Mobile infocommunication systems Mobile infocommunication networks - GSM/GPRS system - GSM/GPRS radio interface basics Fazekas Péter, PhD. BME Dept. of Networked Systems and Services www.hit.bme.hu
Voice telephony basics
Setting the scene end of 1980 s, beginning of 1990 s voice telephony -> transformed to digital telephony networks ISDN: integrated services digital network: defined the digital end terminal (phone) and full digital network GSM stepped in to extend ISDN to mobile environment started in the beginning of 1990 s Hálózati Rendszerek és Szolgáltatások Tanszék Budapesti Műszaki és Gazdaságtudományi Egyetem 3
Voice telephony core of the network: telephony exchange offices, or telephony exchanges large, high capacity switching centres capable of switching hundreds of thousands of connections PBX Private Branch Exchange: local exchange centers, to interconnect the local telephony of a company, or a building signalling: SS7 (Signalling System Seven) the flow of messages and set of rules how the exchange centres communicate to each other the goal is to set up a fix, permanent connection between any two endpoint of the network, based on the called party telephone number Hálózati Rendszerek és Szolgáltatások Tanszék Budapesti Műszaki és Gazdaságtudományi Egyetem 4
SS7 Signalling example e.g. setting up a call. Messages like: IAM (Initial address message: the number of the called; CPG: call in progress)
Network behind voice telephony high capacity voice trunks, carrying a lot of calls together switch/route the trunks multiplexing / de-multiplexing groups of calls finally to interconnect all exchanges carry voice traffic and signalling Hálózati Rendszerek és Szolgáltatások Tanszék Budapesti Műszaki és Gazdaságtudományi Egyetem 6
TDM Plesiochronous Digital Hierarchy for digital telephony trunk lines designed together with SS7 and to carry 64 kbps voice channels ISDN PRI: 30 voice channels + signaling : 2048 kbps E1 in telecommunications: n*e1 capcities
TDM Time division Multiplexing multiplexing: 1 byte voice sample for each connection + 1 byte link control, 1 byte signaling
TDM SDH: Synchronous Digital Hierarchy high capacity core network technology, mainly over optical fibers slight difference in the US SONET can carry in containers the former E carriers often implemented over microwave wireless point-point links
TDM basic bitrate is: 155 Mbps, STM1 ez a szabványban definiáltan számos kapcsolattípus összefogásával érhető el other rates are: STM4: 622 Mbps; STM16: 2.5 Gbps; STM64: 10 Gbps, STM256: 40 Gbps in all cases: a frame is 1/8000 sec a byte in a frame: a voice call a timeslot in the transmission link
TDM hierarchically built networks fix n*e1 capacities between points
TDM simplifed view usually topology is such that anything (except the last segments) can be reached via multiple routes more local loops/endpoints are aggregated at higher levels of TDM hierarchy
TDM
2G GSM networks
GSM network MS MSC/VLR IWF B T S B S C MS B T S B S C AuC HLR EIR PSTN MS MSC/VLR IWF BTS B S C
GSM network
GSM system GSM network consists of four subsystems Mobile Station (MS), Base Station Subsystem (BSS) Network Switching Subsystem (NSS) Operation SubSystem (OSS). The main interfaces between the network elements are Um: radio interface (MS BSS), Abis interface (inside BSS: BTS BSC) A interface (BSS MSC). Mobile Station MS: it is a subsistem, containing the SIM card (Subscriber Identity Module) and Mobile Equipment ME: the equipment itself
BSS, Base Station Subsystem this is the access network, containing devices for allowing mobile terminals to reach the network devices for controlling the radio network three main functinal entities Base Transceiver Station (BTS), Base Station Controller (BSC) TransCoder (TC), often: Transcoding Unit
BSS, Base Station Subsystem BTS: Base Transceiver Station base stations are connected directly to the mobile stations, over the radio interface physical layer signal processing main functions: channel coding and decoding: error correction interleaving and de-interleaving: mixing data encryption and decryption of voice streams radio processing measurement of channel quality in summary: the digital voice stream is transformed to/from radio waves by the BTS
BSS, Base Station Subsystem BSC, Base Station Controller main functions: configure and control the radio channel for all base stations and cells under its control connection point towards the NSS it controls and monitors allocation of radio channels (timeslots) for all user terminals, control and traffic channels quality and strength of traffic channels finding the subscriber within its area (paging) handover of calls between cells in summary: management of radio resources (channels) and interconnection towards NSS the mobile phone s signalling is connected to the BSC
