GSM System Protocol Architecture

Similar documents
10 Call Set-up. Objectives After this chapter the student will: be able to describe the activities in the network during a call set-up.

Section 4 GSM Signaling BSSMAP

GSM. Course requirements: Understanding Telecommunications book by Ericsson (Part D PLMN) + supporting material (= these slides) GPRS

Communication Networks 2 Signaling 2 (Mobile)

Mobile Communications

GSM System Overview. Ph.D. Phone Lin.

UNIT-5. GSM System Operations (Traffic Cases) Registration, call setup, and location updating. Call setup. Interrogation phase

3GPP TS V8.0.0 ( )

EUROPEAN ETS TELECOMMUNICATION November 1996 STANDARD

Signaling System 7 (SS7) By : Ali Mustafa

Chapter 3 GSM and Similar Architectures

ETSI TS V ( )

ISDN. Integrated Services Digital Network. definition of ISDN ISDN services basic BRA / PRA architecture protocols & signalling

ETSI TS V8.0.1 ( )

Cellular Mobile Systems and Services (TCOM1010) GSM Architecture

Pertemuan 7 GSM Network. DAHLAN ABDULLAH

Non-Strategic Change Request GSM 11.23

Mobility and Security Management in the GSM System

Chapter 1 : Historical Background of Mobile Communications Early Systems (World War II)

ISDN. Integrated Services Digital Network

General Packet Radio Service (GPRS) 13 年 5 月 17 日星期五

GSM Mobility Management

GSM Mobility Databases

Traffic Link Redundancy

Wireless and Mobile Network Architecture

WIRELESS SYSTEM AND NETWORKING

Client Server Programming and GSM Networking Protocols (SS7 Signaling)

ETSI TS V7.1.0 ( )

UMTS System Architecture and Protocol Architecture

ETSI TS V ( )

EUROPEAN ETS TELECOMMUNICATION April 1997 STANDARD

Basics of GSM in depth

GSM mobility management using an intelligent network platform

Chapter 3: GSM Mobility Management

9 SIGNALING IN MOBILE NETWORKS

Common Channel Signaling Nr 7 (CCS7)

Introduction to Mobile Computing

GPRS System Architecture

TELE4652 Mobile and Satellite Communication Systems

UNIK4230: Mobile Communications Spring Semester, Per Hj. Lehne

Three kinds of number portability

ETSI TS V4.0.1 ( )

GSM & GPRS. Antti Siitonen. Head of Department, MSc (EE) T Telecommunications architectures

UMTS Addresses and Identities Mobility and Session Management

ETSI TS V7.0.0 ( )

GLOBAL SYSTEM FOR MOBILE COMMUNICATION (2) ETI2511 Friday, 31 March 2017

Course 5 The SS7 signaling systems.

ETSI TS V ( ) Technical Specification

ETSI TS V7.3.0 ( )

3GPP TSG SA WG3 Security S3#30 S October 2003 Povoa de Varzim, Portugal

ETSI TS V5.0.0 ( )

ETSI TS V7.0.0 ( )

GSM GSM TECHNICAL October 1997 SPECIFICATION Version 5.5.0

ETSI TS V3.2.0 ( )

Telecommunication Services Engineering Lab

GSM Hacking. Wireless Mobile Phone Communication 30 th January 2014 UNRESTRICTED EXTERNAL

FROM GSM TO LTE-ADVANCED: AN INTRODUCTION TO MOBILE NETWORKS AND MOBILE BROADBAND 2. GENERAL PACKET RADIO SERVICE (GPRS) AND EDGE

TELE COMMUNICATIONS Objective Introduction Global System for Mobile Communication (GSM):

Routing in Mobile Networks

GSM Protocol Analyzer

Internal. GSM Fundamentals.

