This action might not be possible to undo. Are you sure you want to continue?
At the end of the module the student is able to: Explain the mobility concept (handover, location update, paging) List the three numbers in the authentication triplet and explain the use for each of them List at least four teleservices List and explain the operation of at least four supplementary services offered by GSM networks
³Registration´ of a ³subscriber´
³Updating subscriber data´ Embassy 4 .
Provision of ³services´ 5 .
Turning on a mobile phone BTS 6 .
GSM databases (1) Subscriber Identity Module (SIM) Information in a SIM card: Security handling information Subscriber identity Temporary network information Access rights (Nat.) Preferred networks Prohibited networks 7 . Intl..
GSM databases (2) Home Location register (HLR) Permanent data Regular update of subscriber s current VLR Visitor Location register (VLR) Temporary data Kept as long as subscriber is within its coverage area Updated from the HLR Always associated with a Mobile Services Switching Centre (MSC) HLR VLR MSC 8 .
Databases in a GSM network GSM network HLR VLR MSC SIM 9 .
the Mobile Station starts the location update procedure. The Mobile Station continues to monitor the broadcast information.Location update The Mobile Station monitors the information broadcast by the network. The Mobile Station stores the current location area identity in the SIM card. If the location area identity being broadcast by the network is other than the one stored in the SIM. 10 .
Elements involved in a location update HLR VLR VLR MSC (old) Location Update MSC (new) Mobile moves SIM 11 .
Location update procedure . SUBSCRIBER INFORMATION ACKNOWLEDGEMENT 12 .first time MS BSS MSC VLR HLR LOCATION UPDATE REQUEST REQUEST SUBSCRIBER ID SEND SUBSCRIBER ID REQUEST AUTHENTICATION INFO SEND AUTHENTICATION INFO AUTHENTICATION AUTHENTICATION RESPONSE LOCATION UPDATE MESSAGE LOCATION UPDATE OK ACKNOWLEDGEMENT.
Call set-up in a GSM network: PSTN originated call (1) MSISDN PSTN The dialled number is Mobile Subscriber International ISDN Number (MSISDN) MSISDN = CC + NDC + SN CC: Country Code NDC: National Destination Code SN: Subscriber Number 358505527268 358 = Country Code (Finland) 50 = National Destination code (Radiolinja) 5527268 = Subscriber Number 13 .
Call set-up in a GSM network (2) HLR GMSC PSTN MSISDN VLR GSM Network The PSTN routes the call to a GSM network The MSC connected to the PSTN is known as the Gateway MSC (GMSC) The GMSC analyses the received MSISDN The only database that knows where a GSM subscriber is at any given moment is the HLR The GMSC requests the HLR for some routing information to know where to route the call This procedure is known as HLR Enquiry 14 .
.Call set-up in a GSM network (3) The HLR looks up its database... IMSI = MCC + MNC + MSIN IMSI: International Mobile Subscriber Identity MCC: Mobile Country Code (3 digits) MNC: Mobile Network Code (2 digits) MSIN: Mobile Subscriber Identity Number (max 10 digits) 244052200002345 244: MCC of Finland 05: MNC of Radiolinja 2200002345: MSIN 15 . HLR database contents: MSISDN: 358505527268 IMSI: 244052200002345 VLR address: xyz Subscriber data: Services.
Call set-up in a GSM network (4) HLR Gateway MSC Target MSC VLR VLR PSTN GSM Network Elements involved in a call set-up inside the GSM network 16 .
MSRN = CC + NDC + SN The format of the MSRN is the same as the MSISDN. The MSRN also has sufficient information to enable the GMSC to route the call to the target MSC. in case of MSRN it points a database location in the VLR. The target MSC/VLR allocates a Mobile Subscriber Roaming Number (MSRN) for this call. The HLR sends a routing information request message to the target MSC/VLR. Target MSC 17 . The term SN in the MSISDN points to a database location in the HLR.Call set-up in a GSM network (5) HLR Gateway MSC Routing information request message VLR VLR The HLR takes the VLR address of the subscriber from its database.
to HLR VLR The target MSC forwards the MSRN to the HLR. The HLR forwards this to the originating MSC. The telephone number type of format enables the call to be routed to the destination MSC.Call set-up in a GSM network (6) HLR 358 50 456456 Gateway MSC MSRN No. VLR Target MSC 18 . wherever in the world it may be. The originating MSC analyses the MSRN.
