2G/3G Mobile Communication Systems

(1)

Integrated Communication Systems Group Ilmenau University of Technology

2G/3G Mobile Communication Systems

(2)

Outline



2G Review: GSM



Services



Architecture



Protocols



Call setup



Mobility management



Security



HSCSD



GPRS



Architecture



Protocols



QoS



EDGE



UMTS

(3)

2G to 3G Evolution: GSM - GPRS - UMTS

GSM

RAN

Base station Base station controller Base station Base station MSC

ISDN

GSM Core

(Circuit

switched)

HLR AuC EIR GMSC Transmission ATM based

GSM

(4)

Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network)



several providers setup mobile networks following the GSM standard

within each country

GSM system comprises 3 subsystems



RSS (radio subsystem): covers all radio aspects



MS (mobile station)



BSS (base station subsystem)

or

RAN (radio access network)



BTS (base transeiver station)



BSC (base station controller)



NSS (network and switching subsystem): call forwarding, handover,

switching



MSC (mobile services switching center)



LR (location register): HLR and VLR



OSS (operation subsystem): management of the network



OMC (operation and maintenance center)



AuC (authentication center)

(5)

possible radio coverage of the cell

idealized shape of the cell

cell

segmentation of the area into cells

GSM: cellular network



use of several carrier frequencies



not the same frequency in neighboring cells



cell radius varies from some 100 m up to 35 km depending on

user density, geography, transceiver power etc.



hexagonal shape of cells is idealized (cells overlap, shapes depend

on geography)



if a mobile user changes cells

(6)

Cellular systems: Frequency planning I

Frequency reuse only with a certain distance between the base stations Typical (hexagon) model:

reuse-3 cluster: reuse-7 cluster:

Other regular pattern: reuse-19



the frequency reuse pattern determines the experienced CIR

Fixed frequency assignment:

 certain frequencies are assigned to a certain cell  problem: different traffic load in different cells

Dynamic frequency assignment:

 base station chooses frequencies depending on the frequencies already used in

neighbor cells

Frequency Hopping (fixed or random sequence of frequencies)

 Improves quality for slow moving or stationary users (frequency diversity)  Reduces impact of intercell interference by statistical averaging

f₄ f₅ f₁ f₃ f₂ f₆ f₇ f₄ f₅ f₁ f₃ f₂ f₆ f₇ f₄ f₅ f₁ f₃ f₂ f₆ f₇ f₂ f₁ f₃ f₂ f₁ f₃ f₂ f₁ f₃

(7)

GSM: Air Interface

FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

1 2 3 . . . 123 124 890 MHz 915 MHz 1 2 3 . . . 123 124 935 MHz 960 MHz 200 kHz Uplink Downlink frequency

TDMA (Time Division Multiple Access)

time Downlink 8 7 6 5 4 3 2 1 4,615 ms = 1250 bit Uplink 8 7 6 5 4 3 2 1

(8)

Framing Modulation (GMSK)

GSM: Voice Coding

Voice coding Channel

coding Framing

Modulation (GMSK) 114 bit/slot

114 + 42 bit

Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot) Training sequence: select the best radio path in the receiver and train equalizer

Tail: needed to enhance receiver performance Flag S: indication for user data or control data

1 2 3 4 5 6 7 8

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs 577 µs

tail user data S Training guard

space S user data tail

guard space

(9)

Mobile Terminated Call (MTC)

PSTN calling station GMSC HLR VLR BSS BSS BSS MSC MS 1 2 3 4 5 6 7 8 9 10 11 12 13 16 10 10 11 11 11 14 15 17

1: calling a GSM subscriber

2: forwarding call to GMSC

3: signal call setup to HLR

4, 5: request MSRN from VLR

6: forward responsible

MSC to GMSC

7: forward call to

current MSC

8, 9: get current status of MS

10, 11: paging of MS

12, 13: MS answers

14, 15: security checks

16, 17: set up connection

(10)

RA

Location

Update

Location

Update

Location

Update

Location

Update

Location

Update

Location Management / Mobility Management

The issue: Compromise between



minimizing the area where

to search for a mobile



minimizing the number of

location updates

Solution 1:

Large paging area

Solution 2:

_{Small paging area}

Paging

Signalling Cost

Paging Area Update

Signalling Cost

TOTAL

Signalling Cost



+

=

(11)

Handover

The problem:

Change the cell while

communicating

Reasons for handover:



Quality of radio link

deteriorates



Communication in other cell

requires less radio resources



Supported radius is

exceeded (e.g. Timing

advance in GSM)



Overload in current cell



Maintenance

Li

nk

qu

al

ity

Link to cell 1

Link to cell 2

time

cell 1

cell 2

Handover margin

(avoid ping-pong

effect)

cell 1 cell 2

(12)

Handover procedure (change of BSC)

HO access BTS_old BSC_new measurement result BSC_old Link establishment MSC MS measurement report HO decision HO required BTS_new HO request resource allocation ch. activation ch. activation ack HO request ack HO command HO command HO command HO complete HO complete clear command clear command

clear complete _{clear complete}

„Make-before-break“ strategy

make

(13)

GSM - authentication

A3 RAND K_i 128 bit 128 bit RAND SRES* =? SRES A3 RAND K_i 128 bit 128 bit SRES 32 bit SRES

Authentication Request (RAND)

