A GSM network is a most sophisticated and complex wireless network. It was designed for a purpose from scratch and is neither based on nor compatible with any predecessor technologies. In fact, it is the basis for future wireless networks such as GPRS, EDGE, and 3G.
A GSM network comprises several distinct functional entities:
■ Mobile station
■ Base station subsystem (BSS)
■ Network switching system (NSS)
■ Operation and support subsystem (OMC)
Figure 3-1 GSM network architecture.
Figure 3-1 shows a typical GSM network and its components.
The mobile stations talk to the BSS over the RF interface. The BSS consists of the base transceiver station (BTS) and base station controller (BSC). The BSS is responsible for management of connections on the radio path and handovers. The NSS consists of a mobile switching center (MSC) and databases. The NSS is responsible for management of subscriber mobility, interfacing with PSTN/other PLMNs, and end-to-end call control. The OMC supports network operators to manage the BSS and the NSS equipment. It includes fault, performance, and configuration management.
Mobile station
A mobile station (MS) consists of the mobile equipment (ME) and the subscriber identity module (SIM) as shown in Figure 3-2. The mobile equipment is a complex hardware device. The functionality includes radio transmitter/receiver, gaussian minimum shift keying (GMSK) modulation and demodulation, coding/decoding, and DTMF generation.
Figure 3-2 Mobile station components.
The firmware includes control logic, protocol stack for Call processing/ control, and mobility management. The international mobile equipment number (IMEI) uniquely identifies mobile equipment. The IMEI is burned within the module.
In today’s environment, many of the commercially available MEs are capable of supporting multiple bands, i.e., 900, 1800, and 1900 MHz. This means these devices can be used almost universally.
The ME device, as such, does not have any subscriber information. As a stand-alone device, it cannot be used to make a call, with the exception of emergency calls. The subscriber identity module (SIM) is a smart card. The wireless service provider programs it with the subscription data. The SIM is used to store data related to PLMN (e.g., HPLMN country and network code), subscription (e.g., IMSI, MSISDN), roaming (forbidden networks, etc.), and security (PIN, PUK, etc). In addition, it can also store subscriber data such as SMS and phone numbers.
Mobile station identities
International mobile station equipment identity (IMEI). Every mobile equipment has a unique identifier, i.e., an international mobile station equipment identity (IMEI). The IMEI identifies the mobile equipment and not the subscriber. The IMEI is embedded within the hardware and cannot be changed.
The purpose of IMEI is to protect the mobile equipment from stealth. The wireless service providers maintain a list of all stolen MEs in a database (i.e., equipment identity register) and may deny services to such mobile equipment if they wish to.
As shown in Figure 3-3, the IMEI consists of:
Type approval code (TAC). This code is 6 digits/24 bits long. The TAC is issued by an authorized agency on successful testing for type approval.
Figure 3-3 IMEI format.
Final assembly code (FAC). This code is 2 digits/8 bits long. This uniquely identifies the manufacturer of the mobile equipment.
Serial number (SNR). Each mobile equipment is identified with a unique serial number within a TAC and FAC. The SNR is 6 digits/24 bits long.
The remaining 1 digit/4 bits are not currently used and are a "spare."
Mobile station ISDN number (MSISDN). Each subscriber in a network is identified with a unique international number, i.e., a mobile station ISDN number. The wireless service provider assigns this number at the time of subscription. The format for the MSISDN is defined in the ITU-T E.164 recommendation. As shown in Figure 3-4, MSISDN is of variable length but limited to a maximum of 15 digits excluding prefixes.
Country code (CC). Country codes are defined by the ITU-T. They can be 1 to 3 digits long. For example, the country code for the United States is 1, Japan is 81, and Ecuador is 593.
National destination code (NDC). The country’s telecommunication regulatory authority assigns an NDC to each PLMN. One PLMN may have more than one NDC assigned to it. This field may be 2 to 3 digits.
Subscriber number (SN). The SN is a variable-length field.
The MSISDN number with national or international prefixes is used to call a subscriber. Figure 3-5 illustrates the dialing sequence if a subscriber in India calls a mobile subscriber registered in the Celcom network in Malaysia.
Figure 3-4 MSISDN format.
Figure 3-5 International dialing using MSISDN.
International mobile subscriber identity (IMSI). International mobile subscriber identity (IMSI) is a unique identifier for a GSM subscriber in a PLMN. It is stored in the SIM and also in the HLR as part of the subscriber data. The HLR transfers IMSI information to the serving VLR on registration for temporary storage. ITU-T Recommendation E.212 defines the structure of the IMSI.
As shown in Figure 3-6, IMSI is 15 digits long and consists of MCC, MNC, and MSIN.
Mobile country code (MCC). ITU-T E.212, Annexure-A, lists all the countries and assigned codes. The MCC is 3 digits long. For example, the MCC for Australia is 505, Germany is 262, and the United States is 310.
Mobile network code (MNC). Each PLMN in a country is assigned a unique network code by a regulatory authority in the country. The MNC is 2 digits long. For example, in Singapore the assigned code for Singtel is 01, M1 is 03, and Starhub is 05.
Mobile subscriber identification number (MSIN). The MSIN is a unique number within a PLMN to identify the subscriber.
