Handoff strategies

When a mobile moves into a different cell while a conversation is in progress, the MSC automatically transfers the call to a new channel belonging to a new base station. This handoff not only involves identifying a new base station but also requires that the voice and control signals be allocated to channels associated with the new base station andoffs must be performed successfully and infrequently as possible System designers must ta!e care to achieve effective measure to achieve handoff " method to perform handoff# "n optimum signal level need to be determined to perform handoff

$nce a particular signal level is specified as the minimum usable signal for acceptable voice quality at the base station receiver %normally between &'(d)m and &*((d)m+ ,-.r%handoff+&.r%minimum usable+ /f , is too large then handoffs occur too frequently0 while if the difference is too small then there may be insufficient time to complete a handoff before the signal becomes too wea! and is subsequently lost. /n deciding when to handoff, it is important to ensure that the drop in measured signal is not due to momentary fading and the mobile is actually moving away from the base station.

/n order to ensure this, the base station monitors the signal level for a certain time period before a handoff is initiated The time over which a call may be maintained within a cell, without handoff is called dwell time. The dwell time, is governed by factors propagation, interference, distance between subscriber and base station. Method of handoff# /n first generation analog cellular systems, signal strength measurements are made by base stations and supervised by MSC. 1ach base station constantly monitors the signal strength of all of its reverse voice channels to determine the relative location of each mobile user with respect to the base station tower. /n addition to measuring 2SS/ when call is in progress, a spare receiver called 3locator receiver4, is used to determine signal strengths of mobile users

which are in neighboring cells The locator receiver is controlled by MSC and is used to monitor signal strength of neigboring cells which appear to be in need of handoff and reports all the 2SS/ values to the MSC. /n second generation systems that use digital T,M" technology, handoff decisions are mobile assisted /n Mobile Assisted Handoff , every mobile station measures the received power from the surrounding base stations and continually reports the results of these measurements to the serving base station. " handoff is initiated when the power received from the base station of a neighboring cell begins to e5ceed the power received from the current base station by a certain level. This method of handoff is fast, as it doesn6t involve MSC to ta!e the decision Hard handoff: Hard handoff happens when the connection between the mobile and its initially& serving base station is momentarily bro!en before reconnecting with the new base station. This is the method traditionally used in e5isting cellular systems, because it requires the least processing by the networ! providing service. Soft handoff: In soft handoff the two base stations are briefly simultaneously connected to the mobile unit while crossing the cell boundary. "s soon as the mobile7s 28 lin! with the new base station is acceptable, the initially&serving base station disengages from the mobile unit.
A handoff may span to The same MSC, which is referred to as inter- cell or inter-BS handoff Two different MSCs, which is referred to as inter-system or inter-MSC handoff.

Prioritizing handoffs 9iving priority to handoff called the guard channel concept " fraction of available channels in a cell is reserved e5clusively for handoff requests The drawbac! is reduced total carried traffic :ueuing of handoff requests is another method to decrease the probability of forced termination due to lac! of available channels

Practical handoff considerations

igh speed vehicles pass through the coverage region of a cell within matter of seconds, whereas pedestrian users may never need a handoff during a call. ,ue to fast movement of vehicles MSC can be burdened to manage the handoff. To overcome that , an approach called as 3umbrella approach 4been proposed

Cell dragging: it results from pedestrian users that provide a very strong signal to the base station. Such situation occurs in line of sight radio path between subscriber and base station. "s the user travels away from the base station at a very low speed, the average signal doesn6t reduce. 1ven when the user has traveled beyond the designed range of cell, the received signal at the base station is above the threshold, thus handoff maynot be made.

This creates interference and traffic management problem To deal ith this handoff thresholds and radio co!erage pattern m"st be ad#"sted caref"lly

Interference and system capacity

Sources of interference are# mobile in same cell, a call in progress in a neighboring cell, other base stations operating in the same frequency band /nterference on voice channels causes cross tal!, where the subscriber hears interference in the bac!ground due to an undesired transmission $n the control channels, interference leads to missed and bloc!ed calls due to errors in the digital signaling. /nterference is more severe in urban areas due to greater 28 noise floor and large number of

base stations and mobiles Two ma;or types of system&generated cellular interference are# < co&channel interference < ad;acent channel interference

GSM %Global System for Mobile Communications , originally $ro"pe Sp%cial Mobile+, is a standard set developed bythe 1uropean Telecommunications Standards /nstitute %1TS/+ to describe protocols for second generation %=9+ digital cellular networ!s used by mobile phones.

