Um Interface
Encyclopedia
The Um interface is the air interface
for the GSM mobile telephone standard. It is the interface between the mobile station
(MS) and the Base transceiver station
(BTS). It is called Um because it is the mobile analog to the U interface
of ISDN. Um is defined in the GSM 04.xx and 05.xx series of specifications. Um can also support GPRS packet-oriented communication.
. Um is defined in the lower three layers of the model.
For most channels, Um L1 transmits and receives 184-bit control frames or 260-bit vocoder frames over the radio interface in 148-bit bursts with one burst per timeslot.
There are three sublayers:
. Within the BTS, these ARFCNs are given arbitrary carrier indexes C0..Cn-1, with C0 designated as a Beacon Channel and always operated at constant power.
The channel is time-multiplexed
into 8 timeslots, each with a duration of 156.25 symbol periods. These 8 timeslots form a frame of 1,250 symbol periods. The capacity associated with a single timeslot on a single ARFCN is called a physical channel (PCH) and referred to as "CnTm" where n is a carrier index and m is a timeslot index (0-7).
Each timeslot is occupied by a radio burst with a guard interval, two payload fields, tail bits, and a midamble (or training sequence). The lengths of these fields vary with the burst type but the total burst length is 156.25 symbol periods.
The most commonly used burst is the Normal Burst (NB).
The fields of the NB are:
Midamble : 26-bits for equalizer training at the center of the burst
"Stealing bits" : each side of the midamble, used to distinguish control and traffic payloads
Payload : two 57-bit fields, symmetric about the burst
Tail bits : 3-bit field, at each end of the burst
Guard period : 8.25-symbols at the end of the burst
There are several other burst formats, though. Bursts that require higher processing gain for signal acquisition have longer midambles. The random access burst (RACH) has an extended guard period to allow it to be transmitted with incomplete timing acquisition. Burst formats are described in GSM 05.02 Section 5.2.
GSM timing is driven by the serving BTS through the SCH and FCCH. All clocks in the handset, including the symbol clock and local oscillator, are slaved to signals received from the BTS, as described in GSM 05.10.
BTSs in the GSM network can be asynchronous and all timing requirements in the GSM standard can be derived from a stratum-3 OCXO.
. As a general rule, each GSM channel uses a block parity code
(usually a Fire code), a rate-1/2, 4th-order convolutional code
and a 4-burst or 8-burst interleaver. Notable exceptions are the synchronization channel (SCH) and random access channel (RACH) that use single-burst transmissions and thus have no interleavers. For speech channels, vocoder bits are sorted into importance classes with different degrees of encoding protection applied to each class (GSM 05.03).
Both 260-bit vocoder frames and 184-bit L2 control frames are coded into 456 bit L1 frames. On channels with 4-burst interleaving (BCCH, CCCH, SDCCH, SACCH), these 456 bits are interleaved in to 4 radio bursts with 114 payload bits per burst. On channels with 8-burst interleaving (TCH, FACCH), these 456 bits are interleaved over 8 radio bursts so that each radio burst carries 57 bits from the current L1 frame and 57 bits from the previous L1 frame. Interleaving algorithms for the most common traffic and control channels are described in GSM 05.03 Sections 3.1.3, 3.2.3 and 4.1.4.
, is defined in GSM 04.05 and 04.06. LAPDm is the mobile analog to ISDN's LAPD
.
The access order is RR, MM, CC. The release order is the reverse of that. Note that none of these sublayers terminate in the BTS itself. The standard GSM BTS operates only in layers 1 and 2.
and are referred to as Bm channels.
Traffic channels use 8-burst diagonal interleaving with a new block starting on every fourth burst and any given burst containing bits from two different traffic frames. This interleaving pattern makes the TCH robust against single-burst fades since the loss of a single burst destroys only 1/8 of the frame's channel bits.
The coding of a traffic channel is dependent on the traffic or vocoder type employed, with most coders capable of overcoming single-burst losses.
All traffic channels use a 26-multiframe TDMA structure.
, GSM 06.60 Enhanced Full Rate
or GSM 06.90 Adaptive Multi-Rate
speech codec. It can also be used for fax
and Circuit Switched Data
.
or GSM 06.90 Adaptive Multi-Rate speech codec.
and are referred to as Dm channels.
transfer. It has a payload data rate of 0.8 kbit/s. Up to eight SDCCHs can be time-multiplexed onto a single physical channel. The SDCCH uses 4-burst block interleaving in a 51-multiframe.
and broadcast
channels that do not have analogs in ISDN. These channels are used almost exclusively for radio resource management. The AGCH and RACH together form the medium access mechanism for Um.
BCCH brings the measurement reports
it bring the information about LAI And CGI
BCCH frequency are fixed in BTS
and the current value of the TDMA clock.
SCH repeats on every 1st, 11th, 21st, 31st and 41st frames of the 51 frame multi frame. So there are 5 SCH frames in a 51 frame multiframe.
Additionally, only certain of these combinations are allowed on certain timeslots or carriers and only certain sets of combinations can coexist in a given BTS. These restrictions are intended to exclude non-sensical BTS configurations and are described in GSM 05.02 Section 6.5.
The most common combinations are:
The Um radio resource establishment procedure is defined in GSM 04.08 Section 3.3 and this is the basic medium access procedure for Um.
