3 GSM System ∗ 3.1 The GSM Recommendation The early 1980s were marked by the development of a number of national and incompatible radio networks in Europe; see Table 1.2 and Figure 1.3. The seven different mobile radio networks made the prospect of the mobile telephone unattractive to many potential customers because of high tariffs and equipment costs. For this reason, at its general meeting in Vienna in June 1982, CEPT (see Appendix B.2.2) decided to develop and standardize a Pan-European cellular mobile radio network. The aim was for the new system to operate in the 900 MHz frequency band allocated to land mobile radio. A working group, called Group Sp´ecial Mobile (GSM), was set up under the direction of CEPT. There were no guidelines on how the new mobile radio system was to transmit analogue or digital speech and data. The decision to develop a digital GSM network was not made until the development stage. But it was agreed from the beginning that the system being planned—called the GSM mobile radio system after the working group that developed it—should incorporate and consider new technology from the area of telecommunications, such as ITU-T Signalling System No. 7, ISDN and the ISO/OSI reference model. Six working groups and three supporting groups were formed to cope with the enormity of the standardization work. The tasks of the different GSM working groups are listed in Table 3.1. The GSM objectives for its Public Land Mobile Network (PLMN) were to offer [1]: • A broad offering of speech and data services • Compatibility with the wireline networks (ISDN, telephone networks, data networks) using standardized interfaces • Cross-border system access for all mobile phone users • Automatic roaming and handover • Highly efficient use of frequency spectrum ∗ With the collaboration of Peter Decker and Christian Wietfeld Mobile Radio Networks: Networking and Protocols. Bernhard H. Walke Copyright ©1999 John Wiley & Sons Ltd ISBNs: 0-471-97595-8 (Hardback); 0-470-84193-1 (Electronic) 122 3 GSM System Table 3.1: Tasks of the GSM working groups GSM working groups Tasks Working Party 1 Definition of services and service quality Working Party 2 Definition of access, modulation and coding proce- dures Working Party 3 Definition of protocols for signalling between mo- bile stations, mobile functions and fixed communi- cations networks Working Party 4 Specification of data services Working Party 5 Development of UMTS Working Party 6 Specification of network management features Speech Coder Experts Group (SCEG) Definition of technique for digitization of speech at a low bit rate Security Experts Group (SEG) Responsibility for all aspects of security (access, coding, authentication) Satellite Earth Systems (SES) Support of GSM through satellite systems Table 3.2: Original timetable for introducing the GSM system Date Phase February 1987 Invitation for tenders Mid 1988 Letters of Intent End 1988 Validation of interfaces Mid 1990 System validation March 1991 Start of equipment deliveries June 1991 Operation of first base station 1993 Coverage to metropolitan areas and major roads since 1995 Area-wide operation • Support of different types of mobile terminal equipment (e.g., car, portable and hand-held telephones) • Digital transmission of signalling as well as of user information • Supplier-independence • Low costs for infrastructure and terminal equipment The GSM group tested a number of prototypes for digital cellular radio systems, and in 1987 decided on a standard that combined the best charac- teristics of different systems. A timetable drawn up at the same time for the implementation of the plan gained the full support of the European Union (EU) (see Table 3.2). 3.1 The GSM Recommendation 123 Table 3.3: The series of the GSM recommendation Series Content 00 Preamble 01 General aspects, terminology and service introduction phases of the GSM Public Land Mobile Network (PLMN) 02 Definition of telecommunications services, technical aspects concerning tariffs and international billing procedures 03 Definition of network functions such as traffic routing, handover, secu- rity issues relating to network access, network planning 04 Description and definition of protocols and interfaces between mobile station (MS) and base station (BS) 05 Radio path functions such as multiplexing, channel coding, synchro- nization and interleaving 06 Speech processing and speech coding functions 07 Adaptation of terminal equipment and transmission rates 08 Description of interface functions between base station system (BSS) and mobile services switching centre (MSC) 09 Definition of interworking functions (IWF) between one or more GSM networks and different fixed networks 11 Equipment specifications and type approval guidelines 12 Operation and maintenance of a GSM network By 1987, comprehensive guidelines for the new digital mobile radio system had already been established by the GSM group. By signing the Memoran- dum of Understanding on the Introduction of the Pan-European Digital Mo- bile Communication Service (MoU) on 7 September 1987, the 13 participating countries confirmed their commitment to introducing mobile radio based