What is an IMSI?

The IMSI (International Mobile Subscriber Identity) is a unique 15-digit code used to identify an individual
user on a GSM network.

The IMSI consists of three components:

• Mobile Country Code (MCC)

• Mobile Network Code (MNC)
• Mobile Subscriber Identity Number (MSIN)

The IMSI is stored in the Subscriber Identity Module (SIM).

What is an IMEI?

The IMEI (International Mobile Equipment Identity) is a unique 15 or 17 digit code used to identify an
individual mobile station to a GSM or UMTS network. The IMEI number facilitates an important function; it
easily identifies a mobile phone being used on a GSM (Global System for Mobile Communications) network.
The IMEI is a useful tool to stop a phone that is stolen from accessing a network and being used. Mobile
phone owners that have their phones stolen can contact their mobile network provider and ask them to ban
or shut off a phone using its IMEI number. With an IMEI number, the phone can be banned from the network
quickly and easily. It is important to note that swapping a SIM card will not stop a phone from being banned.

An IMEI device is only used to identify the device and does not usually relate to a specific individual or
organization. Other numbers such as ESN (Electronic Serial Numbers) and MEID (Mobile Equipment
Identifiers) can link an individual to a phone. Usually, an IMSI number stored on a SIM card can identify the
subscriber on a network.

There are a few ways in which you can locate your mobile phone's IMEI number, it can usually be found on
the handset, beneath the battery, sometimes printed on a small white label. Another way to easily locate
your IMEI phone is to dial the following sequence of numbers into the handset: *#06#. If you have a Sony
Ericsson mobile phone, you can retrieve the IMEI by pressing the following key sequence: right,*, left, left,*,
left, *, left.

The Structure of an IMEI Number

IMEI numbers either come in a 15 digit or 17 digit sequences of numbers. These numbers can identify a
handset. Currently the format of the IMEI is AA-BBBBBB-CCCCCC-D.

• These two digits are for the Reporting Body Identifier, indicating the GSMA approved group that
allocated the TAC (Type Allocation Code).
• BBBBBB- The Remainder of the TAC
• CCCCCC- Serial Sequence of the Model
• D- Luhn Check Digit of the entire model or 0 (This is an algorithm that validates the ID number)

What are the components of a GSM network?

Subscriber Equipment

Mobile Station (MS) - The mobile telephone.

The Switching System (SS)

Home Location Register (HLR) - A database which stores data about GSM subscribers, including the
Individual Subscriber Authentication Key (Ki) for each Subscriber Identity Module (SIM).

Mobile Services Switching Center (MSC) - The network element which performs the telephony switching
functions of the GSM network. The MSC is responsible for toll ticketing, network interfacing, common
channel signaling.

Visitor Location Register (VLR) - A database which stores temporary information about roaming GSM
subscribers.

Authentication Center (AUC) - A database which contains the International Mobile Subscriber Identity (IMSI)
the Subscriber Authentication key (Ki), and the defined algorithms for encryption.

Equipment Identity Register (EIR) - A database which contains information about the identity of mobile
equipment in order to prevent calls from stolen, unauthorized, or defective mobile stations.

The Base Station System (BSS)

Base Station Controller (BSC) - The network element which provides all the control functions and physical
links between the MSC and BTS. The BSC provides functions such as handover, cell configuration data, and
control of radio frequency (RF) power levels in Base Transceiver Stations.

Base Transceiver Station (BTS) - The network element which handles the radio interface to the mobile
station. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the
network.

The Operation and Support System (OSS)

Message Center (MXE) - A network element which provides Short Message Service (SMS), voice mail, fax
mail, email, and paging.

Mobile Service Node (MSN) - A network element which provides mobile intelligent network (IN) services.

Gateway Mobile Services Switching Center (GMSC) - A network element used to interconnect two GSM
networks.

GSM Interworking Unit (GIWU) - The network element which interfaces to various data networks.
What are locking and unlocking?

