5 Network aspects

References: [Aud88, Rah93, Che91, Bal91, Bal93]

Ensuring the transmission of voice or data of a given quality over the radio link is only half the problem in a cellular mobile network. The fact that the geographical area covered by the network is divided into cells necessitates the implementation of a handover mechanism. Also, the fact that the mobile can roam nationally and internationally in GSM requires that registration, authentication, call routing and location updating functions exist in the GSM network.


The signalling protocol in GSM is structured in three layers [Rah93, Aud88], shown in Figure 3. Layer 1 is the physical layer, which uses the channel structures discussed above. Layer 2 is the data link layer. Across the Um interface, the data link layer uses a slight modification of the LAPD protocol used in ISDN, called LAPDm. Across the A interface, the lower parts of Signalling System Number 7 are used. Layer 3 is subdivided into 3 sublayers.

Radio Resources Management
controls the setup, maintenance, and termination of radio channels

Mobility Management
manages the location updating, handovers, and registration procedures, discussed below

Connection Management
handles general call control, similar to CCITT Recommendation Q.931, and provides supplementary services.
Signalling between the different entities in the network, such as between the HLR and VLR, is accomplished throught the Mobile Application Part (MAP). Application parts are the top layer of Signalling System Number 7. The specification of the MAP is complex. It is one of the longest documents in the GSM recommendations, said to be over 600 pages in length [Che91].

Described below are the main functions of the Mobility Management sublayer.

5.1 Handover

Handover, or handoff as it is called in North America, is the switching of an on­going call to a different channel or cell. There are four different types of handover in the GSM system, which involve transferring a call between
channels (time slots) in the same cell,

cells (Base Transceiver Stations) under the control of the same Base Station Controller (BSC),

cells under the control of different BSCs, but belonging to the same Mobile services Switching Center (MSC), and

cells under the control of different MSCs.
The first two types of handover, called internal handovers, involve only one Base Station Controller (BSC). To save signalling bandwidth, they are managed by the BSC without involving the Mobile service Switching Center (MSC), except to notify it at the completion of the handover. The last two types of handover, called external handovers, are handled by the MSCs involved. Note that call control, such as provision of supplementary services and requests for further handoffs, is handled by the original MSC.
Handovers can be initiated by either the mobile or the MSC (as a means of traffic load balancing). During its idle time slots, the mobile scans the Broadcast Control Channel of up to 16 neighboring cells, and forms a list of the six best candidates for possible handover, based on the received signal strength. This information is passed to the BSC and MSC, and is used by the handover algorithm.

The algorithm for when a handover decision should be taken is not specified in the GSM recommendations. There are two basic algorithms used, both closely tied in with power control. This is because the BSC usually does not know whether the poor signal quality is due to multipath fading or to the mobile having moved to another cell. This is especially true in small urban cells.

The 'minimum acceptable performance' algorithm [Bal91] gives precedence to power control over handover, so that when the signal degrades beyond a certain point, the power level of the mobile is increased. If further power increases do not improve the signal, then a handover is considered. This is the simpler and more common method, but it creates 'smeared' cell boundaries when a mobile transmitting at peak power goes some distance beyond its original cell boundaries into another cell.

The 'power budget' method [Bal91] uses handover to try to maintain or improve a certain level of signal quality at the same or lower power level. It thus gives precedence to handover over power control. It avoids the 'smeared' cell boundary problem and reduces co­channel interference, but it is quite complicated.

5.2 Location updating and call routing

References: [MJ94, Rah93, DS93]

The MSC provides the interface between the GSM mobile network and the public fixed network. From the fixed network's point of view, the MSC is just another switching node. However, switching is a little more complicated in a mobile network since the MSC has to know where the mobile is currently roaming - and in GSM it could even be roaming in another country. The way GSM accomplishes location updating and call routing to the mobile is by using two location registers: the Home Location Register (HLR) and the Visitor Location Register (VLR).

Location updating is initiated by the mobile when, by monitoring the Broadcast Control Channel, it notices that the location­area broadcast is not the same as the one previously stored in the mobile's memory. An update request and the IMSI or previous TMSI is sent to the new VLR via the new MSC. A Mobile Station Roaming Number (MSRN) is allocated and sent to the mobile's HLR (which always keeps the most current location) by the new VLR. The MSRN is a regular telephone number that routes the call to the new VLR and is subsequently translated to the TMSI of the mobile. The HLR sends back the necessary call­control parameters, and also sends a cancel message to the old VLR, so that the previous MSRN can be reallocated. Finally, a new TMSI is allocated and sent to the mobile, to identify it in future paging or call initiation requests.


