UMTS Traffic Management
Training Document

CTXX5323en Issue 4.0

© Nokia Networks Oy

1 (63)

UMTS Traffic Management

The information in this document is subject to change without notice and describes only the product defined in the introduction of this documentation. This document is intended for the use of Nokia Networks' customers only for the purposes of the agreement under which the document is submitted, and no part of it may be reproduced or transmitted in any form or means without the prior written permission of Nokia Networks. The document has been prepared to be used by professional and properly trained personnel, and the customer assumes full responsibility when using it. Nokia Networks welcomes customer comments as part of the process of continuous development and improvement of the documentation. The information or statements given in this document concerning the suitability, capacity, or performance of the mentioned hardware or software products cannot be considered binding but shall be defined in the agreement made between Nokia Networks and the customer. However, Nokia Networks has made all reasonable efforts to ensure that the instructions contained in the document are adequate and free of material errors and omissions. Nokia Networks will, if necessary, explain issues which may not be covered by the document. Nokia Networks' liability for any errors in the document is limited to the documentary correction of errors. Nokia Networks WILL NOT BE RESPONSIBLE IN ANY EVENT FOR ERRORS IN THIS DOCUMENT OR FOR ANY DAMAGES, INCIDENTAL OR CONSEQUENTIAL (INCLUDING MONETARY LOSSES), that might arise from the use of this document or the information in it. This document and the product it describes are considered protected by copyright according to the applicable laws. NOKIA logo is a registered trademark of Nokia Corporation. Other product names mentioned in this document may be trademarks of their respective companies, and they are mentioned for identification purposes only. Copyright © Nokia Networks Oy 2004. All rights reserved.

2 (63)

© Nokia Networks Oy

CTXX5323en Issue 4.0


1 2 3 3.1 3.2 4 4.1 4.1.1 4.2 4.3 4.3.1 4.3.2 4.3.3 4.3.4 4.4 4.5 4.5.1 4.5.2 5 5.1 5.1.1 5.1.2 5.1.3 5.1.4 5.2 5.2.1 5.2.2 5.2.3 5.2.4 5.3 5.4 5.5 6 6.1 6.1.1 6.1.2 6.1.3 6.1.4 Module objectives ..................................................................................5 Introduction to UMTS traffic management...........................................6 Subscriber information and databases................................................8 Network databases...................................................................................8 Subscriber addressing and identities .....................................................10 Network traffic and radio connection.................................................13 Characteristic of a network bearer .........................................................14 Types and configuration of bearers........................................................15 Bearer transmission in the network ........................................................16 Bearers and the different levels of QoS .................................................17 The end-to-end service and UMTS bearer service ................................18 The radio access bearer service and the core network bearer service ....................................................................................................19 The radio bearer service and the Iu-bearer service ...............................19 The backbone network bearer service ...................................................19 Managing the bearer through the network .............................................20 Managing the bearer over UTRAN.........................................................21 Example: Simplified bearer establishment for a call...............................22 Managing the bearer when the subscriber is moving.............................24 Mobility management...........................................................................25 Cellular architecture ...............................................................................26 Network location areas...........................................................................27 Network routing areas ............................................................................28 UTRAN registration areas ......................................................................28 Location based information services ......................................................29 Mobility procedure - Location updating ..................................................30 Location area based procedures............................................................31 Routing area update (packet switched)..................................................33 Location info retrieval (circuit and packet switched)...............................35 Management of the UTRAN registration areas ......................................35 Mobility management - Paging the subscriber .......................................36 Mobility management - Roaming in another network .............................37 Mobility management procedures ..........................................................38 Session management ..........................................................................39 Initially accessing the network................................................................40 IMSI attach for an existing subscriber ....................................................41 IMSI attach when roaming......................................................................42 Requesting for a dedicated bearer .........................................................42 Access security in UMTS .......................................................................43 Mutual Authentication.............................................................................44

CTXX5323en Issue 4.0

© Nokia Networks Oy

3 (63)

.1 7..........................................................0 .............................. 56 Call control for circuit switched (real time) calls........................... 48 Managing a non-real time (packet) bearer ...... 51 Communication management ................................2 6.............................................. 60 4 (63) © Nokia Networks Oy CTXX5323en Issue 4......... 57 Generation and collection of charging data .................... 58 Note on handling emergency calls .UMTS Traffic Management 6...........................3 7 7....3 8 Managing a real time (circuit switched) bearer............... 59 Review questions .............2 7............................................................................

describe how the session management of real time and non-real time bearers are handled through the network without using any references (if not otherwise stated). At an overview level. identify how the network selection is made With the help of the material. the participant should be able to: • • • • • • • • List and identify the databases used within the UMTS network Identify the subscriber addressing information Name the characteristics of a bearer Describe how the connection moves with the subscriber when a bearer is in use Explain what is meant by the term URA List the procedures used to maintain mobility management in the network List the procedures done when the mobile gains access to the network. After completing the module. Topics to be covered in this module include understanding the network databases and the information stored within them.0 © Nokia Networks Oy 5 (63) . CTXX5323en Issue 4. Also.Module objectives 1 Module objectives The aim of this module is to give the student the conceptual knowledge needed for explaining how traffic management is visualised in a UMTS network. we will look at the different management layers in the network.

RAN (UTRAN & GERAN) Core Network SCEP SMSC Control Plane HLR &AuC Node B BSC Node B 3G MSC AXC Fiber Node B Internet Fiber ATM Access RNC BTS PSTN 2G 3G SGSN SGSN GGSN Gateway Plane Figure 1. there are three ways to approach this. as well as for control activities such as moving and charging. Each management layer is responsible for certain procedures. and the core network. The third approach is to look at how the data and signalling are carried through the network (management layers). 3G/UMTS network architecture The above figure illustrates the UMTS Release 99 architecture.UMTS Traffic Management 2 Introduction to UMTS traffic management When visualising a UMTS network. We can think of all these activities as management functions that the network is performing. RAS. The first view is from the point of view of the architecture and the functions of the elements within the RAS and the core network subsystem. The second approach is through the different interfaces between the mobile. The control plane is responsible for the control of the information through the network. which is divided into two planes. The higher layers require the functions and 6 (63) © Nokia Networks Oy CTXX5323en Issue 4. The functions and procedures are clearly defined in the specifications. The following figure illustrates the four management layers in the network. When thinking of managing the subscriber within a network. whereas the gateway plane manages the user data or bearer through the network. The functions can be divided into management layers.0 . there are many procedures used for locating and paging.

For example. The higher-layer functions performed between the UE and CN are often called as communication management (CM). and it involves managing how the channels are allocated.Introduction to UMTS traffic management procedures that are used on the lower layers. • PS (packet switched): Session management Mobility Management (MM) Radio Resource Management (RRM) UE RAN CN Figure 2. We will discuss RRM only briefly in this module. The CM entity covers the topics like call control (CC). There the function depends on whether the domain is CS (circuit switched) or PS (packet switched). supplementary services (SS) and short message service (SMS). Also the structure of the cellular network and the functions of the management layers will be explained. supplementary services (SS) and short message service (SMS). we can identify three network-wide layers of functionality.0 © Nokia Networks Oy 7 (63) . you must have a connection to the mobile before you can send or receive signalling messages. Communication Management (CM) • CS (circuit switched): Call control (CC). In UMTS networks. session management and call control are maintained by the core network (CN) domains. The mobility management. The radio resource management is the lowest level and it is responsible for the network communication with the mobile over the air interface. CTXX5323en Issue 4. In this module we will first look at how the subscriber's information is stored. 3G-network management layers The radio resource management (RRM) is completely covered between the radio access network (RAN) and the user equipment (UE).

1 Network databases The databases are used all the time to control activities such as paging.0 . Most of the procedures are similar compared with GSM and GPRS. The network uses unique information to identify a subscriber. rights to services. for example. and identification numbers. this chapter is mainly of a repetitive nature. 3. channel set-up and authentication. Network registers 8 (63) © Nokia Networks Oy CTXX5323en Issue 4. Hence.UMTS Traffic Management 3 Subscriber information and databases Information about the subscriber is stored in several parts of the network. and there are different types of databases throughout the network. security data. The figure below summarises the databases that are found within the network. Other information about the subscriber may include. In AuC subscriber security information and in some implementations EIR Control Plane Mobility Core Contains temporary information on the subscriber SMSC SCEP GSM BTS Mod BTS e HLR AuC EIR 3G MSC BSC Triple Mod Mode BTS BTS e Used as an intermediate store for SMS AXC Fiber Fiber Internet PSTN 2G 3G SGSN SGSN GGSN WCDMA Mod BTS BTS e ATM access RNC Gateway Plane Contains temporary information on subscriber Figure 3. This information is used to identify the location of the subscriber when transmitting the paging signal. Used to support subscriber services RAN Contains subscriber IDs. service information and location attributes.

However. The Short Message Service Centre (SMSC) is an intermediate store for the received/sent short messages. location registration. and Gateway/Interworking MSC. Thus. The Visitor Location Register (VLR) is considered to be an integral part of the Serving MSC. The DNS is used for APN name to GGSN IP address translation. The IN Service Control Point (SCP) nowadays has INAP (Intelligent Network Application Part) and/or CAP (Camel Application Part) connections towards the core network circuit switched (CN-CS) domain elements. The HLR is responsible for mobility management related procedures in both the circuit switched and packet switched domains. and security activities. Firewalls are used for security control of external network connections. the GGSN is able to route the user's request further. it has signalling connections with the VLR. public IP. the registers are similar to those in GSM and GPRS. After this.0 © Nokia Networks Oy 9 (63) .Subscriber information and databases Since the core network will not change dramatically in the first release of UMTS. CTXX5323en Issue 4. The Home Location Register (HLR) contains permanent data of the subscribers. who have performed a location update in its area. The border between the corporate networks. and 3G CN-PS domain is maintained by the GGSN which may use the RADIUS database for user authentication. The Equipment Identity Register (EIR) maintains the security information related to the user equipment (UE) hardware. paging. The CN-CS domain elements having the IN connection is called Service Switching Points (SSPs). The Serving GPRS Support Node (SGSN) needs to find out which Gateway GPRS Support Node (GGSN) that supports access to this a specific access point. In the packet switched domain. The Authentication Centre (AC/AuC) is a database handling the Authentication Vectors. These contain the parameters that the VLR uses for security activities performed over the Iu interface. GPRS Support Nodes. Other nodes (such as voice mail systems and application servers) can also contain subscriber and network information. One subscriber can always be in only one HLR. two service nodes are used to supply the required IP access information: the Domain Name Server (DNS) and Firewalls. The role of the DNS is therefore to give the SGSN the IP address to the GGSN. The VLR maintains mobility management related procedures like location update. the HLR is still a centralised source of information. The VLR database contains temporary copies of the active subscribers.

which is the same as the GSM: IMSI = MCC + MNC + MSIN Where: • • • MCC = Mobile Country Code (3 digits) MNC = Mobile Network Code (2 digits) MSN = Mobile Subscriber Identity Number (normally 10 digits). In AuC subscriber security information and in some implementations EIR Control Plane Used to support subscriber services SCEP Core Network HLR &AuC Node B BSC Node B 3G MSC Used as an intermediate store for SMS AXC Fiber Node B Internet Fiber ATM Access RNC BTS PSTN 2G 3G SGSN SGSN GGSN Gateway Plane Contains temporary information on subscriber Figure 4. As in 2G networks. IMSI and MSISDN addresses in the network The unique identity for the mobile subscriber is called IMSI (International Mobile Subscriber Identity). with only one IMSI. unique addressing codes are used to identify the subscriber. Contains temporary information on the subscriber SMSC Contains subscriber IDs. The figure below highlights the identities used and where the information is stored. This number is stored in the SIM card (USIM). service information and location RAN (UTRAN & GERAN) attributes. another MSISDN number for facsimile and so on. For instance.2 Subscriber addressing and identities Each subscriber has to be uniquely identified.UMTS Traffic Management 3.0 . One subscriber may have several services provisioned and activated. the mobile user may have one MSISDN number for speech service. 10 (63) © Nokia Networks Oy CTXX5323en Issue 4. The MSISDN (Mobile Subscriber international ISDN Number) is used for service separation.

