Mobile Networks Overview

2G/3G/4G/5G with Focus on Core Network

Hamidreza Bolhasani
Ph.D., AI/Data Scientist
hamidreza@bolhasani.net
Dec 2020.
Table of Contents
- Self Introduction
- Mobile Networks History
- GSM Overview and concepts
- 2G/3G Network Elements and Protocols
- Basic CS Scenarios Overview
- PS / GPRS / EDGE Introduction
- 4G/LTE Network Architecture and services
- PS / EPC Scenarios Review
- Introduction to 5G and its Services
- Conclusion - Q & A
Self Introduction
Mobile Networks History
Mobile Networks History
Global System for Mobiles (GSM)
◼ Cellular Network or Mobile Network is a communication network where the last link is
wireless. The network is distributed over land areas called cells, each served by at least
one fixed-location transceiver, known as a cell or base station.
2G / 3G Overview

MSC/VLR PSTN
GSM /GPRS BSS GMSC ISDN

BSC
BTS HLR/AUC

PCU SCE
IPBB
RNC
SMS
NodeB SCP
GPRS Internet,
Intranet
UTRAN SGSN GGSN

CG BG

Other PLMN
2G Radio

◼ BTS (Base Station Transceiver)

BTS is a piece of equipment that facilitates wireless communication

between user equipment (UE) and a network. UEs are devices like
mobile phones (handsets), WLL phones, computers with wireless
Internet connectivity.

◼ BSC (Base Station Controller)

BSC is a critical mobile network component that controls one or

more base transceiver stations (BTS), also known as base stations or
cell sites. Key BSC functions include radio network management
(such as radio frequency control), BTS handover management and
call setup. It also carries transcoding of speech channels.
GSM Frequency Bands
ISM Bands
3G Radio

◼ NodeB
NodeB is a term used in UMTS equivalent to the BTS
(base transceiver station) description used in GSM.

◼ RNC (Radio Network Controller)

RNC is a governing element in the UMTS radio access
network (UTRAN) and is responsible for controlling the
NodeBs that are connected to it. The RNC carries out
radio resource management, some of the mobility
management functions and is the point where encryption
is done before user data is sent to and from the mobile.
Terminologies - IMSI

IMSI (International Mobile Subscriber Identity)

NMSI

MCC MNC MSIN

3 digits 2/3 digits

Not more than 15 digits

MCC：Mobile Country Code

MNC：Mobile Network Code
MSIN：Mobile Station Identification Number
NMSI：National Mobile Station Identity
IMSI

 IMSI: International Mobile Subscriber Identity

 IMSI is a unique identifier allocated to each mobile subscriber

 Its code type is E.212

 IMSI can be saved in SIM, HLR and VLR and can be transferred through MAP and Wireless interface.

 IMSI has almost 15 digits (0-9) such as 43211xxxxxxxxxx

TMSI
 TMSI: Temporary Mobile Subscriber Identity

 In order to ensure subscriber identity confidentiality, the VLR (Visiting Location Register) and SGSN

(Serving GPRS Support Node) may allocate TMSI to visiting mobile subscribers.
IMEI
IMEI (International Mobile Equipment Identity)

TAC FAC SNR spare

6 digits 2 digits 6 digits 1 digits

15 digits

TAC：Type Approval Code

FAC：Final Assembly Code
SNR：Serial Number
spare：Standby bit
Example:490547403767335
MSISDN

CC NDC SN

National ( Significant ) Mobile Number

MSISDN：Mobile Station International ISDN number

CC： Country Code, China Country Code is 86

NDC：National Destination Code
SN： Subscriber Number
LAI / GCI / SAI

MCC MNC LAC

Location Area Identity

MCC MNC LAC CI

Cell Global Identity

MCC MNC LAC SAC

Service Area Identity
TAI / TAC

MCC MNC TAC

Tracking Area Identity
2G / 3G Core Network (CN)

◼ Core Network is split into CS domain and PS domain. CS domain is based

on original GSM network. PS domain is based on original GPRS network.

◼ CS domain: used to provide Circuit-switched service. Network mode can

support TDM, ATM and IP. Physical entities include switching equipment
(such as MSC/VLR, GMSCs, HSS), and inter-working equipment (IWF).

