GSM -> Network Aspects

1  Handover
2  Location updating and call
3  Authentication and security

Ensuring the transmission of voice or data of a given quality over the radio link is only half the problem in a cellular mobile 

The signalling protocol in GSM is structured in three layers , shown in Figure 3.  Layer 1 is the physical layer, which uses the channel structures discussed above.  Layer 2 is the data link layer. Across the Um interface, the data link layer uses a slight modification of the LAPD protocol used in ISDN, called LAPDm.  Across the A interface, the lower parts of Signalling System Number 7 are used.  Layer 3 is subdivided into 3 sublayers.

,------------------------------------------------------------------------,
|                             Um                        A                |
|                ,---------,  |                         |  ,---------,   |
|                |   CM    |                               |   CM    |   |     
|   GSM layer 3  |- - - - -|  |                         |  |- - - - -|   |    
|                |   MM    |                               |   MM    |   |  
|                |- - - - -|  |  ,-------------------,  |  |- - - - -|   |
|                |         |     |         |  DTAP   |     |   DTAP  |   |     
|                |   RR    |  |  |   RR    | BSSMAP  |  |  |  BSSMAP |   |
|   - - - - - - -|---------|     |---------|---------|     |---------|   |
|                |         |  |  |         |  SCCP   |  |  |   SCCP  |   |
|   GSM layer 2  |  LAPDm  |     |  LAPDm  |---------|     |---------|   |
|   - - - - - - -|---------|  |  |---------|         |  |  |         |   |
|   GSM layer 1  |  TDMA   |     |  TDMA   |  MTP    |     |   MTP   |   |    
|                `---------'  |  `-------------------'  |  `---------'   |
|                                   BTS       BSC                        |
|                                                                        |
|            Mobile Station      Base Station Subsystem        MSC       |
`------------------------------------------------------------------------'
				FIGURE 3

Radio Resources Management

controls the setup, maintenance, and termination of radio channels

Mobility Management

manages the location updating, handovers, and registration procedures, discussed below

Connection Management

handles general call control, similar to CCITT Recommendation Q.931, and provides supplementary services.

Signalling between the different entities in the network, such as between the HLR and VLR, is accomplished throught the Mobile Application Part (MAP).  Application parts are the top layer of Signalling System Number 7.  The specification of the MAP is complex. It is one of the longest documents in the GSM recommendations, said to be over 600 pages in length .

Described below are the main functions of the Mobility Management sublayer.

1  Handover

• channels (time slots) in the same cell,
• cells (Base Transceiver Stations) under the control of the same Base Station Controller (BSC),
• cells under the control of different BSCs, but belonging to the same Mobile services Switching Center (MSC), and
• cells under the control of different MSCs.

Handovers can be initiated by either the mobile or the MSC (as a means of traffic load balancing).  During its idle time slots, the mobile scans the Broadcast Control Channel of up to 16 neighboring cells, and forms a list of the six best candidates for possible handover, based on the received signal strength.  This information is passed to the BSC and MSC, and is used by the handover algorithm.

The algorithm for when a handover decision should be taken is not specified in the GSM recommendations.  There are two basic algorithms used, both closely tied in with power control.  This is because the BSC usually does not know whether the poor signal quality is due to multipath fading or to the mobile having moved to another cell.  This is especially true in small urban cells.

The 'minimum acceptable performance' algorithm gives precedence to power control over handover, so that when the signal degrades beyond a certain point, the power level of the mobile is increased.  If further power increases do not improve the signal, then a handover is considered.  This is the simpler and more common method, but it creates 'smeared' cell boundaries when a mobile transmitting at peak power goes some distance beyond its original cell boundaries into another cell.

The 'power budget' method uses handover to try to maintain or improve a certain level of signal quality at the same or lower power level.  It thus gives precedence to handover over power control.  It avoids the 'smeared' cell boundary problem and reduces co­channel interference, but it is quite complicated.

2  Location updating and call routing

The MSC provides the interface between the GSM mobile network and the public fixed network.  From the fixed network's point of view, the MSC is just another switching node.  However, switching is a little more complicated in a mobile network since the MSC has to know where the mobile is currently roaming - and in GSM it could even be roaming in another country.  The way GSM accomplishes location updating and call routing to the mobile is by using two location registers: the Home Location Register (HLR) and the Visitor Location Register (VLR).