RAN (UTRAN & GERAN) The TMSI/TMUI is generated by the VLR and used for CS transactions Node B Core Network SCEP SMSC Control Plane HLR &AuC BSC Node B 3G MSC AXC Fiber Node B Internet Fiber ATM Access RNC BTS PSTN 2G 3G SGSN SGSN GGSN Gateway Plane P-TMSI is allocated for packet transactions by the SGSN. Figure 5. Very often this number is called ‘directory number’ or just simply ‘subscriber number’. The P-TMSI is allocated by the SGSN and it is valid over CTXX5323en Issue 4. the UMTS system uses TMSI (Temporary Mobile Subscriber Identity) number. and the network controls this pace of change. which is also called TMUI (Temporary Mobile User Identity). For this purpose. The TMSI/TMUI may also change earlier. Temporary information stored in the network TMSI/TMUI and P-TMSI are random-format numbers. In order to separate this type from the TMSI/TMUI.0 © Nokia Networks Oy 11 (63) . The packet switched domain of the core network allocates similar temporary identities for the same purpose. it is named P-TMSI (Packet Temporary Mobile Subscriber Identity). The TMSI/TMUI numbers are allocated by the VLR and they are valid until the UE performs the next location update procedure.Subscriber information and databases The MSISDN consists of three parts: MSISDN = CC + NDC + SN Where: • • • CC = Country Code (1 to 3 digits) NDC = National Destination Code (1 to 3 digits) SN = Subscriber Number. This number format follows the E. Due to security reasons it is very important that the unique identity (IMSI/IMUI) is transferred in non-ciphered mode as less as possible.164 numbering specification. which have limited validity time and validity area.

Ensuring terminal equipment security All the IMEI numbers are handled in three categories within the core network. The P-TMSI is changed when the UE performs routing area update. The grey listed IMEI numbers are under observation. RAN (UTRAN & GERAN) RAN The IMEI is used to track legal mobile equipment (optional) Core Network SCEP SMSC Control Plane HLR &AuC EIR 3G MSC Node B BSC Node B AXC Fiber Node B Internet Fiber ATM Access RNC BTS PSTN 2G 3G SGSN SGSN GGSN Gateway Plane Figure 6. which is used for call routing purposes. except in case of an emergency call. IMEI (International Mobile Equipment Identity) is a number uniquely identifying the user equipment's hardware. Grey List and Black List. If the accessing UE is on the black list. that is. These categories are called lists. which do not have any troubles.0 . 12 (63) © Nokia Networks Oy CTXX5323en Issue 4. White List. The MSRN is used during a call set-up between the network and a subscriber on another MSC. and every time a UE having grey listed IMEI used. There are several other addresses that are used. it consists of three parts (CC. White listed IMEI numbers are normal identities. The format of the MSRN is the same than MSISDN.UMTS Traffic Management the SGSN area. The network may or may not ask the UE to identify itself with IMEI number either in context of every transaction or occasionally in the cases defined by the network operator.164 numbering specification. The implementation of this explanation is beyond the scope of this module. NDC. There is a separate register called EIR (Equipment Identity Register) handling these identities. the network produces an observation report about the transaction. that is. One is the MSRN (Mobile Subscriber Roaming Number). and SN) and it follows E. the network rejects the transaction.

Internet. The figure below illustrates that a bearer is like a tunnel that goes through the different network elements and is carried on the different network interfaces. From the physical network's point of view.Network traffic and radio connection 4 Network traffic and radio connection In the previous chapter we looked at the type and location of information that is stored about a subscriber within the network. in the case of a voice/video call. UE Uu Node B Iub/Iur RNC Iu Core Network Data/Wireless Protocols are transparent to surrounding network MGW The MGW for 3G-MSC performs speech transcoding Figure 8.0 © Nokia Networks Oy 13 (63) . The core network ensures that the bearer is either connected into the service platform. external network or. In the case of the PSTN. Thinking in terms of a network bearer The application (such as video) in the mobile has a point-to-point connection to a remote application (such as video on another terminal). Data and speech through the bearer CTXX5323en Issue 4. UE Uu Node B Iub/Iur RNC Iu Core Network Figure 7. the information in the bearer pipe must be converted to a form that is understood by the outside world. the UMTS radio access network (UTRAN) must ensure that the bearer is maintained over the air interface and is correctly routed to the core network. the focus is on how the user traffic (also known as the user plane) is visualised in the network and how the connection is managed in the air interface. In this chapter. The first concept to clarify is the bearer. onto the PSTN (see the figure below).

we need a connection from the mobile to the Media Gateway that can support these bit rates. The different air interface classifications Example 2: Internet connection The first characteristic to remember is that Internet traffic is often bursty and asymmetric (there is usually more to download than to upload). the bit rate required is around 16-19 kb/s.UMTS Traffic Management 4. • Conversational class • Voice and video • Streaming class • Streaming video • Interactive class • Web browsing • Background class • Mail downloading Figure 9. let us take two examples. the delay factor is not as significant as for conversation. it can carry different types information (such as speech and circuit switched data). the data may be very sensitive to 14 (63) © Nokia Networks Oy CTXX5323en Issue 4. we have to take the delay factor into account.1 Characteristic of a network bearer If you think in terms of GSM. Therefore. (The bit rate depends of course on which speech coding method we use. Also. Example 1: Voice traffic Voice requires a data speed of. To better understand this concept. the total amount of data needed in the air interface is approximately 24 kb/s. The fundamental difference between GSM and UMTS is that in UMTS. As subscribers we are not tolerant of delays in our speech or video conversations. On the other hand. A traffic channel does share some same characteristics. The type of the bearer reserved and the way it is routed through the network depends on the subscriber's service need. Also. including overhead.) If we add error correction information (to ensure quality). For the interfaces within the radio access network (Iub.2 kb/s. the bearer is flexible. for instance. you probably consider the traffic channel to be the same as a bearer in the air interface. 12. for example.0 . which means that we can tolerate more variable bit rates. Iur) and towards the circuit switched core network (Iu).

the maximum data rates. compared with. all of these factors are linked together. The UMTS specification defines four classifications of bearers.1 Types and configuration of bearers As with all mobile systems.0 © Nokia Networks Oy 15 (63) . the network will allocate the bearer based upon the request of the subscriber's need. for instance. the coverage area. These were summarised in the previous figure. The below figure illustrates typical services and their required data rates. To be more precise. Typical data speeds needed for common 3G services CTXX5323en Issue 4. UE Uu Node B Iub/Iur RNC Iu Core Network Voice Voice Messages Video Streaming Videotelephony Audio Streaming 0 8 16 32 48 64 80 96 112 128 144 160 kbit/s Messaging Transactional Infoservices WWW browsing Intranet access Downloading Figure 10. the largest bottlenecks in allocating resources to a mobile subscriber is in the air interface. The air interface is limited in terms of the maximum amount of subscribers.Network traffic and radio connection errors.1. As a conclusion from these two cases. voice transmission. It means that we may need to apply more ambitious error correction. If you introduce more people to a cell. This is the reason why the RNC is responsible for the bearer allocation. Of course the transmission and core networks must be capable to support the different needs. it is the radio network controller (RNC) that makes the decision about the bearer allocation. one of the important tasks for the network planners is to dimension the accurate capacity in the network beyond the air interface. 4. then the size and bit rate reduces. and quality. In UMTS.

In the packet switched core network (PS-CN). It is then the RNC's responsibility to allocate an air interface channel and to establish the connections through to the core network. there is always a dedicated circuit for the connection and it is only released at the end of the call. In the circuit switched core network (CS-CN) domain. On the connection between the BTS and the RNC and towards the MSC/SGSN. 4. we use tunnelling to make a virtual connection between IP network elements. which are used to carry signalling messages and data between the terminal and the network. Transmission through the network The air interface also has physical channels.UMTS Traffic Management Let us assume that a video call is to be made through the network. The above figure shows that between elements we have pipes. ATM link to the MGW at the MSC HLR AuC EIR Dedicated circuit 3G MSC PSTN Channels from the air interface along the Iub interface RNC 3G SGSN GGSN Packets tunnelled to the SGSN Packets tunnelled from the SGSN to the GGSN Packet Data Internet Physical channels in the air interface are separated by codes Figure 11. it is still not the same as having a dedicated circuit in the network. the bearer 'sits' in a physical channel. a frame-structure protocol (typically ATM) is used. The UE must also inform the network about the needed classification and data speed.0 . A dedicated traffic channel for the air interface must then be requested. the tunnel enables a virtual circuit 16 (63) © Nokia Networks Oy CTXX5323en Issue 4. Basically.2 Bearer transmission in the network On its journey throughout the network. Although tunnelling ensures a semi-dedicated channel in an IP network. The network elements ensure that the right information is moved from one pipe to another.

UMTS bearer service layered architecture is depicted in the below figure (taken from the specifications). which is provided for the user of a network service. An end-to-end service may have a certain QoS. this means from terminal equipment (TE) to another TE.Network traffic and radio connection between the RNC via the Serving GPRS Support Node (SGSN). It is the user that decides whether he/she is satisfied with the provided QoS or not. Student Exercise: Why do you think the RNC makes the decision on the type of bearer that is allocated to a subscriber? 4. CTXX5323en Issue 4. Each bearer service on a specific layer offers its individual services and uses services provided by the layers below.0 © Nokia Networks Oy 17 (63) . a bearer service with clearly defined characteristics and functionality is to be set up from the source to the destination of a service. A bearer service includes all aspects to enable the provision of a contracted QoS. and towards the Gateway GPRS Support Node (GGSN). To realise a certain network QoS. and QoS management functionality.3 Bearers and the different levels of QoS Network services are considered end-to-end. user plane transport. These aspects are among others the control signalling.

