Telecom Diploma

Mobile Systems
Definition
Enjoy communication services while
moving
A mobile communication link is a
communication link in which at least
one terminal is mobile
PLMN
Public Land Mobile Network
A generic term for a mobile wireless network
that is centrally operated and administrated
by an organization and uses land-based radio
frequency transmitters or base stations as
network hubs
PLMNs can stand alone and interconnect with
one another or connect to a fixed system
such as the PSTN
Cellular phones and mobile Internet access
are two common uses of a PLMN
1G
First Generation wireless technology (1G) is the
original analog, voice-only cellular telephone
standard, developed in the 1980s.
Analog cellular service is being phased out in
most places worldwide
Examples
NMT (Nordic Mobile Telephone), used in Nordic countries,
Eastern Europe and Russia
AMPS (Advanced Mobile Phone System) used in the US
TACS (Total Access Communications System) in the UK
JTAGS in Japan, C-Netz in West Germany, Radiocom 2000
in France, and RTMI in Italy.
2G

Second generation of mobile wireless

communication technology (digital)
Can be divided into TDMA-based, and
CDMA-based standards
Allows slow data communication, but
its primary focus is voice
Examples
GSM
CDMA
2.5G
The bridging technology between 2G
and 3G
A digital communication allowing e-
mail and simple Web browsing, in
addition to voice.
Examples
GPRS
WiDEN
3G

Third generation of wireless

communication technologies
Support broadband voice, data and
multi-media communications over
wireless networks
Examples
CDMA2000
UMTS
3.5G
Generally refers to the technologies
beyond the well defined 3G
wireless/mobile technologies
HSDPA
High Speed Downlink Packet Access
Currently considered as the primary 3.5G
technology
Software upgrade of WCDMA
Provides high speed broadband wireless
access
4G

The next generation of technology

for high-speed wireless
communications
Currently in research and
development stage
Will be designed for new data
services and interactive TV through
mobile network
E.g., LTE
3GPP / 3GPP2
The 3rd Generation Partnership Project (2)
A collaboration agreement that was established in
December 1998
A co-operation between ETSI (Europe), ARIB/TTC (Japan),
CCSA (China), ATIS (North America) and TTA (South Korea)
The scope of 3GPP was to make a globally applicable third
generation (3G) mobile phone system specification within
the scope of the ITU's IMT-2000 project
3GPP specifications are based on evolved GSM
specifications, now generally known as the UMTS
system.
3GPP2, in practice, is the standardization group for
CDMA2000, the set of 3G standards based on earlier 2G
CDMA technology
Air Interface
In wireless communications, the air
interface is the radio frequency (RF)
part of the network that transmits
signals between base stations and
end-user equipment.
The air interface is defined by
specifications for a specific format
such as GSM, cdma2000, GPRS, or
UMTS
BS
Base Station
A transmitter and receiver serves as
a bridge between all mobile users in
a cell and connects mobile calls to
the mobile switching centre
BSC
Base Station Controller
A device and software associated
with a base station that
permits it to register mobile phones in
the cell
assign control and traffic channels
perform handoff and
process call setup and termination
BSIC

