1

1
Fundamentals of SS7
and GSM protocol
architecture and procedures
Giuliano Paris
(TILS)
email: giuliano.paris@telecomitalia.it
Rio de Janeiro, September 2005
2
Outline
Background on Signaling
SS7 Characteristics and Protocol Architecture
CCITT #7 Application Parts: TUP/ISUP and TCAP/ASEs
GSM Protocol Architecture
GSM radio channels (signaling and Traffic channel)
GSM radio signaling channels (BCCH, RACH, etc)
Examples of procedures (location update, handover, call scenario,
roaming, SMS, etc.)
2
3
Some background on Some background on Signaling Signaling
Signaling is defined as the exchange of information
specifically concerned with the establishment, release
and other control of calls, and network management, in
automatic telecommunication operation (ITU definition).
Channel Associated Signaling (CAS)
A signaling method in which the signals necessary for the control of a
single user channel (e.g. speech channel) are transmitted in the
channel itself or in a signaling channel permanently dedicated to it.
Common Channel Signaling (CCS)
A signaling technique in which signaling information relating to a
multiplicity of circuits, and other information such as that used for the
network management, is conveyed over a single channel by addressed
messages.
4
CAS and CCS CAS and CCS
UI UI UI UI S S S S
1 2 3 .. M
UI UI UI UI S
Common
Channel
UI = User Information
S= Signaling
1 2 3 .. N 1 2 3 N
Channel Associated Signaling (CAS)
Common Channel Signaling (CCS)
3
5
CAS and CCS CAS and CCS
In telephony CAS traditionally consisted of strictly necessary signals
(very poor vocabolary) to handle a call (off-hook/on hook, called
party number, dial tones and busy signals). It was defined for
electromechanical switching systems (based on selectors and
xpoints). The subscriber dials '958'
CAS is relatively slow (long call setup time), it offers a poverty of
signals (messages) and no error detection and recovery for signaling
information and finally it has been subjected to frauds.
The introduction of electronic processors in the switching systems
(SPC switches) and the development of data communiction
techniques and protocols have given the possibility to implement the
concept of CCS (named CCITT #7, or CCS #7, or SS7).
CCS #7 enables all the network element (i.e. SPC switches, network
databases, etc.) to exchange signaling information in a reliable, fast,
secure (protections from fraud), flexible (in terms of number of
signals) and standardised (worldwide use) manner.
6
CAS CAS signaling signaling Call Call
SEIZURE
CAS
CAS
off-hook
first digits
last digit
DIGITS
PROCEED TO SEND
SEIZURE
ringing
off-hook
DIGITS
PROCEED TO SEND
on-hook
ANSWER
CONVERSATION
on-hook
CLEAR BACK
CLEAR BACK
dial tone.
ADDRESS COMPLETE ADDRESS COMPLETE
RINGING TONE
ANSWER
CLEAR FORWARD
CLEAR FORWARD
RELEASE GUARD
RELEASE GUARD
post
dialling
delay
4
7
N
1
2
P. S.
N
1
2
P. S.
N
1
2
M. Transfer
N
1
2
M. Transfer
CCS link
signaling messages
speech + signaling
speech
From CHANNEL ASSOCIATED SIGNALING ....
... To COMMON CHANNEL SIGNALING
control
control control
control
8
Common Common Channel Channel Signaling Signaling Modes Modes
SP SP
SP SP
STP
Speech Trunks
Signaling link
Associated Mode
Non Associated Mode
SP= Signaling Point
STP= Signaling Transfer Point
5
9
CCS #7 CCS #7 Protocol Protocol Architecture Architecture
MTP 1: Equivalent to OSI layer 1 (generally 64Kb/s)
MTP 2: Error detection and recovery, flow control (based
on HDLC, equivalent to OSI layer 2 )
MTP 3: Provides message routing without lost or
duplicated packets even in case of network failures or
congestion (Equivalent to lower half of OSI layer 3)
MTP Level 1
MTP Level 2
MTP Level 3
USER PART USER PART
10
Contents Contents of of Recommendations Recommendations
(Q.701 (Q.701- -Q.707) Q.707) relating relating to to the MTP the MTP
Recommendation Q.701 contains a functional description and
overview of the Message Transfer Part of SS No. 7.
Recommendation Q.702 details the requirements of a signalling
data link to support SS No. 7.
Recommendation Q.703 describes the signalling link functions.
Recommendation Q.704 describes signalling network functions
and messages.
Recommendation Q.706 defines and specifies values for MTP
performance parameters.
Recommendation Q.707 describes the testing and maintenance
functions applicable to the MTP.
6
11
Circuit Circuit Related Related Applications Applications
The signaling message coming from the USER Part
(i.e. TUP) includes the related Circuit Identification
Code
- - IbF: IbF: prov|des prov|des messoges messoges ond ond procedures procedures regord|ng regord|ng te|ephone te|ephone co|| co||
hond||ng hond||ng
- - ISDN ISDN- -bF [or ISbF}: bF [or ISbF}: enr|ches enr|ches IbF IbF |eotures |eotures w|th w|th ISDN ISDN copob|||t|es copob|||t|es [ [beorer beorer
serv|ces, serv|ces, supp|emetory supp|emetory serv|ces, serv|ces, such such os os co|||ng co|||ng ||ne ||ne |dent|||cot|on |dent|||cot|on, , etc etc.} .}
MTP Level 1
MTP Level 3
MTP Level 2
ISDN-UP/TUP
Transport
Session
Presentation
Application
Physical
Data Link
Network
12
MTP-2
MTP-3
ISUP
TUP/ISUP Message
MSU
ISUP
Switch A Switch B
The messages originated froma switchs User Part (UP) are carried by
the functional block MTP in a Message Signalling Unit (MSU) and
delivered to the other switchs UP.
MTP-3
MTP-2
MTP-1 MTP-1
call
control
call
control
CIC Signaling payload DPC OPC
DPC: Destination Point Code
OPC: Originating Point Code
CIC: Circuit Identification Code
7
13
A
B
T
(a)
(b)
Call Example with CCS (TUP/ISUP)
speech trunks
Signaling circuit
(a) Calling party
(b) Called party
switch with SP and STP function
switch with SP function
14
signaling region
A
SP
STP
signaling
link
QUAD
QUAD Model : non associated mode (stand-alone STP )
speech
signaling region
B
8
15
Conceptual Conceptual models models: :
transport transport and control and control networks networks
switch
SP
SP
SP
SP
switch
switch
switch
SP
switch
STP
STP STP
STP
Signalling Network
Transport Network
16
Signalling Signalling data link data link : : level level 1 (MTP 1 (MTP- -1) 1)
Level 1 defines the physical, electrical and functional characteristics of
a signalling data link and the means to access it. The level 1 element
provides a bearer for a signalling link.
The standard channel time slot for the use of a signalling data link is
time slot 16 (when available) in 2.048 Mbit/s digital path.
The access to the signalling data link can be realized by a
semipermanent connection through the switching network
MTP-2
MTP-3
Switch B
MTP-3
MTP-2
2 Mb/s PCM path
16
16
Switch A
Switch matrix
MTP-1
Switch matrix
9
17
SERVICE INDICATOR (SI)
0000 Signalling network management messages
0001 Signalling network testing and management messages
0011 SCCP
0100 Telephone User Part (TUP)
0101 ISDN User Part (ISUP)
0110 Data User Part (DUP)
.....
