Overview Of The GSM System and Protocol Architecture

GSM and PCNsOverview Of The GSM Systemand Protocol ArchitectureWe can use GSM as a basic framework to define and developthe standards for handling the mobility-specific functions ofnext-generation PCNs.Moe RahnemaGlobal system for mobile telecommunication (GSM)are specific to cellular type personal communicationcomprises the CEPT-defined standardization of thenetworks, whatever the means of implementationservices, functional/subsystem interfaces, andmight be. protocol architecture, based on the use of worldwideIn applying and extending GSM to the next gen-standards produced by CCITT and CCIR, for a pan-eration personal communication networks, how-European digital land mobile system primarily intend-ever, one should be careful in differentiating someed to serve users in motor vehicles. The digital mobileof the implementation specifics unique to the GSMradio networks, for which GSM represents the Euro-network architecture and application from the func-pean standards, provide powerful message signal-tions and issues that would be more or less gener-ing ca pabilities that facilitate and enhanceally applicable and relevant to cellular networking.roaming, compared to the first generation analogueIt is with this point in mind that the reader shouldsystems, through automatic network location detec-view GSM as a framework or platform on whichtion and registration.to build his or her vision of how GSM may be usedGSM provides terminal mobility, with person-as a guide to design and build the next generational mobility provided through the insertion of anetworks. In that regard, a good understanding ofsubscriber identity module (SIM) into the GSM net-the GSM standards and network functions iswork (mobile station). The SIM carries the personalessential for the professional working on the nextnumber assigned to the mobile user. The GSM-basedgeneration personal communication networks. Thiscellular mobile networks are currently in widespreadarticle is intended to assist with this objective.use in Europe. At the present time, the next gen-era tion of personal communication servic esThe Cellular Concept(PCS) beyond GSM is also being considered.These third generation systems, known as univer-sal personal communication networks (PCN) will beC ellular mobile communication is based on theconcept of frequency reuse. That is, the limit-using lower power handsets to provide personaled spectrum allocated to the service is partitionedmobility to pedestrians, as well. The PCS low-powerinto, for example, N non-overlapping channelhandsets are expected to eliminate the need tosets, which are then assigned in a regular repeat-have different handsets for wide-area (cellular)ed pattern to a hexagonal cell grid. The hexagonand local (cordless) applications. The universal PCSis just a convenient idealization that approximateswill also provide a higher quality of personal-servicethe shape of a circle (the constant signal levelmobility across the boundaries of many different net-contour from an omnidirectional antenna placedworks (mobile and fixed, wide- and local-area).at the center) but forms a grid with no gaps orMany network capabilities, however, such asoverlaps. The choice of N is dependent on many trade-mobility management, user security protection, andoffs involving the local propagation environment,resource allocation, addressed in GSM, are also sometraffic distribution, and costs. The propagation envi-of the critical requirements and issues in UPC net-ronment determines the interference received fromw o r k s of the future. GSM is expected to play aneighboring co-channel cells which in turn gov-major role in the specification of the standardserns the r euse dist ance, that is, the distancefor UPC. In the United Kingdom, PCN is alreadyallowed between co-channel cells (cells using thebeing designed and deployed with close adher-same set of frequency channels).ence to the GSM standards other than the differ-The cell size determination is usually based onMOE RAHNEMA is a ent operating frequencies (GSM operates at 900the local traffic distribution and demand. The moreprincipal communicationMHz and the United Kingdom PCN operates at 1800the concentration of traffic demand in the area,engineer at Motorola SatelliteMHz). Generally, GSM may be viewed as a frame-the smaller the cell has to be sized in order to availCommunications.work for studying the functions and issues thatthe frequency set to a smaller number of roaming0163-6804/93/$03.00 1993© IEEEIEEE Communications Magazine • April 1993subscribers and thus limit the call blocking proba-bility within the cell. On the other hand, thesmaller the cell is sized, the more equipment willbe needed in the system as each cell requires the nec-essary transceiver and switching equipment,known as the base s tati on subsystem (BSS),through which the mobile users access the net-work over radio links. The degree to which theallocated frequency spectrum is reused over the cel-lular service area, however, determines the spectrumefficiency in cellular systems. That means thesmaller the cell size, and the smaller the numbersCellular network infrastructure.of cells in the reuse geometry, the higher will bethe spectrum usage efficiency. Since digital mod-throughout the world.ulation systems can operate with a smaller signalDirect links between certain “ l o c a l” M S C sto noise (i.e., signal to interference) ratio for themay also be provided to allow the communicationsame service quality, they, in one respect, would allowbetween two mobile users to bypass the telepho-smaller reuse distance and thus provide higher spec-ny network when there is considerable traffictrum efficiency. This is one advantage the digital cel-flow between the mobile users roaming in thelular provides over the older analogue cellular radioareas under the coverage of those MSCs. Thus,communication systems. The interested reader maythe communication path between any two mobilerefer to [1,2] for the details on spectrum efficien-users roaming under the coverage of two “local”cy analysis in cellular network.MSCs may or may not switch through the public tele-It is worth mentioning that the digital systems havephony network. It