The 9SM standard was developed as a replacement for first generation %*9+ analog cellular networ!s, and originally described a digital& circ"it-s itched net or' optimi>ed for full duple5 voice telephony. This was e5panded over time to include data communications, first by circuit&switched transport, then pac!et data transport via 9.2S %9eneral .ac!et 2adio Services+ and 1,91 %1nhanced ,ata rates for 9SM 1volution or 19.2S+.he primary goal of 9SM was to provide a mobile phone system that allows users to roam and provides voice services compatible to /S,? and other .ST? systems. 9SM has initially been deployed in 1urope using @'(A'*B M > for uplin!s and 'CBA'D( M > for downlin!s A this system is now also called GSM 900 to distinguish it from the later versions. These versions comprise 9SM at *@(( M > %*E*(A*E@B M > uplin!, *@(BA*@@( M > downlin!+, also called ,CS %digital cellular system+ *@((, and the 9SM system mainly used in the FS at *'(( M > %*@B(A*'*( M > uplin!, *'C(A*''( M > downlin!+, also called .CS %personal communications service+ *'((. 9SM G(( is a proposal to deploy 9SM at GB(.GAGBE.DHGE@.@A G@D M > for uplin!s and GD(.GAGDE.DHG@@.@AG'D M > for downlin!s. Mobile ser ices 9SM and permits the integration of different data services and the interwor!ing with e5isting networ!s. different categories voice

Services ma!e a networ! interesting for customers. 9SM has defined three of ser ices # bearer, tele, and supplementary services.

!earer ser ices: 9SM specifies different mechanisms for data transmission, the original 9SM allowing for data rates of up to 'D(( bitHs for non&voice services. )earer services permit transparent and non"transparent# synchronous or asynchronous data transmission$ %ransparent bearer ser ices only use the functions of the physical layer %layer *+ to transmit data. ,ata transmission has a constant delay and throughput if no transmission errors occur. The only mechanism to increase transmission quality is the use of forward error correction %81C+, which codes redundancy into the data stream and helps to reconstruct the original data in case of transmission errors. &on"transparent bearer ser ices use protocols of layers two and three to implement error correction and Iow control.

These services use the transparent bearer services, adding a radio lin! protocol %2J.+. This protocol comprises mechanisms of high&level data lin! control % ,JC+, and special selective& re;ect mechanisms to trigger retransmission of erroneous data. %ele ser ices 9SM mainly focuses on voice&oriented tele services. "nother service offered by 9SM is the emergency number. This service is mandatory for all providers and free of charge. This connection also has the highest priority, possibly pre&empting other connections, and will automatically be set up with the closest emergency center. " useful service for very simple message transfer is the short message ser ice 'SMS(, which offers transmission of messages of up to *D( characters. SMS messages do not use the standard data channels of 9SM but e5ploit unused capacity in the signalling channels The successor of SMS, the enhanced message ser ice ')MS(# offers a larger message

si>e %e.g., ED( characters, concatenating several SMs+, formatted te5t, and the transmission of animated pictures, small images and ring tones in a standardi>ed way %some vendors offered similar proprietary features before+. 1MS never really too! off as the multimedia message ser ice %MMS+ was available. %?o!ia never li!ed 1MS but pushed Smart Messaging, a proprietary system.+ MMS offers the transmission of larger pictures %9/8, K.9, W)M.+, short video clips etc. and comes with mobile phones that integrate small cameras. "nother non&voice tele service is group * fa+, which is available worldwide. /n this service, fa5 data is transmitted as digital data over the analog telephone networ! according to the /TF&T standards T.G and T.C( using modems. Supplementary ser ices 9SM providers can offer supplementary services. Similar to /S,? networ!s, these services offer various enhancements for the standard telephony service, and may vary from provider to provider. Typical services are user identification# call redirection# or forwarding of ongoing calls. Standard /S,? features such as closed user groups and multiparty communication may be available.

(. System architect"re

.L

.L
BSS

LLLL...L..L .

radio cell

8unc t onalarchitec ture of a

"SS

9S M* system

",..&&&& &&&&&....#&&&&&&&&&& ,&&N.& &. L L.

-----------#:;/--------,,77

..
" . ..... ....