This procedure uses the CCCH (PCH and AGCH) as a unicast downlink and the RACH as a shared uplink.
In the simplest form, the steps of the transaction are:
Note that there is a small but non-zero probability that two MSs send identical RACH bursts at the same time in step 2. If these RACH bursts arrive at the BTS with comparable power, the resulting sum of radio signals will not be demodulable and both MSs will move to step 4. However, if there is a sufficient difference in power, the BTS will see and answer the more powerful RACH burst. Both MSs will receive and respond to the resulting channel assignment in step 3. To ensure recovery from this condition, Um uses a "contention resolution procedure" in L2, described in GSM 04.06 5.4.1.4 in which the first L3 message frame from the MS, which always contains some form of mobile ID, is echoed back to the MS for verification.
In its minimal form, the steps of the transaction are:
There are many possible elaborations on this transaction, including:
In its simplest form, the steps of the transaction are:
The TCH+FACCH assignment can occur at any time during the transaction, depending on the configuration of the network. There are three common approaches:
As in the MOC, the TCH+FACCH assignment can happen at any time, with the three common techniques being early, late and very early assignment.
is defined in GSM 04.08 Sections 5.4 and 7.3.4. This transaction is the same whether initiated by the MS or the network, the only difference being a reversal of roles. This transaction is taken from Q.931.
As a general rule, every message transferred in L(n) requires both a transfer and an acknowledgment on L(n-1). Only L1-L4 are visible on Um.
Um also supports frequency hopping (GSM 05.01 Section 6), which is not specifically intended as a security feature but has the practical effect of adding significant complexity to passive interception of the Um link.
Authentication and encryption both rely on a secret key, Ki, that is unique to the subscriber. Copies of Ki are held in the SIM and in the Authentication Center (AuC), a component of the HLR. Ki is never transmitted across Um.
An important and well-know shortcoming of GSM security is that it does not provide a means for subscribers to authenticate the network. This oversight allows for false basestation attacks, such as those implemented in an IMSI catcher.
Note that this transaction always occurs in the clear, since the ciphering key is not established until after the transaction is started.
A typical GSM transaction also includes LAPDm
idle frames and SACCH system information messages at predictable times, affording a Known plaintext attack.
The GSM ciphering algorithm is called A5. There are four variants of A5 in GSM, only first three of which are widely deployed:
Ciphering is a radio resource function and managed with messages in the radio resource sublayer of L3, but ciphering is tied to authentication because the ciphering key Kc is generated in that process. Ciphering is initiated with the RR Ciphering Mode Command message, which indicates the A5 variant to be used. The MS starts ciphering and responds with the RR Ciphering Mode Complete message in ciphertext.
The network is expected to deny service to any MS that does not support either A5/1 or A5/2 (GSM 02.09 Section 3.3.3). Support of both A5/1 and A5/2 in the MS was mandatory in GSM Phase 2 (GSM 02.07 Section 2) until A5/2 was depreciated by the GSMA in 2006.
Air interface
In mobile or wireless communication, the air interface is the radio-based communication link between the mobile station and the active base station...
for the GSM mobile telephone standard. It is the interface between the mobile station
Mobile phone
A mobile phone is a device which can make and receive telephone calls over a radio link whilst moving around a wide geographic area. It does so by connecting to a cellular network provided by a mobile network operator...
(MS) and the Base transceiver station
Base Transceiver Station
A base transceiver station or cell site is a piece of equipment that facilitates wireless communication between user equipment and a network. UEs are devices like mobile phones , WLL phones, computers with wireless internet connectivity, WiFi and WiMAX gadgets etc...
(BTS). It is called Um because it is the mobile analog to the U interface
U interface
U interface: For basic-rate access in an Integrated Services Digital Network environment, a user-to-network interface reference point that is characterized by the use of a 2-wire-loop transmission system that conveys information between the 4-wire user-to-network interface, i.e., the S/T...
of ISDN. Um is defined in the GSM 04.xx and 05.xx series of specifications. Um can also support GPRS packet-oriented communication.
Um layers
The layers of GSM are initially defined in GSM 04.01 Section 7 and roughly follow the OSI modelOSI model
The Open Systems Interconnection model is a product of the Open Systems Interconnection effort at the International Organization for Standardization. It is a prescription of characterizing and standardizing the functions of a communications system in terms of abstraction layers. Similar...
. Um is defined in the lower three layers of the model.
Physical Layer (L1)
The Um physical layer is defined in the GSM 05.xx series of specifications, with the introduction and overview in GSM 05.01.For most channels, Um L1 transmits and receives 184-bit control frames or 260-bit vocoder frames over the radio interface in 148-bit bursts with one burst per timeslot.
There are three sublayers:
- Radiomodem. This is the actual radio transceiver, defined in largely in GSM 05.04 and 05.05.
- Multiplexing and Timing. GSM uses TDMATime division multiple accessTime division multiple access is a channel access method for shared medium networks. It allows several users to share the same frequency channel by dividing the signal into different time slots. The users transmit in rapid succession, one after the other, each using its own time slot. This...
to subdivide each radio channel into as many as 16 traffic channels or as many as 64 control channels. The multiplexing patterns are defined in GSM 05.02. - Coding. This sublayer is defined on GSM 05.03.