depends on the connectivitycommonly used sectored cells with 120-degree orprovided between the two MSCs. The MSC may alsosmaller directional antennas to further lower theconnect to public data networks (PDN), such aseffective reuse distance. This allows a smallerthe packet-switched networks, to provide the mobilesnumber of cells in the reuse pattern and makes awith access to data services.larger fraction of the total frequency spectrum avail-able within each cell. Currently, research is beingdone on implementing other enhancements suchNetwork Databases andas the use of dynamic channel assignment strate-Standardizationgies for raising the spectrum efficiency in certaincases, such as high uneven traffic distributionover cells.GSM defines a number of network databases thatare used in performing the functions of mobil-ity management and call control in a public landThe Network Infrastructuremobile network (PLMN). These elements includethe location registers consisting of the home loca-T he cellular concept of networking is based on the tion register (HLR), and the visiting location reg-superposition of a distributed star type net-i s t e r (VLR), the equipment identity register (EIR),work architecture on the existing fixed landline tele-and the authentication center (AC). The HLR main-phony communication infrastructure. The basictains and updates the mobile subscriber’s loca-network architecture is illustrated in Fig. 1. The tele-tion and his or her service profile information.phony network is used to provide not only theThe VLR maintains the same information local-communication links between a mobile user andly, where the subscriber is roaming. The VLR isa fixed landline user, but also to provide the con-defined as a stand-alone function (see following para-nectivity between the mobile users roaming in remote-graph), but is usually viewed by vendors as part ofly located cells or in the domain of mobile networksthe MSC. These registers are called service con-operated by different service providers. Thetrol points (SCP) in the terminology used in intel-BSSs, provide management of the radio resources,ligent networking (IN). The EIR is used to listand the switching between the radio channels andthe subscribers’ equipment identities, which are usedthe TDM slots on the ir connections with thefor identification of unauthorized subscriber equip-mobile switching center (MSC). MSCs link groupsment, and hence denial of service by the network.of neighboring BSSs through point-to-point land-The AC provides the keys and algorithm fo rline or microwave-based E1 trunks. The MSCmaintaining the security of subscriber identities, andacts as the nerve center of the system. It controlsfor encrypting information passed over the air inter-call signaling and processing, and coordinates theface. The MSC is equipped with a service switch-handover of the mobile connection from oneing point (SSP) module which is used to querybase stat ion to an oth er as the mobile roamsthe databases such as a location register to identi-around. Each MSC is in turn connected to thefy where a mobile subscriber is located and whatlocal public switched telephony network (PSTN,his or her service profile is, for the routing, andor ISDN) to provide the connectivity between theprocessing of calls to (or by) the subscriber.mobile and the fixed telephony users, as well as theThe GSM specifications have defined logicallynecessary global connectivity among the MSCs ofseparate functions and standard interfaces for eachthe cellular mobile network. This is intended to makeof the databases, to allow each function to be imple-it possible for any mobile user to communicatemented on a physically separate network compo-with any other mobile or fixed telephony user innent. The interfaces are specified via the mobilethe world. Thus, the global connectivity providedapplication part (MAP) that uses the transactionby the existing landline telephony infrastructurecapability applications part (TCAP) of (SS7). Theseis used to link up the cellular mobile subscribersare all elements of an IN. GSM is considered anIEEE Communications Magazine • April 1993IN application and GSM providers are consider-ing the GSM implementation as experience inI n GSM, intelligent networking.sthe radioNumbering PlanThe structure for the GSM MSIS-channels areT he numbering consists of at least one international National Calls from Within the PLMNISDN number allocated to either the mobile sub-When a local exchange (MSC) receives a call destinedscriber, if the mobile is card operated, or to the mobilefor a mobile, it queries the mobile’s HLR for the roam-based on astation, otherwise. The mobile station ISDN (MSIS-ing number of the mobile. On receipt of the MSRN,DN) conforms to the CCITT E.164 recommenda-it routes the call to the called mobile’s visiting MSC.tion, and should, in each country, comply to thatTDMA country’s ISDN numbering plan. The MSISDN num-Addressing Other Components of aber basically consists of a country code (CC), aPLMNstructure “national destination code (NDC), which speci-Other components of a PLMN, which may befies a PLMN within that country, and a subscriberaddressed for the routing of various signalingthat is number (SN). This structure is shown in Fig. 2.messages, are the MSCs, and the location regis-The MSISDN number is used for dialing by aters. If these elements are addressed from withincalling subscriber from the PSTN/ISDN, and is usedthe same PLMN, the SS7 point codes (PC) can bei m p l e m e n t e dto route the call to the gateway MSC of the GSM net-used. Otherwise, for interPLMN routing, globalwork. The GSM MSC then uses the MSISDN to inter-titles (GT) derived, for instance, from the mobileon multiplerogate the appropriate HLR for the re-routingcountry code (MCC) and the national destinationinformation required to extend the call to the mobile’scodes (NDC) are used.visiting MSC.f r e q u e n c yThe rerouting information is specified by theRadio Channel Structure in GSMmobile station roaming number (MSRN) which iss u b b a n d sobtained from the HLR and is used to progress thecall to the called mobile. The MSRN is a tempo-I n GSM, the radio channels are based on a TDMAstructure that is implemented on multiple frequency( T