In other words. It is the various services offered by the UMTS bearer service that the UMTS operator offers.1 The end-to-end service and UMTS bearer service 1 On its way from the terminal equipment (TE) to another.0 . it is not subject for further elaboration in the present document. such as another UMTS bearer service.UMTS Traffic Management TE MT UTRAN CN Iu EDGE NODE CN Gateway TE End-to-End Service 1 TE/MT Local Bearer Service UMTS Bearer Service External Bearer Service Radio Access Bearer Service 2 CN Bearer Service Backbone Bearer Service 3 Radio Bearer Service UTRA FDD/TDD Service Iu Bearer Service Physical Bearer Service 4 Figure 12. The end-to-end service on the application level uses the bearer services of the underlying network(s). Layered architecture of the bearer services in UMTS 4. A TE is connected to the UMTS network by use of a mobile terminal (MT). As the end-to-end service is conveyed over several networks (not only UMTS). and an external bearer service. a UMTS bearer service. the traffic has to pass different bearer services of the network(s). The end-to-end-service used by the TE will be realised using a TE/MT local bearer service. it provides the UMTS QoS. 18 (63) © Nokia Networks Oy CTXX5323en Issue 4.3. TE/MT local bearer service is not further elaborated here as this bearer service is outside the scope of the UMTS network. The external bearer service is not further elaborated here as this bearer may be using several network services.

3. The role of the radio bearer service is to cover all the aspects of the radio interface transport. mobility and mobile subscriber profiles.3. 4. This bearer service uses the UTRA FDD/TDD.Network traffic and radio connection 4. The radio access bearer service provides confidential transport of signalling and user data between MT and CN Iu Edge Node with the QoS adequate to the negotiated UMTS bearer service or with the default QoS for signalling. 4. The backbone network service covers the Layer 1/Layer 2 functionality and is selected according to operator's choice in order to fulfil the QoS requirements of the core network bearer service. The segmentation/reassemble is given by the SDU payload format signalled at radio access bearer establishment. Later also Time Division Duplex is expected to be implemented. CTXX5323en Issue 4. UMTS Terrestrial Radio Access/Frequency Division Duplex will be forming the physical layer in the first phase of UMTS.2 The radio access bearer service and the core network bearer service 2 The UMTS bearer service consists of two parts: the radio access bearer service and the core network bearer service. Iu-bearer services for packet traffic shall provide different bearer services for variety of QoS. To support unequal error protection. This service is based on the characteristics of the radio interface and is maintained for a moving MT.0 © Nokia Networks Oy 19 (63) . The radio bearer service handles the part of the user flow belonging to one subflow. The backbone network service is not specific to UMTS but may reuse an existing standard. The Iu-bearer service together with the physical bearer service provides the transport between UTRAN and CN. Both services reflects the optimised way to realise the UMTS bearer service over the respective cellular network topology taking into account such aspects as.3 The radio bearer service and the Iu-bearer service 3 The radio access bearer service is realised by a radio bearer service and an Iu-bearer service.4 The backbone network bearer service 4 The core network bearer service uses a generic backbone network service. according to the reliability requirements for that subflow.3. UTRAN and MT shall have the ability to segment and reassemble the user flows into the different subflows requested by the radio access bearer service. for example.

MSC. BS Manager UTRA ph. bearer related signalling and control information must be exchanged between the MT. how to set-up the bearer. If one network element is not capable to establish the bearer. the UMTS BS manager of the CN inform the CN BS manager about the QoS parameters for the bearer between SGSN and GGSN. that there is no significant difference for the circuit switched case.UMTS Traffic Management 4. the QoS parameters must be known. so that the affected network elements can determine the required QoS parameters for the end-to-end bearer. Control Subscr Control 3G-(G)MSC/GGSN Adm/ Cap. a peer-to-peer bearer service (BS) signalling between the MT.) The peer-to-peer signalling is necessary. If the UMTS bearer service (BS) manager use the GPRS Tunnelling Protocol (GTP) for QoS negotiation between each other.0 . we refer to MT. Control 3G-MSC/SGSN Adm/ Cap. It 20 (63) © Nokia Networks Oy CTXX5323en Issue 4.4 Managing the bearer through the network The UMTS network is responsible to establish a flexible bearer for user data transport between the Mobile Terminal (MT) and the external networks. (In the next lines. SGSN. TE Translation MT Adm/ Cap. In the bearer set-up phase. and GGSN. and (G)MSC takes place. BS Manager UTRA ph. Please note. If they have agreed on the QoS parameters for the bearer. so that the individual network elements within the UMTS network “know”. BS Manager Iu NS Manager Iu NS Manager BB NS Manager BB NS Manager Figure 13. In case of a packet orientated service request. SGSN. and GGSN. QoS management in the control plane As can be seen. a hierarchical approach is used for bearer establishment: In order to establish a bearer in accordance to the QoS requirements of the user’s circuit switched application. a re-negotiation can be initiated to find an alternative bearer – if the user’s application permits it – or the UMTS PLMN is not capable to offer the requested service. Control UTRAN Adm/ Cap. Control Translation external network UMTS BS Manager RAB Manager UMTS BS Manager UMTS BS Manager Local BS Manager Radio BS Manager Radio BS Manager Iu BS Manager Iu BS Manager CN BS Manager CN BS Manager Ext.

too. Each of this connection is known as a RAB. Iu. The RNC is managing so-called Radio Access Bearer (RAB). the Radio BS manager then determines the radio QoS parameters. voice. RRC is a stack structure. The RNC is responsible for the resource management within UTRAN. IP over Frame Relay. If they have agreed on the QoS parameter on their level. then we need to move the whole RRC. and Internet connection bearer open. if we need to move the RRC (in the case of a handover from one BTS to another). they are made available during operation and maintenance.5 Managing the bearer over UTRAN In UMTS there may be a number of connections between the core network and the mobile. As an example. type of convolutionary coding. in which the RABs are located. But often. Depending on the underlying transmission technology and signalling protocols used. A bearer also must be established between the MT and the SGSN. 4. MSC). a subscriber may have a video. it informs its Iu bearer service manager to negotiate and establish the bearer between itself and the SGSN. The RNC must establish the bearer on Uu. CTXX5323en Issue 4. The whole process is conducted to establish on every physical link within the UMTS operator’s network a bearer in accordance to the QoS required for the subscriber’s application. parameters such as spreading codes.0 © Nokia Networks Oy 21 (63) .Network traffic and radio connection lies then in the responsibility of the CN BS manager to negotiate on how to make the bearer available. The RABs for an individual subscriber are grouped together into a RRC (radio resource control). Therefore. (radio access bearer). The physical parameters for the transmission via the radio interface are then determined in the underlying UTRA physical BS manager. Within the backbone. The RAB manager also informs the Radio BS manager about the required QoS parameter. This means that the subscriber will be using multiple bearers to support each service. Iub. which route to take between the SGSN and GGSN. IP over ATM may be applied. Bearers for signalling can be negotiated. A RAB stand for one bearer/ connection between a MT and a core network edge element (SGSN. they inform then the Backbone network service (BB NS) manager about the set QoS parameter. After determining the QoS parameter internally used from the QoS parameters set by the bearer service manager in the SGSN. and – if required – on Iur. spreading factor. the network elements must conduct signalling to step by step establish the bearer between SGSN and GGSN. etc.

Following the UMTS specific RAB Assignment Request message. a signalling protocol called radio resource control is used. RANAP stands for Radio Access Network Application Protocol. and removed. Student Exercise: Can you think of an example where it may be necessary to modify the radio resource connection? 4.0 . Between SGSN an RNC the Iu-PS bearer is currently an AAL5 virtual channel. modified. The relationship between the RAB and RRC in the UTRAN As the above figure illustrates. It send a RAB Assignment request to the radio resource control unit RNC. modify and release radio resource connection. To control the connection between the network and the mobile.1 Example: Simplified bearer establishment for a call The UMTS bearer service manager in the SGSN requests a bearer set-up between the MT and itself. Then. the different RABs are received by the RNC and combined together to form a single RRC connection. This bearer will be later on used for user data transport and is an AAL2 virtual channel. By use of the protocol. downloading email). This would happen if the subscriber needed an additional service (for example. The 3G Specifications make provision for procedures that allow for the RAB to be added. the network can carry messages that are required to set up. an Iub bearer between Node B and RNC can be established.5. 22 (63) © Nokia Networks Oy CTXX5323en Issue 4. the Iu-PS bearer between SGSN and RNC can be set up in accordance to the required quality of service parameter.UMTS Traffic Management MS RAN CN Packet Data Service Speech Service Video Service d Ra io A ss cce Be r are RANAP Connection Packet Network RRC Connection Radio Access Bearer Radio Access Bearer RANAP Connection Circuit Switched Network Figure 14. The bearer control messages are exchanged between SGSN and RNC with RANAP messages.

data rate). The bearer establishment within UTRAN is very complex and allows a wide range of different options. The Node B confirms this message by returning a Radio Link Configuration Complete message.Network traffic and radio connection A signalling connection already exists between the UE and the RNC. MAC layer characteristics (e. puncturing. This connection is used to send the Radio Set-up Bearer message to the UE. with which the UMTS bearer between UE and SGSN is established. The RNC returns the RAB Assignment Complete message to the SGSN. The UE confirms the Radio Bearer Set-up message with the Radio Bearer Setup Complete message.g.g. Now the bearer between the UE and the RNC exists. Please note. etc. that this example is highly simplified.0 © Nokia Networks Oy 23 (63) . acknowledged/unacknowledged mode). RNC modus (e. RAB establishment (simplified) CTXX5323en Issue 4. The Radio Link Reconfiguration message informs the Node B among others about the physical and MAC layer characteristics of the Uu interface transmission. Node B Uu Iub RNC Iu SGSN RAB Assignment Request Iub bearer set-up (AAL 5 virtual channel) Iub bearer set-up (AAL 2 virtual channel) Radio Bearer Set-up Radio Link Reconfiguration Radio Link Reconfiguration Complete Radio Bearer Set-up Complete RAB Assignment Complete Figure 15. The UE is informed about the physical layer characteristics.

