MSC Innovation Configuration

Trunks and
SS7 Links

SSNC:

LTG

PCM30/24

LTG
High Speed
SS7 Links

SN B

LTG:
SN:
MB:

NetM
SSNC

IOP:

207Mb/s
MB D

CP:

207Mb/s
AMPC

CP

AMP:

IOP:MB

NetM:

Signaling
System
Network
Control
Line Trunk
Group
Switching
Network
Message
Buffer Typ D
Input/Output
Processor
ATM Bridge
Processor
Coordination
Processor
Net Manager

MSC structure
Access

DLU

Switching

SN

LTG
LTG

Signaling
System
Network
Control

Coordination

SSNC

SYP
MB
CCG

CP

Some terms of the Circuit Switched Exchange Telephony

Switching
Exchange

Switching
Exchange

Transit Call and

Outgoing Traffic

Lines

Switching
Exchange

Trunks
Incoming
Traffic

Calling Party
(A Subscriber)
Originating
Call

Transit
Exchange

Switching
Exchange

Switching
Exchange

Busy

Originating
Exchange

Note: The network shown here is only an example.

Idle

Terminating
Exchange

Called Party
(B Subscriber)

Routing

Routing in general is the method, how to find a way through a network
for a given Routing Information.

Whithin a Switch, Routing is to find an outgoing trunk, according to the
evaluation results of the Routing Information

Some typical elements of the Routing Information whithin a Switch:

Called Party Number (= dialed number, the most classical element)
Originating Trunk (where the call comes from, see Origin. Depend.
Routing)
Category of the Calling Subscriber (Ordinary, Priority, Operator,..)
Calling Party Number
Transmission Medium Required (Any, Only Digital, Analog,..)
.

During the evaluation of the of the Routing Information, one, some or

all elements can be considered.

Authentication and Ciphering

Authentication and ciphering execution

In the personalization center (PCS), the SIM cards are produced on the one hand and the
database for the subscriber are generated in the authentication center on the other.
The following parameters are necessary on the SIM card along with the IMSI for
authentication and ciphering:
Ki General key
A3 Algorithm 3. Used for generating the authentication code
A8 Algorithm 8. Used for generating the ciphering key
The following parameters are necessary in the database commands along with theIMSI for
authentication and ciphering:
KiA4 General key, however enciphered with algorithm A4 and additional key K4
A3 version Version of the algorithm 3 stored in the AC and to be used.
A8 Version Version of the algorithm 8 stored in the AC and to be used.
The KiA4 is deciphered in the AC with the help of algorithm A4 and key K4 (Ki=A4(K4,KiA4))
and is stored, enciphered again (KiA2=A2(K2,Ki)), in the subscriber database as KiA2 with
A2 and K2.
As soon as the subscriber is set up in the HLR, the AC begins with the generation of the
security parameters. These consist of three values: the rand (a random value), the Sres or
signed response (electronic signature for authentication) and the kc (key for the ciphering on
the radio interface). These three values are designated "triples". A reserve of 6 "triples" are
provisioned.

Authentication and ciphering execution (part2)

Authentication
The Rand is relayed to the mobile station. This generates the Sres with
the help of the parameter Ki stored on the SIM card and A3 (Sres
=A3(ki ,rand)). The Sres is sent back to the MSC/VLR and there
compared with the Sres of the triple. If both Sres are the same, the
authentication is successful. If they are different, the SIM card is
rejected, and only emergency calls are possible depending on the
project.

Ciphering
For the ciphering, the Rand is also used in the MS. The key Kc is
generated (Kc=A8(Ki, Rand)) with the help of the parameter Ki stored
on the SIM card and A8. The ciphering is thereupon carried out with the
algorithm 5 stored in the mobile equipment and the key Kc. The key Kc
contained in the triple is meanwhile relayed to the BSS. The algorithm
A5 is also available here, so that the ciphering can be carried out here
as well.

