CP5201 Network Design and Technologies UNIT III

GSM (Global System for Mobile Communications, originally Groupe Spécial Mobile is a standard developed by the
European Telecommunications Standards Institute (ETSI) to describe the protocols for second-generation digital cellular
networks used by mobile devices such as tablets, first deployed in Finland in December 1991.As of 2014, it has become the
global standard for mobile communications with over 90% market share, operating in over 193 countries and territories.
2G networks developed as a replacement for first generation (1G) analog cellular networks, and the GSM standard originally
described as a digital, circuit-switched network optimized for full duplex voice telephony. This expanded over time to include
data communications, first by circuit-switched transport, then by packet data transport via GPRS (General Packet Radio
Services) and EDGE (Enhanced Data rates for GSM Evolution, or EGPRS).
Subsequently, the 3GPP developed third-generation (3G) UMTS standards, followed by fourth-generation (4G) LTE Advanced
standards, which do not form part of the ETSI GSM standard.
"GSM" is a trademark owned by the GSM Association. It may also refer to the (initially) most common voice codec used, Full
Rate

Technical details

Network structure The network is structured into a number of discrete sections:

Base station subsystem the base stations and their controllers explained

Network and Switching Subsystem the part of the network most similar to a fixed network, sometimes just called the "core
network"

GPRS Core Network the optional part which allows packet-based Internet connections

Operations support system (OSS) network maintenance

Base station subsystem GSM is a cellular network, which means that cell phones connect to it by searching for cells in the
immediate vicinity. There are five different cell sizes in a GSM network macro, micro, pico, femto, and umbrellacells.The
coverage area of each cell varies according to the implementation environment. Macro cells can be regarded as cells where the
base station antenna is installed on a mast or a building above average rooftop level. Micro cells are cells whose antenna height
is under average rooftop level; they are typically used in urban areas. Picocells are small cells whose coverage diameter is a few
dozen meters; they are mainly used indoors. Femtocells are cells designed for use in residential or small business environments
and connect to the service provider‟s network via a broadband internet connection. Umbrella cells are used to cover shadowed
regions of smaller cells and fill in gaps in coverage between those cells.

GSM carrier frequencies GSM networks operate in a number of different carrier frequency ranges (separated into GSM
frequency ranges for 2G and UMTS frequency bands for 3G), with most 2G GSM networks operating in the 900 MHz or 1800
MHz bands. Where these bands were already allocated, the 850 MHz and 1900 MHz bands were used instead (for example in
Canada and the United States). In rare cases the 400 and 450 MHz frequency bands are assigned in some countries because they
were previously used for first-generation systems.

1 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

For comparison, most 3G networks in Europe operate in the 2100 MHz frequency band. For more information on worldwide
GSM frequency usage, see GSM frequency bands.
Regardless of the frequency selected by an operator, it is divided into timeslots for individual phones. This allows eight full-rate
or sixteen half-rate speech channels per radio frequency. These eight radio timeslots (or burst periods) are grouped into a TDMA
frame. Half-rate channels use alternate frames in the same timeslot. The channel data rate for all 8 channels is 270.833 kbit/s, and
the frame duration is 4.615 ms.
The transmission power in the handset is limited to a maximum of 2 watts in GSM 850/900 and 1 watt in GSM 1800/1900.

Voice codecs GSM has used a variety of voice codecs to squeeze 3.1 kHz audio into between 6.5 and 13 kbit/s. Originally, two
codecs, named after the types of data channel they were allocated, were used, called Half Rate (6.5 kbit/s) and Full Rate (13
kbit/s). These used a system based on linear predictive coding (LPC). In addition to being efficient with bitrates, these codecs
also made it easier to identify more important parts of the audio, allowing the air interface layer to prioritize and better protect
these parts of the signal. GSM was further enhanced in 1997 with the enhanced full rate (EFR) codec, a 12.2 kbit/s codec that
uses a full-rate channel. Finally, with the development of UMTS, EFR was refactored into a variable-rate codec called AMR-
Narrowband, which is high quality and robust against interference when used on full-rate channels, or less robust but still
relatively high quality when used in good radio conditions on half-rate channel

Subscriber Identity Module (SIM) One of the key features of GSM is the Subscriber Identity Module, commonly known as a
SIM card. The SIM is a detachable smart card containing the user's subscription information and phone book. This allows the
user to retain his or her information after switching handsets. Alternatively, the user can alsochange operatorswhile retaining the
handset simply by changing the SIM. Some operators will block this by allowing the phone to use only a single SIM, or only a
SIM issued by them; this practice is known as SIM locking.

GSM Layers

Layer 1: Physical layer • physical transmission • channel quality measurements• GSM Rec. 04.04, PCM 30 or ISDN links are
used (GSM Rec. 08.54 on A bis interface and 08.04 on A to F interfaces)

Layer 2: Data link layer • Multiplexing of layer 2 connections on control/signaling channels • Error detection (based on
HDLC) • Flow control• Transmission quality assurance • Routing

Layer 3: Network layer • Connection management (air interface) • Management of location data • Subscriber identification •
Management of added services (SMS, call forwarding, conference calls, etc.)

GSM Air interface

Layer 1 (GSM Rec. 04.04): Um interface
Layer 2 (GSM Rec. 04.05/06): LAP-Dm protocol (similar to ISDN LAP-D): • connectionless transfer of point-to-point and
point-to-multipoint signaling channels • Setup and tear-down of layer 2 connections of point-to-point signaling channels •
connection-oriented transfer with in order delivery, error detection and error correction
Layer 3 (GSM Rec. 04.07/08) with sublayers for control signaling channel functions (BCH, CCCH and DCCH):

Radio resource management (RR): to establish and release stable connection between mobile stations (MS) and an MSC for
the duration of a call and to maintain connection despite user movements - functions of MSC: cell selection – handover
– allocation and tear-down of point-to-point channels – monitoring and forwarding of radio connections – enabling encryption –
change transmission mode

Mobility management (MM) handles the control functions required for mobility: – authentication – assignment of TMSI,
– management of subscriber location

Connection management (CM) - set up, maintain and tear down calls connections:
Call control (CC): Manages call connections, –

Supplementary service support (SS): Handles special services,

Short message service support (SMS): Transfers brief text messages

Radio Resource Management (RR) messages are mapped to or from the base station system application part (BSSAP) for
exchange with the MSC: • Transmission mode (change) management • Cipher mode management• Discontinuous transmission
mode management• Handover execution• Call re-establishment• RR-session release• Load management• SACCH procedures –

2 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

radio transmission control (power&timing, downlink), (measurements, uplink)– -general information• Frequency redefinition •
General information broadcasting (BCCH) – cell selection information
– information for idle mode functions– information needed for access – cell identity

GSM Audio
• Speech coding - 20ms (i.e., 160) samples (8kHz @13 bits) are buffered then coded• Error protection (codec specific)
• Error detection (CRC)• Bad Frame Handling (substitution)
• Voice Activity Detection / Discontinuous Transmission (VAD/DTX)

Manufacturer specific audio features:• noise cancelling• spectrum equalization• echo cancellation

CODECs
Full rate (FR) 13 kbit/s ,
Regular pulse excitation - long term prediction (RPE-LTP)Half rate (HR) 5.65 kbit/s VSELPEnhanced full rate (EFR) 12.2 kbit/s
ACELPAdaptive Multi Rate (AMR) ACELP, 12.2, 10.2, 7.95, 7.4, 6.7, 5.9, 5.15, 4.75 kbit/s
AMR wideband codec (under standardization)

MSC protocols
MAP (Mobile Application Part) (GSM Rec. 09.02) • controls queries to the different databases in the mobile radio network
(HLR, VLR, and EIR) • responsibilities include access and location management, MSC-MSC handover, security functions,
O&M, SMS, and supplementary services. •

TCAP (Transaction Capabilities Application Part) provides universal calls and functions for handling requests to distributed
application processes

ISUP (ISDN User Part) • controls interworking (e.g. call setup/tear-down) between Public Land Mobile Networks
(PLMNs) and other networks, and provides the same basic functionalities as TUP

INAP (Intelligent Network Application Part) implements intelligent supplementary services (e.g. free call, time dependent
routingfunctions in a central service center)

TUP (Telephone User Part) implements interworking between PLMNs and other networks• used to provide international
connections and is being replaced by ISUP

GSM Logical Channels

Traffic channels carry speech or data. There are two main categories here, Full rate (13 kpbs) and Half rate.
Control channels used to for control/command/signaling. Control channels are divided into three categories.

