Download

372 SIGNALING IN CELLULAR MOBILE TELECOMMUNICATIONSTemporary Mobile Station Identity (TMSI). This is a 32-bit binary number thatuniquely identifies the MS within one location area, or a group of adjacent locationareas, of a PLMN. TMSI is a temporary identification and is usually changed by thenetwork when the MS enters a new location area. LAI and TMSI are stored in temporarySIM memory.Most messages on the Um (radio) interface identify a MS by TMSI and LAI.IMSIs are used only in exceptional cases. TMSI gives protection against cloning(obtaining MS identifications for fraudulent use), because an intercepted TMSI nolonger identifies the mobile after it has left the location area.International Mobile Equipment Identity (IMEI). This is the counterpart ofthe mobile serial number (MSN) in AMPS. It uniquely identifies a ME. IMEI is a15-digit number, entered into permanent ME memory by the manufacturer.12.8 SIGNALING BETWEEN MOBILE AND NETWORK12.8.1 IntroductionThis section explores the most important signaling procedures on the Um (radio)interface between a MS and a GSM network [21]. As has been mentioned in the previoussection, some layer 3 messages on this interface are between the MS and theBSS of the cell that serves the mobile, and others are between the MS and the MSCthat controls the BSS. This section describes the signaling as seen by the MS andconsiders the BSS and MSC as “the network.”Each message mentioned in this section points to the subsection of Section 12.9that contains the message description. It will be helpful to read Section 12.8 twice,first ignoring the message descriptions, and looking them up the second time around.12.8.2 MS InitializationWhen a MS is powered up by its user, it needs to find the RF carrier in its cell thatcarries the CCCH, and then to achieve synchronization with the Broadcast Channel(BCCH), the Paging Channel (PAGCH), and the Random Access Channel (RACH),which enable the MS to listen to broadcast and paging messages, and to access thenetwork, for location updating and originating calls.In the AMPS/IS-54 system, a predetermined group of RF carriers has beendesignated by TIA as control channels, and a MS initializes by tuning to the strongestone of these channels (Section 12.1.2). GSM does not designate the RF carriersthat carry common-control channels, and a GSM mobile has to scan all RF carriersoperating in the cell and to find the carrier whose time slots 0 contain CCCH.As a first step, the MS scans the downlink RF channels and looks for theFrequency Correction Channel (FCCH), whose bursts have a distinguishablepattern (148 consecutive zeros) and occur in time slots 0 of frames 0, 10, 20, 30,and 40 of the 51-frame multiframe. When the MS recognizes a FCCH burst, itknows that it is tuned to the RF carrier with CCCH, that the current time slot is