Evolution of Mobile

Earlier in 1946 1st mobile telephone system known as Mobile Telephone

System(MTS) was introduced in 25 cities of US. Mobile transceivers of
MTS were very big & carried by vehicles. It is a Half-Duplex system.

Limitations were manual switching of calls & limited no. of channels

were available.
Dr Martin Cooper, a Motorola researcher and
executive made the first phone call from a
handheld mobile phone on April 3, 1973.
In 1960 direct dialing from car phones became
possible with Improved Mobile Telephone
Service (IMTS), which also increased the
number of radio channels available for calls.
Analog Cellular Telephony
• As IMTS uses the spectrum inefficiently .
• The first generation of cellular networks uses multiple cell
tower sites, each connected through a network, allowed users
to travel and even switch cell towers during a call. It was the
first being built in Chicago in 1977 Known as the Analog
Mobile Phone System (AMPS) built by AT&T .
Digital Cellular Telephony
• Data is represented digitally which is done by
using an analog to digital converter.

• Digitized data can be easily encrypted.

• 2G systems support for messaging services, caller

identification.
 GSM
Global System for Mobile Communications
(GSM) is a second generation cellular
standard developed to provide voice services
and data delivery using digital modulation.
 GSM
• Developed by Group Special Mobile (founded 1982)
which was an initiative of CEPT ( Conference of
European Post and Telecom )

• GSM have 124 duplex channels, each 200Khz wide, are

used for FDMA.

• GSM offer data rates of up to 9.6Kbps.

 GSM Developments
GSM 900
•Mobile to BTS (uplink): 890-915 Mhz
•BTS to Mobile(downlink):935-960 Mhz

GSM 1800 (DCS –Digital Cellular System)

•Mobile to BTS (uplink): 1710-1785 Mhz
•BTS to Mobile(downlink) 1805-1880 Mhz

GSM 1900 (PCS –Personal Communication Service)

•Mobile to BTS (uplink): 1850-1910 Mhz
•BTS to Mobile(downlink) 1930-1990 Mhz
 GSM Subscriber Services
• Dual-Tone Multi Frequency (DTMF): It is a tone signaling scheme
used for remote control of an answering machine. GSM supports full-
originating DTMF.

• Facsimile group III: As standard fax machines are designed to be

connected to a telephone using analog signals, a special fax converter
connected to the exchange is used in the GSM system.

• Short Message Services: A message consisting of a maximum of 160

alphanumeric characters can be sent to or from a mobile station.
 GSM Subscriber Services
• cell broadcast: A variation of the short message service is the cell broadcast
facility. A message of a maximum of 93 characters can be broadcast to all
mobile subscribers in a certain geographic area.

• voice mail: Calls can be forwarded to the subscriber's voice-mail box and
the subscriber checks for messages via a personal security code.

• fax mail: With this service, the subscriber can receive fax messages at any
fax machine.
GSM provides three different categories of services:

•Tele-services
•Bearer or Data Services
•Supplementary services
 Tele Services
• Telecommunication services that enable voice
communication via mobile phones
• Offered services
- Mobile telephony
- Emergency calling
 Bearer Services
• Include various data services for information transfer between GSM
and other networks like PSTN, ISDN etc at rates from 300 to 9600
bps
• Short Message Service (SMS)
– up to 160 character alphanumeric data transmission
to/from the mobile terminal
• Unified Messaging Services(UMS)
• Voice mailbox
• Electronic mail
Supplementary Services
Call related services :
•Call Waiting-Notification of an incoming call while on the handset
•Call Hold-Put a caller on hold to take another call
•Call Barring-All calls, outgoing calls, or incoming calls
•Call Forwarding-Calls can be sent to various numbers defined by the user
•Multi Party Call Conferencing -Link multiple calls together
•CLIP –Caller line identification presentation
•CLIR –Caller line identification restriction
•CUG –Closed user group
 GSM System Architecture
A GSM system consists of three subsystems
1.Radio Sub System (RSS)
2.Network & Switching Subsystem (NSS)
3.Operation Sub System (OSS).
1. Radio Subsystem (RSS): The radio subsystem (RSS) comprises all
radio specific entities like mobile stations (MS) and base station
subsystem (BSS). The A interface connects NSS and RSS and O
interface connects NSS and OSS.
• Base station subsystem (BSS): A GSM network comprises many
BSSs, each controlled by a base station controller (BSC). The BSS
performs all functions necessary to maintain radio connections to an
MS, coding/decoding of voice, and rate adaptation to/from the
wireless network part. BSS contains several BTSs.
• Base transceiver station (BTS): A BTS comprises all radio equipment, i.e., antennas, signal processing,
amplifiers necessary for radio transmission. A BTS is connected to MS via the Um interface and to the
BSC via the Abis interface. The Um interface contains all the mechanisms necessary for wireless
transmission (TDMA, FDMA etc.). A group of BTS’s are controlled by an BSC.

