GSM Flashcards
What is the size of a Location Area ?
It is set by the network operator.
Could be several dozen cells.
Describe the Authentication Process of a SIM to the AuC
The process is initiated when a subscriber establishes a signaling connection with the network (before the actual call establishment request or another request).
Then the MSC request an authentication triplet from the HLR/AuC. The AuC retrieves the Ki of the subscriber and the authentication algorithm (A3 Algorithm) based on the IMSI of the subscriber that is part of the message from the MSC.
The Ki is then used with the A3 Algorithm and a random number (RAND) to generate the authentication:
- RAND (the random number generated): on 128 bits
- SRES generated from A3 with the parameters Ki and RAND - on 32 bits
- Kc generated from Ki and Rand through another algorithm
This tripplet is then sent to the MSC to authenticate the subscriber. The key Ki never leaves the HLR/AuC.
The MSC/VLR will therefore send the RAND number to Mobile Station. The Mobile Station will send this number to the SIM Card, which will then use the Ki and A3 algorithm to generate a Signed Response SRES* that will be sent back to the MSC.
If SRES and SRES* are equal, the MSC will consider the SIMCard as authenticated.
What is the AuC ?
It is the Authentication Center.
It contains for each subscriber an authentication secret key named Ki.
The Ki key is stored within the AuC (in the HLR) and also within the SIM in a way that prevent its from being read directly.
What is a burst ?
It is the timeframe of a GSM timeslot
In France which frequency bands are allocated to UMTS ?
around 2 GHz
Why are multiframes needed on the A Interface ?
Each frame has 8 timeslots (bursts).
However in order to work properly, gsm needs to have multiple channel type. Some are signaling channels and others are voice channels. The total number of channel types is far above 8. And each burst can encode only 114bits. Then, multiple frames are needed to encode and represent all type of channels.
The 2g Air Interface defined 2 types of multiframe:
- Signaling multiframes formed by 51 frames and using the timeslots 1 and 2 of these 51 frames.
- User multiframes formed by 26 frames and using the timeslots 3 to 8.
The spec TS 45.002 define the various type of Logical channels and how they are mapped on the physical channels of the multiframes.
What does BICN means ?
Bearer Independent Core Network
What does PCM means ?
Pulse Code Modulation
What does AGCH mean ?
Access Grant CHannel
Describe the ISUP message RLC
Release Complete
This message is sent by a switching center in response to a REL message, to confirm termination of the connection.
What was the only service that was provided by the 1g networks ?
Voice calls.
How many frequencies can be used by à base station for frequency hopping ?
Up to 64
What does TCAP means ?
Transaction Capability Application Part
What are the sizes possible for Micro QRCode ?
11 × 11 modules to 17 × 17 modules (Versions M1 to M4, increasing in steps of two modules per side)
Which error correction code is used with QR Code ?
Reed Solomon
L 7% — M 15% — Q 25% — H 30%
What does FCH mean ?
Frequency Correction Channel
What is the typical Value of the RSSI indicating that the Mobile Station is very close to the BTS ?
- 60 dBm
What does SMSC means ?
Short Messaging Service Center
What does SIGTRAN means and what is it ?
SIGnaling TRANsmission
It is the new IP-based SS7 protocol stack or the IP-based transmission of SS7 messages.
The abbreviation originated from the name of the IETF working group that was created for the definition of these protocols.
What is the aim of the “tails” at the beginning and at the end of the burst ?
It is a well‐known bit pattern sent to enable the receiver to detect the beginning and end of a burst correctly
What are the standardized supplementary services ?
- Call Forward Unconditional (CFU)
- Call Foward Busy (CFB)
- Call Forward No Reply (CFNRY)
- Call Forward Not Reachable (CFNR)
- Barring of Outgoing Calls (BAOC)
- Barring of Incoming calls (BAIC)
- Call Waiting (CW) - Signaling an incoming call while another one is already engaged.