Radiomodem
GSM uses GMSK or 8PSK modulation with a 13/48 MHz (270.833 kHz) symbol rate and a channel spacing of 200 kHz. Since adjacent channels overlap, the standard does not allow adjacent channels to be used in the same cell. The standard defines several bands ranging from 400 MHz to 1990 MHz. Uplink and downlink bands are generally separated by 45 or 50 MHz (at the low-frequency end of the GSM spectrum) and 85 or 90 MHz (at the high-frequency end of the GSM spectrum). Uplink/downlink channel pairs are identified by an index called the ARFCNARFCN
In GSM cellular networks, an absolute radio-frequency channel number is a code that specifies a pair of physical radio carriers and channels used for transmission and reception on the Um interface, one for the uplink signal and one for the downlink signal. ARFCNs are defined in GSM Specification...
. Within the BTS, these ARFCNs are given arbitrary carrier indexes C0..Cn-1, with C0 designated as a Beacon Channel and always operated at constant power.
The channel is time-multiplexed
Time division multiple access
Time division multiple access is a channel access method for shared medium networks. It allows several users to share the same frequency channel by dividing the signal into different time slots. The users transmit in rapid succession, one after the other, each using its own time slot. This...
into 8 timeslots, each with a duration of 156.25 symbol periods. These 8 timeslots form a frame of 1,250 symbol periods. The capacity associated with a single timeslot on a single ARFCN is called a physical channel (PCH) and referred to as "CnTm" where n is a carrier index and m is a timeslot index (0-7).
Each timeslot is occupied by a radio burst with a guard interval, two payload fields, tail bits, and a midamble (or training sequence). The lengths of these fields vary with the burst type but the total burst length is 156.25 symbol periods.
The most commonly used burst is the Normal Burst (NB).
The fields of the NB are:
| 3 | 57 | 1 | 26 | 1 | 57 | 3 | 8.25 |
|---|---|---|---|---|---|---|---|
| Tail bits | Payload | Stealing bit | Midamble | Stealing bit | Payload | Tail bits | Guard period |
Midamble : 26-bits for equalizer training at the center of the burst
"Stealing bits" : each side of the midamble, used to distinguish control and traffic payloads
Payload : two 57-bit fields, symmetric about the burst
Tail bits : 3-bit field, at each end of the burst
Guard period : 8.25-symbols at the end of the burst
There are several other burst formats, though. Bursts that require higher processing gain for signal acquisition have longer midambles. The random access burst (RACH) has an extended guard period to allow it to be transmitted with incomplete timing acquisition. Burst formats are described in GSM 05.02 Section 5.2.
Multiplexing and timing
Each physical channel is time-multiplexed into multiple logical channels according to the rules of GSM 05.02. Traffic channel multiplexing follows a 26-frame (0.12 second) cycle called a "multiframe". Control channels follow a 51-frame multiframe cycle. The C0T0 physical channel carries the SCH, which encodes the timing state of the BTS to facilitate synchronization to the TDMA pattern.GSM timing is driven by the serving BTS through the SCH and FCCH. All clocks in the handset, including the symbol clock and local oscillator, are slaved to signals received from the BTS, as described in GSM 05.10.
BTSs in the GSM network can be asynchronous and all timing requirements in the GSM standard can be derived from a stratum-3 OCXO.
Coding
The coding sublayer provides forward error correctionForward error correction
In telecommunication, information theory, and coding theory, forward error correction or channel coding is a technique used for controlling errors in data transmission over unreliable or noisy communication channels....
. As a general rule, each GSM channel uses a block parity code
Block code
In coding theory, block codes refers to the large and important family of error-correcting codes that encode data in blocks.There is a vast number of examples for block codes, many of which have a wide range of practical applications...
(usually a Fire code), a rate-1/2, 4th-order convolutional code
Convolutional code
In telecommunication, a convolutional code is a type of error-correcting code in which* each m-bit information symbol to be encoded is transformed into an n-bit symbol, where m/n is the code rate and...
and a 4-burst or 8-burst interleaver. Notable exceptions are the synchronization channel (SCH) and random access channel (RACH) that use single-burst transmissions and thus have no interleavers. For speech channels, vocoder bits are sorted into importance classes with different degrees of encoding protection applied to each class (GSM 05.03).
Both 260-bit vocoder frames and 184-bit L2 control frames are coded into 456 bit L1 frames. On channels with 4-burst interleaving (BCCH, CCCH, SDCCH, SACCH), these 456 bits are interleaved in to 4 radio bursts with 114 payload bits per burst. On channels with 8-burst interleaving (TCH, FACCH), these 456 bits are interleaved over 8 radio bursts so that each radio burst carries 57 bits from the current L1 frame and 57 bits from the previous L1 frame. Interleaving algorithms for the most common traffic and control channels are described in GSM 05.03 Sections 3.1.3, 3.2.3 and 4.1.4.
Data Link Layer (L2)
The Um data link layer, LAPDmLAPDm
LAPDm is a data link layer protocol used in GSM cellular networks. LAPDm forms Layer 2 of the Um interface between the Base Transceiver Station and Mobile station, which is to say that it is used in the radio link between the cellular network and the subscriber handset.LAPDm is derived from a much...