Category 1: Broadcast channels As the name suggests they are point-to-multipoint and downlink only channels.

FCCH: Frequency correction control channel, this is transmitted by BTS to MS. This helps MS tune its local oscillator to
exact RF carrier frequency of the BTS cell. All zero sequences are transmitted here which will produce fixed tone at the output
of GMSK modulator. The frequency value will be about 67.7075 KHz.

SCH:synchronization channel, this carry BSIC(Base transceiver station identity code) and Frame number which helps MS tune
to specific (Frequency,Ts) physical slot on
3 Uthaya Kumar csenotescorner.blogspot.com
 CP5201 Network Design and Technologies UNIT III

TDMA frame in GSM network.

BCCH: Broadcast control channel, carry CGI,MNC,MCC which is received by MS. It is compared with SIM information, once
varified OK connection is established with the network.

Category 2: Common Control channels They are point-to-multipoint and downlink only channels except RACH which is used
in uplink.

PCH:Paging channel,When someone is calling mobile phone, this channel sent information on downlink to alert called mobile
phone.This is known as mobile phone terminated call.

RACH:Random Access channel, used in mobile originated call. When mobile wants to call some other mobile phone, control
information is sent on this channel.

AGCH:Access Grant Channel,transmitted by BTS to MS once network approves request of mobile by RACH.

CBCH:Cell Broadcast channel, Used to carry the short message service cell broadcast.

Category 3: Dedicated Control channels

They are bidirectional and point-to-point Channels.

SDCCH: Stand alone dedicated control channel, used for call setup.

SACCH: Slow associated control channel, is used for control and supervisory signals associated with the traffic channels.

FACCH: Fast associated control channel, is used for control requirements such as handoff/handovers.

GSM TimingA very elaborate timing structure ranging from 1/4 of a bit (900ns) to an encryption hyperframe (3 hours 28
minutes and 53.76s)! Unit Time bit 3.69us
slot 156.25 bits (577 us) frame 8 slots (4.615 ms) traffic multiframe 26 frames (120 ms) or control multiframe 51 frames (235.4
ms) superframe 51 traffic multiframes or 26 control multiframes (6.12 s) hyperframe 2048 superframes (3 hours 28 minutes and
53.76s)

Authentication User authentication normally takes place when the MS is turned on (user must keyin a PIN code on the handset
in order to activate the hardware before this automatic
procedure can start).
Authentication occurs with each incoming call and outgoing call. This is based on checking that “Ki” (secret encryption key)
stored in the AuC matches the “Ki”stored in SIM card of the MS.

Authentication and Encryption

4 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

GSM data rates

The following table of data rates is from page 39 of [5]
Connection Typea
a. T = Transparent, NT = Non-transparent Two-way delay
TCH/F9.6 T 330 ms
TCH/F9.6 NT > 330 ms
TCH/F4.8 T 330 ms
TCH/F2.4 T 200 ms
TCH/H4.8 T 600 ms
TCH/H4.8 NT > 600 ms
TCH/H2.4 T 600 ms

Phone locking Sometimes mobile network operators restrict handsets that they sell for use with their own network. This is called
locking and is implemented by a software feature of the phone. A subscriber may usually contact the provider to remove the lock
for a fee, utilize private services to remove the lock, or use software and websites to unlock the handset themselves. It is possible
to hack past a phone locked by a network operator.
In some countries (e.g., Bangladesh, Belgium, Brazil, Canada, Chile, Germany, Hong Kong, India, Iran, Lebanon, Malaysia,
Nepal, Pakistan, Poland, Singapore, South Africa, Thailand) all phones are sold unlocked

GSM security GSM was intended to be a secure wireless system. It has considered the user authentication using a pre-shared
key and challenge-response, and over-the-air encryption. However, GSM is vulnerable to different types of attack, each of them
aimed at a different part of the network.
The development of UMTS introduced an optional Universal Subscriber Identity Module (USIM), that uses a longer
authentication key to give greater security, as well as mutually authenticating the network and the user, whereas GSM only
authenticates the user to the network (and not vice versa). The security model therefore offers confidentiality and authentication,
but limited authorization capabilities, and no non-repudiation.

Standards information The GSM systems and services are described in a set of standards governed by ETSI, where a full list is
maintained

GSM open-source software Several open-source software projects exist that provide certain GSM features:

General Packet Radio Service (GPRS)

GPRS features: • True packet radio system - sharing network and air interface resources• Volume based charging• TCP/IP
(Internet & Intranet) interworking, SMS over GPRS, (and X.25interworking)• Peak data rate from 9.05 kbps .. 171.2 kbps•
Protocols designed for evolution of radio• EDGE - new GSM modulation • Migration into 3rd Generation

GPRS nodes
GPRS introduces new network elements• Serving GPRS Support Node (SGSN)• authentication & authorization, GTP
tunneling to GGSN, ciphering & compression, mobilitymanagement, session management, interaction with HLR,MSC/VLR,
charging & statistics,as well as NMS interfaces.• Gateway GPRS Support Node (GGSN)• interfacing to external data networks
(basically it is a network router)encapsulating data packets in GTP and forwarding them to right SGSN,routing mobile originated
packets to right destination, filtering end usertraffic, as well as collecting charging and statistical information of datanetwork
usage
GPRS is the result of committees trying to “adapt” Mobile IP to GSM systems

5 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

GPRS INTERFACES AND PROTOCOLS

GGSN-SGSN. The user data packets arriving at the SGSN from the MS or at the GGSN from the external PDN are encapsulated
before onward transmission within the GPRS backbone network.
The GPRS tunneling protocol for user plane (GTP-U) is used to tunnel the user data between SGSN and GGSN over the Gn
interface and between GSNs from different PLMNs over the Gp interface. GTP carries the user packets, i.e., X.25 or IP.

TCP/UDP is used to transport GTP packets within the GPRS intra-PLMN backbone. TCP carries GTP PDUs (G-PDUs) for
protocols that require a reliable data link, e.g., X.25. UDP carries G-PDUs for protocols that do not require a reliable data link,
e.g., IP.

Below UDP/TCP, IP is used as a network layer protocol to route the packets from the upper layer through the backbone network.
Currently, IPv4 is used with a future option to upgrade to IPv6

SGSN-BSS. the subnetwork dependent convergence protocol (SNDCP) is used to transfer data packets between SGSN and MS.
SNDCP is designed to carry N-PDU transparently between SGSN and MS regardless of the network layer protocol, i.e., IP,
X.25, or any other future protocol that an end application might use. SNDCP also converts the network layer PDUs on the Gn
interface into a format suitable for the underlying GPRS network architecture. The functions of SNDCP include the following
■ Multiplexing of N-PDUs from one or several network layer entities (PDPs such as X.25 or IP) onto a virtual logical
connection ■ Buffering of PDUs for acknowledge service
■ Delivery sequence management for each NSAPI ■ Compression and decompression of the user data
■ Compression and decompression of protocol headers

6 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

■ Segmentation of a network protocol data unit (N-PDU) into LLC protocol data units (LL-PDUs) and reassembly of LLPDUs
into an N-PDU

■ Negotiation of the control parameters between the SNDCP entities

logical link control (LLC) protocol is used for packet data transfer between the SGSN and the MS. The LLC provides a highly
reliable, ciphered logical link between the MS and the SGSN.
The LLC frame format is based on the LAPD protocol with a few modifications to make it suitable to be used on a radio link. It
uses both acknowledged and unacknowledged data transfer, depending upon the requirement on QoS. The LLC also manages
frame retransmission and buffering based on the negotiated QoS

The data from several mobile stations is multiplexed over a Gb link in downlink direction. The same is true for the uplink
direction, where the data destined to several MSs is to be multiplexed over a Gb link. How can LLC frames belonging to a MS
be routed to the right MS (RLC/MAC) via a BSS? The base station subsystem GPRS protocol (BSSGP), which is a new and
GPRS-specific protocol, in conjunction with the network service (NS) layer, performs this task. The tasks performed by the
BSSGP are:

■ In the uplink direction, the BSSGP at the BSS provides the needed information to route the user data to the SGSN. The
information is derived from the RLC/MAC.
■ In the downlink direction, the BSSGP layer at the SGSN provides radio-related information used by the RLC/MAC function.
■ Node management functions between the SGSN and the BSS.
The relay function at the BSS transfers LLC frames between the RLC/MAC layers and the BSSGP layer. The BSSGP uses the
following identifiers to indicate to the NS layer the destination of packets:
■ BSSGP virtual connection identifier (BVCI)
■ Link selection parameter (LSP)
■ Network service entity identifier (NSEI)

BVCI virtual connection identifier identifies entities at the SGSN and the BSS between which the data and signaling
information is to be transferred. Each BVCI between two peer entities is unique.