Traditional telephony network and protocols

Telecommunication Services Engineering Lab

3G TS V3.1.0 ( )

3GPP TS V ( )

ETSI ETR 109 TECHNICAL October 1993 REPORT

3GPP TS V ( )

ETSI TS V1.1.1 ( )

SS7. Mercantec H2 2009

GSM GSM TECHNICAL July 1996 SPECIFICATION Version 5.2.0

Wireless Communications

ETSI TS V6.4.0 ( )

GSM and IN Architecture

ETSI TS V3.5.0 ( )

Attacking Mobile-Terminated Services in GSM

ETSI TS V ( )

Advanced Computer Networks Exercise Session 4. Qin Yin Spring Semester 2013

TELECOMMUNICATION SYSTEMS

ETSI TS V7.0.0 ( )

GSM GSM TECHNICAL July 1998 SPECIFICATION Version

TR V6.0.0 ( )

E2-E3: CONSUMER MOBILITY. CHAPTER-5 CDMA x OVERVIEW (Date of Creation: )

GSM GSM TECHNICAL November 1996 SPECIFICATION Version 5.4.0

3GPP TR V8.0.0 ( )

Chapter 4 Transmission Systems and the Telephone Network. School of Info. Sci. & Eng. Shandong Univ.

ETSI TS V8.1.0 ( )

Nexus8610 Traffic Simulation System. Intersystem Handover Simulation. White Paper

Communication Systems for the Mobile Information Society

ETSI TS V6.2.0 ( )

Narrowband ISDN. (ISDN = Integrated Services Digital Network)

ETSI TS V5.1.0 ( )

EUROPEAN ETS TELECOMMUNICATION January 1999 STANDARD

CHAPTER 4 SYSTEM IMPLEMENTATION 4.1 INTRODUCTION

TS-3GA (R99)v3.6.0 Serving GPRS Support Node SGSN - Visitors Location Register (VLR); Gs Interface Layer 3 Specification

Part IV: GPRS Interfaces

3GPP TR V4.0.0 ( )

JP-3GA (R99) Network Architecture

Trillium 3G Wireless Software

Threat patterns in GSM system. Basic threat patterns:

ETSI TS V ( )

Transcription:

GSM System Protocol Architecture References: Jörg Erbespächer, Hans Jörg Vogel, Christian Bettstetter, GSM: Switching services and protocols, Wiley 2001, ISBN 0-471-499903-X Schiller: Mobile communications, 2nd ed. 512 pages, ISBN 0-321-12381-6, Addison- Wesley, 2003 Copyright Jouko Kurki, 2006 DM_7_GSM_Protocol_Architecture.ppt 1

Protocol architecture planes Three Planes: User Plane (Speech, data) Control plane (Signaling fro call setup etc.) Management Plane (management of network elements, like configuration, faults User Plane: Logical Channels at the Service Access Point (SAP) of layer 1 (Physical layer). Left: Reference model fro the GSM User-Network Interface (UNI) Um. User data across air interface using Traffic Channels, TCH. Protocols in signaling Plane needed e.g. fro call set-up and network element management. The D channels (corresponding to ISDN D channels) in air IF are signaling channels DM_7_GSM_Protocol_Architecture.ppt 2

GSM Network Architecture (protocols) MS BTS MSC BSC CM CM MM MM Layer 3 RR RR BTSM RR BTSM BSSAP SCCP BSSAP SCCP Layer 2 LAPDm LAPDm LAPD LAPD MPT MTP Layer 1 physical layer physical layer physical layer physical layer Um Interface A-bis interface A interface DM_7_GSM_Protocol_Architecture.ppt 3

GSM Network Signaling Architecture as OSI Model MS BTS MSC BSC CM CM MM MM Layer 3 RR RR BTSM RR BTSM BSSAP SCCP BSSAP SCCP Layer 2 LAPDm LAPDm LAPD LAPD MPT MTP Layer 1 physical layer physical layer physical layer physical layer Um Interface A-bis interface A interface DM_7_GSM_Protocol_Architecture.ppt 4

Protocol Architecture in User Plane 1. Connection between Reference points 2. Connections are constructed of connection elements Radio Interface Connection Element A Interface Connection Element DM_7_GSM_Protocol_Architecture.ppt 5