LAI = MCC + MNC + LAC LAI = Location Area Identity MCC = Mobile Country Code MNC = Mobile Network Code LAC = Location Area Code LA 3 LA 2 19 .Location areas Reception Restaurant Bar Pool LA 5 LA 4 MSC VLR LA 1 The MSC/VLR area is divided into small areas called Location areas. The maximum size of an LA can be one MSC area and the minimum size is one cell. A subscriber can move within this area without having to make a generic location update (explained later). Paging is done in all cells of the LA where the subscriber is currently located.
Paging process Location Area Paging Paging BTS Mobile responds to paging Paging BTS BTS 20 .
Simplified steps of a call set-up in a GSM network ASubscriber PSTN GMSC HLR MSC/VLR CALL SETUP (MSISDN) ANALYSE NUMBER CALL SETUP (MSISDN) MSISDN IMSI MSRN MSRN CALL SETUP (MSRN) PAGING 21 .
The procedure is same as that of a PSTN originating call. the call is routed out to the Public Switched Telephone Network (PSTN) via the Gateway MSC. The serving MSC analyses the calling subscriber data. Depending on the subscriber data. an HLR enquiry is performed to obtain the MSRN. If the dialled number is any other number.Mobile originated call The Mobile Station user dials a number. If the dialled number is an MSISDN of another Mobile Station belonging to the same network. 22 . the MSC will: authorise or deny the use of the network activate the requested service route the call.
security procedures 3. call set up complete 10. all ok 6. alert 11. 5. call setup 4.Simplified steps of a mobile originated call EXC GMSC HLR MSC VLR BSS MS 1. call is proceeding 7. traffic channel allocated 8. check services etc. B answers 23 . channel assignment 2. set up the call 9.
Done every time a Mobile Station is switched on. Generic Done every time a Mobile Station changes a location area. 24 . since the last transaction with the network. M SC VLR Periodic Performed after a preset timer expires. Timer value is dependent on the network operator. LA 2 LA 1 The Mobile Station starts the procedure.Types of location updates Power On Also known as IMSI Attach and Location Registration .
security procedures 6. request subscriber identity 4. TMSI acknowledgement 25 . location cancelling accepted 10. cancel old location 9. send subscriber identity and security information 5. subscriber information 8. location update acknowledgement. acknowledgement. location update request 3. channel assignment MSC VLRnew VLRold HLR 2. update HLR 7. new TMSI 11.Generic location update procedure MS BSS 1.
The BSC controlling the current cell makes the decision to perform a handover.Handovers Handover due to traffic reasons When the capacity of a cell nears its maximum. Frequency resources of previous cells can not be used any more. he may travel from one cell to another. 26 . Handover due to signal quality and strength When a mobile subscriber is moving during a call. The MSC starts the procedure. mobile stations in the periphery of the cell may be handed over to neighbouring cell with lower traffic load. There are four types of these handovers. The mobile station is handed over to the new cell.
Intra BSC handover Air A BTS BSC TC 27 .Intra cell .
Inter cell .Intra BSC handover Air BTS BSC TC A BTS Old Cell / BTS New Cell / BTS 28 .
Inter cell .Inter BSC handover New Cell / BTS Air A BTS BSC TC M SC BSC TC VLR BTS Old Cell / BTS 29 .
Inter MSC handover (1) New Cell / BTS Air A BTS BSC TC M SC VLR BTS BSC TC M SC VLR Old Cell / BTS 30 .
The call is routed from the source MSC to the target MSC. A routing number is needed to route a call from one MSC to another MSC. The format is the same as the MSRN. The target MSC allocates one and gives it to the source MSC. HON = CC + NDC + SN 31 . The source MSC requests the target MSC for a Handover Number (HON).Inter MSC handover (2) The source MSC is known as the Anchor MSC.
provide HON and target cell info 7. connect 12.Inter MSC handover (3) MS BSSold 1. request for radio resources 5. request HON 4. set up speech connection (HON) 8. handover command 9. release old connections 32 . handover required 3. handover complete 10. handover complete 11. radio resources reserved 6. measurement reports MSCold MSCnew BSSnew MS (after HO) 2.
