PART 5

GSM Switching & Mobility

Le ct u r e 5 .1
Pr ot ocol a r ch it e ct u r e ove r vie w

Giuseppe Bianchi

The GSM network layer

D ivide d in t h r e e su b- la ye r s
Radio Resource Management (RR)
Provides a communication link
between MS and MSC;

Mobility Management (MM)

CM

Communication Management (CM)

MM

Manages DB for MS location

Controls user connection

Un de r lyin g ba se :
Transmission level

RR
Transmission

Giuseppe Bianchi

RR
M a n a ge s a dm in ist r a t ion of fr e qu e n cie s a nd ch a n ne ls
Mostly deals with air interface
Several RR functions considered in previous part

Gu a r a n t e e s st a ble lin k u pon h a n dove r

Surprise! handover is part of RR, not MM!

Fu n ct ion su m m a r y:
Monitoring BCCH, PCH
RACH administration
Request/assignment of channels
MS power control & synchronization
Handover
W h e r e is RR:
MS, BTS, BSC, MSC
Giuseppe Bianchi

MM
M a n a ge s use r loca t ion a n d t a sk s r e su lt in g fr om
m obilit y
Fu n ct ion su m m a r y:
TMSI assignment
MS localization
Location updating
MS authentication
MS identification, attach/detach
W h e r e is M M :
MS, MSC

Giuseppe Bianchi

CM
Con t r ols ca lls, su pple m e n t a r y se r vice s, a n d SM S
Fu n ct ion su m m a r y:
Call establishment (from MS, to MS)
Emergency call management
Call termination
DTMF signaling (Dual Tone MultiFrequency)
In-call modification
W h e r e is CM :
MS, MSC, GMSC

Giuseppe Bianchi

Protocol placement
CM
GMSC

MM
HLR

RR
Trans.
MS

BTS

BSC

MSC
(VLR)

Giuseppe Bianchi

Protocol outline
MS

BTS

Relay
MSC

BSC

CM

RIL3-CC

MM

RIL3-MM

RR

RIL3-RR

RSM

Anchor
MSC

HLR

MAP/D

BSSMAP

MAP/E
TCAP

LAPDm

LAPD

RIL3: Radio Interface Layer 3

RSM: Radio Subsystem Management
BSSMAP: BSS Management Application Part
MAP: Mobile Application Part

SCCP
MTP

SCCP
MTP

SCCP
MTP

TCAP: Transaction Capabilities Application Part

SCCP: Signaling Connection Control Part
MTP: Message Transfer Part
LAPD: Link access Protocol on D channel
LAPDm: Link access Protocol on Dm channel

Giuseppe Bianchi

PART 5
GSM Switching & Mobility

Le ct u r e 5 .2
h a n dove r ( ph ysica l m obilit y)

Giuseppe Bianchi

Neighbor cells
BTS
2

BTS
1

BTS
n

A st a t ion m u st :
monitor beacon power level of neighbor cells
Keep detailed track of best 6 neighbor cells
DECODE their BCCH (i.e. read FCCH, SCH) to get parameters
At least once every 5 minutes
BSIC (from SCH) refreshed every at most 30s

Giuseppe Bianchi

Camping cell selection

path loss criterion C1

C1(n) = RXLEV(n)
RXLEV_ACCESS_MIN

Select cell with greatest c1(n)>0:

max[0, (MS_TXPWR_MAX_CCH P )]

RXLEV(n): received power from BTS(n)

RXLEV_ACCESS_MIN: minimum received power level required for registration in the cell
(parameter transmitted on BCCH; typically 98 to 106 dB)
MS_TXPWR_MAX_CCH: maximum allowed transmitted power on RACH
(parameter transmitted on BCCH; typically 31-39 dBm)
P: maximum MS power (from MT class)

When cell parameters are the same, simply select cell with higher RXLEV!
Giuseppe Bianchi

Cell reselection criterion (C2)

Re se le ct ce ll w it h gr e a t e st C2 > 0 :

C2(n) = C1(n) + CELL_RESELECT_OFFSET

TEMPORARY_OFFSET H(PENALTY_TIME T)
0 x < 0
where H(x) =
1 x 0

T: amount of consecutive time since considered cell became with C1>0

PENALTY_TIME, CELL_RESELECT_OFFSET, TEMPORARY_OFFSET: BCCH parameters
If all parameters = 0, reselect cell with better path loss performance (no time hysteresis included)

Giuseppe Bianchi

Consequences of cell reselection

BTS

BTS

N one , w h e n M S idle !