The data link layer (layer 2) over the radio link is based on a modified LAPD (Link Access Protocol for the D channel) referred to as LAPDm (m like mobile). On the A-bis interface, the layer 2 protocol is based on the LAPD from ISDN. The Message Transfer Part (MTP) level 2 of the SS& protocol is used at the A interface. DM_7_GSM_Protocol_Architecture.ppt 6

User Data and Control at Air Interface ISDN channels: 2 x B + D = 2x 64 kb/s + 16 kb/s = 144 kb/s. D channel used for signaling and possibly some user data. In GSM: Bm channel for traffic / user data Dm channel for signaling As in ISDN the Dm channel in GSM can be used for user data if capacity is available. GSM s Short Message Service (SMS) uses this. Cases: No call, SDCCH channel During call, SACCH channel DM_7_GSM_Protocol_Architecture.ppt 7

LAPD frame structure Octet 1 Octet 2 Octet 3 Octet 4 Octet 5 Octet 6 Octet N-3 Octet N-2 Octet N-1 Octet N 0 1 1 1 1 1 1 0 Address octet 1 Address octet 2 Control octet 1 Control octet 2 Layer 3 information FCS octet 1 FCS octet 2 0 1 1 1 1 1 1 0 Opening flag The structure of the control filed depends on the frame type Layer 3 information is only presented in Layer in Layer 2 information frame Frame check sequence Frame check sequence Closing flag DM_7_GSM_Protocol_Architecture.ppt 8

Speech transmission in GSM Overview of protocols for speech: GSC = GSM Speech Codec FEC = Forward error Correction MPX = (Sub)Multiplexing 3 x 13+3 kb/s inserted to 64 kb/s TRAU = Transcoding unit: GSM Speech 13 kb/s coded to 64 kb/s ISDN speech DM_7_GSM_Protocol_Architecture.ppt 9

BTS architectures with various positions of TRAU DM_7_GSM_Protocol_Architecture.ppt 10

GSM protocol architecture for speech Air IF Transcoding unit (TRAU) at BTS site Logical flow of data DM_7_GSM_Protocol_Architecture.ppt 11

Protocol architecture for speech DM_7_GSM_Protocol_Architecture.ppt 12

Protocol architecture for transparent data Provides transparent data transmission at 9.6 / 14.4 kb/s. Standard GSM error correction. DM_7_GSM_Protocol_Architecture.ppt 13

Protocol architecture for nontransparent data Provides non-transparent data transmission. Error correction based on checksum and Automatic Repeat Request (ARQ). Uses Radio Link Protocol (RLP). Fixed 240 bit frames, otherwise rather similar to HDLC link protocol. 24-bit Frame check sequence. Delay around 200 ms DM_7_GSM_Protocol_Architecture.ppt 14

Frame structure for RLP protocol DM_7_GSM_Protocol_Architecture.ppt 15

SIGNALING ARCHITECTURE DM_7_GSM_Protocol_Architecture.ppt 16

A bis interface CM and MM messages are not interpreted by the BSC or the BTS. They are transferred over the A-bis interface as transparent messages and over the A interface using the Direct Transfer Application Part (DTAP). RR messages are mapped to the BSS Application Part (BSSAP) in the BSC. In the BTS, most of them are handled as transparent by the BTS (e.g. random access, start ciphering, paging). BTS Management (BTSM) is used to transfer all OAM related information to the BTS. DM_7_GSM_Protocol_Architecture.ppt 17

A interface The Message Transfer Part (MPT) and the SCCP (Signalling connection Control Point) are used to support the transfer of signalling messages between the MSC and the BSS. The SCCP part is used to provide a referencing mechanism to identify a particular transaction relating to, for instant, a particular call. The SCCP can also be used to enhance message routing, operation and maintenance information. DM_7_GSM_Protocol_Architecture.ppt 18

Signaling Needed for call control Signaling is needed to setup and takedown of calls etc. The whole system is called Signaling System Number 7 (SS#7 or SS7) and it is used in Public telephone system and mobile telephone systems throughout the world. It enables calls throughout the world. Signaling system is separate system from speech Example of operations. Signaling in call set-up. Signaling is transferred as messages. DM_7_GSM_Protocol_Architecture.ppt 19