Most GSM Mobile Stations (MS) are sold to be used on a specific GSM network. The Mobile Stations are
"locked" to only accept a Subscriber Identity Module (SIM) from the GSM carrier that sold the Mobile Station.

There are several situations where you would want to unlock your Mobile Station. For example, you might
wish to switch GSM service providers and keep your current Mobile Station. Or, you may have purchased a
new Mobile Station and you want to sell your old Mobile Station to someone who is subscribed to a different
GSM service provider. A third situation is if you are travelling extensively in another GSM service providers
area and you would like to get local GSM service instead of paying roaming charges.

There are two methods of unlocking Mobile Stations. The first method, which requires no equipment, is to
enter the unlock code for your Mobile Station from the keypad. Your GSM service provide will be able to give
you this unlock code, but may not be willing to do so. The second method is to use dedicated unlocking
hardware which plugs into your Mobile Station and unlocks it. You may purchase this hardware, or send your
Mobile Station to an unlocking service which will unlock it for a small fee.

What is a Subscriber Identity Module (SIM)?

The Subscriber Identity Module (SIM) is a small smart card which contains both programming and
information.

The A3 and A8 algorithms are implemented in the Subscriber Identity Module (SIM).

Subscriber information, such as the IMSI (International Mobile Subscriber Identity), is stored in the
Subscriber Identity Module (SIM).

The Subscriber Identity Module (SIM) can be used to store user-defined information such as phonebook
entries.

One of the advantages of the GSM architecture is that the SIM may be moved from one Mobile Station to
another. This makes upgrades very simple for the GSM telephone user.

How can I find my IMEI?

The IMEI (International Mobile Equipment Identity) number can be displayed on most phones by dialing the code *# 06 #.

The IMEI is also usually printed on the compliance plate under the battery.

Introduction to GSM

What is GSM?

Global System for Mobile Communication (GSM) is a set of ETSI standards specifying
the infrastructure for a digital cellular service. The standard is used in approx. 85
countries in the world including such locations as Europe, Japan and Australia . 1

Home Location Register (HLR)

A Home Location Register (HLR) is a database that contains semi-permanent mobile

subscriber information for a wireless carriers' entire subscriber base. HLR subscriber
information includes the International Mobile Subscriber Identity (IMSI), service
subscription information, location information (the identity of the currently serving
Visitor Location Register (VLR) to enable the routing of mobile-terminated calls), service
restrictions and supplementary services information.

The HLR handles SS7 transactions with both Mobile Switching Centers (MSCs) and
VLR nodes, which either request information from the HLR or update the information
contained within the HLR. The HLR also initiates transactions with VLRs to complete
incoming calls and to update subscriber data.

Traditional wireless network design is based on the utilization of a single Home Location
Register (HLR) for each wireless network, but growth considerations are prompting
carriers to consider multiple HLR topologies.

Visitor Location Register (VLR)

A Visitor Location Register (VLR) is a database which contains temporary information

concerning the mobile subscribers that are currently located in a given MSC serving area,
but whose Home Location Register (HLR) is elsewhere.

When a mobile subscriber roams away from his home location and into a remote
location, SS7 messages are used to obtain information about the subscriber from the
HLR, and to create a temporary record for the subscriber in the VLR. There is usually
one VLR per MSC.

International Mobile Subscriber Identity (IMSI) Number

The IMSI is a unique non-dialable number allocated to each mobile subscriber in the
GSM system that identifies the subscriber and his or her subscription within the GSM
network. The IMSI resides in the Subscriber Identity Module (SIM), which is
transportable across Mobile Station Equipment (MSE). The IMSI is made up of three
parts (1) the mobile country code (MCC) consisting of three digits, (2) the Mobile
Network Code (MNC) consisting of two digits, and (3) the Mobile Subscriber Identity
Number (MSIN) with up to 10 digits.

Mobile Subscriber ISDN (MSISDN) Number

The MSISDN is the dialable number that callers use to reach a mobile subscriber. Some
phones can support multiple MSISDNs - for example, a U.S.-based MSISDN and a
Canadian-based MSISDN. Callers dialing either number will reach the subscriber.