No need to inform BTS at all!

Ex ce pt ion:
When cell reselection implies a Location Area Update
Need to inform the network!

Addit ion a l r e st r ict ion :

C2>CELL_RESELECT_HYSTERESIS
Giuseppe Bianchi

handover

Pr oce du r e in w h ich a n M S r e le a se s a conne ct ion w it h

a BTS, a n d e st a blish e s a con ne ct ion w it h a n e w BTS,
w h ile e n sur in g t h a t t h e ongoing ca ll is m a in t a ine d
The MS remains in dedicated state (unlike cell reselection, where MS is in idle
state)
H a ndoff: syn on ym ous of h a n dove r
N e e ds t w o m e ch a n ism s
Handover preparation: detection of cell-border crossing
Based on radio link quality measurements

Handover execution: setup of a new channel in a cell, and tear-down of a

previous channel
I m pr ove d h a n dove r m e ch a n ism s:
Seamless handover: when active call performance is not impaired

Not possible in GSM: for about 100-200ms, communication is interrupted

Soft Handover: when two channels are simultaneously set-up (old and new)
Not possible in GSM; possible in UMTS

Giuseppe Bianchi

Hard, Seamless, Soft handover

Hard
handover
(GSM)

before

during

after

MSC

MSC

MSC

BSS 1
f1

BSS 2

BSS 1
f1

MS
MSC

Seamless
(DECT)

BSS 1
f1

Soft
handover
(UMTS)

BSS 2

BSS 1
f1

MS

f1

MSC

BSS 2

BSS 2
f2

MS
MSC

BSS 2
MS

BSS 1

f2

MS

BSS 1
f1

f2

MSC

MSC

BSS 2

BSS 2
MS

BSS 1

MSC

BSS 1

MS

f1

MS

BSS 2

f1

BSS 1

BSS 2
MS

f1

Giuseppe Bianchi

Handover classification
Classification by motivation

Re scu e ha n dove r

( m a n da t or y h a n dove r )

Driven by radio channel quality

degradation
Con fine m e n t h a n dove r

( n e t w or k - dir e ct e d h a n dove r )

Target: minimize radio interference

Assign new channel when old
channel results critical for total
interference
Tr a ffic h a ndove r
( n e t w or k - dir e ct e d h a n dove r )

Driven by traffic congestion

conditions
Also called load-balancing

Classification by typology

I n t e r na l h a n dove r
Intra-BTS

New radio channel in the same

cell
Not termed as handover but
assubsequent assignment

Inter-BTS (Intra-BSC)

Under control of same BSC

Ex t e r n a l ha n dove r
Inter-BSC (Intra-MSC)

Change reference BSC; may

imply a location area update

Inter-MSC

Most complex: need to change

MSC

Giuseppe Bianchi

Types of handover
Switching
point for
all inter-MSC
handover
Switching
point for
internal
handover

Anchor MSC:
the MSC that first
managed the current call

Relay MSC:
the MSC that currently
manages the call

A-MSC

R-MSC

A
BSC

BSC

Switching
point for
inter-BSC
handover

BSC

A-bis
BTS

BTS

BTS

BTS

radio
interface

Giuseppe Bianchi

Handover taxonomy
BCH O: Ba se st a t ion Con t r olle d H a ndove r
Handover detection: BS
Handover Execution: BS
M CH O: M obile Con t r olle d H a n dove r
Handover detection: MS
Handover Execution: MS
M AH O: M obile Assist e d H a n dove r
Handover detection: MS
Handover Execution: BS

GSM : som e h ow a BCH O w it h a fla vor of M AH O

Handover decision always taken by BSC
Based on measures taken at both BTS and MS
New channel selection decision taken at BSC or R-MSC or A-MSC
(depending on handover type) based on traffic consideration
Giuseppe Bianchi

Handover preparation

M e a su r e m e n t s pe r for m e d a t BTS
Up-link signal level received from MS lower than threshold
RXLEV_UL < L_RXLEV_UL_H

Up-link signal quality (BER) received from MS

RXQUAL_UL < L_RXQUAL_UL_H

Distance between MS and BTS

adaptive timing advance parameter > MAX_MS_RANGE

Interference level in unallocated time slots.