One characteristic of a CDMA network is that there could be simultaneous connections between different base stations and the mobile.5.0 . the radio resource connection must follow.UMTS Traffic Management 4.2 Managing the bearer when the subscriber is moving As a subscriber moves through the network. the base stations are constantly being added and removed from the active set. The below figure illustrates a network with the path of a bearer being connected from end to end (UE to MSC and UE to SGSN). As the mobile moves. It makes sense that the mobile should receive the signal from the BTS with the best signal quality and strength. the signal it receives from the serving BTS will change (possibly decrease as in the below example) and the signal received from a neighbouring BTS will increase. but by transmitting the signal from different sources there are advantages in gain that can be achieved. 24 (63) © Nokia Networks Oy CTXX5323en Issue 4. It is the same information. Mobile has a single RRC 3G MSC RNC 3G SGSN RNC RNC Figure 16. surely it would be better to just use the one connection? In principle this is true. In theory. As the mobile moves. we are able to decrease the interference and power in the radio network. just being transmitted and received by different sources. One common question that students ask is why use the extra resources. The initial situation of an end-to-end bearer connection The base stations that have simultaneous radio resource connections to the same terminal are known to belong to an active set. therefore increasing capacity.

But. The role of the HLR as the centralised database The Home Location Register (HLR) is the central database that stores information on the subscriber. UMTS has a cellular architecture that allows the network to identify the subscriber. the network must keep track on where the mobile is located. As in GSM networks. such as the IMSI and MSISDN.Mobility management 5 Mobility management Note for self-studying You will notice that this chapter quite much repeats the concepts from GSM and GPRS. CTXX5323en Issue 4. please be aware that some new concepts are introduced in this chapter too. 3G MSC Radio Access Core Network RNC Location Updating 3G MSC HLR AuC EIR Service Information 3G SGSN Supplementary Services GGSN Locating the Subscriber 3G MSC RNC 3G SGSN Foreign Network GGSN Figure 17. The system must at least be capable of knowing the geographical area in which the subscriber is located. and the procedures are specified to allow a constant updating of these databases as the subscriber moves around the network. As discussed in the previous section. the network maintains information about the location of a subscriber. The HLR also stores information on which serving MSC and SGSN the subscriber can be found. and also from one network to another. As the user terminals are not fixed to certain positions.0 © Nokia Networks Oy 25 (63) .

5. The location areas are used in the circuit switched domain as the routing areas are used in the packet switched domain. and UTRAN registration areas (URA). if the network needs to locate the subscriber in the case of a mobile terminated call. which is being served by a base station. supplementary and packet services) that the subscriber can/cannot use. The operating size of the cell (CI) can change geographically depending on the parameters used. then all requests are sent to the HLR. 26 (63) © Nokia Networks Oy CTXX5323en Issue 4.0 . routing areas (RA).UMTS Traffic Management Also in the HLR we store information on the subscriber's service profile. In other words. we have a record of the different services (teleservices.1 Cellular architecture The smallest entity within the radio network is known as a cell. The cells are grouped together geographically into location areas (LA). UMTS cellular architecture The above figure illustrates the structure of the network. This may look confusing and overly complex. or if the network needs to check if the subscriber is valid. Therefore. CELL LA = Location Area (MSC) RA = Routing Area (SGSN) URA = UTRAN Registration Area (RNC) Cell = Cell (RNC) Position = Positioning Service (UTRAN) ROUTING CELL CELL URA CELL AREA (RA) CELL CELL CELL CELL URA Location Area (LA) ROUTING AREA (RA) CELL CELL CELL Figure 18. The reasoning behind the structure is to make UMTS backward compatible with GSM and GPRS. A single cell can belong to both a LA and RA and this information is used by the core network for routing information to the radio access network (RAN).

0 © Nokia Networks Oy 27 (63) . the network within a country (MNC). A cell cannot belong to different LA or RA. Student Review: One MSC can have many LAs. the VLR pages the desired UE from the location area it has performed the latest location update. minimum is one cell and the maximum is all the cells under one VLR. the identity must be expanded and in this case it is called cell global identity (CGI): CGI = MCC + MNC + LACode + CI The CGI value covers the country of the network (MCC). In UMTS. To globally separate cells from each other. they must be unique. location area in the network. Thus. the LA does not have any other hardware bindings.1 Network location areas The location area (LA) is used in the circuit switched domain. two separate connections are made for circuit and packet switched data. LAI = MCC + MNC + LA Code Where the MCC and MNC (see previous section) is the same as in IMSI number. The LA consists of cells. LAI is unique number throughout the world. an UTRAN registration area (URA) is introduced to more intelligently monitor the location of a subscriber in the RAN. one RNC may have several location areas or one location area may cover several RNCs. For instance. Therefore. CTXX5323en Issue 4. to reduce the excessive amount of signalling that may occur. The LA code is just a number identifying LA. This information is needed in case of mobile terminated call.1. but an LA cannot cross MSCs. the maximum size of one LA could be the same than VLR area. there is a single connection that can carry multiple bearers. and finally the cell number within the network.Mobility management In GSM. A RA can cross BSCs. A cell can belong to more than one URA. In the location update procedure the location of the UE is updated in the VLR with LA accuracy. 5. It should be noted that in other respects than the VLR. but not MSCs.

For example. through which these nodes may change location information. the VLR may inform SGSN through the Gs interface that the UE should also perform routing area update in order to guarantee packet traffic. In addition. 28 (63) © Nokia Networks Oy CTXX5323en Issue 4. thus reducing the amount of signalling in the network. that is. On the other hand. With URA. When transmitting the paging signal.3 UTRAN registration areas As mentioned before.1. it is the area where the UE may move without performing the routing area update. but not both. 5. and it controls handovers between RNCs. it must identify which cells belong to which RNC.2 Network routing areas The packet switched domain has its own location definitions based on a routing area (RA). Gs.1. the information has to be updated. As a subscriber moves into the geographical range of the RNCs serving area. but not vice versa.0 . the RA is kind of a 'subset' of LA: one LA may have several RAs within it. one RA cannot belong to two LAs. an additional grouping of cells is introduced. LAs and RAs is to ensure compatibility to GSM and GPRS networks. Only when the subscriber moves from the control or supervision of one RNC to another. The reason why these two definitions co-exist is the possibility to have a UE supporting either circuit or packet traffic. if the UE performs a location update. SGSN uses the RNC address when routing packets for a designated user. A routing area is definition-wise very similar than the LA.UMTS Traffic Management 5. the reasoning for having the CIs. At the core network side the VLR and the SGSN can have a common optional interface. As the RNC has greater mobility management functions. the RNC can limit the paging to the URA area. In 3G/UMTS. It means that we can define an URA more flexibly than LA/RA with respect to where people are located (and what patterns of movement they have). the subscriber is allocated into the serving URA. it is also possible to create more accurate demographic areas within the network. the UTRAN registration area (URA).

indoor coverage. the future for UTRAN positioning service is for the provisioning of services that are based upon the subscriber's exact location.Mobility management If the LA and/or RA changes. Unlike the URA. As UMTS networks are designed to work with different types of core network. The aim is to be capable of locating the subscriber within a 50 . the 3G-SGSN still works on the basis of RAs. CTXX5323en Issue 4. Unlike in GSM. However.1. viewing maps. Therefore. which use the triangulation between base stations to measure the delay in signals. and even political reasons. the only way that the network can identify which cells belong to which RNC is based upon the use of URA. which are used for controlling mobility management (that is. LA and RA. the MSC is always responsible for inter-BSC handovers. such as GPS (Global Positioning System).70 m range. the RNC can handle inter-RNC handovers via the Iur interface. subscriber location for call set-up). There are different techniques that can be used. RNC will ensure thatupdated information is sentto the core network HLR &AuC 3G MSC 3G SGSN RNC RNC RNC As the subscriber moves from one URA to another. 5. this may have limitations due to line of sight. As for GPRS. the only new entities are the URA and UTRAN positioning services. RNC and URA architecture in the network Notes on GSM evolution of UMTS The MSC and the VLR still use the LA-based method for mobility management functions for circuit switched operations such as CS call set-up.0 © Nokia Networks Oy 29 (63) . In GSM. Other techniques exist. a URA update is performed URA URA URA URA URA URA Figure 19.4 Location based information services Another characteristic of a 3G/UMTS network is that it is possible to determine a more accurate position of the subscriber by using the UTRAN positioning service. Examples of such services could be emergency calls. and locating the nearest doctor.

UMTS Traffic Management When location updating is active (option that the subscriber can enable with the exception of law enforcement). In UMTS. RA and URA).0 . Figure 20. In a GSM network the BSC took no responsibility for mobility management. For example. there are multiple procedures used to track the subscriber's movements. there are three basic types of location update procedures: • • • Location registration (power on / cell attach) Movement between area Periodic update These are explained in more detail in the forthcoming pages. the mobile's location can be given to the police / ambulance services. then the mobile is constantly informing the network of its current location. 30 (63) © Nokia Networks Oy CTXX5323en Issue 4. Service possibilities 5.2 Mobility procedure . instead the mobile would contact the core networks directly to inform about a change in location. In practice. if an emergency call is made. the situation is different as the RNC not only keeps information on which subscribers are in which URA. This information can then be accesses by different types of service applications. but is also responsible for the location updating to the core network.Location updating As the network maintains three layers of information on the subscriber's location (LA.