The network service (NS) layer uses frame relay over the Gb interface. The NS layer uses a data link connection identifier
(DLCI) to indicate the routing path between SGSN and the BSS. The NS layer derives the DLCI value from the BVCI, LSP, and
NSEI given by BSSGP Layer.

The physical connection (bearer) between the BSS and the SGSN is E1/T1. The bearer channel (BC) carries frame relay
signaling and data.

On a bearer channel, several logical flows are maintained; i.e., permanent virtual connections (PVCs). The PVC is identified by
the DLCI. These are set by the network providers.

■ A network service virtual links identifier (NSVLI) identifies the virtual link on a physical bearer. NSVLI = DLCI + BC.

■ The end-to-end virtual connection between the BSS and the SGSN is known as NS-VC.

7 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

■ A group of NS-VCs is identified by NSEI. BSS-MS. Layer 2, the data link layer, at the Um interface consists of two
sublayers:

■ A logical link control layer between MS and SGSN, which has been described in the previous section

■ A radio link control (RLC)/medium access control (MAC) layer

he main task of the RLC sublayer is to establish a reliable link between the MS and the BSS. The functions of RLC layer
include:

■ LLC PDU transfer between the LLC and the MAC layers.

■ Segmentation of LLC PDUs into smaller RLC data blocks and reassembly of the blocks to fit into a TDMA frame. This is
done because the LLC PDU size is too big to be transferred on the air interface efficiently. A unique temporary frame identity
(TFI) identifies each segment. The TFI is derived from the MS identifier TLLI (see Section 4.5 for the definition) and the frame
sequence number.

■ Backward error correction of RLC data blocks. The backward error correction is based on the NAK automatic repeat
request (ARQ) protocol. If the receiving RLC entity detects a missing TFI, it requests retransmission of the missing block. Once
the missing block is available, the LLC frame is built and passed to the upper layer.

The medium access control (MAC) controls and manages the common transmission medium to enable data transfer from and
to multiple MSs. It employs algorithms for contention resolution, scheduling, and prioritization based on negotiated QoS.

Signaling plane The signaling plane architecture consists of a set of protocols to support the functions of the transmission/user
plane. Most of the protocols used are the same as those in the transmission plane.

GPRS mobility management (GMM) supports mobility management functions. GMM includes functions such as GPRS
attach/detach, security, and cell and routing area update.

Session management (SM) includes the function to create, manage and control the user sessions. Create PDP context, Delete
PDP context are a few examples of session management procedures.

Issues with patents and open source Patents remain a problem for any open-source GSM implementation, because it is not
possible for GNU or any other free software distributor to guarantee immunity from all lawsuits by the patent holders against the
users. Furthermore, new features are being added to the standard all the time which means they have patent protection for a
number of years

8 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

MAP protocol is used between the SGSN and the HLR It has been extended to support GPRS-specific procedures. The
applications/users, i.e., SGSN and HLR, use the MAP protocol to transport the signaling information related to location update,
subscription data, handovers, etc.

The GSM base station subsystem application part (BSSAP) has been extended to support GPRS specific procedures and is
called BSSAP+. It is used for signaling transfer between the MSC/VLR and the SGSN (Figure 4-8). BSSAP+ supports the
procedures for combined GPRS/IMSI attach, combined location update (GSM & GPRS), and paging for an MS using GPRS.
BSSAP+ relies on SCCP and the underlying MTP protocol to transport messages between communicating entities.

The GPRS tunneling protocol control plane (GTP-C) is used between two GSNs over the Gn/Gp interface. The GTP-C
signaling flow is logically associated with, but separate from, the GTP-U tunnels. This protocol tunnelssignaling messages
between SGSNs and GGSNs (Gn) and between SGSNs in the backbone network (Gp). This supports procedures such as create
PDP context and PDU notification.
GPRS Coding Schemes The upload and download speeds that can be achieved in GPRS depend on a number of factors such
as:the number of BTS TDMA time slots assigned by the operator,the channel encoding used., the maximum capability of the
mobile device expressed as a GPRS multislot class
Multiple access schemes The multiple access methods used in GSM with GPRS are based on frequency division duplex (FDD)
and TDMA. During a session, a user is assigned to one pair of up-link and down-link frequency channels. This is combined with

9 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

time domain statistical multiplexing which makes it possible for several users to share the same frequency channel. The packets
have constant length, corresponding to a GSM time slot
Channel encoding The channel encoding process in GPRS consists of two steps: first, a cyclic code is used to add parity bits,
which are also referred to as the Block Check Sequence, followed by coding with a possibly punctured convolutional code.[5] The
Coding Schemes CS-1 to CS-4 specify the number of parity bits generated by the cyclic code and the puncturing rate of the
convolutional code.

Bitrate
GPRS Bitrate including excluding
Code
Coding RLC/MAC RLC/MAC Modulation
[a][b] [c] rate
scheme overhead (kbit/s/slot) overhead
(kbit/s/slot)
CS-1 9.20 8.00 GMSK 1/2
CS-2 13.55 12.00 GMSK ≈2/3
CS-3 15.75 14.40 GMSK ≈3/4
CS-4 21.55 20.00 GMSK 1
This is rate at which the RLC/MAC layer protocol data unit (PDU) (called a radio block) is transmitted. As shown in TS 44.060
section 10.0a.1,[6] a radio block consists of MAC header, RLC header, RLC data unit and spare bits. The RLC data unit
represents the payload, the rest is overhead. The radio block is coded by the convolutional code specified for a particular Coding
Scheme, which yields the same PHY layer data rate for all Coding Schemes.

TDMA
Download Upload timeslots
Technology
(kbit/s) (kbit/s) allocated
(DL+UL)
CSD 9.6 9.6 1+1
HSCSD 28.8 14.4 2+1
HSCSD 43.2 14.4 3+1
21.4
(Class 8
GPRS 85.6 & 10 4+1
and CS-
4)
42.8
(Class
GPRS 64.2 3+2
10 and
CS-4)
59.2
(Class 8,
EGPRS (EDGE) 236.8 4+1
10 and
MCS-9)
118.4
(Class
EGPRS (EDGE) 177.6 3+2
10 and
MCS-9)

GPRS Multislot Classes- in order to quantify the performance of various handsets or mobiles, GPRS multislot classes are
defined.
GPRS mobiles are able to support data transmission as well as voice. GPRS mobiles are available with a variety of levels of
operation.
These are often defined by defining them as a particular GPRS class. These GPRS classes indicate the level of service they are
able to provide
10 Uthaya Kumar csenotescorner.blogspot.com
 CP5201 Network Design and Technologies UNIT III

.In many respects many GPRS mobile phones may not look different to ordinary GSM phones, but they are able to offer a level
of data service that cannot be provided by a standard GSM phone. Some GPRS phones may even offer a keyboard for emails,
etc.

Class A: - This class describes mobile phones that can be connected to both GPRS and GSM services at the same time.

Class B: - These mobiles can be attached to both GPRS and GSM services but they can be used on only one service at a time. A
Class B mobile can make or receive a voice call, or send and or receive a SMS message during a GPRS connection. During voice
calls or texting the GPRS service is suspended but it is re-established when the voice call or SMS session is complete.

Class C: - This classification covers phones that can be attached to either GPRS or GSM services but user needs to switch
manually between the two different types

The multislot class determines the speed of data transfer available in the Uplink and Downlink directions. It is a value between 1
and 45 which the network uses to allocate radio channels in the uplink and downlink direction. Multislot class with values
greater than 31 are referred to as high multislot classes.