D M A /rary number, allocated by the VLR (associated withsubbands (TDMA/FDMA). Each base station isthe mobile’s visiting MSC) and sent to the mobile’sequipped with a certain number of these preassignedHLR either on location update (discussed in afrequency/time channels.F D M A ) .later section) or on a per call basis. The MSRNCEPT has made available two frequency bandshas the same structure as the MSISDN numbersto be used by the GSM system. These are: 890-915in the visiting location area where it is allocated.MHz for the direction mobile to base station, andFor provision of mobile packet data services, a935-960 MHz for the direction base station tomobile international data number conforming tomobile terminal. These bands are divided intoCCITT recommendation X.121 may be specified.124 pairs of carriers spaced by 200 kHz, starting withGSM recommendation 03.70 discusses the require-the pair 890.2 MHz. Each cell site has a fixedments for the numbering interworking functionsassignment of a certain number of carriers, rang-required in this case.ing from only one to usually not more than 15c h a n n e l s.The cell ranges in size from 1 to several km.Addressing and Call RoutingThe assigned spectrum of 200 kHz per chan-The MSISDN number is used for the routing ofnel is segmented in time by using a fixed alloca-calls within the PSTN/ISDN networks. The detailstion, time-division multiple access (TDMA) scheme.of call routing requ irements are discussed inThe time axis is divided into eight time slots ofGSM rec omm end ation 03.04. The followinglength 0.577 ms. The slots numbered from timeparagraphs provide a summary discussion of pos-slot 0 to 7 form a frame with length 4.615 ms. T h esible scenarios involved in call routing.recurrence of one particular time slot in eachframe makes up one physical channel.National Calls from the Fixed NetworkThe TDMA scheme uses a gross bit rate of aboutA local or transit exchange, when receiving a call270 kb/s (with a Gaussian minimum shift keyingdestined for a mobile, recognizes the NDC, andmodulation, GMSK) and requires sophist i c a t e droutes the call to a gateway MSC. The gatewayadaptive receiver techniques to cope with the t r a n s-MSC performs the HLR query for the MSRN,mission problems caused by multipath fading.T h ewhich it then uses to reroute the call.TDMA factor of 8 in combination with a carrierspacing of 200 kHz would correspond to the earli-International Calls from the Fixeder analog system using single-channel per-carrier w i t hNetworka 25 kHz carrier spacing. The GSM digital syst e mWhen a local or transit exchange receives an inter-allowed operation at lower carrier to interferencenational call and recognizes the international pre-(C/I) ratio by using the gains provided by digital voicefix, it routes the call to the nearest ISC. The ISCcompression along with channel coding (powerfulrecognizes that the NDC indicates a PLMN. If it canerror correction). The reduced C/I ratio in turnsupport HLR query (i.e., if it has TCAP signalingallowed the use of shorter channel reuse dis-connectivity to the HLR) it queries the HLR andtances to achieve spectrum efficiencies competi-receives the called subscriber’s roaming number andtive to that achieved by the analog systems.routes the call to the visiting MSC. If not, it routesThe TDMA structure is applied in both the for-the call to the ISC of the home PLMN of thew a r d (base station to mobile) and the reverse ( m o b i l ecalled subscriber.to base station) directions. The numbering, however,is staggered by three time slots, to prevent the mobilestation from transmitting and receiving at theIEEE Communications Magazine • April 1993same time. These time slots are used to carryCCCH — Common control channels are used foruser, and signaling or control information intransferring signaling information between allCo m m o nb u r s t s . The bursts are slightly shorter than themobiles and the BSS for call origination and call-slots, namely .546 ms, to allow for burst timing align-paging functions. There are three common con-ment errors, delay dispersion on the propagationtrol channels:control path, and for smooth switch on/off of the transmitter.• PCH: paging channel used to call (p a ge) a mobileGSM defines a variety of traffic and signal-from the system.channels areing/control channels of different bit rates. These• RACH: random access channel used by the mobileschannels are assigned to logical channels derivedtrying to access the system. The mobiles usefrom multiframe structuring of the basic eightthe slotted Aloha scheme over this channel forused forslotted TDMA frames just discussed. For thisrequesting a DCCH from the system at call ini-purpose, two multiframe structures have beentiation.t r a n s f e r r i n gdefined: one consisting of 26 time frames (result-• AGCH: access grant channel used by the sys-ing in a recurrence interval of 120 ms), and one com-tem to assign resources to a mobile such as a DCCHs i g n a l i n gprising 51 time frames (or 236 ms).channel.The 26 multiframe is used to define trafficNote that the AGCH and the PCH are never usedchannels (TCH), and their slow and fast associat-by a mobile at the same time, and therefore are imple-i n f o r m a t i o ned control channels (SACCH and FACCH) thatmented on the same logical channel. All the con-carry link control information between the mobiletrol signaling channels, except the SDCCH, arebetween alland the base stations. The TCH have been definedimplemented on time slot 0 in different TDMAto provide six different forms of services, that is, full-frames of the 51 multiframes using a dedicatedrate speech or data channels supporting effective bitRF carrier frequency assigned on a per cell basis.mobiles andrates of 13 kb/s (for speech), 2.4, 4.8, and 9.6 kb/s;The multiframe structure for the SDCCH and itsand the half-rate channels with effective bit-ratesa ssociated slow a ssociat ed co ntrol channelthe BSS of 6.5 (for speech) and kb/s, 2.4 kb/s, and 4.8 kb/s(SACC) is implemented on one of the physical chan-for data (note that the gross bit rates on thesenels (TDM slots and RF carriers) selected by the sys-for call channels are higher due to required channel coding,tem operator.22.8 k b/ s for full -rate spe