M e a su r e m e n t s pe r for m e d a t M S.
Down-link signal level received from serving cell

RX signal
level

From
(dBm)

To
(dBm)

RXLEV_0

-110

RXLEV_1

-110

-109

RXLEV_2

-109

-108

RXLEV_3

-108

-107

RXLEV_62

-49

-48

RXLEV_63

-48

Bit error
Ratio

From
(%)

To
(%)

RXLEV_DL < L_RXLEV_DL_H

RXQUAL_0

0.2

Down-link signal quality (BER) received from serving cell

RXQUAL_1

0.2

0.4

RXQUAL_DL < L_RXQUAL_DL_H

RXQUAL_2

0.4

0.8

Down-link signal level received from n-th neighbor cell

RXQUAL_3

0.8

1.6

RXLEV_NCELL(n) > RXLEV_MIN(n)

RXQUAL_4

1.6

3.2

RXQUAL_5

3.2

6.4

RXQUAL_6

6.4

12.8

RXQUAL_7

12.8

Giuseppe Bianchi

A note on MS distance
D ist a n ce ca n be m e a su r e d ba se d on TA
TA = a dva n ce bit s
Ideally, TA should be set as

TA[bits ] tbit =

2d
c

d=

Hence, the TA resolution, in mt, is:

d (TA) = TA

c tbit
= TA
2

TA
c tbit
2

300000[mt / ms]
2

1
[ms ]
270.833
TA 554mt

INSUFFICIENT for microcells!

Sufficient only to understand we are going out of the cell
Giuseppe Bianchi

Handover preparation
additional metrics

Tr a n sm ission pow e r
Maximum MS transmission power
Maximum serving BTS transmission power
Maximum neighboring BTSs transmission
power
con ge st ion st a t u s
of serving BTS
of neighboring BTSs
provided they can support the MS.

H a n dove r M a r gin
To avoid ping-pong handover effect
5-10 dB in normal operation; up to 30dB in
urban operation (to fight shadowing)

RXLEV
(cell A)

RXLEV
(cell A)

HANDOVER ALGORITHM: operator-dependent!

GSM standard SUGGESTS a simple reference
algorithm, but implementation left to operator

Handover

Handover

RXLEV
(cell B)

RXLEV
(cell B)

hysteresis

Giuseppe Bianchi

10

handover procedure skeleton

1) Handover request goes up to switching point
MSC

2) Switching point prepares new path on fixed net

3) Switching point sends HO command to MS

1
5

4) MS accesses new channel

BSC

BSC

5) Old channel/path torn down

3
4
BTS

BTS

Giuseppe Bianchi

Signaling for intra-MSC handover

(simplified)

MS

BTS-A
Measurement info

handover command

BSC-A

MSC

handover required
(destination cell)

BSC-B

handover request

handover req. ack

(contains handover
handover command command message
prepared by BSC-B
with info on BCCH,
channel assigned, etc)

BTS-B

MS

Channel allocation
Channel activation
ACK

handover access
(an access burst
on new TCH!!!)
physical info
(new TA, power)
handover complete

handover detection
handover detection

handover complete
clear command
clear complete

Measurement
info

Giuseppe Bianchi

11

Inter-MSC handover

M or e com ple x , a s a n I SD N cir cu it m u st be se t

be t w e e n M SCs
Well not enter into details (just the basic ideas)
Tw o ca se s
Second MSC change
(subsequent handover)

First MSC change

(basic handover)

MSC-A

MSC-A

MSC-R1

Note the role of the

Anchor MSC!

