GSM System

Overview
Unit -3
Introduction
 Global system for mobile communication is a digital wireless standard design by
European telecommunications.
 Basic requirements of GSM are :
 Services: system will provide services to all mobile stations(MSs) or mobile phones.
 Quality of services and security : the system will provide better quality of voice
telephony and it also provide information encryption without affecting the costs.
 Radio frequency utilization: system will permit a high level of spectrum efficiency.
 Network : An international standardized signaling system will be used for switching
and mobility management.
 Cost: The system parameters will be chosen with a view to limiting the cost of the
complete system.
GSM Architecture
 In the architecture, a mobile
station(MS) communicates with a
base station system(BSS) through
the radio interface.
 The BSS is connected to the
network and switching
subsystem(NSS) by communicating
with a mobile switching center
(MSC) using the A interface.
Mobile station(MS)
 The MS consists of 2 parts : Subscriber identity module(SIM) and Mobile equipment(ME).
 It also consists of 3rd part called terminal equipment(TE),which can be a PDA or PC connected
to the ME.ME and SIM together is called Mobile terminal(MT).
 The SIM is protected by a personal identity number (PIN) which is of four to eight digits in
length. The PIN is initially loaded by the network operator at the subscription time. this PIN
can be deactivated or changed by user.
 To use the MS, the user is asked to enter the PIN. If the number is not entered correctly for
consecutive 3 times the SIM will be blocked. To unlock the SIM user is asked to enter eight
digit PIN unblocking key(PUK).
 SIM contains the subscriber-related information like list of abbreviated and customized
numbers, short messages received etc., it also include the PIN and PUK codes.
 SIM information can be modified by the subscriber using MS or a personal computer using
RS232 connection
Contd..
 Subscriber related data are sent to the ME during operation, which are deleted after the
removal of the SIM or deactivation of the MS.
 The SIM can be updated over the air using SIM toolkit, with which network operations can be
remotely upgraded an MS by sending codes through short messages. These messages are
issued form a SimCard server and are received by MSs equipped with SIM-toolkit capability.
 SIM Toolkit provides security-releated functions so that SIM cards are not falsely modified.
 ME contains noncustomer-related hardware and software specific to the radio interface. When
SIM is removed from an MS,the remaining ME cannot be used for reaching the services.
 For every new connection between MS(SIM) and the network, the characteristic indication of
ME, called classmark,is given to the network .
 This SIM-ME design supports both portability and for enhancing security.
Base station system
 The BSS connects the MS and the NSS. It consists of two parts: the base transceiver station (BTS) and the
base station controller (BSC).
 The BTS contains transmitter, receiver, and signalling equipment specific to the radio interface in order to
contact the MSs. An important part of the BTS is the transcoder/rate adapter unit (TRAU) that carries out
GSM-specific speech encoding/decoding and rate adaption in data transmission.
 The BSC is responsible for the switching functions in the BSS, and is in turn connected to an MSC in the NSS.
The BSC supports radio channel allocation/release and handoff management.
 A BSC may connect to several BTSs and maintain cell configuration data of these BTSs. The BSC
communicates with the BTSs using ISDN protocols via the A-bis interface.
 In GSM BSS design, a BSC only connect to one BTS. In this scenario, the BSC and the BTS may be integrated
without the A-bis interface.
 Capacity planning for BSC is very important. In busy hours, the processor load of a BSC is roughly distributed
in call activities(20-25%), paging and short message service(10-15%), mobility management(20-25%), and
hardware checking/network-triggered events(15-20%). A BSC is typically engineered at 80 utilization.
 When a BSC is overloaded, it first rejects location update, then MS originating calls, and then handoffs.
Network and switching system(NSS)
 The NSS supports the switching functions, subscriber profiles, and mobility management. The basic
switching function in the NSS is performed by the MSC.
 MSC also communicates with other network elements external to GSM utilizing the signalling
protocol. The current location of an MS is usually maintained by the HLR and VLR.
 When an MS moves from the home system to a visited system, its location is registered at the VLR of
the visited system. The VLR then informs the MS's HLR of its current location.
 The authentication centre(AuC) is used in the security data management for the authentication of
subscribers. The AuC may be co-located with the HLR.
 An incoming call is routed to an MSC, unless the fixed network is able to interrogate the HLR directly.
That MSC is called the gateway MSC(GMSC).
 An MSC can function as a GMSC by including appropriate software and HLR interrogation
information, and by provisioning interface and the signalling link to the HLR.
 The GMSC obtains the location information and routes the calls to the visited MSC of the subscribers
to receive the calls.
Radio Interface
 The GSM radio link uses both FDMA and TDMA technologies.
 The frequency bands for the GSM downlink signal and the uplink signal are 935-960MHz
and 890-915MHz, respectively. The frequency band is divided into 124 pairs of frequency
duplex channels with 200KHz carrier spacing.
 For a given distance, less power is required to transmit signal over a lower frequency. To
save MS power, uplink frequencies in mobile systems are always the lower band of
frequencies.
 Discontinuous transmission is used in GSM to save the power consumption of the MS.
With this function, an MS turns the transmitter ON only while voice is present. When there
is no voice input, the transmitter is turned OFF.
 GSM also supports discontinuous reception where the MS only needs to listen to its sub-
channel for paging.
Contd..
 The length of a GSM frame in a frequency channel is 4.615 msec. The frame is
divided into 8 bursts time slots of length 0.577 msec.
 The time slots in the uplink are derived from the downlink by a delay of three time
slots. This arrangement prevents an MS from transmitting and receiving at the same
time.
 Due to propagation delays, when the MS is far away from the BTS, the three-time-
slot delay cannot be accurately maintained. The solution is to compute the timing
advance value so that the exact shift between downlink and uplink seen by the MS is
three time slots minus the timing advance value.
 This timing advance value is calculated by the BSS based on the bursts received from
the MS and is signalled to the MS twice per second to inform the MS of the
appropriate timing value. 
Contd..
  The GSM burst structure is illustrated in Figure. Every burst contains 148 bits 0.546 msec
followed by 0.031 msec guard time 8.25 bits.
 The burst begins with 3 head bits and ends with 3 tail bits, all of which are logical zeros.
Two groups of data bits are separated by an equalizer training sequence of 26 bits.
 Each data group consists of 57 information bits and one flag that indicates whether the
information bits are for user speech/data or signalling.
Depending on the information carried by a time slot, i.e., the information bits in Figure, two
types of logical channels are defined: traffic channels (TCHs) and the control channels (CCHs).