• Base station controller (BSC): The BSC basically manages the BTSs. It reserves radio frequencies,
handles the handover from one BTS to another within the BSS, and performs paging of the MS. BSC
multiplexes the radio channels

• Mobile station (MS): An MS consists of user independent hardware, software and of the subscriber
identity module(SIM), which stores all user-specific data that is relevant to GSM. The SIM card
contains many identifiers and tables, such as card-type, serial number, a list of subscribed services, a
personal identity number (PIN), a PIN unblocking key (PUK).
2. Network and switching subsystem:
• The NSS connects the wireless network with standard public networks, performs handovers
between different BSSs, comprises functions for worldwide localization of users and supports
charging, accounting, and roaming of users between different providers in different countries.

• Mobile services switching center (MSC): They set up connections to other MSCs and to the
BSCs via the A interface, and form the fixed backbone network of a GSM system. Typically, an
MSC manages several BSCs in a geographical region. A gateway MSC (GMSC) has additional
connections to other fixed networks, such as PSTN and ISDN. Using additional interworking
functions (IWF), an MSC can also connect to public data networks (PDN) such as X.25. An MSC
handles all signaling needed for connection setup, connection release and handover of
connections to other MSCs. The standard signaling systemNo. 7 (SS7) is used for this purpose.
• Home location register (HLR): It is the database in a GSM system as it stores all user-
relevant information like mobile subscriber ISDN number (MSISDN), subscribed
services e.g., call forwarding, roaming restrictions, GPRS, and the international mobile
subscriber identity (IMSI). Dynamic information is also needed, e.g., the current
location area (LA) of the MS, the mobile subscriber roaming number (MSRN).

• Visitor location register (VLR): The VLR associated to each MSC is a dynamic database
which stores all important information needed for the MS users currently in the LA
that is associated to the MSC e.g., IMSI, MSISDN, HLR address. If a new MS comes into
an LA the VLR is responsible to copy all relevant information for this user from the
HLR.
3. Operation subsystem:
• The third part of a GSM system, the operation subsystem (OSS), contains the necessary
functions for network operation and maintenance.

• Operation and maintenance center (OMC): The OMC monitors and controls all other network
entities via the O interface. Typical OMC management functions are traffic monitoring, status
reports of network entities, subscriber and security management, or accounting and billing.

• Authentication centre (AuC): As the radio interface and mobile stations are particularly
vulnerable, a separate AuC has been defined to protect user identity and data transmission.
The AuC contains the algorithms for authentication as well as the keys for encryption and
generates the values needed for user authentication in the HLR.
• Equipment identity register (EIR): The EIR is a database for all IMEIs,
i.e., it stores all device identifications registered for this network. As
MSs are mobile, they can be easily stolen. With a valid SIM, anyone
could use the stolen MS. The EIR has a blacklist of stolen (or locked)
devices.
 Radio interface
The Um interface comprises of many mechanisms. GSM implements
SDMA using cells with BTS and assigns MS to a BTS. Furthermore, FDD is
used to separate downlink and uplink.
The following example is based on the GSM 900 system, but GSM works in a
similar way at 1800 and 1900 MHz the Figure also shows the TDM used.
Two types of channels
Physical channel: channel defined by specifying both, a carrier
frequency and a TDMA timeslot number.

Logic channel: logical channels are multiplexed into the physical

channels. Each logic channel performs a specific task. Consequently
the data of a logical channel is transmitted in the corresponding
timeslots of the physical channel. During this process, logical channels
can occupy a part of the physical channel or even the entire channel.
Logical channels and frame hierarchy
There are two different types of logical channel within the GSM
system: Traffic channels (TCHs), Control channels (CCHs).
• Traffic Channels: Traffic channels carry user information such as
encoded speech or user data. Traffic channels are defined by using a
26-frame multiframe.
Two general forms are defined
i. Full rate traffic channels (TCH/F), at a gross bit rate of 22.8 kbps
(456bits / 20ms)
ii. Half rate traffic channels (TCH/H), at a gross bit rate of 11.4 kbps.
Uplink and downlink are separated by three slots (bursts) in the 26-
multiframe structure.
Control Channels: Control channels carry system signalling and synchronisation data for
control procedures such as location registration, mobile station synchronisation, paging,
random access etc. between base station and mobile station. Three categories of control
channel are defined: Broadcast, Common and Dedicated. Control channels are multiplexed
into the 51-frame multiframe.

•Broadcast control channel (BCCH): A BTS uses this channel to signal information to all MSs
within a cell like the cell identifier, frequency hopping & frequencies available inside the
cell & in neighboring cells. The BTS sends information for frequency correction via the
frequency correction channel (FCCH) and information about time synchronization via the
synchronization channel (SCH), where both channels are sub channels of the BCCH.
•Common control channel (CCCH): All information regarding connection setup between MS
and BS is exchanged via the CCCH. For calls toward an MS, the BTS uses the paging channel
(PCH) for paging the appropriate MS. If an MS wants to set up a call, it uses the random
access channel (RACH) to send data to the BTS. The BTS uses the access grant channel
(AGCH) to signal an MS that it can use a TCH or SDCCH for further connection setup.
• Dedicated control channel (DCCH): It is bidirectional channel. As long as an
MS has not established a TCH with the BTS, it uses the stand-alone dedicated
control channel (SDCCH) with a low data rate (782 bit/s) for signaling. This can
comprise authentication, registration or other data needed for setting up a TCH.
• Each TCH and SDCCH has a slow associated dedicated control channel (SACCH)
associated with it, which is used to exchange system information, such as the
channel quality and signal power level.
• Finally, if more signaling information needs to be transmitted and a TCH already
exists, GSM uses a fast associated dedicated control channel (FACCH). The FACCH
uses the time slots which are otherwise used by the TCH. This is necessary in the
case of handovers where BTS and MS have to exchange larger amounts of data in
less time.
 Protocols