, is defined in GSM 04.05 and 04.06. LAPDm is the mobile analog to ISDN's LAPD
Link Access Procedures, D channel
Link Access Procedures on the D channel , specified in ITU-T Q.920 and ITU-T Q.921, is the second layer protocol on the ISDN protocol stack in the D channel.It is heavily based on HDLC.-External links:*http://www.protocols.com/pbook/pdf/isdn.pdf...
.
Network Layer (L3)
Um L3 is defined in GSM 04.07 and 04.08 and has three sublayers. A subscriber terminal must establish a connection in each sublayer before accessing the next higher sublayer.- Radio ResourceRadio resource managementRadio resource management is the system level control of co-channel interference and other radio transmission characteristics in wireless communication systems, for example cellular networks, wireless networks and broadcasting systems...
(RR). This sublayer manages the assignment and release of logical channels on the radio link. It is normally terminated in the BSC. - Mobility ManagementMobility managementMobility management is one of the major functions of a GSM ora UMTS network that allows mobile phones to work. The aim of mobility management is to track where the subscribers are, allowing calls, SMS and other mobile phone services to be delivered to them....
(MM). This sublayer authenticates users and tracks their movements from cell to cell. It is normally terminated in the VLR or HLR. - Call ControlCall controlIn telephony, call control refers to the software within a telephone switch that supplies its central function. Call control decodes addressing information and routes telephone calls from one end point to another. It also creates the features that can be used to adapt standard switch operation to...
(CC). This sublayer connects telephone calls and is taken directly from ITU-T Q.931Q.931ITU-T Recommendation Q.931 is ISDN's connection control protocol, roughly comparable to TCP in the Internet Protocol stack. Q.931 doesn't provide flow control or perform retransmission, since the underlying layers are assumed to be reliable and the circuit-oriented nature of ISDN allocates...
. GSM 04.08 Annex E provides a table of corresponding paragraphs in GSM 04.08 and ITU-T Q.931 along with a summary of differences between the two. The CC sublayer is terminated in the MSCMobile switching centre serverThe Mobile Switching Centre Server, or MSC Server abbreviated MSS, is a 3G core network element which controls the network switching subsystem elements. Alternatively or adaptively, MSS can be used in GSM networks as well, if the manufacturer has implemented support for GSM networks in the MSS...
.
The access order is RR, MM, CC. The release order is the reverse of that. Note that none of these sublayers terminate in the BTS itself. The standard GSM BTS operates only in layers 1 and 2.
Um logical channels
Um logical channel types are outlined in GSM 04.03. Broadly speaking, non-GPRS Um logical channels fall into three categories: traffic channels, dedicated control channels and non-dedicated control channels.Traffic channels (TCH)
These point-to-point channels correspond to the ISDN B channelB channel
B channel is a telecommunications term which refers to the ISDN channel in which the primary data or voice communication is carried. It has a bit rate of 64 kbit/s in full duplex....
and are referred to as Bm channels.
Traffic channels use 8-burst diagonal interleaving with a new block starting on every fourth burst and any given burst containing bits from two different traffic frames. This interleaving pattern makes the TCH robust against single-burst fades since the loss of a single burst destroys only 1/8 of the frame's channel bits.
The coding of a traffic channel is dependent on the traffic or vocoder type employed, with most coders capable of overcoming single-burst losses.
All traffic channels use a 26-multiframe TDMA structure.
Full-rate channels (TCH/F)
A GSM full rate channel uses 24 frames out of a 26-multiframe. The channel bit rate of a full-rate GSM channel is 22.7 kbit/s, although the actual payload data rate is 9.6-14 kbit/s, depending on the channel coding. This channel is normally used with the GSM 06.10 Full RateFull Rate
Full Rate or FR or GSM-FR or GSM 06.10 was the first digital speech coding standard used in the GSM digital mobile phone system. The bit rate of the codec is 13 kbit/s, or 1.625 bits/audio sample...
, GSM 06.60 Enhanced Full Rate
Enhanced Full Rate
Enhanced Full Rate or EFR or GSM-EFR or GSM 06.60 is a speech coding standard that was developed in order to improve the quite poor quality of GSM-Full Rate codec. Working at 12.2 kbit/s the EFR provides wirelike quality in any noise free and background noise conditions...
or GSM 06.90 Adaptive Multi-Rate
Adaptive Multi-Rate
The Adaptive Multi-Rate audio codec is a patented audio data compression scheme optimized for speech coding. AMR was adopted as the standard speech codec by 3GPP in October 1999 and is now widely used in GSM and UMTS...
speech codec. It can also be used for fax
Fax
Fax , sometimes called telecopying, is the telephonic transmission of scanned printed material , normally to a telephone number connected to a printer or other output device...
and Circuit Switched Data
Circuit Switched Data
Circuit Switched Data is the original form of data transmission developed for the time division multiple access -based mobile phone systems like Global System for Mobile Communications...
.
Half-rate channels (TCH/H)
A GSM half rate channel uses 12 frames out of a 26-multiframe. The channel bit rate of a half-rate GSM channel is 11.4 kbit/s, although the actual data capacity is 4.8-7 kbit/s, depending on the channel coding. This channel is normally used with the GSM 06.20 Half RateHalf Rate
Half Rate is a speech coding system for GSM, developed in the early 1990s.Since the codec, operating at 5.6 kbit/s, requires half the bandwidth of the Full Rate codec, network capacity for voice traffic is doubled, at the expense of audio quality. It is recommended to use this codec when the...
or GSM 06.90 Adaptive Multi-Rate speech codec.