- Call Hold (HOLD) - Accept an incoming call during an already active call or start a second call.
- Calling Line Identification Presentation (CLIP) - Forward the number of the caller to the callee.
- Calling Line Identification Restriction (CLIR)
- Connected Line Presentation (COLP) - show the MSISDN to which the call is forwarded
- Multiparty (MPTY) : Allows to establish conferences with many subscribers.
What is the Broadcast Common Control CHannel (BCCH)?
It is the main information channel of a cell and broadcasts SYS_INFO messages that contain a variety of information about the network. The channel is monitored by all mobile devices which are switched on but currently not engaged in a call or signaling connection (idle mode), and broadcasts, among many other things, the following information:
the MCC and MNC of the cell;
the identification of the cell, which consists of the location area code (LAC) and the cell ID;
and to simplify the search for neighboring cells for a mobile device, the BCCH also contains information about the frequencies used by neighboring cells. Thus, the mobile device does not have to search the complete frequency band for neighboring cells.
What was the data rate of the UMTS (initially)
1 Mbps
Describe the ISUP message REL
RELease Message
This message is sent by the switching center of a user who have terminated a call to the other switching center implied in the communication, after having resets the connection in its switching matrix.
At a high level, describe the protocol stack in a MSC.
Application (voice calls)
Connection Management
Mobility Management
BSSAP
MAP*
TCAP*
SCCP
STP 1,2, 3
What does MSISDN mean ?
Mobile Subscriber Integrated Services Digital Network.
Which spec does specify SMS ?
TS 23.040
What is the MSIN ?
It is the part of the IMSI that identifies uniquely a subscriber within the home network.
What are the types of Logical channels ?
From a functionality view :
- Signaling channels
- Traffic CHannel
From a destination view:
- Dedicated Channel (single user)
- Common channels (broadcast)
What does IMSI means ?
e International Mobile Subscriber Identity
What are the expected answers to a “Setup” message sent by MSC to a Mobile Station ?
= A “Called Confirmed” message
- Alerting message
- Connect message
What is the Standalone Dedicated Control Channel (SDCCH) ?
It is a pure signaling channel that is used during call establishment when a subscriber has not yet been assigned a TCH. Furthermore, the channel is used for signaling that is not related to call establishment, such as for the location update procedure or for sending or receiving a text message (SMS)
Where are the TRAU features implemented ?
Between the MSC and the BSC.
Within the Mobile Station.
While the TRAU is a logical component of the BSS, it is most often installed next to an MSC in practice. This has the advantage that four compressed voice channels can be transmitted in a single E‐1 timeslot. After compression, each voice channel uses a 16‐kbit/s sub‐timeslot. Thus, only one‐quarter of the transmission capacity between an MSC and BSC is needed in comparison to an uncompressed transmission. As the BSCs of a network are usually located in the field and not close to an MSC, this helps to reduce transmission costs for the network operator.
Which software changes were needed by the circuit-switching virtualization over IP ?
The main differences are found in the lower protocol layers for call signaling and voice call transmission.
For mobile devices, that transition was completely transparent.
What are the dedicated channels of the GSM ?
- The traffic channel (TCH)
- The Fast Associated Control Channel (FACCH)
- The Slow Associated Control Channel (SACCH)
- The Standalone Dedicated Control Channel (SDCCH)
Describe the channel codec process ?
The channel coder takes in input the 260bits produced by the FR codec, and generate 456bits in outputs.
Additional bits are added for cyclic redundancy check and error correction.
What is an MSRN ?
It is a temporary identity allocated by a roaming network (specifically the V-MSC) to the called subscriber (in roaming) for an incoming call.
That MSRN is similar to a normal subscriber number. Then why do we need another number? The call can work without MSRN only if the subscriber is not roaming. Telecom network does the routing based on country code and network code.
