4 5 6 7 8

Uplink
1 2 3 4 5 6 7 8

4,615 ms
= 1250 bit time

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 7

GSM: Voice Coding

Channel Modulation
Voice coding Framing
coding (GMSK)
114 bit/slot
114 + 42 bit

GSM TDMA frame

1 2 3 4 5 6 7 8
4.615 ms

GSM time-slot (normal burst)

guard guard
space tail user data S Training S user data tail space
3 bits 57 bits 1 26 bits 1 57 bits 3
546.5 s
577 s
Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot)
Training sequence: select the best radio path in the receiver and train equalizer
Tail: needed to enhance receiver performance
Flag S: indication for user data or control data
Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 8
Mobile Terminated Call (MTC)
1: calling a GSM subscriber
2: forwarding call to GMSC 4
3: signal call setup to HLR HLR
5
VLR

4, 5: request MSRN from VLR 3 6

8 9
14 15
6: forward responsible
MSC to GMSC calling PSTN GMSC
7
MSC
station
7: forward call to 1 2

current MSC 10 10 13 10
16
8, 9: get current status of MS
BSS BSS BSS
10, 11: paging of MS
11 11 11
12, 13: MS answers
14, 15: security checks 11 12
16, 17: set up connection 17
MS

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 9

Location Management / Mobility Management
The issue: Compromise between
Solution 1: Solution 2:
minimizing the area where Large paging area Small paging area
to search for a mobile
minimizing the number of
location updates
RA RA Location
RA
Update
TOTAL
Signalling Cost
=

Signalling
Paging
Cost
RA RA Location
Update
RA

+ Paging Area Update

Signalling Cost

RA RA RA
Location
Update
Location
Update
Location
Update
Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 10
Handover
The problem:
Change the cell while
communicating

Reasons for handover:

Quality of radio link cell 2
cell 1
deteriorates
Communication in other cell
requires less radio resources
Supported radius is
exceeded (e.g. Timing Link quality cell 1
advance in GSM) Handover margin
(avoid ping-pong
Overload in current cell effect)
Maintenance
cell 2

Link to cell 1 Link to cell 2 time

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 11

Handover procedure (change of BSC)

Make-before-break strategy

MS BTSold BSCold MSC BSCnew BTSnew

measurement measurement
report result

HO decision
HO required HO request

resource allocation
ch. activation

HO request ack ch. activation ack make

HO command HO command
HO command
HO access
Link establishment

HO complete HO complete
clear command clear command
break
clear complete clear complete

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 12

 GSM - authentication Challenge-Response:
Authentication center provides RAND to Mobile
AuC generates SRES using Ki of subscriber and
RAND via A3
Ki RAND
Mobile (SIM) generates SRES using Ki and RAND
Mobile transmits SRES to network (MSC)
128 bit 128 bit
AuC network (MSC) compares received SRES with one
generated by AuC
A3

SRES* 32 bit RAND RAND Ki

mobile network
128 bit 128 bit
Authentication Request (RAND)
SIM
A3

SRES 32 bit

MSC Authentication Response (SRES 32 bit)

SRES* =? SRES SRES

Ki: individual subscriber authentication key SRES: signed response

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 13

GSM - key generation and encryption
Ciphering:
Data sent on air interface ciphered for security
A8 algorithm used to generate cipher key
A5 algorithm used to cipher/decipher data
Ciphering Key is never transmitted on air
MS with SIM

RAND
Ki RAND RAND Ki
AuC 128 bit 128 bit SIM
128 bit 128 bit

A8 A8

cipher Kc
key 64 bit mobile network (BTS) Kc
64 bit
data encrypted SRES
data
BTS data MS
A5 A5

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 14

GSM Evolution Overview

adaptive EDGE
modulation
Macro diversity
space
Spectral
efficency diversity Intelligent antennas

time Equalizer
adaptive
interference redundancy HSCSD
GPRS

continuous
Dynamic bursty
Frequency Interference
channel cancelation
hopping
allocation (multi-user Data
detection)
traffic

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 15

HSCSD (High-Speed Circuit Switched Data)

continuous use of multiple time slots for a single user

(on a single carrier frequency)
asynchronous allocation of time slots between DL and UL
gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)

Downlink
1 2 3 4 5 6 7 8 1 2

Uplink
1 2 3 4 5 6 7 8 1 2

mainly software update

additional HW needed if more than 3 slots are used

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 16

2G to 3G Evolution: GSM - GPRS - UMTS

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller
GSM Core
GSM (Circuit
RAN switched)
Base station