?SS

Of .H#.#&&&... M
.--'--'-.
/S,?,.ST?

l J>. .....
s

" 9SM system consists of three subsystems, the radio sub system ',SS(, the networ- and switching subsystem '&SS(# and the operation subsystem '.SS($

Cell: Cell is the basic service area# one )TS covers one cell. 1ach cell is given a Cell 9lobal /dentity %C9/+, a number that uniquely identifies the cell. /ocation Area: " group of cells form a Jocation "rea. This is the area that is paged when a subscriber gets an incoming call. 1ach Jocation "rea is assigned a Jocation "rea /dentity %J"/+. 1ach Jocation "rea is served by one or more )SCs. Mobile station international IS0& number 'MSIS0&(: The important number for a user of 9SM is the phone number. The number is associated with S/M, which is personali>ed for a user. The MS/S,? follows the /TF&T standard . This number consists of the country code %CC+ %e.g., PG' *E' *=CGBDE with G' for 9ermany+, the national destination code %?,C+ %i.e., the address of the networ! provider, e.g., *E'+, and the subscriber number %S?+. International mobile subscriber identity 'IMSI(: 9SM uses the /MS/ for internal unique identification of a subscriber. /MS/ consists of a mobile country code %MCC+ %e.g., =G( for Sweden, =(@ for 8rance+, the mobile networ! code %M?C+ %i.e., the code of the networ! provider+, and finally the mobile subscriber identiQcation number %MS/?+. %emporary mobile subscriber identity '%MSI(: To hide the /MS/, which would give away the e5act identity of the user signaling over the air interface, 9SM uses the G byte TMS/ for local subscriber identification. TMS/ is selected by the current RJ2 and is only valid temporarily and within the location area of the RJ2 %for an ongoing communication TMS/ and J"/ are sufficient to identify a user0 the /MS/ is not needed+. "dditionally, a RJ2 may change the TMS/ periodically. Mobile station roaming number 'MS,&(: "nother temporary address that hides the identity and location of a subscriber is MS2?. The RJ2 generates this address on request from the MSC, and the address is also stored in the J2. MS2? contains the current visitor country code %RCC+, the visitor national destination code %R?,C+, the identification of the current MSC together with the subscriber number. The MS2? helps the J2 to Qnd a subscriber for an incoming call.

,adio subsystem: "s the name implies, the radio subsystem %2SS+ comprises all radio specific entities, i.e., the mobile stations %MS+ and the base station subsystem %)SS+. 8igure shows the connection between the 2SS and the ?SS via the " interface %solid lines+ and the connection to the $SS via the $ interface %dashed lines+. The " interface is typically based on circuit&switched .CM&C( systems %=.(G@ MbitHs+, carrying up to C( DG !bitHs connections, whereas the $ interface uses the Signalling System ?o. E %SSE+ based on S.=B carrying management data toHfrom the 2SS. !ase station subsystem '!SS(: The )SS is composed of two parts# The )ase Transceiver Station %)TS+ The )ase Station Controller %)SC+ The )SS carries out transcoding of speech channels, allocation of radio channels to mobile phones, paging, transmission and reception over the air interface and many other tas!s related to the radio networ!. !ase transcei er station '!%S(: The )TS houses the radio transceivers that define a cell and handles the radio lin! protocols with the MS. The )TS corresponds to the transceivers and antennas used in each cell of the networ!. " )TS is usually placed in the center of a cell. /ts transmitting power defines the si>e of a cell. 1ach )TS has between * and *D transceivers, depending on the density of users in the cell. 1ach )TS serves as a single cell. /t also includes the following functions# 1ncoding, encrypting, multiple5ing, modulating, and feeding the 28 signals to the antenna Transcoding and rate adaptation Time and frequency synchroni>ing Roice through full& or half&rate services ,ecoding, decrypting, and equali>ing received signals 2andom access detection

!ase station controller '!SC(: The )SC basically manages the )TSs. The )SC manages the radio resources for one or more )TSs. /t handles radio channel setup, frequency hopping, and handovers. The )SC is the connection between the mobile and the MSC. The )SC also translates the *C Tbps voice channel used over the radio lin! to the standard DG Tbps channel used by the .ublic Switched Telephone ?etwor! %.S,?+ or /S,?.