Figure 3-6 E.212 IMSI format.
Mobile station—temporary identities. In addition to MS identities described in the section, "Mobile station identities," the network assigns temporary identities to the MS during call processing to ensure security and facilitate roaming.
Temporary mobile subscriber identity. The temporary mobile subscriber identity (TMSI) is used in place of IMSI on the air interface to prevent a possible intruder from tracking a mobile subscriber. The IMSI is used only in cases where TMSI is not assigned, e.g., for initial registration while roaming in the other PLMN. The network assigns TMSI to all active subscribers. The TMSI is stored in the VLR along with the IMSI. The network may reallocate the TMSI during location update and call processing. On the network side, the VLR is responsible for TMSI management, i.e., assignment, storage, updating, and mapping with other identities. On the MS side, the TMSI is stored in SIM card. TMSI has only local significance within the serving MSC/VLR area. The network providers themselves decide the format of TMSI. However, the recommended length is four octets or less.
Mobile station roaming number. The mobile station roaming number (MSRN) is used during the mobile terminating call setup. This is a temporary identifier assigned by the VLR to a MS roaming in its serving area to facilitate call routing. The VLR manages the assignment and the reallocation of MSRN. As described in Section 3.6, under "Mobile Terminated Call," the VLR assigns the MSRN when a send routing information request is received from the HLR. The HLR then returns the MSRN to the GMSC, which uses it to route the call. This MSRN assignment is valid only during call setup and is released as soon as the call is established.
Figure 3-7 shows the format of the MSRN as defined by the GSM Recommendation. It consists of three parts:
Country code (CC). Country codes are defined by the ITU-T. It can be 1 to 3 digits. For example, the country code for the United States is 1, Japan is 81, and Ecuador is 593.
Figure 3-7 MSRN format.
National destination code (NDC). The country’s telecommunication regulatory authority assigns the NDC to each PLMN. One PLMN may have more than one NDC assigned to it. This field may be 2 to 3 digits.
Subscriber number (SN). The SN is a variable-length field. In this case, this is a temporary subscriber number assigned by the serving MSC/VLR to an MS roaming in its coverage area.
Base station subsystem
As shown in Figure 3-1, the Base Station Subsystem (BSS) provides a connection between the MS and the GSM network via the air interface. It consists of two main functional entities.
■ Base transceiver station (BTS)
■ Base station controller (BSC)
Base station transceiver. The BTS contains the radio transceivers and antennas that provide radio interface to and from the Mobile Station. It defines the cell and handles radio link level protocols with the MS. The BTS can be considered as a counterpart of the MS within a GSM network. Each BTS may have up to 16 transceivers, each of which is allocated a different RF channel. The number of transceivers depends on the traffic-handling requirements in a particular cell. A number of BTSs are deployed in a network to achieve desired coverage. A BTS is usually installed at the center of a cell. The size of a cell is determined by the transmitting power of a BTS. The main tasks of a BTS include the following:
■ Channel coding and decoding: speech, data, signaling
■ Speech coding: half and full rate
■ Ciphering
■ GMSK modulation and demodulation
■ Frequency hopping
■ Time and frequency synchronization
■ Timing advance and power control
■ Radio link measurements and management
■ Operation and maintenance
Base station controller. As the name implies, the BSC monitors and controls one or more base stations. The number of BTSs controlled by a BSC varies, depending on the technology adopted by a particular manufacturer. It provides a number of functions related to radio resources management (RRM) and mobility management (MM). The BSC connects with the BTS using the Abis interface, a description of which is given in the next section. The main tasks of a BSC include:
■ Frequency administration
■ Time and frequency synchronization
■ Time delay measurements
■ Handovers
■ Power management
■ Operation and maintenance
The same vendor usually supplies the BTS and BSC. This is because the BTS implementation is vendor specific. No standards are available for the internal design of a BTS.
Identities associated with the BSS
Location area identity. The PLMN is divided into one or more location areas (LAs). Each location area consists of one or more BTSs. The purpose of defining an LA is to optimize paging efficiency and location area updates. A mobile station moving from one cell to another in the same LA does not need to update its location. Also, if the network needs to contact the MS, it transmits only the paging message belonging to cells of the last known LA.
Each location area is identified by a unique location area identity (LAI). The format of an LAI is defined by the GSM Recommendations. Figure 3-8 shows the format and structure of an LAI.
Mobile country code (MCC). ITU-T E.212, Annexure A, lists all the countries and assigned codes. The MCC is 3 digits long. For example, the MCC for Australia is 505, Germany is 262, and the United States is 310.
Mobile network code (MNC). Each PLMN in a country is assigned a unique network code by the country’s regulatory authority. The MNC is 2 digits long.
Figure 3-8 Location area identity.
For example, in Singapore the assigned code for Singtel is 01, M1 is 03, and Starhub is 05.
Location area code (LAC). LAC identifies a location area within a GSM PLMN. It is 4 digits/16 bits long.
Cell global identity. Each cell within a PLMN is assigned a 4-digit/16 bit code, which is known as the cell identity (CI). To make it distinct and unique on global basis, GSM Recommendations define cell global identity (CGI). The CGI (Figure 3-9) is a unique identifier of a cell within a location area. It is a combination of LAI and cell identity.