◼ PS domain: used to provide Packet-switched service. Network mode is IP.

Physical entities include SGSN, GGSN, CG , BG etc.
2G / 3G Core Network (CN)

◼ Function entity shared by CS domain and PS :

 MSC Server: Control layer, to realize MM
(Mobility Management), CM (Call Control),
MGC (Media Gateway Control).
 MGW: Bearer layer, to realize the exchange of
voice and media flow, and provide all kinds
sources, such as TC, EC, play announcement
and receive DTMF.
 SG: To realize signaling transfer from MTP (SS7
transmission layer) to SCTP/IP (SIGTRAN).
2G / 3G Core Network (CN)
 HLR/HSS: To realize mobile subscriber
management and location information
management.
 VLR: To deal with all kinds of data
information of current mobile
subscriber.
 AUC: To store authentication
information of mobile subscriber.
 EIR: To store IMEI data of mobile
subscriber.
 SMS: Short Message Center.
Scenario #1 Location Update
Um BSSAP MAP MAP
MS BSS MSC VLR HLR/AUC
A B D
Locating updating
Locating updating request
request(IMSI) Update location area
imsi/tmsi,old lai,current Send parameters(IMSI)
lai/gci (IMSI)
Authentication parameters
Authenticate (RAND/SRES/Kc,IMSI)
Authentication request

Authentication response Authentication response PVLR

Update location

cancel location
Inserte subscriber data cancel location
ack.
Subscriber data insertion ack.

Update location ack.

Set cyphering mode
(HLR?)
Forward new TMSI
CYPHER MODE COMMAND Update location area ack.
CYPHER MODE COMPLETE
Location updating accepte
TMSI reallocation complete TMSI acknowledge
CLEAR COMMAND
CLEAR COMPLETE
Scenario #1 Location Update / Authentication

AUC HLR MSC/VLR MS SIM Card

Store the authentication

Store authentication key
key Ki of all subscribers
Ki, algorithms A3 and A8
in HLR

Generate Temporarily store Store the

authentication Ki
authentication triplet authentication
according to A3 and triplet, and deliver triplets of all
A8 algorithms the authentication accessed
triplet to VLR upon subscribers
VLR’s request Access request
RAN/Kc/SRESAUC
RAND

Algorithm Algorithm
A3 A8

SRESAUC =？ SRESMS
SRESMS Kc
Unequal: Equal:
authentication authentication
fail succeeds
Scenario #1 Location Update / Authentication

mobile network SIM

RAND
Ki RAND RAND Ki

AC 128 bit 128 bit 128 bit 128 bit

A3 A3
SIM
SRES* 32 bit SRES 32 bit

SRES
MSC SRES* =? SRES SRES
32 bit

Ki: individual subscriber authentication key SRES: signed response

Scenario #2 Call Flow (1/2)
Um A B D
MSa BSSa MSC VLR HLR
A Um MSb
RACH channel request BSSb

SDCCH CM service request CM service req.)

(CKSN,IMSI/TMSI) CM service req.) Send parameters
(IMSI/TMSI)
Authentication para.
Authentication request(RAND,CKSNn) Authenticate (IMSI,RAND/SRES/Kc)
(RAND,CKSNn)
Authen. res.(SRES)
Authentication response(SRES)
Set cyphering mode
Access req. accepted
CM service accept
(IMSI/MSISDN)
CIPHER MODE COMMAND(Kc)
CIPHER MODE COMPLETE

Setup ( MSISDN) Send info. for o/g call setup

Call proceeding Complete Call

ASSIGNMENT REQUEST
ASSIGNMENT COMPLETE
Send routing info req. (MSISDN, supplyment service info )
Provide roaming number req(IMSI)
Provide roaming number Ind
Send Routing infomation acknowledge
send info.for i/c call setup
page MS(LAI)
PAGING(LAI,IMSI)

Page response(LAI,GCI) Page response

Scenario #2 Call Flow (2/2)
Um A B D
MSa BSSa MSC VLR HLR
A Um MSb
BSSb
Process access req.
Send para.
(IMSI/TMSI)
Authen. para.
Authenticate
(IMSI,RAND/SRES/Kc)
(RAND,CKSNn)
Authentication request(RAND,CKSNn)