HLR
AuC
EIR
GSM+GPRS
SGSN Inter-
net
GPRS Core GGSN
(Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 17

GPRS (General Packet Radio Service)
Introducing packet switching in the network
Using shared radio channels for packet transmission over the air:
multiplexing multiple MS on one time slot
flexible (also multiple) allocation of timeslots to MS
(scheduling by PCU Packet Control Unit in BSC or BTS)
using free slots only if data packets are ready to send
(e.g., 115 kbit/s using 8 slots temporarily)
standardization 1998, introduction 2001
advantage: first step towards UMTS, flexible data services

GPRS network elements

GSN (GPRS Support Nodes): GGSN and SGSN
GGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)
SGSN (Serving GSN)
supports the MS (location, billing, security)

HLR (GPRS Register GR)

maintains location and security information

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 18

GPRS: Multiplexing and multislot allocation

Multiplexing

TS
0 1 2 3 4 5 6 7 carrier

Multislot capability

0 1 2 3 4 5 6 7

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 19

GPRS protocol architecture

MS BSS SGSN
Um Gb Gn GGSN Gi

appl.

IP/X.25 IP/X.25

SNDCP GTP
SNDCP GTP
LLC LLC UDP UDP

RLC BSSGP IP IP
RLC BSSGP
MAC MAC
FR FR L1/L2 L1/L2
radio radio

BSSGP: Base Station Subsystem GPRS Protocol (control plane: routing & QoS)
SNDCP: Subnetwork-Dependent Convergence Protocol (mapping, segmentation,
header compression)
Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 20
GPRS services
End-to-end packet switched traffic (peak channel rates)
28 kbps (full use of 3 time slots, CS-1: FEC)
171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002)

95 kbps (for both up and downlink)

Assumptions: 4/12 reuse, realistic RF conditions, random traffic
Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control FEC)

CS 1: 9.05 Kbps/slot
CS 2: 13.4 Kbps/slot
CS 3: 15.6 Kbps/slot
CS 4: 21.4 Kbps/slot (no Forward Error Correction)
Problems and limits
IP-based network => high latency, no guarantees
Limited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4)
Latency/flow control problems with TCP

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 21

EDGE (Enhanced Data Rates for GSM Evolution)
Enhanced spectral efficiency depends on:
Size of frequency band
Duration of usage
Near-far problem
Level of interference with others (power)

EDGE Technology:
EDGE can carry data speeds up to 236.8 kbit/s for 4
UE 1
timeslots (theoretical maximum is 473.6 kbit/s for 8
timeslots)
Adaptation of modulation depending
on quality of radio path
GMSK (GSM standard 1 bit per symbol)
8-PSK (3 bits per symbol) NodeB
Adaptation of coding scheme depending
on quality of radio path (9 coding schemes)
Gain: data rate (gross) up to 69,2kbps (compare to
22.8kbps for GSM)
UE 2
complex extension of GSM!

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 22

EDGE Adaptive Modulation and Coding Schemes
Scheme Modulation Maximum Code Rate Family
rate [kb/s]
M CS-9 8PSK 59.2 1.0 A
M CS-8 54.4 0.92 A
M CS-7 44.8 0.76 B
M CS-6 29.6 / 27.2 0.49 A
M CS-5 22.4 0.37 B
M CS-4 GM SK 17.6 1.0 C
M CS-3 14.8 / 13.6 0.80 A
M CS-2 11.2 0.66 B
M CS-1 8.8 0.53 C

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 23

2G to 3G Evolution: GSM - GPRS UMTS R99/R3

Transmission
ATM based
Base station Base station ISDN
Base station MSC GMSC
controller
GSM Core
GSM (Circuit
RAN switched)
Base station

GSM+GPRS+UMTS R99 HLR

AuC
EIR

Base station
Base station SGSN Inter-
Radio network
controller net
GPRS Core GGSN
Base station UTRAN (Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 24

2G to 3G Evolution: GSM - GPRS - UMTS R5 - IMS

Base station Base station

Base station
controller
GERAN
GSM
Base station
RAN GERAN + UMTS R5 + IMS

Transmission
Base station IP based
Base station SGSN Inter-
Radio network
controller net
3G Core
GPRS Core GGSN
Base station UTRAN (Packet
Switched)

Mobile Communication Networks Andreas Mitschele-Thiel, Florian Evers 25