Inside a GSM Network

AuC HLR VLR EIR

BTS

SS 7 LAP-D LAP-Dm

SMSC

GMSC
OMS/SC

BSC

BTS BTS BTS BTS BTS

MS

VLR PSTN

BSC

MSC

BSC

GSM Fundamentals Page 5

sA

MSC - Mobile Switching Center GMSC - Gateway Mobile Sw. Center BSC - Base Station Controller BTS - Base Transceiver Station MS - Mobile Station HLR - Home Location Register VLR - Visitor Location Register EIR - Equipment Info. Register SMSC - Short Message Service Center AuC - Authorization Center OMC/SC - Op/Maint, Service Center
Copyright 2000, Agilent Technologies All Rights Reserved

TRAFFIC MANAGEMENT

Traffic management

Objectives
At the end of the module the student is able to: Explain the mobility concept (handover, location update, paging) List the three numbers in the authentication triplet and explain the use for each of them List at least four teleservices List and explain the operation of at least four supplementary services offered by GSM networks

Registration of a subscriber

Updating subscriber data

Embassy

Provision of services

Turning on a mobile phone

BTS

GSM databases (1)

Subscriber Identity Module (SIM)

Information in a SIM card: Security handling information Subscriber identity Temporary network information Access rights (Nat., Intl.) Preferred networks Prohibited networks

GSM databases (2)

Home Location register (HLR) Permanent data Regular update of subscriber s current VLR Visitor Location register (VLR) Temporary data Kept as long as subscriber is within its coverage area Updated from the HLR Always associated with a Mobile Services Switching Centre (MSC)

HLR

VLR

MSC

Databases in a GSM network

GSM network
HLR VLR

MSC

SIM

Location update

The Mobile Station monitors the information broadcast by the network. The Mobile Station stores the current location area identity in the SIM card. The Mobile Station continues to monitor the broadcast information. If the location area identity being broadcast by the network is other than the one stored in the SIM, the Mobile Station starts the location update procedure.

10

Elements involved in a location update

HLR

VLR

VLR

MSC (old)
Location Update

MSC (new)

Mobile moves

SIM

11

Location update procedure - first time

MS

BSS

MSC

VLR

HLR

LOCATION UPDATE REQUEST REQUEST SUBSCRIBER ID

SEND SUBSCRIBER ID REQUEST AUTHENTICATION INFO SEND AUTHENTICATION INFO AUTHENTICATION AUTHENTICATION RESPONSE LOCATION UPDATE MESSAGE

LOCATION UPDATE OK

ACKNOWLEDGEMENT, SUBSCRIBER INFORMATION

ACKNOWLEDGEMENT

12

Call set-up in a GSM network: PSTN originated call (1)

MSISDN

PSTN

The dialled number is Mobile Subscriber International ISDN Number (MSISDN) MSISDN = CC + NDC + SN CC: Country Code NDC: National Destination Code SN: Subscriber Number 358505527268 358 = Country Code (Finland) 50 = National Destination code (Radiolinja) 5527268 = Subscriber Number

13

Call set-up in a GSM network (2)

HLR

GMSC

PSTN

MSISDN

VLR

GSM Network

The PSTN routes the call to a GSM network The MSC connected to the PSTN is known as the Gateway MSC (GMSC) The GMSC analyses the received MSISDN The only database that knows where a GSM subscriber is at any given moment is the HLR The GMSC requests the HLR for some routing information to know where to route the call This procedure is known as HLR Enquiry

14

Call set-up in a GSM network (3)

The HLR looks up its database. HLR database contents: MSISDN: 358505527268 IMSI: 244052200002345 VLR address: xyz Subscriber data: Services....

IMSI = MCC + MNC + MSIN IMSI: International Mobile Subscriber Identity MCC: Mobile Country Code (3 digits) MNC: Mobile Network Code (2 digits) MSIN: Mobile Subscriber Identity Number (max 10 digits) 244052200002345 244: MCC of Finland 05: MNC of Radiolinja 2200002345: MSIN

15

Call set-up in a GSM network (4)

HLR

Gateway MSC

Target MSC
VLR VLR

PSTN

GSM Network

Elements involved in a call set-up inside the GSM network

16

Call set-up in a GSM network (5)

HLR

Gateway MSC

Routing information request message

VLR

VLR

The HLR takes the VLR address of the subscriber from its database. The HLR sends a routing information request message to the target MSC/VLR. The target MSC/VLR allocates a Mobile Subscriber Roaming Number (MSRN) for this call. MSRN = CC + NDC + SN The format of the MSRN is the same as the MSISDN. The term SN in the MSISDN points to a database location in the HLR; in case of MSRN it points a database location in the VLR. The MSRN also has sufficient information to enable the GMSC to route the call to the target MSC.