The other reason why MSRN exists is that it is possible, and even likely, that there are transit switching centers between the G-MSC and the V-MSC. The MSRN identifies uniquely the V-MSC of the subscriber. If the MSISDN were used in all calls, those devices in transit would have to always query the HLR to know where to route the messages
As the MSRN is saved in the billing record for the connection, it is also possible to invoice the terminating subscriber for forwarding the call to a foreign network and to transfer a certain amount of the revenue to the foreign network operator.
What does HSDPA means ?
High Speed (Downlink) Packet Access
What was the data rate of the LTE (initially) ?
100Mb
With the Mobile Number Portability which HLR perform the conversion MSISDN - IMSI for a ported number ?
The HLR of the first operator to which belonged the number. The HLR of the operator owning the Network Destination Code (in the MSISDN).
What does MCC mean ?
Mobile Country Code
What are the most important parameters within the SIM Card ?
IMSI
Ki Secret Key
What is an SCP ?
Service Control Point.
It is either a database or an application software that can influence the establishment of a connection.
In a GSM network, an SCP can be used, for example, for storing the current location of a subscriber.
What are the protocols underlying the BSSMAP protocol ?
As BSSMAP is not a database query protocol/language, it is directly based on SCCP (rather than having TCAP in between).
How is the IMSI used when the Mobile Device is switched on ?
The IMSI is retrieved from the SIM Card and sent to the MSC. There the MCC and the MNC of the IMSI are analysed and the MSC/VLR is enabled to request the subscriber’s record from the HLR of the subscriber’s home network.
Where is the A8 algorithm executed ?
in the SIM Card
What does BTS mean ?
Base Transceiver Station
What does SCTP means ?
Stream Control Transmission Protocol
What is the DS0 ?
Digital Signal 0 (DS0) is a basic digital signaling rate of 64 kilobits per second (kbit/s), corresponding to the capacity of one analog voice-frequency-equivalent communication channel.
The DS0 rate was introduced to carry a single digitized voice call. For a typical phone call, the audio sound is digitized at an 8 kHz sample rate, or 8000 samples per second, using 8-bit pulse-code modulation for each of the samples. This results in a data rate of 64 kbit/s.
What does BCCH mean ?
Broadcast Common Control Channel
Which spec does specify the file and folder structure of a SIM Card ?
TS 31.102
On which interface the BSSMAP and DTAP protocol transit ?
the A Interface.
For the communication between the MSC and the BSS or the MS
Who is the main responsible of the creation of the SS7 standard ?
ITU.
International Telecommunication Union
What does VoLTE means ?
Voice over LTE
What is the Channel used by the “immediate assignment” message ?
AGCH (Access Grant CHannel)
How many timeslots of 64kbits/s are in an T1 connection ?
24
What is the Access Grant Channel (AGCH) ?
a subscriber sends a Channel Request message on the RACH, the network allocates an SDCCH or, in exceptional cases, a TCH, and notifies the subscriber on the AGCH via an Immediate Assignment message. The message contains information about which SDCCH or TCH the subscriber is allowed to use.
What is the aim of the training sequence in the middle of a burst ?
The training sequence in the middle of the burst always contains the same bit pattern. It is used to compensate for interference caused, for example, by reflection, absorption, and multipath propagation. On the receiver side, these effects are countered by comparing the received signal with the training sequence and thus adapting the analog filter parameters for the signal. The filter parameters calculated this way can then be used to modify the rest of the signal and thus to better recreate the original signal.
When receiving a SMS send request, how does the MSC knows the SMSC to which it needs to be sent.
The SMSC number is in the message request.
It is configured within the SIMCARD and then sent as part of the message request by the Mobile Station
Which spec provides details on the call establishment procedures ?
TS 23.018
What are the main tasks of the Mobility Management (MM) function of an MSC ?
- Authentication of subscribers at connection establishment
- If no connection exists between the network and the Mobile Station, the MS has to report a change of location to the network to be reachable for incoming calls and messages. This procedure is called Location Update
- If the subscriber changes their location while a connection is established with the network, the MSC is part of the process that ensures that the connection is not interrupted and is rerouted to the next cell. This is the handover process.