Dedicated Control Channels (DCCHs)
These point-to-point channels correspond to the ISDN D channelD channel
D channel is a telecommunications term which refers to the ISDN channel in which the control and signalling information is carried.The bit rate of the D channel of a basic rate interface is 16 kbit/s, whereas it amounts to 64 kbit/s on a primary rate interface.For DSS1 signalling, the D channel...
and are referred to as Dm channels.
Standalone Dedicated Control Channel (SDCCH)
The SDCCH is used for most short transactions, including initial call setup step, registration and SMSSMS
SMS is a form of text messaging communication on phones and mobile phones. The terms SMS or sms may also refer to:- Computer hardware :...
transfer. It has a payload data rate of 0.8 kbit/s. Up to eight SDCCHs can be time-multiplexed onto a single physical channel. The SDCCH uses 4-burst block interleaving in a 51-multiframe.
Fast Associated Control Channel (FACCH)
The FACCH is always paired with a traffic channel. The FACCH is a blank-and-burst channel that operates by stealing bursts from its associated traffic channel. Bursts that carry FACCH data are distinguished from traffic bursts by stealing bits at each end of the midamble. The FACCH is used for in-call signaling, including call disconnect, handover and the later stages of call setup. It has a payload data rate of 9.2 kbit/s when paired with a full-rate channel (FACCH/F) and 4.6 kbit/s when paired with a half-rate channel (FACCH/H). The FACCH uses the same interleaving and multiframe structure as its host TCH.Slow Associated Control Channel (SACCH)
Every SDCCH or FACCH also has an associated SACCH. Its normal function is to carry system information messages 5 and 6 on the downlink, carry receiver measurement reports on the uplink and to perform closed-loop power and timing control. Closed loop timing and power control are performed with a physical header at the start of each L1 frame. This 16-bit physical header carries actual power and timing advance settings in the uplink and ordered power and timing values in the downlink. The SACCH can also be used for in-call delivery of SMS. It has a payload data rate of 0.2-0.4 kbit/s, depending on the channel with which it is associated. The SACCH uses 4-burst block interleaving and the same multiframe type as its host TCH or SDCCH.Common Control Channels (CCCHs)
These are unicastUnicast
right|200pxIn computer networking, unicast transmission is the sending of messages to a single network destination identified by a unique address.-Addressing methodologies:...
and broadcast
Broadcast
Broadcast or Broadcasting may refer to:* Broadcasting, the transmission of audio and video signals* Broadcast, an individual television program or radio program* Broadcast , an English electronic music band...
channels that do not have analogs in ISDN. These channels are used almost exclusively for radio resource management. The AGCH and RACH together form the medium access mechanism for Um.
Broadcast Control Channel (BCCH)
The BCCH carries a repeating pattern of system information messages that describe the identity, configuration and available features of the BTS.BCCH brings the measurement reports
it bring the information about LAI And CGI
BCCH frequency are fixed in BTS
Synchronization Channel (SCH)
The SCH transmits a Base station identity codeBase station identity code
The Base Station Identity Code is a code used in GSM to uniquely identify a base station. The code is needed because it is possible that mobile stations receive the broadcast channel of more than one base station on the same frequency. This is due to frequency re-use in a cellular network...
and the current value of the TDMA clock.
SCH repeats on every 1st, 11th, 21st, 31st and 41st frames of the 51 frame multi frame. So there are 5 SCH frames in a 51 frame multiframe.
Frequency Correction Channel (FCCH)
The FCCH generates a tone on the radio channel that is used by the mobile station to discipline its local oscillator. FCCH will repeat on every 0th, 10th, 20th, 30th and 40th frames of the 51 frame multiframe. So there are 5 FCCH frames in a 51 frame multiframe.Paging Channel (PCH)
The PCH carries service notifications (pages) to specific mobiles sent by the network. A mobile station that is camped to a BTS monitors the PCH for these notifications sent by the network.Access Grant Channel (AGCH)
The AGCH carries BTS responses to channel requests sent by mobile stations via the Random Access Channel.Random Access Channel (RACH)
The RACH is the uplink counterpart to the AGCH. The RACH is a shared channel on which the mobile stations transmit random access bursts to request channel assignments from the BTS.Allowed channel combinations
The multiplexing rules of GSM 05.02 allow only certain combinations of logical channels to share a physical channel. The allowed combinations for single-slot systems are listed in GSM 05.02 Section 6.4.1.Additionally, only certain of these combinations are allowed on certain timeslots or carriers and only certain sets of combinations can coexist in a given BTS. These restrictions are intended to exclude non-sensical BTS configurations and are described in GSM 05.02 Section 6.5.
The most common combinations are:
- Combination I: TCH/F + FACCH/F + SACCH. This combination is used for full rate traffic. It can be used anywhere but C0T0.
- Combination II: TCH/H + FACCH/H + SACCH. This combination is used for half rate traffic when only one channel is needed. It can be used anywhere but C0T0.
- Combination III: 2 TCH/H + 2 FACCH/H + 2 SACCH. This combination is used for half rate traffic. It can be used anywhere but C0T0.