GSM system
BSS, Base Station Subsystem Transcoding and Rate Adaptation Unit (TRAU) creating the voice stream of the radio interface (13 kbps) from the traditional telephony 64 kbps voice adapt the bitrate of CS data services of GSM to/from ISDN data channels originally: part of base station normal telephone trunk lines could be connected to the BTS this is TFO (Tandem Free Operation) advanced solution to install TRAU between MSC and BSC lower bitrate voice streams could be carried in large part of the network extra computation extension of ISDN voice transmission: 16 kbps data channels
Transport network in GSM TDM (Time Division Multiplex) networks (interfaces) PDH (Plesiochronous Digital Hierarchy) later SDH (Synchronous Digital Hierarchy) over microwave, copper or optical fiber high bitrate, robust networking for telephony operators TDM: voice calls are represented by sending a byte in a timeslot over the link a timeslot is periodically allocated for a given connection, end to end, for the whole duration of the call signalling: SS7, with MAP (Mobile Application Part) special signalling for mobile network
GSM Network and Switching Subsystem main role is to switch and maintain: voice connections between MEs in the network ME in the network and outside two main parts are: switching centres (exchanges) data registers auxiliary part for handling extra features IN Intelligent Network IT infrastructure for advanced services
GSM Network and Switching Subsystem MSC: Mobile Switching Centre MSC is basically a telephone exchange enables setting up, switching, maintaining of voice calls registration, authentication, location updating, handovers, and call routing to roaming subscriber collecting billing records value added services, controlled by IN call barring, forwarding, announcements, Main difference between an MSC and an exchange is authentication MSC can find the subscriber in case of mobile terminated call
GSM Network and Switching Subsystem usually there are several MSCs in the NSS some of them are configured to be Gateway MSC find roaming customer and route call towards visited network route call from outside network
GSM Network and Switching Subsystem Subscriber and terminal equipment databases Home Location Register (HLR) contain permanent information of all subscribers of the network their identity, number services the user can access contain location information at least: in which MSC/VLR more accurate position info can be found
GSM Network and Switching Subsystem HLR if a mobile attaches to the network, the system checks its available services if there s an incoming call, the (G)MSC queries the HLR where to route the call Internationa Mobile Subscriber Identity Mobile Station ISDN Number Visitor Location Register VLR it is a separate functional entity, but in practice it is integrated within the MSC temporary storage (in memory) of subscriber data knowledge of location are of registered users Temporary Mobile Subscriber Identity
GSM Network and Switching Subsystem AuC Authentication Center It contains authentication and encryption keys for subscribers It runs the authentication algorithms to check the identity of the SIM card authentication may be required when registering to the networks or when initiating a call or when activating a service
GSM Network and Switching Subsystem EIR Equipment Identity Register contain information about the mobile devices not the subscribers International Mobile Equipment Identity number to track malfunctioning, or stolen devices
GSM Network and Switching Subsystem SMSC Short Message Service Center storing and forwarding device for SMS messages actually MSCs switch it not standardized in all details some implementations distinguish between centres for accepting SMS from outside and for sending SMSC should be able to query the HLR whether the mobile is available store the message if not detect if it becomes attached again
Operation Support Subsystem OSS enables the operator to supervise and monitor the network Telecommunications Management Network functions: collecting data of and managing: errors, configurations, performance, security, etc. According to standard TMN concepts, the OSS is connected to all network elements provide machine-human interface for the operator this is the OMC or NOC OSS measures user quaity parameters, such as dropped calls, failed handovers, etc. To some extent remote intervention (e.g. restart) is possible through the OSS
Operation Support Subsystem Operation and Maintenance Center OMC, Network Operation Center NOC this is the central office for network supervision alerts are shown, collected, managed here