Why bother to keep updating a location? The reason is that the network's VLR and SGSN databases are only temporary.1 Location area based procedures Location registration (IMSI attach) takes place when a user equipment (UE) is turned on and it informs the VLR that it is now back in service and is able to receive calls. it is assumed that the information is old. It also informs the core network when the subscriber changes LA and/or RA 3G MSC VLR RNC If the VLR is not informed about the user then the data is removed HLR RNC 3G SGSN Periodically over time if mobile does perform an update When moving from area to area On a cell/LA/RA/URA level The SGSN keeps a track of the mobiles Figure 21. to stop having a huge amount of useless data in the network.Mobility management When switching on/off IMSI Attach/Detach The RNC keeps track of the mobiles within the URAs. the information is only stored for a certain time. The RNC will update its own information about the subscriber within the URA and inform the SGSN and VLR. the information is removed. The TMSI is used for security CTXX5323en Issue 4. via the control channels of the air interface. Related to this process.2. respectively. Location update generic procedures and information in the network As the RNC receives a location updating message. These two numbers are the current Location Area Identity (LAI) and the Temporary Mobile Subscriber Identity (TMSI). it takes responsibility for informing the core network. if the routing area / location area also change. sends the LAI. 5. If there has been no updating. The network.0 © Nokia Networks Oy 31 (63) . the network sends the UE two numbers that are stored in the USIM (Subscriber Identity Module) card of the UE. Therefore. Depending on the parameters that the operator use.

the new VLR/SGSN sends information about this change to the HLR.0 . Such a situation is created when a mobile is switched on but no traffic is carried. IMSI attach/detach (circuit switched) In the circuit switched domain the UE may have two states. The UE continuously analyses its radio environment. there is no need to send a location update request. the new MSC requests the subscriber data from the HLR and then updates the VLR and HLR after successful authentication. it reads the LAI and compares it with the LAI stored in its USIM card. Every time the mobile receives data through the control channels. in which case the mobile is only reading and measuring the information sent by the network. A generic location update is performed if they are different. If it matches. detached. The location registration procedure is similar for both circuit and packet switched domains. If the subscriber is moving within a single location area. Using this IMSI. When the target MSC/VLR receives the request. 32 (63) © Nokia Networks Oy CTXX5323en Issue 4. so that the IMSI of a subscriber does not have to be transmitted over the air interface. Periodic location update is carried out when the network does not receive any location update request from the mobile in a specified time. When the UE is switched off. A timer controls the periodic updates and the operator of the VLR sets the timer value. If not. When the VLR/SGSN is changed. which identifies the MSC/VLR that has served the mobile up to this point. If the subscriber had earlier location information present in the HLR. In case of packet switched domain the MSC/VLRs are replaced with SGSNs. A channel request message is sent that contains the subscriber identity (that is. The mobile starts a location update process by accessing the MSC/VLR that sent the location data. The network broadcasts this timer value so that a UE knows the periodic location update timer values. The TMSI is a temporary identity. which regularly changes. In the attached state the UE is able to handle transactions and it is active in the network. A signalling connection is established between the two MSC/VLRs and the subscriber's IMSI is transferred from the old MSC to the new MSC.UMTS Traffic Management purposes. the UE just informs the VLR that it is now attached again and able to handle transactions. it stores the latest radio environment information into its memory and informs the network that it is now being switched off. LAC and cell identities being 'visible'. it first checks whether the radio environment matches to the one it has in its memory. IMSI/TMSI) and the LAI stored in the USIM card. the HLR cancels the previous location. the UE performs a location area update. The HLR responds by sending the subscriber information to the VLR/SGSN. The VLR stores this state change and the UE is not tried to be reached in case of mobile terminated transaction. it reads the old LAI. When the UE is switched on again. attached and detached.

This could be compared to a handover in UMTS/GSM for circuit switched connections.0 © Nokia Networks Oy 33 (63) . Periodic routing area update is used for checking that a UE that has not performed any routing area updates for some period of time is still reachable.2. the routing area update is very similar to the location update and it is performed for the same purpose. The possibility of buffering data in the Serving GPRS Support Node (SGSN) can be in such cases.2 Routing area update (packet switched) As a procedure. SGSN-1 RNC-1 RA-1 Old cell New cell Figure 22. One SGSN can manage many routing areas. The UE performs a cell update (also cell reselection) when it changes cell within a routing area in Ready mode. The old SGSN then forwards user packets to the new SGSN. an intraSGSN routing area update is performed. CTXX5323en Issue 4. If the new routing area is managed by a different SGSN. it performs a routing area update. Cell update and routing area updates halt possible reception or sending of data. There are two types of routing area updates: the intraSGSN routing area update and the inter-SGSN routing area update. The routing area update When the UE changes cells between the different routing areas. If the new routing area is managed by the same SGSN as the old one. an inter-SGSN routing area update is performed.Mobility management 5.

When there is nothing to transfer. The MM-detached state has the same meaning in both of the CN domains. the MM-state of the connection is MM-connected. The way to suppress the packet connection. From the point of view of SGSN. Mobility management state diagram in packet domain In order to utilise the 3G network resources (such as radio bandwidth) as effectively as possible. Signalling may be opened to the RNC. and it can be said that the MM-state mostly depends on the activity of the connection. MM States in UE: Packet Received Radio Link Release Detach Packet Attach Detach MM States in SGSN: Packet Received Iu Connection Release Packet Attach Figure 23. Between these bursts the connection is not used. In UMTS. 34 (63) © Nokia Networks Oy CTXX5323en Issue 4. That is. when there are packets to send or receive. but still remain the necessary information in both ends of the connection. the MM-state management is as such not enough for the packet switched (PS) traffic. it is in MM-connected state when there is a packet attach/received message.UMTS Traffic Management Cell attach/detach In the core network packet domain the MM-state changes during the packet switched connection. but the MM-connected state is only used when there is actual traffic. This leads to the situation where it is reasonable to 'cut' the connection through the network in order to make the network resources available for other active connections. Therefore.0 . the two figures are purely from the point of view of the UE and the SGSN. Notes on GPRS evolution to UMTS If you are familiar with GPRS. the MM-state of the connection is MM-idle. the RNC has different RRC states depending on the traffic situation. In PS traffic. the above figure about the different states may seem confusing. the traffic delivered can be presented as occasional packet bursts. is called cell attach / detach.

2. must track which URA the subscriber is within. In case of the circuit switched domain: This procedure starts when a MSC requests routing information for the called subscriber from the HLR. the Gateway MSC (the first MSC to realise that this transaction is to be terminated to the same network the called subscriber belongs to) performs the location info retrieval procedure. the subscribers drift through the radio network passing from one RNC to another.3 Location info retrieval (circuit and packet switched) In case of mobile terminated transaction.2. The VLR responds by giving a MSRN. The address of this SGSN is submitted to the GGSN for the data connection establishment.) When the GTP tunnel is established up to the SGSN. In networks where the RNCs are connected through Iur interfaces (as opposed to the MSC controlling handovers). Both domains use the LA and RA respectively to track the subscriber's location. for a circuit switched connection). 5. with which it is able to establish the GTP tunnel between itself and the SGSN. The HLR then asks the destination VLR to provide MSRN for call path connection purposes. The HLR checks its database and finds out the latest SGSN where the subscriber has performed the routing area update. which the HLR forwards to the requesting MSC. The HLR checks its database and finds out the destination MSC/VLR where the called subscriber has performed the location update. CTXX5323en Issue 4. the called subscriber can be paged. The RNC.4 Management of the UTRAN registration areas In UMTS the RNC can handle simultaneous CS and PS connections to the subscriber. In case of the packet switched domain: This procedure starts when the GGSN requests routing information for the called packet data subscriber from the HLR. When the call path is established up to the MSC/VLR. the paging of the called subscriber can be started.Mobility management 5. (GTP = GPRS Tunnelling Protocol. Therefore.0 © Nokia Networks Oy 35 (63) . Now the GGSN has address information. Now the MSC may start the activities for call path connection towards the target MSC/VLR. however. the serving RNC must identify in which URA a subscriber is located when it receives traffic for him/her (that is.

In UMTS. the VLR/SGSN would ask every cell in a certain location area to send the same paging message. MSC) will contact the MSC/SGSN serving that area and request contact to the mobile. the network is able to determine at the very least in which location area/routing area the subscriber is located. The VLR/SGSN will then send a paging message.0 . if the subscriber is known to be located in a certain URA (UTRAN registration area). Routing Area Paging BTS Mobile responds to paging Paging Paging BTS BTS Figure 24. which contains the ID of the subscriber on a dedicated channel in the air interface.g. or receive the SMS).UMTS Traffic Management 5. A mobile in idle mode is always listening to this channel.Paging the subscriber From the HLR. In GSM. Paging in the network If the mobile is able to detect that the network is trying to contact it. The network (e. the mobile will request access to the network to gain a signalling channel to determine what the network is asking (such as set up a call. 36 (63) © Nokia Networks Oy CTXX5323en Issue 4.3 Mobility management . therefore reducing the signalling in the network. the RNC can intelligently page for the subscriber in the URA.

the call still has to be initially placed back to the home MSC. When the subscriber registers in the visiting network. When the network needs to contact him/her (for example to receive a video call). it will in turn contact the home network (remember that part of the IMSI code specifies the home network). User requests access (IMSI Attach) Visitor Network Figure 25. in which the subscriber was last seen.Roaming in another network When a subscriber is in a foreign network. the procedures are the same. Every VLR in the world has a unique address. Roaming in another network Let us take one example: A subscriber is roaming in another network. If the two operators have a roaming agreement and the subscriber is valid. Even if the calling subscriber is located in the foreign network. This information is returned to the MSC and a call is routed to the foreign MSC.0 © Nokia Networks Oy 37 (63) . The HLR is always informed of the unique VLR. the paging process can begin.4 Mobility management . So. The HLR will then contact the serving MSC to check that the subscriber is still located in the VLR (HLR request). information is copied to visitor network (from VLR/HLR) 3. Network Confirm access RNC International Network HLR 3G MSC 3G SGSN BSC 1.Mobility management 5. CTXX5323en Issue 4. If operators have a roaming agreement. the subscriber information is copied into the serving VLR of the MSC and the information on the subscriber is stored in the HLR. Home Network BSC HLR RNC 3G MSC 3G SGSN 2. As a subscriber moves from one network to another. the subscriber's location is always checked from the HLR. the location updating proceeds as normal.

5 Mobility management procedures There are several different mobility management procedures. 38 (63) © Nokia Networks Oy CTXX5323en Issue 4.0 . The specification contains the so-called SDL figures. please check the specifications. the specifications give detailed information on the content of such messages. some of which have been mentioned in this module.UMTS Traffic Management 5. The figures illustrate how signalling messages are passed from one element to another. Also. what happens in case of a failure). in the sequence of time and condition (that is. In the following chapter we will look at some of the procedures in their context of the session management layer: • • • • • • • • • • • • Location registration Location update IMSI attach/detach Routing area update Cell attach/detach Location info retrieval Paging Paging Authentication procedure Ciphering procedure UE identity checking UE hardware (IMEI) checking (CS and PS) (CS) (CS) (PS) (PS) (CS and PS) (CS) (PS) (CS/PS) (CS/PS) (CS/PS) (CS/PS) This chapter has given the initial first look at how mobility management is achieved in a 3G network. If you require more information and a detailed look at different scenarios. The following is a short list of UMTS specified procedures.

when the mobile is activated. CTXX5323en Issue 4. Session management requires procedures from RRM and MM As this chapter will look at the procedures used to obtain a bearer through the network. In this chapter we look at how the mobile is able to access the network and to obtain a bearer. We will also cover two simplified cases of how real time and non-real time bearers are set up in the network. More details on these procedures can be found from the specifications. the aim is to give an overall picture of the procedures used to set up a session. This information is broadcasted by every cell in the network. Therefore. the network planning of frequencies and codes used/shared in inter-boarder areas are selected to reduce conflict. Through co-operation between operators. Communication Management (CM) Session Management (SM) Mobility Management (MM) Radio Resource Management (RRM) UE RAN CN RAN (UTRAN & GERAN) Control Plane Core Network SMSC SCEP Node B HLR &AuC EIR BSC 3G MSC AXC Fiber Node B Internet Fiber 2G 3G SGSN SGSN Node B ATM Access BTS PSTN GGSN RNC Gateway Plane Figure 26.0 © Nokia Networks Oy 39 (63) . Like the previous two chapters.Session management 6 Session management In the previous chapter we looked at the mobility management and how the network keeps track of the location of the subscriber and the procedures it performs. If you remember. it is able to distinguish between operators by checking this information. the first concept to clarify is how a terminal is capable of determining one network from another. each country has its own MCC (mobile country code) and each operator within a country has a unique MNC (mobile network code).

