Download GSM Numbers, Cont…

Southern Methodist University Fall 2003
EETS 8316/NTU CC745-N
Wireless Networks
Lecture 9: Review
Instructor: Jila Seraj
email: [email protected]
http://www.engr.smu.edu/~jseraj/
tel: 214-505-6303
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#1
Terminology, Cont….
Low-tier cellular (PCS)
— Between cellular and cordless
— Very small cells, limited mobility, usually campus
range
High tier cellular
— Large cells
Protocols
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#2
Protocols
— Rules for exchanging data between different
entities, Protocol layers
— Concept of dividing (usually complex) protocols into
separate functions
— Higher protocol layers build on the functions
(“services”) of lower layers
— Each protocol layer can be designed and analyzed
separately, if “services” provided to higher protocol
layers is unchanged
— Each protocol layer uses separate overhead
information (eg, header fields)
— Protocol “entities” in each layer communicate with
their “peer entities” in the same layer
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#3
OSI protocol reference model
Host A
Host B
application
presentation
session
transport
network
data link
physical
EETS 8316/NTU TC 745, Fall 2003
application
presentation
session
transport
network
data link
physical
SMU
ENGINEERING
#4
TCP/IP protocol reference model
Host A
Host B
application
application
transport
transport
internet
internet
network access
network access
Application Layer: user program that generates data
Transport Layer: end-to-end connection management, error
recovery
Internet Layer: route IP packets between different networks
Network Access Layer: any network and physical layer
protocols
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#5
Hierarchical Network
Access Tandem
Tandem
Local
Subscriber
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#6
Voice and Signaling
Signaling is used to transfer information
between entities for the purpose of carrying
traffic or performing other functions/
services.
Rules governing the signaling between
entities are called protocols.
There are many signaling protocols,
however Signaling System Number 7 is the
most commonly used of all
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#7
Voice and Signaling
STP: Signal Transfer Point
SCP: Switching Control Point, stores
translation Tables
SCP
EETS 8316/NTU TC 745, Fall 2003
STP
SMU
ENGINEERING
SS7
#8
TDMA Network Structure
PSTN
AUC
EIC
GMSC/MSC
/VLR
HLR
BSC
BSC
Base station Controller
BSC
Base station
Base station
Air interface
Mobile
station
Base station
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#9
Cellular DCCH Structure
DCCH
Reverse
RACH
PCH
ARCH
EETS 8316/NTU TC 745, Fall 2003
Forward
SPACH
BCCH
SMSCH
FBCCH
SMU
ENGINEERING
SCF
EBCCH
Reserved
SBCCH
#10
Roaming and Registration
When a mobile moves in the network, it is
called roaming
When a mobile is powered up, it sends a
registration message to BSC.
Registration informs MSC of the presence
of the mobile, or that it has changed
location
MSC request information about the MS from
HLR, which replies with subscriber data
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#11
Roaming and Registration
Registration
— Power Up/Power Down Registration
— Location Area Update Registration
• The coverage area of MSC is divided into
location areas. Location areas are chosen by
the network operator to simplify operation and
improve performance of the network.
• Every time an MS crosses the boundary
between location areas, it re-register with the
MSC.
— Periodical Registration
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#12
Roaming and Registration, Cont…
 Location cancellation, AKA de-registration
— MSC triggered
•
•
MSINACT with or without De-registration parameter
Bulkdereg, remove all mobiles associated with the MSC
— HLR triggered
•
•
•
Location update in another switch
Administrative actions
Data failure in HLR
 If registration happens in several MSC, HLR decides
which one is valid.
 If registration happens in several BS, MSC determines
which one is valid
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#13
Location Area, MSC border
MSC-1
LA-1
MSC-1
LA-2
MSC-1
LA-3
MSC-2
LA-1
MSC-2
LA-2
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#14
Handoff
Movement into a different cell requires MTSO
to automatically transfer call to another base
station without interruption
Hard handoff: “break before make”, connection
is broken then re-established
Soft handoff: temporarily connected to two or
more base stations simultaneously before
dropping all but one
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#15
Handoff, Cont…
 Initiation: Base station detects measured uplink signal
strength drops below threshold (first generation), or
mobile station reports signal from neighboring base
stations and one of them is stronger than current base
station (second generation), or the uplink quality is
lower than minimum acceptable.
 Resource reservation: frequencies are reserved with
new base station
 Execution: actual handoff of connection
 Completion: unneeded resources are cleared
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#16
Handoff Challenge
 Measured signal strength drop is caused by
momentary fading
 Handoff must be completed before signal strength
drops below a minimum acceptable level
 No channels are free at nearby base stations, causing
call connection problems, dropped calls.