/t assigns and releases frequencies and time slots for the MS. The )SC also handles intercell handover. /t controls the power transmission of the )SS and MS in its area. The function of the )SC is to allocate the necessary time slots between the )TS and the MSC. /t is a switching device that handles the radio resources. Additional functions include: Control of frequency hopping .erforming traffic concentration to reduce the number of lines from the MSC .roviding an interface to the $perations and Maintenance Center for the )SS 2eallocation of frequencies among )TSs Time and frequency synchroni>ation .ower management Time&delay measurements of received signals from the MS Mobile Station 'MS( # The MS is the user equipment which contains the software required for communication with the 9SM networ!. The MS consists of user independent hardHsoftware and the subscriber identity module %S/M+, which stores the user specific data. While an MS can be identified via the international mobile equipment identity %/M1/+

" subscriber identity module or subscriber identification module %SIM+ is an integrated circuit that securely stores the international mobile subscriber identity %/MS/+ and the related !ey used to identify and authenticate subscribers on mobile telephony devices

SIM card contains many identifiers and tables, such as card& type, serial number, a list of subscribed services, a personal identity number %./?+, a ./? unbloc!ing !ey %.FT+, an authentication !ey Ti , and the international mobile subscriber identity %/MS/+. The ./? is used to unloc! the MS. Fsing the wrong ./? three times will loc! the S/M. /n such cases, the .FT is needed to unloc! the S/M. The MS stores dynamic information while logged onto the 9SM system, such as, e.g., the cipher !ey Tc and the location information consisting of a temporary mobile subscriber identity %TMS/+ and the location area identiQcation %J"/+. SIM cards are identified on their individual operator networ!s by a unique /nternational Mobile Subscriber /dentity %/MS/+. Mobile networ! operators connect mobile phone calls and communicate with their mar!et S/M cards using their /MS/s
The T is a *=@&bit value used in a"thenticating the S)Ms on the mobile net or'. 1ach S/M holds a unique T assigned to it by the operator during the
i i

personali>ation process.

Authentication process:
1hen the Mobile )2uipment starts up, it obtains the /nternational Mobile Subscriber /dentity %/MS/+ from the S/M card, and passes this to the mobile operator requesting access and authentication. The operator networ! searches its database for the incoming /MS/ and its associated T .
i

The operator networ! then generates a 2andom ?umber and signs it with the T associated with the /MS/ %and stored on the S/M card+, computing another
i

number !nown as Signed 2esponse * %S21SU*+. The operator networ! then sends the 2"?, to the Mobile 1quipment, which passes it to the S/M card. The S/M card signs it with its T , producing
i

S21SU=, which it gives to the Mobile 1quipment along with encryption !ey T . The Mobile 1quipment passes S21SU= on to the operator networ!.
c

The operator networ! then compares its computed S21SU* with the computed S21SU= that the Mobile 1quipment returned. /f the two numbers match, the S/M is authenticated and the Mobile 1quipment is granted access to the operator7s networ!. Tc is used to encrypt all further communications between the Mobile 1quipment and the networ!.

/ocation area identity The S/M stores networ! state information, which is received from the Jocation "rea /dentity %J"/+. $perator networ!s are divided into Jocation "reas, each having a unique J"/ number. When the device changes locations, it stores the new J"/ to the S/M and sends it bac! to the operator networ! with its new location. /f the device is power cycled, it will ta!e data off the S/M, and search for the prior J"/.
8unction Management of radio channels 8requency hopping Management of terrestrial channels Mapping of terrestrial onto radio channels

3 3 3 3 3 3 3
...
"

Channel coding and decoding 2ate adaptation 1ncryptionHdecryption .aging Fplin! Signal measurement Traffic measurement "uthentication Jocation registry, location update andover management

...
"

3 3

3 3

X X

?etwor! and switching subsystem

The 3heart4 of the 9SM system is formed by the networ! and switching sub&system %?SS+. The ?SS connects the wireless networ! with standard public networ!s, performs handovers between different )SSs, comprises functions for worldwide locali>ation of users and supports charging, accounting, and roaming of users between different providers in different countries. The ?SS consists of the following switches and databases# Mobile ser ices switching center 'MSC(: The central component of the ?etwor! Subsystem is the MSC. The

MSC performs the switching of calls between the mobile and other fi5ed or mobile networ! users, as well as the management of mobile services such as registration, authentication, location updating, handovers, and call routing to a roaming subscriber. SSE %Signalling System E+ covers all aspects of control signaling for digital networ!s %reliable routing and delivery of control messages, establishing and monitoring of calls+. 8eatures of SSE are number calling etc. Home location register 'H/,(: The relevant information. portability, free phoneHtollHcollectHcredit calls, call forwarding, three&way

J2 is the most important database in a 9SM system as it stores all user&

This comprises static information, such as the mobile subscriber /S,? number %MS/S,?+, subscribed services %e.g., call forwarding, roaming restrictions, 9.2S+, and the international mobile subscriber identity %/MS/+. 0ynamic information is also needed, e.g., the current location area %J"+ of the MS, the mobile subscriber roaming number %MS2?+, the current RJ2 and MSC. "s soon as an MS leaves its current J", the information in the J2 is updated. This information is necessary to locali>e a user in the worldwide 9SM networ!.