1 Initially accessing the network When the mobile is switched on. to check if it is still valid. the mobile is aware of the possible frequencies that are available in UMTS and all the possible codes (512) that are used by the cells. Previous cell is tried and if not there the terminal scans frequencies and applies codes. and if it is the home network and it is the first time. then it can choose a preferred network (usually set by the home network operator). The subscriber will also be registered into the current URA. If that is not available. If possible home network is selected.0 . The information on the subscriber will be copied to the serving VLR for the MSC area and the current information on the subscriber will be updated to the HLR. The RNC will then request for the location update.UMTS Traffic Management 6. Without going into too much detail about the air interface. The procedure of network selection can be made manually. If the home network is not present. Initial network access (switch on) On the selection of the network. 40 (63) © Nokia Networks Oy CTXX5323en Issue 4. but it is usually performed automatically. the mobile will request a location update (IMSI attach) of its position. The mobile will first check the last frequency and code (used to identify the cell). the mobile will start applying each code to each possible frequency in an attempt to detect a signal that will indicate that there is a cell present. the mobile will select as first choice its home network (information of this is on the SIM). the update is made. If the cell cannot be found. the mobile will randomly select another network providing the signal level is adequate. Once the scanning process is over. it starts the network selection procedure. RNC HLR 3G MSC Operator A (frequency 1) 3G SGSN Operator B (frequency 2) Networks transmit information about themselves (MCC+MNC) Operator C (frequency 3) Figure 27.

When the user switches on the mobile again. The packet core domain is also updated with the new location information.) After a successful authentication (3). New VLR requests and receives authentication information and IMSI from previous VLR 3. Request Location Update (IMSI Attach) 2.1 IMSI attach for an existing subscriber If the subscriber is already registered in the network and is still registered in the same VLR. Authentication request and response 4. Moreover. HLR cancels the old location. RNC also keeps information about subscribers within the URA. RNC 3G MSC 4. Figure 28. New MSC/VLR updates HLR with new location. Moving the subscriber's information between VLRs Let us now assume that the mobile has moved between to VLR areas while being switched off. a location update request will be transmitted to the new VLR (1). after which the HLR sends the subscriber information to the new VLR (4).0 © Nokia Networks Oy 41 (63) . (Similar steps would take place between the UE and the SGSN in case of a routing area update. 6. HLR sends acknowledgement and subscriber information. HLR AC EIR 5. 2. and cancels the old VLR (5). 5. 1. the HLR is updated with the new location information. CTXX5323en Issue 4. The figure above shows such a case.Session management 6.1. 3G MSC 3G SGSN 3. an acknowledge message is sent to the mobile. Also the HLR is informed of the new information. Finally. the RNC is constantly keeping track of all the connected subscribers' current URAs. Then the authentication and IMSI information is copied between the old and the new VLR (2). old VLR sends acknowledgement 6. the information is updated. together with the TMSI/TMUI number (6). TMSI/TMUI allocation/acknowledgement and location update acknowledgement 1.

Requesting a bearer from the network 42 (63) © Nokia Networks Oy CTXX5323en Issue 4. As two operators have a dedicated signalling link. the mobile must make a request to the network.3 Requesting for a dedicated bearer When the mobile does not have a RRC (radio resource connection) to the network. If we wish to have a service.UMTS Traffic Management 6. 6. the network will attempt to secure a bearer. The HLR is updated with information on the unique VLR/SGSN address where the subscriber is located. Figure 29. 1.1. we require a bearer. namely the RACH (Random Access Channel). RNC will allocate a bearer for the subscriber Mobile in idle mode and camping on a cell.1. In the air interface there is a special physical channel that is used to receive request messages from the mobile. when the subscriber requests a service (such as video call or Internet connection). it is known to be in idle mode. Depending on the type of channel that the subscriber is interested in. Mobile sends a request for a bearer (on RACH and listens for reply) HLR 3G MSC RNC 3G SGSN 2.2 IMSI attach when roaming The procedure for updating the VLR/SGSN when the subscriber is in a visiting network is exactly the same as described above.0 . then information is copied into the visiting network. Therefore.

But if a persistent tracking of users would occur. When the network receives the request. he/she would be quite irritated. e. Privacy and confidentiality are largely synonymous in this presentation. It is required that end users of the system are authenticated. as well as the confidentiality of transmitted user data.g. it estimates an appropriate level. 6.4 Access security in UMTS In UMTS requirements for access security are not changed. CTXX5323en Issue 4. Then the mobile sends a short burst of information. i. If not. to use ciphering (or. the mobile must re-transmit again. it is checked that all control messages have been created by authorised elements of the network. which includes a random sequence to the random access channel. If the mobile detects this signal. encryption). Most of the time an average citizen does not care whether anybody can trace where he/she is. it will re-transmit the random part of the initial burst on a separate channel. identity of each subscriber is verified. Network operators consider reliability of the network functionality to be important: they want control inside network to function effectively..0 © Nokia Networks Oy 43 (63) . This is the most effective way to protect communications against malicious purposes. In general. the network will transmit on a different channel information about the channel that the mobile can use. synonymously.1. The confidentiality of voice calls is protected in radio access network. It is sometimes useful to make communication deliberately incomprehensive. insertion. Also. given that one is available. Similarly. i. when the mobile attempts to gain access to the network.g. e. That consists of various techniques which all have roots in the science and art of secret writing. nobody wants to pay for calls that are made by a cheating impostor.Session management How to gain access without interfering with other mobiles too much? Technically. it is not aware of the power level to use.e. The most important ingredient in providing security for network operators and subscribers is cryptography. integrity checking protects against any manipulation of a message. privacy of the user data is a critical issue when data is transferred through the network. but using more power. Then. Availability of the UMTS access is clearly important for a subscriber who is paying for it. for burglars. Privacy of the user's whereabouts is generally appreciated. it assumes that the network has heard it.e. Hence. exact information about location of people would be useful.. Users also want to know that the confidentiality protection is really applied: visibility of applied security mechanisms is needed. This is guaranteed by integrity of all radio network signalling. This process continues until either the power level set by the network is reached or the network responds. deletion or substitution. This means that the user has control of choosing the parties with whom he/she wants to communicate.

more specifically USIM (typically in a smart card) 44 (63) © Nokia Networks Oy CTXX5323en Issue 4.1.1 Mutual Authentication There are three entities involved in the authentication mechanism of the UMTS system being: • • • Home network Serving network (SN) Terminal. terminal. Authentication codes and keys are stored and generated in the AuC The SIM and terminal contain authentication keys Figure 30.4. Algorithms for mutual authentication are operatorspecific. Network authentication UMTS security features The most important security features in the access security of UMTS are the following: • • • • Mutual authentication of the user and the network Use of temporary identities Radio access network encryption Protection of signalling integrity inside UTRAN Note that publicly available cryptographic algorithms are used for encryption and integrity protection. 6. Each of these features are described in the following subsections.0 . location and services.UMTS Traffic Management Information is checked from the HLR The IMSI and IMEI are checked (optional and at a changeable interval) RNC HLR 3G MSC 3G SGSN The HLR contains information on the subscriber.

These control messages are carried on the MAP protocol. It is a basic principle in cryptography to limit the use of permanent keys to minimum and instead derive temporary keys from it for protection of bulk data. CTXX5323en Issue 4. These are temporary keys with the same length of 128 bits. A quintet consists of five elements: • • • • • a network challenge RAND. an expected user response XRES. The key K is never transferred out from the two locations. permanent identity IMSI or temporary identity TMSI. the user has no knowledge of her/his master key. a cipher key CK. The AuC contains master keys of the users and based on the knowledge of IMSI the AuC is able to generate authentication vectors for the user. has been transmitted to VLR or SGSN. New keys are derived from the permanent key K during every authentication event. keys for encryption and integrity checking are derived. The generated vectors are sent back to VLR/SGSN in the authentication data response. We describe now the Authentication and Key Agreement (AKA) mechanism at general level. The security is based on the Quintet. At the same time with mutual authentication. The identification occurs when the identity of the user.0 © Nokia Networks Oy 45 (63) . an integrity key IK a network authentication token AUTN The cornerstone of the authentication mechanism is a master key K that is shared between the USIM of the user and the home network database.e. UMTS authentication vector: temporary authentication and key agreement data that enables an VLR/SGSN to engage in UMTS AKA with a particular user. The authentication procedure can be started after the user is identified in the serving network. The latter part is a new feature in UMTS (compared to GSM) and through it the terminal can check that it is connected to a legitimate network. The generation process contains executions of several cryptographic algorithms.Session management The basic idea is that the serving network checks subscriber’s identity (as in GSM) by a so-called challenge-and-response technique while the terminal checks that serving network has been authorised by the home network to do so. This process is depicted in figure below. Then VLR and SGSN send an authentication data request to the Authentication Center (AuC) in the home network. This is a permanent secret with the length of 128 bits. For instance. i.

In the case of match. This message contains two parameters from the authentication vector. The USIM contains the master key K. The serving network (VLR or SGSN) sends a user authentication request to the terminal.e. the computed parameter RES is sent back to VLR/SGSN in the user authentication response. in the positive case.UMTS Traffic Management VLR SGSN AuC IMSI RAND K SQN XRES AUTN CK IK RAND. i.31 Authentication Data Request and Authentication Data Response In the serving network. This process also contains executions of several algorithms. AUTN. for each run of the authentication procedure. i. As the result of the computation USIM is able to verify whether the parameter AUTN was indeed generated in AuC and. called RAND and AUTN. one authentication vector is needed for each authentication instance. Indeed. USIM carries out a computation that resembles the generation of authentication vectors in AuC. This part of the process is depicted below. 46 (63) © Nokia Networks Oy CTXX5323en Issue 4. the VLR/SGSN may fetch new authentication vectors from AuC well before the number of stored vectors runs out. These parameters are transferred into the USIM that exists inside a tamper-resistant environment. in UMTS IC card (UICC). as is the case in the corresponding AuC computation. CK. IK Figure 6.e. This means the (potentially long distance) signalling between SN and the AuC is not needed for every authentication event and it can in principle be done independently of the user actions after the initial registration. authentication ends positively. and using it with the parameters RAND and AUTN as inputs. Now the VLR/SGSN is able to compare user response RES with the expected response XRES which is part of the authentication vector. XRES.0 .

the USIM is able to compute CK and IK as well after it has obtained RAND (and verified it through AUTN). are transferred to the VLR/SGSN. The sequence number SQNHE is an individual counter for each user and the sequence number SQNMS denotes the highest sequence number the USIM has accepted. On the other side. The SQN is a counter. These keys are later transferred further into the RNC in the radio access network when the encryption and integrity protection are started. CTXX5323en Issue 4. are created as a by-product in the authentication process.32 User Authentication Request and User Authentication Response The keys for radio access network encryption and integrity protection. namely CK and IK. These temporary keys are included in the authentication vector and. thus. AUTN RAND K AUTN RES SQN CK IK RES UE checks whether the SQN is big enough VLR/SGSN checks whether RES = XRES Figure 6.0 © Nokia Networks Oy 47 (63) .Session management UE VLR SGSN RAND. There are two SQNMS and SQNHE respectively to support network authentication. Temporary keys are subsequently transferred from USIM to the mobile equipment where the encryption and integrity protection algorithms are implemented.

