Lesson Refreshments

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

GSM 2G Architecture
NSS
BSS
E

Abis

PSTN

Um

PSTN

B
BSC

MS

MSC

BTS

VLR

GMSC

SS7

F
H
EIR
HLR

AuC

NSS

RSS
BSS Base Station System

NSS Network Sub-System

BTS Base Transceiver Station

MSC Mobile-service Switching Controller

BSC Base Station Controller

VLR Visitor Location Register

MS Mobile Station

HLR Home Location Register

AuC Authentication Server
GMSC Gateway MSC

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

GSM Global System for Mobile communication

OSS
2

GSM 2,5G Architecture

NSS
BSS
E

Abis

PSTN

Um

PSTN

B
BSC

MS

MSC

BTS

Gs F

VLR

GMSC

SS7
H

Gb

EIR

2G+ MS (voice & data)

Gr

HLR

AuC

Gc

Gn

SGSN

Gi

IP

PSDN

GGSN

BSS Base Station System

NSS Network Sub-System

SGSN Serving GPRS Support Node

BTS Base Transceiver Station

MSC Mobile-service Switching Controller

GGSN Gateway GPRS Support Node

BSC Base Station Controller

VLR Visitor Location Register

MS Mobile Station

HLR Home Location Register

GSM Global System for Mobile communication

AuC Authentication Server

GMSC Gateway MSC
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

3G rel4 Architecture (UMTS) Soft

Switching
2G MS (voice only)

CN

CS-MGW

Abis

Nc
Mc

BSC
Gb

BTS

CS-MGW

Nb

BSS

PSTN

B
C

MSC Server
Gs

PSTN
Mc
GMSC server

VLR

SS7
H

2G+ MS (voice & data)

IuCS
RNS

Gr

HLR

ATM
Iub

IuPS
RNC

AuC

IP/ATM
Gc

Gn
SGSN

Gi

PSDN

GGSN

Node B
3G UE (voice & data)
BSS Base Station System

CN Core Network

SGSN Serving GPRS Support Node

BTS Base Transceiver Station

MSC Mobile-service Switching Controller

GGSN Gateway GPRS Support Node

BSC Base Station Controller

VLR Visitor Location Register

HLR Home Location Register

RNS Radio Network System

AuC Authentication Server

RNC Radio Network Controller

GMSC Gateway MSC

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

RSS Components

RSS components :
Mobile Station (MS)
Base Station Subsystem

To/From NSS
BSS

(BSS)
MS
To/From OMS

Radio Subsystem

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

NSS Components

VLR

Network Switching Subsystem

(NSS) components :

MSC

Mobile Switching Centre (MSC)

Home Location Register (HLR)
HLR

EIR

AUC

Visitor Location Register (VLR)

Authentication Centre (AUC)

Network Switching Subsystem

Equipment Identification Register

(EIR)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

OSS Components

OSS provides monitoring &

maintenance functions

OSS Components :
1. Operation Maintenace
Server for BSS (OMCR)
and NSS (OMCS)

OMCS

OMCR

2. Operation Maintenance Terminal (OMT)

Operation and Maintenance Subsystem

Sometime there is also OMC-T (OMC for Transmission)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Numbering in GSM










IP NGN_Mobility

Location Area Identity (LAI)

Cell Global Identification (CGI)
International Mobile Equipment Identity (IMEI)
Personal Identification Number (PIN)
International Mobile Subscriber Identity (IMSI) E.212
Mobile GT (E.214)
Mobile Station ISDN Number (MSISDN) E.164
Mobile Subscriber Roaming Number (MSRN)
Temporary Mobile Subscriber Identity (TMSI)

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Mobility Management

IP NGN_Mobility

Paging

Roaming

Location Registration

IMSI Attach / Detach

Handover

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Security & Authentication in GSM

GSM Recommendations

Security Aspects

02.09, "Security Aspects"

02.17, "Subscriber Identity Modules"
03.20, "Security Related Network
Functions
03.21, "Security Related Algorithms"

subscriber identity authentication

subscriber identity confidentiality
signaling data confidentiality
user data confidentiality

GSM Security
and
Authentication

IP NGN_Mobility

3 system elements

Parameters Involved

Subscriber Identity Module (SIM)

GSM handset or MS
GSM network

IMSI
- PIN, PUK
Ki
- White, Gray, Black ME
Kc
TMSI
Algorithm A3, A5, A8
Triplets (RAND, SRES, Kc)