 If mobile station moves to another cellular system
(controlled by different MTSO), an intersystem handoff
is required - more complicated
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#17
Handoff, Cont….
There are three type of handoffs
— MS controlled handoff
— Network controlled handoff
— Mobile assisted handoff (MAHO)
D-AMPS and CDMA use MAHO, AMPS uses
network controlled handoff.
Capabilities required for the MS are taken
into account.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#18
Path Optimization Process
6
BS
7
BS
BS
Serving MSC
PSTN
Anchor MSC
4
Target MSC
1
2
3
5
8
9
10
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#19
Path Optimization Process, Cont…
BS
BS
BS
MSC
PSTN
Anchor MSC
New Serving MSC
Call Path after path minimization process
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#20
Paging, Cont..
Gateway MSC has now sufficient
information to connect to the visiting MSC.
Gateway MSC send call set up request to
the visiting MSC, which sets up the call
What happens when more than one MSC
report to GMC that the mobile is its
coverage area?
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#21
Paging, Cont..
When HLR receives more than one
response, it chooses the MSC with
strongest signal.
It send the address of the chosen VMSC to
the gateway MSC and informs other MSC
that the call is off.
How does HLR know it has received
response from all MSCs? Internal timer
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#22
North American Numbering Plan
North American Numbering Plan consists of
10 digits, NPA-NXX-XXXX
All phone numbers follow the same
structure.
NPA is the area code
NXX is the switch identifier
XXXX indicates the subscriber in the switch
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#23
North American Numbering Plan, Cont
Due to this structure, there is no way for a
switch to identify that a number belongs to
a mobile subscriber, nor can it identify the
network provider.
Mobile network provider “buy” a certain
number series in each area for their users.
Therefore we can not bill a caller to a
mobile user for the air usage. They do it in
other countries!
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#24
GSM Network Structure
PSTN
VLR
GSM Public
land mobile
network
(PLMN)
MSC
HLR
OMC
AUC
A
EIR
BSC
BSS
NMC
BSS
ADC
BTS
BTS
OSS
Um
MT
TE
MS
EETS 8316/NTU TC 745, Fall 2003
OSS: operation subsystem
BSS: base station subsystem
MS: mobile station
MS
SMU
ENGINEERING
#25
GSM Interfaces, cont..
Air Interface
Um
Abis
A
CM
CM
MM
MM
LAPD
RF
RRM
RRM
RRM
LAPD LAPD
RF
EETS 8316/NTU TC 745, Fall 2003
RF
SCCP
SCCP
LAPD LAPD
LAPD
RF
SMU
RRM
ENGINEERING
RF
RF
#26
GSM Logical Channel Structure
TCH/F
TCH/H
BCH
FCCH SCH
CBCH
CCH
TCH
CCCH
BCCH
DCCH
PCH AGCH RACH
SACCH
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
ACCH
SDCCH
FACCH
#27
GSM Numbers
 IMEI = International mobile station equipment identity.
 IMEI= TAC + FAC + SNR + SP
— TAC = Type Approval Code, 6 decimals
— FAC = Final Assembly Code, 6 decimals, assigned by
manufacturer
— SNR = Serial Number, 6 decimals, assigned by
manufacturer
— SP = Spare, 1 decimal place
 EIR = Equipment Identity Register, has while, black
and optionally grey list
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#28
GSM Numbers, Cont…
IMSI = International mobile Subscriber Identity,
is stored on the SIM (Subscriber Identity
Module) card. IMSI is obtained at the time of
subscription. IMSI is not made public.
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code, 3 decimals
MNC = Mobile Network Code, 2 decimals
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#29
GSM Numbers, Cont…
MSIN = Mobile Subscriber Identification
Number, maximum 10 decimal digits
MSISDN = Mobile Station ISDN number, is the
real phone number of the subscriber. Stored in
HLR and on SIM card
MSISDN = CC + NDC + SN
<=3d
EETS 8316/NTU TC 745, Fall 2003
2-3d
SMU
<= 10d
ENGINEERING
#30
GSM Numbers, Cont…
Mobile Station Roaming Number (MSRN),
same format as MSISDN. A temporary location
dependent ISDN number. Is assigned at call
set up.
Location Area Identity (LAI). Regularly sent on
BCCH LAI = CC + MNC + LAC, LAC =
Location Area Code, max 5 decimals
Temporary Mobile Subscriber Identity (TMSI).