Base Station Identity Code

A unique code contained in
messages on the broadcast channels
of a cell or base station that uniquely
identifies the base station.
BSS
The Base Station Subsystem
The section of a cellular network which is responsible
for handling traffic and signalling between a mobile
phone and the Network Switching Subsystem
Carries out
transcoding of speech channels
allocation of radio channels to mobile phones
Paging
quality management of transmission and reception
over the Air Interface, and
many other tasks related to the radio network
Cellular System
In wireless communications, cellular refers most basically to
the structure of the wireless transmission networks which
are comprised of cells or transmission sites.
Each connection, or conversation, requires its own
dedicated frequency, and the total number of available
frequencies is limited.
To support large number of simultaneous conversations
(more than the number of available frequencies), cellular
systems allocate a set of number of frequencies for each
cell.
Two cells can use the same frequency for different
conversations as long as the cells are not adjacent to each
other.
The terms "cellular phone" or "cell phone" are used
interchangeably to refer to wireless phones
Cell
In wireless communication, Cell is the
geographic area encompassing the signal
range from one base station
Wireless transmission networks are comprised
of many hexagonal, overlapping cell sites to
efficiently use radio spectrum for wireless
transmissions.
Basis for the term "cellular phone
Cell Site
Cell Site, also called the Base Station,
is the local cellular tower and radio
antenna (including the radios,
controller, switch interconnect, etc.)
that handles communication with
subscribers in a particular area or cell.
A cellular network is made up of many
cell sites, all connected back to the
switch via landline or microwave.
Channel
In wireless communication, a channel
describes a communications path between
two systems.
They may be either physical or logical
depending on the application
An RF channel is a physical channel, whereas
control and traffic channels within the RF
channel would be considered logical channels
Downlink (forward) is the transmission path
from the base station down to the mobile
station
Uplink (reverse) is the transmission path from
the mobile station up to the base station
Handoff or Handover
The transfer of a cellular phone transmission
from one radio frequency within a cell to
another radio frequency in an adjacent cell.
Handoffs occur when a cellular phone user
passes out of the range that the cell can
handle and into another cells range, and the
signal is passed from one base station to the
next.
The handoff is transparent to the user and
typically will not result in a loss of service
unless the user moves out of range of a cells
base station.
The transition and the process required to
make the transition are both referred to as
the handof.
Handoff (cont)
Soft handof
It is a process of establishing a link with a target
sector before breaking the link with the serving
sector
Softer handof
Like the soft handoff, but the handoff is occurred
between multi-sectors in the same base
station
Hard handof
Hard handoff occurs when the two sectors are
not synchronized or are not on the same
frequency. Interruption in voice or data
communication occurs but this interruption
 Transmission Techniques
Traffic channels: diferent users
CDMA are assigned unique code and
transmitted over the same
frequency band, for example,
Power WCDMA and CDMA2000
y
e nc
Ti qu
m e
e Fr TDMA
Traffic channels: diferent time
slots are allocated to diferent
users, for example, GSM and
Power DAMPS
cy
Tim uen
e q
e Fr FDMA

Power Traffic channels: diferent

cy frequency bands are
e n
Tim qu allocated to diferent
e e
Fr users,for example, AMPS
and TACS
 Development of Mobile
Communications
1st Generation 2nd Generation 3rd Generation
1980s (analog) 1990s (digital) current (digital)

GSM UMTS
AMPS WCDMA
CDMA
TACS IS95 CDMA
Analog to Voice to
2000
NMT Digital TDMA Broadband
IS-136 TD-
Others SCDMA
PDC

EDGE: Enhanced Data rates for Global Evolution or Enhanced Data GSM
Environment or Enhanced Data rates for GSM Evolution
A faster version of GSM wireless service that enables data to be delivered
at rates up to 384 Kbps
Although technically a 3G network technology, it is generally classified as
the unofficial standard 2.75G, due to its slower network speed
Mobile Systems

CDMA
Development of CDMA
System
CDMA2000
3x
CDMA2000
1x 307.2kbps
Heavier voice
IS95A IS95B
9.6kbp 115.2kb CDMA2000
s ps service 1x EV
capacity
1995 1x EV-DO
1998 Longer period
1x EV-DV
of standby time
2000
2003

Higher spectrum efficiency and network

capacity
Higher packet data rate and more
diversified services
Smooth transit to 3G
1xRTT
1xRTT is a cellular data technology
for CDMA networks.
RTT stands for Radio Transmission
Technology
1xRTT has a theoretical maximum of
144 Kbps of bandwidth, but achieves
a practical throughput of only 50 to
70 Kbps in the real world.
1xEV-DO
1xEV-DO, also known as Evolution
Data Optimized (EV-DO)
A 3G cellular data technology for
cellular phones, networks and
handheld devices
Its bandwidth is up to 3.1Mbps
1xEV-DV
1xEV-DV, also known as Evolution
Data/Voice (EV-DV)
A 3G cellular data technology for
cellular phones, networks and
handheld devices
Its bandwidth is up to 3.1Mbps
CDMA2000 Network
Structure

(1)
Mobile Station (MS)
The mobile subscriber equipment, which can
originate and receive calls and communicate
with the BTS.
Base Transceiver Station (BTS)
Transmits and receives radio signals, realizing
communication between the radio system and
the mobile station.
Base Station Controller (BSC)
Performs management and control of BTS, call,
mobility, handoff, power, and radio resources
Packet Control Function (PCF)
Performs the radio packet connection
management
 CDMA2000 Network
Structure (2)
Packet Data Service Node (PDSN)
Performs the switching of packet data services of mobile
subscribers.
One PDSN can be connected to multiple PCFs.
It provides the interface between the radio network and
the packet data network.
Home Location Register (HLR)
A database for mobile subscriber management
Responsible for storing subscription information, MS
location information, MS identity numbers
AC (Authentication Center)
A database that is physically combined with the HLR.
A functional entity of the HLR, specially dedicated to the
security management of the CDMA system.
It stores the authentication information.
prevents unauthorized subscribers access
CDMA2000 Network
Structure (3)
Home Agent (HA)
An HLR like agent located at the home network of the
Mobile Node
Broadcasts the accessible information of MN
Tunnels data for the MN when it is in a foreign network
Mobile Switching Center (MSC)
The MSC implements the service switching between the
calling and called subscribers.
One MSC is connected with multiple BSCs, and can also
be connected to the PSTN, ISDN or other MSCs.
Visitor Location Register (VLR)
a dynamic database, stores the temporary information
(all data necessary to set up call connections) of the
roaming subscribers in the local MSC area
CDMA 2000 Network
Structure (4)
 Direct Spread (DS)
Transmission Receiving
Wideband signal