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

10

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

11

Introduction to GSM
and SS7

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

12

Some Basic Rules

Please obey these rules to get the best
result ;-)
No Sleeping

Switch off/silent phone

No Laptop

Lets start and enjoy this class

Concentrate
IP NGN_Mobility

Ask when unclear

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

Quiet please

Take notes

Smile ;-)
13

Agenda
GSM History, Network, Numbering, Mobility & Security
Simple Call & Signaling Scenarios
SS7 Architecture & MTP
ISUP & SCCP
TCAP & MAP
Sigtran & ITP MTP3 + SCCP database
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

14

Simple Call Flow

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

15

Several Simple Call Flows

 Location Update
 IMSI attach / detach
 Authentication and Chipering
 Mobile Originating Call
 Mobile Terminating

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

16

Previous

HLR

MSC/VLR

4
5

New

MSC/VLR
7

BSS

BSS
7

Roaming (Changing from

one cell to another)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

17

VLR

VLR
1

Detach Ack

Attach Ack
1

MSC

MSC
1

BSS

BSS
1

Attach

Detach

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

18

2:Send
IMEI

EIR
2 2

Access
Granted

MSC
2 2

BSS
2:IMEI

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

2 2

Cisco Public

1:Access Request

19

3:RAND

VLR
4:Kc
4 3 3

HLR

2
1

3:SRES

Triplets:
1

Access
Granted

1:Access request

RAND
SRES
Kc

BSS
4 3 3

IP NGN_Mobility

AuC

Triplets request

MSC
4 3 3

2
2

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

20

IMSI

Udara

Sim card

AUC

IMSI
Ki

Authentication Request

Ki

RAND

RAND
MSC/VLR

SRES
A3 Authentication Response

=?

SRES

Cipher Mode Command

A8

Kc

Kc
Ciphered Data

Voice - Data - Signal

A5

A5

IP NGN_Mobility

Kc

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

BTS/BSC
Voice - Data - Signal

21

MOC To PSTN
Calling party (MS)
Adam, +254725288888

+2542721111

BTS/BSC
Called Party (PSTN)

3
VLR

MSC

Eva, +2542721111

4
+2542721111

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

22

MTC from PSTN

Called party
(MS)

Pak Rudy, 0816444444

7

BTS/BSC

8 9

BTS/BSC

7
MSRN : 08160170025

8 9

BTS/BSC
7 Paging dalam 1 LAC
510-01-4400000001

MSC/VLR
4

IMSI : 510-01-4400000001

HLR

6
0816444444

GMSC

MSRN : 08160170025
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

MSRN : 08160170025

Calling party
(PSTN)

MSISDN : 0816444444
1

Cisco Public

23

MS - MS within 1 MSC

Sisca, +25472529999

Adam, +254725288888

1 +25472529999
BTS/BSC

BTS/BSC
1

8
MSC/VLR
2 : MSISDN

BTS/BSC
8
6 Paging

3 : IMSI

5 : MSRN

4 : MSRN
HLR

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

24

MS - MS in different MSCs
Sisca, +25472529999

Adam, +254725288888

BTS/BSC

BTS/BSC

BTS/BSC

BTS/BSC
9

9
MSC/VLR 1

MSC 2
6

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

HLR

25

Call Wait Scenario

PSTN

GMSC

Eva, +2542721111

IAM, waiting call

MSC/VLR

MSC/VLR

Response (accept/reject) /
No response (ignore)
BTS/BSC

Notifikasi

Adam, +254725288888
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

BTS/BSC

Sisca, +25472529999
26

Call Hold Scenario

PSTN

GMSC
IAM, waiting call

Eva, +2542721111

MSC/VLR

MSC/VLR

Response accept & on hold

Notifikasi

BTS/BSC

Adam, +254725288888
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

BTS/BSC

Sisca, +25472529999
27

CF during HLR Interrogation

2&6
3

HLR

4&9

1
5

GMSC

10

Eva, +2542721111

7 8
11
MSC/VLR

13
14

BTS/
BSC

12
13
14
Adam, +254725288888

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

28

CF after VLR Subscription Check

2&6
3

HLR

5&11&13

6&9

1
5

GMSC

Eva, +2542721111

4&12&14
8&15
10 MSC/VLR

17
18

BTS/
BSC

9&16
17
18
Adam, +254725288888

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

29

GSM Services

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

30

Call Forward
Call Forward is divided into 2 conditions:
 Unconditional
 Conditional (CF if busy, CF if no reply, CF if not reachable)
CF can be set to prohibited to certain number(s), meaning subscribers can
not forward their calls to these certain number(s). These number(s) can be
set to be:
 Prohibited to all subscribers
 Prohibited to a category of subscribers
CF is detected by these conditions:
 During HLR interrogation
 During VLR subscription check