33 .Charging Installation fee Renting of the service Use of the network What to charge? Different charging packages.
Factors affecting the price of a call Type of basic service Duration of the call Time of the call Destination of the call Origin of the call Use of networks Type of supplementary service Use of radio resources Roaming leg 34 .
Whom to charge? Where is the called party? Bill to subscriber BSC Billing BC Transfer of Charging data PSTN BC Path of the call MSC PLMN 2 HLR MSC Charging PLMN 1 Calling Party 35 .
The MSC that handles the call collects all information which could be the basis for charging. This collected information call is stored in Charging Data Records (Toll Tickets). GMSC BSC PSTN BTS HLR Charging Data Record 36 .Collection of charging data Charging depends on many factors.
Elements involved in call handling HLR GMSC BSC PSTN BTS MSC BSC 37 .
The Billing Centre is responsible for producing the bills for the subscribers based on the information contained in the Charging Record.25 or Ethernet Billing Centre (BC) 38 . When sufficient charging records have been collected they are transferred in one bulk to the Billing Centre.Transfer of charging data Charging records are stored in the MSC where they are collected. HLR GMSC MSC PSTN BSC BTS X.
User confidentiality Avoidance of the broadcast of user s IMSI in the Air Interface. IMEI checking Verification of the Mobile Equipment by checking the validity of the International Mobile Equipment Identity (IMEI). 39 .Security issues Authentication Verification of the subscriber. Ciphering Encryption of user speech in the Air Interface.
Ki. stored in the Authentication Centre (AC) and the SIM card. Air SIM card A AC MSC * I MSI * Ki VLR * I MSI * Ki 40 . Authentication always performed by the VLR before call establishment and location update.Authentication Each subscriber has an identity key. Comparison of Ki without broadcasting it in the Air Interface.
41 . Actual encryption of user speech is done using Kc and digitised speech as inputs to the encryption algorithm A5. SRES is calculated in the AC and SIM. Need a cipherkey.Security algorithms Need to check Ki without transmitting it in the air Use of one-way algorithm. Kc to encrypt user speech. and compared in the VLR for authentication. Kc is generated using the algorithm A8. Performed between the Base Transceiver Station (BTS) and the Mobile Equipment (ME). A3. to produce a Signed Response (SRES). by using a Random Number (RAND) and Ki as inputs.
Location of security algorithms A ir A AC A3 BSC TC A8 BTS MSC VLR ME + SIM A5 A5 A3 A8 42 .
new triplets are requested from the AC. The AC generates a number of SRESs. 43 . The VLR can be external to the subscriber s home network (in case of roaming). and transfers them along with the corresponding RAND and cipher key Kc to the serving VLR. Excessive signalling is required to transfer the SRES to the VLR every time authentication is needed.Authentication triplet Authentication verification is done in the VLR serving the subscriber. The VLR uses the triplets to verify the subscriber. When the number of triplets reaches below a certain threshold.
Authentication triplet generation Random number generator Ki AC RAND A3 A8 SRES Kc Authentication triplet VLR RAND SRES Kc Authentication triplet 44 .
Authentication procedure Authentication Triplet VLR RAND SRES Kc Comparison BSC BTS MS RAND Kc SIM A3 SRES Kc Ki A8 45 .
Speech encryption SPEECH/DATA BTS A5 Kc TDMA A5 ENCRYPTED SPEECH/DATA A5 Kc TDMA A5 SPEECH/DATA 46 .
IMEI checking The validity of a mobile equipment may be checked to ensure its proper operation and as prevention against stolen phones. 47 . can store black listed IMEI numbers. The mobile equipment sends its IMEI before a transaction with the network The MSC can request the EIR to see if the received IMEI is black listed If it is. The Equipment Identity Register (EIR). the MSC can stop the call set-up An operator can set the MSC to check the IMEI of a mobile equipment at times other than during call set-up as well. which is implemented as part of the HLR.