Slow Information Slow information

Sent Recovered

Fast spreading sequence Fast spreading sequence

Direct Sequence Spread spectrum system mixes the input data

with a fast sequence and transmits a wideband signal.
The spreading sequence is independently regenerated at the
receiver and mixed with the incoming wideband signal to
recover the original information.
 Spectrum-domain Analysis
Power spectrum of Power spectrum of
information spread signal(broad
signal(narrow band) band)
P() Spread P()

P()

Add

P() P() De-spread P()

integral/filtering

Mixed signals Mixed signals

Recover signals power power
power spectrum spectrum(broad spectrum(broad
(narrow band) band and narrow band and broad
band) band)
Communication Model
10010
11001
11000
11001
1

1 0 1 0 1 1

Channel
Source coding Spread Scrambling Modulation RF transit
Coding

Revers
e
Forwar
Symbo d
Bit Chip
l

1 0 1 0 1 1

Source Channel
De-Spread Unscrambling Demodulation RF receive
Decoding Decoding
MS: Which BTS ?

P BTS B
BTS A 4N

8
10
PN
2
PN 5

BTS C
Short code

512 total PN available to identify the 512 sectors/BTSs.

MS-B: Which is my signal?

0000000. A
0101010 B
0000111 C
MS-C

MS-H
0

MS-G 0101010
MS-B
MS-A
MS-F

MS-D

MS-E
Walsh codes
Each MS has unique Walsh code
BTS: Which MS?

MS-C

MS-H

MS-G MS-B

MS-A

MS-F

MS-D
Long code
MS-E

A PN sequence (long code) is used to Spread the information on the

reverse CDMA channel and identify the MS
 Power Control: CDMA is a self-
interference system`

no power control

after power control

All mobiles transmit at the same frequency, internal interference generated

within the system plays a critical role in determining system capacity and
traffic quality.
The transmit power from each mobile must be controlled to limit
interference
Power Control Classification
According to the direction
Reverse power control
Forward power control
According to the type
Reverse power control
Reverse open loop power control
Reverse closed loop power control
Forward power control
Measurement report power control
EIB power control
Fast power control
 RAKE Receiver

Delays on the reflected path may add to (strengthen) or subtract from

(fade) the main path. Solution: multiple receive antennas or frequency
Pilot Set (1)
An MS always track the pilot channel of different BTSs (or
sectors).
It determines the pilot signal strength and if it is strong,
reports to the BSC through the current BTS for new
connectivity
MS arranges the different detected Pilots into groups or
Sets
Active set
A set of pilots which are being used by MS for communication.
A CDMA system can have up to 6 pilots in this set
Candidate set
Pilots which are not being used by MS but have enough signal strength
that MS can use it for connectivity
Neighbor set
Pilots which are of neighboring BTSs to the serving one.
Once a good signal is received from any neighbor pilot, MS updates his
information and put this pilot in to the candidate or active set.
Remaining Set
 Searcher correlator

Pilot Sets (2)

Active Set

Candidate Set

Neighbor Set

Remaining Set
Soft Handoff And Softer
Handoff
MS can keep traffic channel
with two or more sectors.
Soft handoffinvolves
traffic channel from more
than one BTS and Multi-
path combination in the
BSC.
Softer handoffinvolves
traffic channel from two or
more sectors of one BTS
and Multi-path combination
in the BTS.
Definition of Coverage Areas
Service area

PLMN area

MSC area

Location area

Cell area

Sector
area
 MIN/IMSI (identity/international mobile subscriber identity )

