Giuseppe Bianchi

PART S
PART S
GSM
GSM
-
-
SwItcbIng & MobIIIty
SwItcbIng & MobIIIty
Lecture 5.1
Protocol architecture overview
Giuseppe Bianchi
Tbe GSM network Iayer
Tbe GSM network Iayer
Divided in three sub-layers
Rad|o Resource Varagererl (RR)
Provides a communication link
between MS and MSC;
Voo|||ly Varagererl (VV)
Manages DB for MS location
Corrur|cal|or Varagererl (CV)
Controls user connection
Underlying base:
Trarsr|ss|or |eve|
Transmission
RR
MM
CM
Giuseppe Bianchi
RR
RR
Manages administration of frequencies and channels
Vosl|y dea|s W|lr a|r |rlerlace
Several RR functions considered in previous part
Guarantees stable link upon handover
Surprise! handover is part of RR, not MM!
Function summary:
Vor|lor|rg 8CCl, PCl
RACl adr|r|slral|or
Requesl/ass|grrerl ol crarre|s
V3 poWer corlro| & syrcrror|zal|or
lardover
Where is RR:
V3, 8T3, 83C, V3C
Giuseppe Bianchi
MM
MM
Manages user location and tasks resulting from
mobility
Function summary:
TV3l ass|grrerl
V3 |oca||zal|or
Local|or updal|rg
V3 aulrerl|cal|or
V3 |derl|l|cal|or, allacr/delacr
Where is MM:
V3, V3C
Giuseppe Bianchi
CM
CM
Controls calls, supplementary services, and SMS
Function summary:
Ca|| eslao||srrerl (lror V3, lo V3)
Erergercy ca|| raragererl
Ca|| lerr|ral|or
0TVF s|gra||rg (0ua| Tore Vu|l|Frequercy)
lr-ca|| rod|l|cal|or
Where is CM:
V3, V3C, 0V3C
Giuseppe Bianchi
ProtocoI pIacement
ProtocoI pIacement
CM
MM
RR
Trans.
MS BTS BSC
MSC
(VLR)
HLR
GMSC
Giuseppe Bianchi
ProtocoI outIIne
ProtocoI outIIne
MS BTS BSC
Relay
MSC
Anchor
MSC
HLR
CM
MM
RR
RIL3-CC
RIL3-MM
RSM MAP/E
MAP/D
LAPDm LAPD MTP MTP MTP
SCCP
SCCP SCCP
TCAP
BSSMAP
RIL3-RR
R|L3: Rad|o |nterface Layer 3
R8H: Rad|o 8ubsystem Hanagement
88HAP: 88 Hanagement App||cat|on Part
HAP: Hob||e App||cat|on Part
T6AP: Transact|on 6apab|||t|es App||cat|on Part
866P: 8|gna||ng 6onnect|on 6ontro| Part
HTP: Hessage Transfer Part
LAP0: L|nk access Protoco| on 0 channe|
LAP0m: L|nk access Protoco| on 0m channe|
Giuseppe Bianchi
PART S
PART S
GSM
GSM
-
-
SwItcbIng & MobIIIty
SwItcbIng & MobIIIty
Lecture 5.2
handover (physical mobility)
Giuseppe Bianchi
NeIgbbor ceIIs
NeIgbbor ceIIs
A station must:
ror|lor oeacor poWer |eve| ol re|groor ce||s
Keep dela||ed lrac| ol oesl re|groor ce||s
0EC00E lre|r 8CCl (|.e. read FCCl, 3Cl) lo gel pararelers
At least once every 5 minutes
BSIC (from SCH) refreshed every at most 30s
BTS
1
BTS
2
BTS
n
Giuseppe Bianchi
CampIng ceII seIectIon
CampIng ceII seIectIon
patb Ioss crIterIon C1 patb Ioss crIterIon C1
When cell parameters are the same, simply select cell with higher RXLEV!
( ) [ ] P AX_CCH MS_TXPWR_M , 0 max
SS_MIN RXLEV_ACCE
RXLEV(n) C1(n)