4isitor location register '4/,(: The RJ2 associated to each MSC is a dynamic database which stores all important information needed for the MS users currently in the J" that is associated to the MSC %e.g., /MS/, MS/S,?, J2 address+.

/f a new MS comes into an J" the RJ2 is responsible for, it copies all relevant information for this user from the J2. This hierarchy of RJ2 and J2 avoids frequent J2 updates and long&distance signaling of user information.

$peration subsystem
The third part of a 9SM system, the operation subsystem %$SS+, contains the necessary functions for networ! operation and maintenance. The $SS possesses networ! entities of its own and accesses other entities via SSE signaling The following entities have been deQned# .peration and maintenance center '.MC(: The $MC monitors and controls all other networ! entities via the $ interface %SSE with S.=B+. X.25 is a standard suite of protocols used for pac!et switching across computer networ!s. Signalling System &o$ 5 %SS5+ is a set of telephony signaling protocols which are being used to set up most of the world7s public switched telephone networ! %.ST?+ telephone calls. Typical $MC management functions are traffic monitoring, status reports of network entities, subscriber and security management, or accounting and billing. $MCs use the concept of telecommunication management net& wor! %TM?+ as standardi>ed by the /TF&T.

Authentication centre 'AuC(: "s the radio interface and mobile stations are particularly vulnerable, a separate "uC has been deQned to protect user identity and data transmission.

The "uC contains the algorithms for authentication as well as the !eys for encryption and generates the values needed for user authentication in the J2. The "uC may, in fact, be situated in a special protected part of the J2. )2uipment identity register ')I,(: The 1/2 is a database for all /M1/s, i.e., it stores all device identifications registered for this networ!.

"s MSs are mobile, they can be easily stolen. With a valid S/M, anyone could use the stolen MS. The 1/2 has a blac!list of stolen %or loc!ed+ devices. /n theory an MS is useless as soon as the owner has reported a theft.

G ! Protocol Architect"re

u171 ./r /nt%lrfa.oo

"

GM

CM

Jayer C

MM

SCC. Jayer = MTP

Jayer *

)lVS CM: CO miCtion managams T,M"H8,M" MM# Mobility man,agement

SCC.0 Si nl cer.nrM)c ion conrol part

)SC

((: )a% resource management MIT P" M e7SSCg-* t tr*lls +*-f Pt1J J".,#Ji ! access pro OO,I -,

ITtg: JII C '1.1

T!": #SJ$l

protW/$.ll

a"%l&:te tlJ"''

-.

 1ach of the =G@ channels is additionally separated in time via a 9SM T,M" frame, The duration of a frame is G.D*B ms. " frame is again subdivided into @ 9SM time slots, where each slot represents a physical T,M channel and lasts for BEE Xs ,ata is transmitted in small portions, called bursts The burst is only BGD.B Xs long and contains *G@ bits. The remaining C(.B Xs are used as guard space to avoid overlapping with other bursts due to different path delays and to give the transmitter time to turn on and off The Qrst and last three bits of a normal burst %tail+ are all set to ( and can be used to enhance the receiver performance. The training sequence in the middle of a slot is used to adapt the parameters of the receiver to the current path propagation characteristics and to select the strongest signal in case of multi&path propagation.

9SM .rotocol Stac!

B(

/n any telecommunication system, signalling is required to coordinate the necessarily distributed functional entities of the networ!.
&

The transfer of signalling information in 9SM follows the layered $S/ model

/ayer 6: .hysical Jayer

2adio Transmission provides error&free transmission between ad;acent entities, based on the /S,?6s J"., protocol for the Fm and "bis interfaces, and on SSE6s Message Transfer .rotocol %MT.+ for the other Jayer interfaces $ It offers reliable

/ayer 7# ,ata Jin! Jayer %,JJ+

data transfer o er connections# re"se2uencing of data frames# and flow control

/ayer *: ?etwor!ing or Messaging Jayer

2esponsible for the communication of networ! resources, mobility, code format and call&related management messages between various networ! entities

The data lin! layer %layer =+ over the radio lin! is based on a modified J"., %Jin! "ccess .rotocol for the , channel+ referred to as J".,m %m li!e mobile+. B(

$n the "&bis interface, the layer = protocol is based on the J"., from /S,?.The Message Transfer .rotocol %MT.+ level = of the SSE protocol is used at the " interface.