15 digits

3 digits 2 digits

MCC MNC MSIN

NMSI

IMSI

Mobile subscriber identity/international mobile

subscriber identity
For example, 634070110023406

MCC: Mobile Country Code, 634 for Sudan

MNC: Mobile Network Code 01: zain, 02: MTN, 07: sudani
MIN/IMSI
IMSI is the only number to identify a
mobile user in a CDMA digital public land
cellular mobile communication network.
This code is valid in all locations including
a roaming area
IMSI adopts E.212 coded system.
IMSI is stored in the mobile station/UIM
card, HLR and VLR and transmitted on a
wireless interface and MAP interface.
ESN (Electronic Serial
Number )
A unique Electronic Serial Number (ESN) is used to identify single
MS. An ESN includes 32 bits and has the following structure:

31 24 23 1817 0

Manufacturers reserved
number Equipment SN

For example, FD 03 78 0A (the 10th Motorola 378 mobile phone)

The equipment serial number is allocated by a manufacturer.
 MDN (Mobile directory
number) subscriber
number

CC + MAC (NDC) + H 0H 1H 2H 3 + ABCD

International mobile subscriber DN

National valid mobile subscriber number

Is the dialed no when a mobile user is in home network
MDN adopts E.164 coded system.
MDN is stored in HLR and VLR, and transmitted on a MAP interface
CC: country code, e.g., 249
MAC: Mobile Access Code, network number plan adopted in home
network, 12, 11: sudani, 90,91: zain, 92: MTN
ABCD: mobile user number, allocated by various HLRs.
H0H1H2H3 regulator dependent (HLR ID)
NDC: national destination code
 TLDN (Temporary local directory
number)

CC + MAC + 44 + H0H 1H2 + ABC

TLDN is a number temporarily allocated by the VLR of the visiting office

to a visiting mobile user for the sake of network routing when a call is
made to a mobile user.
TLDN is part of a mobile user MDN and its number structure is shown in
the figure:
CC: country code
MAC: mobile access code
H0H1H2: identify a certain MSC/VLR.
ABC: defined by MSC/VLR itself.
Location Area Identity (LAI)
PAGING message is broadcast within a local area, the
size of which depends on traffic, paging bearer
capability, signaling flow , etc.
Format: MCC+MNC+LAC
MCC: Mobile Country Code, 3 digits
MNC: Mobile Network Code, 2 digits
LAC: Location Area Code, a 2-byte-long hexadecimal
BCD code. 0000 cannot be used with FFFE
Global Cell Identity (GCI)
The unique ID of a cell in PLMN
Format: LAI+CI
CI: Cell Identity, a 2-byte-long hexadecimal
BCD code, pre defined by the engineering
department. The first 3 digits and the last
digit represent the base station number
and the sector number respectively. For an
omni-directional site, the last digit of CI is
0.
For example, 4600301001230 shows base
station number 123 contains an omni-
Example: Number Analysis
According to
MDN, get the
Transfer IMSI that can be
TLDN to used to query
MSC1 VLR Location
Number With IMSI,
Analysis HLR
send
120120XXX paging
Find HLR informatio
n to B

BSC MSC1/VLR MSC2/VL BSC

R
With
TLDN,
connect
to MSC2 According to IMSI,
BT allocate TLDN that will BT
S be sent back to HLR S

120120120 Here is a call for you

Lab Activities: Network Components
Access network:
BTS
BSC
BTS-BSC connection: E1
Core Network:
HLR
HDU (for user data base, Linux server)
SAU (for signaling, windows)
SMU ( business hall , adding, query ,.(Windows))
MSCe (Soft switch)
VLR
MGW
 Lab Activities: HLR
commands
ADD CSUB
creation of a new subscriber
LST CSUB (249127777777, 249126666666)
query information of existing subscriber
LST M3LNK
query the information of the M3UA link
between HLR and Softswitch
Using the maintenance terminal, student should
trace the Location Update and the registration of
the MS

 Lab Activities: MSCe

Commands
DSP USRINF
User information on VLR
the result will be two active user in the VLR (0126 666666 and
0127 777777)
LST M3LNK
to list all the M3UA LINK created in the MSC
the result will show the link between MSC and HLR,IN and SMC
LST H248LNK
Between MGW and MSC
this indicate the H.248 link
DSP VLRUSR
for all VLR
Using the maintenance terminal the students should trace the
Location Update and the registration of the MS in the network and
also the student should trace the call setup messages.
 Lab Activities: MGW
The MGW is controlled by the MSCe
using the H.248 protocol which can
be traced from the MSCe side
GSM