F CK SIF SIO LI
F
I
B
FSN
B
I
B
BSN F
8 16 8n (n>2) 4+4 2 6 1 7 1 7 8
MSU (Message Signal Unit)
Legenda:
F = Flag
CK = Check bits (CRC)
SIF = Signalling Information Field
SIO = Service Indicator Octet
LI = Length Indicator
FIB = Forward Indicator Bit
FSN = Forward Sequence Number
BIB = Backward Indicator Bit
BSN = Backward Sequence Number
SLS = Signaling Link Selection
UP Message
label
routing
SI NI
parts of interest to levels 3 and 4
SLS OPC DPC
Signalling Signalling link link functions functions: : level level 2 (MTP 2 (MTP- -2) 2)
NETWORK INDICATOR (NI)
00XX international network
01XX spare for international network
10XX national network
11XX spare for national network
18
MTP MTP- -2 2 signal signal units units: FISU, LSSU, MSU : FISU, LSSU, MSU
LI Value Signal Unit Type
0 Fill-In Signal Unit (FISU)
1..2 Link Status Signal Unit (LSSU)
3..63 Message Signal Unit (MSU)
10
19
Signalling Signalling network network functions functions: : level level 3 (MTP 3 (MTP- -3) 3)
MESSAGE
DISTRIBUTION
MESSAGE
DISCRIMINATION
MESSAGE
ROUTING
MESSAGE HANDLING
SIGNALING NETWORK MANAGEMENT
SIGNALING
TRAFFIC
MANAGEMENT
SIGNALING
LINK
MANAGEMENT
MTP-3
USER PARTS
MTP-2
Message Flows
Control and Indication
SIGNALING
ROUTE
MANAGEMENT
20
Signalling Signalling network network functions functions: : level level 3(MTP3): 3(MTP3):
Signalling Signalling Traffic Traffic Management Management Procedures Procedures
Changeover
Changeback
Forced Rerouting
Controlled Rerouting
Signalling Point Restart
Signalling Traffic Flow Control
11
21
SLS=XXX1
SLS=XXX0
A B
A
B D E
F C
XXX0
XXX1
SIGNALING TRAFFIC LOAD SHARING (I) SIGNALING TRAFFIC LOAD SHARING (I)
Load sharing within a link set
Load sharing between link sets
22
SIGNALING TRAFFIC MANAGEMENT SIGNALING TRAFFIC MANAGEMENT
( (Example Example of of changeover changeover) )
12
23
SIGNALING ROUTE MANAGEMENT SIGNALING ROUTE MANAGEMENT
(EXAMPLE: Transfer (EXAMPLE: Transfer Prohibited Prohibited Procedure ) Procedure )
6
13
19
8
9
STP sents a transfer prohibited message (TFP) to each of SPs.
the message has the following information:
Destination Point (DPC) = 6, 19, 13
Origin Point (OPC) = 9
Message Indication = TFP
TFP related Destination = 8
The 3 SPs (6,19,13), once received the TFP message, will execute a forced
rerouting procedure
STP
i
24
MTP performance MTP performance requirements requirements
The availability and dependability objectives for the transport of signalling messages by
the MTP are:
No more than one in 10E+7 (1 in 10,000,000) messages should be lost.
No more than one in 10E+10 messages should be delivered out of sequence or
duplicated.
No more than one in 10E+9 message errors should remain undetected.
The signalling route between an origination and destination SP should be available
99.9998% of the times or better. This implies a maximum permissible downtime or
unavailability of 10 minutes per year per route.
Though there are no specific end-to-end delay objectives for SS7, they are specified for
specific services or uses of the SS7 protocol. Further there are delay objectives for some
network components, and others can be calculated. Thus an estimate can be made for
any given network configuration.
13
25
Background: Background: What What is is ISDN? ISDN?
It represents the evolution of the Integrated
Digital Network (IDN), it offers an end-to-end 64
kbit/s digital connectivity in order to provide a
very large set of voice and data services,
through a limited number of standardised
access interfaces. ISDN provides the access to
both circuit and packet switched networks and
services.
26
Background: Background:
ISDN Network ISDN Network Architecture Architecture
packet switched
network
circuit switched
network
...other networks
ISDN
local
exchange
14
27
Background: Background:
ISDN Services ISDN Services Characteristics Characteristics
Bearer:
end-to-end 64 kbit/s digital connectivity (circuit mode)
speech and 3.1 KHz audio (circuit mode)
packet connectivity
Teleservices (examples):
fax (G.3 and G.4), telephone, videoconference,etc.
Supplementary services (examples):
Call Completion Busy Subscriber (CCBS)
Closed User Group (CUG)
Calling Line Identity, etc.
28
Background: ISDN Access Background: ISDN Access Types Types
- - 8kA [8ose kote Access}: 8kA [8ose kote Access}: 2 8 + D 2 8 + D chonne|s chonne|s
[8= 4 [8= 4 kb|t kb|tJs Js chonne|s chonne|s}, [ D= 1 }, [ D= 1 kb|t kb|tJs Js |or |or s|gno||ng s|gno||ng ondJor ondJor
doto} doto}
- - FkA [ FkA [Fr|mory Fr|mory kote Access} kote Access}; 30 8 + D ; 30 8 + D chonne|s chonne|s
[8= 4 [8= 4 kb|t kb|tJs Js chonne|s chonne|s}, [ D= 4 }, [ D= 4 kb|t kb|tJs Js |or |or s|gno||ng s|gno||ng} , } ,
P
A
B
X
I
S
D
N
NT
BRA
BRA
PRA
NT
TA
15
29
DSS1 (Digital Subscriber Signalling N. 1) is the ISDN
standard access (user-network) protocol and ISUP-
CCITT #7 is the network protocol (network-network).
limitations of such an architecture for broadband
services
N N- -ISDN ISDN protocol protocol architecture architecture
access
protocol
(DSS1)
access
protocol
(DSS1)
network
protocol
(ISUP/
CCITTn.7)
network
protocol
(ISUP/
CCITTn.7)
Network
ISDN Switch
30
DSS1 DSS1 Protocol Protocol
LAP-D (layer 2)
Q.931 (layer 3)
(call handling)
Physical (layer 1)
2 wires for BRA 2B1Q code
4 wires for PRA HDB3 code
Q.931 provides the means to establish, mantain,
and release network connections across an
ISDN between signaling entities. It also
provides procedures for the invocation and the
operation of supplementary services
LAP-D (Q.921) is the data link protocol used
over the D-channel. It provides frame error
detection and error recovery, flow control,
SAPI and TEI addressing (SAPI + TEI = DLCI)
16
31
TUP and ISUP TUP and ISUP
ISUP comprehends, beyond all the capabilities provided by
TUP, a set of capabilities needed to support ISDN services (i.e.
beares services (speech,. 3.1 khz audio, 64 Kb/s unrestricted)
and supplementary services (CLIP, CLIR, CUG,
subaddressing, user to user signaling, etc.)
ISUP capabilities
TUP capabilities
ISUP Reccomandations: Q.761 - Q.768
32
Routing label
Circuit identification code
Message type code (es. IAM, ACM, etc.)