UMTS Traffic Management

In UMTS, multiple air-interface channels are used in the connection to the mobile



Ciphering is performed in the RNC and the mobile

Authentication codes are used to create a signal which is scrambled with the data. It is almost impossible to decode the signal without knowing the keys

Figure 33.

Ciphering in UMTS/UTRAN


Managing a real time (circuit switched) bearer
The following section describes how a real time bearer is allocated. The whole process is summarised in a figure at the end of this chapter, with brief descriptions of the steps. The next two pages discuss the process in more detail. At the first stage of any mobile originated action, a signalling channel needs to set up between the mobile and the RNC. This channel is used to verify the USIM, to identify the subscriber, to find out what the subscriber needs, and to perform the authentication procedures. The mobile will request a connection (1), the RNC will then instruct a BTS to reserve a signalling channel (2), and through a common channel (that is, all mobiles in the area can share), inform the mobile which channel to use (3). The mobile can then use the signalling channel to communicate with the RNC. The mobile will now inform the RNC what are its service or bearer requirements. If the mobile just wishes to perform signalling, the already dedicated channel will be sufficient (that is, location update). A subscriber wishing to access the Internet will be discussed in the next section. Should the subscriber wish a QoS assured service (such as voice), the RNC forwards the call set-up message to the CS-CN (5). Depending how the network is configured, the subscriber's identity is checked before any bearer set-up

48 (63)

© Nokia Networks Oy

CTXX5323en Issue 4.0

Session management

proceeds. These transactions are usually performed not by using the subscribers IMSI, but by the TMSI. If this is not available, then the IMSI is used. The network will check if the subscriber is allowed to use the service. Also, it is possible that the user equipment can be crosschecked to ensure that it is valid. In the case of a call, the RNC informs the CS-CN (MSC) that a traffic channel is needed. The MSC will respond to the RNC with information about the bearer it should provide (6). In return, the RNC will allocate the correct bearer service to mobile in the radio network (7). Once the connection is made, the RNC informs the MSC that the connection is complete and the transaction can start (8). The system knows that a voice/video call is required, so the MSC or Media Gateway (MGW) understands where the end point should be. In this case, the subscriber wants to call to another mobile. The procedure is the same as in GSM, where the HLR enquiry is sent from the MSC/VLR (9). The HLR will now request the MSRN (Mobile Station Roaming Number) from the target VLR (10). The HLR will also inform the requesting MSC of the MSRN of the target subscriber (11). The serving MSC will now contact the target MSC in order to make the final connection to the subscriber (12). The target MSC will now page the called party. As the VLR only knows the location area of the subscriber, then all the cells in the target LA are requested to send a paging message (13). The mobile will then answer by requesting a signalling channel. If the call terminates in a UMTS network, a similar bearer assignment procedure will happen as described in steps 1 - 8 above. The set-up procedure for the target subscriber starts with the allocation of a bearer for a signalling channel. The subscriber identity is checked and a bearer for the traffic channel is allocated. Once the radio access bearer is in place, the RNC will respond with a confirmation of the set-up. Now, the two parties can start the conversation. This process provides a basis for UMTS to add easily into an existing GSM network. In case of services such as video, the core network will either have a direct connection via an ATM network, or through a server that supports video streaming. In the next figure, a simplified UMTS originated - GSM terminated call set-up case is shown. This case clearly shows that specifications have as much as possible been based on the GSM procedures.

CTXX5323en Issue 4.0

© Nokia Networks Oy

49 (63)

UMTS Traffic Management










1. Radio Resource Connection Request 2. Radio Link Setup 3. Radio Resource Connection Setup 4. RRC Setup Complete 5. Call Setup 6. Bearer Assignment Request (Create) - Bearer Parameters and Binding ID 7. RAB Setup / Radio Link Modification 8. Bearer Assignment Complete 9. HLR Enquiry 10. Send Routing Information (MSRN) 11. Call Setup Continues 12. Paging 13. Paging Response 14. Setup 16. Conversation 15. Call Confirmed/Alert

Figure 34.

Simplified UMTS originated – GSM terminated call set-up

Summary of the steps in the figure: 1. 2. 5. 6. A radio resource connection request for a signalling channel is requested. The RNC sets up the radio link between the base station and itself. Call set-up message to the MSC/VLR. Security procedures are also performed (not shown in the figure above). Bearer assignment request. In this step, the bearer parameters are defined; also a binding identification number is allocated. Binding ID is used to tie together control information with user data for a certain connection. Radio access bearer set-up and radio link modification. Given the inputs from the MSC/VLR concerning the bearer, the RNC allocates an appropriate radio access bearer (RAB) in the air interface. Also the radio link between the BTS and the RNC is modified in accordance with the bearer need. The RNC informs the MSC/VLR that the bearer has been assigned.

3-4. RRC set-up (downlink) and RRC set-up complete (uplink) messages.



9-17. Since the circuit switched core network (CS-CN) is common for UMTS and GSM, the call set-up procedures within the CN are the same, including HLR enquiry, MSRN allocation, etc. Note also that for calls terminating in a UMTS network, a bearer and a radio link in the terminating side should be allocated in a similar way as in the originating side.

50 (63)

© Nokia Networks Oy

CTXX5323en Issue 4.0

The PDP context terminology and the GTP (GPRS tunnelling protocol) are discussed after that. for example. At this stage the RNC is not yet aware what service the subscriber wishes to use. One GGSN could have several different access points to different networks (4). The new element Media Gateway (MGW) for 3G-MSC is responsible for converting the Iu (UMTS) messages to be compatible with the MSC (A-interface). Now it is time for the mobile to request a bearer. which is the most logical solution. then a dynamic IP address needs to be allocated). Furthermore. then the Equipment Identity Register (in HLR) is interrogated (not shown in the figure).Session management Notes on GSM evolution in the Nokia solution The function of the MSC is the same as in GSM. Also. The whole process is shown in figures at the end of the next page. The same way as the circuit switched (CS) management is based upon GSM. access point name (APN) and the IP address (if the field is empty. as the mobile first requests a signalling channel from the network (1). It is thus possible to authenticate the UE (USIM) (5). the SGSN received the subscriber information from the Home Location Register (HLR). AMR) are located in the Media Gateway. Also IMEI checking may be performed. security information for authentication and encryption is stored in the SGSN. as it allows more cost-efficient transmission. Then. In this request are. The interface leads to an external packet network. The APN is a symbolic name for a network interface in the GGSN. If IMEI checking is performed. The Iu interfaces offer more service possibilities than the A-interface. 6. the voice transcoders (which are based upon adaptive multi-rate codecs. The effect is that the MSC recognises and treats UMTS calls in a similar way than GSM calls.0 © Nokia Networks Oy 51 (63) . therefore it will allocate a dedicated signalling channel (2-3) and inform the mobile which channel to use. the SGSN checks the subscription data. The MGW for 3G-MSC (3G-IWU) also has to convert the ATM connection into PCM to make it compatible with the MSC. The process also starts in the similar way. Unlike in GSM. An acknowledgement is also sent from the mobile. the 3GPP Specifications have finally stated that the transcoding function also logically belongs to the core network. the management of packet switched (PS) bearers is based upon GPRS. CTXX5323en Issue 4. when the subscriber made a routing area update.3 Managing a non-real time (packet) bearer This chapter describes the PDP context activation and the allocation of a nonreal time bearer. Therefore MGW also supports these services. The last part of the chapter shows the signalling when the user quits the connection. Earlier. References to the different steps are found in the text below.

It is a physical or logical interface in the GGSN. The APN is associated with the external network the subscriber wants to use. which includes given IP address. 52 (63) © Nokia Networks Oy CTXX5323en Issue 4. The SGSN now sends a 'Create PDP Context Request' message to the GGSN (8). The DNS finds the correct GGSN IP address based on the access point name (APN). The request includes the APN and the proposed tunnel identification (TID). The 3G-SGSN is now ready to route user traffic between the user equipment and the GGSN. TID confirmation. This is followed by (10) the 3G-SGSN sending a bearer assignment request (Create) to the RNC. Finally. the access point is its ‘default gateway’. One could say that the access point is similar to the default gateway defined for a normal IP-subnetwork − it is a point out from the subnetwork. and a charging ID. When this is done. TID consists of the IMSI number and the network service access point identifier (NSAPI). The SGSN gets the GGSN IP address from the Domain Name Server (DNS) (6-7).UMTS Traffic Management The next step of context activation is to find the requested GGSN and send the request for context creation to it. whose primary function is user authentication. The external element may be a Dynamic Host Configuration Protocol (DHCP) server. which issues dynamic addressing information. For the UE.0 . In the case of a dynamic address. The GGSN now selects the access point it will use (not shown in the figure). The external element might alternatively be a Remote Access Dial In User Service (RADIUS) server. the RNC will send a message to 3G-SGSN to notify that the bearer assignment is completed (12). the 3G-SGSN can send an 'Activate PDP Context Accept' message to the UE (13). NSAPI is used as a reference number of the PDP context. In (9) the GGSN sends a 'Create PDP Context Response' back to the 3G-SGSN. the GGSN or an external network element can issue the IP address. The RNC will then modify the radio link and set up the bearer over the air interface (11).