With the above location­updating procedure, call routing to a roaming mobile is easily performed. The most general case is shown in Figure 4 [Aud88], where a call from a fixed network (Public Switched Telecommunications Network or Integrated Services Digital Network) is placed to a mobile subscriber. Using the Mobile Subscriber's telephone number (MSISDN, the ISDN numbering plan specified in the ITU­T E.164 recommendation), the call is routed through the fixed land network to a gateway MSC for the GSM network (an MSC that interfaces with the fixed land network, thus requiring an echo canceller). The gateway MSC uses the MSISDN to query the Home Location Register, which returns the current roaming number (MSRN). The MSRN is used by the gateway MSC to route the call to the current MSC (which is usually coupled with the VLR). The VLR then converts the roaming number to the mobile's TMSI, and a paging call is broadcast by the cells under the control of the current BSC to inform the mobile.

5.3 Authentication and security

References: [DS93, FR93, LM92]

Since the radio medium can be accessed by anyone, authentication of users to prove that they are who they claim to be, is a very important element of a mobile network. Authentication involves two functional entities, the SIM card in the mobile, and the Authentication Center (AC). Each subscriber is given a secret key, one copy of which is stored in the SIM card and the other in the Authentication Center. During authentication, the AC generates a random number that it sends to the mobile. Both the mobile and the AC then use the random number, in conjuction with the subscriber's secret key and a ciphering algorithm called A3, to generate a number that is sent back to the AC. If the number sent by the mobile is the same as the one calculated by the AC, the subscriber is authenticated.

The above calculated number is also used, together with a TDMA frame number and another ciphering algorithm called A5, to encipher the data sent over the radio link, preventing others from listening in. Enciphering is an option for the very paranoid, since the signal is already coded, interleaved, and transmitted in a TDMA manner, thus providing protection from all but the most persistent and dedicated eavesdroppers.

Another level of security is performed on the mobile equipment, as opposed to the mobile subscriber. As mentioned earlier, each GSM terminal is identified by a unique International Mobile Equipment Identity (IMEI) number. A list of IMEIs in the network is stored in the Equipment Identity Register (EIR). The status returned in response to an IMEI query to the EIR is one of the following:

white­listed
The terminal is allowed to connect to the network
grey­listed
Under observation from the network, possible problems
black­listed
The terminal has either been reported as stolen, or it is not type approved (the correct type of terminal for a GSM network). The terminal is not allowed to connect to the network.
6 Conclusion and comments
References: [Mal88]
In this paper I have tried to give an overview of the GSM system. As with any overview, and especially one covering a standard 8000 pages long, there are many details missing. I believe, however, that I gave the general flavor of GSM and the philosophy behind its design. It was a monumental task that the original GSM committee undertook, and one that has proven a success, showing that international cooperation on such projects between academia, industry, and government can succeed. It is a standard that ensures interoperability without stifling competition and innovation among suppliers, to the benefit of the public both in terms of cost and service quality. For example, by using Very Large Scale Integration (VLSI) microprocessor technology, many of functions of the mobile station can be built in one chipset, resulting in lighter, smaller, and more energy­efficient terminals.

Telecommunications are evolving towards personal communication networks, whose objective can be stated as the availability of all communication services anytime, anywhere, to anyone, by a single identity number and a pocketable communication terminal [Win93]. Having a multitude of incompatible systems throughout the world moves us farther away from, not closer to, this ideal. The economies of scale created by a unified system are enough to justify its implementation, not to mention the convenience to people of carrying just one communication terminal anywhere they go, regardless of national boundaries.

The GSM system, and its twin system operating at 1800 MHz, called DCS1800, are a first approach at a true personal communication system. The SIM card is a novel approach that implements personal mobility in addition to terminal mobility. Together with international roaming, and support for many other services such as data transfer, fax, Short Message Service, and supplementary services, in addition to telephony, GSM comes close to fulfilling the requirements for a personal communication system: close enough that it is being used as a basis for the next generation of communication technology in Europe.

Another point where GSM has shown its commitment to openness, standards and interoperability is the compatibility with the Integrated Services Digital Network (ISDN) that is evolving in most industrialized countries, and Europe in particular (the so­called Euro­ISDN). GSM is the first system to make extensive use of the Intelligent Networking concept in ISDN, in which services like 800 numbers are concentrated and handled from a few centralized service centers, instead of being distributed over every switching center in the country. This is the concept behind the use of the various registers such as the HLR. In addition, the signalling between these functional entities uses Signalling System Number 7, an international standard already used in many countries and specified for ISDN.

GSM is a very complex standard, but that is probably the price that must be paid to achieve the level of integrated service and quality offered while subject to the fairly severe restrictions imposed by the radio environment.


--------------------------------------------------------------------------------
Copyright 1994 by John Scourias, jscourias@barrow.uwaterloo.ca.