Message Transfer Part -MTP MTP is the in infrastructure for transferring signaling messages between network elements The entire Signaling System number 7 (SS#7 or SST) is built on the foundation of MTP Layer 1 Physical layer, voltages etc. Layer 2 Datalink, error free transfer of signaling messages Layer 3- Transfer of signaling messages within one network (only) Transport of Signaling Messages within one Network Data Link Control Physical Connections Layer 3 Layer 2 Layer 1 DM_7_GSM_Protocol_Architecture.ppt 20

Telephone User Part (TUP) call control TUP is the entity that sends and receives messages used for actual call control In fixed network there are only these two parts. TUP can be replaced by National User Part (NUP), allowing some minor variations. In ISDN more functionality -> ISDN User Part (ISUP) DM_7_GSM_Protocol_Architecture.ppt 21

Signaling Connection and Control Part - SCCP Takes care of connections between networks allowing: virtual connection and connectionless signaling. This enables signaling between networks. Summary: MTP is Message Transfer Part, responsible for transferring messages between network elements within same network TUP is the user part for messages transferred by MTP. These messages deal with setting up supervising and clearing call connections. Two variations NUP (national) and ISUP (ISDN). SCCP is the Signaling Connection and Control Part. Main function: virtual connection and connectionless signaling. DM_7_GSM_Protocol_Architecture.ppt 22

SS7 in GSM (1) In GSM system more functionality is needed because of more functionally due to non-call related signaling (measurements, handover control etc.), user mobility and additional network elements. The additional protocol layers are: BSSAP: Used for signaling between MSC and BSC and MS. Since there is BSC between MSC and MS, there must be a virtual connection, thus SCCP is needed. Examples: Authentication, assigning new TMSI. BSSP need for signaling between MSC-BSC and MSC-MS. MAP is a GSM specific protocol, for noncall related applications between Network Elements. MAP signaling includes e.g. messaging between MSC and HLR. TCAP, Transaction Capabilities Application Part. The MAP transactions need a sort of secretary for managing the transactions. This is the function of TCAP. DM_7_GSM_Protocol_Architecture.ppt 23

SS7 in GSM (2): MTP and BSSAP The MTP part provides a mechanism for providing the reliable transfer of signalling messages. A subset of MTP is used between the BSS and the MSC. The BSSAP provides the channel switching and aerial functions, it performs RR management, and the interworking functions between the data link protocols used on the radio and the BSS-MSC side for transporting signalling related messages. DM_7_GSM_Protocol_Architecture.ppt 24

SS7 Protocols in GSM (3) Nam e Protocol Function DM_7_GSM_Protocol_Architecture.ppt 25

SS7 layers in GSM system elements overview DM_7_GSM_Protocol_Architecture.ppt 26

Signaling functions in various GSM elements DM_7_GSM_Protocol_Architecture.ppt 27

Protocol interfaces in Mobile Network DM_7_GSM_Protocol_Architecture.ppt 28

International signaling relations via ISDN DM_7_GSM_Protocol_Architecture.ppt 29

Overview of signaling in GSM DM_7_GSM_Protocol_Architecture.ppt 30

Protocol architecture for Signaling DM_7_GSM_Protocol_Architecture.ppt 31

Layer 3 Functions are divided into 3 categories: 1. Radio Resource (RR) Management: Function relating to the establishment of physical connections for the purpose of transmitting call-related signalling information. 2. Mobility Management (MM): Functions relating to location registration, paging, attachment/detachment, handover, dynamic channel allocation and management. 3. Connection Management (CM): Call control related functions, SMS and service handling functions. DM_7_GSM_Protocol_Architecture.ppt 32

Layer 3 Protocols at MS side Main task of LAPDm is to transfer layer layer 3 protocols with special support for: RR = radio Resource Management MM = Mobility management CC = Call Control DM_7_GSM_Protocol_Architecture.ppt 33