Authentication(SRES)
Authentication response(SRES)
Set cyphering mode
Access request accepted
Complete call
CIPHER MODE COMMAND(Kc)
CIPHER MODE COMPLETE
Setup （calling MSISDN）
Call confirmed
ASSIGNMENT REQUEST
ASSIGNMENT COMPLETE
Alerting
Alerting
Connect
Connect
Connect acknowledge
Connect acknowledge
Scenario #2 Call Flow / Real (1/5)
Scenario #2 Call Flow / Real (2/5)
Scenario #2 Call Flow / Real (3/5)
Scenario #2 Call Flow / Real (4/5)
Scenario #2 Call Flow / Real (5/5)
Scenario #3 SMS MO
GPRS Network Structure

⚫ What is GPRS?

 General Packet Radio Service

⚫ Why GPRS?

 In order to provide the data service out the scope of the fixed network

⚫ GPRS network classification

 GSM GPRS
 UMTS GPRS

⚫ GPRS network background

 GSM GPRS network reuse the existed GSM network
 UMTS GPRS network just change the RAN side
GPRS Network Structure
MSC/VLR SMS-GMSC SCP GMLC HLR EIR
SMS-IWMSC

SS7
Gs Gd Ge Lg Gr Gf Gc

BSS FR SGSN Gn
GGSN PDN TE
ATM Gi
Um Gb GPRS
DDN
Gn Backbone
ISDN Ga
Ethernet.etc

UTRAN SGSN CG
ATM Ga
Um Iu
BG
Gp
GPRS Network Structure

⚫ Some Abbreviation

 GPRS: General Packet Radio Service

 BSS: Base Station Subsystem

 UTRAN: UMTS Terrestrial Radio Access Network

 SGSN: Service GPRS Support Node

 GGSN: Gateway GPRS Support Node

 CG: Charging Gateway

 BG: Bordering Gateway

 PDN: Packet Data Network

GPRS Network Structure

⚫ Important Entity Function __ SGSN

 Mobility management
− The mobility management functions are used to keep track of the
current location of an MS within the PLMN or within another PLMN.
 Session management
− Session Management (SM) function manages the PDP context of
MS.
 Routing and transfer
− SGSN performs routing and forwarding of service data between
MS and GGSN.
 Charging
− SGSN can generate, store, convert and send CDRs.
 Lawful Interception
 NTP
GPRS Network Structure

⚫ Important Entity Function __ GGSN

 Session management
− Session Management (SM) function manages the PDP
context of MS.
 Routing and transfer
− GGSN performs routing and forwarding of service data
between MS and internet.
 Charging
− GGSN can generate, store, convert and send CDRs.
 Dynamic IP allocation
 Service management
− Manage APN
GPRS Network Structure

⚫ Important Entity Function __ CG

 Real-time collection of GPRS bills

 Temporary storage and buffering of GPRS bills

 Pre-processing of GPRS bills

 Sending GPRS bills to the billing center

GPRS Network Structure
⚫ Important Entity Function | DNS
SGSN GGSN(A)

ISP A
GPRS backbone
ISP B

BSS

DNS Internet/
GGSN(B) Intranet

MS
 Resolve the APN to a GGSN IP in the PDP active procedure
 Resolve the RAI to a SGSN IP in the inter-SGSN RAU procedure
 Resolve the RNCID to a SGSN IP in the relocation procedure (UMTS)
Attach Procedure
Reject Causes by GPRS Network

Cause in attach reject Actions in PS domain Actions in CS domain

Illegal MS The MS shall set the GPRS update status to If the MS is IMSI attached, the MS
GU3 ROAMING NOT ALLOWED The shall in addition set the update
Illegal ME
SIM/USIM shall be considered as invalid for status to U3 ROAMING NOT
GPRS services until switching off or the ALLOWED, shall delete any TMSI,
SIM/USIM is removed LAI and ciphering key sequence
number

GPRS services not allowed The MS shall set the GPRS update status to no effect
GU3 ROAMING NOT ALLOWED; The
SIM/USIM shall be considered as invalid for
GPRS services until switching off or the
SIM/USIM is removed.