Mandatory fixed part
Mandatory variable part
Optional part
ISDN User Part (ISUP) : ISDN User Part (ISUP) : message message format format
1 2 3 4 5 6 7 8
T1148210-92/d14
Order of bit transmission
Order of octet
transmission
Routine label
Circuit identification code
Message type code
Mandatory parameter A
Mandatory parameter F
Pointer to parameter P
Pointer to start of optional part
Length indicator of parameter M
Pointer to parameter M
Parameter M

Length indicator of parameter P
Parameter P
Parameter name = X
Length indicator of parameter X
Parameter X
Parameter name = Z
Length indicator of parameter Z
Parameter Z
End of optional parameter field
Mandatory
fixed part
Mandatory
variable part
Optional part
(12 bits)
17
33
Message type: Initial address
Parameter Reference Type
Length
(octets)
Message type
Nature of connection indicators
Forward call indicators
Calling party's category
Transmission medium requirement
Called party number
Calling party number
Optional forward call indicators
Closed user group interlock code
User-to-user information
Access transport
User service information
End of optional parameters
2.1
3.23
3.20
3.9
3.35
3.7
3.8
3.25
3.13
3.38
3.2
3.36
3.17
F
F
F
F
F
V
O
O
O
O
O
O
O
1
1
2
1
1
4-11
4-12
3
6
3-131
3-?
4-13
1
ISUP ISUP message message: IAM ( : IAM (Initial Initial Address Address Message Message) )
34
64 Kbit/s call between ISDN users
(en-bloc dialing and automatic answer)
IAM (# # # #) IAM(# # # #)
CONNECT CONNECT
DSS1 ISUP
SETUP(#...#)
SETUP
CONNECT CONNECT
CONVERSATION (data transfer)
DISCONNECT RELEASE
RLC
RELEASE
RLC
DISCONNECT
RELEASE
REL. COMPLETE
RELEASE
REL. COMPLETE
ISUP DSS1
18
35
ISUP: ISUP: Call Call between between POTS POTS subscribers subscribers
IAM (# # # #) IAM(# # # #)
ISUP
CONVERSATION
SUS
ISUP
OFF-HOOK
First digits
.
Last digit
SAM
SAM
SAM
SAM
ringing
Off-hook ANM ANM
ACM ACM
On-hook
SUS
Off-hook
RES RES
CONVERSATION
On-hook REL
REL
RLG
RLG
36
Local
Exchange
1) IAM
2) REL (*)
3) IAM
CONGESTION
REL(*) = the message has a parameter informing that cranck-back is possible (Crank-back
indicator)
Automatic Automatic Rerouting Rerouting ( (Crank Crank- -back back) )
Local
Exchange
Transit
Exchange
Transit
Exchange
19
37
Example:
outgoing trunk failure
IAM IAM IAM IAM
ACM ACM ACM ACM
REL (cause)
REL (cause) REL (cause) REL (cause)
RLC RLC RLC RLC
Call Call failure failure: :
ISUP Cause and Location ISUP Cause and Location
ISUP provides exact information on the failure cause of a call
Cause value
Cause indicators parameter
Location
SGU SGT
SGU
ISUP ISUP
ISUP
ISUP
38
0000001 (1) unallocated (unassigned) number
0000011 (3) noroute todestination
0000100 (4) send special information tone
0010000 (16) normal call clearing
0010001 (17) user busy
0010010 (18) nouser responding
0010011 (19) noanswer fromuser (user alerted)
0010101 (21) call rejected
0010110 (22) number changed
0011011 (27) destination out of order
0011100 (28) address incomplete
0011101 (29) facilityrejected
0011111 (31) normal unspecified
0100010 (34) nocircuit/channel available
0100110 (38) network out of order
0101001 (41) temporaryfailure
0101010 (42) switching equipment congestion
0101100 (44) requested channel not available
0101111 (47) resource unavailable - unspecified
0110111 (55) incoming calls barredwithin CUG
0111001 (57) bearer capabilitynot authorized
0111010 (58) bearer capabilitynot presentlyavailable
0111111 (63) service/option not available - unspecified
1000001 (65) bearer capabilitynot implemented
1001111 (79) service or option not implemented - unspecified
1010111 (87) user not member of CUG
1011000 (88) incompatible destination
1011111 (95) invalid message - unspecified
1100110 (102) recoveryon timer expiry
1101111 (111) protocol error - unspecified
1111111 (127) interworkingunspecified
Example: Cause value field (ISUP-S)
20
39
Service Provisioning Evolution
CLASS
Services based on
DB (SCP) queries
- I.N. Services
- Personal Mobility Services
- UPT services
- .....
- Call forwarding
- Call waiting
- Itemised Billing
- Three-way calling
- Centralized Answering
Machine
- ........
- Call Completion Busy
Subscriber (CCBS)
- ....
- Closed User Group (CUG)
- Calling Line Identification
Presentation (CLIP) &CLIR
Supplementary Services
40
Non Non- -Circuit Circuit Related Related Applications Applications
Transaction-oriented services
- - SCCF [ SCCF [S|gno|||ng S|gno|||ng Connect|on Contro| Fort}: Connect|on Contro| Fort}: Iogether Iogether w|th w|th the MIF the MIF- -3, 3, prov|des prov|des |u|| OSI |u|| OSI
network network |oyer |oyer |unct|ono||ty |unct|ono||ty, , |nc|ud|ng |nc|ud|ng oddress oddress copob|||t|es copob|||t|es ond C.O. ond C.O. serv|ce serv|ce
- - ICAF [ ICAF [Ironsoct|on Ironsoct|on Copob|||t|es Copob|||t|es App||cot|on App||cot|on Fort} : Fort} : prov|des prov|des the trons|er o| the trons|er o| non non- -c|rcu|t c|rcu|t
re|oted re|oted |n|ormot|on |n|ormot|on between between two network two network nodes nodes
- - ASE [ ASE [App||cot|on App||cot|on Serv|ce Serv|ce E|ement E|ement}: }: prov|des prov|des the the spec|||c spec|||c |n|ormot|on |n|ormot|on thot thot on on
opp||cot|on opp||cot|on needs needs [e.g. 800 [e.g. 800 number number |nto |nto o network o network routob|e routob|e te|ephone te|ephone number number} }
null
SCCP
ASE
TCAP
MTP Level 1
MTP Level 3
MTP Level 2
ISDN-UP/TUP
Physical
Data Link
Network
Transport
Session
Presentation
Application
ASE
21
41
Signalling Signalling Connection Control Part (SCCP) Connection Control Part (SCCP)
and and Transaction Transaction Capabilities Capabilities Application Application Part (TCAP) Part (TCAP)
Enhance MTP for connection oriented and connectionless
control
Identify subsytems in Signaling Points
Global Title Translation (GTT): translation of network
address (eg Dialed Digits) to Point Code
Used for database access (eg 800) and Direct end-to-end
information
TCAP supports the exchange of non-circuit related data
between applications across the SS7 network using the
SCCP connectionless service. Queries and responses sent
between SSPs and SCPs are carried in TCAP messages. For
example, an SSP sends a TCAP query to determine the
routing number associated with a dialed 800 number and to
check the personal identification number (PIN) of a calling
card user.
42
Examples Examples implementing implementing ASEs ASEs
GSM Networks
MAPs (Mobile Application Parts): set of protocols
that provides the information exchange between
MSC, HLR, VLR, etc., necessary for mobile
capabilities
Intelligent Networks
ASE-RI, INAP: protocol that supports the information
transfer between Service Switching Points and
specialized nodes (Service Control Points)
22
43
Why Why SERVICES SERVICES provided provided by the by the
INTELLIGENT NETWORK ? INTELLIGENT NETWORK ?
Simplicity, time to market introduction
Customer Tailored
Flexible Access (trasportability)
Customer control
Creation flexibility
Manufacturer independency
?
?
44
Intelligent Intelligent Network (IN) Services Network (IN) Services
Green Number (800 service-USA)
Private Virtual Network
Premium Charge (in Italy 144, 166)
Split Charging
Mass Calling
Televoting
Calling card
Personal Number
Universal Number
. . . . .