Multislot Classes for GPRS/EGPRS

Multislot Class Downlink TS Uplink TS Active TS
1 1 1 2
2 2 1 3
3 2 2 3
4 3 1 4
5 2 2 4
6 3 2 4
7 3 3 4
8 4 1 5
9 3 2 5
10 4 2 5
11 4 3 5
12 4 4 5
30 5 1 6
31 5 2 6
32 5 3 6
33 5 4 6
34 5 5 6

Attributes of a multislot class Each multislot class identifies the following:

the maximum number of Timeslots that can be allocated on uplink
the maximum number of Timeslots that can be allocated on downlink
the total number of timeslots which can be allocated by the network to the mobile
the time needed for the MS to perform adjacent cell signal level measurement and get ready to transmit
the time needed for the MS to get ready to transmit
the time needed for the MS to perform adjacent cell signal level measurement and get ready to receive
the time needed for the MS to get ready to receive.
The different multislot class specification is detailed in the Annex B of the 3GPP Technical Specification 45.002

Usability The maximum speed of a GPRS connection offered in 2003 was similar to a modem connection in an analog wire
telephone network, about 32–40 kbit/s, depending on the phone used. Latency is very high; round-trip time (RTT) is typically

11 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

about 600–700 ms and often reaches 1s. GPRS is typically prioritized lower than speech, and thus the quality of connection
varies greatly

History of GPRS GPRS opened in 2000 as a packet-switched data service embedded to the channel-switched cellular radio
network GSM. GPRS extends the reach of the fixed Internet by connecting mobile terminals worldwide.
The CELLPAC protocol developed 1991-1993 was the trigger point for starting in 1993 specification of standard GPRS by
ETSI SMG. Especially, the CELLPAC Voice & Data functions introduced in a 1993 ETSI Workshop contribution anticipate
what was later known to be the roots of GPRS. This workshop contribution is referenced in 22 GPRS related US-Patents.
Successor systems to GSM/GPRS like W-CDMA (UMTS) and LTE rely on key GPRS functions for mobile Internet access as
introduced by CELLPAC

Short Message Service (SMS) Short Message Service (SMS) offers connectionless (message) delivery (similar to “two way-
paging”)
If the GSM telephone is not turned on, the message is held for later delivery. To Ensure that each time a message is delivered to
an MS, the network expects to receive an acknowledgement from the MS that the message was correctly received.
SMS supports messages up to 140 octets (160 characters of GSM default Alphabet see GSM 03.38) in length.
SMS concatination - combines several messages
SMS compression - defined standard for compression of content
With internation roaming these messages can be delivered by any GSM network around the world to where ever the MS
currently is. Two types of messages: cell broadcast and point-to-point service

Short Message Service Architecture

SM-SC Short Message Service Centre

SMS GMSC SMS Gateway MSC
IWMSC Interworking MSC

SM-SCs • High reliability• High availability• High performance

• existing SM-SCs talk TCP/IP as well as other protocols
There exist SMS brokers from whom you can buy SMS capacity in bulk, they receive your messages and then transfer them to
operators thatthey haveagreements with.

Three kinds of SMSs User-specific display to a user

ME-specific ME processes the message when it is received
Nokia has special function to play ring tone, display a business card, modify the default icon, …
SIM-specific SIM processes the message when it is received
(for use via SIM toolkit applications)

Entering Short Messages To improve the speed of entering SMSs (and other text)• Full keyboards (such as Ericsson‟s Chat
Board)• Onscreen keyboard (such as Plam‟s on-screen keyboard)• Fitaly keyboard - arranges letters based on their frequency
andprobability transitions in English • Predictive text input algorithms• Tegic T9 - utilizes numeric keypad and probability to
work out probably string • e-acute‟s Octave keyboard • Handwriting recogntion• Word recognition, such as Psion‟s CalliGrapher

12 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

• Character recognition, such as Palm‟s Graffiti • CJKOS - an OS extension for Palm for Chinese, Japanese, and Korean •
Speech recognition

Voice Messaging System (VMS) A value-added service which redirects incoming calls (i.e., forwards them) to a voice mailbox
whenMSis turned off, low on battery, left unattended (after ringing for xx seconds) or temporarily out of coverage.
A Voice Message Alert (VMA) can be send (via SMS) to the MS to let the user know there is a waiting voice message

Voice Profile for Internet Mail (VPIM) Voice Profile for Internet Mail (VPIM) Version 2 is currently a Proposed Standard
(RFC 2421) Applicability Statement, it is an application of Internet Mail originally intended for sending voice messages between
voice messaging systems

International Roaming GSM‟s roaming feature allows a user to make and receive calls in any GSMnetwork and to use the
same user-specific services worldwide.
Requires a roaming agreement between the individual operators.

Operation/Administration/MaintainenceOperation/Administration/Maintainence (OA&M) follows ITU-T

Telecommuncations Management Network (TMN) model, which has severalcomponents

Operations system (OS) OS uses Operating System Function (OSF) to provide overallmanagement, billing, account,
management of mobile equipment, HLRmeasurement, …

Network Element Functions (NEFs) provides monitoring and control of Network Elements (NEs): HLR,VLR, AuC, EIR,
MSC, BSC, and BTS

Data Communication Network OS, NEs, and other TMN elements via Data Communication Function(DCF)
Mediation device (MD) adapts the OS to a specfic NE
Q-Adapter (QA) uses Q-adapter function to adapte non-TMN equipment

Workstation (WS) OA&M personnel interact with OS via Workstation functions (WSFs)

Enhanced Data Rates for GSM Evolution (EDGE) • enhanced modulation technique designed to increase network
capacityand data rates in GSM networks
• provide data rates up to 384 Kbps. • EDGE lets operators without a 3G license compete with 3G networks

GSM/EDGE Radio Access network (GERAN) the radio interface used in Enhanced Data Rates for GSM Evolution (EDGE)
Maximum data rate: 384 kbps

EGRPS EDGEan extension/enhancement of GPRS including 4 new DataPacket Traffic Channels using 8-PSK modulation
and a incremental redundancymechanism extended to the GMSK based data packet traffic channels.• Support for simultaneous,
multiple radio access bearers with different QoS profiles. • New bearer classes: – Conversational Class - Voice & video
conferencing where small delay is required – Streaming Class - Capable of processing as transfer is taking place, needs
somewhat constant delay and throughput
– Interactive Class - on-line applications – Background Class - Delay insensitive but requires few errors (may require multiple
re-transmissions to hide errors)

Network Elements GPRS works in a very different way compared to the circuit-switched GSM network. This is why three new
network components were introduced into the mobile network and software updates had to be made for some of the existing
components

13 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

The main new network architecture entities that are needed are:

SGSN Serving GPRS Support Node - the SGSN forms a gateway to the services within the network.
The SGSN or Serving GPRS Support Node element of the GPRS network provides a number of takes focussed on the IP
elements of the overall system. It provides a variety of services to the mobiles: Packet routing and transfer
Mobility management
Attach/detach
Logical link management
Authentication
Charging data
There is a location register within the SGSN and this stores location information (e.g., current cell, current VLR). It also stores
the user profiles (e.g., IMSI, packet addresses used) for all the GPRS users registered with the particular SGSN.
GGSN Gateway GPRS Support Node, GGSN, forms the gateway to the outside world. The GGSN, Gateway GPRS Support
Node is one of the most important entities within the GPRS network architecture.
The GGSN organises the interworking between the GPRS network and external packet switched networks to which the mobiles
may be connected. These may include both Internet and X.25 networks.
The GGSN can be considered to be a combination of a gateway, router and firewall as it hides the internal network to the
outside.
In operation, when the GGSN receives data addressed to a specific user, it checks if the user is active, then forwarding the data.
In the opposite direction, packet data from the mobile is routed to the right destination network by the GGSN.

PCU Packet Control Unit, PCU, which differentiates whether data is to be routed to the packet switched or circuit switched
networks. network component, the PCU.
The PCU is the packet-switched counterpart of the BSC and fulfills the following tasks

GPRS network upgrading One of the key elements for any network operator is the cost of capital expenditure (capex) to buy
and establish a network. Capex costs are normally very high for a new network, and operators endeavour to avoid this and use
any existing networks they may have to make the optimum use of any capital. In addition to the capex, there are the operational
costs, (opex). These costs are for general maintenance and other operational costs that may be incurred. Increasing efficiency and
reliability will reduce the opex costs.