Target MSC

17

Call set-up in a GSM network (6)

HLR

358 50 456456 Gateway MSC

MSRN No. to HLR

VLR

The target MSC forwards the MSRN to the HLR. The HLR forwards this to the originating MSC. The originating MSC analyses the MSRN. The telephone number type of format enables the call to be routed to the destination MSC, wherever in the world it may be.

VLR

Target MSC

18

Location areas

Reception Restaurant

Bar

Pool

LA 5 LA 4
MSC
VLR

LA 1

The MSC/VLR area is divided into small areas called Location areas. A subscriber can move within this area without having to make a generic location update (explained later). The maximum size of an LA can be one MSC area and the minimum size is one cell. Paging is done in all cells of the LA where the subscriber is currently located. LAI = MCC + MNC + LAC LAI = Location Area Identity MCC = Mobile Country Code MNC = Mobile Network Code LAC = Location Area Code

LA 3

LA 2
19

Paging process

Location Area
Paging Paging

BTS Mobile responds to paging

Paging

BTS

BTS

20

Simplified steps of a call set-up in a GSM network

ASubscriber

PSTN

GMSC

HLR

MSC/VLR

CALL SETUP (MSISDN) ANALYSE NUMBER CALL SETUP (MSISDN) MSISDN IMSI MSRN MSRN CALL SETUP (MSRN) PAGING

21

Mobile originated call

The Mobile Station user dials a number. The serving MSC analyses the calling subscriber data. Depending on the subscriber data, the MSC will:
authorise or deny the use of the network activate the requested service route the call.

If the dialled number is an MSISDN of another Mobile Station belonging to the same network, an HLR enquiry is performed to obtain the MSRN.
The procedure is same as that of a PSTN originating call.

If the dialled number is any other number, the call is routed out to the Public Switched Telephone Network (PSTN) via the Gateway MSC.

22

Simplified steps of a mobile originated call

EXC

GMSC

HLR

MSC

VLR

BSS

MS
1. channel assignment

2. security procedures

3. call setup 4. check services etc. 5. all ok 6. call is proceeding 7. traffic channel allocated 8. set up the call 9. call set up complete 10. alert 11. B answers

23

Types of location updates

Power On
Also known as IMSI Attach and Location Registration . Done every time a Mobile Station is switched on.

Generic
Done every time a Mobile Station changes a location area.
M SC
VLR

Periodic
Performed after a preset timer expires, since the last transaction with the network. Timer value is dependent on the network operator.

LA 2 LA 1

The Mobile Station starts the procedure.

24

Generic location update procedure

MS

BSS
1. channel assignment

MSC

VLRnew

VLRold

HLR

2. location update request 3. request subscriber identity 4. send subscriber identity and security information 5. security procedures 6. update HLR 7. acknowledgement, subscriber information 8. cancel old location 9. location cancelling accepted 10. location update acknowledgement, new TMSI

11. TMSI acknowledgement

25

Handovers

Handover due to traffic reasons

When the capacity of a cell nears its maximum, mobile stations in the periphery of the cell may be handed over to neighbouring cell with lower traffic load. The MSC starts the procedure.

Handover due to signal quality and strength

When a mobile subscriber is moving during a call, he may travel from one cell to another. Frequency resources of previous cells can not be used any more. The mobile station is handed over to the new cell. The BSC controlling the current cell makes the decision to perform a handover. There are four types of these handovers.