23
45
Intelligent Intelligent Network Network Goals Goals
Migration of service control software out of switching
node (in the Service Control Points)
Service Creation Environment (SCE) in order to
personalize the services
Standardized Interfaces between the network elements
46
I.N. I.N. Functional Functional Architecture Architecture
SCF
CCF CCF CCF
SSF SSF
SDF
SRF
SMF
SMAF
SCEF
CCF: Cc|| CcnIrc| FuncIicn
SSF: Service SwiIching F.
SCF: Service CcnIrc| F.
SDF: Service DcIc F.
SMF: Service McncgemenI F.
SM/F: Service MgmI /cce:: F.
SCEF: Service CrecIicn
EnvircnmenI F.
SFF: Specic|izec Fe:curce F.
24
47
I.N. Network I.N. Network Architecture Architecture
SCP
SCP
SMS
SMS
Customer
Control
SCE
Service
Manager
switched
network
PSTN
CCS n.7 network
SMS = Service Management System
SCP = Service Control Point
SSP = Service Switching Point
SCE=Service Creation Environment
SSP
SSP
48
CCS#7 CCS#7 Protocol Protocol Architecture Architecture for for
Intelligent Intelligent Network Network
SSP
STP SCP
ASE
TCAP
SCCP
MTP
MTP
SCCP
MTP
SCCP
TCAP
ASE
25
49
Example Example: Green : Green Number Number (800 (800- -service) service)
SDF
SSP
SCF
SSF
CCF CCF
SCP
SMF
SMS
800xxxxxx
SSF: Service SwiIching FuncIicn
SCF: Service CcnIrc| FuncIicn
SDF: Service DcIc FuncIicn
CCF: Cc|| CcnIrc| FuncIicn
SMF: Service McncgemenI FuncIicn
1
2
3
50
ISUP ISUP Applications Applications
Interconnection Interconnection between between operators operators: :
i.e. i.e. Carrier Carrier Selection Selection
LE LE
TE TE
10xy-06-7654321
OLO OLO
switch switch
OLO network
OLO OLO
switch switch
ISUP with CLI
CLI check
Telecom Italia Network
LE: Local Exchange
TE: transit Exchange
TIM network
GMSC
MSC
Subscriber
database
CLI: Calling Line Identity.
OLO: Other Licensed Operator
26
51
HLR
GSM Network GSM Network Architecture Architecture
MSC
BTS
BSC BSC
VLR
VLR
BTS
BTS
BTS
MSC
BSC BSC
PSTN/ISDN
AUC
LAi
LAj
access
coverage
switching
intelligence
52
GSM GSM Protocol Protocol Architecture Architecture
CM
MM
RR
LAPDm
TDMA
FDMA
SCCP
Radio interface
BSS MS
MSC
LAPDm
RR
TDMA
FDMA
BSSAP
MTP
CM
MM
SCCP
BSSAP
SCCP
TCAP
M
A
P
MTP MTP
A- interface
to the other
network elements
and PSTN
MAP
TUP/
ISUP
27
53
8SC 8SC
HLk HLk FSIN FSIN VLk VLk MSC MSC VLk VLk
MSC MSC
CM CM
MM MM
kk kk
LAFDm LAFDm
Fh.Loyer Fh.Loyer
LAFDm LAFDm
Fh.Loyer Fh.Loyer
kk kk
8SSAF 8SSAF
I I
S S
b b
F F
CM CM
MM MM
ICAF ICAF
SCCF SCCF
M M
A A
F F
SCCF SCCF
MIF MIF
1} DIAF 1} DIAF
2} 8SSMAF 2} 8SSMAF
MIF MIF' '
8SSAF 8SSAF
1
MIF MIF' '
MIF MIF
I I
S S
b b
F F
SCCF SCCF
MIF MIF
M M
A A
F F
ICAF ICAF
SCCF SCCF
MIF MIF
ICAF ICAF
I I
S S
b b
F F
M M
A A
F F
bm bm A A- -b|s b|s A A CJD CJD
FSIN FSIN
EJG EJG
MS MS
2
8IS 8IS
SCCF SCCF' '
8 [MSC 8 [MSC - - VLk} VLk}
GSM: GSM: interfaces interfaces and and
signaling signaling protocols protocols
54
GSM GSM Signaling Signaling Protocols Protocols: :
standard standard interfaces interfaces
MSC MSC
HLR
EIR VLR VLR
BTS BSC
BSS
E
F C
B
D G
A
Abis
radio
interface
PSTN
ISDN
ISUP /TUP
MTP
MAP
TCAP
SCCP
MTP
28
55
Fixed Fixed- -Mobile Mobile Call Call
(mobile (mobile terminating terminating) )
MSC
GMSC
HLR
PSTN
BTS
BSC
BTS
BTS
BTS
BSC
LAi
LAj
VLR
VLR
2
MSISDN
3
1
IMSI
MSRN
4
MSRN
5
6
ISUP /TUP
MTP
MAP
TCAP
SCCP
MTP
= 1,6
= 2,3,4,5
: Send Routing Information 2
3
: Provide Roaming Number
56
BCCH: Brnadcast Cnntrn! Channc!
pnInt-tn-mu!tIpnInt unIdIrcctInna! cnntrn! channc!
brnadcastIng systcm InfnrmatInn tn M5
CCCH: Cnmmnn Cnntrn! Channc!
up-!Ink: RACH (Randnm Acccss
CHannc!)
dnwn-!Ink: PCH (PagIng Channc!)
AGCH (Acccss Grant CHannc!)
DCCH: DcdIcatcd Cnntrn! CHannc!
pnInt-tn-pnInt bIdIrcctInna! cnntrn! channc!
5ACCH (5!nw AssncIatcd Cnntrn! CHannc!)
FACCH (Fast AssncIatcd Cnntrn! CHannc!)
5DCCH (5tand A!nnc DcdIcatcd Cnntrn! CHannc!)
GSM GSM Signalling Signalling channels (I) channels (I)
29
57
TX (Up!Ink) RX (dnwn!Ink)
/ PCH + BCCH
systcm InfnrmatInn pagIng
RACH
randnm acccss
AGCH
assIgnmcnt nf dcdIcatcd cnntrn! channc!
5DCCH + 5ACCH 5DCCH + 5ACCH
sIgna!!Ing prnccdurc mcasurcmcnts sIgna!!Ing prnccdurc mcasurcmcnts
TCH + 5ACCH
vnIcc / data traffIc nr
sIgna!!Ing prnccdurc
(FACCH)
mcasurcmcnts
TCH + 5ACCH
vnIcc / data traffIc nr
sIgna!!Ing prnccdurc
(FACCH)
mcasurcmcnts
GSM GSM Signalling Signalling channels (II) channels (II)
58
GSM radio signaling channels
Broadcast channels (BCH)
- Broadcast Control CHannel (BCCH) continually
broadcasts, on the downlink (unidirectional) information
including Country and network identities, Location Area
ID, Cell ID, etc. This channel is continuously active, with
dummy bursts when there is no information to transmit,
because its signal strengths are monitored by mobile stations
for handover determination; BCCH is a low capacity channel
(23 bytes each 0.235 sec. = 782 b/s). Each cell has one
BCCH channel (or BTS) (time slot 0).