How to compute the theoritical maximum distance between the BTS and a Mobile Station ?
64 * 550m = 35km
What are the Common channels of the GSM Air Interface ?
- The Synchronization Channel (SCH)
- The Frequency Correction Channel (FCCH)
- The Broadcast Common Control Channel (BCCH)
- The Paging Channel (PCH)
- The Random Access Channel (RACH)
- The Access Grant Channel (AGCH)
What does SIM mean ?
Subscriber Identity Module
What is the gross datarate of a T1 Connection ?
1.544 Mbits/s
What is the gross datarate of an E1 Connection ?
2.048 Mbits / s
What change on the radio transmission path when it comes to send circuit-switched data rather than frame ?
- it is not possible to tolerate a single faulty bit. If even a single bit is faulty, a retransmission of at least one single frame has to be performed, as most applications cannot tolerate a faulty data stream.
- To increase the likelihood of correctly reconstructing the initial data stream, the interleaver spreads the bits of a frame over a much larger number of bursts than the eight bursts used for voice frames.
- Furthermore, the channel coder, which separates the bits of a frame into different classes based on their importance, had to be adapted for data calls as well, as all bits are equally important. Thus, the convolutional decoder has to be used for all bits of a frame.
- Finally, it is also not possible to use a lossy data compression scheme for data calls. Therefore, the TRAU operates in a transparent mode for data calls.
Which channel is used by the Mobile Station to send a “Channel Request” message ?
RACH (Random Access CHannel)
What is an SSP ?
Service Switching Point.
It is a Switching Center that is more generally referred to as network element and is able to establish, transport, or forward voice and data connections.
What are the necessary interfaces in an IP-based NSS architecture ?
- The A Interface between the BSS and the MSC
- The C Interface: between the MSC and the HLR
- The D Interface: between the VLR and the HLR
- The Nb Interface between 2 MGW
- The Nc Interface between 2 MSC-S
- The Mc Interface between an MSC-S and a MGW
What does MAP means ?
Mobile Application Part
What happens if parts of a frame are destroyed beyond repair during transmission on the air interface ?
The complete 20‐millisecond voice frame is discarded by the receiver and the previous data block is used instead to generate an output signal.
Most errors that are repaired this way remain undetected by the listener. This trick, however, cannot be used indefinitely. If after 320 milliseconds a valid data block has still not been received, the channel is muted and the decoder keeps trying to decode the subsequent frames.
If, during the following few seconds no valid data frame is received, the connection is terminated and the call drops.
At which frequency the voice is sampled in the digitization process ?
8000 Hz (8 Khz)
What are the tech specificities of the LTE ?
OFDMA
IP Access is the only service offered. With a low latency. Other services must rely on IP.
What is a G-MSC ?
Gateway Mobile Switch Center, it is a normal MSC that is also connected to other networks (fixed or mobile-other operators), and act as a gateway to the mobile subscribers for those networks.
What does ITU means ?
International Telecommunication Union
Which message is sent by the Mobile Device when the customer ends the call ?
The “disconnect” message
What is the reference standard of the MAP protocol ?
3GPP TS 29.002
What is an STP ?
Signaling Transfer Point.
It is a network element responsible for the forwarding of signaling messages between SSP and SCPs as not all network nodes have a dedicated link to all other nodes of the network.
It can be compared to an IP router in the Internet. However STPs only forward signaling messages that are necessary to establish, maintain or clearing a call. The calls themselves are directly carried on dedicated links between the SSPs.
Describe the encryption process of the GSM:
Inputs: the encryption key Kc, the current frame number, the 114bits of data of the current frame
Output: 114bits ciphered
What is the SCCP SSN of an VLR ?
7
What are the services provided by 2g network ?
Voice Calls, SMS, USSD, Data transmission (10kbps)
What was the data rate of the UMTS (initially) ?