- Combination IV: FCCH + SCH + BCCH + CCCH. This is the standard C0T0 combination for medium and large cells. It can be used only on C0T0.
- Combination V: FCCH + SCH + BCCH + CCCH + 4 SDCCH + 2 SACCH. [(5x1)+(5x1)+(1x4)+(3x4)+(4x4)+(2x4)+1idle=51frame multiframe] This is the typical C0T0 combination for small cells, which allows the BTS to trade unnecessary CCCH capacity for a pool of 4 SDCCHs. It can be used only on C0T0.
- Combination VI: BCCH + CCCH. This combination is used to provide additional CCCH capacity in large cells. It can be used on C0T2, C0T4 or C0T6.
- Combination VII: 8 SDCCH + 4 SACCH.[(8x4)+(4x4)+3idle=51frame multiframe] This combination is used to provide additional SDCCH capacity in medium and large cells. It can be used anywhere but C0T0.
Fundamental Um transactions
Basic speech service in GSM requires five transactions: radio channel establishment, location update, mobile-originating call establishment, mobile-terminating call establishment and call clearing. All of these transactions are described in GSM 04.08 Sections 3-7.Radio channel establishment
Unlike ISDN's U channel, Um channels are not hard-wired, so the Um interface requires a mechanism for establishing and assigning a dedicated channel prior to any other transaction.The Um radio resource establishment procedure is defined in GSM 04.08 Section 3.3 and this is the basic medium access procedure for Um.
This procedure uses the CCCH (PCH and AGCH) as a unicast downlink and the RACH as a shared uplink.
In the simplest form, the steps of the transaction are:
- Paging. The network sends a RR Paging Request message (GSM 04.08 Sections 9.1.22-9.1.23) over the PCH, using the subscriber's IMSI or TMSI as an address. GSM does not allow paging by IMEI (GSM 04.08 Section 10.5.1.4). This paging step occurs only for a transaction initiated by the network.
- Random Access. The mobile station sends a burst on the RACH. This burst encodes an 8-bit transaction tag and the BSIC of the serving BTS. A variable number of most-significant bits in the tag encode the reason for the access request, with the remaining bits chosen randomly. In L3, this tag is presented as the RR Channel Request message (GSM 04.08 9.1.8). The mobile also records the TDMA clock state at the time the RACH burst is transmitted. In cases where the transaction is initiated by the MS, this is first step.
- Assignment. On the AGCH, the network sends the RR Immediate Assignment message (GSM 04.08 Section 9.1.18) for a dedicated channel, usually an SDCCH. This message is addressed to the MS by inclusion of the 8-bit tag from the corresponding RACH burst and a time-stamp indicating the TDMA clock state when the RACH burst was received. If no dedicated channel is available for assignment, the BTS can instead respond with the RR Immediate Assignment Reject message, which is similarly addressed and contains a hold-off time for the next access attempt. Emergency callers receiving the reject message are not subject to the hold-off and may retry immediately.
- Retry. If the RACH burst of step 2 is not answered with an assignment or assignment reject in step 3 within a given timeout period (usually on the order of 0.5 second), the handset will repeat step 2 after a small random delay. This cycle may be repeated 6-8 times before the MS aborts the access attempt.
Note that there is a small but non-zero probability that two MSs send identical RACH bursts at the same time in step 2. If these RACH bursts arrive at the BTS with comparable power, the resulting sum of radio signals will not be demodulable and both MSs will move to step 4. However, if there is a sufficient difference in power, the BTS will see and answer the more powerful RACH burst. Both MSs will receive and respond to the resulting channel assignment in step 3. To ensure recovery from this condition, Um uses a "contention resolution procedure" in L2, described in GSM 04.06 5.4.1.4 in which the first L3 message frame from the MS, which always contains some form of mobile ID, is echoed back to the MS for verification.
Location updating
The location updating procedure is defined in GSM 04.08 Sections 4.4.1 and 7.3.1. This procedure normally is performed when the MS powers up or enters a new Location area but may also be performed at other times as described in the specifications.In its minimal form, the steps of the transaction are:
- The MS and BTS perform the radio channel establishment procedure.
- On the newly established dedicated channel, the MS sends the MM Location Updating Request message containing either an IMSI or TMSI. The message also implies connection establishment in the MM sublayer.
- The network verifies the mobile identity in the HLR or VLR and responds with the MM Location Updating Accept message.
- The network closes the Dm channel by sending the RR Channel Release message.
There are many possible elaborations on this transaction, including:
- authentication
- ciphering
- TMSI assignment
- queries for other identity types
- location updating reject
Mobile-Originating Call (MOC) establishment
This is the transaction for an outgoing call from the MS, defined in GSM 04.08 Sections 5.2.1 and 7.3.2 but taken largely from ISDN Q.931.In its simplest form, the steps of the transaction are:
- The MS initiates the radio channel establishment procedure and is assigned to a Dm channel, usually an SDCCH. This establishes the connection in the L3 RR sublayer.
- The first message sent on the new Dm is the MM Connection Mode service Request, sent by the MS. This message contains a subscriber ID (IMSI or TMSI) and a description of the requested service, in this case MOC.
- The network verifies the subscriber's provisioning in the HLR and responds with the MM Connection Mode Service Accept message. This establishes the connection in the L3 MM sublayer. (This is a simplification. In most networks MM establishment is performed with authentication and ciphering transactions at this point.)