- Frequency Correction CHannel (FCCH) and
Synchronization CHannel (SCH): information sent from BSS
for carrier and frame synchronization respectively;
30
59
Mobile Mobile
initialization initialization
Prior to establishing any communication
links to other parties, the MS must first
acquire synchronization with the GSM
system. This process begins after the MS is
turned on in a PLMN. The first step of the
process is for the MS to search for and
acquire a frequency control channel
(FCCH) burst on some common control
frequency channel. The mobile will scan all
or part of 124 RF channels and obtain the
average signal strength of each channel
After the frequency correction burst is
detected, the MS will try to synchronize
with the time synchronization burst
synchronization channel (SCH). The SCH
always occurs in the next frame in the
same time slot as the FCCH. This is eight
burst periods later than the FCCH. The SCH
contains precise timing information on the
timeslot boundaries to permit refining the
received slot timing. The SCH message also
contains the current frame number to
which the MS synchronizes
60
GSM radio signaling channels
Common Control Channels (CCCH)
Common Control CHannels (CCCH) are used for transmitting signaling
information between all mobiles and the BSS for call originating and
call paging functions:
uplink
- Random Access CHannel (RACH): slotted aloha channel used by
the mobile to request access to the network;
downlink
- Paging CHannel (PCH): used to alert the mobile station of incoming
call;
- Access Grant CHannel (AGCH): used to allocate a dedicated
control channel to a mobile following a request on the RACH.
31
61
GSM radio GSM radio channels channels (bit rate) (bit rate)
62
Example Example: BCCH : BCCH
BCCH
By means of BCCH, one BTS continuously transmits, among others,
the Location Area Identification (LAI), la cell identification, by which
MS can realize its position.
LAI = MCC + MNC + LAC
CGI = LAI + CI
MCC (*)= Mobile Country Code (3 digits)
MNC= Mobile Network Code (2 digits)
LAC= Location Area Code (2 digits)
CGI= Cell Global Identity
CI = Cell Identity (2 bytes)
(*) MCC for Italy = 222
32
63
Example Example: RACH and AGCH : RACH and AGCH
AGCH
(DCCH provided)
When a Mobile Station (MS) has to send, over the air, the phone number
digits to make a call, prior the digits could be sent to the BTS, MS must
require, through RACH (common control channel), a dedicated control
channel (SDCCH). The BSC assigns such a channel through the AGCH
(common control channel). Over the SDCCH, all the signalling information
are exchanged for the call setup (authentication, dialing digits, TCH
assignment, etc.)
+39335 ...
RACH
(DCCH request)
64
Dedicated Dedicated control control channels channels
Stand Alone Dedicated Control CHannel (SDCCH): it is an eighth rate
traffic channel (TCH/8) used for the transfer of call control signaling to and
from the mobile during call setup, before the TCH is assigned (i.e. for
authentication, location update, ecc.); capacity of about 10 messages/sec.
Slow Associated Control CHannel (SACCH): associated to a traffic
channel, it may carry about 2 messages/s and it used for non urgent
procedures (i.e. radio measurements concerning handover). It is
implemented on frame 12 and there is one dedicated signaling channel for
each of the 8 TCH channels.
Fast Associated Control CHannel (FACCH): it is obtained on demand by
stealing from traffic channel (during call setup and release phases, no user
data are transmitted and therefore signaling may use the channel without
conflict). It carries information to indicate the call setup progress, or to
authenticate the subscriber, to command a handover, etc.
33
65
GSM radio GSM radio channels channels
66
Control Control Channels Channels (i.e. 51 (i.e. 51 slots slots frames frames) )
downlink
uplink
34
67
Location Location updating updating
68
Location Location Updating Updating (GSM 3.12) (GSM 3.12)
Channel Request (RACH)
Channel Assignment (AGCH)
Request for Location Updating (SDCCH)
Authentication Request (SDCCH)
Authentication Response (SDCCH)
Ciphering Command (SDCCH)
Ciphering Complete (SDCCH)
Location updating confirm, including new TMSI (optional)
(SDCCH)
new location andTMSI Ack (SDCCH)
Channel release by the network (SDCCH)
MS
Base
Station
Periodic location updating (6 min.-24 h)
Location updating on LA crossing
35
69
Mobile Mobile- -Originated Originated Call Call
70
Chiamata Chiamata Mobile Mobile- -Originated Originated (MOC) (MOC)
Channel Request (RACH)
Channel Assignment (AGCH)
Call establishment Request (SDCCH)
Authentication Request (SDCCH)
Authentication Response (SDCCH)
Ciphering Command (SDCCH)
Ciphering Complete (SDCCH)
Setup message (includes called party number) (SDCCH)
Call Proceeding (SDCCH)
Traffic channel Assignment (SDCCH)
Assignment complete (FACCH)
Alerting (ringing on the called side) (FACCH)
Connect (called party answers) (FACCH)
Connect Ack (FACCH)
conversation phase (TCH)
MS
Base
Station
14 signaling messages are
exchanged before a
conversation can begin
remark:
(*)
(*) optionally
TMSI reallocation
36
71
8SC 8SC
HLk HLk FSIN FSIN VLk VLk MSC MSC VLk VLk
MSC MSC
CM CM
MM MM
kk kk
LAFDm LAFDm
Fh.Loyer Fh.Loyer
LAFDm LAFDm
Fh.Loyer Fh.Loyer
kk kk
8SSAF 8SSAF
I I
S S
b b
F F
CM CM
MM MM
ICAF ICAF
SCCF SCCF
M M
A A
F F
SCCF SCCF
MIF MIF
1} DIAF 1} DIAF
2} 8SSMAF 2} 8SSMAF
MIF MIF' '
8SSAF 8SSAF
1
MIF MIF' '
MIF MIF
I I
S S
b b
F F
SCCF SCCF
MIF MIF
M M
A A
F F
ICAF ICAF
SCCF SCCF
MIF MIF
ICAF ICAF
I I
S S
b b
F F
M M
A A
F F
bm bm A A- -b|s b|s A A CJD CJD
FSIN FSIN
EJG EJG
MS MS
2
8IS 8IS
SCCF SCCF' '
8 [MSC 8 [MSC - - VLk} VLk}
GSM: GSM: interfaces interfaces and and
signaling signaling protocols protocols
72
Review Review on DSS1 on DSS1 Protocol Protocol (ISDN) (ISDN)
LAP-D (layer 2)
Q.931 (layer 3)
(call handling)
Physical (layer 1)
2 wires for BRA 2B1Q code
4 wires for PRA HDB3 code
Q.931 provides the means to establish, mantain,
and release network connections across an
ISDN between signaling entities. It also
provides procedures for the invocation and the
operation of supplementary services
LAP-D (Q.921) is the data link protocol used
over the D-channel. It provides frame error
detection and error recovery, flow control,
SAPI and TEI addressing (SAPI + TEI = DLCI)
37
73
GSM: radio GSM: radio protocol protocol Architecture Architecture
The signaling protocol in GSM is structured into 3 layers.
We have to be careful in not confusing layer 3 protocol functions defined by
GSM with what is formally defined to be the layer 3 functions in the OSI
model.
The GSM layer 3 protocols are used for the communication of network
resources, mobility, and call related management messages. Since, in the
OSI model, some of these functions are actually provided by the higher
layers, the term message layer may be more appropriate term for the layer 3
in the GSM.
The message layer consists of 3 sublayers::
Radio Resource (RR) implemented over the link between the MS and
the BSS;
Mobility Management (MM) and
Connection Management (CM) sublayers providing the
communication between the mobile station and the MSC .
74
GSM GSM Protocol Protocol Architecture Architecture
Radio Interface ( Radio Interface (Um Um - - between between MS and BSS) MS and BSS)
Physical Physical and Data and Data Link Link layers layers
The physical layer, based on FDMA/TDMA, has been discussed in the
radio interface channels section.
The data link layer is based on a LAPD- like protocol, called LAPDm, that
has been modified for operation within the constraints set by the radio path.