TCHs are intended to carry user information speech or data. Two kinds of TCHs are defined:
Full rate TCH(TCH/F) provides transmission speed of 13 Kbps for speech or 9.6, 4.8
or 2.4 Kbps for data. Enhanced Full Rate(EFR) speech coders have been implemented
to improve the speech quality of a TCH/F.
Half -rate TCH(TCH/H) allows transmission of 5.6 Kbps speech or 4.8 or 2.4 Kbps
data.
The CCHs are intended to carry signalling information. Three types of CCHs are defined in
GSM:
Common control channels(CCCHs) include the following channel types:
Paging channel(PCH) is used by the network to page the destination MS in call
termination.
Access grant channel(AGCH) is used by the network to indicate radio link
allocation upon prime access of an MS.
The random access channel(RACH) is used by the MSs for initial access to the
network.
PCH and AGCH are delivered from the BSS to the MSs by the downlink. RACH utilizes the
uplink.
Dedicated control channels are supported in GSM for dedicated use by a specific MS.
standalone dedicated control channel(SDCCH) is used only for signalling and for
short messages.
Slow associated control channel(SACCH) is associated with either a TCH or an
SDCCH. The SACCH is used for non-urgent procedures, mainly the transmission
of power and time alignment control information over the downlink and
measurement re- ports from the MS over the uplink. A TCH is always allocated
with a control channel SACCH to transport both user information and signalling
data in parallel.
The fast associated control channel (FACCH) is used for time critical signalling
such as call establishing progress, authentication of subscriber, or handoff . The
FACCH makes use of the TCH during a call. Thus, there is a loss of user data
because the FACCH steals the bandwidth of the TCH.
Cell broadcast channel(CBCH) only carries the short message service cell
broadcast messages, which uses the same time slot as the SDCCH.  
The CBCH is used in downlink only. SDCCH, SACCH and FACCH are used in both
downlink and uplink.

Broadcast channels(BCHs) is used by the BTS to broadcast information to the MSs in

Frequency correction channel(FCCH) and synchronization channel(SCH) carry

The broadcast control channel(BCCH) provides system information such as

Figure shows the radio aspect of mobile call origination, which describes how the logical
channels are involved in the call setup procedure.
To initiate the call setup, the MS sends a signalling channel request to the network through
RACH.
The BSC informs the MS of the allocated signalling channel SDCCH through AGCH.
Then the MS sends the call origination request via SDCCH. The MSC instructs the BSC to
allocate a TCH for this call. Finally, both the MS and the BTS tune to the TCH.
GSM call termination(radio aspect):

Figure shows the radio aspect of mobile call termination. In this case the MSC requests the BSS
to page the MS.
The BSCs instruct the BTSs in the desired LA to page the MS by using PCH.
When the destination MS receives the paging message, it requests for an SDCCH through
RACH. The BTS assigns the SDCCH through AGCH.
The MS responds the paging through SDCHH.SDCCH is also used to setup the call as in the
call origination case.
Location tracking and call setup
 The current location of an MS is maintained
by a two-level hierarchical strategy with the
HLR and the VLRs. When an MS visits a
new location, it must register in the VLR of
the visited location.
 The HLR must also be informed about this
registration. To access the MS, the HLR is
queried to find the current VLR of the MS.
 The registration process of the MS moving
from VLR to another VLR is shown in
figure.
Following steps are followed:
Step 1. The MS periodically listens to the BCCH broadcast from the BSS. If the MS detects that it
has entered a new location area, it sends a registration message to the new VLR by using the
SDCCH channel.