- The MS sends the CC Setup message, which contains the called party number.
- Assuming the called party number is valid, network response with the CC Call Proceeding message.
- The network sends an RR Assignment message to move the transaction off of the SDCCH and onto a TCH+FACCH.
- Once the MS has acquired the timing on the TCH+FACCH, it responds on the new FACCH with the RR Assignment Complete message. From this point on, all control transactions are on the FACCH.
- When alerting is verified at the called destination, the network sends the CC Alerting message.
- When the called party answers, the network sends the CC Connect message.
- The MS response with the CC Connect Acknowledge message. At this point, the call is active.
The TCH+FACCH assignment can occur at any time during the transaction, depending on the configuration of the network. There are three common approaches:
- Early Assignment. The network assigns the TCH+FACCH after sending CC Call Proceeding and completes call setup on the FACCH. This allows the use of in-band patterns (like the ringing or busy patterns) generated by the network. This is the example shown.
- Late Assignment. The network does not assign the TCH+FACCH until after alerting has started. This forces the MS itself to generate the patterns locally since the TCH does not yet exist to carry the sound.
- Very Early Assignment. The network makes an immediate assignment to the TCH+FACCH in the initial RR establishment and performs the entire transaction on the FACCH. The SDCCH is not used. Because immediate assignment starts the FACCH in a signaling-only mode, the network must send the RR Channel Mode Modify message at some point to enable the TCH part of the channel.
Mobile-Terminating Call (MTC) establishment
This is the transaction for an incoming call to the MS, defined in GSM 04.08 Sections 5.2.2 and 7.3.3, but taken largely from ISDN Q.931.- The network initiates the radio channel establishment procedure and assigns the MS to a Dm channel, usually an SDCCH. This establishes the connection in the L3 RR sublayer.
- The MS sends the first message on the new Dm, which is the RR Paging Response message. This message contains a mobile identity (IMSI or TMSI) and also implies a connection attempt in the MM sublayer.
- The network verifies the subscriber in the HLR and verifies that the MS was indeed paged for service. The network can initiate authentication and ciphering at this point, but in the simplest case the network can just send the CC Setup message to initiate Q.931-style call control.
- The MS responds with CC Call Confirmed.
- The network sends an RR Assignment message to move the transaction off of the SDCCH and onto a TCH+FACCH.
- Once the MS has acquired the timing on the TCH+FACCH, it responds on the new FACCH with the RR Assignment Complete message. From this point on, all control transactions are on the FACCH.
- The MS starts alerting (ringing, etc.) and sends the CC Alerting message to the network.
- When the subscriber answers, the MS sends the CC Connect message to the network.
- The network response with the CC Connect Acknowledge message. At this point, the call is active.
As in the MOC, the TCH+FACCH assignment can happen at any time, with the three common techniques being early, late and very early assignment.
Call clearing
The transaction for clearing a callClearing (telecommunications)
Clearing, in telecommunications means:* A sequence of events used to disconnect a call and return to the ready state. It is sometimes, particularly in the context of common channel signaling, called teardown....
is defined in GSM 04.08 Sections 5.4 and 7.3.4. This transaction is the same whether initiated by the MS or the network, the only difference being a reversal of roles. This transaction is taken from Q.931.
- Party A sends the CC Disconnect message.
- Party B responds with the CC Release message.
- Party A responds with the CC Release Complete message.
- The network releases the RR connection with the RR Channel Release message. This always comes from the network, regardless of which party initiated the clearing procedure.
SMS transfer on Um
GSM 04.11 and 03.40 define SMS in five layers:- L1 is taken from the Dm channel type used, either SDCCH or SACCH. This layer terminates in the BSC.
- L2 is normally LAPDm, although GPRS-attached devices may use Logical link controlLogical Link ControlThe logical link control data communication protocol layer is the upper sub-layer of the data link layer in the seven-layer OSI reference model...
(LLC, GSM 04.64). In LAPDm SMS uses SAP3. This layer terminates in the BTS. - L3, the connection layer, defined in GSM 04.11 Section 5. This layer terminates in the MSC.
- L4, the relay layer, defined in GSM 04.11 Section 6. This layer terminates in the MSC.
- L5, the transfer layer, defined in GSM 03.40. This layer terminates in the SMSCSMSC* Seoul Metro * Short message service center* Smart Mixed-Signal Connectivity...
.
As a general rule, every message transferred in L(n) requires both a transfer and an acknowledgment on L(n-1). Only L1-L4 are visible on Um.
Mobile-Originated SMS (MO-SMS)
The transaction steps for MO-SMS are defined in GSM 04.11 Sections 5, 6 and Annex B. In the simplest case, error-free delivery outside of an established call, the transaction sequence is:- The MS establishes an SDCCH using the standard RR establishment procedure.
- The MS sends a CM Service Request,
- The MS initiates multiframe mode in SAP3 with the normal LAPDm SABM procedure.
- The MS sends a CP-DATA message (L3, GSM 04.11 Section 7.2.1), which carries an RP-DATA message (L4, GMS 04.11 Section 7.3.1) in its RPDU.
- The network responds with a CP-ACK message (L3, GSM 04.11 Section 7.2.2).