=
RXLEV(n}: rece|ved power from T8(n}
RXLEV_A66E88_H|N: m|n|mum rece|ved power |eve| requ|red for reg|strat|on |n the ce||
(parareler lrarsr|lled or 8CCl; lyp|ca||y -98 lo -10 d8)
H8_TXPwR_HAX_66h: max|mum a||owed transm|tted power on RA6h
(parareler lrarsr|lled or 8CCl; lyp|ca||y 31-39 d8r)
P: max|mum H8 power (from HT c|ass}
Select cell with greatest c1(n)>0:
Giuseppe Bianchi
CeII reseIectIon crIterIon (C2)
CeII reseIectIon crIterIon (C2)

<
=

+ =
0 x 1
0 x 0
H(x) where
T) TIME H(PENALTY_ OFFSET TEMPORARY_
ECT_OFFSET CELL_RESEL C1(n) C2(n)
T: amount of consecut|ve t|me s|nce cons|dered ce|| became w|th 61>0
PENALTY_T|HE, 6ELL_RE8ELE6T_0FF8ET, TEHP0RARY_0FF8ET: 66h parameters
6ELL_RE8ELE6T_0FF8ET: typ|ca||y used to ass|gn a pr|or|ty to a ce||
Frequent |n the case of dua|-band operators: greater offset (pr|or|ty} for 1800 Hhz ce||s
|f a|| parameters = 0, rese|ect ce|| w|th better path |oss performance (no t|me hysteres|s |nc|uded}
Reselect cell with greatest C2>0:
Giuseppe Bianchi
Consequences oI ceII reseIectIon
Consequences oI ceII reseIectIon
None, when MS idle!
No need to inform BTS at all!
Exception:
wrer ce|| rese|ecl|or |rp||es a Local|or Area updale
Need to inform the network!
Additional restriction:
C2>CELL_RE3ELECT_lY3TERE3l3
BTS BTS
Giuseppe Bianchi
bandover
bandover
Procedure in which an MS releases a connection with
a BTS, and establishes a connection with a new BTS,
while ensuring that the ongoing call is maintained
Tre V3 rera|rs |r ded|caled slale (ur|||e ce|| rese|ecl|or, Wrere V3 |s |r |d|e
slale)
Handoff: synonymous of handover
Needs two mechanisms
handover preparat|on: delecl|or ol ce||-oorder cross|rg
Based on radio link quality measurements
handover execut|on: selup ol a reW crarre| |r a ce||, ard lear-doWr ol a
prev|ous crarre|
Improved handover mechanisms:
3ear|ess rardover: Wrer acl|ve ca|| perlorrarce |s rol |rpa|red
Not possible in GSM: for about 100-200ms, communication is interrupted
3oll lardover: Wrer lWo crarre|s are s|ru|lareous|y sel-up (o|d ard reW)
Not possible in GSM; possible in UMTS
Giuseppe Bianchi
Hard, SeamIess, SoIt bandover
Hard, SeamIess, SoIt bandover
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
1
MSC
BSS 1 BSS 2
MS
f
2
MSC
BSS 1 BSS 2
MS
MSC
BSS 1 BSS 2
MS
f
2
f
1
f
2
f
1
f
1
before during after
Hard
handover
(GSM)
Seamless
(DECT)
Soft
handover
(UMTS)
Giuseppe Bianchi
Handover cIassIIIcatIon
Handover cIassIIIcatIon
Rescue handover
(mandatory handover)
0r|ver oy rad|o crarre| qua||ly
degradal|or
Confinement handover
(network-directed handover)
Targel: r|r|r|ze rad|o |rlerlererce
Ass|gr reW crarre| Wrer o|d
crarre| resu|ls cr|l|ca| lor lola|
|rlerlererce
Traffic handover
(network-directed handover)
0r|ver oy lrall|c corgesl|or
cord|l|ors
A|so ca||ed |oad-oa|arc|rg
Internal handover
lrlra-8T3
New radio channel in the same
cell
Not termed as handover but
assubsequent assignment
lrler-8T3 (lrlra-83C)
Under control of same BSC
External handover
lrler-83C (lrlra-V3C)
Change reference BSC; may
imply a location area update
lrler-V3C
Most complex: need to change
MSC
Classification by motivation Classification by typology
Giuseppe Bianchi
Types oI bandover
Types oI bandover
A-MSC
BSC
BTS BTS BTS BTS
BSC BSC
R-MSC
A
A-bis
radio
interface
Anchor MSC:
the MSC that first
managed the current call
Relay MSC:
the MSC that currently
manages the call
Switching
point for
internal
handover
Switching
point for
all inter-MSC
handover
Switching
point for
inter-BSC
handover
Giuseppe Bianchi
Handover taxonomy
Handover taxonomy
BCHO: Base station Controlled Handover
lardover delecl|or: 83
lardover Execul|or: 83
MCHO: Mobile Controlled Handover
lardover delecl|or: V3
lardover Execul|or: V3
MAHO: Mobile Assisted Handover
lardover delecl|or: V3
lardover Execul|or: 83
GSM: somehow a BCHO with a flavor of MAHO
lardover dec|s|or a|Ways la|er oy 83C
8ased or reasures la|er al oolr 8T3 ard V3
NeW crarre| se|ecl|or dec|s|or la|er al 83C or R-V3C or A-V3C
(deperd|rg or rardover lype) oased or lrall|c cors|deral|or
Giuseppe Bianchi
Handover preparatIon
Handover preparatIon
Measurements performed at BTS
up-||r| s|gra| |eve| rece|ved lror V3 |oWer lrar lrresro|d
RXLEV_UL < L_RXLEV_UL_H
up-||r| s|gra| qua||ly (8ER) rece|ved lror V3
RXQUAL_UL < L_RXQUAL_UL_H
0|slarce oelWeer V3 ard 8T3
adaptive timing advance parameter > MAX_MS_RANGE
lrlerlererce |eve| |r ura||ocaled l|re s|ols.
Measurements performed at MS.
0oWr-||r| s|gra| |eve| rece|ved lror serv|rg ce||
RXLEV_DL < L_RXLEV_DL_H
0oWr-||r| s|gra| qua||ly (8ER) rece|ved lror serv|rg ce||
RXQUAL_DL < L_RXQUAL_DL_H
0oWr-||r| s|gra| |eve| rece|ved lror n-lr re|groor ce||
RXLEV_NCELL(n) > RXLEV_MIN(n)
- -48 RXLEV_63
-48 -49 RXLEV_62


