GSM Q&A

All answers have been held as short as possible and require an understanding and study of the corresponding chapter of the book.

Answer 1:
In a circuit switched digital telecommunication network a speech channel usually uses a 64 kbit/s timeslot. The pulse code modulation (PCM) algorithm is used to convert an analog voice signal for digital transmission.

Answer 2:
The GSM NSS consists of at least of the following network components:

• MSC: The Mobile Switching Center, which includes the Visitor Location Register, is responsible for connecting calls and mobility management.
• The Home Location Register, which stores subscriber information
• Service Control Points, which handle services like prepaid or location based billing applications
• SMS Service Center
• Voice Mail Systems

Answer 3:
The GSM BSS consists of the following network components:

• The Base Station Controller, which controls the channels on the air interface. It is also responsible for power control, timing advance control and handovers.
• Transcoding and Rate Adaptation units convert the speech codecs used in the BSS into 64 kbit/s PCM coded channels used in the core network. (Note: The TRAU is usually co-located with the MSC in order to minimize the number of required transmission links between the MSCs and the BSCs).
• The Base Transceiver Stations (BTS): A high number of base stations are connected to a base station controller. They are responsible for transferring data streams over the air interface.

Answer 4:
Three methods are used: Several calls can be handled on the same frequency. This is done by splitting a channel into 7 timeslots. This is called Time Division Multiple Access (TDMA). Capacity can be further increased by using several carrier frequencies per base station. Typical GSM base stations today use one to three carriers. This is called Frequency Division Multiple Access (FDMA). Additionally, a further increase can be achieved by splitting the coverage area of a base station into several sectors and by using different carrier frequencies in each sector. Typical base stations today use either two or three sectors.

Answer 5:
The first step is to digitize the voice signal recorded by the microphone by using the PCM codec. This digital signal is then used as input for the speech coder (Full Rate, Enhanced Full Rate, AMR) which compresses the data generated by the PCM codec. This data stream is then sent to the channel coder which adds redundancy (error detection and error correction bits). Afterwards, the Interleaver changes the order of the bits and spreads consecutive bits over a wider area of the data stream. This allows spreading transmission errors which usually affect several consecutive bits over a larger area which helps the receiver to detect and correct errors. To protect the communication from eavesdropping and tampering the resulting data stream is then ciphered. Finally the now encrypted data stream is modulated onto an analog carrier frequency and transmitted.

Answer 6:
A handover changes the routing of an ongoing voice call from one cell to another. This is necessary if a subscriber leaves the coverage area of a cell and enters the coverage area of another. Network elements involved in the handover are the mobile station, the old and the new base station and the base station controller. If the current base station controller is not responsible for the new cell, the mobile switching center and the BSC controlling the new cell are also part of the handover procedure.

Answer 7:
For an incoming call the Gateway MSC queries the home location register of the subscriber to ask for its location (Send Routing Information). The HLR is aware of the current MSC/VLR (Visited MSC) of the subscriber and requests a temporary identifier, the Mobile Station Roaming Number (MSRN). This number is returned by the HLR to the Gateway MSC. From there the call can then be forwarded to the Visited MSC. At this stage of the call routing process, standard ISUP signaling is used which is already known from fixed line networks. Instead of using the phone number as identifier, the MSRN is used to route the call. On the Visited MSC, the temporary MSRN is used to correlate the call to the correct subscriber. As the V-MSC is only aware of the subscriber’s current location area, the subscriber has to be paged in order to establish the cell to which the call has to be forwarded to.

Answer 8:
In order to authenticate a subscriber, the MSC queries the Authentication Center for the Authentication Triplets of the subscriber. Elements of each triplet are a random number (RAND) and a response value (SRES) which is generated from the random number with an authentication algorithm. The MSC then sends the random number to the mobile station. The MS forwards the random number to the SIM card which computes the SRES. This value is then sent back to the network. The MSC then compares the SRES computed by the authentication center and the SRES computed by the SIM card. The two values can only match if the authentication center and the SIM card have used the same secret key to generate the signed response from the same random number.

Answer 9:
A mobile phone always sends an SMS to the SMS Service Center (SMSC) which is a network node in the core network. The SMSC then uses the phone number contained in the short message to query the HLR for the current MSC of the destination subscriber. It then forwards the message to this MSC. If the subscriber is not reachable, the Message Waiting Flag is set in the MSC/VLR and HLR, and the SMS is stored in the SMSC. Once the subscriber becomes reachable again the SMSC is informed and another delivery attempt is undertaken.

Answer 10:
In downlink direction (network to mobile phone) the DSP is used for the analysis of the incoming data stream. The training sequence of a burst is used to calculate a channel approximation which is then applied to the main parts of each burst. This improves compensation of external effects on the transmission. Furthermore, the DSP compresses and decompresses the speech data by using the Full Rate / Enhanced Full Rate / AMR codec. The RISC processor on the other hand deals with channel coding and decoding, interleaving/de-interleaving and ciphering/de-ciphering of the incoming and outgoing data stream. Additionally, the RISC processor also manages the user interface, the overall control of a connection (Mobility Management / Session Management), user programs and external interfaces (Bluetooth, USB, etc.).

Answer 11:
Data is stored on the SIM card in a non-volatile, re-writable memory. To the outside, the microcontroller on the SIM card presents the memory as a directory tree and files. While PCs use filenames to identify files and directories, the SIM card instead uses 4 digit hexadecimal numbers. Each file has its set of individual read and write permissions. Some files are readable only, such as the file that contains the IMSI of the user. Some files can neither be read nor written to from the outside, like for example the file which contains the secret key used for authentication. Directories are referred to as ‚dedicated files’, ordinary files are called ‚elementary files’.

Answer 12:
CAMEL is the abbreviation for Customized Applications for Mobile Enhanced Logic. It describes how databases and applications can communicate over network boundaries and interfaces via MSCs, SGSNs and GGSNs. CAMEL is used for services such as prepaid or location based services. As CAMEL is not restricted to the home network of a user, foreign MSCs are able to contact databases in the home network of a subscriber for services such as prepaid billing when a subscriber is abroad. CAMEL specifies both the protocol between the network nodes and a state model which describes the different phases of a call by using Detection Points. If a certain detection point is activated for a subscriber, the treatment of a call is suspended at this point and the database and service responsible for the subscriber is contacted for further instructions of how to proceed with the call.