Step 2. The new VLR communicates with the old VLR to find the HLR of the MS. The new VLR
then performs the authentication process.

Step 3. After the MS is authenticated, the new VLR sends a registration message to the HLR. If
the registration request is accepted, the HLR provides the new VLR all relevant subscriber
information for call handling.

Step 4. The new VLR informs the MS of the successful registration.

Step 5. After Step 3, the HLR sends a deregistration(cancellation) message to the old VLR. The
old VLR cancels the record for the MS and sends an acknowledgement to the HLR for the
cancellation.
When the MS is inactive, due to switching off or SIM removal, it transmits a detach to
deregister from the network.
The MS may also periodically send registration messages to the network.
The period may range from 6 minutes to slightly more than 24 hours.
Periodic registration is useful for fault tolerance purposes .
 If the VLR or HLR fails, periodic registration will speed up the recovery of the databases.
For a GSM mobile call termination or call delivery, the MS ISDN number (MSISDN) of
the subscriber is dialed. MSISDN is part of the ISDN numbering plan defined in ITU-T
Recommendation E.164.
This number points to the subscriber's record in the HLR. The HLR record contains the
information to locate the MSC where the subscriber is currently located. 
The basic call termination procedure is described in the following steps and is shown in Figure:
Step 1. When the MSISDN is dialed, the call is forwarded to the GMSC, a switch that has the
capability to interrogate the HLR for routing information. The HLR requests the current VLR of
the MS to provide the routable address called a mobile station roaming number MSRN. Step 2.
The VLR returns the MSRN to the GMSC through the HLR.
Step 3. The GMSC uses the MSRN to route the call to the MS through the visited MSC.

The MS may be engaged in another communication when a call arrives. If the mobile user has
subscribed to the call waiting service, then the MSC proceeds directly to connect the call to the
MS.
Different communication sessions may be associated with an MS at the same time. These
sessions are distinguished by their transaction identifiers .
 Security
GSM security is addressed in two aspects: Authentication and Encryption. Authentication
avoids fraudulent access of a cloned MS. Encryption avoids unauthorized listening.

A secret key Ki is used to achieve authentication. Ki is stored in the AuC as well as in the SIM.
The Ki value is unknown to the subscriber.

To initiate the authentication process, the home system of the MS generates a 128-bit random
number called RAND . This number is sent to the MS. By exercising an algorithm A3, both the
network AuC and the MS SIM use Ki and RAND to produce a signed result SRES as shown in
Figure.

The SRES generated by the MS is sent to the home system and is compared with the SRES
generated by the AuC. Note that if SRES and RAND generated by the AuC are sent from the HLR
to the visited VLR in advance, then the SRES comparison can be done at the visited VLR. If they
are not identical, then the access request is rejected.
Algorithm A3 is dependent on the GSM service provider. Since the visited system may not
know the A3 algorithm of a roaming MS, authentication result SRES is generated at the home
system of the MS.
 If the MS is accepted for access, an encryption key Kc is produced by an algorithm A8 with
Ki and RAND as inputs shown in Figure .
Like A3, A8 is specific to the home system. After the home system has generated Kc , this
encryption key is sent to the visited system.
Kc and the TDMA frame number encoded in the data bits are used by an algorithm A5 to
cipher and decipher the data stream between the MS and the visited system.
The same A5 algorithm may be used in all systems participating in the GSM service.
 Data Services
GSM Phase 2 standard supports two data service groups: short message services and
bearer services.

To offer bearer service, a circuit-switched connection is established in the GSM network
to connect the MS and an interface of the PSTN. To do so, the wireline circuit and radio
channel resources are reserved even if the data are not transferred.

An alternative is to release the resources when the data are not transferred.

The disadvantage is that the GSM call set-up time is too long and extra signalling traffic
for circuit setup is created.

Since Phase 2 GSM systems do not support fast access to radio resources on demand and
packet- switched transmission, the short message and bearer data services in GSM are
insufficient to support Internet applications such as large volume FTP or World Wide Web in
an e client manner.
To provide e client data capabilities for GSM, new GSM data protocols have been
developed by European Telecommunications Standards Institute ETSI as part of GSM
Phase 2+ standard. These protocols include:

High Speed Circuit Switched Data (HSCSD) for high speed file transfers and
mobile video applications
 General Packet Radio Service(GPRS), for bursty data applications such as email
and WWW.