-107 -108 RXLEV_3
-108 -109 RXLEV_2
-109 -110 RXLEV_1
-110 - RXLEV_0
To
(dBm)
From
(dBm)
RX signal
level
- 12.8 RXQUAL_7
12.8 6.4 RXQUAL_6
6.4 3.2 RXQUAL_5
3.2 1.6 RXQUAL_4
1.6 0.8 RXQUAL_3
0.8 0.4 RXQUAL_2
0.4 0.2 RXQUAL_1
0.2 - RXQUAL_0
To
(%)
From
(%)
Bit error
Ratio
Giuseppe Bianchi
A note on MS dIstance A note on MS dIstance
Distance can be measured based on TA
TA = advance bits
ldea||y, TA srou|d oe sel as
lerce, lre TA reso|ul|or, |r rl, |s:
lN3uFFlClENT lor r|croce||sl
3ull|c|erl or|y lo urderslard We are go|rg oul ol lre ce||
[ ]
bit bit
t c
TA
d
c
d
t bits TA = =
2
2
( ) mt TA
ms ms mt
TA
t c
TA TA d
bit
554
2
] [
833 . 270
1
] / [ 300000
2

=
Giuseppe Bianchi
Handover preparatIon
Handover preparatIon
-
-
addItIonaI metrIcs
addItIonaI metrIcs
Transmission power
Vax|rur V3 lrarsr|ss|or poWer
Vax|rur serv|rg 8T3 lrarsr|ss|or poWer
Vax|rur re|groor|rg 8T3s lrarsr|ss|or
poWer
congestion status
ol serv|rg 8T3
ol re|groor|rg 8T3s
provided they can support the MS.
Handover Margin
To avo|d p|rg-porg rardover ellecl
5-10 d8 |r rorra| operal|or; up lo 30d8 |r
uroar operal|or (lo l|grl sradoW|rg)
RXLEV
(cell A)
RXLEV
(cell B)
Handover
RXLEV
(cell A)
RXLEV
(cell B)
Handover
hysteresis
HANDOVER ALGORITHM: operator-dependent!
GSM standard SUGGESTS a simple reference
algorithm, but implementation left to operator
Giuseppe Bianchi
bandover procedure skeIeton
bandover procedure skeIeton
2) Switching point prepares new path on fixed net
2
1) Handover request goes up to switching point
1
MSC
T8
T8
86
86
3) Switching point sends HO command to MS
3
4) MS accesses new channel
4
5) Old channel/path torn down
5
Giuseppe Bianchi
SIgnaIIng Ior Intra
SIgnaIIng Ior Intra
-
-
MSC bandover
MSC bandover
(sImpIIIIed) (sImpIIIIed)
MS BTS-A
MSC BSC-B MS BTS-B BSC-A
Heasurement |nfo
handover requ|red
(dest|nat|on ce||}
handover request
6hanne| a||ocat|on
6hanne| act|vat|on
A6K
handover req. ack
{conra|ns nanoover
commano message
prepareo o, 3$0-3
u|rn |nlo on 300l,
cnanne| ass|gneo, ercj
handover command
handover command
handover access
{an access oursr
on neu T0l|||j
phys|ca| |nfo
{neu T/, pouerj
handover comp|ete
handover comp|ete
handover detect|on
handover detect|on
c|ear command
c|ear comp|ete
Heasurement
|nfo
Giuseppe Bianchi
Inter
Inter
-
-
MSC bandover
MSC bandover
More complex, as an ISDN circuit must be set
between MSCs
we'|| rol erler |rlo dela||s (jusl lre oas|c |deas)
Two cases
MSC-A MSC-R1
First MSC change
(basic handover)
MSC-A MSC-R1
Second MSC change
(subsequent handover)
MSC-R2