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

31

Standard Codes for Call Forwarding

Forward Service
All Calls
If Busy
If Not Answered
If Out of Reach

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Activate
*21*[phone number]#
*67*[phone number]#
*61*[phone number]#
*62*[phone number]#

Cisco Public

Cancel Status
##21#
#21#
##67#
#67#
##61#
#61#
##62#
#62#

32

Call Barring
 Call barring is a functionality which allows you to stop calls being made to
or from your mobile phone. You can use call barring to prevent someone
else from using your phone, or if you want to keep control of your
spending.
 With call barring you can bar (prohibit) calls from being made or received
from undesired callers and therefore control your privacy. You can also
activate or deactivate this barring feature at your convenience to control
your spending. For example, no international calls allowed except to the
home country or no incoming calls allowed while roaming.
 There are 5 (five) types of barring:

outgoing calls

outgoing international calls

outgoing international calls expect to home country
incoming calls
incoming calls when abroad
IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

33

CLIP & CLIR

 CLIP (Calling Line Identification Presentation) is a
feature to allow calling number to be displayed in
mobile phone of called number. It is a functionality
allowing you to identify the people that are calling you
 CLIR (Calling Line Identification Restriction) is a feature
to hide calling number to be displayed in mobile phone
of called number
 CLIP Overwrite is a feature to override CLIR so that
even though calling number uses CLIR, but the number
is still displayed in mobile phone of called number
(which has CLIP Overwrite)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

34

Activate and Deactivate CLIR

 To activate CLIR **31#
 To activate CLIR for single call *31#number
 To deactivate CLIR ##31#
 To deactivate CLIR for single call #31#number
 To check status of CLIR *#31#

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

35

Quick Facts about SMS

 Short Message Service (SMS) is a technology that enables the sending and
receiving of messages between mobile phones.
 SMS first appeared in Europe in 1992
 3GPP (Third Generation Partnership Project) is now responsible for the
development and maintenance of the GSM and SMS standards
 One SMS can contain at most 140 bytes (1120 bits), so it can contain up to
160 character if 7-bit character encoding is used (suitable for encoding Latin
characters like English Alphabets) or 70 characters if 16-bit Unicode UCS2
character encoding is used. (SMS text messages containing non-Latin
characters like Chinese characters should use 16-bit character encoding.)
 SMS can also carry binary data such as ringtones, pictures, operator logos,
wallpapers, animations, business cards (e.g. VCards) and WAP
configurations

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

36

Air Interface

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

37

TDMA GSM Structure 1/2

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

38

TDMA GSM Structure 2/2

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

39

Various Channel in Air Interface

Channel

TCH (Traffic
Channel)

TCH/F (Full
Rate)

IP NGN_Mobility

CCH (Control
Channel)

TCH/H (Half
Rate)

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

CCCH
(Common
CCH)

BCCH
(Broadcast
CCH)

DCCH
(Dedicated
CCH)

RACH
(Random
Access Ch)

SDCCH
(Stand Alone
DCCH)

AGCH
(Access Grant
Ch)

FACCH (Fast
Associated
CCH)

PCH (Paging
Ch)

SACCH (Slow
Associated
CCH)

40

Channels Functions
No

Channel Functions

BCCH

to provide information about LAI, network, available frequency

RACH

to ask DCCH allocation

AGCH

to provide DCCH allocation

PCH

to find subscribers/paging

SDCCH

to exchange signaling information before TCH takes place

SACCH

to provide power measurement and BTS quality results

"BCCH" when subscribers are active

TCH/F

Traffic with max. rate 13 Kbps for speech call

Data call max. 9600 Bps

TCH/H

Speech coded 6,5 Kbps

Data call max. 4800 bps

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

41

Successful Call
Signaling phase

Conversation Phase
SUCCESSFUL CALL

SDCCH

SDCCH

TCH

Call

Congestion

Drop

Failure

Drop

End of

Normal

Call

Call Clearing

CONNECTION FAILURE

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

42

Simple Signaling Flow

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

43

Signaling GSM Principles

 Signaling No. 7 (N7, CCS7) is used
 Signaling channel is different than voice/data channel, one
benefit is that subscriber can receive SMS when he/she has
active call (busy)
 Signaling is used for control functions: establish call,send
information, tear down call, etc
 Signaling between GSM elements are unique to each other,
depends on defined interface