Location Registration
Since subscribers can change their locations in the PLMN any number of times, it is
absolutely necessary to log the current site to a central position for the availability of
the subscriber. This central position is the HLR of the respective subscriber.
Therefore the routing label of the visited MSC/VLR is entered there.
Location update is carried out for the following situations:

When first checking into a network.

The subscriber checks into a network for the first time.

Upon change of location.

The subscriber changes to another MSC area.

Periodical location update (only in the VLR)

A time provider in the mobile station runs out and a location update is carried out
in the VLR.

After failure of the HLR

After a HLR failure, all affected VLRs are informed of the possible data loss. After
subsequent originating traffic (mobile originating call), for instance, a location update is
carried out in the HLR.

Location up-date
MS

BS/MSC/VLR
old LAI & old TMSI

Allocate
new TMSI
ciphered(new TMSI)
Acknowledgement

While staying in the old MSC area, the identification code of the location area (LAI location area ID) is
noted on the SIM card (subscriber identity Module)
If the subscriber now moves to a new MSC area and thus also to a new location area, the mobile
subscriber receives a new LAI from the MSC/VLR.
Since the new LAI is different from the old LAI, the mobile subscriber sends both LAIs back to the MSC.
If the new MSC knows the old LAI or the corresponding old MSC/VLR, it requests from there the security
parameters not used (triples) and the subscriber identification IMSI (international mobile subscriber identity).
Hereupon the new location area is transmitted to the HLR from the new VLR/MSC.
The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
in the VLR.

Location up-date
TMSI unknown

MS

BS/MSC/VLR
old LAI & old TMSI
old TMSI
unknown
ID request
IMSI

Allocate
new TMSI
ciphered(new TMSI)
Acknowledgement

Location Update with Location Change to an

Unknown MSC/VLR

While staying in the old MSC area, the identification code of the location area
(LAI location area ID) is noted on the SIM card (subscriber identity Module)
If the subscriber now moves to a new MSC area and thus also to a new location
area, the mobile subscriber receives a new LAI from the MSC/VLR.
Since the new LAI is different from the old LAI, the mobile subscriber sends both
LAIs back to the MSC.
Since in this case the old MSC/VLR is unknown in the new MSC/VLR, the MSC/
VLR requests the subscriber identification number (IMSI international subscriber
identity) from the mobile subscriber and transmits the new location to the HLR.
The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
in the VLR.

Mobile Originated Call (MOC) in D900

The dialing information is received via BSSAP in the MSC.

An audit of possible subscriber restrictions takes place in the MSC/VLR.
The dialing information is converted in the MSC and via the routing a route into
the PSTN is determined.

A-interface

Signalling
e g by ISUP, TUP, MFCR2

BSSAP
based on SCCP

VLR
BSC

B
number

Visited
MSC

B
number

MOC
Outgoing Traffic

Transit
switch

B
number

Transit
switch

B
number

Terminating
exchange

Transit Call
Transit Call
Terminating Call
Outgoing Traffic Outgoing Traffic Terminating Traffic

BTS

Air interface

A-side
Mobile Station

B-side
terminal
equipment

MOC macro
Message 1
MSC <- BSS CR(Complete L3 info(CM service request))
Message 2
MSC -> BSS CC(Authentication Request)
Message 3
MSC <- BSS DT1(Authentication Response)
Message 4
MSC -> BSS DT1(Cipher Mode Command)
Message 5
MSC <- BSS DT1(Cipher Mode Complete)
Message 6
MSC -> BSS DT1(ID Request (IMEI))
Message 7
MSC <- BSS DT1(Setup)
Message 8
MSC -> BSS DT1(Call Proceeding)
Message 9
MSC -> BSS DT1(Assignment Request)
Message 10
MSC <- BSS DT1(ID Response (IMEI))
Message 11
MSC <- BSS DT1(Assignment Complete)
Message 12
MSC -> BSS DT1(TMSI Reallocation Command)
Message 13
MSC <- BSS DT1(TMSI Reallocation Complete)
Message 14 PSTN <- MSC
IAM
Message 15 PSTN -> MSC
ACM
Message 16
MSC -> BSS DT1(Alerting)
Message 17 PSTN -> MSC
ANM
Message 18
MSC -> BSS DT1(Connect)
Message 19
MSC <- BSS DT1(Connect Acknowledge

Mobile Originated Call (MOC) in D900 with MNP (QoD query on digits)

The dialing information is received via BSSAP in the MSC.