Basics
Overview
GSM: Global System for Mobile Communications
1990, GSM phase 1 published
GSM uses a TDMA/FDMA combination
More channels of communication are available
All channels are digital
GSM uses higher frequency bands
Provides additional capacity
And higher subscribers densities
GSM is capable for international roaming through
agreements between GSM operators worldwide
Frequency Bands: 450, 900,1800,1900 MHz
Technical data
Multiple Access Method
TDMA / FDMA
BS to MS frequencies
935960 MHz
MS to BS frequencies
890915
Duplex spacing
45 MHz
Channel spacing
200 kHz
8 Speech Channels per RF channel
SIM
Subscriber Identity Module or Smart Card
Contains a computer chip and some non-
volatile memory
Inserted into a slot in the base of the handset
The memory held info include
Subscriber identity number
Telephone number
Original network to which the subscriber belongs
Can be moved from one handset to another
A handset reads the info off the smart card
and transmits it to the network
Network Elements
Mobile Station (MS)
Base Transceiver Station (BTS)
Base Station Controller (BSC)
Base Station Subsystem (BSS)
Mobile Switching Center (MSC)
Equipment Identity Register (EIR)
Authentication Center (AuC)
Home Location Register (HLR)
Visitor Location Register (VLR)
Network and Switching Subsystem (NSS)
MS
Mobile Station
Starting point of a mobile wireless network
Can contain
Mobile Terminal (MT)
GSM cellular handset
Terminal Equipment (TE)
PC or Personal Digital Assistant (PDA)
Can be
Two devices (MT & TE) interconnected with a P-t-P
interface
A single device with both functions integrated
BTS
Base Transceiver Station
A subscriber call request is sent by the MS
to the BTS
Includes all the necessary radio equipment
for radio transmission within a cell
Antennas, signal processing devices, amplifiers
Responsible for
Establishing the link to the MS
Modulating/Demodulating radio signals between
the MS and the BTS
BSC
Base Station Controller
The controlling component of the radio
network
Manages the BTSs
Reserves radio frequencies for
communications
Handles the handoff between BTSs when an
MS roams from one cell to another
Responsible for paging the MS for incoming
calls
BSS
Base Station Subsystem
A GSM network is comprised of many
BSSs
Each BSS is controlled by a BSC
The BSS performs the necessary
functions for
Monitoring radio connections to the MS
Voice coding/decoding
Rate adaptation to/from the wireless
network
A BSS can contain several BTSs
MSC
Mobile Switching Center
A digital ISDN switch that sets up
connections to the other MSCs and to
the BSCs
The MSCs form the wired (fixed)
backbone of a GSM network and can
switch calls to the PSTN
An MSC can connect to several BSCs
EIR
Equipment Identity Register
A database that stores the international
mobile equipment identities (IMEIs) of
all the MSs in the network
The IMEI is an equipment identifier
assigned by the manufacturer of the MS
The EIR provide security features such
as blocking calls from handsets that
have been stolen
HLR
Home Location Register
The central database for all users to
register to the GSM network
Stores subscribers static information
such as
International mobile subscriber identity
(IMSI)
Subscribed services
Subscriber authentication key
It also stores dynamic subscriber info
such as the current location of the
AuC
Authentication Center
A database associated with the HLR
Contains
The algorithms for subscribers
authentication
The necessary encryption keys to
safeguard the user input
VLR
Visitor Location Register
A distributed database that temporarily stores
information about the MSs that are active in
the geographic area for which the VLR is
responsible
A VLR is associated with each MSC in the
network
When a new subscriber roams into a location
area, the VLR copies subscriber info from the
HLR to its local database
This HLR-VLR relationship avoids
Frequent HLR database update
Long distance signaling of the user info
Hence allowing faster access to subscriber info
GSM database
The HLR, VLR, and AuC comprise the
management database that support
roaming (including international
roaming) in the GSM network
They authenticate calls while the GSM
subscribers roam between the private
network and the PLMN
They store subscriber identities, current
location area, and subscription levels
NSS
Network and Switching Subsystem
The heart of the GSM system
Connects the wireless network to the
standard wired network
Responsible for calls handoff
between BSSs
Perform services such as
Charging
Accounting
Roaming
 Other Network
AuC
EIR

GMSC/VLR
BSS
HLR

MS BTS
BSC MSC/VLR
cell
NSS

BSC
MS BTS

cell

GSM network s truc ture

Interfaces
Um
(1)
Air interface (MS to BTS)
Traffic
Voice: 13kbps, Data: 9.6kbps
Signaling
Link Access Procedure-D mobile (LAPDm)
Abis
BTS to BSC
Traffic
16kbps
Signaling
LAP-D signaling protocol
Interfaces (2)
TRAU: Transcoder Rate Adapter Unit
BSC to MSC
A interface
Traffic
Translates between the 16 kbps on the BTS
side and the 64 kbps on the GMSC side
Signaling
SS7 protocol, which defines call set-up and
call services across the interface
Interfaces (3)
B: MSC-VLR
C: MSC-HLR
D: HLR-VLR
E: MSC-MSC
F: MSC-EIR
G: VLR-VLR
H: HLR-AuC
Interfaces (4)