26

Intra cell - Intra BSC handover

Air

BTS

BSC

TC

27

Inter cell - Intra BSC handover

Air
BTS BSC TC

BTS

Old Cell / BTS

New Cell / BTS

28

Inter cell - Inter BSC handover

New Cell / BTS

Air

BTS

BSC

TC

M SC
BSC TC

VLR

BTS

Old Cell / BTS

29

Inter MSC handover (1)

New Cell / BTS

Air

BTS

BSC

TC

M SC

VLR

BTS

BSC

TC

M SC

VLR

Old Cell / BTS

30

Inter MSC handover (2)

The source MSC is known as the Anchor MSC. The call is routed from the source MSC to the target MSC. A routing number is needed to route a call from one MSC to another MSC. The source MSC requests the target MSC for a Handover Number (HON). The target MSC allocates one and gives it to the source MSC. The format is the same as the MSRN. HON = CC + NDC + SN

31

Inter MSC handover (3)

MS

BSSold
1. measurement reports

MSCold

MSCnew

BSSnew

MS (after HO)

2. handover required 3. request HON 4. request for radio resources 5. radio resources reserved 6. provide HON and target cell info 7. set up speech connection (HON)

8. handover command 9. handover complete 10. handover complete 11. connect

12. release old connections

32

Charging

Installation fee

Renting of the service

Use of the network

What to charge? Different charging packages.

33

Factors affecting the price of a call

Type of basic service Duration of the call Time of the call Destination of the call Origin of the call Use of networks Type of supplementary service Use of radio resources Roaming leg

34

Whom to charge?

Where is the called party?

Bill to subscriber

BSC

Billing

BC
Transfer of Charging data

PSTN BC Path of the call

MSC PLMN 2

HLR MSC Charging

PLMN 1 Calling Party

35

Collection of charging data

Charging depends on many factors. The MSC that handles the call collects all information which could be the basis for charging. This collected information call is stored in Charging Data Records (Toll Tickets).

GMSC

BSC

PSTN
BTS

HLR

Charging Data Record

36

Elements involved in call handling

HLR

GMSC

BSC

BTS

PSTN

MSC

BSC

37

Transfer of charging data

Charging records are stored in the MSC where they are collected. When sufficient charging records have been collected they are transferred in one bulk to the Billing Centre. The Billing Centre is responsible for producing the bills for the subscribers based on the information contained in the Charging Record.

HLR

GMSC

MSC

PSTN

BTS BSC

X.25 or Ethernet

Billing Centre (BC)

38

Security issues

Authentication
Verification of the subscriber.

Ciphering
Encryption of user speech in the Air Interface.

IMEI checking
Verification of the Mobile Equipment by checking the validity of the International Mobile Equipment Identity (IMEI).

User confidentiality
Avoidance of the broadcast of user s IMSI in the Air Interface.

39

Authentication

Each subscriber has an identity key, Ki, stored in the Authentication Centre (AC) and the SIM card. Comparison of Ki without broadcasting it in the Air Interface. Authentication always performed by the VLR before call establishment and location update.

Air SIM card

AC
MSC

* I MSI * Ki

VLR

* I MSI * Ki

40

Security algorithms

Need to check Ki without transmitting it in the air

Use of one-way algorithm, A3, to produce a Signed Response (SRES), by using a Random Number (RAND) and Ki as inputs. SRES is calculated in the AC and SIM, and compared in the VLR for authentication.

Need a cipherkey, Kc to encrypt user speech.

Kc is generated using the algorithm A8.

Actual encryption of user speech is done using Kc and digitised speech as inputs to the encryption algorithm A5.
Performed between the Base Transceiver Station (BTS) and the Mobile Equipment (ME).

41

Location of security algorithms

A ir

AC
A3
BTS BSC TC

A8

MSC
VLR

ME + SIM

A5

A5

A3

A8

42

Authentication triplet

Authentication verification is done in the VLR serving the subscriber. The VLR can be external to the subscriber s home network (in case of roaming). Excessive signalling is required to transfer the SRES to the VLR every time authentication is needed. The AC generates a number of SRESs, and transfers them along with the corresponding RAND and cipher key Kc to the serving VLR. The VLR uses the triplets to verify the subscriber. When the number of triplets reaches below a certain threshold, new triplets are requested from the AC.