ech). The full-rateTCHs are implemented on 24 frames of the mul-Mobility Managemento r i g i n a t i o ntiframe, with each TCH occupying one time slot fromeach frame. Th e SACCH is implemented onand call-frame 12 (numbered from 0), providing eight SACCHMobility management is concerned with the func-tions of tracking the location of roamingchannels, one dedicated to each of the eight TCHmobiles and registering the information in appro-channels. Frame 25 in the multiframe is currentlypriate network elements, and handling connec-paging idle and reserved to implement the additionaltion handoffs for users in the communication process.eight SACCH required when half-rate speech chan-These functions are discussed in the followingf u n c t i o n s .nels become a reality. The FACCH is obtainedsections.on demand by stealing from the TCH, and is usedby either end for signaling the transfer character-Connection Handoffsistics of the physical path, or other purposes suchThis may be done between channels in the sameas connection handover control messages. The steal-cell, between channels in different cells under theing of a TCH slot for FACCH signaling is indi-same BSS coverage, or between cells under thecated through a flag within the TCH slot.coverage of different BSSs, and even differentThe 51-frame multiframe has a more complexMSCs. In GSM, the BSS may autonomously han-structure and we will refer the reader to GSMdle the connection handoffs in the same cell, orRecommendation 05.0 for the specific positionsbetween cells under its own coverage. This is calledof the various logical channels in the multiframe.internal connection handoffs. The MSC is involvedThe 51-frame structure, however, is used to derivein managing connection handoffs that need tothe following signaling and control channels. take place between cells under coverage of twodifferent BSSs. These are called external connec-S D C C H — Stand-alone dedicated control chan-tion handoffs. When the BSS indicates that an exter-nel is used for the transfer of call control signal-nal handover is required, the decision of whening to and from the mobile during call setup. Likeand whether an external handover should occurthe TCHs, the SDCCH has its own SACCH andis then taken by the MSC. The MSC uses the signalis released once call setup is complete.quality measurement information reported by themobile stations (MSs) which are pre-processed atB C C H — Broadcast control channel is used inthe BSS for external handover determination.the BSS to mobile direction to broadcast systemThe original MSC handling a call will alwaysinformation such as the synchronization parame-keep control of the call in an external handoverters, available services, and cell ID. This channelto a different and even a subsequent MSC.is continuously active, with dummy bursts substi-When the BSS performs an internal connec-tuted when there is no information to transmit,tion handoff, it informs the MSC at the comple-because its signal strengths are monitored by mobilestion of the process. The need for a connection handofffor handover determination.may be indicated by the mobile user, throughmessaging on the FACH, for instance, or by theSCH — Synchronization channel carries informa-BSS as it keeps tracking the quality of the signalstion from the BSS for frame synchronization.received. The BSS monitors the quality of theradio signal received and also transmits suchFCCH — Frequency control channel carries infor-results to the MSC who keeps a more global viewmation from the BSS for carrier synchronization.on the radio channels belonging to its BSSs. TheIEEE Communications Magazine • April 1993sGSM protocol architecture.and then comment on the scenario in which thecall is initiated by a mobile to another mobile.When the call is initiated by a mobile to a land-line user, the procedure is rather straightforward.In the case of a call initiated by a landline user,the PSTN may use the mobile station ISDN num-ber, MSISDN, to route the call to the closest Gate-way MSC within the mobile’s PLMN. The GMSC inturn uses the MSISDN to interrogate the mobile’sHLR for the routing information required to extendsLAPDm “address field” format.the call to the visiting MSC of the mobile at thet i m e.This visiting MSC (or more specifically the,V L RMSC may also initiate the need for a connectionwithin the local MSC) is identified in the mobile’shandoff for traffic reasons in an attempt to bal-HLR by the MSRN which specifies the visiting MSC.ance out the traffic load in the network.The MSRN is a temporary number allocated bythe VLR and sent to the HLR on location updat-Handling of Location Informationing, or call initiation. The MSRN should have theLocation information is maintained and used bysame structure as the MSISDN numbers in the VLRthe network to locate the user for call routing pur-area where it is allocated. The VLR then initiatesposes. The network registers the user’s locationthe paging procedure and the MSC pages the mobilein a register called the user’s, HLR, which is asso-station with a paging broadcast to all BSSs of theciated with an MSC located in the PLMN, to whichlocation area, as the exact base station area of thethe user is subscribed. Each BSS keeps broadcast-mobile may not be known. After paging response,ing, on a periodic basis, the cell identities on thethe current BSS is located. The RR and MM con-“broadcast control channels” of the cells under itsnec tion s are established, during which bot hcoverage. The mobiles within each cell keep mon-authentication of the user (for access to the network),itoring such information. As changes in locationas well as cipher mode setting are performed.are detected (from the last information recordedThe VLR then sends the required parameters forby them), they each report the new location tocall setup to the MSC, and may also assign the mobilethe BSS which routes it to the VLR, of the MSCa new TMSI for the call. The MSC sends a setup mes-to which it is connected. The VLR , in turn, sends thesage to the mobile station.location information to the user’s HLR, where itThe mobile station, on receiving the set-upis also recorded. In the meant ime, t he HLRmessage performs a compatibility check and returnsdirects the old VLR to delete the old visitinga call-confirmed message to the network, which maylocation of the mobile from its data base, and alsoinclude the bearer capability of the mobile sta-sends a copy of the user’s service profile to thetion. The BSS may at this point assign a trafficnew VLR. Location updating is performed by thechannel, TCH, to the call, or may assign it at amobility management (MM) protocol sublayerlater stage, the latest being on receipt of thethat will be discussed later in the article.