Intelligent Network in GSM ITU recommendation, for implementing value added services for telecomm networks in general, not just GSM can be implemented in MSCs or in combination IT infrastructure and logics, close interaction with MSCs televoting, telephone number portability, toll free calls, prepaid calling, virtual private networks (such as family group calling), virtual private branch excange mass-calling service, reverse charging, call-distribution, etc. later evolved into TAS (Telecommunication Application Server) and, or application servers of the IMS
GSM air interface
GSM radio basics medium access: TDMA/FDMA/FDD FDMA: 200 khz wide band around a carrier frequency TDMA: frame structure based on 8 timeslots / frame a connection has a timeslot (out of 8) in both directions FDD: uplink and downlink communications are in two separate frequency bands
UPLINK. [MHz] GSM 450 450.4-457.6 or 478.8-486 P-GSM900 890- DCS1800 (GSM 1800) E-GSM 880-915 R-GSM900 876-915 GSM 1900 (USA, Canada) GSM 850 (USA, Canada) 460.4-467.6 or 488.8-496 935-960 1805-1880 925-960 1850-1910 DOWNLNK [MHz] 915 1710-1785 921-960 1930-1990 Number of channels 35 124 374 174 194 299 824-849 869-894 124 GSM frequency channels
GSM radio basics Frame structure: 1 frame = 8 timeslots, each with length of approx. 577 s slot, frame length is 4,615 ms multiframe: traffic channel timeslots: 26 frames control channel timeslots: 51 frames 120 ms 235.36 ms
GSM radio basics 0. Multiframe: 26 frames: 120 ms 0 11 frame: TCH 13 24. keret: TCH 5. 12. 13. 24. 25. SACCH TDMA frame 60/13 ms 0. 1. 2. 3. 4. 5. 6. 7. empty physical bursts (in timeslots) Normal burst 3 bit 57 1 26 1 57 3 8,25 tail Data (voice) flagbit flagbit tail data (Voice) guard interval training sequence
GSM radio basics Logical channels: a channel between the mobile and the BSC logical channel: for a given purpose, as if there was a separate wire for this purpose but mapped and carried in the timeslot/frame structure Traffic Channels - TCH carry user data (voice) Control Chanels - *CCH: control and signalling informations
GSM radio basics dedicated channels: dedicated to a user, TCHs are dedicated, can be dedicated CCH, used when mobile is active common channels: used by more mobiles, used when mobile is idle TCHs: carry data or voice traffic a single timeslot and a normal burst in the timeslot, in every frame, except the 13rd and 26th, which are control and empty, respectively
GSM radio basics Elements of the burst (see figure above) Training sequence (26 bits) one of 8 standard sequences enables bit-level synchronisation of the receiver a known seqence (the receiver knows it) -> it enables the estimation of the effect of the channel. Hence the data bits can be detected correctly. tail bits (3-3): no information, this is needed to let the electronic circuits set their operation point, when turning on/of at the beginning/end of the burst
GSM radio basics simultaneous transmission/reception is not possible, it would cause big problems not full duplex at radio level therefore there are 3 timeslots difference between reception and transmission although full duplex at service level (voice call is full duplex, both party can talk at the same time) half-duplex at low, radio operation level
GSM radio basics guard interval due to the different distances of mobiles from the base station, the propagation delay of bursts is also different guard interval prevents bursts of different users to collide when arriving to base station
GSM radio basics Timing advance mobile syncronizes itself to the BTSs signal in downlink according to the received frames at the MS, lets suppose it would have to start transmission at the beginning of a timeslot, at e.g. T0 however, in downling, the has this info at T0+d/c, where d is its distance, c is speed of light it starts transmitting, but on uplink it again has a delay, hence arrives to the base station at T0+2d/c the burst may overlap with that of the user transmitting in the next slot
GSM radio basics Timing advance hence the system measures the delay of the burst s arrival orders the mobile to start the transmission earlier this is timing advance theoretically the mobile should start earlier by 2d/c, compared to when it thinks it shoud start
GSM radio basics Basic procedure of finding the network MS turned on tuning over GSM frequencies and listing them according to received signal level searching special signal pattern (see later SCH) on the channel, to detect whether the frequency carries broadcast control channel (is it BCCH carrier?) If yes: search for FCCH (Frequency Correction CH): tune its frequency exactly to that of the base station search for SCH (Synchronisation CH): this carries special pattern for bit-synchronisation (-> clock of MS can be same as clock of BS) and reckognition of SCH; this also carry frame number (-> to sysncronise to frame structure); and a base station code: to enable distuinguishing between SCHs of neighboring BSs If no: continue searching with the next frequency