Radio Resource Management – Mobility Management and Session Management applying RRM techniques to the global
system for mobile communication (GSM)/enhanced data rates for GSMevolution (EDGE) system. Even though the presented
results are focused on the GSM/EDGE system, the principles employed by most of the considered RRM techniquescan be
applied to other radio access networks (RANs)

Fundamentals of RRM in GSM/EDGE The second generation of cellular systems was marked by a transition from analog to
digital radio communications.
GSM emerged in this context, with its phase 1specification and initial deployment dating back to the early 1990s.
GSM had a significantrole in unifying the previously diverging European standards
In 1999, the enhanced GPRS (EGPRS) was introduced and then adopted as the packet system of the GSM/EDGE radio access
network, which is the focus of this section.
14 Uthaya Kumar csenotescorner.blogspot.com
 CP5201 Network Design and Technologies UNIT III

In the following section, an overview of GSM/EDGE is presented along with some of its standard functionalities.

GSM/EDGE Radio Access Network Overview The GSM/EDGE radio access network (GERAN) represents the evolution of
theGSM system for providing improved packet data transmission.
The GPRS andEGPRS are radio technologies that provide packet-switched connections betweenMS and BS, while the GERAN
is composed of several network elements that are interconnected through standard interfaces

Base station subsystem (BSS): It comprehends the base transceiver station (BTS), or simply BS, which is the onsite base
station, and the base station controller (BSC), which is a controlling unit responsible for a group of BTSs.

Core network: It has functionalities such as mobility management, authentication, charging, among others, and also provides
access to networks outside of the cellular system.
In the case of circuit-switched connections, the mobile switching center (MSC) is the main element of the core network,
providing accessibility to the conventional public-switched telephone network (PSTN)

Channel Structure The GSM/EDGE system implements multiple access through frequency division as
well as through time division. Each frequency carrier has a cyclic time structure associated, which is composed of hyperframes,
superframes, multiframes, frames, and timeslots

Besides the displayed frame structure, which is employed for traffic channels,there is an alternative signaling frame structure that
defines a multiframe with 51 frames and a superframe with 26 multiframes.2.1
The basic time unit is the timeslot, which is equivalent to roughly 0.577 ms. A sequence of eight timeslots defines a time division
multiple access (TDMA) frame, and a group of four frames composes a TDMA radio block.
Among the 26 frames of the multiframe structure in Fig. 2.1, the 13th and the last frame are reserved for control and other
functionalities. Therefore, the other 24 frames may be employed for traffic, i.e., six radio blocks
The logical channels may be divided into traffic and control channels. Next, some of the most relevant logical channels are
presented:

Traffic channel (TCH): This is a circuit-switched traffic channel used for voiceas well as circuit-switched data transmission.

Packet data traffic channel (PDTCH): This is a packet-switched traffic channelused for data transmission.

Broadcast control channel (BCCH): This is a downlink control channel thatdistributes general information to the MSs
concerning the system configuration.
The information may include number of common control channels, possiblecombinations of control channels, whether support
for packet-switched traffic is enabled, among others

Common control channel (CCCH): It corresponds to a set of common controlchannels that are used for implementing access
management functions.

Dedicated control channel (DCCH): It corresponds to a set of dedicated control channels that are used for measurements,
signaling, among other functionalities.

Protocols This section presents an overview of the protocol stack of the GSM/EDGE networkfor packet data transmission. are
organized among the different network elements in the 3GPP standards.
The focus of this chapter lies on the radio link between theMS and the BS, which is supported by the following three protocol
layers:

15 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Link layer control (LLC): It offers a reliable and secure logical link betweentheMS and the SGSN for superior layers. One of
its main functionalities consists of performing the segmentation of packets arriving fromhigher layers.

Radio link control (RLC) and medium access control (MAC): These protocolsprovide services for the transfer of information
over the physical layer.
Among their functionalities are the error-correcting procedures enabled through the selective retransmission of erroneous blocks

GSM RF or physical layer: It provides data transfer services over the physical channel between the BS and the MS. Among its
functionalities are the coding of data and the detection/correction of transmission errors in the physical medium.

Link Adaptation The link adaptation (LA) mechanism of EGPRS, which is described in tries to provide the best possible quality
to the MS through the modification of the current MCS. This adaptation occurs according to the availability of link quality
measurementsand it intends to exploit the channel diversity and maximize data rates bysuitably selecting an MCS according to
the channel state

Frequency Hopping The frequency hopping (FH) technique consists of periodically changing the transmission frequency with
the purpose of introducing diversity. The diversity effectmay include both frequency and interference diversity, which are
illustrated in

Random frequency hopping (RFH): It performs the hopping in an unorderedfashion, according to a pseudo-random sequence
determined based on system parameters and the algorithm presented

Cyclic frequency hopping (CFH): It performs the hopping in an ordered fashion, according to a previously established cyclic
sequence.

Parameter Description
MAL Mobile allocation list containing the frequencies available for allocation
MAIO Mobile allocation index offset indicating the offset within the MAL
Nfreq Number of frequencies per mobile allocation list
FN TDMA frame number currently in use
HSN Hopping sequence number allocated to each sector
MAI Mobile allocation index referencing the frequency of MAL to be used

Advanced Radio Resource Management for GSM/EDGE

Since the deployment of the first GSM-based networks, the demand for mobile communicationhas increased enormously.
Conventional GSM/EDGE networks havereached their capacity limits and, in order to serve the growing demand for mobile
communication, solutions to increase system capacity are required
Spectrum is a scarce resource whose use is granted and regulated by estate institutions,such that a capacity expansion through the
acquisition of new frequencybands may become very expensive

Power Control Power control (PC) is a well-established RRM technique which aims at, mainly,reducing interference levels in a
wireless network and conserving battery power ofterminals.. In this section, some particular aspects of PC in the context of
GSM/EDGE networks are detailed

16 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Dynamic Channel Allocation Dynamic channel allocation (DCA) assumes that there is a central channel pool, from which the
channels may be allocated on-demand, i.e., there is no fixed distributionof the channels among the cells. This higher flexibility
allows that the fluctuationsin the offered traffic and co-channel interference be treated with a higherefficiency

Measurements and SIR Estimation The GSM/EDGE cellular network does not count with direct SIR measurements.
The SIR must be inferred based on the measurement report mechanisms availablein the network

Channel Selection and Admission Control The considered DCA algorithm prioritizes the channel presenting the best SIR. In
the case when several channels perceive no interference, or when the estimated SIR is the same, the choice is done at random
among them

Management of Multiple ServicesThe support of multiple services, such as web-browsing, e-mail, audio/video
streaming,among others, is one of the main features of the third generation of cellular systems and beyond.

Multi-antenna TechniquesThe application of multi-antenna techniques to mobile communication systems iscapable of

providing capacity gains as well as the improvement of the quality ofservice perceived by the subscribers.
The spatial filtering realized through the use ofnarrow beams, which can be either selected from a fixed set (switched fixed
beams)or adaptively steered toward the desired MSs (adaptive beamforming), is able to significantly reduce the co-channel
interference levels

Simulation and Modeling of GSM/EDGE Networks Studying the performance of modern wireless networks, such as
GSM/EDGE, is a complex task. Due to the large number of variables and mechanisms involved, a pure analytical study is not
feasible and computer simulations are applied to investigatethe system‟s characteristics of interest

Cellular Grid, Frequency Reuse, and Mobility Models the cellular network is modeled as a macrocellular system composedof
tri-sectored cells organized in 1/3 or 1/1 uniform frequency reuse patterns

Propagation Models There are different average path loss models, which are adequate for differentpropagation scenarios .
Herein, the Okumura–Hata model is employed, which applies to urban and suburban environments where the average
buildingheight is approximately uniform.

Small Screen Web Browsing over GPRS and EDGEEDGE offers sufficient bandwidth today for web browsing. If the user
wants to access informationon a small mobile device, a number of different approaches can be taken to overcome the limitations
of the relatively slow data transmission, the small screens, the limited processing power, etc

WAP 1.1 Used in Early GPRS Devices The initial WAP 1.1 standard was designed for web browsing in, from today‟s point of
view, very constrained devices, which are not widely used anymore. Thediscussion in this section is therefore mostly of
historical nature.Special attention was given to the following limitations:
• Very limited bandwidth of the connection, which has an impact on the speed a page canbe downloaded.
• Very limited processing power of the mobile device, which has an impact on how quickly pagescan be rendered on the screen.
• Reliability of the connection. Pages should be loaded as quickly as possible to reduce the effectsof transmission interruptions
and lost network coverage on the user experience

WML WML
WSP HTTP
UDP TCP
IP IP
GPRS ETHERNET,
ATM….