on the recommendations of the GSM. Later, in March 1989, the GSM working party was taken over by ETSI (see Appendix B.2.3), and since 1991 has been called the Special Mobile Group (SMG). Today the abbreviation GSM stands for Global System for Mobile Communications, thereby underlining its claim as a worldwide standard. In the meantime all the European countries as well as a large number of other countries in the world have signed the GSM-MoU agreement and have developed or will be developing mobile radio systems in their countries based on the GSM recommendations (see Table 3.39). The planned official start to the GSM system was delayed by one year. Only five countries were in a position to undertake test operations on 1st July 1991. The reason for the delay was the level of complexity of the digital network and its components, which is reflected in the voluminous specifications which today total around 8000 pages. In 1990 alone another 500 GSM change requests were passed. The entire set of GSM recommendations is divided into 13 series, which cover different aspects of the GSM system, as shown in Table 3.3 (see also Appendix E). 124 3 GSM System The GSM recommendations contain detailed specifications for the radio in- terface which in part are borrowed from the concepts for the analogue national cellular standard and ITU-T Rec. X.25. However, large parts of the radio in- terface are specific to the GSM system. Some of the important features of GSM include: Frequency band The frequency range between 935 and 960 MHz is used as the base station transmitting frequency (downlink) and the frequencies between 890 and 915 MHz are used as the base station receiving fre- quency (uplink). The carrier frequencies of the FDM radio channels have 200 kHz channel spacing in each band, thus providing 124 FDM channels. With time-division multiplexing (TDM), eight communica- tions channels (time slots) are supported per FDM channel. Handover Handover from one base station to another is a mechanism that allows the connection quality of calls between users to be maintained, interference to be minimized and traffic distribution to be controlled. In addition, procedures are defined for the re-establishment of a connection if a handover fails. Power control In the area over 30 dB the equipment of the mobile user and of the base station controls power in 2 dB steps in order to minimize interference. Discontinuous transmission (DTX) GSM offers the option of discontinuous transmission of speech using voice activity detectors. With DTX, trans- mitter battery power is only used when speech or data is being trans- mitted, which minimizes interference and improves the utilization of frequency spectrum. Synchronization Depending on the system, all frequencies and times are syn- chronized with a highly stable (0.005 ppm) reference, which can be cou- pled with a frequency normal. The following features distinquish GSM from other European mobile radio systems: • Europe-wide coverage • Europe-wide standardization • digital radio transmission • extensive ISDN compatibility • protection against eavesdropping • support of data services GSM is regarded as an important advance compared with predecessor sys- tems and is considered to be representative of so-called 2nd-generation sys- tems. Along with important technological advances (particularly the intro- duction of digital transmission technology), the standardization of the inter- faces between subsystems in GSM has provided manufacturers and network operators flexibility in their development work and configurations. 3.2 The Architecture of the GSM System 125 U m A bis (NSS) Switching Subsystem Network and (OSS) Subsystem Operation MS MS EIR OMC AuC HLR VLR BSC BTS BTS BSC MSC BTS MS A O BTS-BSC PSTN ISDN, PDN (BSS) Base Station Subsystem Radio Subsystem O (see below) Points of reference: Interface to Transition to Interface Radio Interface other Networks Figure 3.1: Functional architecture of the GSM mobile radio network 3.2 The Architecture of the GSM System 3.2.1 Functional Structure of the GSM System In GSM specification 1.02 the GSM system is divided into the following sub- systems [20]: • Radio subsystem (RSS) • Network and switching subsystem (NSS) and • Operation subsystem (OSS) These subsystems and their components are represented in the simplified version of the functional architecture in Figure 3.1. 126 3 GSM System 3.2.1.1 Radio Subsystem The radio subsystem is made up of the mobile stations (MS) and the Base station subsystem (BSS). Mobile station The term mobile radio station (MS) refers to all the physical equipment of a PLMN user. It includes the mobile terminal and the user interface that the subscriber needs in order to access PLMN services. A GSM mobile station consists of two parts. The first part contains all the hardware and software components relating to the radio interface; the second part, known as the subscriber identity module (SIM), stores all the subscriber’s personal data. The SIM is either installed into the terminal or provided as a smart card, which is about the size of a credit card and has the function of a key. Once it has been removed from a device, it