1 Mbps
What was the tech specificities of the GPRS-EDGE ?
Packet Switching + New modulation
What is MNP ?
It is a functionality that allows a subscriber to retain its MSISDN even if he wants to change its mobile network operator.
What are the codecs used on Nb Interface to transmit voice ?
PCM/G.711, Narrowband‐AMR, or Wideband‐AMR
In France which autorities assign the frequency bands to TelCo ?
ARCEP
What does RSSI mean ?
Received Signal Strength Indication
How is Kc generated ?
It is computed by the AuC based on the A8 algorithm
What does SSN means ?
SubSystems Number
It is the equivalent of TCP/UDP port in SCCP
What are the protocols underlying the MAP protocol ?
In order : TCAP, SCCP and the MTPs.
What does PDP mean ? (GPRS)
Packet Data Protocol (IPv4, IPv6, PPP)
How is the encryption key (kc) generated ?
Kc is calculated in the AuC and on the SIM card by using a random number (RAND) and the secret key (Ki) as input parameters for the A8 algorithm.
Which nodes does initiate the “authentication” procedure ?
HLR/AuC
What does SABM means ?
Set Asynchronous Balance Mode
Describe the ISUP message ACM
Address Complete Message
A switching center send back this message in response of the IAM message, once it has analyzed the phone number, established the connection to the B line via the switching matrix, and applied a periodic current to the B line so that the B phone can generate an alerting tone.
By receiving this message, the other switching center knows that the number is complete and that the terminating party is being alerted about the incoming call.
What is the function of the interleaver unit ?
The convolutional decoder has one weak point: if several consecutive bits are changed during transmission over the air interface, the convolutional decoder on the receiver side is not able to correctly reconstruct the original frame.
To decrease this effect, the interleaver changes the bit order of a 456‐bit data frame in a specified pattern over eight bursts and consecutive frames are thus interlocked with each other.
What does HLR means ?
Home Location Register
How the mobile station knows the frequencies of the neighbouring cells he has to measure the signal strengths ?
Their transmission frequency is announced on the broadcast channel (BCCH) of the currently serving cell
How many physical contacts are defined for the communication between the SIM Card and the Mobile Device.
8 contacts.
5 required.
What is the A Law Standard ?
An A-law algorithm is a standard companding algorithm, used in European 8-bit PCM digital communications systems to optimize, i.e. modify, the dynamic range of an analog signal for digitizing. It is one of two versions of the G.711 standard from ITU-T, the other version being the similar μ-law, used in North America and Japan.
The reason for this encoding is that the wide dynamic range of speech does not lend itself well to efficient linear digital encoding.
What are the one-act of MNP ?
- it is no longer possible to use the NDC to decide which tariff to apply to a call. Which complexity routing and billing.
Instead of a simple call routing scheme based on the NDC, the networks now have to query an MNP database for every call to a mobile Subscriber to find out if the call can be routed inside the network or if it has to be forwarded to a different national mobile network.
- it is no longer possible to discern the Mobile Network Operator from the NDC.
After which frequency the waves transmission in the Air become very difficult ?
3GHz
What was the data transmission debit in first 2g networks ?
Around 10kbps
What does MTP means ?
Message Transfer Part.
There are 3 layers - MTP-1, MTP-2, MTP-3
What does ISDN means ?
Integrated Services Digital Network
What are the technology specificities of GSM (first 2G) networks ?
TDMA
digital
Circuit Switched
Where is the VAD (Voice Activity Detection) implemented ?
In the TRAU (downlink) and in the Mobile Station (uplink)
What does UICC mean ?
Universal Integrated Circuit Card
It is the SIM Card
At a high level, describe the protocol stack in a BTS.
Data Link (Radio) | Data Link (BSC) Physical (Radio) | Physical (BSC)
What is the MCC ?
The MCC is the part of the IMSI that identifies the subscriber’s home country. On 3 digits.
How many steps are in the timing advance Control system of the GSM ?
64 steps
What does ETSI means ?