IP network IP network
(e.g.GPRS) WAP (e.g.GPRS) WAP
gateway gateway

17 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

WAP 2.0Since the adoption of the WAP 1.1 standard, capabilities of both the networks and the mobile devices have improved
significantly. The mobile device processing power has increased, which allows, among other things, fast data downloads by
aggregating several GPRS timeslots

Instead of using a proprietary language for describing WAP pages, WAP 2.0 makes use of a subset of XHTML called XHTML
Mobile Profile. As XHTML is backward compatible to HTML, ordinary web pages can be viewed as well

Small Screen Web Browsing with Network Side Compression Currently, many high-end mobile devices have built-in web
browsers that can download and display standard web pages. The bigger the screen, the better a web page can be displayed. The
two downsides of this approach are the time it takes to download a standard web page over GPRS and EDGE andthe limited
processing capability of the mobile device, which results in a slow rendering of the web page. As a consequence, this approach
results in a much degraded user experience for many web pages

Small Screen Web Browsing – Quality of Experience The quality of experience of a small screen web-browsing session from
the user‟s point of view mainly consists of short page load times and a high click success rate. The click success rate is defined in
this context as the percentage of pages that start getting displayed within a certain amountof time after the user has selected a link
to another page. A typical maximum value for this reaction time is 7 seconds

Screen size: As web browsers are included even in very small phones today, user experience is limited by small displays that
require the user to scroll through pages a lot more often than on bigger displays. A good approach for a page design optimized
for mobile devices is to find a compromise that suits both big and small mobile device displays.
A fast processor can render pages a lot faster than a slower one. A processor architecture that offers high processing power and a
good power-saving mode once the page has been rendered greatly increases the user experience while preserving battery power.
Processor speed also has an influence on how fast pages can be scrolled up and down.
Good integration of the web browser into the mobile device operating system and wireless stack.

As discussed in Chapter 1, different companies produce different parts of the overall software of a mobile device. The web
browser, for example, is one of the most visible parts of the mobile device software that is often outsourced by phone
manufacturers to third-party companies.
To quickly react to user input, the browser should be integrated very tightly with the phone‟s operating system and
especially the GPRS stack.

The Multimedia Messaging Service (MMS) over GPRS Another mobile data application that has become popular is the
multimedia messaging service or MMS. MMS is advertised by mobile network operators as the multimedia successor of the text-
based short messaging service (SMS) that can transport not only text but also pictures, music and videos. The architectures of
SMS and MMS, however, are fundamentally different.

If a mobile device wants to send an MMS message, it establishes an IP connection to the MMS server via the GPRS network.
The PDP context activation procedure that is required to get an IP address in the first place has already been described before.
Instead of using the same APN as for a transparent connection to the Internet, the MMS service usually requires its own APN

18 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

MMS
WSP
UDP
IP
GPRS

IPnetwork(e.
g.GPRS)
WAP
gateway
MMS
HTTP
TCP
MMS IP
GSM
relay ETHERNET
SMSC ATM
MMS
server

Sample MMS settings

APN orangemms
Username Orange
Password Multimedia
IP address of proxy gateway 192.168.224.10
MMS server URL http://mms.orange.co.uk
will inform the user that a new MMS message is waiting in the network. The user notification priorto the MMS download can be
useful in cases where receiving an MMS is not free, for example,with some operators when roaming abroad. If the mobile device
is allowed to download the MMS automatically, there is no user interaction and the user is only notified once the MMS message
has been fully retrieved.
Pictures: JPEG, GIF, WBMP. The maximum guaranteed image size is 160 × 120 pixels. This corresponds to the display
resolution of small mobile devices. If pictures are sent with a higher resolution they might have to be downsized in the receiving
mobile device or by the MMS server.
Nevertheless, it makes sense to include pictures with a higher resolution in the MMS as the user might later on transfer the
picture to a PC via Bluetooth, for example, to benefit from the higher resolution of the PC‟s display.
Text: ASCII 8-bit, UTF-8 or UTF-16.
Audio: AMR (Adaptive Multirate).
Video: 3GPP MPEG-4 format. Many PC audio/video players offer plugins for this format so that received videos can be
transferred to PCs for playback as well.

Web Browsing via GPRS

Impact of Delay on the Web-Browsing Experience
While a high bandwidth connection is certainly one of the most important factors for a good web-browsing experience, the
round-trip delay (RTD) time of the connection must also not be underestimated. The RTD time is defined in this context as the

19 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

time it takes to receive a response to a transmitted frame.

As per the processes presented above, the time between entering a URL and being shown the first
part of the web page can be estimated as follows:

Total Delay (EDGE) = Delay DNS query + Delay TCP Establish + Delay Request/Response

= 750 ms + 320 ms + 660 ms

= 1730 ms
Web Browser Optimization for Mobile Web Browsing
Pipelining is activated in the Firefox browser as follows:
• In the URL field, about:config has to be entered to get the list of all parameters that can be changed.
• Pipelining is activated by setting the network.http.pipelining parameter to TRUE.
• A good value for the number of accumulated requests that should be set in network.http. pipelining.maxrequests is eight

Universal Mobile Telecommunications Systems (UMTS)

The Universal Mobile Telecommunications System (UMTS) is a third generation wireless telecommunication system and
follows in the footsteps of GSM and GPRS. Since GSM was
standardized in the 1980s, huge progress has been made in many areas of telecommunication.
This allowed system designers at the end of the 1990s to design a new system that went far beyond the capabilities of GSM and
GPRS. UMTS combines the properties of the circuit-switched voice network with the properties of the packet-switched data
network and offers a multitude of new possibilities compared to the earlier systems

Overview, History and Future The trends and developments seen in fixed-line networks are also appearing in mobile networks
albeit with a delay of about 5 years. In fixed networks, the number of people using the network not only for voice telephony but
also to connect to the Internet is increasing as steadily as the transmission speeds.
When the Internet first became popular, circuit-switched modems were used to establish a dial-up connection to the network
featured speeds of about 14.4 kbit/s, later models achieved around 50 kbit/s in the downlink (network to user) direction.
Another incredible step forward was made around the year 2002 when technologies like cable and Asymmetric Digital
Subscriber Line (ADSL) modems reached the mass market and dramatically increased transmission speeds for end users
For UMTS, these advances were consistently used.
While voice communication was the most important application for a wireless communication system when GSM was designed,
data services are now playing an ever more important role in wireless networks.

20 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Therefore, the convergence of voice and high-speed data services into a single system has been a driving force in the UMTS
standardization from the beginning

3GPP Release 99: The First UMTS Access Network Implementation Initially, 3GPP specification releases were named after
the year of ratification, while later on a version
number was used. This is why the first combined 3GPP GSM/UMTS release was called Release 99
while subsequent versions were called Release 4, Release 5, Release 6 and so on. At the time of publication, 3GPP is in the
process of working on Release 10, which combines GSM, UMTS, LTE and LTE-Advanced
As no major changes were necessary in the core network it was possible to connect the UMTS radio access network (UTRAN) to
a GSM and GPRS core network. The MSCs and SGSNs only required a software update and new interface cards to support the
Iu(cs) and Iu(ps) interfaces. Figure 3.1 shows the network elements of a combined GSM and UMTS network

UTRAN
PSTN
MSC MSC
RNC Node-B

UE
Node-B
MSC MSC
MSC MSC
GSM RNC
BSS
Internet

TRAU

3GPP Release 4: EnhancementsBSC for the Circuit-Switched Server

Core NetworkA major enhancement for circuit-switched voice and data services has been specified with 3GPP Release 4. Up to
and including Release 99, all circuit-switched voice calls were routed through theGSM and UMTS core network via E1
connections inside 64 kbit/s timeslots.
The most importantenhancement ofPCU Release 4 is a new concept called the Bearer-Independent Core Network, or BICNfor short.
Instead of using circuit-switched 64 kbit/s timeslots, traffic is now carried inside IP packets.
For this purpose, the MSC has been split into an MSC-Server (MSC-S), which is responsible for CallControl (CC) and Mobility
Management (MM), and a Media Gateway (MG), which is responsible forhandling the actual bearer (user traffic)

3GPP Release 5: IMS and High-Speed Downlink Packet Access A further step toward an all IP wireless network is the IP
Multimedia Subsystem (IMS). The groundworkfor IMS was laid in 3GPP Release 5. Subsequent versions of the standard have

21 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

extended it withnew functionalities. Instead of using the circuit-switched part of the radio network, the IMS handles voice calls
and other services via the packet-switched

As the IMS is an IP-based system it cannot directly communicate with circuit-switched telephony systems that are still dominant
in wireless networks. Nevertheless, it has to be ensured that every user
can talk to every other user regardless of the kind of telephony architecture that is in use at each end.