Note the role of the

Anchor MSC!
Giuseppe Bianchi
PART S
PART S
GSM
GSM
-
-
SwItcbIng & MobIIIty
SwItcbIng & MobIIIty
Lecture 5.3
location registration/update
Authentication & Ciphering
Giuseppe Bianchi
LocatIon Area
LocatIon Area
vs
vs
MSC servIce area
MSC servIce area
LA-4 LA-n
LA-1 LA-2 LA-3
MSC VLR
Giuseppe Bianchi
RegIstratIon
RegIstratIon
vs
vs
update
update
Very similar procedures, with goals:
0elerr|re Wrere lre user |s
Aulrerl|cale user
Differences:
Local|or Reg|slral|or
User first access to PLMN
Needs to send IMSI and receive TMSI
Local|or updale
Subsequent accesses to PLMN (either in old or new MSC/VLS)
Also after MS shut-down!
TMSI-based identification
Registered user:
Tre PLVN |roWs lre LA Wrere lre user |s (or |s supposed lo oe)
Giuseppe Bianchi
Procedure start
Procedure start
-
-
up
up
MS switches on
Detects BCCH carrier
Ture ard syrcrror|ze
Listens to BCCH
Obtains Location Area Identifier
LAl: [CC,VNC,LAC|
Country Code (CC): 3 digits
Mobile Network Code: 2 digits
Location Area Code: max 5 digits
Giuseppe Bianchi
LRJLU (very) basIc Idea
LRJLU (very) basIc Idea
MSC VLR
T8
T8
T8
86
H8
HLR
1
1) Obtain LAI from BCCH
2
2) Register MS ID into local VLR
3
3) Update pointer at HLR
Giuseppe Bianchi
LocatIon RegIstratIon
LocatIon RegIstratIon
MS
VLR HLR AUC
BSS/MSC
Loc. Upd. Request
IMSI, LAI
Update Loc. Area
IMSI, LAI
Auth. Param. Req.
IMSI
Auth. Info. Req.
IMSI
Auth. Info
(Auth. Parameters)
Auth. Info
(Auth. Parameters)
authentication
Activate
ciphering
Update Location
IMSI, MSRN
Insert Subscrib. Data
IMSI, additional data
Insert Subscrib. Data
ACK
Locat. Upd. Accept
IMSI
Start Ciphering
Kc
Locat. Upd. Accept
Forward new TMSI
TMSI
TMSI Realloc Cmd
Locat. Upd. Accept
TMSI Realloc ACK
TMSI ACK
Giuseppe Bianchi
AutbentIcatIon
AutbentIcatIon
(managed by VLR) (managed by VLR)
Authentication Request
Challenge: 128 bit RAND
A3
RAND Ki
SRES
Authentication Response
Signed RESult: 32 bit SRES
Equal?
SRES
VLR
H8
HLR /
AUC
IMSI, RAND
SRES, Kc
A8
RAND Ki
Kc
Giuseppe Bianchi
AutbentIcatIon (detaIIs)
AutbentIcatIon (detaIIs)
Side effect of authentication:
0ererale ercrypl|or |ey Kc v|a A8 a|gor|lrr
Secret A3, A8 algorithms (one-way hash functions)
3lored |rlo lre 3lV
Along with secret key Ki
Nole lral roar|rg operalor 00E3 N0T reed lo |roW lrerl
Since A3,A8 run ONLY in the AUC at the home HLR
Ki is NEVER transmitted away from AUC or MS!
Generally implemented together
[3RE3,Kc| = A38[K|,RAN0|
To reduce signaling, real implementation slightly
different:
vLR serds lV3l
Rece|ves oac| severa| lup|es ol (RAN0, 3RE3, Kc) lo oe used lor lre
cors|dered V3 a|so |r suosequerl accesses