The next time a transaction between the GSM network and the MS is initiated. there is the provision of a Personal Identification Number (PIN) code in the SIM card. the subscriber is identified by the use of TMSI.User confidentiality IMSI is a confidential identity of the subscriber. if enabled. which. must be entered before an MS can be used. Additionally. a mobile subscriber is allocated a Temporary Mobile Subscriber Identity (TMSI). After a successful first time location update. 48 . The format of TMSI is operator dependent. TMSI is reallocated after every successful authentication verification. It is a 32 bit binary number.
Classification of services Teleservices Provide full communication capacity by means of terminals and network functions. OSI layers 1 to 7. OSI layers 1 to 3.Services What are services? A subscriber action that uses the facilities of the GSM network. Basic services Supplementary services Services Teleservices Bearer services 49 . Bearer services Provide the capability for transmitting signals between the GSM network access point and an appropriate access point in the terminating network.
including emergency calls. For the reception of Short messages. For sending and receiving facsimile messages. For sending a short message to another GSM subscriber. Emergency calls are possible automatically. For sending short messages to more than one receiver simultaneously within a given cell. normal speech service. T61 T62 50 . Not supported by NOKIA.Teleservices Service Description Speech (Telephony) GSM Specification Code T11 Characteristics Speech (Emergency Calls) Short Message Service (Mobile terminated) Short Message Service (Mobile originated) Short Message Service (cell broadcast) Group 3 Facsimile transmission (with alternate speech) Automatic Group 3 Facsimile transmission T12 T21 T22 T23 The most important service for mobile systems.
Mobile Terminated SM S A fa sk op m 346 l Alfask op m3 4 6 A lfa sko p m34 6 51 .Short Message Service (MO. Mobile Originated Short Message Service. MT) Air A MSC VLR Short Message Service.
Cell Broadcast O&M Alfask o pm3 46 A lf s k op m346 a Alf sk o pm 346 a 52 .Short Message Service (Cell broadcast) Air BTS A BTS BTS BTS BSC BTS Short Message Service.
Appl. SMS-IWMSCSMS ± Interworking MSC SMS-GMSC SMS ± Gateway MSC SMSC SMS Centre 53 .SMS Architecture BSS NSS BTS BSC TRAU MS BTS EIR HLR AC MSC/VLR SMSIWMSC SMSGMSC SMSC Ext.
MO Short Message.GSM (Successful Case) MS 1 3 9 5 MSC 8 SMSIWMSC 6 7 SMSC 2 4 VLR HLR 1: Access Request 2: Access Request 3: Message Transfer 4: SendInfoFor-MO-SMS 5: ForwardShortMessage 6: Message Transfer 7: Submit Report 8: Submit Report 9: Submit Report 54 .
(Failure Due to Absent Subscriber) 3 MS MSC/ SGSN 5 4 6 SMSGMSC 7 2 1 8 SMSC VLR HLR 1: Message Transfer 2: SendRoutingInfo ForShortMsg 3: ForwardShortMessage 4: SendInfoForMT-SMS 5: Failure Report 6: Failure Report 7: SM-Delivery ReportStatus 8: Failure Report 55 .MT Short Message.
Facsimile transmission Air Transparent / Non Transparent A HLR AC EIR BTS BSC TC M SC VLR IW F Modems / Rate Adaptation 56 .
Data services Air Transparent / Non Transparent A HLR AC EIR BTS BSC TC M SC VLR IW F Synchronous / Asynchronous Modems / Rate Adaptation 57 .