Authentication Response (SRES 32 bit) mobile network

AuC

MSC

SIM

K_i: individual subscriber authentication key SRES: signed response SRES* 32 bit

Challenge-Response:

• Authentication center provides RAND to Mobile • AuC generates SRES using Ki of subscriber and

RAND via A3

• Mobile (SIM) generates SRES using Ki and RAND • Mobile transmits SRES to network (MSC)

• network (MSC) compares received SRES with one generated by AuC

(14)

GSM - key generation and encryption

A8 RAND K_i 128 bit 128 bit K_c 64 bit A8 RAND K_i 128 bit 128 bit SRES RAND encrypted data mobile network (BTS) MS with SIM AuC BTS SIM A5 K_c 64 bit A5 MS data _data cipher key

Ciphering:

• Data sent on air interface ciphered for security • A8 algorithm used to generate cipher key

• A5 algorithm used to cipher/decipher data • Ciphering Key is never transmitted on air

(15)

GSM Evolution – Overview

Spectral

efficency

Data

traffic

adaptive

modulation

EDGE

diversity

space

time

Macro diversity

Intelligent antennas

Equalizer

adaptive

redundancy

interference

Frequency

hopping

Dynamic

channel

allocation

GPRS

bursty

HSCSD

continuous

Interference

cancelation

(multi-user

detection)

(16)

HSCSD (High-Speed Circuit Switched Data)



continuous use of multiple time slots for a single user

(on a single carrier frequency)



asynchronous allocation of time slots between DL and UL



gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)



mainly software update



additional HW needed if more than 3 slots are used

Uplink Downlink 7 1 2 3 4 5 6 8 1 2 7 1 2 3 4 5 6 8 1 2

(17)

2G to 3G Evolution: GSM - GPRS - UMTS

GPRS Core

(Packet

Switched)

SGSN GGSN

Inter-net

GSM

RAN

Base station Base station controller Base station Base station MSC

ISDN

GSM Core

(Circuit

switched)

GSM+GPRS

(18)

GPRS (General Packet Radio Service)



Introducing packet switching in the network



Using shared radio channels for packet transmission over the air:

 multiplexing multiple MS on one time slot

 flexible (also multiple) allocation of timeslots to MS

(scheduling by PCU Packet Control Unit in BSC or BTS) 

using free slots only if data packets are ready to send

(e.g., 115 kbit/s using 8 slots temporarily)



standardization 1998, introduction 2001



advantage: first step towards UMTS, flexible data services

GPRS network elements



GSN (GPRS Support Nodes): GGSN and SGSN



GGSN (Gateway GSN)



interworking unit between GPRS and PDN (Packet Data Network)



SGSN (Serving GSN)



supports the MS (location, billing, security)



HLR (GPRS Register – GR)

(19)

carrier TS 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

Multiplexing

Multislot capability

(20)

GPRS protocol architecture

appl. IP/X.25 LLC GTP MAC radio MAC radio FR RLC BSSGP IP/X.25 FR U_m G_b G_n L1/L2 L1/L2 MS BSS SGSN GGSN UDP G_i SNDCP RLC BSSGP IP IP LLC UDP SNDCP GTP

BSSGP: Base Station Subsystem GPRS Protocol (control plane: routing & QoS)

SNDCP: Subnetwork-Dependent Convergence Protocol (mapping, segmentation,

(21)

GPRS services

End-to-end packet switched traffic (peak channel rates)



28 kbps (full use of 3 time slots, CS-1: FEC)



171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell

(Source: H. Menkes, WirelessWeb, Aug. 2002)



95 kbps (for both up and downlink)

Assumptions: 4/12 reuse, realistic RF conditions, random traffic



Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control – FEC)



CS 1: 9.05 Kbps/slot



CS 2: 13.4 Kbps/slot



CS 3: 15.6 Kbps/slot



CS 4: 21.4 Kbps/slot (no Forward Error Correction)

Problems and limits



IP-based network => high latency, no guarantees



Limited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4)



Latency/flow control problems with TCP

(22)

EDGE (Enhanced Data Rates for GSM Evolution)

Enhanced spectral efficiency depends on:



Size of frequency band



Duration of usage



Level of interference with others (power)

EDGE Technology:



EDGE can carry data speeds up to 236.8 kbit/s for 4

timeslots (theoretical maximum is 473.6 kbit/s for 8

timeslots)



Adaptation of modulation

depending

on quality of radio path

 GMSK (GSM standard – 1 bit per symbol)  8-PSK (3 bits per symbol)



Adaptation of coding scheme

depending

on quality of radio path (9 coding schemes)



Gain: data rate (gross) up to 69,2kbps (compare to

22.8kbps for GSM)



complex extension of GSM!

NodeB UE 1 UE 2

Near-far problem

(23)

EDGE – Adaptive Modulation and Coding Schemes

Scheme Modulation Maximum

rate [kb/s]

Code Rate Family

M CS-9 59.2 1.0 A M CS-8 54.4 0.92 A M CS-7 44.8 0.76 B M CS-6 29.6 / 27.2 0.49 A M CS-5 8PSK 22.4 0.37 B M CS-4 17.6 1.0 C M CS-3 14.8 / 13.6 0.80 A M CS-2 11.2 0.66 B M CS-1 GM SK 8.8 0.53 C