MS AuC

Um D
H PSTN, ISDN, PDN

BTS VLR HLR

C
Abis B

BSC GMSC
A
F EIR D
E

B
MSC VLR
GPRS

Overview
Introduction
General Packet Radio Service
Provides packet radio access for GSM users
Allows network operators to implement an IP based core architecture
for data applications, and it can be expanded for integrated voice and
data applications
It was originally standardized by ETSI, but now by the 3GPP
For multiple access control, FDD and FDMA methods are used
During a session, a user is assigned to one pair of UL and DL
frequency channels.
This is combined with time domain statistical multiplexing, i.e. packet
mode communication, which makes it possible for several users to
share the same frequency channel
The DL uses FIFS packet scheduling, while the UL uses a reservation
scheme
When the mobile built-in browser is used, IPv4 is utilized.
But if the mobile is used as a modem to the connected computer, PPP
is used to tunnel IP to the phone
Packet transport rates: from 9.6 kbps to 171 kbps
GPRS applications
Features
Ability to maintain constant voice and data communications while on
the move
Ability to obtain connectivity when needed regardless of location
Ability to obtain info relevant to subscribers current location
Ability to reach applications whether they reside in the service
providers network or the public Internet
Examples
Communications
E-mail, fax, unified messaging, intranet access, Internet access
Value-added services
Information services, games
E-commerce
Banking, financial trading
Location-based applications
Navigation, traffic condition, hotel finding
Vertical applications
Vehicle tracking
advertising
GPRS network elements
(NEs)
Terminal Equipment (TE)
BTS
BSC
GSN
GPRS Support Node
SGSN: serving GSN
GGSN: gateway GSN
Databases
All existing databases (HLR, VLR, . . ) with
software upgrade
 SMS-GMSC SMS-SC
SMS-IWMSC