Stored only in the VLR and SIM card. Consists
of 4*8 bits excluding value FFFF FFFFhex
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#31
GSM Numbers, Cont…
TMSI has only local meaning and can be
defined according to operator’s specifications.
LAI + TMSI uniquely identifies the user, I.e.
IMSI is no longer needed for ongoing
communication
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#32
GSM Numbers, cont..
 LMSI = Local Mobile Subscriber Identity. Created in
VLR and stored in HLR. Like TMSI is operator defined.
Used in communication with VLR to speed the search
for mobile records.
 Speed is essential to achieve short call setup times.
 GCI = Global Cell Id = LAI + CI. CI = Cell id, unique id
within the LAI. Maximum 2*8 bits.
 BSIC = Base Transceiver Station Identity Code. BSIC=
NCC + BCC
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#33
GSM Numbers, cont…
BSIC is broadcast periodically by the base
station on the synchronization channel.
NCC = Network Color Code, 3 bits
BCC = Base Station Color Code, 3 bits
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#34
GSM Handoffs
3 types of handoffs
—Intra-BSS: if old and new BTSs are attached
to same base station
• MSC is not involved
—Intra-MSC: if old and new BTSs are
attached to different base stations but within
same MSC
—Inter-MSC: if MSCs are changed
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#35
IS-95 CDMA
 D-AMPS increased capacity of AMPS by factor 3
 CDMA claimed to increase capacity by factor 20
 Spread spectrum techniques adapted from military
(used since 1950)
— Narrowband signal is multiplied by very large
bandwidth signal (spreading signal)
— All users, each with own pseudorandom codeword
approximately orthogonal to all other codewords,
can transmit simultaneously with same carrier
frequency
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#36
IS-95 CDMA - Radio Aspects (cont)
—Receiver performs a time correlation
operation to detect only desired codeword
—All other codewords appear as noise due to
decorrelation
—Receiver needs to know only codeword
used by transmitter
—In other words, users are separated by their
codes rather than frequency and time slot
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#37
IS-95 CDMA Interesting Features
 Multiple users can share same frequency
 Spatial diversity provides soft handoff: MSC monitors
signal of a user from multiple base stations and
chooses best version of signal at any time
 Multipath fading is reduced by signal spreading
 CDMA is dual mode like TDMA.
 The system can move a call from digital to analog
when the call enters the coverage area of a cell that
does not have CDMA capability. The opposite does not
work.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#38
IS-95 CDMA Interesting Features (cont)
Soft capacity limit: more users raises noise
floor linearly, no absolute limit on number of
users - performance degrades gradually for all
users
Self-jamming is a problem: because spreading
sequences of different users are not exactly
orthogonal
—When despreading, other users can
contribute significantly to receiver decision
statistic
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#39
IS-95 CDMA Interesting Features (cont)
Near-far problem: if power of multiple users are
unequal, strongest received mobile signal will
capture demodulator at base station
—Base stations must implement power control
to ensure that each mobile within coverage
area provides same signal level to base
station receiver
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#40
Soft handoff
Two base stations receive signals from the
mobile. The signals are sent to the MSC that
decides which one has lowest bit error rate.
Vocoder in CDMA is in the switch.
Mobile receives signals from two base stations
and combine them before decoding. Uses rake
receiver. Each tunes to one base station.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#41
Soft handoff (cont)
This requires synchronization of the base
stations.
It also requires that the mobile dedicates one
correlator for searching other pilot channels.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#42
Soft handoff (cont)
Mobile
Current
BS
Conversation
MSC
Candidate
BS
Neighbor pilot
can be a candidate
Measure the strength of pilot
New Active Set, handoff direction
Conversation
Measurements
Conversation
Measurements
Handoff
Handoff
Conversation
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#43
Mobitex - Architecture
NCC
NCC: network
Control center
Main
exchange
Regional
switch
Local
switch
Regional
switch
Local
switch
Base stations use 1-4
frequencies each 8 kb/s
FEP
EETS 8316/NTU TC 745, Fall 2003
Local switch covers a
service
area, each with 10-30
frequency pairs
SMU
ENGINEERING
#44
Mobitex, protocol architecture
Applications
4-7 Applications
3
2
1
MPAK
MPAK
MPAK
MASC
MASC
RS232
RS232 GMSK
Mobile
EETS 8316/NTU TC 745, Fall 2003
ROSI
ROSI HDLC
GMSK X.21
Base
Station
Radio
modem
SMU
ENGINEERING
MPAK
HDLC
X.25
X.21 X.21
Local
switch
MPAK
X.25
X.21
Server
#45
Mobitex, Major features, Cont...