can only be used for emergency calls, if the network so allows. A mobile subscriber can use the SIM to identify himself over any mobile station in the network, and accordingly a mobile phone can be personalized using the SIM. In addition, each mobile station has its mobile equipment identity (EI). The following numbers and identities are assigned for the administration of each mobile station within a GSM network; see Figure 3.57: • International Mobile Subscriber Identity (IMSI) • Temporary Mobile Subscriber Identity (TMSI) • Mobile Station International ISDN Number (MSISDN) • Mobile Station Roaming Number (MSRN) Mobile stations can be installed in automobiles or provided as port- able/hand-portable devices and, according to GSM Rec. 2.06, are divided into five different classes depending on the allowable transmitter power; see Table 3.4. These classifications also characterize different types of devices: mounted, portable and hand-portable devices. Equipment for the GSM-900 class 1 (8– 20 W) has not yet been developed. Instead, portable and mounted equipment is typically found in class 2 (5–8 W). Hand-portable equipment mostly con- forms with class 4 (0.8–2 W). Class 5 (up to 0.8 W) is also being planned for hand-portable equipment, but places a considerable strain on cellular radio signal supply. This is one of the reasons why it is more suitable for urban environments with small cells, but it is hardly being used anywhere yet. An MS can have facilities for both voice as well as data transmission. In addition to the network-dependent radio and protocol functions that enable access to operation in the network, a mobile station outwardly has at least one other interface to the mobile subscriber (see Section 3.2.2). It is intended either for a human user (man–machine interface) or for coupling the terminal adapter of another terminal, such as a computer or a fax machine or 3.2 The Architecture of the GSM System 127 Table 3.4: Power classes of mobile stations according to GSM or DCS 1800 GSM 900 DCS 1800 Class Max. transmit. Type of device Max. transmit. Type of device power [W] power [W] 1 20 Mounted 1 Hand-portable and portable 2 8 Portable and 0.25 Hand-portable mounted 3 5 Hand-portable − – 4 2 Hand-portable − – 5 0.8 Hand-portable − – a combination of the two. The GSM specifications leave the conversion and extent of the interface technique up to the manufacturer. A user interface usually consists of the following components: • microphone • speaker • LCD display field • alphanumeric keyboard • so-called soft keys Soft keys are function keys used to switch a terminal to different operating states. They are not assigned a specific function, as is the case with hard keys, e.g., on a drinks dispenser. Consequently the user must be informed of the respective function before using the keys. Soft keys are extremely useful with hand-held mobile phones. The sub- scriber can use his mobile device with one hand because of the soft key menu functions that are displayed on the mobile, without having to press key combi- nations at the same time, as is required with the hard key version of a control panel. Unlike the conventional telephone, where the user is identified through the fixed network connection, radio connections form an anonymous network. Therefore subscriber identification is a prerequisite in a mobile radio network alone for operational reasons. The stored subscriber-related data in a SIM module identifies the subscriber when he checks in, and his location area is derived from the serving base station—an automatic procedure when the terminal is used. In older devices the SIM is installed into the equipment, but the new ap- proach is to plug it in as a card; there are two versions of this: • smart card, also called standard SIM card • plug-in SIM card 128 3 GSM System The only difference between the two cards is their size. The standard SIM card is the size of a credit card based on standard ISO 7816, whereas the plug- in module is smaller in size and based on the GSM Rec. 02.17 [6]. In addition to their size, the cards are also used differently. Whereas the standard SIM card can be activitated simply by being inserted into the card slot provided in the mobile telephone, the smaller module slides into the equipment mounted on a cut-down card, which involves first removing the battery. The smaller plug-in SIM card has been successful with hand-held mobile telephones. The subscriber-related data is stored in the non-volatile memory of the SIM. It can be changed statistically as well as temporarily. The permanent data includes the following elements [6]: • SIM card type • IC card identification: serial number of the SIM; identifies card holder at the same time • SIM service table: list of additional services subscribed • IMSI (International mobile subscriber identity) • PIN (Personal identity number) • PUK (PIN unblocking key) • Authentification key K i Before a SIM card is assigned to a subscriber, it is first initialized with this data, and only then can the subscriber use the card to check into the network. On the other hand, the dynamic data, which is permanently updated when the terminal is