43

Authentication triplet generation

Random number generator

Ki

AC
RAND

A3

A8

SRES

Kc

Authentication triplet

VLR

RAND

SRES

Kc

Authentication triplet

44

Authentication procedure

Authentication Triplet

VLR

RAND

SRES

Kc

Comparison

BSC

BTS
MS
RAND

Kc

SIM
A3

SRES Kc

Ki

A8

45

Speech encryption

SPEECH/DATA

BTS

A5
Kc TDMA

A5

ENCRYPTED SPEECH/DATA

A5
Kc TDMA

A5

SPEECH/DATA

46

IMEI checking

The validity of a mobile equipment may be checked to ensure its proper operation and as prevention against stolen phones. The Equipment Identity Register (EIR), which is implemented as part of the HLR, can store black listed IMEI numbers. The mobile equipment sends its IMEI before a transaction with the network The MSC can request the EIR to see if the received IMEI is black listed If it is, the MSC can stop the call set-up An operator can set the MSC to check the IMEI of a mobile equipment at times other than during call set-up as well.

47

User confidentiality

IMSI is a confidential identity of the subscriber. After a successful first time location update, a mobile subscriber is allocated a Temporary Mobile Subscriber Identity (TMSI). The next time a transaction between the GSM network and the MS is initiated, the subscriber is identified by the use of TMSI. TMSI is reallocated after every successful authentication verification. The format of TMSI is operator dependent. It is a 32 bit binary number. Additionally, there is the provision of a Personal Identification Number (PIN) code in the SIM card, which, if enabled, must be entered before an MS can be used.

48

Services

What are services?

A subscriber action that uses the facilities of the GSM network.

Classification of services
Teleservices Provide full communication capacity by means of terminals and network functions. OSI layers 1 to 7. Bearer services Provide the capability for transmitting signals between the GSM network access point and an appropriate access point in the terminating network. OSI layers 1 to 3.
Basic services Supplementary services

Services

Teleservices

Bearer services

49

Teleservices

Service Description

Speech (Telephony)

GSM Specification Code T11

Characteristics

Speech (Emergency Calls) Short Message Service (Mobile terminated) Short Message Service (Mobile originated) Short Message Service (cell broadcast) Group 3 Facsimile transmission (with alternate speech) Automatic Group 3 Facsimile transmission

T12 T21 T22 T23

The most important service for mobile systems, normal speech service, including emergency calls. Emergency calls are possible automatically. For the reception of Short messages. For sending a short message to another GSM subscriber. For sending short messages to more than one receiver simultaneously within a given cell. Not supported by NOKIA. For sending and receiving facsimile messages.

T61 T62

50

Short Message Service (MO, MT)

Air

MSC

VLR

Short Message Service, Mobile Originated

Short Message Service, Mobile Terminated

SM S

A fa sk op m 346 l

Alfask op m3 4 6

A lfa sko p m34 6

51

Short Message Service (Cell broadcast)

Air
BTS

BTS BTS BTS BSC

BTS

Short Message Service, Cell Broadcast

O&M
Alfask o pm3 46

A lf s k op m346 a

Alf sk o pm 346 a

52

SMS Architecture

BSS NSS
BTS BSC TRAU MS BTS EIR HLR
AC

MSC/VLR

SMSIWMSC SMSGMSC

SMSC

Ext. Appl.

SMS-IWMSCSMS Interworking MSC SMS-GMSC SMS Gateway MSC SMSC SMS Centre

53

MO Short Message,GSM (Successful Case)

MS

1 3 9

5 MSC 8 SMSIWMSC

6 7 SMSC

VLR

HLR

1: Access Request 2: Access Request 3: Message Transfer

4: SendInfoFor-MO-SMS 5: ForwardShortMessage 6: Message Transfer

7: Submit Report 8: Submit Report 9: Submit Report

54

MT Short Message, (Failure Due to Absent Subscriber)

3 MS MSC/ SGSN 5 4 6 SMSGMSC 7 2

1 8 SMSC

VLR

HLR

1: Message Transfer 2: SendRoutingInfo ForShortMsg 3: ForwardShortMessage

4: SendInfoForMT-SMS 5: Failure Report 6: Failure Report

7: SM-Delivery ReportStatus 8: Failure Report

55

Facsimile transmission

Air
Transparent / Non Transparent

A
HLR AC EIR

BTS

BSC

TC

M SC

VLR

IW F
Modems / Rate Adaptation

56

Data services

Air
Transparent / Non Transparent

A
HLR AC EIR

BTS

BSC

TC

M SC

VLR

IW F
Synchronous / Asynchronous Modems / Rate Adaptation

57

Supplementary services (1)