Giuseppe Bianchi
cIpberIng
cIpberIng
A5 algorithm is known (to allow roaming)
Generates two ciphering sequences
ore lor up||r|, ore lor doWr||r|
3equerce per|od|c W|lr per|od 2x51x2018=2,Z15,18
2
21
=2,097,152 < 2,715,648 < 2
22
=4,194,304
114 bits per frame, depending on frame number
XOR-ed with burst data field
A5 MS A5 BTS
Frame number
FN, 22 bits
Kc
64 bits
Frame number
FN, 22 bits
Kc
64 bits
XOR XOR
XOR XOR
S2 S2 S1 S1
In-clear uplink In-clear uplink enciphered uplink
In-clear downlink enciphered downlink In-clear downlink
Giuseppe Bianchi
LocatIon Update In same VLR
LocatIon Update In same VLR
(same as IocatIon regIstratIon, but wItb TMSI) (same as IocatIon regIstratIon, but wItb TMSI)
MS
VLR HLR AUC
BSS/MSC
Loc. Upd. Request
TMSI, LAI
Update Loc. Area
TMSI, LAI
Auth. Param. Req.
IMSI
Auth. Info. Req.
IMSI
Auth. Info
N x (Kc,RAN0,3RE3)
Auth. Info
N x (Kc,RAN0,3RE3)
authentication
Activate
ciphering
Update Location
IMSI, MSRN
Insert Subscrib. Data
IMSI, additional data
Ins. subs. data ACK
Locat. Upd. Accept
IMSI
Start Ciphering
Kc
Locat. Upd. Accept
Forward new TMSI
TMSI Realloc Cmd
Locat. Upd. Accept
TMSI Realloc ACK
TMSI ACK
Generate
New TMSI
Giuseppe Bianchi
CbangIng
CbangIng
MSCJVLR
MSCJVLR
ase
8tat|on
V3C
Pub||c sw|tched
te|ephone network
P8TN
Pub||c sw|tched
te|ephone network
P8TN
ase
8tat|on
V3C
VLR
VLR
hLR
An M3 always has a dedicated entry in the hLR
Plus one entry in J037 1 VLR
[related to the M3C the user is connected toj
Giuseppe Bianchi
TMSI
TMSI
TMSI = Temporary Mobile Subscriber Identity
1 oclels (32 o|ls)
RereWed per|od|ca||y; al every Lu / lV3l_allacr
v|a TV3l_Rea||ocal|or_Corrard/TV3l_Rea||ocal|or_Corp|ele
RATl0NALE: rereW TV3l Wrer lrarsr|lled |r c|earl
(TV3l rea||ocal|or occurs |r c|prer|rg rode)
Meaningful only in a given VLR
3pec|l|ca||y, or|y lor a g|ver Local|or Areall
Some author (Mouly-Pautet) uses the term
TIC (Temporary Identity Code) = 4 bytes
TMSI = TIC+LAI = unambiguous user identification
While entering a new Location Area:
user rusl |derl|ly |lse|l W|lr TV3lLAl pa|r.
Operator may set a 6min
up to 24hrs periodicity
for LU (value transmitted
on BCCH)
IMSI_attach = a special LU
in a same Location Area;
IMSI_attach follows
an IMSI_detach
(power-down of MS)
Giuseppe Bianchi
LocatIon Update: dIIIerent VLR
LocatIon Update: dIIIerent VLR
MS
VLR-new HLR VLR-old
BSS/MSC
Loc. Upd. Request
TV3l( o|d LAl), LAl
Update Loc. Area
TV3l( o|d LAl), LAl
authentication
Activate
ciphering
Update Location
IMSI, MSRN
Insert Subscrib. Data
IMSI, additional data
Ins. subs. data ACK
Locat. Upd. Accept
IMSI
Start Ciphering
Kc