switched on, accelerates the checking-in process because relevant information is already stored centrally and there is no need for it to be requested from the network. This includes the following data items [6]: • Location information: consists of a TMSI, a LAI, a periodically changed location updating timer, and update status • Ciphering key K c for encoding, and its sequence number • BCCH information: list of carrier frequencies for cell selection during handover and call setup • List of blocked PLMNs • HPLMN search: period of time in which an MS roams the home network before it tries to check into another network 3.2 The Architecture of the GSM System 129 Other optional data items can be found in [6]. All SIM data is copied in the memory of the MS only for the duration of the active operating state and then deleted. Manufacturers of mobile terminals have the option of additionally providing intermediate storage of less important data, such as short messages and the last-called telephone number. However, this data can only be called up if the equipment is turned on again with the same SIM card that was used for its previous deactivation [6]. PIN Except for emergency calls, mobile equipment can only be operated if the SIM card has first been activated. This is done by the subscriber punching in a PIN code, which can be between four and eight digits long, after switching on the equipment. When the SIM card is provided by the service provider, the PIN is generally preset with a four-digit number, which the subscriber can change as often as he likes. After the PIN has been correctly entered, the network responds and the mobile is automatically checked in. A PIN can be but should not be disabled, because the subscriber will run the risk of potential thieves using the mobile free of charge until use of the card is suspended. Anyone who steals an activated mobile phone can only use the SIM card fraudulently until the first time the equipment is switched off or the battery runs out. If an incorrect PIN is inserted three times in a row, the card will be suspended. The subscriber then needs an unlocking key PUK. Some cards are available with a second PIN to protect some of the numbers stored in the card. This specifically protects personal telephone numbers and names entered on the card from unauthorized access. The security mecha- nisms and maximum allowable code length of the PIN2 are identical to those of the PIN [6]. PUK A blocked SIM card can only be released through the use of an PIN unblocking key PUK. The subscriber is allowed 10 attempts in which to enter the correct PUK code or else the card will be blocked permanently and can only be unblocked by the service provider. The PUK is an eight-digit permanent number that is divulged to the subscriber when he receives the card [6]. 3.2.1.2 Base Station Subsystem (BSS) The BSS comprises all the radio-related functions of the GSM network. Depending on the radio transmitting and receiving capabilities of the base transceiver system, which because of limited transmitter power only supplies coverage to a specific geographical area within the network, radio cells are cre- ated in which the mobile subscriber is free to roam or communicate. The size of the individual cells depends on a number of parameters, including char- acteristics of radio wave propagation, local morphology, and expected user density in the region. 130 3 GSM System A BSS uses transceivers and the following hardware and software to enable it to connect a mobile subscriber to a number in the public telephone network (PSTN) and allow it to communicate: • signalling protocols for connection control • speech codecs (coders/decoders) as well as data-rate adaptation (trans- coder/rate adapter unit, TRAU) for access to the network • digital signal transmission for coded data. These functions already give an indication of some of the other important tasks of the BSS. Various interfaces have been specified between the BSS and GSM network elements and other networks for the exchange of information between subscribers and the GSM network or other networks; see Figure 3.1. The interface to the mobile subscriber is called the U m -interface. It contains specific parameters for digital radio transmission, such as GMSK modulation, data rate, status of carrier frequencies in the 900 MHz band and channel grid. The BSS is connected to the GSM fixed network over the A-interface (familiar from ISDN) with MSCs, the NSS switching centres that provide the subscriber connectivity to each other and to the external network. The A-interface like- wise contains specific digital transmission parameters, including PCM (pulse code modulation), a 64 kbit/s data rate and a 4 kHz voice bandwidth. Network availability and quality is established by the network operations and maintenance centre (OMC) of the GSM operator over an O-interface, which provides direct access to BSS units. The elements making up the BSS include: • Base transceiver station (BTS) • Base station controller (BSC) BTS The BTS comprises the transmitting and receiving facilities, including antennas and all the signalling related to the radio interface. Depending on the type of antenna used, the BTS supplies one or several cells, so, for example, sectorized antennas can supply three cells arranged at 120 ◦ to each other (see Chapter 2.4). In a standardized GSM structure the transcoding and rate adaptation unit TRAU is part of the BTS. It contains GSM-specific speech coding and decod- ing as well as rate adaptation for data transmission. BSC The BSC is responsible for the management of the radio interface through the BTS, namely for the reservation and the release of radio channels as well as handover management. Its other tasks include paging and trans- mitting connection-related signalling data adapted to the A-interface from/to the MSC. A BSC generally manages several BTSs, and is linked to the NSS via an MSC. [...]