LAPDm uses no flags for frame delimitation, since it is done by the
physical layer.
LAPDm, uses no cyclic redundancy check bits for error detection. Error
recovery and detection mechanisms are provided by a combination of block
and convolutional coding used in the physical layer
Over the LAPD
m
two information flows coexist: signaling messages
(SAPI=0) and Short Message Services (SAPI=3). The LAP-D layer,
originally defined for the ISDN network, in the GSM network is used in the
Abis (BTS- BSC interface).
38
75
The Radio Resource (RR) management performs the functions of
establishing physical connections over the radio path for the purpose of
transmitting call related signaling information such as the establishment of
signaling and traffic channels between a specific mobile user and the BSS.
The RR management functions are basically implemented in the BSS.
Moreover RR sublayer is also involved in handover procedures.
Examples of signaling channels use at this layer are RACH, AGCH, PCH.
Some of the procedures involved in RR sublayer are:
channels assignment and release
handover
frequencies change and hopping sequences
power control management
...
Radio Interface ( Radio Interface (U U
m m
- - between between MS and BSS) MS and BSS)
Layer Layer 3 3 - - Radio Radio Resources Resources sublayer sublayer
76
Radio Resource Management (RR)
Mobility Management (MM)
Connection Management (CM)
Call Control (CC)
Short Message Service (SMS)
Supplementary Services (SS)
Protocol Discriminator (PD)
Service Access Point Identifier (SAPI)
CM
Legenda:
Radio Interface Radio Interface - - Layer Layer 3 ( 3 (message message layer layer) )
SDCCH e SACCH are the channels for
the transport of SMS messages
Note:
Protocol Discriminator (PD) is used to address
RR sublayers (PD=06), MM (PD=05), CM
(PD=03 for CC, SS e SMS)).
39
77
GSM: GSM: Protocol Protocol Architecture Architecture
A Interface A Interface ( (between between BSS and MSC) BSS and MSC) (GSM 8.0X) (GSM 8.0X)
As mentioned earlier, over the radio interface an ISDN-like protocol is used
(LAPDm), while at this interface the protocols used are based on Common
Channel Signaling (CCS). The lower layers are based on MPT(1-3) and SCCP
protocol (that is mainly involved in the Global Title Translation (GTT))..
The A interface is used for messages between BSC and MSC as well for
messages to and from MS (using CC or MM protocol discriminator) therefore
the BSSAP (BSS Application Part) layer must be able to detect messages
addressed to the MS and to BSS:
- messages addressed to the MS are relayed transparently by the
DTAP (Direct Transfer Application Part) sublayer;
- messages addressed to the BSS related to radio resources are
handled by the BSSMAP (BSS management Application Part
sublayer (for instance BSSMAP is involved in the handover when it
occurs between different BSSs, and in the assignment/release of traffic
channels over the A interface).

78
A Interface A Interface
At the physical layer the A interface is made of 2 Mb/s with traffic channels
of 64 K/s (transcoding 16->64 Kb/s in the TRAU).
TRAU= Transcoding
and Adaption Unit
40
79
A Interface: DTAP and BSSMAP A Interface: DTAP and BSSMAP
M
S B
S
S
M
S
C
BSSMAP
Radio
Resource
mngmt (RR)
DTAP
Call Control (CC)
Mobility Mngmt (MM)
BSSMAP Message example : Assignment
the request is sent during the connection setup phase (i.e..
Mobile terminating) in order to assing a channel over the A
interface and over radio link; the message does not specify the
radio channel number, while it identifies the (CIC) over the A
interface;
assign. complete is the positive answer to the TCH assignment
80
GSM: GSM: Protocol Protocol Architecture Architecture
A Interfacce A Interfacce( (between between BSS and MSC) BSS and MSC)
The Mobility Management (MM) layer is built on top of RR layer (in the
MS side) and it handles the functions that arise from the mobility of the
subscriber, as well as the authentication and security aspects. Location
management is concerned with the procedures that enable the system to
know the current location area of a powered-on mobile station so that
incoming call routing can be completed.
The Communication Management (CM) layer is responsible for call
control, supplementary service management, and short message service.
Each of these may be considered as a separate sublayer within the CM layer.
The CM layer manages the call control in very similar way to Q.931
protocol of ISDN.
41
81
Functional Functional Distinction Distinction between between
Base Station Base Station Subsystem Subsystem(BSS) and MSC (BSS) and MSC
continued
82
GSM: GSM: Protocol Protocol Architecture Architecture
Interfaces Interfaces between between MSC and MSC and other other network network entities entities
The MM and CM sublayers are both terminated within the MSC.
The MSC performs the interrelaying functions between the CM,
MM, and BBSMAP entities and the Application entities of SS7, such
as ISUP, Mobile Application Part (MAP). In particular MAP
requires the services provided by SCCP and TCAP in order to
interrogate databases (HLR, VLR) in a similar way as the Intelligent
Network services. MAP handles non call-related signaling among the
different entities of the GSM network.
There are different protocols according the entities involved in the
signaling exchange (MAP/A between BSS and MSC, MAP/B between
MSC and VLR, etc..).
42
83
MAP MAP Protocols Protocols (TS (TS - - GSM 09.02) GSM 09.02)
MSC
HLR
VLR
MSC
VLR
GMSC
MAP/D
MAP/C
MAP/E MAP/G
(B)
(B)
B (MSC-VLR)
- Location registration
- Incoming e outgoing call setup
- Authentication
- Management of security services
- Operation of supplementary services
C (MSC-HLR)
- Routing information
D (HLR-VLR)
- Location registration and updating
E (MSC-MSC)
- Handover inter-MSC
F (MSC-EIR)
- Blacklist of MS equipment
G (VLR-VLR)
- location updating using TMSI
Subscriber data (IMSI, authentication
parameters.)
EIR
MAP/F
84
SCCP SCCP protocol protocol
In the SS7 two methods of addressing are possible
The first one is based on the MTP3 addressing level using the so called
Signaling Point Code (SPC) ed in particular Originating Point Code (OPC)
and Destination Point Code (DPC). This scheme has a limited scope, such
as one SS#7 national network. Within this scope, the networking function of
the MTP3 are able to route messages with the DPC.
The second method is based on the concept of global title. It is used in
SCCP, where it provides in GSM (but also in other networks such as the
Intelligent Network) the addressing capacity needed for the transport of
MAP messages between network entities (MSC, HLR, VLR etc.).
The global title may be a number with no direct relationship with SS#7, such
as a PSTN number (E.164), a data number (X.121) or a GSM subscriber
identity (an IMSI), etc. It does not contain explicit information on the way to
route the message, and an SCCP translation function(called Global Title
Translation, GTT) is required to know the MTP address from the global title,
at least at each network border.
43
85
SS7: SCCP SS7: SCCP layer layer
MAP/C
TCAP
SCCP
MTP
MSC STP
SCCP
MTP
MAP/C
TCAP
SCCP
MTP
HLR
= MSU, Message Segnaling Unit
86
MTP, SCCP and TCAP MTP, SCCP and TCAP Messages Messages
F FCS SIF SIO LI FSN BSN F
Component Portion
Transaction
Portion
Component n Component 1 . . .
MTP
SCCP
TCAP
User message/data
SCCP
message
header
Message
Type
RL
C-ingPA+C-edPA+MFD
UD= User Data
F= Flag
FCS= Frame Check Sequence
C-ingPA= Calling Party Address
C-edPA= Called Party Address
SIF= Signalling Information Field
MFD = Mandatory Fixed Part
SIO = Service Information Octet
MTC = Message Type Code
LI = Length Indicator
RL = Routing Label
FSN = Forward Sequence Number
BSN = Backward Sequence Number
* = parte opzionale
Legenda:
44
87
SCCP SCCP layer layer : :
the the Global Global Title Title Translation Translation (GTT) (GTT)
MSC/
VLR
STP "B"
HLR
. . .