The data rates are expected to be raised from 9.6 Kb s to 28.8 Kb s or higher. In the
near term, the baseline standard for mobile professionals will probably be 19.2 Kbps.
HSCSD
HSCSD is a circuit-switched protocol for large le transfer and multimedia applications. The
physical layer of HSCSD is the same as that for the Phase 2 GSM data services.

The data rate of HSCSD has been increased by using multiple TDMA time slots up to 8 instead
of one time slot in the current data applications.

The data rate can also be increased by data compression techniques. The HSCSD architecture is
illustrated in Figure.

The data computing session is performed at a terminal equipment(TE),such as a computer

The radio link protocol (RLP) has been enhanced in HSCSD to support multi-link
time slot operation. The protocol may or may not recover the frame errors between
TAF and IWF.

The problem of multiple time slot assignment is that the blocking rate of the system
will be increased, i.e, fewer customers can share the GSM services if more radio
resources are assigned to individual customers.

This problem can be reduced by flexible resource assignment where the service or
the customers specify the maximum capacity and the minimum capacity. Based on the
current available capacity of a BS, a customer will be assigned any rate between the
maximum and the minimum capacities.
Fig : HSCSD architecture
GPRS
GPRS is a packet-switched protocol for applications such as web.

 GSM circuit switching architecture cannot satisfy the packet switching nature of GPRS. Thus,
GPRS requires its own transport network.

 GPRS introduces two new entities : i) Serving GPRS support node (SGSN) and ii) Gateway
GPRS support node (GGSN).

 SGSN receives and transmits packets between the MSs and their counterparts in the public
switched data network PSDN.

GGSN interworks with the PSDN using connectionless network protocols.

SGSN and GGSN interact with the GSM location databases, including the HLR and the VLRs,
to track the location of the MSs. The GPRS data units are routed to the destination MSs based on
location information.
Both SGSN and GGSN may be equipped with cache memories containing location information
to speed up the routing procedure.

GPRS air interface requires a new radio link protocol to guarantee fast call setup procedure and
low bit error rate for data transfer between the MSs and the BSs. Furthermore, GPRS needs to
implement a packet radio media access control MAC for packet switching

HSCSD and GPRS implementation Cost :

GPRS typically supports up to 100 users with 1-8 channels, while HSCSD typically supports
fewer users where a user may utilize 2-8 channels.

GPRS supports broadcast and multi-sessions, while HSCSD supports point-to-point sessions.

GPRS requires to invest on new infrastructure. On the other hand, HSCSD needs to address
handoff issues.
Fig : GPRS architecture
Unstructured Supplementary Service Data 
To support the new services in old MSs, Unstructured Supplementary Service Data (USSD) was
introduced in GSM 02.90, 03.90 and 04.90 specifications.

When the MS cannot recognize the text string entered by the user, it utilizes USSD to deliver
the text to the network, and leave the interpretation of the text to the network. USSD is used as a
GSM transparent bearer for old MSs.

A USSD string is a command code typically two or three digits followed by several parameters.
The parameters (supplementary information)have variable lengths and are separated by the * key.
The whole string is ended by # the key.
Ex: if we specify command code 159 for call forwarding, the USSD string :
*159 *5288128#
sent by the MS will instruct the network to forward all incoming calls to that Ms to the phone
number 528-8128.

 MSs can store several USSD strings and allows sending these strings through speed dialling
keys.
The USSD provides interaction between a GSM node (MSC, VLR, or HLR) and the MS.
 If the USSD service node is an MSC, then the USSD messages are exchanged through path 1
in Figure. If the service node is a VLR(or HLR), then the messages are exchanged through path
1 2(or1 2 3).
 Suppose that a new USSD service enabling subscribers to obtain real-time stock quotes is
implemented at the home network. To utilize this service USSD messages would be exchanged
between the MS and the HLR. Since the MS communicates directly with the HLR, the
subscriber can monitor stock values even when roaming to another country. However, it is
probably not practical to support this stock query service in HLR.
The HLR is expensive to modify, maintain and test, and may not have extra processing power
required to handle services. Thus, a reasonable solution is to introduce a USSD gateway that
connects to the application i.e., stock query server.
The USSD gateway connects to HLR using GSM MAP and to application servers by TCP IP.
When the subscriber issues a stock query request encoded in a USSD string, the MS sends it to
the HLR via SS7.
The HLR routes the USSD message directly to the USSD gateway 4 in Figure without any
interpretation. The USSD gateway translates the USSD format and sends the query to the
application server 5 in Figure. The server then returns the results to the MS for display.
Fig : USSD architecture
GSM Short message Service