Call Forwarding Unconditional Call Forwarding on Mobile Subscriber Busy Call Forwarding on No Reply Call Forwarding on Mobile Subscriber Not reachable Barring Of Outgoing Calls Barring Of Outgoing International Calls Barring Of all Incoming Calls Barring Of Outgoing International Calls Excluding Those Directed to the Home PLMN Country Barring Of all Incoming Calls when roaming outside the Home PLMN

58

Supplementary services (2)

Call Waiting Call Hold Multiparty Service Explicit Call Transfer Calling Number Identification Presentation Calling Number Identification Restriction Advice of Charge Centrex Service Operator Determined Barring Alternate Line Service (personal or business)

59

Review Questions to GSM Traffic Management

60

Review

1. The location update procedure is initiated by the:

a) b) c) d)

Mobile Station (MS) Mobile services Switching Centre (MSC) Base Station Controller (BSC) Home Location Register (HLR)

2. The format of the International Mobile Subscriber Identity (IMSI) is:

a) b) c) d)

CC + NDC + SN MCC + MNC + MSIN MCC + MNC + LAC Operator-specific 32-bit binary number

61

Review

3. Which of the following cases result in an HLR enquiry?

a) b) c) d)

PSTN originated PSTN terminated call Mobile originated PSTN terminated call PSTN originated mobile terminated call None of the above

4. A location area:

a) is the geographical area under one Base Station Controller (BSC). b) is equal to one MSC area. c) is equal to one cell. d) is identified by a unique Location Area Identity.

62

Review

5. Initiation of the paging process for a mobile station is done by:

a) b) c) d)

the MSC over a location area. all Base Transceiver Stations in a location area. a Base Station Controller over one BSC area. a Base Transceiver Station in one cell.

6. In a mobile terminated call a traffic channel from the NSS in the terminating side to the called mobile station is reserved when:

a) the MS user answers the ringing of the phone. If GSM Phase 2 feature Off Air b) the B-subscriber accepts the international roaming Call Set-up Is available leg charging. c) the MSRN analysis is done and the location area of the subscriber is known. d) the mobile station answers the paging signal.
63

Review

7. Why is it necessary to check the calling subscriber s data before allowing the call to proceed in the originating NSS side?

a) To make sure that s/he has the correct IMSI. b) To make sure that s/he is provisioned the requested service. c) To make sure that s/he has the correct TMSI number. d) To make sure that the NSS knows whom to charge for the call.
8. If in a GSM/DCS network the periodic location update timer is set as 10 hours, then a periodic location update is done:

a) b) c) d)

10 hours after the last periodic location update. 10 hours after the last power on location update. 10 hours after the last generic location update. 10 hours after the last transaction of any kind with the NSS.
64

Review

9. In an inter-VLR location update, the new VLR asks the old VLR for some information about the mobile subscriber. The old VLR responds to this query by providing which of the following information?

a) b) c) d)

IMSI and authentication triplets. IMSI, TMSI and subscribed services. IMSI and last location update time. IMSI and HLR address in case of a roaming subscriber.

65

Review

10. If a handover occurs during a call:

a) The new frequency resource always belongs to a cell other than the current one. b) A handover number is always required. c) The initial speech path is not disconnected until a successful message comes from the mobile station on the new channel. d) The subscriber always has to pay extra for the additional network operation required to maintain his/her call. .

66

Review

11. Charging records can be generated in:

a) b) c) d)

the MSC. the HLR. both in the MSC and the HLR. Charging records are not generated in the GSM network. The HLR with information from the MSC. The MSC with information from the Billing Centre. The Billing Centre with information from the MSC. The Billing Centre with information from the Transcoder.

12. Which network element creates bills for the subscriber?

a) b) c) d)

67

Review

14. The contents of the authentication triplet are:

a) b) c) d)

SRES, RAND, A3 SRES, RAND, Kc A3, A5, A8 RAND, A3, A8

15. What is the result when you use Ki and RAND as inputs through A8?

a) b) c) d)

Encoded speech Signed response Authentication triplet Kc

68

Review

16. What is SRES and Kc used for, respectively?

a) SRES is used for speech encryption and Kc is used for authentication. b) SRES is used for speech encryption and Kc is used for frame alignment. c) SRES is used for authentication and Kc is used for speech encryption. d) Both SRES and Kc are used for speech encryption.

17. Which of the following is not a basic service?

a) b) c) d)

SMS-MO Speech, emergency CLIP 14.4 Kbits per second synchronous transparent

69