MSC/VLR HLR

PDN TE
TE MT BSS SGSN GGSN

SGSN EIR
GGSN

Other PLMN

GPRS network Signaling & data

diagram signaling
GPRS interfaces
Ga: GSN-CG
Gb: SGSN-BSS
Gc: GGSN-HLR
Gi: GGSN-external PDN
Gn: GSN-GSN
Gp: GSN-GSN in different PLMN
Gr: SGSN-HLR
Gs: SGSN-MSC/VLR
Gf: SGSN-EIR
GPRS BSS
BSC + one or more PCU + software upgrade
PCU provides a physical and logical data interface to the
BSS for packet data traffic
BTS: no hardware enhancements, but may need software
upgrade
When either voice or data traffic is originated at the
subscriber terminal, it is transported over the air interface
to the BTS, and from the BTS to the BSC in the same way as
a standard GSM call
However, at the output of the BSC, the traffic is separated
Voice is sent to the MSC per standard GSM, and data is sent
to the SGSN via the PCU over a Frame Relay interface
The PCU can be a separate hardware element associated
with the BSC
GPRS Support Node (GSN)
Core Network Entities
Existing MSCs are based on circuit
switched technology
Can not handle packet traffic
Two new components (GSNs), are
added
Serving GPRS Support Node (SGSN)
Gateway GPRS Support Node (GGSN)
SGSN
Delivers packets to MSs within its service area
Obtains GPRS subscriber profile data by
sending queries to the HLR
Detects new GPRS MSs in a given service area
Processes registration of new MSs
Keeps records of MSs locations inside a
predefined area
Performs mobility management (e.g., handoff)
Connected to BSS (PCU) through a FR
connection
GGSN
Interface to external IP networks (e.g.,
Internet), other GPRS networks, or enterprise
intranets
Maintains routing info that is necessary to
tunnel the PDUs to the SGSNs that serve
particular MSs
Performs network/subscriber screening
Performs address mapping
One or more GGSNs can be provided to
support multiple SGSNs
Data Packet Routing
Interaction with the external data network is a
main function of the GGSN
SGSNs supply routing information about the MS
location, and the GGSN updates the location
directly accordingly
The GGSN receives packets from external data
network, encapsulates it, and sends it over the
GPRS backbone to the SGSN currently serving the
MS
For outgoing packets, the GGSN decapsulates and
forwards them to the appropriate external data
network, and collects charging data that is
forwarded to a charging gateway (CG)
GPRS network encapsulates all data network
protocols into its own encapsulation protocol: the
GPRS tunneling protocol (GTP)
GTP
GPRS tunneling protocol
A layer 3 tunneling protocol
IP header identifies a session flow between
the GGSN and SGSN
The UDP header identifies the GTP application
protocol (port 3386)
The GTP header identifies the GTP tunnel
session
The payload identifies the session flow
between the MS and the remote host
IP UDP GTP Payload (IP or PPP)
GPRS
Attach processes
Process by which the MS attaches (connects) to
the SGSN
Authentication
Process by which the SGSN authenticates the
mobile subscriber
PDP activation
Process by which a user session is established
between the MS and the destination network
Detach
Process by which the MS detaches
(disconnects) from the SGSN
Network-initiated PDP request for static IP
address
Network-initiated PDP request for dynamic IP
address
 Attach
When a mobile subscriber turns on his handset
A handset attach request is sent to the new SGSN
The new SGSN queries the old SGSN for the identity of this
handset
The old SGSN responses with the handset identity
The new SGSN requests authentication info from the MS
The authentication process continues to the HLR
The HLR acts like a radius server using a handset-level
authentication based on IMSI
A check of the equipment identity is initiated with the EIR
If the equipment ID is valid, the new SGSN sends a location update
to the HLR indicating the change of location to the new SGSN
The HLR notifies the old SGSN to cancel the location process for
this MS
The HLR sends an insert subscriber data request and notifies the
new SGSN that the update location has been performed
The new SGSN initiates a location update request to the VLR
The VLR acts like a proxy RADIUS that queries the home HLR
The new SGSN sends the attach accept message to the MS
The MS sends the attach complete message to the new SGSN
The new SGSN notifies the new VLR that the relocation process is
complete
MS BSS NSGSN OSGSN GGSN EIR NMSC/VLR HLR OMSC/VLR
GPRS subscriber terminals
Existing GSM phones do not handle enhanced air
interface or packet data
New terminals required, but backward compatible with
GSM for voice calls
Terminal Equipment (TE)
Refers to the variety of mobile phones and mobile stations
that can be used in a GPRS environment
Defined by class and type
Classes
A, B, and C
Types
High speed version of current phones
New PDA device with an embedded GSM phone
PC cards for Laptops
Class A Terminals
Support simultaneous attach,
activation, monitor, and traffic for
GPRS and other GSM services (SMS,
voice, . .)
Can make or receive calls on two
services simultaneously
In the presence of circuit switched
services, GPRS virtual circuits are
placed on hold instead of being
cleared
Class B Terminals
Can monitor GSM and GPRS channels
simultaneously, but can support only one
service (GSM or GPRS) at a time
Therefore, it can support simultaneous attach,
activation, and monitor, but not simultaneous
traffic
GPRS VCs held on presence of circuit-
switched traffic
Users can make/receive either packet or
circuit switched calls sequentially, but not
simultaneously
Class C Terminals
Support only sequential attach
User must select which service to
connect to
Can make/receive calls only over the
manually selected service
Other service is unreachable
GPRS MS states
A GSM MS has one of two states
Idle
Active
While a GPRS MS has three possible
states
Active
Standby
idle
GPRS MS states: Active
Data is transmitted between an MS and the GPRS network only
when the MS is in the active state
In this state the SGSN knows the location (cell) of the MS
Transmission is initiated by paging to notify the MS of an
incoming data packet
The paging message indicates the channel that will be
immediately used for data transmission
MS listens only to the paging messages (not all data packet in
DL channels), significantly reducing battery usage
When an MS has a packet to transmit, it must access the UL
channel that is shared by a number of MSs, and its use is
allocated by a BSS
The MS requests use of the channel in a random access
message
The BSS allocates an unused channel, and sends an access
grant message including the description of the channel (one or
multiple TSs)
Data is transmitted on the reserved channels
GPRS MS states: Standby
In this state, only the routing area of the MS is known
(one or more cells within a GSM location area)
Before sending a packet to an MS in the standby state,
the SGSN sends a paging message to the routing area
On receiving the packet paging message, the MS relays
its cell location to the SGSN to establish the active state
Standby state reduces the load in the GPRS network
caused by cell-based routing update messages, and
saves MS battery
The SGSN is informed of only routing area changes
Hence, the operator can control the number of routing
update messages by adjusting the size of the routing
area
GPRS MS states: Idle
MS does not have a logical GPRS
context activated
It does not have any packet-switched
public data network address
It can receive only multicast messages
those can be received by any GPRS MS
MS location is unknown to the network,
and it is not possible to send messages
to that MS from external data networks
UMTS