GSM radio basics Basic procedure of finding the network MS searches the BCCH (Broadcast Control CH); it contains: network code (operator); Location Area Code (LAC); used frequencies by neighboring base stations; configuration of contorl channels, other system confguration informations if the MS finds its operator s network (own network in BCCH information), then it may initiate the registration process
GSM radio basics Basic procedure of registering to the network MS sends an access request on the RACH (Random Access CH) how does it know, where is it (in which timeslots?) - > its broadcasted in the BCCH, of course in the RACH burst the mobile sends the reason of sending the RACH (-> I want to register ) the MS then listens to the AGCH (Access Grant Channel) the system sends on the AGCH the reply and assignes an SDCCH (Standalone Dedicated Control CH) for the rest of the process
GSM radio basics Basic procedure of registering to the network over the SDCCH the authentication and registration process (bi-directional exchange of messages) is done also the mobile makes a Locatuion Update, that is it sends the LAC to the system after succesful authentication, the MS is known to the netwrok, the network stores the current LAC and that the mobile is turned on and available
GSM radio basics Basic procedure of camping (being idle) in the network the mobile is constantly listening to the FCCH, SCH, BCCH of the best serving cell to keep synchronised and check whether its LAC changed (-> the mobile may move to another LA) the mobile is listening to the PCH (Paging Channel) of that cell it is where incoming calls are notified Basic procedure of location update the mobile finds a new LAC it initiates a RACH message (reason: I want to make a location update ) system answers on AGCH and assigns a SDCCH location update message is sent over SDCCH
GSM radio basics Basic procedure of receiving a call when a call arrives, the system sends a notification to the PCH of all cells in the LA, where the mobile is the mobile reads its identity in the PCH the mobile initiates a RACH message (reason: I m answering to a call ) the system answers over the AGCH and assigns a traffic channel (TCH) this is immediate assignment higher level signalling and then the actual voice data is over the TCH
GSM radio basics Meanwhile having a call every 13rd frame contain a timeslot for the mobile, that is not TCH but SACCH (Slow Associated CCH), see figure above SACCH contains: power control commands, timing advance commands, measurement reports and SMS, if it is during a call if the mobile goes out of the cell, while having a call: based on the reports provided in the SACCH, the system decides that a handover is necessary it sends the handover command over the FACCH (Fast Associated CCH) FACCH: it is physically transmitted in the place of a voice burst. The flag bit in the normal burst (see figure) ssignals the fact if the FACCH has stolen the burst from the voice the mobile then knows that it should interpret the bits there as FACCH message, not voice
GDSM radio basics frame structure, timeslots and SAACH Hálózati Rendszerek és Szolgáltatások Tanszék Budapesti Műszaki és Gazdaságtudományi Egyetem 54
GSM radio basics mapping of logical channels to timeslots for SACCH and FACCH we discussed timeslot 0 on a given frequency is for control channels (combined configuration) in case of heavy traffic, timeslot 1 is used to carry dedicated control channels and timeslot 0 for common control channels (CCH) moe slots in uplink can be used if more RACH slots are needed note SACCH in the figure -> it is because every SDCCH also has a SACCH
GSM radio basics mapping of logical channels to timeslots non-combined channel allocations
HSCSD - (High Speed Circuit-Switched Data) Next step in GSM evolution Goal is higher bitrates How: allocate maxim 4 timeslots in parallel to a single data connection maximum 4 * 14.4 = 57.6 kbps bitrate same as dial-in modems in fixed phone networks at that time Advantage: can be implemented in existing GSM network, no need for new devices Naturally new mobile terminals are needed Disadvantage: still circuit switched the connection is alive and is billed based on the time; regardless of actual data transmission
GPRS - (General Packet Radio Service) Goals: to support IP based packed data networking and communications, in the whole mobile network not over dial-in modems to support higher bitrates least possible modifications is the network do not change radio interface and radio network to achieve this new devices needed in the core network, to support PS data transmission/routing along with mobility support this, the GSM/GPRS core network will be able to be used as core network for the 3rd generation mobile system (UMTS) new, flexible mechanisms in the air interface channel allocation is only for the transmission, when it is needed charging is based on the amount of data transmitted, regardless the duration of the transmission