“connect message” from the mobile station. Ifuser alerting is carried out at the MS, an alerting mes-Call Routing and Signalingsage is sent to the calling subscriber. When, thesubscriber answers the call, the MS sends a con-Acall may be initiated by a mobile user to anoth- nect message, which at the network side initiates theer mobile or a fixed landline user, or in reverse,completion of the traffic channel allocation andby a fixed landline user to a mobile. For routing a callswitch through of the connection. The connectto a mobile user, however, the network signalingmessage is progressed to the calling subscriber.needs to first locate the mobile. We will illustrate thisThe network also sends an acknowledgement tofor the case when a call is initiated by a landline user,the MS, that enters the active state.IEEE Communications Magazine • April 1993L A P D mis aL A P D- l i k esLAPDm general frame format.protocol thatProtocol Layeringitation. Instead, frame delimitation in LAPDm isArchitecturedone by the physical layer that defines the trans-has beenmission frame boundaries. LAPDm uses a “LengthT he GSM protocol architecture used for the Indicator” field to distinguish the information modified forexchange of signaling messages pertaining tocarrying field from fill-in bits used to fill themobility, radio resource, and connection manage-transmission frame. LAPDm uses an addressment functions is shown in Fig. 3. The protocolfield to carry the service access point identifier,o p e r a t i o nlayering consists of the physical layer, the data(SAPI), (3 bits in this case) which LAPD alsolink layer, and the Layer 3. It is noted to theuses to identify the user of the service providedwithin theOSI-minded reader to be careful in not confusingby the protocol. When using command/controlthe Layer 3 protocol functions defined by GSM withframes, the SAPI identifies the user for which what is normally defined to be the Layer 3 func-a command frame is intended, and the user trans-c o n s t r a i n t stions in the OSI model. The GSM Layer 3 proto-mitting a response frame. The format for the addresscols are used for the communication of networkfield is shown in Fig. 4. The 2-bit link protocolset by theresource, mobility, code format and call-related man-discriminator (LPD) is used to specify a particu-agement messages between the various network enti-lar recommendation of the use of LAPDm, theradio pass.ties involved. Since, in the OSI model, some of theseC/R is a single bit which specifies a command orfunctions are actually provided by the higher lay-response frame as used in LAPD, and a 1-bit extend-ers, the term “me ssage layer” may be a moreed address (EA) is used to extend the addressappropriate term for refering to the Layer 3 in GSM.field to more than one octet (the EA bit in theThe message layer (Layer 3) protocol is made uplast octet of the address should be set to 1, other-of three sublayers called the resource manage-wise to 0). The 8-bit is reserved for future uses.ment (RR) implemented over the link betweenLAPDm use s a co ntr ol field as is used inthe MS and the BSS, the mobility management (MM),LAPD to carry sequence numbers, and to specifyand connection management (CM) sublayersthe type of frame. LAPDm uses three types of framesproviding the communication between the MSu sed for supervisory fu nctions, unnumberedand the MSC. Layer 3 also implements the mes-information transfer and control functions (unac-sage transport part (MTP), level 3, and the sig-knowledged mode), and numbered informationnaling connection control part of the CCITT SS7 ontransfer (multiframe acknowledged mode) asthe link between the BSS and the MSC (the Aused in LAPD. LAPDm uses no cyclic redundan-interface) to provide the transport and address-cy check bits for error detection. Error correctioning functions for signaling messages belonging to theand detection mechanisms are, instead, provided byvarious calls routed through the MSC.In dis-a combination of block and convolutional codingcussing the functionality provided by the Layer 3used (in conjuction with bit interleaving) in the phys-in the GSM protocol stack, particular attention shouldical layer. The general frame format for LAPDmbe paid to not confuse the details of this layer’s func-is shown in Fig. 5.tionality with what is commonly provided by theLayer 3 of the OSI protocol stack. In GSM, theLink Layer on the A InterfaceCM, and MM sublayers, for instance, provideOn the terrestrial link connecting the BSS to theactually some of the functionalities which areMSC (the A interface), the MTP level 2 of therealized by the transport, the session, and theSS7 protocol is used to provide the OSI Layer 2 func-presentation layers of OSI, as will be seen later. Thetions of reliable transport for the signaling messages,functions of each protocol layer/sublayer is discussedsuch as recovery from transmission errors throughin some detail in the following.error detection and retransmission.Physical LayerThe physical layer on the radio link was discussed inMessage Layer Protocols andthe section on radio channel structure. The trafficFunctionschannels on the landside are formed from TDM slotsimplemented on 2.048 Mb/s links (E1 trunks).Radio Resource (RR) ManagementThe signaling channels are basically logically mul-Sublayertiplexed on an aggregate of the TDM slots.The RR management sublayer terminates at the BSSLink Layer on the Air Interfaceand performs the functions of establishing physi-The data link layer over the radio link (connect-cal connections over the radio for the purpose ofing the MS to the BSS) is based on a LAPD-like pro-transmitting call-related signaling information suchtocol, labeled LAPDm, that has been modifiedas the establishment of signaling