An audit of possible subscriber restrictions takes place in the MSC/VLR.
Based on the dialled digits, MNP query is started; MNP server is triggered
The information from MNP server is converted in the MSC and via the routing a
route into the PSTN is determined.
MNP server

A-interface
BSSAP
based on SCCP

Signalling
e g by ISUP, TUP, MFCR2

VLR
BSC

B
number

Visited
MSC

B
number

MOC
Outgoing Traffic

Transit
switch

B
number

Transit
switch

B
number

Terminating
exchange

Transit Call
Transit Call
Terminating Call
Outgoing Traffic Outgoing Traffic Terminating Traffic

BTS

Air interface

A-side
Mobile Station

B-side
terminal
equipment

Mobile Terminating Call e.g. from PSTN

The dialing information is received by PSTN e.g. via ISUP in the PLMN
gateway MSC
The dialing information is converted in the gateway MSC.
A so-called "interrogation" is started as a response; i.e. a MAP message
is sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the gateway MSC.
The gateway MSC converts this temporary directory number and sets up
a circuit connection (ISUP) to the visited MSC. The location area is
specified in the MSC/VLR owing to the cross-connection between
temporary directory number and mobile subscriber.
The visited MSC now sends a "paging" to all BSCs situated in the location
area.
The BSC in which the subscriber is currently situated answers with a
"paging response".
The MSC makes the connection to the called subscriber.

Mobile Terminating Call

A-side
terminal
equipment

MSISDN

local
exchange
Originating Call
Outgoing Traffic

A-interface

Signalling
e g by ISUP (TUP, MFCR2)

Transit
switch
Transit Call
Outgoing
Traffic

MSISDN

Gateway
MSC

Interrogation

MSRN

Mobile
Terminating
Traffic

Transit
switch

MSRN

BSSAP
based on SCCP

BSC
Visited
MSC

MSRN

VLR

Outgoing
Traffic

BTS

SendRoutingInfo
MSRN

MSRN

Provide
RoamingNr

Air interface

HLR

MAP signalling
based on SCCP and TCAP

B-side
Mobile Station

MTC macro
Message 1
Message 2
Message 3
Message 4
Message 5
Message 6
Message 7
Message 8
Message 9
Message 10
Message 11
Message 12
Message 13
Message 14
Message 15
Message 16
Message 17
Message 18
Message 19
Message 20

PSTN -> MSC IAM

MSC -> BSS UDT(paging)
MSC <- BSS CR(ComL3Inf (Paging response)
MSC -> BSS CC(Authentication Request)
MSC <- BSS DT1(Authentication Response)
MSC -> BSS DT1(Cipher Mode Command)
MSC <- BSS DT1(Cipher Mode Complete)
MSC -> BSS DT1(ID Request)
MSC -> BSS DT1(Setup)
MSC <- BSS DT1(ID Response)
MSC -> BSS DT1(TMSI Reallocation Command)
MSC <- BSS DT1(Call Confirmed)
MSC -> BSS DT1(Assignment Request)
MSC <- BSS DT1(Assignment Complete)
MSC <- BSS DT1(TMSI Reallocation Complete)
MSC <- BSS DT1(Alerting)
PSTN <- MSC ACM
MSC <- BSS DT1(Connect)
MSC -> BSS DT1(Connect Acknowledge)
PSTN <- MSC ANM