As can be seen in Figures 3.2 and 3.3 this is achieved by using MGs, which convert between IMS VoIP, BICN and the classic
circuit-switched timeslot transmission.
Unfortunately, the IMS suffers from a number of difficulties that have so far prevented it from becoming an alternative to the
Release 99 or Release 4 MSC architecture. Some of these are as follows

3GPP Release 6: High-Speed Uplink Packet Access (HSUPA) The HSPA functionality continued to evolve in 3GPP Release
6. This revision of the specificationbrought the introduction of methods to increase uplink speeds, which have remained the same
sinceRelease 99. This feature set, referred to as HSUPA (High-Speed Uplink Packet Access) in public,
enables uplink datarates of several megabits per second for a single user under ideal conditions. Taking realistic signal conditions
into account, the number of users per cell and mobile device capabilities, HSUPA enabled devices can still achieve significantly
higher uplink speeds than was possible withRelease 99

UMTS Channel Structure on the Air Interface

UserPlane and Control Plane GSM, UMTS and other fixed and wireless communication systems differentiate between two
kinds ofdata flows. In UMTS, these are referred to as two different planes. Data flowing in the user plane isdata which is directly
and transparently exchanged between the users of a connection like voice dataor IP packets. The control plane is responsible for
all signaling data that is exchanged between theusers and the network.

22 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Control plane User plane

Core network
CC, MM Voice or
RRC
GMM/SM IP packets
messages End to end Bearerr

Radio network
Common and Dedicated (UTRAN)
Channels Both user plane data and control plane data is transferred over the UMTS air interface in so-
called„channels‟. Three different kinds of channels exist:

Dedicated channels: These channels transfer data for a single user. A dedicated channel is used, for example, for a voice
connection, for IP packets between the user and the network or a location update message.
Terminal

Common channels: The counterpart to a dedicated channel is a common channel. Data transferred in common channels is
destined for all users of a cell. An example for this type of channel is the broadcast channel, which transmits general information
about the network to all users of a cell in order to inform them of, for example, the network the cell belongs to, the current state
of the network, etc.

Shared channels: Very similar to common channels are shared channels. These channels are not monitored by all devices but
only by those that have been instructed by the network to do so. An example of such a channel is the High-Speed Downlink
Shared Channel (HS-DSCH) of HSDPA

Logical, Transport and Physical Channels To separate the physical properties of the air interface from the logical data
transmission, the UMTSdesign introduces three different channel layers. Figure 3.13 shows the channels on different layers
indownlink direction while

Logical Channels The topmost channel layer is formed by the logical channels. Logical channels are used to separate
different kinds of data flows that have to be transferred over the air interface. The channels contain no information on how the
data is later transmitted over the air. The UMTS standards define the following logical channels:

The BCCH (Broadcast Control Channel): This channel is monitored by all mobile devices in Idle state to receive general
system information from the network. Information distributed via this channel, for example, includes how the network can be
accessed, which codes are used by the neighboring
cells, the LAC, the Cell-ID and many other parameters

The PCCH (Paging Control Channel): This channel is used to inform users of incoming calls or SMS messages. Paging
messages are also used for packet-switched calls if new data arrives from the network once all physical resources (channels) for a
subscriber have been released owing to a long period of inactivity

The CCCH (Common Control Channel): This channel is used for all messages from and to individual mobile devices
(bidirectional) that want to establish a new connection with the network. This is necessary, for example, if a user wants to make a
phone call, send an SMS or to establish a channel for packet-switched data transmission.

The DCCH (Dedicated Control Channel): While the three channels described above are common channels observed by many
mobile devices in the cell, a DCCH only transports data for a single subscriber

The DTCH (Dedicated Traffic Channel): This channel is used for user data transfer between the network and a single user.
User data can, for example, be a digitized voice signal or IP packets of a packet-switched connection

The CTCH (Common Traffic Channel): This channel is used for cell broadcast information. In GSM, the same mechanism is
used by some network operators to inform subscribers of fixedline phone network area codes which are used around the current
cell that can be called from the mobile device for a cheaper tariff, to inform about the location of the cell, for broadcasting news,
etc

Transport Channels Transport channels prepare downlink data frames for transmission over the air interface by splitting

23 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

them up into smaller parts, which are encapsulated into RLC/MAC-frames that are more suitable for transmission over the air
interface. The RLC/MAC header that is placed in front of each frame contains, among other things, the following information:
• length of the frame (10, 20, 40 or 80 milliseconds);
• type of integrity checking mechanism (CRC checksum);
• channel coding format for error detection and correction;
• rate matching in case the speed of the physical channel and the layers above do not match;
• control information for detection of discontinuous transmission (DTX) in case the other end has no data to send at a particular
time

Logical channels are mapped to the following transport channels:

The BCH (Broadcast Channel): Transport channel variant of the logical BCCH.

The DCH (Dedicated Channel): This transport channel combines data from the logical DTCH and
the logical DCCH. The channel exists in both uplink and downlink directions as data is exchanged in both directions.

The PCH (Paging Channel): Transport channel variant of the logical PCCH.

The RACH (Random Access Channel): The bidirectional logical CCCH is called RACH on thetransport layer in uplink
direction. This channel is used by mobile devices to send RRC Connection
Request messages to the network if they wish to establish a dedicated connection with the network(e.g. to establish a voice call).

Physical Channels Finally, physical channels are responsible for offering a physical transmission medium for one ormore
transport channels. Furthermore, physical channels are responsible for channel coding, that is, the addition of redundancy and
error detection bits to the data stream.

The following physical channels are used in a cell:

The P-CCPCH (Primary Common Control Physical Channel): This channel is used for distributing broadcast information in
a cell.

The S-CCPCH (Secondary Common Control Physical Channel): This channel is used to broadcast the PCH and the FACH.

The PRACH (Physical Random Access Channel): The physical implementation of the RACH.

The AICH (Acquisition Indication Channel): This channel is not shown in the channel overview figures as there is no
mapping of this channel to a transport channel. The channel is used exclusively together with the PRACH during the connection
establishment of a mobile device with the network.
More about this channel and the process of establishing a connection

The DPDCH (Dedicated Physical Data Channel): This channel Lub-FP is the physical counterpart
of a dedicated channel to a single mobile device. The channel AAL2/IP Lur-FP combines user data
and signaling messages from (Packet) MM, CC and SM. AAL2/IP
Node
The DPCCH (Dedicated Physical Control Channel): This channel is used in addition to a DPDCH in both uplink and
-B
downlink directions

Logical Channels: These channels describe different flows of information like user data and signaling data. Logical channels
contain no information about the characteristics of the transmission channel.

Transport Channels: These channels prepare data packets that are received from logical channels for transmission over the air
interface. Furthermore, this layer defines which channel coding schemes (e.g. error correction methods) are to be applied on the
physical layer.

Physical Channels: These channels describe how data from transport channels is sent over the air interface and apply channel
coding and decoding to the incoming data streams.