Mobile Station Equipment (MSE) Subscription Services

GSM carriers typically order Mobile Station Equipment (MSE) (or GSM phones) from
their suppliers (Nokia, Motorola, Sony, etc.) in large quantities (e.g. 1000 Units). After
receiving an order, the equipment supplier will program the ordered MSE SIMs with a
range of IMSI numbers.

Example: ABC Communications Inc. orders 1000 MSE Units with the following range
of IMSIs.

MCC MNC MSIN

Unit #1 310 68 4451000
Unit #1000 310 68 4451999

Once the range of IMSI numbers has been determined, the HLR can be populated with
the new IMSI records that will be configured and activated at a future date by authorized
sales or service subscription representatives. The fact that the HLR can be populated with
ranges or blocks of IMSI numbers creates efficiencies in the storage and retrieval of
routing information.

The wireless carrier distributes the Mobile Station Equipment to Sales Outlets that sell
GSM subscription services. When a new subscriber orders a GSM phone at one of the
outlets, the service representative will create a Service Order (SO) to enter the new
subscriber's service subscription information, including the MSISDN number. The key to
the Service Order is the IMSI that is programmed in the SIM. The SO is sent to the HLR,
where the IMSI record is created. It can either be set to an active state immediately,
allowing the new subscriber to send and receive telephone calls or it can be activated at a
future date.
Note that the MSISDN numbers are assigned one at a time as each new customer
subscribes. The MSISDN numbers are therefore provisioned individually, rather than in
blocks, which complicates the MSISDN based routing of messages. The ramifications of
MSISDN provisioning are discussed further in the example found at the end of this
document.

GSM Call Routing

Mobile Subscriber Roaming

When a mobile subscriber roams into a new location area (new VLR), the VLR
automatically determines that it must update the HLR with the new location information,
which it does using an SS7 Location Update Request Message. The Location Update
Message is routed to the HLR through the SS7 network, based on the global title
translation of the IMSI that is stored within the SCCP Called Party Address portion of the
message. The HLR responds with a message that informs the VLR whether the subscriber
should be provided service in the new location.

Mobile Subscriber ISDN Number (MSISDN) Call Routing

When a user dials a GSM mobile subscriber's MSISDN, the PSTN routes the call to the
Home MSC based on the dialed telephone number. The MSC must then query the HLR
based on the MSISDN, to attain routing information required to route the call to the
subscribers' current location.

The MSC stores global title translation tables that are used to determine the HLR
associated with the MSISDN. When only one HLR exists, the translation tables are
trivial. When more than one HLR is used however, the translations become extremely
challenging; with one translation record per subscriber (see the example below). Having
determined the appropriate HLR address, the MSC sends a Routing Information Request
to it.

When the HLR receives the Routing Information Request, it maps the MSISDN to the
IMSI, and ascertains the subscribers' profile including the current VLR at which the
subscriber is registered. The HLR then queries the VLR for a Mobile Station Roaming
Number (MSRN). The MSRN is essentially an ISDN telephone number at which the
mobile subscriber can currently be reached. The MSRN is a temporary number that is
valid only for the duration of a single call.

The HLR generates a response message, which includes the MSRN, and sends it back
across the SS7 network to the MSC. Finally, the MSC attempts to complete the call using
the MSRN provided.
Adding a Second HLR to the GSM Network

As a GSM wireless carrier's subscriber base grows, it will eventually become necessary
to add a second HLR to their network. This requirement might be prompted by a service
subscription record storage capacity issue, or perhaps an SS7 message processing
performance issue. It might possibly be prompted by a need to increase the overall
network reliability.

The new HLR can be populated with service subscription records as new subscribers are
brought into service or existing service subscription records can be ported from the old
HLR to the new HLR to more evenly distribute the SS7 traffic load.