Protocol Architecture for signaling

• Layer 1, the physical layer, handles all radio-specific functions. This includes the
creation of bursts, multiplexing of bursts into a TDMA frame, synchronization with
the BTS, detection of idle channels, and measurement of the channel quality on
the downlink. The physical layer at Um uses GMSK for digital modulation and
performs encryption/decryption of data.

• LAPDm(link access procedure for the D-channel) protocol has been defined at the
Um interface for layer two. LAPDm is a lightweight LAPD because it does not need
synchronization flags or check summing for error detection. LAPDm offers reliable
data transfer over connections, re-sequencing of data frames, and flow control.

• The lowest sub-layer is the radio resource management (RR). The main tasks of RR
are setup, maintenance, and release of radio channels. RR also directly accesses
the physical layer for radio information and offers a reliable connection to the next
higher layer. The functions of RR’ are supported by the BSC via the BTS
management (BTSM).
• Mobility management (MM) contains functions for registration,
authentication, identification, location updating, and the provision of a
temporary mobile subscriber identity (TMSI) that replaces the international
mobile subscriber identity (IMSI) and which hides the real identity of an MS
user over the air interface.

• Finally, the call management (CM) layer contains three entities: call control
(CC), short message service (SMS), and supplementary service (SS). SMS
allows for message transfer using the control channels SDCCH and SACCH.

• Signaling system No. 7 (SS7) is used for signaling between an MSC and a
BSC. This protocol also transfers all management information between
MSCs, HLR, VLRs, AuC, EIR, and OMC. An MSC can also control a BSS via a
BSS application part (BSSAP).
 Localization and Calling
The fundamental feature of the GSM system is the automatic, worldwide
localization of users for which, the system performs periodic location updates.

The HLR always contains information about the current location and the VLR
currently responsible for the MS informs the HLR about the location changes.

Changing VLRs with uninterrupted availability is called roaming. Roaming can

take place within a network of one provider, between two providers in a
country and also between different providers in different countries.
 To locate and address an MS, several numbers are
needed:

• Mobile station international ISDN number (MSISDN):- The only important

number for a user of GSM is the phone number. This number consists of
the country code (CC), the national destination code (NDC) and the
subscriber number (SN).
• International mobile subscriber identity (IMSI): GSM uses the IMSI for
internal unique identification of a subscriber. IMSI consists of a mobile
country code (MCC), the mobile network code (MNC), and finally the
mobile subscriber identification number (MSIN).
• Temporary mobile subscriber identity (TMSI): To hide the IMSI, which would
give away the exact identity of the user signalling over the air interface, GSM
uses the 4 byte TMSI for local subscriber identification.

• Mobile station roaming number (MSRN): Another temporary address that

hides the identity and location of a subscriber is MSRN. The VLR generates
this address on request from the MSC, and the address is also stored in the
HLR. MSRN contains the current visitor country code (VCC), the visitor
national destination code (VNDC), the identification of the current MSC
together with the subscriber number. The MSRN helps the HLR to find a
subscriber for an incoming call.
For a mobile terminated call (MTC), the following figure
shows the different steps that take place:
step 1: User dials the phone number of a GSM subscriber.
step 2: The fixed network (PSTN) identifies the number belongs to a user in GSM network and forwards the call
setup to the Gateway MSC (GMSC).
step 3: The GMSC identifies the HLR for the subscriber and signals the call setup to HLR
step 4: The HLR checks for number existence and its subscribed services and requests an MSRN from the current
VLR.
step 5: VLR sends the MSRN to HLR
step 6: Upon receiving MSRN, the HLR determines the MSC responsible for MS and forwards the information to the
GMSC
step 7: The GMSC can now forward the call setup request to the MSC indicated
step 8: The MSC requests the VLR for the current status of the MS
step 9: VLR sends the requested information
step 10: If MS is available, the MSC initiates paging in all cells it is responsible for.
step 11: The BTSs of all BSSs transmit the paging signal to the MS
step 12: Step 13: If MS answers, VLR performs security checks
step 15: Till step 17: Then the VLR signals to the MSC to setup a connection to the MS
For a mobile originated call (MOC), the following steps
take place:
step 1: The MS transmits a request for a new connection
step 2: The BSS forwards this request to the MSC
step 3: Step 4: The MSC then checks if this user is allowed to set up a
call with the requested and checks the availability of resources
through the GSM network and into the PSTN. If all resources are
available, the MSC sets up a connection between the MS and the
fixed network.