GPRS services not allowed in this shall set the GPRS update status to GU3
PLMN ROAMING NOT ALLOWED

PLMN not allowed shall set the GPRS update status to GU3 The MS shall perform a PLMN
ROAMING NOT ALLOWED), shall reset the selection
Location area not allowed
GPRS attach attempt counter and shall
Roaming not allowed in this location change to state GMM-DEREGISTERED
area

No Suitable Cells In Location Area shall set the GPRS update status to GU3 The MS shall search for a suitable
ROAMING NOT ALLOWED cell in another location area in the
same PLMN
Detach Procedure
MS BSS/UTRAN SGSN GGSN

1. Detach Request

2. Delete PDP Context Request

2. Delete PDP Context Response

3. Detach Accept

4. PS Signalling Connection Release

Detach type

bit4 bit3 bit2 bit1

power off detach tye

4G/LTE
4G/LTE
4G/LTE Attach
4G/LTE Detach
History of IMS

⚫ The IMS is introduced as part of 3GPP specifications at the R5

stage, act as a subsystem of the PS domain.
3GPP R7
- IMS
3GPP R6
enhance
- IMS QoS,
3GPP R5 Billing, FMC,
3GPP R4 - CN: IMS
etc
- CN: MSC introduced
3GPP R99 server and
-CN: TDM MGW

TISPAN R2
-- NASS/RACS,
TISPAN R1 etc
-- NGN/FMC, etc

2000/03 2001/03 2002/03 2005/12 2006/X

IMS Motivations

Legacy Core Network Arch. Converged Multi-service Arch.

⚫ Vertical network, overlap in ⚫ Horizontal network, converge fixed,
hardware, service and database mobile and data service network
⚫ Separated user and service ⚫ Unified database and service

⚫ Difficult to decrease OPEX/CAPEX ⚫ Access independent

Mobile Fixed Multiple Application

Internet
Network Network
Unified Database/Charging
Database Database Database

Charging Charging Charging

IMS Core
(Unified session control)
Service Service Service

Control Control Control

IP Bearer

Bearer Bearer Bearer Multiple Access

Overlapping Cost
Convergent
IMS Network Architecture
3rd Party Application
SCP Applications
Gaming Conference

Service
OSS
IM-SSF OSA Presence PTT IM Group capability

HSS
OMS S-CSCF I-CSCF
BGCF Session
control
CCF
MRFC P-CSCF AGCF MGCF

A-RACF NACF CLF

MRFP
PCRF
SPDF Bearer Control Layer Bearer
GGSN AC
Control and
Bearer Core Network Access
SIP H.248 H.248
SIP
AG MGW
AP
SGSN
SIP IAD
SIP Terminals
2G/3G RAN WiFi access
xDSL/LAN access PSTN/PLMN
IMS Network Entities
Function NE Function NE
P－CSCF MGCF
Network
Call control I－CSCF IM－MGW
interworking
S－CSCF BGCF

User HSS MRFC

Media
management
resource
SLF MRFP

PLMN/PSTN

S-CSCF BGCF MGCF

PLMN/PSTN
S-CSCF BGCF1 BGCF 2 MGCF
IMS Call Procedure (Simple Model)

Callee part
Caller part
S-CSCF I-CSCF S-CSCF

P-CSCF DNS/ENUM HSS P-CSCF

Media

signaling media
5G – Primitives
5G – Near Future
2G → 5G Roadmap
Towards → 5G
2G → 5G Roadmap
5G Motivations
5G I MT-2020
5G – Primitives
5G – Network Architecture
NFV-Network Function Virtualization
5G-CRAN Cloud RAN
5G – Interoperable Network
5GC – Interoperable Network
5GNR – New Radio
5GNR – New Radio
5G Spectrum – mmWave
5G Spectrum – mmWave
5G Spectrum – mmWave
5G Network Slicing
5G Network Slicing
5G Network Slicing
5G Network Slicing
5G & AR / VR
5G & AR / VR
5G & Artificial Intelligence (AI)
5G & Artificial Intelligence (AI)
5G & V2X / Connected Cars
5G & Health
5G & Health
5G & Health
5G & Health
MVNOs role in 5G Market
MVNOs role in 5G Market
MVNOs role in 5G Market
MVNOs role in 5G Market
Thanks!
Hamid Reza Bolhasani
Hamidreza@Bolhasani.net
Dec 2020