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

44

Interface between GSM Elements

Other
Network

BSC

F-

E-

A-

MSC

MSC
A-bis

EIR

B-

CD-

BTS

HLR
Um

MS

IP NGN_Mobility

VLR

HAuC

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

45

Location Update
MS

MSC/VLR

BTS/BSC

Old MSC/VLR

HLR/AuC

Channel Request
Immediate Assignment
Location Update Request (old LAI, TMSI, new LAC-CI)
Send Identification (TMSI)
Send Identification result (IMSI)
Send Authentication (IMSI)
Authentication Request (RAND)

Send Authentication Result (Triplets)

Authentication Response (SRES)

Cipher Mode Command (Kc, allowed A5 version)
Cipher Mode Complete (Algorithm A5 version)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

46

Location Update con`t

MS

MSC/VLR

BTS/BSC

Old MSC/VLR

HLR

Update Location (IMSI, new VLR no)

Cancel Location (IMSI, old VLR no)
Cancel Location Ack
Insert Subscriber Data
Subscriber Data insertion Ack
Update Location Ack
Location Update Accept (new LAI, new TMSI)
TMSI Reallocation Complete
Channel Release
Channel Release Ack

IP NGN_Mobility

Clear Command
Clear Complete

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

47

Mobile Originating Call

MS

MSC/VLR

BTS/BSC
Channel Request

PSTN

Immediate Assignment
CM Service Request (LAC, CI, TMSI)
Authentication Request (RAND)
Authentication Response (SRES)
Cipher Mode Command (Kc, allowed A5 version)
Cipher Mode Complete (Algorithm A5 version)
Setup (service, called number)
Call proceeding
Assign Request
Assign Command

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

48

Mobile Originating Call con`t

MSC/VLR

BTS/BSC

MS

Assign Complete

PSTN

IAM (Calling No MSISDN, Called No)

ACM

Ringing

ANM

Answer

Alerting
Connect
Connect Ack
Conversation takes place
Disconnect
Release
Release Complete
Channel Release
Channel Release Ack

IP NGN_Mobility

REL
RLC

Clear Command
Clear Complete

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

49

Mobile Terminating Call

MS

BTS/BSC

MSC/VLR
Paris = Nairobi

HLR

GMSC

PSTN

IAM (Calling No, Called No MSISDN)

Send Routing Info (MSISDN)

Provide Roaming Number (IMSI)
Roaming Number (MSRN)
Routing Info (MSRN)
IAM (Calling No, Called No MSRN)
Paging (TMSI)
Channel Request
Immediate Assignment
Paging Response (LAC, CI, TMSI)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

50

Mobile Terminating Call con`t 1

MS

BTS/BSC

MSC/VLR
Paris = Nairobi

HLR

PSTN

GMSC

Authentication Request (RAND)

Authentication Response (SRES)
Cipher Mode Command (Kc, allowed A5 version)
Cipher Mode Complete (Algorithm A5 version)
Setup (service)
Call Confirm
Assign Request
Assign Command
Assign Complete
Ringing

IP NGN_Mobility

Alerting

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

ACM

ACM

51

Mobile Terminating Call con`t 2

MS

BTS/BSC

MSC/VLR
Paris = Nairobi

PSTN

GMSC

HLR

Connect
Connect Ack
Conversation takes place
Disconnect

REL

REL
RLC

Release

RLC

Release Complete
Channel Release Clear Command
Channel Release Ack

IP NGN_Mobility

Clear Complete

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

52

Handover Inter MSC

(Target cell ID)

(HO Number)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

(HO Number)

53

SMS
MSC

MS

SMSC

HLR

After authentication

Destination
MSC

Destination
MS

Forward SM (B# MSISDN , message)

SM Accepted
SMSC stores SMS and creates schedule for delivery (FIFO). Or, it will do FDA
Send Routing Info for SM
Routing info for SM (IMSI, MSC Address)
Forward SM (IMSI, message)
After paging and authentication
Delivery Report

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

54

SMS for Absent Subscriber

MSC

MS

SMSC

HLR

After Authentication

Destination
MSC

Destination
MS

Forward SM (B# MSISDN, message)

SM Accepted
SMSC stores SMS and create schedule for re sending it
Send Routing Info for SM
Routing info for SM (IMSI, MSC Address)
Forward SM (IMSI, pesan)
MS Detach (switch off)
HLR & MSC take notice that there is message waiting
Delivery Report (fail, absent subscriber)

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

55

SMS for Absent Subscriber

MSC

MS

SMSC

HLR

Destination
MSC

Destination
MS

When MS is switch on
Location Update
Location Update
Alert Service Center

After receiving Alert SC then SMSC will resend SMS as normal SMS delivery

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

56

Questions?!?

IP NGN_Mobility

2006 Cisco Systems, Inc. All rights reserved.

Cisco Public

57