and traffic chan-for operation within the constraints set by thenels between a specific mobile user and the BSS. Theradio pat h. In p arti cular, LAPDm u ses n o RR management functions are basically imple-flags (and therefore no bit stuffing) for frame delim-mented in the BSS.IEEE Communications Magazine • April 1993Mobility Management Sublayer (MM)indication from the network that it is not knownin the VLR upon trying to establish an MM con-Lo c a t i o nThe MM sublayer is terminated at the MSC andnection. Anytime, the network updates the mobile’sthe relat ed messages from or t o the MS ar elocation, it sends it an updated“temporary mobile sub-relayed transparently in the BSS using the DTAPscriber i d e n t i f i c a t i o n” ( T M S I ) , in ciphered mode,updating process. The MM sublayer provides functionswhich is stored in the MS and used for subsequentthat can be classified into three types of proce-mobile identification in paging and call initiatingis the dures. These are called the MM specific procedures,operations. The purpose of using the TMSI asthe MM common procedures, and the MM con-opposed to the user’s IMSI is to keep the subscriber’sprocedure nection-related procedures. These proceduresidentity confidential on the radio link. The TMSI hasare discussed in the following.no GSM- specific structure, and has significance onlywithin the location area assigned. The TMSI hasfor keepingMM Connection Related Proceduresto be combined with the location area identifier (LAI)These are the procedures used to establish, main-to provide for unambiguous identification outsidethe networktain, and release a MM connection between the MSthe area where it is assigned.and the network (MSC) over which an entity ofthe connection management (CM) sublayer canIMSI Attachinformed exchange information with its peer. More thanThe IMSI attach procedure is the complement of theone MM connection may be active at the sameIMSI detach procedure, a function of the MMof where time to serve multiple CM entities. Each CMcommon procedures (discussed later). Both of theseentity within the MS will have its own MM connection,procedures are network options whose necessitythe mobile and each connection is identified by the protocol dis-of usage are indicated through a flag in the sys-criminator, and a transaction identifier within thetem information broadcast on the BCCH chan-related signaling messages exchanged. The trans-nel. The IMSI detach/attach procedures mark theis roaming.action identifier is sort of analogous to the callMS as detached/attached in the VLR (and option-reference used by ISDN to identify signaling mes-ally in the HLR) on MS power down or power upsages from different calls on the D channel. Thusor subscriber information module (SIM) removed orparallel calls can be supported by the same MS whichinserted (The IMSI detach disables the locationare then identified by a different value for theupdating function to prevent unnecessary signal-transaction identifier parameter. Establishmenting overhead on the network). Any incomingof a MM connection requires that no MM-specif-calls, in that case, are either rejected or forward-ic procedure (discussed later) be active.ed as may be specified by the user). The IMSI is usedThe MM connections provide services to theto indicate the IMSI as active in the network.different entities of the upper connection man-This procedure is invoked if an IMSI is activatedagement (CM) sublayer which currently consistin a MS (power up, or SIM insertion) in the cov-of the call control (CC), the short message ser-erage area of the network, or an activated MS entersvices (SMS), and the call-independent supple-the network’s coverage area from outside. The IMSImentary services (SS). An MM connection is initiatedattach procedure is then performed only if the storedby a CM service request message which identifieslocation area at the time is the same as the onethe requesting CM entity and the type of servicebeing broadcast on the BCCH channel of therequired of the MM connection. The servicesserving cell. Otherwise, a normal location u p d a t-provided by the MM connections include such thingsing procedure is invoked regardless of whether theas enciphering (for privacy of user information), andnetwork supports IMSI attach/detach procedures.authentication (of the users-access to the networkand the service requested) which would be actual-MM Common Proceduresly provided by the presentation, and application lay-The MM common procedures can be initiated at anyers in the OSI framework. Each of these servicestime while a dedicated radio channel exists betweenwould involve the exchange of multiple messagesthe network and the MS. They do not set up anbetween the MS and the network before the requiredMM connection, but can be initiated during anMM connection is established and the requestingMM specific procedure, or while an MM connectionentity within the CM sublayer is notified.is in place. The MM Common procedures consistof IMSI detach, TMSI reallocation, and authenti-Mobility Management Specificcation/identification. These are discussed next.ProceduresThe MM specific procedures do not set up anIMSI DetachMM connection. They can only be initiated when n oThe IMSI detach procedure is invoked by the mobileother MM-specific procedure is running, and no MMstation to indicate inactive status to the network.connection is establishe d. These proced u r e sNo response or acknowledgement is returned toconsist of location updating, and the IMSI attachthe MS by the network on setting the active flagprocedures. These are discussed in the following.for the IMSI.The IMSI detach procedure is not started if at theLocation Updatingtime a MM-specific procedure is active. In that case,Location updating is the procedure for keeping thethe IMSI detach procedure is delayed, if possiblenetwork informed of where the mobile is roaming.until the MM-specific procedure is finished, oth-Location updating is always initiated by the mobileerwise the IMSI detach request is omitted.station on either detecting that it is in a new loca-If at the time of a detach request, a radio con-tion area by periodically monitoring the locationnection is in existence between the MS and theinformation