MSC-R1

MSC-R2

Giuseppe Bianchi

PART 5
GSM Switching & Mobility

Le ct u r e 5 .3
loca t ion r e gist r a t ion / u pda t e
Au t h e n t ica t ion & Ciph e r in g

Giuseppe Bianchi

12

Location Area
vs
MSC service area

LA-1

LA-2

MSC
LA-4

LA-3

VLR

LA-n

Giuseppe Bianchi

Registration vs update
Ve r y sim ila r pr oce dur e s, w it h goa ls:
Determine where the user is
Authenticate user
D iffe r e n ce s:
Location Registration
User first access to PLMN

Needs to send IMSI and receive TMSI

Location Update

Subsequent accesses to PLMN (either in old or new MSC/VLS)

Also after MS shut-down!
TMSI-based identification

Re gist e r e d u se r :
The PLMN knows the LA where the user is (or is supposed to be)

Giuseppe Bianchi

13

Procedure start-up
M S sw it ch e s on
D e t e ct s BCCH ca r r ie r
Tune and synchronize
List e n s t o BCCH
Obt a in s Loca t ion Ar e a I de n t ifie r
LAI: [CC,MNC,LAC]
Country Code (CC): 3 digits
Mobile Network Code: 2 digits
Location Area Code: max 5 digits

Giuseppe Bianchi

LR/LU (very) basic idea

MSC

VLR

HLR

BSC
2

BTS

1) Obtain LAI from BCCH

BTS
1

BTS

2) Register MS ID into local VLR

3) Update pointer at HLR

MS

Giuseppe Bianchi

14

Location Registration
MS

BSS/MSC

Loc. Upd. Request

IMSI, LAI

VLR

Update Loc. Area

IMSI, LAI

HLR
Auth. Param. Req.
IMSI
Auth. Info
(Auth. Parameters)

AUC

Auth. Info. Req.

IMSI
Auth. Info
(Auth. Parameters)

authentication
Update Location
IMSI, MSRN
Start Ciphering
Insert Subscrib. Data
Kc
Forward new TMSI IMSI, additional data
TMSI
Insert Subscrib. Data
ACK
Locat. Upd. Accept
Locat. Upd. Accept
IMSI

Activate
ciphering

TMSI Realloc Cmd

Locat. Upd. Accept
TMSI Realloc ACK

TMSI ACK

Giuseppe Bianchi

Authentication
(managed by VLR)
IMSI, RAND

Authentication Request

MS
Ki

SRES, Kc

RAND
A3

SRES

SRES

Authentication Response
Signed RESult: 32 bit SRES

Ki

VLR

Challenge: 128 bit RAND

HLR /
AUC

Equal?

RAND
A8
Kc
Giuseppe Bianchi

15

Authentication (details)

Side e ffe ct of a u t he nt ica t ion :

Generate encryption key Kc via A8 algorithm
Se cr e t A3 , A8 a lgor it h m s ( one - w a y h a sh fu n ct ion s)
Stored into the SIM
Along with secret key Ki

Note that roaming operator DOES NOT need to know them!

Since A3,A8 run ONLY in the AUC at the home HLR
Ki is NEVER transmitted away from AUC or MS!

Ge n e r a lly im ple m e n t e d t oge t he r

[SRES,Kc] = A38[Ki,RAND]
To r e duce sign a lin g, r e a l im ple m e n t a t ion sligh t ly
diffe r e n t :
VLR sends IMSI
Receives back several tuples of (RAND, SRES, Kc) to be used for the
considered MS also in subsequent accesses
Giuseppe Bianchi

ciphering

A5 a lgor it h m is k n ow n ( t o a llow r oa m in g)
Ge n e r a t e s t w o ciph e r in g se qu e n ce s
one for uplink, one for downlink
Sequence periodic with period 26x51x2048=2,715,648
221=2,097,152 < 2,715,648 < 222=4,194,304

1 1 4 bit s pe r fr a m e , de pe n din g on fr a m e n u m be r
X OR- e d w it h bu r st da t a fie ld
Frame number
FN, 22 bits

MS

Kc
64 bits

Frame number
FN, 22 bits

A5

BTS

A5

S1
In-clear uplink

Kc
64 bits

S1

S2

XOR

In-clear downlink XOR

XOR

enciphered uplink
enciphered downlink

S2

XOR

In-clear uplink

In-clear downlink

Giuseppe Bianchi

16

Location Update in same VLR

MS

(same as location registration, but with TMSI)