- The network delivers the RPDU to the MSC.
- The MSC responds with an RP-ACK message (L4, GSM 04.11 Section 7.3.3).
- The network sends a CP-DATA message to the MS, carrying the RP-ACK payload in its RPDU.
- The MS responds with a CP-ACK message.
- The network releases the SDCCH with the RR Channel Release message. This implies a closure of the MM sublayer and triggers the release of L2 and L1.
Mobile-Terminated SMS (MT-SMS)
The transaction steps for MT-SMS are defined in GSM 04.11 Sections 5, 6 and Annex B. In the simplest case, error-free delivery outside of an established call, the transaction sequence is:- The network pages the MS with the standard paging procedure.
- The MS establishes an SDCCH using the standard RR paging response procedure, which implies a CC sublayer connection.
- The network initiates multiframe mode in SAP3.
- The network sends the RP-DATA message as the RPDU in a CP-DATA message.
- The MS responds with the CP-ACK message.
- The MS processes the RPDU.
- The MS sends a CP-DATA message to the network containing an RP-ACK message in the RPDU.
- The network responds with a CP-ACK message.
- The network releases the SDCCH with the RR Channel Release message. This implies a closure of the MM sublayer and triggers the release of L2 and L1.
Um security features
GSM 02.09 defines the following security features on Um:- authentication of subscribers by the network,
- encryption on the channel,
- anonymization of transactions (at least partially)
Um also supports frequency hopping (GSM 05.01 Section 6), which is not specifically intended as a security feature but has the practical effect of adding significant complexity to passive interception of the Um link.
Authentication and encryption both rely on a secret key, Ki, that is unique to the subscriber. Copies of Ki are held in the SIM and in the Authentication Center (AuC), a component of the HLR. Ki is never transmitted across Um.
An important and well-know shortcoming of GSM security is that it does not provide a means for subscribers to authenticate the network. This oversight allows for false basestation attacks, such as those implemented in an IMSI catcher.
Authentication of subscribers
The Um authentication procedure is detailed in GSM 04.08 Section 4.3.2 and GSM 03.20 Section 3.3.1 and summarized here:- The network generates a 128 bit random value, RAND.
- The network sends RAND to the MS in the MM Authentication Request message.
- The MS forms a 32-bit hash value called SRES by encrypting RAND with an algorithm called A3, using Ki as a key. SRES = A3(RAND,Ki). The network performs an identical SRES calculation.
- The MS sends back its SRES value in the RR Authentication Response message.
- The network compares its calculated SRES value to the value returned by the MS. If they match, the MS is authenticated.
- Both the MS and the network also compute a 64-bit ciphering key, Kc, from RAND and Ki using the A8 algorithm. Kc = A8(RAND,Ki). Both parties save this value for later use when ciphering is enabled.
Note that this transaction always occurs in the clear, since the ciphering key is not established until after the transaction is started.
Um encryption
GSM encryption, called "ciphering" in the specifications, is implemented on the channel bits of the radio bursts, at a very low level in L1, after forward error correction coding is applied. This is another significant security shortcoming in GSM because:- the intentional redundancy of the convolutional coder reduces the Unicity distanceUnicity distanceIn cryptography, unicity distance is the length of an original ciphertext needed to break the cipher by reducing the number of possible spurious keys to zero in a brute force attack. That is, after trying every possible key, there should be just one decipherment that makes sense, i.e...
of the encoded data and - the parity word can be used for verifying correct decryption.
A typical GSM transaction also includes LAPDm
LAPDm
LAPDm is a data link layer protocol used in GSM cellular networks. LAPDm forms Layer 2 of the Um interface between the Base Transceiver Station and Mobile station, which is to say that it is used in the radio link between the cellular network and the subscriber handset.LAPDm is derived from a much...
idle frames and SACCH system information messages at predictable times, affording a Known plaintext attack.
The GSM ciphering algorithm is called A5. There are four variants of A5 in GSM, only first three of which are widely deployed:
- A5/0—no ciphering at all
- A5/1A5/1A5/1 is a stream cipher used to provide over-the-air communication privacy in the GSM cellular telephone standard. It was initially kept secret, but became public knowledge through leaks and reverse engineering. A number of serious weaknesses in the cipher have been identified.-History and...
: strong(er) ciphering, intended for use in North America and Europe - A5/2A5/2A5/2 is a stream cipher used to provide voice privacy in the GSM cellular telephone protocol.The cipher is based around a combination of four linear feedback shift registers with irregular clocking and a non-linear combiner.In 1999, Ian Goldberg and David A...
: weak ciphering, intended for use in other parts of the world, but now depreciated by the GSMA - A5/3: even stronger ciphering with open design
Ciphering is a radio resource function and managed with messages in the radio resource sublayer of L3, but ciphering is tied to authentication because the ciphering key Kc is generated in that process. Ciphering is initiated with the RR Ciphering Mode Command message, which indicates the A5 variant to be used. The MS starts ciphering and responds with the RR Ciphering Mode Complete message in ciphertext.
The network is expected to deny service to any MS that does not support either A5/1 or A5/2 (GSM 02.09 Section 3.3.3). Support of both A5/1 and A5/2 in the MS was mandatory in GSM Phase 2 (GSM 02.07 Section 2) until A5/2 was depreciated by the GSMA in 2006.