STATION ID - 7047/3.12 9x Datakit Network FOR OFFICIAL USE ONLY This is a 9x system, restricted to authorized persons and for official 9x business only. Anyone using this system, network or data is subject to being monitored at any time for system administration and for identifying unauthorized users or system misuse. Anyone using this system expressly consents to such monitoring and is advised that any evidence of criminal activity revealed through such monitoring may be provided to law enforcement for prosecution. Understanding The GSM (Part I) by The Monty e-mail me at: m0nty@hack.gr check the http://www.hack.gr/users/m0nty Intro: ~~~~~~~~ GSM stands for Global System Mobile. It's a digital cellular network used in Europe. In 1982 CEPT (Conference of European Postal and Telecommunication Administration) establish a work team for GSM, the Group Special Mobile. The purposes of this team was: > To validate an international European roaming > Improve the quality of the digital communication > Create interfaces for other networks (PSTN, ISDN, PSPDN etc..) > Granting services teleservices (Telebox, Voice Mail, Fax, etc..) > Bearer Services (data communication with 9600bps) > Better use of the frequencies so that the system could have bigger capacity General characteristics of the GSM 900Mhz: > It obviusly uses the frequencies arround 900Mhz. > Has 124 RF channels. > Each RF channel has 8 TDMA channels. > GMSK. > Three cells per Reuse (instead of seven cells in the analog systems). > 6000 subscribers per cell (the analogs can handle about 2280). Introduction: ~~~~~~~~~~~~~~~ A mobile telephony network obviusly has to be connected with the stable telephony network. The mobile network consists from 3 main units, the MSC (Mobile Switching Center) , the BSC (Base Station Center) where the BS (Base Stations) are located and the MS (Mobile Stations) which are the mobile telephones. A MSC is connected via cord with a number of BS. The area that each MSC covers is called service area. The area that a BS covers is called cell area. So we can understand that the service area of a MSC depends to the number of BS that are connected with it. Each BS communicates with the MS (that are inside the cell area) cordless. The structure if the mobile network is called cellular cause of the "cell" that the BS uses. This is a ascii schematic..I know I'm not an ascii artist but i've done my best so..be kind ;) _______ / ____ \ _______/ |BS| \_______ / ____ \ ~~~~ / ____ \ / |BS| \_______/ |BS| \ \ ~~~~ / _____ \ ~~~~ --/------------> this is a cell \_______/ |MSC| \_______/ / ____ \ ~~~~~ / ____ \ / |BS| \_______/ |BS| \ \ ~~~~ / ____ \ ~~~~ / The service area \_______/ |BS| \_______/ and the BSs cells \ ~~~~ / \_______/ Understanding The Calling Procedure: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Every BS has one control channel and many conversation channels. From the MS to the BS and the oposite the control channel is cordless. From the BS to the MSC the control channel is connected with a four-cords line. The signals between the MS and the BS are continuous (through the control channel). The MSC is able to know the exact position of a MS since it communicates with the BS. Roaming: ~~~~~~~~~~ When a MS moves from the cell area of the BS No1 to the cell area of the BS No2 the connection with the control channel 1 (of the BS No1) roams to the control channel 2 (of the BS No2). Roaming is the procedure which the MSC uses in order to know always the exact position of a MS. Making A Call: ~~~~~~~~~~~~~~~~ We will examine here the procedure that takes place each time we call a MS from a stable phone. The MS's number is 094-391-128. You pick up the phone and dial 094-391-128. Your call goes through the MSC that the MS belongs. The MSC orders every BS that are connected with it (remeber the four-cords line that connects the MSC with a BS..) to call the MS via the control channel. () _____ /\ ORDER: 'call' _____ (094-391-128) | | / \ ---------------> | | ----------->----| MSC | / BS \ 094-391-128 | MS| |_____|______________/ \ |___| (4 cord line) When the MS receives the signal from a BS of it's area it sends back a Achnowledgement Signal (AS) in order to confirm the BS that it got the signal. The BS informs the MSC that it received a AS from the MS (094-391-128). Now the MSC uses only the BS that the MS is located in. The MSC knows every moment which convertation channels are free in every BS. () _____ /\ ____ | | / \ (Inform the MS) | | | MSC | / BS \ ---------<--------------| MS | |_____|______________/ \ ------------->----------|____| (4 cord line) (Roams in a conv channel) Thus the MSC chooses a free convertation channel of the BS and orders the MS through the control channel to roam into the convertation channel. The MS roams to that channel and sends through it and the BS a signal to the MSC. The MSC orders the MS through that channel to ring and this is the time that the subscriber understands that someone is calling him. If the subscriber answers the call the MS sends an answer signal to the MSC and the MSC establishes a connection so the convertation begins. Now if the MS wants to call somewhere you first dial the number and then you order the device to dial (pressing the OK button). The MS sends a message to the MSC through the control channel. This message consists from a call signal and the number that you dialed. () ____ /\ _____ | | call signal / \ | | (Stable Telephone | MS | -----------------> / BS \ | MSC |------<------>--- |____| number U dialed / \______________|_____| Network) (4 cord line) The MSC now choose a free convertation channel for the BS and informs the MS about it. The MSC then activates the MS's transmitter and the convertation begins. () ____ _____ /\ (Inform the MS) | | | | / \ ---------<--------------| MS | | MSC | / BS \ ------------->----------|____| |_____|_______________/ \(Roams in a conv channel) (4 cord line) Quality Check: ~~~~~~~~~~~~~~~~ During the convertation the quality of the connection is being checked with a signal from the BS to the MS. This signals returns to the BS from the MS. The BS checks the noise of the returned signal. If the quality is bad then the BS sends an alarm signal in the MSC. The MSC orders the BSs arround the MS to check if any of them has better quality and then inform it. If there is a BS with better quality the MSC orders the MS to roam in another convertation channel inside the BS area (with the better quality). This whole procedure is called handoff (or handover) and lasts less than one second. Of course the subscriber doesn't have a clue about it.. The End: ~~~~~~~~~~ This was the first part of the 'Understanding The GSM' story. The second part will have inside information about MSC and BSC, it'll talk about GSM security and the algorithms that it uses and many more (i hope).. The Monty m0nty@hack.gr