. . . .
A
C
DPC + SSN GT
GTT
. . . . .
OPC=A
DPC=B
OPC
SSN
GT . .
RL C-ed
PA
C-ing
PA
OPC=B
DPC=C
. . . . . .
OPC
SSN
SSN . . .
Strati MTP
Strato SCCP
UD= User Data F= Flag
C-ingPA= Calling Party Address FCS= Frame Check Sequence
C-edPA= Called Party Address SIF= Signalling Information Field
MFD= Mandatory Fixed Part SIO= Service Information Octet
MTC= Message Type Code LI= Length Indicator
RL= Routing Label FSN= Forward Sequence Number
*= parte opzionale BSN= Backward Sequence Number
Legenda:
In the example MSC/VLR and HLR belong to
different PLMNs.
IMSI (Racc. E.212) used to derive the MGT by
the Gateway entity.
IMSI = MCC + MNC + MSIN
88
A GW A
(MSC/VLR)
Signaling Point (SP)
Signaling Transfer Point (STP)
STP Gateway (GW) with SCCP
Function (performs GTT)
B
GW B
international SS7 Net National SS7 network
(country A)
National SS7 network
(country B)
called SCCP = M. Global Title (derived from IMSI of MS)
OPC = A; DPC = GWA
SCCP
layer
OPC = GWA; DPC = GWB OPC=GWB; DPC=B
(HLR)
MTP
layer
Global Global Title Title Translation Translation (GTT) (GTT)
A B
GW A
45
89
How How to to obtain obtain the the
Mobile Mobile Global Global Title Title (MGT) (MGT)
STRUCTURE:
MGT = CC + NDC + MSIN
E.164 E.212
MGT is obtained from IMSI:
IMSI = MCC + MNC + MSIN
MGT = CC + NDC + MSIN
CC: Country Code (39 for Italy);
NDC: National Destination Code (339 for TIM);
MSIN: Mobile Station Identification Number (10 digits).
Example: a MS is roaming in a visiting PLMN, when it has to register in a such network, the
only available information to VLR, to address the HLR of the MS is IMSI, from which the
MGT is derived
90
Mobile Mobile terminated terminated call call (I) (I)
MSC
GMSC
HLR
PSTN
BTS
BSC
BTS
BTS
BTS
BSC
LAi
LAj
VLR
VLR
2
MSISDN
3
1
MSRN Request (via IMSI)
MSRN
4
MSRN
5
6
2
3
: Send Routing Information
: Provide Roaming Number
46
91
Mobile Mobile terminated terminated call call (II) (II)
92
PSTN
(origin of the call)
GMSC
HLR
MSC
VLR Speech Path
signaling
ISUP
MAP/D
ISUP
COUNTRY VISITED BY THE COUNTRY VISITED BY THE
CALLED PARTY CALLED PARTY
International routing for International routing for
a roaming subscriber a roaming subscriber
HOME COUNTRY OF HOME COUNTRY OF
THE CALLED PARTY THE CALLED PARTY
47
93
PSTN
origin of the call
GMSC
HLR
MSC
VLR
country B
country A
signaling
GSM: GSM: without without optimal optimal routing routing (2) (2)
ISUP
MAP/C
ISUP
MAP/D
Speech path
HOME COUNTRY OF HOME COUNTRY OF
THE CALLED PARTY THE CALLED PARTY
COUNTRY VISITED BY THE COUNTRY VISITED BY THE
CALLED PARTY CALLED PARTY
94
PSTN
origin of the call
GMSC
HLR
signaling
MSC
VLR
country B
country A
GSM: GSM: optimal optimal routing routing (3) (3)
ISUP
MAP/C
MAP/D Speech routing
HOME COUNTRY OF HOME COUNTRY OF
THE CALLED PARTY THE CALLED PARTY
COUNTRY VISITED BY THE COUNTRY VISITED BY THE
CALLED PARTY CALLED PARTY
(visited PLMN)
48
95
Inter Inter- -system system Roaming Roaming
Source: http://www.ericsson.com/about/publications/review/1999_02/article52.shtml
So far Cellular networks have handled (macro)mobility with a vertical
approach (radio access technology dependent: i.e. direct roaming is impossible
between GSM e TDMA/AMPS handsets) unless..
96
Call Call delivery delivery to to a GSM a GSM subscriber subscriber
roaming roaming in a TDMA/AMPS network in a TDMA/AMPS network.
Source: http://www.ericsson.com/about/publications/review/1999_02/article52.shtml
3 = Send routing information invoke
4 = Provide roaming number invoke
5 = Routing request invoke
6 = Routing request return result
7 = Provide roaming number result
8 = Send routing information result
9 = Call delivery (voice trunk)
10 = Mobile terminal call setup
GAIT (GSM/ANSI136 Interoperability Team) is born in order to
facilitate roaming between ANSI-136 and GSM
49
97
Location Location Updating Updating (VLR (VLR change change and and using using TMSI) TMSI)
If the subscriber identity is a TMSI, the VLR
checks whether the previous location area
identification (LAI) provided in the primitive
received fromMSC belongs to an area of this
VLR: - if so, the TMSI will be checked. In
case of location area change within a VLR,
the TMSI should be known and the process
may continue with the authentication check.
- if the TMSI is not known or the subscriber
data stored are incomplete, e.g. because the
new LA belongs to a different VLR or due to
VLR restoration, the indicator "Confirmed
by VLR" is set to "Not Confirmed" to initiate
HLR updating later on.
If the subscriber has not already been
registered in the VLR, i.e. the previous LAI
belongs to a different VLR, the indicators
"Confirmed by HLR" and "Location
Information Confirmed in HLR" are set to
"Not Confirmed" and the VLR checks
whether the identity of the Previous VLR
(PVLR) is derivable fromthe previous LAI:
- if so, the IMSI and authentication
parameters are requested fromthat VLR
98
Location Location Updating Updating (VLR (VLR change change and and using using IMSI) IMSI)
/ AuC
VLR1= PVLR
50
99
MS BSS MSC VLR HLR GMSC
PSTN
exchange
IAM
SEND ROUTING INFO
ROUTING INFO
IAM
PROVIDE R.N.
R.N. ACK
SEND INFO FOR I/C
CALL SETUP
SEND PARAM.
FROM HLR
CALL DATA
ACK
PAGE MS PAGING
PAGING REQ
CHAN REQ
IMM ASS
PAGE RESPONSE COMPLETE
LAYER 3 INFO
PROCESS
ACCESS REQ.
AUTHENTICATE AUTHENTIC. REQUEST
AUTHENTIC. RESPONSE
AUTHENTIC.
RESPONSE
START CIPHERING CIPHER
TMSI
TMSI ACK
SETUP
CALL CONF
ASSIGN REQ ASSIGN CMD
ASSIGN COM ASSIGN COMP
ALERT ADDRESS COMPLETE MESSAGE (ACM) ACM
CONNECT ANSWER ANS
CONNECT ACK
Fixed Fixed to to Mobile Mobile call call scenario scenario
(*)
(*)= passi semplificati (alcuni messaggi non presenti)
100
MS BSS MSC VLR
HLR
CHIAMATO
PSTN
exchange
CHAN REQ
IMM ASS
COMPLETE
LAYER 3 INFO
PROCESS
ACCESS REQ.