Basics
Overview
Universal Mobile Telecommunication System
3G mobile communication system that provides a range
of broadband services
Delivers low-cost mobile communications at data rates
of up to 2 Mbps
Preserves the global roaming capability of GSM/GPRS
networks, and provides new enhanced capabilities
Designed to provide voice, data, and multimedia
services for mobile wireless subscribers
Extends GSM/GPRS networks toward an all-IP network
Uses Wide-band Code Division Multiple Access (WCDMA)
Handover between UMTS and GSM is supported
Service: QoS classes
Conversational class
Voice, video telephony, video gaming
Streaming class
Multimedia, video on demand, webcast
Interactive class
Web browsing, database access
Background class
E-mail, SMS, file downloading
Service: categories and applications

Internet access
Messaging, video download, VoIP, mobile
commerce
Intranet/extranet access
Enterprise e-mail, mobile sales, corporate database
access, conferencing
Customized information
Info download, travel assistance, distance
education
MMS
SMS extension for images, unified messaging,
document transfer
Location based services
Yellow pages, trading, navigational service
Network Elements
GSM core NEs
MSC, HLR, VLR, AuC, EIR
GPRS NEs
SGSN, GGSN
UMTS-specific NEs
User Equipment (UE)
UMTS Terrestrial Radio Access Network (UTRAN)
elements
 GSM BSS
VLR GMSC PSTN
PSTN
BTS MSC ISDN
ISDN
MS

BSC

BTS

UTRAN EIR VLR HLR

AuC

Node B
PDN
PDN
UE RNC

SGSN GGSN
Node B

Core network
Node B RNC

Architecture
UMTS interfaces
Four new open interfaces
Uu
UE-Node B, the UMTS air interface
Iu
RNC-GSM/GPRS
Iu-Cs: circuit switched data
Iu-Ps: packet switched data
Iub
RNC-Node B
Iur
RNC-RNC
UTRAN
UMTS terrestrial radio access network
UMTS uses WCDMA for air interface access
WCDMA has two basic operation modes
Frequency Division Duplex (FDD)
Time Division Duplex (TDD)
This new air interface requires a new radio access network
(RAN), which is the UTRAN
The core network requires minor modifications to
accommodate the UTRAN
Two new NEs are introduced in the UTRAN
RNC
Node B
The UTRAN contains multiple radio network systems (RNS),
and each RNS is controlled by an RNC
The RNC connects to one or more Node B elements
Each Node B can serve multiple cells
RNC
Radio Network Controller
Similar functions to BSC of GSM/GPRS
Provides centralized control of the node B
elements in its coverage area
Handles protocol exchange between UTRAN
interfaces
Provides centralized O&M for the RNS and
access to an OSS
Unlike GSM/GPRS RNC uses Iur interface to
manage radio resources
Manages control functions such as connection
to the UE, congestion control, and handover
Node B
Equivalent to the BTS
Radio tx/rx unit of communication between cells
Can be physically located with an existing GSM BTS:
reducing cost
Connects to the UE over the radio interface using WCDMA
A single node B can support both FDD and TDD modes
Connects to the RNC using ATM
Functions
Air interface Tx/Rx
Modulation/Demodulation
CDMA physical channel coding
Diversity
Closed loop power control
Data conversion on the air interface including error
correction and rate adaptation
It monitors the quality and strength of the connection
and calculates the frame error rate, and sends the result
to the RNC
UE
UMTS user equipment
It is the combination of the subscribers
mobile equipment and the UMTS subscriber
identity module (USIM)
The USIM is physically similar to the
GSM/GPRS SIM, and it
Supports multiple user profiles
Updates its information over the air
Provides security functions
Provides user authentication
Supports payment methods inclusion
Supports secure downloading of new applications
UE identity parameters
Many of them taken directly from GSM
IMSI
International Mobile Subscriber Identity
TMSI
Temporary Mobile Subscriber Identity
P-TMSI
Packet Temporary Mobile Subscriber Identity
TLLI
Temporary Logical Link Identity
MSISDN
Mobile Station ISDN
IMEI
International Mobile Equipment Identity
IMEISV
International Mobile Station Equipment Identity and Software
number
UE operation modes
PS/CS mode
UE is attached to both packet-switched and circuit-
switched domain
UE can simultaneously use PS and CS services
PS mode
UE is attached to the PS domain
Can use only PS service
Allows CS-like services (e.g., VoIP)
CS mode
It is attached to the CS domain
Uses only CS services