The UMTS Terrestrial Radio Access Network (UTRAN)

24 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Node-B, Iub Interface, NBAP and FP The base station, called Node-B in the 3GPP standards, is responsible for all functions
required for sending and receiving data over the air interface. This includes, as shown in Section 3.3, channel coding, spreading
and despreading of outgoing and incoming frames as well as modulation. Furthermore,the Node-B is also responsible for the
power control of all connections

For the exchange of control and configuration messages on the Iub interface, the Node-B Application Part (NBAP) is used
between the RNC and the Node-B. It has the following tasks:
• cell configuration; • common channel management; • dedicated channel management such as the establishment of a new
connection to a subscriber; • forwarding of signal and interference measurement values of common and dedicated channels to the
RNC

The RNC, Iu, Iub and Iur Interfaces, RANAP and RNSAP
The heart of the UMTS radio network is the RNC. As can be seen in Figures 3.20 and 3.21, all interfaces of the radio network
are terminated by the RNC.
In the direction of the mobile subscriber the Iub interface is used to connect several dozen Node-Bs to an RNC. During the first
years after the initial deployment of UMTS networks, most Node-Bs were connected to the RNC via 2Mbit/s E-1 connections
either via fixed-line or microwave links

MSC SGSN
Lu(cs)
Lu-FP
AAL2/IP
RNC
lub lur lub

RNC
The Iur interface completes the overview of the UTRAN interfaces for this chapter. This interface connects RNCs with each
other to support the soft handover procedure between Node-Bs that are

Bandwidth /Quality of Service Bandwidth requirements, of the user Available spreading codes Interference level Service
level,Distance of the, user to the center, of the cell, Speed of the user

Adaptive Multirate (AMR) Codec for Voice Calls For UMTS, it was decided to use the AMR codec for voice encoding. AMR
was already introduced as an optional voice codec for GSM, as described in Chapter 1; however, Lu-FP in UMTS,
AMR is mandatory.
With AMR, the codec is no longer only negotiated at the establishment of a voice call but the GTP systemcan
change the codec every 20 milliseconds UDP/IP
AAL5/IP
Radio Resource Control (RRC) States The activity of a subscriber determines in which way data is
transferred over the air interface betweenthe mobile device and the network

Idle State In this state, a mobile device is attached to the network but does not have a physical or logicalconnection with the
radio network. This means that the user is involved neither in a voice call nor in a data transfer. From the packet-switched core
network point of view, the subscriber might still have an active PDP context (i.e. an IP address) even if no radio resources are
assigned at the moment

Cell-DCH State The Cell-DCH RRC state is used similarly to the GSM dedicated mode for circuit-switched voicecalls. While in
this state, a physical connection is established between the mobile device and the network.
In the UTRAN this means that the mobile device has been assigned its own spreading codein the downlink direction and its own
spreading and scrambling codes in the uplink direction

Cell-FACH State The Cell-FACH state is mainly used when only a small amount of data needs to be transferred to orfrom a
subscriber. In this mode, the subscriber does not get a dedicated channel but uses the FACH to receive data

Cell-PCH and URA-PCH States The optional Cell-PCH (Cell-Paging Channel) RRC state and the URA-PCH (UTRAN
RegistrationArea – Paging Channel) RRC state can be used to reduce the power consumption of the mobile deviceduring
extended times of inactivity

25 Uthaya Kumar csenotescorner.blogspot.com

 CP5201 Network Design and Technologies UNIT III

Core Network Mobility Management From the point ofview of the MSC and the SGSN, the mobile device can be in any of the
MM orPMM states described below. The MSC knows the following MM states

MM Detached: The mobile device is switched off and the current location of the subscriber isunknown. Incoming calls for the
subscriber cannot be forwarded to the subscriber and are eitherrejected or forwarded to another destination if the Call Forward
Unreachable (CFU) supplementary service is activated

MM Idle: The mobile device is powered on and has successfully attached to the MSC . The subscriber can at any time start an
outgoing call. For incoming calls, the mobile
device is paged in its current Location Area.

MM Connected: The mobile device and MSC have an active signaling and communication connection.
Furthermore, the connection is used for a voice or a video call. From the point of view of the RNC, the subscriber is in the Cell-
DCH RRC state as this is the only bearer that supports
circuit-switched connections.

PMM Detached: The mobile device is switched off and the location of the subscriber is unknown to the SGSN. Furthermore,
the mobile device cannot have an active PDP context, that is, no IP address is currently assigned to the subscriber.

PMM Connected: The mobile device and the SGSN have an active signaling and communication connection. The PMM
connected state is only maintained while the subscriber has an active PDP context, which effectively means that the GGSN has
assigned an IP address for the connection.
In this state, the SGSN simply forwards all incoming data packets to the Serving RNC (S-RNC).
In contrast to GSM/GPRS, the UMTS SGSN is aware only of the S-RNC for the subscriber and not of the current cell

Mobility Management in the Cell-DCH State For services like voice or video communication it is very important that little or
no interruption ofthe data stream occurs during a cell change. For these services, only the Cell-DCH state can be used.
In this state, the network constantly controls the quality of the connection and is able to redirect the connection to other cells if
the subscriber is moving

Mobility Management in the Cell-DCH State For services like voice or video communication it is very important that little or
no interruption of the data stream occurs during a cell change. For these services, only the Cell-DCH state can be used.
In this state, the network constantly controls the quality of the connection and is able to redirect theconnection to other cells if
the subscriber is moving

RSSI: To describe the total signal power received in milliwatts. The value is usually expressed in dBm (logarithmic scale) and
typical values are −100dBm for a low signal level to −60 dBm for a very strong signal level.

RSCP (Received Signal Code Power): The power the pilot channel of a base station is received with. The RSCP can be used,
for example, to detect UMTS cell edge scenarios where no neighboring UMTS cell is available to maintain the connection. In
this case, the network takes action when the
RSCP level falls below a network-operator-defined threshold

EcNo: The received energy per chip (Ec) of the pilot channel divided by the total noise power density (No). In other words, the
EcNo is the RSCP divided by the RSSI. The better this value the better the signal can be distinguished from the noise. The EcNo
is usually expressed in decibels as it is a relative value.

Hard Handover By receiving measurement results from the mobile device of the active connection and measurement
results of the signal strength of the broadcast channel of the neighboring cells, the RNC is able to recognize if a neighboring cell
is more suitable for the connection

user tower
lub

user tower RNC

26 Uthaya Kumar csenotescorner.blogspot.com

user tower
 CP5201 Network Design and Technologies UNIT III

Soft Handover With this kind of handover, a voice call is not interrupted at any time during the procedure. On thebasis of signal
quality measurements of the current and neighboring cells, the RNC can decide to setthe mobile device into soft handover state.
All data from and to the mobile device will then be sentand received not only over a single cell but also over two or even more
cells simultaneously.
Allcells that are part of the communication are put into the so-called Active Set of the connection. If aradio connection of a cell
in the Active Set deteriorates, it is removed from the connection

lub
lu(cs), lu(ps)
user tower

Reduction of the spreading factor: For this option, the spreading factor is reduced for some frames. Thus, more data can be
transmitted
user during thesetower
periods, which increases the speed of the connection.
RNC
This allows the insertion of short transmission gaps for interfrequency measurement purposes without reducing the overall speed
of the connection. As the spreading factor changes, the transmission power has to be increased to ensure an acceptable error rate.

Puncturing: After the tower

channel coder has added error correction and error detection bits to the original data stream, some of them
are removed again to have time for interfrequency measurements.
To keep the error rate of the radio bearer within acceptable limits, the transmission power has to be increased.

Reduction of the number of user data bits per frame: As fewer bits are sent per frame, the transmission power does not have
to be increased. The disadvantage is the reduced user dataratewhile operating in compressed mode
Mobility Management in Idle State While in Idle state, the mobile device is passive, that is, no data is sent or received.
Nevertheless,there are a number of tasks that have to be performed periodically by the mobile device.
To be able to respond to incoming voice calls, short messages, MMS messages, etc., the PCH is monitored. If a paging message
is received that contains the subscribers IMSI or TMSI, the mobile device reacts and establishes a connection with the network.

Mobility Management in Other States In Cell-FACH, Cell-PCH or URA-PCH state, the mobile device is responsible for
mobility managementand thus for cell changes. The big difference between these states and the Idle state is that a
logicalconnection exists between the mobile device and the radio network when a packet session is active.
Depending on the state, the mobile device has to perform certain tasks after a cell change
As the SGSN detects during the location and routing area update that there is still a logical connection to a different RNC, it
sends a message to the previous RNC that the subscriber is no longer under its control. Thus, it is ensured that all resources that
are no longer needed to maintain
the connection are released

UMTS Security Like GSM, UMTS has strong security measures to prevent unauthorized use and eavesdropping on
user data traffic and conversations. UMTS also includes enhancements to overcome a number ofweaknesses that have been
found, over the years, in the way GSM protects networks and users. The following are the main weaknesses:
• The GSM circuit-switched part does not protect the link between the base station and the BSC. In many cases microwave links
are used, which are vulnerable to third party monitoring.
• GSM allows man-in-the-middle attacks with equipment that masquerades as a GSM base station.
• The CK length used in GSM is 64 bits. Although secure when GSM was first developed in the early 1990s, the length is
considered insufficient today.
• A number of weaknesses with the A5/1 stream cipher have been detected, as described in which allow decryption of a voice
conversation with the appropriate equipment

27 Uthaya Kumar csenotescorner.blogspot.com