AUTHENTICATE
AUTHENTIC. REQUEST
AUTHENTIC. RESPONSE
AUTHENTIC.
RESPONSE
START CIPHERING CIPHER
TMSI REAL COMP
TMSI ACK
SETUP
CALL PROC
ASSIGN REQ ASSIGN CMD
ASSIGN COM ASSIGN COMP
ALERT
INITIAL ADDRESS MESSAGE (IAM)
CONNECT
ANSWER
CONNECT ACK
Mobile Mobile to to Fixed Fixed call call scenario scenario
SENDING INFO
FOR O/G CALL
COMPLETE CALL
ADDRESS COMPLETE MESSAGE (ACM)
CM SERV REQ
(*)
(*)= semplified steps (some message are not present)
51
101
102
52
103
104
53
105
MS BSS_A MSC1
HND REQUIRED
interMSC interMSC Handover Handover
MSC2
PERFORM HANDOVER
HND REQ
HND CMD
HND CMD
HND REQ ACK
PHYS INFO
HANDO ACCESS
CHAN REL
CRL CMD
IAM
SEND END SIGNAL
BSS_B VLR
ALLOCATE HANDOVER NUMBER
SEND HANDOVER REPORT
RADIO CHAN ACK
ACM
HND CMD
HND DETECT
HANDOVER COM
HND CMP ANS
CRL COM
FORWD ACC. SIGNAL.
CALL CONTROL OR MOBILITY MANAGEMENT MESSAGE
ACKNOWLEDGEMENT
CALL CONTROL OR MOBILITY MANAGEMENT MESSAGE
PROCESS ACC. SIGNAL
.
.
END SIGNAL
HANDOVER REPORT
106
MS BSS 1 MSC
HND RQD
intraMSC intraMSC Handover Handover
BSS 2
HND REQ
HND REQ ACK
HND CMD
HND CMD
HANDO ACCESS
HND DETECT
PHYS INFO
HANDO COM
CHAN REL CRL CMD
CRL COM
HND CMP
54
107
radio channels used by SMS
Short Short Message Message Service Service (SMS) (SMS)
architecture architecture
SME
SMSC
SME
SME
SME
SMS
GW-MSC
MSC
BSS
CSS7
SMSC: Short Message Service Center
SMS-GW-MSC: SMS Gateway MSC
(usually integrated in the SMSC)
SME: Short Message Entity (entity that
is able to Tx or Rx short messages;
SME may be in the fixed network, may
be a MS, or other services center
HLR VLR
(Stand-by mode)
(Dedicated mode)
Outside the scope of
GSM standard
108
Short Message Service (SMS) Short Message Service (SMS)
Mobile Originated
BSS
MSC MSC
IWMSC IWMSC
1
2 3 4
SMS SMS- -C C
BSS
MSC MSC GMSC GMSC
1
4
7
8
2
?
info
3
5
?
info
6
HLR VLR
Mobile
Terminated
55
109
Mobile Mobile Originated Originated Short Short Message Message (MO (MO - - SM) SM)
110
Mobile Mobile Terminated Terminated Short Short Message Message (MT (MT - - SM) SM)
56
111
QoS QoS requirements of traffic types requirements of traffic types
Jitter Delay
Conversational
Loss
Streaming
Interactive
Background
Voce
Video
Signaling
Internet
112
Network Network Evolution Evolution: : simplified simplified models models
STP
STP STP
STP
SS7 network
(packet switching)
Telephone Network
(Circuit switching)
Voice
Services
Signaling
(+ SMS of GSM)
router
router
router
router
router
internet (IP)
(packet switching)
Data Services
57
113
RELIABLE
MAX DELAY
Current transport
Protocols over IP
TCP
UDP
SIGNALING
REQUIREMENTS
NON REAL TIME
NON RELIABLE FAST
LIGHT
RELIABLE
FAST LIGHT
New Transport Protocol: SCTP
(Stream Control Transmission Protocol) ;
Signaling over IP ( Signaling over IP (SoIP SoIP) )
How to fulfill signaling requirements ? How to fulfill signaling requirements ?
ANSWER
114
Architectural Architectural View View of SCTP (RFC2960) of SCTP (RFC2960)
SCTP is viewed as a layer between the SCTP user application ("SCTP
user" for short) and a connectionless packet network service such as
IP.
The basic service offered by SCTP is the reliable transfer of user
messages between peer SCTP users.. It offers acknowledged error-free
non-duplicated transfer of datagrams (messages). Detection of data
corruption, loss of data and duplication of data is achieved by using
checksums and sequence numbers. A selective retransmission
mechanism is applied to correct loss or corruption of data
It performs this service within the context of an association between
two SCTP endpoints.
SCTP is connection-oriented in nature, but the SCTP association is a
broader concept than the TCP connection.
SCTP provides the means for each SCTP endpoint to provide the
other endpoint (during association startup) with a list of transport
addresses (i.e., multiple IP addresses in combination with an SCTP
port) through which that endpoint can be reached and from which it will
originate SCTP packets. The association spans transfers over all of the
possible source/destination combinations which may be generated from
each endpoint's lists.
58
115
MTP
1-3
M3UA/
SCTP/
IP
SG MGC
ISUP
M3UA/
SCTP/
IP
PSTN/ISDN
DSS1
MTP
1-3
ISUP
n:n
MGC
ISUP
M3UA/
SCTP/
IP/
IP network
n:n
MTP
1-3
M3UA/
SCTP/
IP
SG
n:n
n:n
Signaling Transport over IP (I) Signaling Transport over IP (I)
MTP3 function resides in the
Signaling Gateway (SG)
116
MTP
1-2
M2UA/
SCTP/
IP/
SG
MGC
PSTN/ISDN
1:n
DSS1
MTP
1-2
ISUP
MTP3
ISUP
M2UA
SCTP/
IP/
MTP3
IP network
1:n
ASP
ASP
Signaling Transport over IP (I) Signaling Transport over IP (I)
M2UA (RFC3331) provides an equivalent functionality to its users as
MTP2 provides to MTP3. It is used between a SG and a MGC. Unlike
M2UA, M2PA (IETF draft) supports complete MTP3 message
handling and network management between any two SS7 nodes
communicating over an IP network.
59
117
Signaling Signaling over IP over IP
IP Transfer Point (ITP), known in the industry as a Signaling Gateway (SG)
SEP: Signaling End Point
118
offload of SMS traffic from transit offload of SMS traffic from transit
exchanges (TR/STP) exchanges (TR/STP) - - SMS over IP SMS over IP
Traffic from SMS procedures
Traffic from mobility procedures,
Call handling and supplementary
services
IP UNIGATE
network
MSC-VLR
STP STP
STP STP
SMS-C
SMS-C
HLR
HLR
SGw SGw
SGw SGw
MSC-VLR
60
119
Cisco Architecture: M2PA Cisco Architecture: M2PA adaption adaption
protocol protocol
SP SG (STP)
SS7
Appl
MTP3
MTP2
MTP1
MTP2
M2PA
SCTP
MTP1 IP
M2PA
SCTP
IP
SS7 IP
IP network
Peer to Peer
MTP3
SP
SS7
Appl
MTP3
MTP2
MTP1
MTP3
MTP2
MTP1
SG (STP)
SS7
Transport
SCCP SCCP
GTT GTT GTT GTT
SCTP StreamControl Transmission Protocol (RFC 2960)
M3UA MTP3 User Adaptation (RFC 3332)
M2UA MTP2 User Adaptation (RFC 3331)
M2PA MTP2 Peer to Peer Adaption (IETF draft)