European Telecommunication Standards Institute
What was the data rate of the LTE (initially) ?
100Mb
Which specs specify the BICC protocol ?
ITU Q.1901 [7] and 3GPP TS 29.205
Describe the bsc handover procedure
Once the BSC decides to perform a handover, a TCH is activated in the new cell as shown in Figure 1.30. Afterward, the BSC informs the mobile device via the old cell with a Handover Command message that is sent over the FACCH. Important information elements of the message are the new frequency and timeslot number of the new TCH. The mobile device then changes its transmit and receive frequency, synchronizes to the new cell if necessary, and sends a Handover Access message in four consecutive bursts. In the fifth burst, a Set Asynchronous Balanced Mode (SABM) message is sent, which is acknowledged by the BTS to signal to the mobile device that the signal can be received. At the same time, the BTS informs the BSC of the successful reception of the mobile device’s signal with an Establish Indication message. The BSC then immediately redirects the speech path to the new cell.
From the mobile’s point of view, the handover is now finished. The BSC, however, has to release the TCH in the old cell, and has to inform the MSC of the performed handover before the handover is finished from the network’s point of view. The message to the MSC is only informative and has no impact on the continuation of the call.
What does “Connection establishment of a Mobile Station” concretely mean ?
- Sending a channel request via the RACH ?
- Receive an Immediate Assignment response containing an SDCCH channel number reserved
What are the parameters of the A8 algo ?
Rand and Ki
What does USSD mean ?
Unstructured Supplementary Service Data
What is a carrier system ?
A carrier system is a telecommunications system that transmits information, such as the voice signals of a telephone call and the video signals of television, by modulation of one or multiple carrier signals above the principal voice frequency or data rate.[1]
Carrier systems typically transmit multiple channels of communication simultaneously over the shared medium using various forms of multiplexing. Prominent multiplexing methods of the carrier signal are time-division multiplexing (TDM) and frequency-division multiplexing (FDM). A cable television system is an example of frequency-division multiplexing. Many television programs are carried simultaneously on the same coaxial cable by sending each at a different frequency. Multiple layers of multiplexing may ultimately be performed upon a given input signal. For example, in the public switched telephone network, many telephone calls are sent over shared trunk lines by time-division multiplexing. For long-distance calls several of these channels may be sent over a communications satellite link by frequency-division multiplexing. At a given receiving node, specific channels may be demultiplexed individually.
The purpose of carrier systems is to save money by carrying more traffic on less infrastructure.
How many timeslots (each per Subscriber) are in à GSM frame ?
8
What is frequency hopping ?
It is the use alternating frequencies for a single channel.
it changes the carrier frequency for every burst during a transmission. This increases the probability that only few bits are lost if one carrier frequency experiences a lot of interference from other sources like neighboring cells.
What does ISUP means ?
Integrated Service digital network User Part
What does MNC means ?
Mobile Network Code
What does FLO means ?
Flexible Layer One
What does BCSM mean ?
Basic Call State Model (BCSM)
Why is it important to have standardized interfaces between network nodes ?
This allows network operators to acquire different components for the network from different network equipment vendors.
How does the A5 algorithm is selected ?
The selection of the ciphering algorithm depends on the capabilities of the mobile device. During the establishment of a connection, the mobile device informs the network about the ciphering algorithms that it supports. The network can then choose an algorithm that is supported by the network and the mobile device.
Why is TCAP protocol used for ?
TCAP is the protocol designed on top of SCCP to access databases. It defines a number of different modules and messages that can be used to query all kinds of different databases in a uniform way.
What was the HSDPA data rate ?
10Mbps
What does PCH mean ?
Paging Channel
What is the burst duration ?
577ms
What does TRAU mean ?
Transcoding and Rate Adaptation Unit
in GSM, how the secret key shared only by the SIM and the AuC is called ?
Ki
Which spec does specify the Logical channels and their mapping on the physical one ?
TS 45.002