Radio Resource Connection Setup / Complete 4. In SM active state the network has routing information available and it is possible to transfer data between the UE and the network. PDP context activation A very important concept of the packet switched session management is PDP context (PDP = Packet Data Protocol). Create PDP Context Request. RAB Setup / Radio Link Modification 12. offered QoS 11. The inactive state means that the packet data services related to a certain PDP address are not active. GGSN address resolution Request (APN) 7. Authentication 6. QoS. PDP Context Activation Accept: NSAPI. the PDP context information is not updated. APN. IP address if available) 5.Session management PDP: Packet Data Protocol APN: Access Point Name GTP: GPRS Tunneling Protocol UE BS RNC 3G-SGSN DNS GGSN-1 1. If the location of the UE changes. CTXX5323en Issue 4. Radio Link Setup 3.(Access Point Name. offered QoS PDP PDU GTP PDU GTP PDU Figure 35. Dyn. active and inactive. given dynamic IP-address. Charging Id 10. The PDP context is an entity defining all required information for the UE – network connection establishment. The PDP context is used for two purposes: for PDP address allocation to the user and to make a logical connection with the required/desired QoS (Quality of Service) level through the 3G network. IP-address. PDP-Context Activation Request . Create PDP Context Response. the network does not have any routing information available for that PDP address and thus it is not possible to transfer any data. Bearer Assignment Request (Create): NSAPI. GGSN address resolution Response 8. Radio Resource Connection request 2. Bearer Assignment Complete 13. Dynamic IP Address 9. Also the UE location information is updated in the PDP context. From the session management (SM) point of view.0 © Nokia Networks Oy 53 (63) . the PDP context has two states.

User packet Us er P ac ke t U s er et pa c k User packet User packet RNC 3G SGSN GG SN Th e stre am o f of containers The stream c ontain ers form ing a tun ne l. One allocated PDP address may have many PDP contexts and one PDP context always has one QoS class (QoS profile). The GTP tunnel 54 (63) © Nokia Networks Oy CTXX5323en Issue 4.PDP Context Activation Rejected .PDP Context Deactivation (last) .0 . Between the RNC.Packet Data Detach . This makes it possible to have many packet data connections. for instance. the packet data protocol is used.PDP Context Activation .PDP Context Modification . The UE may. each of them simultaneously having a different QoS. Between the mobile and the radio network controller (RNC).PDP Context Deactivation Figure 36. As the network connection is established. and the GGSN the packet of Internet data is transferred in the GPRS tunnelling protocol (GTP). packets of data in the PDU are transferred through the network by using different types of protocols. PDP context states The figure illustrates how the different PDP context procedures are used in different session management states. be used for software downloading and web browsing at the same time.PDP Context Activation . form a 'tunnel' Figure 37. 3G-SGSN.UMTS Traffic Management .

PDP Context Deactivation Accept 3. A request is sent from the mobile. it is inserted into a container and sent to the SGSN. CTXX5323en Issue 4. the RNC sends an acknowledgement to the 3G-SGSN (5). The stream of containers from RNC all the way to the GGSN is totally transparent to the user.Session management The user data packets are carried from RNC to GGSN via 3G-SGSN in ‘containers’. Bearer Assignment Complete (Release) Figure 38. Radio Link Release 5. the radio resources are then released (3-4). Once the mobile is deactivated. or to an application. PDP Context Deactivation Request 2. Bearer Assignment Request (Release) 4. The container is then opened and packed into a new container towards the RNC. The user quits the connection Although the connection may remain active for some time. through the RNC to the 3G-SGSN to release the resources (1-2). Finally. In data communications this type of virtual stream of containers is called a tunnel – the GSNs and RNC perform tunnelling of user packets. the mobile may deactivate the PDP context. It seems as if the user is connected directly via a router to an external network. When a packet from an external packet network arrives at the GGSN. This is shown in the figure above. UE BS RNC 3G-SGSN 1.0 © Nokia Networks Oy 55 (63) .

security and charging of a bearer. The subscriber's applications and control components sit upon the bearer. Also. The below figure illustrates the services and control of the services that sit upon the physical connection.personalisation . there are a few notes about emergency calls and charging. 56 (63) © Nokia Networks Oy CTXX5323en Issue 4. manage the connection through mobility management.. It is the role of communication management to route the bearer to the high application layers. communication management in UMTS is all about managing mobility.push control . • Subscriber's service profile ..UMTS Traffic Management 7 Communication management A UMTS network is a platform to give the operator's the best solution to provide a varied amount of services. Therefore. • Security • Mobility • Charging information collection Service and customer application control Network Application Intelligence Connection Figure 39.. End user application • Email • MO-MT SMS • etc.0 . Functions of communication management The communication management needs the services of the lower layers. as these maintain the bearer..etc.billing of service . This chapter exemplifies the high level functions in terms of the call control process for circuit switched calls.location information . and handle the bearer security and charging for the session.

Number analysis investigates both the calling and called numbers and makes decisions based on the rules defined.Wrong Dialling . When the correct destination for the call is known. routing. Call control can functionally be divided into three phases. A call coming in Number Analysis Routing A call going out Charging I Fail: . the system checks if the call requires any inter-working equipment (like a modem) to be connected and if the call is chargeable or not. Generally speaking. In Phase I the switch checks whether the called number is reasonable at all and if any restriction such as call barring is to be applied with the calling number. and charging. Also statistics for this call is initiated in this phase.Communication management 7. the system starts to set up channel(s)/bandwidth towards the desired destination by CTXX5323en Issue 4. which the call attempt must pass in order to perform through connection.Restrictions .Service Not Supported Figure 40.1 Call control for circuit switched (real time) calls Call control is a high-level name describing the functions required for incoming and outgoing call handling within a switch. Number analysis is performed both in call control Phase I and Phase II.Circuits Not Available . The nature of the call is investigated: Is it an international or national call and is there any routing rule defined for the called number at all? In addition. the system knows where the call attempt should be routed.InterWorking Failure III Fail: . Number analysis is a collection of rules how the incoming call should be handled. As a successful result of call control Phase II. Those activities are number analysis. the switch should perform three activities before a call can be connected through.0 © Nokia Networks Oy 57 (63) .Unsuccessful Setup . Call control principles In call control Phase II the system concentrates on the called number.Unreasonable Numbers II Fail: .

When the call is finished. This network feature is called AoC (Advice of Charge) and is a supplementary service. Operators select what causes a CDR to be generated.UMTS Traffic Management using. ISUP signalling protocol. MSC. the amount of information contained in the CDR has been increased to include details of the service quality and the network elements used. An event could be a call. Collection of charging data As part of the evolution from GSM/GPRS towards UMTS. data usage. call control Phase III takes care of releasing all the resources related to the call. The CDRs are transferred to the Billing Centre where the information is collected and priced. 58 (63) © Nokia Networks Oy CTXX5323en Issue 4. the UMTS Specifications describe features that allow the subscriber to see more information on the cost of a service. HLR 3G MSC RNC Charging Gateway 3G SGSN GGSN Billing Centre CDR (Charging Data Records) are sent to the Billing Centre Figure 41. and in fact almost any different type of network activity.0 . During the call.2 Generation and collection of charging data The 3GPP Specifications give a detailed list of requirements for the type of CDR (charging data record) to collect. The Charging Gateway. SMS. which describe different events in the network. Also. for instance. 7. which give the subscriber details of the service cost almost immediately. the switch stores statistical information about the call and its connection and collects charging information (if the call was judged to be chargeable). HLR and many elements within the service platform generate CDRs. location update.

based upon location RNC HLR 3G MSC To different regional call centres Location Based Server 3G SGSN GGSN No checking is done (also SIM does not need to be active) to make emergency call If location based services are used. Handling emergency calls CTXX5323en Issue 4.0 © Nokia Networks Oy 59 (63) . The MSC defines if calls are allowed and where they should be routed to. the operator can check in which location the subscriber is based and hence direct the emergency services to the scene more quickly than today.Communication management 7.3 Note on handling emergency calls In UMTS (and in the evolved GSM). when location based servers are in place. then the emergency services can gain accurate information on the subscriber's location Figure 42. it will be possible to actually specifically locate the subscriber within 50-70 m. When an emergency call is received.

f. b. e.0 . f. c. c. b. In which network elements is security related information located? a. IMSI IMEI MCC P-TMSI TMSI PIN 3. d. d. e. b. d. 1. The aim of the review is for you to reflect and apply what you have studied. Which location information is known in the UE? a. LA RA URA 3G-MSC supply area 3G-SGSN supply area 60 (63) © Nokia Networks Oy CTXX5323en Issue 4. c. 2. USIM RNC AuC SGSN Node B non of all above Which parameter identifies the subscriber? a.UMTS Traffic Management 8 Review questions Please spend some time to complete the following review questions. e.

d. True ❏ False ❏ CTXX5323en Issue 4. b.0 © Nokia Networks Oy 61 (63) . c. 7. IMSI attach is always made when the terminal is switched on. The URA (UTRAN registration area) is used by the core network to keep track of subscribers in the network. b. Variable data rate Transparent through the RAN Different lengths of delay Asymmetric connection None of the above. Used in the RNC ______________________ Used by the CN PS Domain ______________________ Used by the CN CS Domain ______________________ What other information is kept? __________________ __________________ __________________ __________________ 6. Periodic location updates are not used in UMTS. fill in the missing names of the cellular network architecture. e.Review questions 4. Location/routing area update takes place when a subscriber moves between LAs and/or RAs. 5. d. None of the above. Which of the following sentences about location update is not true? a. In the following figure. c. Which of the following is/are characteristic(s) of a UMTS bearer? a.

c. Which of the following sentences best describes authentication? a. If data is being transferred from the packet core to the mobile. 12. The operation of requesting a subscriber to contact the network is called: a. d. c. The mobile is in ____________ mode when it does not have any connection state. The mobile is in ____________ mode when it is camping on a cell. It is only used in GPRS networks. b. c. which information us transmitted from the UE to the SGSN? a. During a PDP context activation process. APN PDP GGSN address DNS address TID 62 (63) © Nokia Networks Oy CTXX5323en Issue 4. idle and connected. b.UMTS Traffic Management 8. c. In UMTS a terminal has two states. b. identify which state the mobile is in. d. then the state is _____________ . c. a. d.0 . b. It is a collection of radio access bearers over the air interface. IMSI attach Location update Paging Bearer allocation 10. Security of the user information on the air interface IMSI and IMEI checking Supplementary service status checking (by the subscriber) A process used by the GGSN to determine firewall access 11. All of the above. 9. d. e. In the following list. b. It is a wireless protocol. Which of the following sentences about the RRC (radio resource connection) is true? a.

b. c.0 © Nokia Networks Oy 63 (63) . True ❏ False ❏ CTXX5323en Issue 4. When a subscriber triggers an event in the network (for example a call). 14. SMS messages can be sent via the SGSN.Review questions 13. a CDR is generated. which is a bill that is sent to the customer All of the above. d. What is a CDR? a. Charging data record which is sent to a Billing/Charging Centre Caller digital reset to the MSC Customer data receipt.

Sign up to vote on this title
UsefulNot useful