Jayer

/// Message

2adio 2esource Management %22+, Mobility Management %MM+ and Connection Management %CM+.

2adio 2esource Management %22+

B(

B(

Mobility Management %MM+

& "ssumes a reliable 22 connection & 2esponsible for & location management and & Security
/ocation management involves the procedures and signaling for location "pdating, so that the mobile6s current location is stored at the J2, allowing incoming calls to be properly routed.
&

& Security involves the a"thentication of the mobile, to prevent unauthori>ed access to the networ!, as well as the encryption of all radio lin! traffic. & The protocols in the MM layer involve the S/M, MSC, RJ2, and the J2, as well as the "uC %which is closely tied with the J2+.

The CM functional layer is divided into three sub layers. & Call Control %CC+ & Supplementary Services & Short Message Service Call Control 'CC( sub layer & manages call routing, establishment, maintenance, and release, and is closely related to /S,? call control.

Connection Management %CM+

Supplementary Ser ices sub layer& manages the implementation of the various supplementary services %Call 8orwardingHwaitingHhold +, and also allows users to access and modify their service subscription. Short Message Ser ice sub layer& handles the routing and delivery of short messages, both from and to the mobile subscriber.

ecurity
9SM offers several security services using conQdential information stored in the "uC and in the individual S/M %which is plugged into an arbitrary MS+. The S/M stores personal, secret data and is protected with a ./? against unauthori>ed use. %8or e5ample, the secret !ey Ti used for authentication and encryption procedures is stored in the S/M.+ The security services offered by 9SM are# Access control and authentication# The Qrst step includes the authentication of a valid user for the S/M. The user needs a secret ./? to access the S/M. Con8dentiality: "ll user&related data is encrypted. "fter authentication, )TS and MS apply encryption to voice, data, and signaling Anonymity# To provide user anonymity, all data is encrypted before transmission, and user identiQers %which

would reveal an identity+ are not used over the air. /nstead, 9SM transmits a temporary identiQer %TMS/+, which is newly assigned by the RJ2 after each location update. "dditionally, the RJ2 can change the TMS/ at any time

Algorithm A* is "sed for a"thentication& A+ for encryption& and A, for the generation of a cipher 'ey.

a. "uthentication

)efore a subscriber can use any service from the 9SM networ!, he or she must be authenticated. "uthentication is based on the S/M, which stores the individual authentication !ey Ti , the user identiQcation /MS/, and the algorithm used for authentication "C. "uthentication uses a challenge& response method#

control "C generates a random number 2"?, as challenge, and the S/M within the MS answers with S21S %signed response+ as response %see 8igure+. The "uC performs the basic generation of random values 2"?,, signed responses S21S, and cipher !eys Tc for each /MS/, and then forwards this information to the J2. The current RJ2 requests the appropriate values for 2"?,, S21S, and Tc from the J2. 8or authentication, the RJ2 sends the random value 2"?, to the S/M. )oth sides, networ! and subscriber module, perform the same operation with 2"?, and the !ey Ti , called "C. The MS sends bac! the S21S generated by the S/M0 the RJ2 can now compare both values. /f they are the same, the RJ2 accepts the subscriber, otherwise the subscriber is re;ected

1ncryption

To ensure privacy, all messages containing user&related information are encrypted in 9SM over the air interface."fter authentication, MS and )SS can start encryption by applying the cipher !ey Tc %the precise location of security functions for encryption, )TS andHor )SC are vendor dependent+. using

Tc is generated using the individual !ey Ti and a random value by applying the algorithm "@. ?ote that the S/M in the MS and the networ! both calculate the same Tc based on the random value 2"?,. The !ey Tc itself is not transmitted over the air interface. MS and )TS can now encrypt and decrypt data using the algorithm "B and the cipher !ey Tc. "s 8igure shows, Tc should be a DG bit !ey A which is not very strong, but is at least a good protection against simple eavesdropping.