Architecture of GSM

Basicly, GSM consists three main subsystems:

>> SSS - Switching SubSystem (commutation network subsystem);

>> RSS - Radio SubSystem;

>> OMS - Operation and Maintenance Subsystem;


SSS

This subsystem is actually the commutation network. The basic elements of this subsystem are:

> MSC - Mobile-services Switching Center;
> VLR - Visitor Location Register;
> HLR - Home Location Register;
> AC - Authentication Center;
> EIR - Equipment Identification Register;

VLR and HLR are databases. As we can see from the Picture 1, MSC can establish connections with other networks, like PSTN (Public Switched Telephone Network), ISDN (Integrated Services Digital Network), etc. For these purposes, the MSC uses IWF (InterWorking Functions).


RSS

This is the Radio subsystem, which actually provides the mobile communications between the users of GSM. The RSS subsystem is consists of:

> BSC - Base Station Controllers;
> BTS - Base Transceiver Stations;
> MS - Mobile Station (mobile phone, this is user side);

Every BSC is consists of two sub-elements: BCE - Base Station Central Equipment, and TCE - TransCoding Equipment. Maximum of 16 BTS-s can be connected to one BSC. One BTS can serve up to 24 TDMA (Time Division Multiple Access) systems, but one BCE can serve maximum of 48 TDMA.


OMS

The OMS subsystem has the main role in the GSM system, because it operates with other two subsystems, RSS and SSS, and provides maintenance for them. The architecture of the GSM system is shown on the Picture 1.

Picture 1: Architecture of GSM


SIM Card

SIM - Subscriber Identity Module. The SIM card is placed in mobile phone (MS), and this is users identification. Another parameters for users of GSM are:

> IMSI - International Mobile Subscriber Identification;
> TMSI - Temporary MSI;
> MSRN - Mobile Station Roaming Number;
> MSISDN - Mobile Subscriber ISDN number;
> LMSI - Local MSI;



Hierarchy of areas

Location Area (LA) is territory of one or more cells. Every LA has its own LAI - Location Area Identity. One or more LA-s creates area which is under control of one VLR, and this area is called VLRA - Visitor Location Register Area. One or more VLRA-s creates an PLMNA - Public Land Mobile Network Area. One or more PLMNA-s are included within the state PLMN (or state GSM area).


Signal processing

GSM uses RPE-LTP (Residual Pulse Excited - linear Long Term Predictive) coder or RELP - Residual Excited Linear Prediction coder. Samples are taken on every 20 ms, and they are digitalized with 260 bits, so, the speed of data transfer for speech is 13 kbps (kilo bits per second). Adding the redundant bits for every sample, the number of bits per sample then is 456, and the speed of data transfer is 22.8 kbps. These bits are followed into modulator. GSM uses digital phase modulation, like GMSK - Gaussian Minimum Shift Keying.

Mobile Telecommunications Systems

First generation (1G) of wireless communication (mobile telecommunications) was based on analog radio technology. The analog telecommunications standards were introduced in the 1980s. After that they were replaced with digital radio signals, which is actually the beginning of 2G networks (second generation).

One such standard is CT-1 (Cordless telephone - 1). Other examples for these analog standards are:

>> AMPS - Advanced Mobile Phone System (used in north America)
>> TACS - Total Access Communications System (used in Europe)
>> NTT - Nippon Telephone and Telegraph System (used in Japan)
>> NMT - Nordic Mobile Telephone (used in north Europe)
>> C-450 - (used in Germany)


The second generation (2G) of mobile telecommunication networks is based on digital radio technology. The most popular 2G standards are:

>> GSM - Global System for Mobile Communications (Europe)
>> IS-54 - Interim Standard (America)
>> NDC - Nippon Digital Cellular (Japan)


3G (third generation) standard for mobile telecommunication networks is UMTS - Universal Mobile Telecommunication System. The 3rd Generation Partnership Project (3GPP) is a collaboration between groups of telecommunications associations with the initial scope to make a globally applicable third-generation (3G) mobile phone system specification based on evolved GSM specifications.