Supplementary services (1)
Call Forwarding Unconditional Call Forwarding on Mobile Subscriber Busy Call Forwarding on No Reply Call Forwarding on Mobile Subscriber Not reachable Barring Of Outgoing Calls Barring Of Outgoing International Calls Barring Of all Incoming Calls Barring Of Outgoing International Calls Excluding Those Directed to the Home PLMN Country Barring Of all Incoming Calls when roaming outside the Home PLMN
Supplementary services (2)
Call Waiting Call Hold Multiparty Service Explicit Call Transfer Calling Number Identification Presentation Calling Number Identification Restriction Advice of Charge Centrex Service Operator Determined Barring Alternate Line Service (personal or business)
Review Questions to ´GSM Traffic Management³
Review 1. The location update procedure is initiated by the: a) b) c) d) Mobile Station (MS) Mobile services Switching Centre (MSC) Base Station Controller (BSC) Home Location Register (HLR) 2. The format of the International Mobile Subscriber Identity (IMSI) is: a) b) c) d) CC + NDC + SN MCC + MNC + MSIN MCC + MNC + LAC Operator-specific 32-bit binary number 61 .
Review 3. A location area: a) is the geographical area under one Base Station Controller (BSC). b) is equal to one MSC area. 62 . Which of the following cases result in an HLR enquiry? a) b) c) d) PSTN originated PSTN terminated call Mobile originated PSTN terminated call PSTN originated mobile terminated call None of the above 4. c) is equal to one cell. d) is identified by a unique Location Area Identity.
63 .Review 5. 6. Initiation of the paging process for a mobile station is done by: a) b) c) d) the MSC over a location area. a Base Transceiver Station in one cell. If GSM Phase 2 feature ÄOff Air b) the B-subscriber accepts the international roaming Call Set-up³ Is available leg charging. a Base Station Controller over one BSC area. all Base Transceiver Stations in a location area. c) the MSRN analysis is done and the location area of the subscriber is known. d) the mobile station answers the paging signal. In a mobile terminated call a traffic channel from the NSS in the terminating side to the called mobile station is reserved when: a) the MS user answers the ringing of the phone.
Review 7. Why is it necessary to check the calling subscriber s data before allowing the call to proceed in the originating NSS side? a) To make sure that s/he has the correct IMSI. then a periodic location update is done: a) b) c) d) 10 hours after the last periodic location update. 8. 10 hours after the last generic location update. 10 hours after the last power on location update. If in a GSM/DCS network the periodic location update timer is set as 10 hours. d) To make sure that the NSS knows whom to charge for the call. b) To make sure that s/he is provisioned the requested service. 10 hours after the last transaction of any kind with the NSS. c) To make sure that s/he has the correct TMSI number. 64 .
65 . IMSI. the new VLR asks the old VLR for some information about the mobile subscriber. In an inter-VLR location update. TMSI and subscribed services. IMSI and HLR address in case of a roaming subscriber. IMSI and last location update time. The old VLR responds to this query by providing which of the following information? a) b) c) d) IMSI and authentication triplets.Review 9.
. b) A handover number is always required. d) The subscriber always has to pay extra for the additional network operation required to maintain his/her call.Review 10. 66 . c) The initial speech path is not disconnected until a successful message comes from the mobile station on the new channel. If a handover occurs during a call: a) The new frequency resource always belongs to a cell other than the current one.
The Billing Centre with information from the Transcoder. Charging records can be generated in: a) b) c) d) the MSC. Which network element creates bills for the subscriber? a) b) c) d) 67 . the HLR. The HLR with information from the MSC. The MSC with information from the Billing Centre. both in the MSC and the HLR. Charging records are not generated in the GSM network.Review 11. The Billing Centre with information from the MSC. 12.
The contents of the authentication triplet are: a) b) c) d) SRES. A5. A8 RAND. RAND. RAND. Kc A3. A8 15.Review 14. What is the result when you use Ki and RAND as inputs through A8? a) b) c) d) Encoded speech Signed response Authentication triplet Kc 68 . A3 SRES. A3.
Review 16. emergency CLIP 14. Which of the following is not a basic service? a) b) c) d) SMS-MO Speech. d) Both SRES and Kc are used for speech encryption. 17.4 Kbits per second synchronous transparent 69 . b) SRES is used for speech encryption and Kc is used for frame alignment. c) SRES is used for authentication and Kc is used for speech encryption. What is SRES and Kc used for. respectively? a) SRES is used for speech encryption and Kc is used for authentication.
This action might not be possible to undo. Are you sure you want to continue?
We've moved you to where you read on your other device.
Get the full title to continue reading from where you left off, or restart the preview.