Mobile Terminating Call with MNP (QoHLR query on HLR)

A-side
terminal
equipment

MSISDN

local
exchange
Originating Call
Outgoing Traffic

Signalling
e g by ISUP (TUP, MFCR2)

Transit
switch
Transit Call
Outgoing
Traffic

MSISDN

Transit
switch

Gateway
MSC

Interrogation

Transit
switch

Outgoing
Traffic

SendRoutingInfo
Unknown subscriber

HLR

MAP signalling
based on SCCP and TCAP

Call Forwarding Unconditional

A-side
terminal
equipment

Signalling
e g by ISUP (TUP, MFCR2)

MSISDN

local
exchange
Originating Call
Outgoing Traffic

MSISDN

Transit
switch
Transit Call
Outgoing
Traffic

Gateway
MSC

Transit Call
Interrogation

SendRoutingInfo

FTNO

Transit
switch

Transit Call
Outgoing Traffic

FTNO

terminating
exchange

Terminating Call
Terminating Traffic

FTNO

C-side
HLR

B side (mobile) to
C side

MAP signalling
based on SCCP and TCAP

terminal
equipment

Mobile to Mobile Call (Mobile Subscribers in

different MSC/VLRs)
The dialing information is received via BSSAP in the MSC
An audit of possible subscriber restrictions takes place in the MSC/VLR
The dialing information is converted in the visited MSC of the calling
subscriber.
A so-called "interrogation" is started as a response; i.e. a message is
sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the MSC of the calling subscriber.
The MSC of the calling subscriber converts this temporary directory
number and sets up a circuit connection (ISUP) to the visited MSC. The
location area is specified in the MSC/VLR owing to the cross-connection
between temporary directory number and mobile subscriber.
The visited MSC now sends a "paging" to all BSCs situated in the
location area. The BSC in which the subscriber is currently situated
answers with a "paging response".
The MSC makes the connection to the called subscriber.

MIC LOOP: (Mobile Internal Call Loop)

MS

BSSAP - LTG
CP

MOC
LOOP - LTG

MTC
CP
MS

BSSAP - LTG
MIC-Code would be
neccesary

The ORIG1 Story

When we need to perform different actions in differnet callsetup-states with the
same digits, then we use the ORIG1 parameter in command CR CPT

The ORIG1 can be imagined as an additional digit suffix. It is copied into the CPB
and is together with the digits an additional input for the digittranslator.

There are two kinds, how an ORIG1 can be assigned to a call (and copied to the
CPB):
a) assignment via incoming trunk group
b) assignment within specific callsetup

An incoming trunkgroup can be forced to assign an ORIG1 by the ORIG1
parameter in CR TGRP. (see Origination Dependent Routing in the EWSD).
This method is used in D900 MIC/PBX-loop treatment to distinguish between
BSSAP, Trunk or PBX call origination

In specific cases during call setup, the assignement occurs with a procedural
access to preadministered ORIG1 values for MSRN, CF, IN Loop, NP,...
(see MML command ENTRMPRDDAT)

Quiz
Q1: Does the HLR know the respective location of the subscriber?
Q2: Does the AC generate the mobile station roaming number?
Q3: Does the MSC serve to through connect the call from the BSC
to other MSCs?
Q4: Which number serves to identify the subscriber and is stored on
the SIM card?
Q5: With which number can the subscriber be internationally dialed?
Q6: Which number is transmitted to the equipment identification
register for auditing?
Q7: Which number is used instead of the IMSI in order to avoid
unnecessary interchange of the IMSI via the radio interface?
Q8: Which three components does a so-called triple comprise?
Q9: Which parameter of the triple compares the MSC/VLR for the
authentication test?
Q10: Did you find this course interesting/usefull?

Answers

A1: Yes
A2: No
A3: Yes
A4: IMSI
A5: MSISDN
A6: IMEI
A7: TMSI
A8: Sres, rand, kc
A9: Sres
A10: Of course