GPRS motivation Do not touch the MS-BTS (Um) interface (just minimally) therefore older (non-gprs capable) phone remains compatible dynamic sharing of resources with classical GSM speech services should provide packet switching service internetworking with IP- and X.25 nets standardized just establish new core network elements 14/06/2016 Department of Networked 59
GPRS network PCU Forrás: Ericsson
GPRS/UMTS network
GPRS network new elements in the core network: SGSN, GGSN (Serving GPRS Support Node, Gateway - -) new element in BSS (Base Station Subsystem): PCU PCU (Packet Control Unit): practical implementation: a hardware extension for the BSC; or a distinct device in the network (usually co-located with the BSC) interface between the GPRS core network and the BSS forwarding of packets to/from base stations from/to SGSN the PCU transforms the data into PCU frames (a special frame formats) similar to TRAU frames, format of the voice frames in GSM radio resource management for PS services allocation of timeslots, logical channels scheduling of user data: who can transmit/receive when setting up radio links for GPRS connections mobility management for GPRS services paging handover
GPRS network SGSN: packet routing and forwarding for the PCUs, other SGSNs and GGSNs router (not correct term: switch) or center for the packet swtched traffic take part in mobility management location update and querying of location database regarding the mobiles position mobility is tracked based on routing area mobile phones in ready state (meaning: its about to communicate) the location is tracked at cell level collection of charging records for packet data traffic helps setting up IP-level session between the mobile and GGSN PDP context, later security encription; optional data compression
GPRS hálózat GGSN: collecting charging records for communications with the outside networks (e.g. internet) gateway to the internet and other mobile networks allocation of IP address to the mobiles anchor of mobility in the GPRS: wherever a mobile roams in the network, while having an active session, its traffic is going through a given GGSN conversion of IP addresses, if needed the mobile has an IP level session with the GGSN it is the PDP context (Packet Data Protocol) it contains: allocated IP address + IMSI (International Mobile Subscriber Id.) + other descriptiors of the traffic
GPRS network architecture 14/06/2016 Department of Networked 65
GPRS protocol stack MAC: Medium Access Control RLC: Radio Link Control LLC: Logical Link Control UDP: User Datagram Protocol TCP: Transmission Control Protocol BSSGP: BSS GPRS Protocol GTP: GPRS Tunneling Protocol SNDCP: Sub-Network Dependency Convergence Protocol IP: Internet Protocol 14/06/2016 Department of Networked 66
Előadás címe Előadó Neve, 67
GPRS protocol stack note: we discussed GPRS protocols only at the GGSN- SGSN interface, we discussed GTP protocol only the rest is for those who are interested 14/06/2016 68
GPRS protocol stack from the GPRS mobile station via the BSS and the SGSN to the GGSN the Interconnection between the PLMN and external Packet Data Networks or PDN's is achieved via the GGSN Note that the IP and UDP/TCP protocols between SGSN and GGSN present the Intra-PLMN backbone as a transport medium for the GPRS Tunneling Protocol (GTP) however, they do not represent the application or user protocols that can be found at the very top of the protocol stack 14/06/2016 69
MS-BSS interface (Um interface) Layer 1: radio subsystem layer (physical layer) radio interface to the BTS is the same interface used by the existing GSM network MAC (Medium Access Control) MAC arbitrates access to the shared medium between multiple MSs and GPRS network priority handling between data flows of one UE priority handling between UEs by means of dynamic scheduling RLC (Radio Link Control) error correction in-sequence delivery of SDUs duplicate detection 14/06/2016 70
MS-BSS interface (Um interface) LLC (Logical Link Control): reliable logical link between MS and SGSN LLC messages are transparent to RAN C-Plane: attach, authentication and PDP activation U-Plane: carry actual data SNDCP (Sub-Network Dependency Convergence Protocol) Transparent over BSS Used only in U-Plane compression of user data 14/06/2016 71
Tunneling 14/06/2016 72
Tunneling User data packets are sent over the GPRS backbone in containers. When a packet coming from an external packet network arrives at the GGSN, it is inserted in a container and sent to the SGSN. The stream of containers inside the GPRS backbone network is totally transparent to the user To the user, it seems like he/she is connected directly via a router (the GGSN) to external networks In data communications, this type of virtual stream of containers is called a tunnel GSNs are performing tunneling of user packets 14/06/2016 73