Protocol architecture for SMS transfer DM_7_GSM_Protocol_Architecture.ppt 34

Signaling at Air Interface LAYER 1 SERVICES: Layer 1 provides bit transport service to logical channels. Access Capabilities Error Detection Encryption RR has direct access to Layer 1 Physical layer connections. Logical channels defined. Layer 1 service interfaces DM_7_GSM_Protocol_Architecture.ppt 35

Layer 1 services MS Modes: Idle Dedicated NULL: Power off BCH: Synchronized with one BTS, ready for RACH Tuning DCH: Tries to synchronize with a channel State diagram of MS physical layer Layer 1 frame structure (SACCH block): Transport of signaling messages that accur as LAPDM frames at the Service Access Point (SAP). SACCH frame also carreis power level etc. DM_7_GSM_Protocol_Architecture.ppt 36

Layer 2 signaling L2 = Data link protocol for signaling channels at air interface. Similar to HDLC except fixed frame length. Two modes: Unacknowledged, no flow and error control Acknowledged mode: Positive acknowledgement, Error correction based on ARQ. Logical channels and modes for Layer 2 SAPIs Specific SAPI values reserved fro specific functions: SAPI = 0 for signaling (CM, MM, RR) SAPI = 3 for SMS DM_7_GSM_Protocol_Architecture.ppt 37

LAPDm frame formats USAGE: A, B: SACCH, FACCH, SDCCH Abis, Bbis: BCCH, PCH, AGCH DM_7_GSM_Protocol_Architecture.ppt 38

Radio Resource management Procedures for Radio Resource Management (RR) are signaling and control procedures for air interface (Um): Assignment, allocation and administration of radio resources. Format of Um signaling message shown below. Message Type (MT), see next page. Format of Layer 3 signaling message at air interface (Um) DM_7_GSM_Protocol_Architecture.ppt 39

RR messages, channels and MT codes MT = Message type code DM_7_GSM_Protocol_Architecture.ppt 40

RR connection set-up and take-down LAPDm held back until complete BTS sends RR message: Physical information, TA Measurement result DM_7_GSM_Protocol_Architecture.ppt 41

Channel change encryption and handover DM_7_GSM_Protocol_Architecture.ppt 42

Mobility Management (MM) MM messages DM_7_GSM_Protocol_Architecture.ppt 43

MM messages category common Specific: e.g Location Update, see Eberspächer DM_7_GSM_Protocol_Architecture.ppt 44

Call Set-Up Mobile originating and Mobile terminating DM_7_GSM_Protocol_Architecture.ppt 45

OACSU Mobile initiated call setup using late assignment (OACSU = Off Air Call Set- Up) Radio resource reserved only in last minute when call is fully routed DM_7_GSM_Protocol_Architecture.ppt 46

Realization of Short Message Services (SMS) DM_7_GSM_Protocol_Architecture.ppt 47

EXTRA DM_7_GSM_Protocol_Architecture.ppt 48

MSISDN is the directory number used to call GSM subscribers. IMSI is the main subscriber number used internally within GSM. MSRN is the routing number used on the second leg of an incoming call between GMSC and serving MSC. It is not known to GSM users. Both MSISDN and IMSI contain a country identity and a network identity Within the country. MSRN can be contained in the HLR record if the serving MSC/VLR has provided it when updating the location information. DM_7_GSM_Protocol_Architecture.ppt 49

HLR (1) MSISDN (2) IMSI (4) MSRN (3) MSRN Incoming Call MSISDN GMSC MSRN MSC / VLR An example of a call routing (to route an incoming call towards serving MSC) MSISDN IMSI MSRN Mobile Station ISDN Number International Mobile Subscriber Identity Mobile Station Roaming Number DM_7_GSM_Protocol_Architecture.ppt 50

Protocols in the call control producers MAP/D HLR MS RIL3-CC MSC/VLR MAP/C GMSC RIL3-CC MAP Radio Interface Layer 3 - Call Control Mobile Application Part DM_7_GSM_Protocol_Architecture.ppt 51

Format of BTSM-RSL protocol messages Format of BTSM-RSL protocol messages Layer 3 between BSC and BTS DM_7_GSM_Protocol_Architecture.ppt 52