Forward new TMSI
Generate
New TMSI
Send parameters (TMSI, old LAI)
IMSI response (IMSI,RAND,SRES,Kc)
Cancel Location
IMSI
Cancel Locat. ACK
determine
VLR-old
Fromold LAI
Giuseppe Bianchi
SpecIaI
SpecIaI
cases
cases
1. New VLR not capable of determining old
VLR from old LAI
2. Old VLR does not recognize TMSI
lderl|l|cal|or procedure
lV3l lrarsr|lled |r c|ear
MS
MSC
Identity Response
IMSI
Identity Request
PAGING:
- Normally based on TMSI
- But when no valid TMSI information available (e.g. after a DB restore
after crash), based on IMSI
Giuseppe Bianchi
PART S
PART S
GSM
GSM
-
-
SwItcbIng & MobIIIty
SwItcbIng & MobIIIty
Lecture 5.4
Call Management & routing
Giuseppe Bianchi
NotatIon
NotatIon
A call involves two "Parties"
Calling Party (caller)
user gereral|rg lre ca||
Called Party (callee)
user rece|v|rg lre ca||
Mobile Originating Call (MOC)
Ca|| or|g|raled oy ar V3
Mobile Terminating Call (MTC)
Ca|| d|recled lo ar V3
Giuseppe Bianchi
CaII
CaII
estabIIsbment
estabIIsbment
basIcs
basIcs
MS MSC
Fixed
party
setup
MS MSC
Fixed
party
setup
setup
6a|| conf|rmed
a|ert|ng
a|ert|ng
connect
connect
DATA
setup
Mobile Terminated Call
Mobile Originated Call
6a|| proceed|ng
a|ert|ng
a|ert|ng
6onnect
6onnect
6onnect Ack
DATA
In ISDN ISUP: - setup = IAM (Initial Address Message);
- Alerting = ACM (Address Complete Message);
- Connect = ANS (Answer)
Giuseppe Bianchi
CaII
CaII
estabIIsbment
estabIIsbment
steps
steps
Channel request
Paging request
Paging Response
Immediate Assignment
Authentication Response
Authentication Request
Ciphering Mode Complete
Ciphering mode command
Call Confirmed
Setup
Assignment Complete
Assignment Command
Alerting
Connect
Connect Acknowledge
Mobile
Terminated Call
MS network
Channel request
Service Request
Immediate Assignment
Authentication Response
Authentication Request
Ciphering Mode Complete
Ciphering mode command
Call proceeding
Setup
Alerting
Connect
Connect Acknowledge
Mobile
Originated Call
MS network
Assignment Complete
Assignment Command
Giuseppe Bianchi
RadIo
RadIo
Resource
Resource
aIIocatIon
aIIocatIon
tbree tbree standardIzed standardIzed soIutIons soIutIons
Non-Off Air Call Set-Up (Non-OACSU)
Norra||y used (prev|ous descr|pl|or)
Off Air Call Set-Up (OACSU)
TCl ass|gred or|y Wrer lre ca||ed parly aclua||y respordsl
Best utilization of radio resource (avoids allocation if callee not available)
Call drop if no TCH is available at this point
Very Early Assignment (VEA)
lrred|ale ass|grrerl ol TCl
Fastest signalling process
Waste of resources
RACH
RACH
RACH
VEA
TCH (FACCH)
TCH (FACCH)
Non-OACSU
OACSU
SDCCH
TCH (DATA)
SDCCH
TCH (DATA)
TCH (DATA)
Connection established Callee responds
Giuseppe Bianchi
DTMF
DTMF
sIgnaIIng
sIgnaIIng
Dual-Tone Multi-Frequency
0|g|la| lores assoc|aled lo lerr|ra| |eys
09#
Inband signalling
lrarsr|lled |r lre lrall|c crarre|sl
Nol |r lre s|gra|||rg relWor|
MS MSC
Start DTMF (w. key code)
Start DTMF ACK
On FACCH)
Key
Pressed
Stop DTMF
On air interface:
3|gra| lrasr|lled or FACCl as
s|gra|||rg dala (code ol pressed
|ey)
0lrerW|se coded corpress|or
Wou|d d|slorl 0TVF lores
Tore gereraled al V3C Wrer
3T0P 0VTF ressage rece|ved
Giuseppe Bianchi
MSC
A
HLR
MSC
C
MSC
B
PLMM
ISDN
GMSC
VLR
B
RoutIng
RoutIng
an
an
MTC
MTC
1
:

M
S
I
S
D
N
4
:

M
S
R
N
2
:

M
S
I
S
D
N
3
:

M
S
R
N
5: MSRN
6: TMSI
7
:

p
a
g
i
n
g
Giuseppe Bianchi
RoutIng
RoutIng
an
an
MTC (aIternatIve)
MTC (aIternatIve)
reduces reduces sIgnaIIIng sIgnaIIIng Ioad Ioad durIng durIng LU LU
MSC
A
HLR
MSC
C
MSC
B
PLMM
ISDN
GMSC
VLR
B
During an LU within a same VLR,
MSRN is NOT signaled!
MSRN retrieved on a per-call basis!
(choice of solution depends on trade-offs)
1
:

M
S
I
S
D
N
2
:

M
S
I
S
D
N
6
:

M
S
R
N
5
:

M
S
R
N
7: MSRN
8: TMSI
9
:

p
a
g
i
n
g 3: IMSI
4: MSRN
Giuseppe Bianchi
PLHN 1
(|TA}
V3C
0V3C 1
hLR
PLHN 2
(UK}
V3C
|80N
(|ta}
Transit
Exchange
Local
Exchange
International
Switching
Center
MSISDN
+39.335.1234567
335.1234567
International
Switching
Center
|80N
(UK}
MSRN
+44.NDC.8877665
RoutIng
RoutIng
caIIs
caIIs
to
to
RoamIng
RoamIng
MS
MS
Giuseppe Bianchi