Candidates for the fourth generation (4G) standards are:

>> LTE Advanced - Long-term-evolution Advanced
>> 3GPP LTE
>> Mobile WiMAX (IEEE 802.16e) - Mobile Worldwide Interoperability for Microwave Access
>> Flash OFDM - Flash Orthogonal Frequency Division Multiplexing
>> UMB - Ultra Mobile Broadband

Security for Wireless Instrumentation

The last decade has seen huge growth in wireless process instruments and other field devices. While there was a brief time of protocol development, most suppliers and end users have settled on either ISA100.11a (IEC 62734) or WirelessHART (IEC 62591). These two protocols are similar in many ways, including use of the IEEE 802.15.4 radio, but their differences make them incompatible. Some end users have embraced wireless technology rapidly because it offers many advantages for deploying instrumentation and other devices in difficult environments where conventional wiring is expensive or otherwise impractical. At the same time, other users have taken a more conservative approach, not fully convinced that devices depending on radio rather than direct wiring can be sufficiently reliable and secure. After all, radio wave signal propagation can be disrupted in various ways, and its nature makes it difficult to limit where the signal may travel. In this time of concern about cyber security, is it prudent to have such devices using radio communication in critical applications?


Encrypted communication

ISA100.11a and WirelessHART both use sophisticated encryption methods, including 128-bit Advanced Encryption Standard (AES) block cipher. But what does this mean, and does it ensure security? As mentioned before, the two main protocols are incompatible. While there are many similarities, there are also many differences. For purposes of this discussion, we will concentrate on ISA100.11a. “ISA100 Wireless security operates at two levels, in the transport layer and the data-link layer,” says the ISA100 Wireless Compliance Institute (WCI) website (Picture 1). “Transport layer security protects your data. It provides end-to-end assurances that mission-critical messages received are secret and authentic. Data-link layer security protects the network. It provides hop-by-hop assurances that each message is flawlessly transmitted to the next hop, with detailed performance and security diagnostics accumulated at each point.” So what does this mean? Encryption is very important to the extent it is impossible to build any kind of secure wireless network without it. Providing security at two levels in this manner is, for all practical purposes, unbreakable. This method has not been broken, and there is no known technology available today able to break it. However, while it makes the transport mechanism rock solid, there are many other elements to the larger security picture.

Picture 1: ISA100 wireless security operates at two levels: the transport layer and the data-link layer


Wireless service denied

Should the possibility of a DOS (Denial Of Service) attack make you think twice about using wireless instrumentation? It shouldn’t stop you entirely, but it should make you think about how you apply it. Ask yourself what would happen to your process if such a disruption actually occurred. Devices designed to jam other signals, whether crude or sophisticated, have to be relatively close to the signals they mean to interrupt, and they have no capability to gather information or serve as a method for gaining access to another network. They are the cyber security equivalent of throwing a brick through a window. Jamming devices are not difficult to detect so they can usually be located and disabled. Interference that causes jamming can also come from other unintentional sources, so disruptions should not always be seen as an attack. Poorly shielded equipment elsewhere in your plant can cause radio-frequency interference (RFI) that is just as troublesome. In some cases this may require moving the RFI source or network assets to points where the interference is blocked by a building or other plant infrastructure.


How to decrease risk

Wireless field device networks need to be protected following the same basic methods as wired networks. Various network segments should be separated with appropriate demilitarized zones (DMZs) and firewalls to limit movement from one part of the network to another. Supply chain practices should ensure reliance on trusted suppliers with proven security track records. Verifying all the various settings of routers and gateways is critical. Don’t leave inadvertent entry points for hackers because you have not turned off some feature, including those you don’t yet realize are there. Hackers know those points and look for them. You should too. Don’t give away too much information. Hackers look for specific kinds of equipment and specific configurations where they know there are vulnerabilities. Don’t give away information about your networks and the way they’re set up.



Source: Control Engineering, Jeff Melrose - the principal technology strategist for cyber security at Yokogawa Corporation of America.