GPRS Tunneling Protocol GTP packets are transported between the SGSN and the GGSN GTP is defined both for the Gn interface, that is, the interface between GSNs within the same PLMN, and the Gp interface between GSNs in different PLMNs Two modes of operation of the GTP layer are supported (and can support both modes simultaneously): unacknowledged (UDP/IP) acknowledged (TCP/IP) allows end users of a GSM or WCDMA network to move from place to place whilst continuing to connect to the internet as if from one location at the GGSN 14/06/2016 74
GPRS Tunneling Protocol 14/06/2016 75
GPRS radio interface
GPRS radio interface minimal changes to GSM modulation waveform is the same frequency channels, timeslot and frame structure is the same basic unit of transmission: RB Radio Block (456 bits) -> 4 physical bursts in 4 timeslots novelties:
GPRS radio interface novelties for higher bitrates allow the use of all 8 timeslots for a given user theoretical max bitrate per timeslot is 20 kbps, the total max is hence 8*20 kbps = 160 kbps for those instants, when the mobile is scheduled, not for long time usually in practice, averag e 30-40 kbps can be reached novelties for flexibility (for efficient serving of PS data) no need to allocate channel (timeslot) for a long time to a user, only should it be scheduled when it is needed in contrast with voice, where the timeslot is allocated to a call until its end, regardless of actually having voice transmitted or not scheduling timeslots dynamically several users can share a timeslot, meaning not a particular slot in a particular frame; but e.g. timeslot 4 can be used by several mobiles, and the scheduler will decide in which frames which mobile will use timeslot 4 uplink and downlink can be asymmetric (usually more traffic in downlink) -> ul and dl scheduled independently, based on the needs introduction of quality of service classes
GPRS radio interface new logical channels: with the same functionalities as GSM logical channels name is also P*CH, where *CH was the name of the GSM logical channel (e.g. PCH, BCCH, AGCH, etc.) might use the same timeslots as GSM logical channels PNCH: packet Notification Channel: the GPRS defines multicast sending multicast: a given transmission is for more then one mobile it is sent only once, on a single channel -> all the mobiles in the multicast group should listen to PNCH tells when a multicast packet is coming
GPRS radio interface timing advance (TA) control the actual transmission of a mobile can be sporadic can travel physically between two transmissions data: no continuous transmission (compared to voice) -> therefore TA cannot be measured continuously therefore: there is special TA slots in the GPRS frame, where active mobiles send RACH burts below: GPRS frame. Note that this is mapped to a timeslot, say timeslot 4 in the air frame structure (next slide)
GPRS frames GPRS radio interface
GPRS radio interface channel scheduling, downlink: the system tells the MS which timeslots to listen to e.g. slots 1,2,3 and 4 should be listened to in every timeslots there s a stream of RBs, see previous figures how does the MS know, which RB should be read? there is a label, address in the RB, called TBF Temporary Block Flow when mobile sees its TBF in the block, it reads its content how does the MS know when it is finished? there s a bit FBI Final Block Indicator, this tells if the mobile s flow has ended channel scheduling, uplink: the system tells the mobile which uplink timeslot it may use, say timeslot 6,7 and 8 the mobile must read the downlink slots 6,7 and 8 there is one more label in the blocks, the USF (Uplink State Flag) -> label of the mobile if the mobile reads its own USF in any block in a timeslot (e.g. mobile sees its own USF in block 215, in timeslot 6 in the downlink) -> it can send in the same timeslot in the next block in uplink (e.g. the mobile sends in the block 216 in uplink timeslot 6 end of uplink flow: the system makes the scheduling decisions in advance, it should know earlier, when the uplink flow will finish. So in uplink, there is a counter in the blocks, which are decreased in the last few blocks. The last block has counter value 0.
Enhanced Data rates for GSM Evolution (EDGE) extension of GSM/GPRS for higher bitrates with the introduction of a new modulation waveform, the bitrate can be increased to 60 kbps per timeslot, in case of good channel conditions using 8 timeslots, theoretical max of 480 is achievable in the instants of transmitting, receiving in practice, roughly 80-100 kbps on average