broadcast by the network on the broad-network, the MM sublayer will release any ongo-cast channel, and comparing it to the informationing MM connections before the MM detach indi-previously stored in its memory, or by receiving ancation message is sent.IEEE Communications Magazine • April 1993TMSI ReallocationThe BSSMAP is used to implement all proce-dures between the MSC and the BSS that requireThe authenti-The purpose of TMSI reallocation is to provide iden-interpretation and the processing of informationtity confidentiality. That is, to protect the userrelated to single calls, and resource manage-from being identified and located by an intruder.ment. Basically, the BSSMAP is the process with-cation proce-This procedure must be performed at least at eachin t he BS S th at co ntrols radio reso urces inchange of the MSC coverage area. Reallocationresponse to instructions from the MSC (in thatdure allowsin any other case is left to the network operator.sense, the BSSMAP represents the RR sublayerIf the TMSI provided by a mobile station isto the MSC). For instance, the BSSMAP is usedunknown in the network, for instance, in the casein the assignment and switching of radio channelsthe networkof a data base failure, the MS has to provide itsat call setup, and handover processes.IMSI on request from the network. In this caseThe DTAP process is used for the transparentto verify thethe identification procedure has to be performedtransfer of MM/CM signaling messages between thebefore the TMSI procedure can be initiated.MS and the MSC. That is, the DTAP functionidentity pro-provides the transport level protocol interworkingAuthenticationfunction for transferring Layer 3 signaling messagesThe purpose of the authentication procedure isfrom and to the MS to and from the MSC with-vided by theto let the network verify the identity provided byout any analysis of the message contents.the user when requested, and to provide a new cipher-user whening key to the mobile station. The cases when authen-Signaling Transport Protocolstication procedures should be used are defined inGSM Recommendation 02.09. The authentica-r e q u e s t e d ,tion procedure is always initiated and controlledT he CCITT SS7 MTP and SCCP protocols areused to implement both the data link and theby the network.Layer 3 transport functions for carrying the call con-and to pro-trol and mobility management signaling messagesIdentificationon the BSS-MSC link. The MM and CM sublayervide a newThis procedure is used by the network to requestsignaling information from the mobile station is rout-a mobile station to provide specific identificationed over signaling channels (such as the DCCH,parameters to the network, such as the user’sSACCH, FACCH) to the BSS from where they areciphering keyinternational mobile subscriber or equipmenttransparently relayed through the DTAP processidentifiers (IMSI or IMEI). The mobile station shouldto an SCCP, of CCITT SS7 type logical channel,to the mobilebe ready to respond to an identity request mes-assigned for that call, on the BSS-MSC link for trans-sage at any time while RR connection exists betweenmission to the peer CC entity in the MSC for pro-the mobile and the network.cessing. Similarly, any call signaling informations t a t i o n .initiated by the MSC on the SCCP connection isrelayed through the DTAP process in the BSS to theConnection Managementassigned signaling channel, using the LAPDmSublayer (CM)data link protocol, for delivery to the mobile station.The interworking between the Layer 2 proto-T he CM sublayer terminates at the MSC and con- col on the radio side and the SS7 on the BSS-MSCtains entities that currently consist of CC includ-link is provided by a distribution data unit withining call-related supplementary services, SMS, andthe information field of the SCCP. These param-call independent supplementary services supporteters are known as the discrimination, and the data(SS). Once a MM connection has been established,link connection identifier (DLCI) parameters.the CM can use it for information transfer. TheThe discrimination parameter (currently dedicat-CC entity uses the CCITT Q.931 protocol, with minored one octet) uses a single bit to address a messagemodifications, for the communication of call con-either to the DTAP or the BSSMAP processes. Thetrol-related messages between the MS and the MSC.DLCI parameter (sized one octet) is made up of twoThe SMS is a GSM-defined service that provides forsubparameters that identify the radio channel typespeedy packet mode (“connectionless”) commu-(such as the DCCH, SACCH, FACCH), and thenication of messages up to 140 bytes between the MS“Service Access Point Interface”(SA P I) value (in theand a third party service center. These messages canLAPDm protocol) used for the message on the radiobe sent or received by the mobile station while a voicelink. The SCCP provides for the logical multiplexingor data call is in the active or inactive state. It is accept-of signaling information from different calls ontoable, however, if the service is aborted while athe same physical channel (such as a single 64 kb/scall is in a transitional state such as handover or busy-slot of a 2.048 Mb/s E1 trunk) on the BSS-MSC link.to-idle. The service center is responsible for theFor each call supported by a BSS, an SCCP logicalcollection, storage, and delivery of short mes-connection is established on the BSS-M S C link. A n ysages, and is outside the scope of GSM.information pertaining to a specific call flows throughits associated SCCP connection and that is howBSS Application Part (BSSAP)signaling information exchange pertaining t odifferent calls are identified in the BSS or MSC.T he BSS, in addition to providing the channel switch-The connectionless service mode of the SCCPing and aerial functions, performs radio resourceis also supported for the transfer of OA&M relat-management, and interworking functions b e t w e e ned messages as well as BSSMAP messages thatthe data link protocols used on the radio and thedo not pertain to any specific call (Note that BSSMAPBSS-MSC side for transporting signaling-relatedmessages pertaining to specific calls, such as hand-m e s s a g e s . These functions are provided by theoff messages, are transmitted