... successful in analogue mobile radio networks, in which a geographical area is divided into planned radio cells (in the simplest case hexagons), with one BTS per cell with which the mobile stations can make contact The radio cells, each having the exclusive use of specic FDM channels, are combined into groups (clusters) The same frequencies are only reused after a suciently long distance in neighbouring... switching centre (MSC) The gross transmission rate over the radio interface is 270.833 kbit/s 3.3.1 Multiplex Structure Along with voice coding and modulation, multiplexing is also very important In the GSM recommendations a combination of frequency-division multiplexing (FDM) and time-division multiplexing (TDM) has been standardized, providing multiple access by mobile stations to these systems (FDMA,... information are exchanged between mobile users during a connection Speech and data are digitally transmitted on these channels using dierent coding methods Dierent transmission capacities are required depending on the type of service used (e.g., voice transmission, short-message service, data transfer, facsimile) A distinction is therefore made between the following trac channels: Bm -channel Transmission... channel (CCCH) Dedicated control channel (DCCH) Table 3.6 contains a list of all the control channels dened in the GSM recommendations, and in the directional column indicates the directions possible on each channel (uplink, downlink or both) Broadcast Control Channel (BCCH) This channel is used to transmit information about the PLMN from the base station to the mobile stations in the radio cell through... maximum length n 1 applied to the interleaved bit stream on the radio medium is resolved into single bit errors after de-interleaving The block interleaving procedure further contributes to spread originally neighbouring bits during the radio transmission to improve the resistance against the so-called error bursts resulting from signal fading Figure 3.26 (b) shows the error protection mechanisms for... allocated to a cell and morphological conditions Thus cells in rural areas can have a radius of up to 35 km Larger cell radii would cause a higher round-trip propagation delay; the maximum delay is 0.233 ms, much larger than specied in the standard In metropolitan areas the radius might only be at 300 m, which allows a trac volume of up to 200 Erl./km2 Cells are divided into sectors in order to increase... not be available until 2001 After current use is discontinued, an additional 10 MHz between 880 and 890 MHz and between 925 and 935 MHz will be available as a GSM extension band (see Appendix C) A duplex interval of 45 MHz exists between the transmit and receive frequencies The frequency bands are divided into 200 kHz bandwidth channels, therefore providing a total of 124 FDM channels each for transmitting... of valid mobile radio stations; the black list contains all the IMEIs of stolen or suspended mobile radio stations The grey list includes a list of IMEIs for malfunctioning equipment that is not receiving any services 3.2.2 Interfaces of the GSM System 3.2.2.1 User Interface of the Mobile Station A GSM mobile station consists of the terminal equipment (TE) to which the subscriber has direct access,... switching centre (MSC) The MSC is a high-performance digital switching centre that carries out normal switching tasks and manages the network Each MSC is usually allocated several base station controllers, and in the geographical area assigned to it carries out the switching between mobile radio users and other PLMNs and also forms the link between the mobile radio network and the wireline networks (PSTN,... required to protect a subscribers identity, and his mobile communication against eavesdropping, and his right to use the radio interface Because the radio interface is generally susceptible to unauthorized access, special measures (e.g., authentication key assigned to each subscriber and coding of transmitted information) were undertaken in order to prevent the fraudulent use of GSMPLMN connections Authentication . following features distinquish GSM from other European mobile radio systems: • Europe-wide coverage • Europe-wide standardization • digital radio transmission. 3.2.1.1 Radio Subsystem The radio subsystem is made up of the mobile stations (MS) and the Base station subsystem (BSS). Mobile station The term mobile radio