trombonIng
trombonIng
"
"
PLHN 1
(|TA}
V3C
0V3C 1
hLR
PLHN 2
(UK}
V3C
ISC
(UK)
MSISDN
+39.335.1234567
MSRN
+44.NDC.9876543
Call to MSISDN
+39.335.1234567
ISC
(ITA)
Is the PRICE (!)
to pay for
simple routing
and billing
Call to MSISDN
+39.335.3043125
Giuseppe Bianchi
TrombonIng
TrombonIng
tecbnIcaI
tecbnIcaI
soIutIons
soIutIons
First alternative: national-wise
Add a reW dalaoase - Roarer Local|or Cacre (RLC)
Consulted by ISCs (which MUST support GSM-MAP!)
Second alternative: PLMN specific
RLC W|lr|r lre PLVN assoc|aled sW|lcr
Ca||er rusl d|a| spec|a| N0C ruroer (lre sW|lcrl)
I.e. must know the MS is roaming in the PLMN
Add|l|ora| dev|ces ard proloco| rod|l|cal|ors requ|red
Extensions toVLR or to GMSC
Details in Lin-Chlamtac
Giuseppe Bianchi
RLC at ISC
RLC at ISC
-
-
LocatIon
LocatIon
RegIstratIon
RegIstratIon
and
and
caII
caII
management
management
hLR
PLHN 2
(UK}
V3C VLR
ISC
(UK)
ISC
(ITA)
PLHN 1
(|TA}
RL6
1
2
3
3 bis
4
Giuseppe Bianchi
Sbort
Sbort
Message
Message
ServIce
ServIce
SMS:
ressages up lo 10 oyles
Vessage corcaleral|or a||oWed
Transmitted on air interface over:
3ACCl (Wrer user |r corversal|or)
30CCl (Wrer user |r |d|e slale)
Two transmission modes in a cell:
Po|rl-lo-po|rl
ce|| oroadcasl
Connectionless service
ressage sW|lcr|rg (slore&lorWard)
lrp|ererled lrrougr lre 3rorl Vessage 3erv|ce Cerler
Giuseppe Bianchi
SMS
SMS
routIng
routIng
management
management
MSC
IWMSC
Short Message
Service Center
PLMN
Internet, PSDN
SMS-GMSC
MSC
PLMN
hLR
Get routing info
for terminating MS
Giuseppe Bianchi
ProtocoI
ProtocoI
bIerarcby
bIerarcby
8hort Hessage
Re|ay Ent|ty
(8HR}
8hort Hessage
6ontro| Ent|ty
(8H6}
3rorl Vessage
App||cal|or Layer
(3V-AL)
3rorl Vessage
Trarsler Layer
(3V-TL)
3rorl Vessage
Re|ay Layer
(3V-RL)
Correcl|or
Varagererl
3uo|ayer (CV-suo)
MS
MSC
IW-MSC
SM-SC
8hort Hessage
Re|ay Ent|ty
(8HR}
8hort Hessage
6ontro| Ent|ty
(8H6}
3rorl Vessage
Re|ay Proloco|
(3V-RP)
3rorl Vessage
Corlro| Proloco|
(3V-CP)
3rorl Vessage Trarsler Proloco| (3V-TP)
Quite complex signalling involved (see specific texts)
Giuseppe Bianchi
Number
Number
portabIIIty
portabIIIty
Subscriber may switch operator without
changing his number
First implemented in fixed network
Recerl|y (ray 2002) exlerded lo roo||e relWor|s
Essential for fair competition among
network operators
uK survey: 12 ol corporale suoscr|oers Were W||||rg lo
crarge roo||e operalor; oul 9 Were, |l ruroer cou|d oe
porled
Resistence from leading operators
Nuroer porlao|||ly re|ps reWer operalors lo corpele W|lr
lrad|l|ora| ores
Giuseppe Bianchi
NotatIon
NotatIon
Donor switch
Tre sW|lcr correspord|rg lo a 'porled le|eprore
ruroer
Recipient switch
Tre sW|lcr lo Wr|cr lre porled ruroer |s allacred
Giuseppe Bianchi
TecbnIcaI
TecbnIcaI
soIutIons
soIutIons
a)
a)
caII
caII
IorwardIng
IorwardIng
switch switch
switch
Originating network Donor network
Recipient network
Originating switch sets-up trunk to donor switch
Donor switch sets-up trunk to recipient switch
Simplest solution, as call forwarding is a feature available in virtually all switches
8uf exfremeIy inefficienf roufing ond frunking resource consumpfionl
Giuseppe Bianchi
TecbnIcaI
TecbnIcaI
soIutIons
soIutIons
b)
b)
query
query
on
on
reIease
reIease
switch switch
switch
Originating network Donor network
Recipient network
Donor switch blocks incoming call with a release message (REL)
REL carries a QoR cause value, stating that called party number is ported
Originating switch then queries Number Portability database
SS7 ISUP IAM
SS7 ISUP REL
Number
Portability
DataBase
Giuseppe Bianchi
TecbnIcaI
TecbnIcaI
soIutIons
soIutIons
c)
c)
aII
aII
-
-
caII
caII
query
query
switch switch
switch
Originating network Donor network
Recipient network
Originating switch queries Number Portability database for every call!!
- best solution if majority of numbers are ported (no interaction with donor)
- but very high DB load, as EVERY number must be looked-up!
Number
Portability
DataBase
Giuseppe Bianchi
MobIIe
MobIIe
Number
Number
PortabIIIty
PortabIIIty
Same ideas as fixed number portability
Tre doror sW|lcr |s lre 0V3C ol lre doror relWor|
Donor GMSC Call forwarding (if more efficient
fixed number portability not supported)
wr||e porl|rg ruroer, ray a|so gel V3RNl
GMSC
Incoming call
Donor network
HLR
Signaling relay
function
GMSC
Recipient network
HLR MSC
Note: If path must cross GMSC:
Use Intermediate Routing Number
MSRN
(or IRN)
MSRN IRN
CIeurIy stiII suffers of tromboning|
Giuseppe Bianchi
Return IRN
MobIIe
MobIIe
Number
Number
PortabIIIty
PortabIIIty
( (wItb wItb aII aII caII caII query query approacb approacb) )
switch
Incoming call
GMSC
Recipient network
HLR
MSC
IRN
Number
Portability
DataBase
Query IRN
Return MSRN
Query MSRN
Giuseppe Bianchi
MobIIe
MobIIe
Number
Number
PortabIIIty
PortabIIIty
Improved Improved - - (wItb aII caII query approacb) (wItb aII caII query approacb)
Return MSRN
switch
Incoming call
GMSC
Recipient network
HLR
MSC
MSRN
Number
Portability
DataBase
Query MSRN
Signaling relay
function