Typically, when new subscribers are brought into service, the second HLR will be
populated with blocks of IMSI numbers that are allocated when new MSE equipment is
ordered. As the following example shows, this grouping of IMSI numbers within a single
HLR simplifies the routing translations that are required within the SS7 network for VLR
to HLR Location Update Request transactions. Global Title Translation (GTT) tables will
contain single translation records that translate an entire range of IMSIs numbers into an
HLR address. Even if some individual records are moved between the HLRs, as shown in
the example, the treatment of IMSIs as blocks results in a significant simplification of the
Global Translation tables.

Much more complicated SS7 message routing Global Title Translations are required for
Routing Information Request transactions between the MSCs distributed over the entire
wireless carrier serving area and the two or more HLRs. MSC Routing Information
Requests are routed to the appropriate HLR based on the dialed MSISDN and not the
IMSI. Unlike the IMSI numbers, the MSISDN numbers can not easily be arranged in
groups to reside within a single HLR and therefore, the MSC must contain an MSISDN
to HLR address association record for every mobile subscriber homed on each of the
MSCs. As the example illustrates, the MSC routing tables quickly grow much more
extensive than the STP tables. The network administration becomes increasingly complex
and prone to error.

Example: Simple Network with two MSCs and two HLRs

The following example illustrates the issues relating to GSM network routing table
administration with multiple HLRs. A simple GSM network is shown, with the various
routing tables following:
HLR Datafill

HLR #1 is populated with IMSI Range 310-68-4451000 to 310-68-4451005 and is

populated with service subscribers from two different MSCs.

HLR #1

IMSI MSISDN Other Subscriber Data

310-68-4451000 813-567-1234 ~~~~~~~~~~~~

310-68-4451001 813-567-4355 ~~~~~~~~~~~~

310-68-4451002 813-567-8479 ~~~~~~~~~~~~

310-68-4451003 415-457-0238 ~~~~~~~~~~~~

310-68-4451004 415-457-2332 ~~~~~~~~~~~~

310-68-4451005 415-387-6325 ~~~~~~~~~~~~

310-68-5568099 415-387-8884 ~~~~~~~~~~~~

New HLR#2 is populated with IMSI Range 310-68-5568095 to 310-68-5568100 and is

populated with new service subscribers from the same two MSCs. One subscriber has
been moved from HLR #2 to HLR #1 (IMSI = 310-68-5568099).

HLR #2
 IMSI MSISDN Other Subscriber Data

310-68-5568095 415-457-1235 ~~~~~~~~~~~~

310-68-5568096 415-387-4444 ~~~~~~~~~~~~
310-68-5568097 415-457-1236 ~~~~~~~~~~~~

310-68-5568098 415-457-4444 ~~~~~~~~~~~~

310-68-5568100 813-567-0055 ~~~~~~~~~~~~

STP Datafill

The STPs route SS7 messages to these HLRs based on the IMSI numbers which are
usually provisioned in blocks. In this case, the STPs (which have identical GTT tables)
are provisioned to route one block of IMSIs to the each HLR. Note that individual
records can be moved between HLRs with the addition of another record in the routing
table which specifies the individual IMSI. Individual records take precedence over IMSI
block entries.

STP #1, #2

IMSI HLR
310-68-4451XXX 1
310-68-5568XXX 2
310-68-5568099 1

MSC Datafill

When a GSM subscriber receives a phone call, the call attempt messages are routed to the
subscriber's MSC, based on the dialed numbers (the MSISDN). The MSC is provisioned
with routing tables which relate each MSISDN to an HLR. Note that the MSISDN
numbers cannot be assigned in convenient blocks like the IMSI numbers.

MSC #1

MSISDN HLR

813-567-1234 1
813-567-4355 1
813-567-8479 1
813-567-0055 2

MSC #2
 MSISDN HLR
415-457-1235 2
415-387-4444 2
415-457-1236 2
415-457-4444 2
415-387-8884 1
415-457-2332 1
415-457-0238 1
415-387-6325 1

Performance Technologies offers a GSM Signaling Platform that provides SS7 signal
processing and network interworking that supports enhanced GSM roaming applications.
Our GSM platforms have been used by some of the largest national and international
carriers throughout the world. Visit the GSM Signaling Platform overview page to learn more.