Location updating is initiated by the mobile when, by monitoring the Broadcast Control Channel, it notices that the location­area broadcast is not the same as the one previously stored in the mobile's memory.  An update request and the IMSI or previous TMSI is sent to the new VLR via the new MSC.  A Mobile Station Roaming Number (MSRN) is allocated and sent to the mobile's HLR (which always keeps the most current location) by the new VLR.  The MSRN is a regular telephone number that routes the call to the new VLR and is subsequently translated to the TMSI of the mobile.  The HLR sends back the necessary call­control parameters, and also sends a cancel message to the old VLR, so that the previous MSRN can be reallocated.  Finally, a new TMSI is allocated and sent to the mobile, to identify it in future paging or call initiation requests.

,--------------------------------------------------------------------------,
|   Fixed    PSTN/ISDN  Gateway  Home Location  PSTN/ISDN          Mobile  |
| Subscriber exchange     MSC      Register     exchange  MSC/VLR  Station |
|     |          |         |          |          |          |          |   |
|     |--------->| MSISDN  |          |          |          |          |   |
|     | MSISDN   |-------->|  MSISDN  |          |          |          |   |  
|     |          |         |- - - - ->|          |          |          |   |
|     |          |         |   MSRN   |          |          |          |   |
|     |          |         |<- - - - -|          |          |          |   |
|     |          |         |   MSRN   |          |          |          |   |
|     |          |         |-------------------->|  MSRN    |          |   |
|     |          |         |          |          |--------->|  TMSI    |   |
|     |          |         |          |          |          |--------->|   |
|     |        ,---,     ,---,        |        ,---,      ,---,        |   |
|     |        | S |     | S |        |        | S |      | S |        |   |
|              `---'     `---'                 `---'      `---'            |
|   ,---,                                                                  |
|   | S | indicates a switching node.                                      |
|   `---'                                                                  |
`--------------------------------------------------------------------------'
				FIGURE 4

With the above location­updating procedure, call routing to a roaming mobile is easily performed.  The most general case is shown in Figure 4, where a call from a fixed network (Public Switched Telecommunications Network or Integrated Services Digital Network) is placed to a mobile subscriber.  Using the Mobile Subscriber's telephone number (MSISDN, the ISDN numbering plan specified in the ITU­T E.164 recommendation), the call is routed through the fixed land network to a gateway MSC for the GSM network (an MSC that interfaces with the fixed land network, thus requiring an echo canceller).  The gateway MSC uses the MSISDN to query the Home Location Register, which returns the current roaming number (MSRN).  The MSRN is used by the gateway MSC to route the call to the current MSC (which is usually coupled with the VLR).  The VLR then converts the roaming number to the mobile's TMSI, and a paging call is broadcast by the cells under the control of the current BSC to inform the mobile.

3  Authentication and security

Since the radio medium can be accessed by anyone, authentication of users to prove that they are who they claim to be, is a very important element of a mobile network.  Authentication involves two functional entities, the SIM card in the mobile, and the Authentication Center (AC).  Each subscriber is given a secret key, one copy of which is stored in the SIM card and the other in the Authentication Center.  During authentication, the AC generates a random number that it sends to the mobile.  Both the mobile and the AC then use the random number, in conjuction with the subscriber's secret key and a ciphering algorithm called A3, to generate a number that is sent back to the AC.  If the number sent by the mobile is the same as the one calculated by the AC, the subscriber is authenticated.

The above calculated number is also used, together with a TDMA frame number and another ciphering algorithm called A5, to encipher the data sent over the radio link, preventing others from listening in.  Enciphering is an option for the very paranoid, since the signal is already coded, interleaved, and transmitted in a TDMA manner, thus providing protection from all but the most persistent and dedicated eavesdroppers.

Another level of security is performed on the mobile equipment, as opposed to the mobile subscriber.  As mentioned earlier, each GSM terminal is identified by a unique International Mobile Equipment Identity (IMEI) number.  A list of IMEIs in the network is stored in the Equipment Identity Register (EIR).  The status returned in response to an IMEI query to the EIR is one of the following:

white­listed

The terminal is allowed to connect to the network

grey­listed

Under observation from the network, possible problems

black­listed

The terminal has either been reported as stolen, or it is not type approved (the correct type of terminal for a GSM network).  The terminal is not allowed to connect to the network.

<<<GSM Radio Links Aspects             GSM vs CDMA >>>