Major features
—Seamless roaming
—Store and forward of messages
—Dependability above 99.99%
—Interoperability and many connectivity
options
—Capacity to support millions of subscribers
—Security against eavesdropping
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#46
Mobitex, Major features, Cont...
Major features
—Packet switching occurs at lowest level of
system hierarchy - relieves backbone traffic
—Packet multicasting (to multiple recipients) is
handled by network
—Closed User Group (CUG) feature
—Frequency depends of the country, 900
MHZ in US and 450 in most others.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#47
Mobitex - common functions
Requires subscription
—individual
—groups of terminals
—host computer
—groups of host computers
Security
—Password based
—ESN
—CUG (Closed User Group)
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#48
Mobitex - Mobility
Mobiles monitor and evaluate signals from
other base stations
At power-up, mobile tries to resgister with
the last base station in its memory, if
possible
Base station provides necessary
information, such as acceptable signal
strength, neighbour list,etc periodically.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#49
CDPD - Network Architecture
Internet or other
networks
IS
IS
MD-IS
Intermediate systems = generic
packet switches in backbone
network
IS
Mobile data intermediate
systems = packet switches
with mobility management
capabilities
MD-IS
Mobile data base station =
base station
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#50
CDPD
Cellular digital packet data (CDPD):
connectionless packet-switched data
designed to work with an analog cellular
system (eg, AMPS)
—Originated by IBM as packet-switching
overlay to analog cellular system, early
1990s developed by CDPD Forum, now
developed by Wireless Data Forum
—Overlay system uses unused bandwidth in
cellular system and existing AMPS functions
and capabilities
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#51
CDPD , Cont...
CDPD is a value added system. Other users
do not need to be aware of its presence in
the network. This has implicaitons:
CDPD transmission must not interfere with
transmission of other services
No dedicated bandwith, uses only idle time
between users, channel-hop
No dedicated Control channel, all Control is
in-band.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#52
CDPD , Cont...
CDPD is transparent to voice system
—To avoid collisions with voice calls, CDPD
uses channel hopping when antenna
detects a power ramp-up (indicating
initiation of voice traffic)
—Base station closes current transmission
channel within 40 msec and new idle
channel is chosen to hop to
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#53
CDPD , Cont...
CDPD is transparent to voice system
—New channel may or may not be announced
before old channel closed
• If not announced, mobile terminal must
hunt around set of potential CDPD
channels to find new one
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#54
GPRS - Network Architecture
Internet or other
networks
HLR
SGSN
MSC/
VLR
GGSN
Gateway GSN = packet switch
interworks with other networks
SGSN
Serving GPRS support node
= packet switch with mobility
management capabilities
BSC/PCU
GPRS makes use of existing
GSM base stations
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#55
GPRS , Cont...
SGSN = Serving GPRS Support Node
—Ciphering
—Authentication, IMEI check
—Mobility Management
—Logical Link Management towards mobile
station
—Packet routing and transfer
—Connection to HLR, MSC, BSC and SMSMC
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#56
GPRS , Cont...
GGSN = Gateway GPRS Support Node
— External interfaces
— Routing
GPRS register maintains GPRS subscriber
data and routing information. Normally it is
integrated in GSM HLR
PCU (Packet Control Unti) is collocated with
BSC.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#57
GPRS , Cont...
SGSN communicates with MSC/VLR with SS7
based protocol based on BSSAP.
Three class of mobile terminals
—Class A: Operates GPRS and Circuit
switched service simultaneously
—Class B: Monitors the Control channels of
GPRS and GSM simulataneously but can
opeate one set of services at a time
—Class C: Only CS or GPRS capable.
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#58
GPRS , Cont...
For mobility management a new concept is
defined, Routing Area
RAI = MCC +MNC + LAC + RAC
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#59
GPRS - Radio Interface
Mobile station must register and establish a
temporary logical link identity (TLLI) with its
serving GSN
—Mobile station’s HLR is queried for access
privileges
Data is transmitted over a number of GSM
physical channels that network provider
dedicates to GPRS (packet data channels or
PDCHs)
—Each PDCH = one physical timeslot in
TDMA frame
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#60
GPRS - Radio Interface , Cont...
Mobile station with data ready sends a short
random access message to BTS on packet
random access channel (PRACH) requesting a
number of GPRS slots
—When BSC grants slots, mobile station can
transmit
Packets for mobile stations use paging
channels to locate MS and reserve timeslots
EETS 8316/NTU TC 745, Fall 2003
SMU
ENGINEERING
#61