using the SCCPBSS Management Application Process (BSSMAP),connection established for the call). The SCCP rout-and the Direct Transfer Application Process (DTAP).ing function uses the SubSystem Number (SSN)IEEE Communications Magazine • April 1993in the Service Information Octet (SIO) within theand present it in some logical and well-relatedMTP level 3 message to distinguish messagesformat. I have tried my best, however, to achieve thisThe o p t i m u maddressed to the OA&M function from thosegoal in this article.addressed to either the DTAP or the BSSMAP appli-This article was meant to provide a concise, brief,size for thecation parts. The high-level address translation capa-but adequately detailed description of the GSM sys-bility of the SCCP, known as global title translation,tem and protocol architecture that can serve as amay then be used to provide additional address-quick, rather self-contained conceptual frame-paging a r e aing capabilities such as use of E.164 numberingwork for extending and relating the mobility-specificfor addressing different OA&M entities. Thefunctions of the next generation personal com-is determinedglobal title translation feature of the SCCP also pro-munication networks to the GSM network functions,vides the MSC the capability to address signalingand the protocols used to achieve them. Finally, amessages to remote MSCs that may be located inlist of references have been provided for anyby a propera different PLMN.more detailed information on the issues addressedThe interworking functions between the CM, MMin the article.b a l a n c eand BSSMAP entities and the correspondingentities of the SS7 (i.e., the ISDN-UP), MAP, SCCP,Acknowlegementsbetween t h eand the transactions capabilities application partThe author would like to thank Bomber Bishop(TCAP) is provided by the MSC.and David Leeper from Motorola, and PrapeepSherman from AT&T for their careful reading ofcosts ofPagingthe original manuscript and for providing usefulcomments.paging andP aging messages for mobiles are sent via theBSSMAP to the BSS as a connectionless mes-sage through the SCCP/MTP. The paging mes-Referencesthe costs ofsage may include the mobile’s IMSI in order to[1] W.C.Y. Lee, “Spectrum Efficiency in Cellular,” IEEE Trans. on Veh. Tech. ,vol. 38, no. 2, May 1989.allow derivation of the paging population num-[2] W.C.Y. Lee, “Spectrum Efficiency and Digital Cellular,” 38th IEEEl o c a t i o nber. A single paging message transmitted to the BSSVeh. Tech. Conf. Records, pp.643, June 1988..may contain a list of cells in which the page is to be[3] GSM Recommendation 04.03, “MS-BSS Interface: Channel Struc-tures and Access Capabilities.”u p d a t e s .broadcast. The larger the paging area is defined, the[4] GSM Recommendation 05.01, “Physical Link Layer on the Radiolower the frequency of location updates and hencePath” (General Description).[5] GSM Recommendation 05.02, “Multiplexing and Multiple Accessthe associated traffic overhead on the network.on the Radio Path.”On the other hand, large paging areas result in[6] Conference Proceedings, Digital Cellular Radio Conference, Hagen FRG,Oct. 1988.increased use of transmitting power as well as the[7] GSM Recommendation 002.02, “Bearer Services Supported by a PLMN.”radio resources (channels). Therefore, the optimum[8] GSM Recommendation 09.01, “General Aspects on PLMN Inter-size for the paging area (location area) is detem-w o r k i n g . ”[9] GSM Recommendation 03.04, “Signaling Requirements Related toined by a proper balance between the costs ofRouting of Calls to Mobile Subscribers.”paging and the costs of location updates.[10] GSM Recommendation 08.02, “BSS-MSC Interface-Interface Principles.”[11] GSM Recommendation 08.04, “BSS-MSC Layer 1 Specifications.”The paging messages received from the MSC are[12] GSM Recommendation 08.06, “ Signaling Transport Mechanismsstored in the BS, and corresponding paging messagesfor BSS-MSC Interface.”[13] GSM Recommendation 09.02, “Mobile Application Part (MAP)are transmitted over the radio interface at the appro-Specification.”priate time. Each paging message relates to only one[14] GSM Recommendation 08.08, “BSS-MSC Layer 3 Specifications.”mobile station and the BSS has to pack the pages into[15] GSM Recommendation 04.08, “Mobile Radio Interface-Layer 3Specifications.”the relevant 04.08 paging message (include Layer3 information). Once a paging message is broad-cast over the radio channel(s), if a response messageBiographyis received from the mobile, the relevant signalingMO E RA H N E M A received a B.S. degree in engineering science from theconnection is set up towards the MSC and theUniversity of Kentucky at Lexington in 1978 with honors. He receivedthe M.S. degree and the more advanced engineering degree in Avion-page response message is passed to the MSC.ics from MIT in 1981. From 1983 to 1984, he taught and studied com-munication sciences at Northeastern University from which he also receivedthe Engineer degree in electrical and computer engineering with Ph.D-Summary Remarkslevel coursework. He worked as a senior communication design engi-neer at infinet in Andover, Mass from 1984 to 1985, where he designedT he description of the GSM network functions, the digital signal processing firmware for a 4800 baud modem. From 1985to 1989, he worked as a member of the technical staff at GTE Laboratories,system architecture and protocols are spreadand developed a new system architecture for fast packet switchingover a large number of GSM documents, each ofbased on the slotted ring concept (published in IEEE Transactions on Com -m u n i c a t i o n s, April 1990). From 1989 to 1991, he worked as a princi-which contains many details with some of the crit-pal engineer at Arinc on the design and analysis of air/ground communicationical issues and highlights covered within those details.networks for the airlines industry. He joined Motorola as a principalTherefore, it is not an easy task to extract outcommunication engineer in 1992, and since has been working on theIridium satellite project. His interests include wireless networks, com-some of the crucial concepts and design specifics,munication systems, and digital signal processing.IEEE Communications Magazine • April 1993