BSS/MSC
VLR
HLR

Loc. Upd. Request

TMSI, LAI

AUC

Update Loc. Area

TMSI, LAI

authentication

Update Location
IMSI, MSRN
Generate
New TMSI

Start Ciphering
Kc
Insert Subscrib. Data
Forward new TMSI IMSI, additional data
Ins. subs. data ACK

Activate
ciphering

Locat. Upd. Accept

TMSI Realloc Cmd

Locat. Upd. Accept

IMSI

Locat. Upd. Accept

TMSI Realloc ACK

TMSI ACK
Auth. Param. Req.
IMSI
Auth. Info
N x (Kc,RAND,SRES)

Giuseppe Bianchi

Auth. Info. Req.

IMSI
Auth. Info
N x (Kc,RAND,SRES)

Changing MSC/VLR
HLR
VLR

MSC

Public
Publicswitched
switched
telephone
telephonenetwork
network
PSTN
PSTN

VLR

MSC

Base
Station
Base
Station

An MS always has a dedicated entry in the HLR

Plus one entry in JUST 1 VLR
(related to the MSC the user is connected to)
Giuseppe Bianchi

17

TMSI
TM SI = Te m por a r y M obile Subscr ibe r I de nt it y
4 octets (32 bits)
Operator may set a 6min
up to 24hrs periodicity
Renewed periodically; at every LU / IMSI_attach
for LU (value transmitted
Via TMSI_Reallocation_Command/TMSI_Reallocation_Complete
RATIONALE: renew TMSI when transmitted in clear!
(TMSI reallocation occurs in ciphering mode)

M e a n in gfu l on ly in a give n VLR

Specifically, only for a given Location Area!!

on BCCH)
IMSI_attach = a special LU
in a same Location Area;
IMSI_attach follows
an IMSI_detach
(power-down of MS)

Some author (Mouly-Pautet) uses the term

TIC (Temporary Identity Code) = 4 bytes

TMSI = TIC+LAI = unambiguous user identification

W hile e n t e r ing a ne w Loca t ion Ar e a :

user must identify itself with TMSI+LAI pair.
Giuseppe Bianchi

Location Update: different VLR

MS

BSS/MSC

Loc. Upd. Request

TMSI(+ old LAI), LAI

VLR-new

HLR

VLR-old

Update Loc. Area

TMSI(+ old LAI), LAI
determine
VLR-old
From old LAI Send parameters (TMSI, old LAI)

IMSI response (IMSI,RAND,SRES,Kc)

authentication
Update Location
IMSI, MSRN
Generate
New TMSI

Activate
ciphering

Cancel Location
IMSI
Cancel Locat. ACK

Start Ciphering
Kc
Insert Subscrib. Data
Forward new TMSI IMSI, additional data
Ins. subs. data ACK

Locat. Upd. Accept

IMSI

Giuseppe Bianchi

18

Special cases
1 . N e w VLR n ot ca pa ble of de t e r m in in g old
VLR fr om old LAI
2 . Old VLR doe s n ot r e cognize TM SI
Identification procedure

IMSI transmitted in clear

MS

MSC
Identity Request
Identity Response
IMSI

PAGING:
- Normally based on TMSI
- But when no valid TMSI information available (e.g. after a DB restore
after crash), based on IMSI

Giuseppe Bianchi

PART 5
GSM Switching & Mobility

Le ct u r e 5 .4
Ca ll M a n a ge m e n t & r ou t in g

Giuseppe Bianchi

19

Notation
A ca ll in volve s t w o Pa r t ie s
Ca llin g Pa r t y ( ca lle r )
user generating the call
Ca lle d Pa r t y ( ca lle e )
user receiving the call
M obile Or igin a t in g Ca ll ( M OC)
Call originated by an MS
M obile Te r m in a t in g Ca ll ( M TC)
Call directed to an MS
Giuseppe Bianchi

Call establishment basics

MS

Mobile Terminated Call

Fixed
MSC
party
setup
setup

Mobile Originated Call

MS

setup

Fixed
party

MSC
setup

Call proceeding
alerting

Call confirmed

alerting

alerting
alerting
connect
connect

Connect Ack

DATA

DATA
In ISDN ISUP:

Connect
Connect

- setup
= IAM
- Alerting = ACM
- Connect = ANS

(Initial Address Message);

(Address Complete Message);
(Answer)

Giuseppe Bianchi

20

Call establishment steps

MS

Mobile
Terminated Call

network

MS

Mobile
Originated Call

network

Paging request
Channel request

Channel request

Immediate Assignment

Immediate Assignment

Service Request

Paging Response

Authentication Request

Authentication Request

Authentication Response

Authentication Response

Ciphering mode command

Ciphering mode command

Ciphering Mode Complete

Ciphering Mode Complete

Setup

Setup
Call proceeding

Call Confirmed
Assignment Command
Assignment Complete

Assignment Command
Assignment Complete
Alerting

Alerting

Connect

Connect
Connect Acknowledge

Connect Acknowledge

Giuseppe Bianchi

Radio Resource allocation

three standardized solutions
N on - Off Air Ca ll Se t - Up ( N on - OACSU)
Normally used (previous description)
Off Air Ca ll Se t - Up ( OACSU)
TCH assigned only when the called party actually responds!

Best utilization of radio resource (avoids allocation if callee not available)

Call drop if no TCH is available at this point

Ve r y Ea r ly Assignm e n t ( VEA)
Immediate assignment of TCH
Fastest signalling process
Waste of resources

VEA RACH
Non-OACSU RACH
OACSU RACH

TCH (FACCH)
TCH (DATA)
SDCCH
TCH (FACCH) TCH (DATA)
SDCCH
TCH (DATA)
Connection established

Callee responds

Giuseppe Bianchi

21

DTMF signaling

D u a l- Ton e M u lt i- Fr e qu e n cy
Digital tones associated to terminal keys
09#

I n ba n d sign a llin g
transmitted in the traffic channels!
Not in the signalling network
MS
MSC
Start DTMF (w. key code)
Start DTMF ACK

Key
Pressed

On a ir in t e r fa ce :
Signal trasmitted on FACCH as
signalling data (code of pressed
key)
Otherwise coded compression
would distort DTMF tones
Tone generated at MSC when
STOP DMTF message received

On FACCH)

Stop DTMF

Giuseppe Bianchi

1:
M
SI
S

ISDN

D
N

Routing an MTC

PLMN
MSCC
5: MSRN
VLRB

MSCB
ng
gi
pa
7:

6: TMSI

N
SD
SI SRN
M
2: 3: M

4:
M
SR
N

GMSC

MSCA

HLR

Giuseppe Bianchi

22

Routing an MTC (alternative)

During an LU within a same VLR,
MSRN is NOT signaled!

ISDN

1:
M
SI
S

MSRN retrieved on a per-call basis!

(choice of solution depends on trade-offs)

PLMN

GMSC

6:
M
SR
N

N
SD
SI SRN
M
2: 5: M

MSCC
7: MSRN
VLRB

MSCB

HLR

MSCA

ng
gi
pa
9:

8: TMSI

D
N

reduces signalling load during LU

3: IMSI
4: MSRN

Giuseppe Bianchi

Routing calls to Roaming MS

ISDN
(UK)

International
Switching
Center

PLMN 2

MSC

(UK)

ISDN
(ita)

International
Switching
Center

Transit
Exchange
Local
Exchange

GMSC 1
MSISDN
+39.335.1234567

PLMN 1

MSRN
+44.NDC.8877665

(ITA)

MSC

HLR
335.1234567

Giuseppe Bianchi

23

Call to MSISDN
+39.335.3043125

tromboning
MSC

ISC

PLMN 2

(UK)

(UK)
Call to MSISDN
+39.335.1234567

ISC
(ITA)

GMSC 1

MSISDN
+39.335.1234567

PLMN 1
(ITA)

MSRN
+44.NDC.9876543

MSC

Is the PRICE (!)

to pay for
simple routing
and billing

HLR

Giuseppe Bianchi

Tromboning technical solutions

Fir st a lt e r n a t ive : n a t ion a l- w ise
Add a new database - Roamer Location Cache (RLC)

Consulted by ISCs (which MUST support GSM-MAP!)

Se con d a lt e r n a t ive : PLM N spe cific

RLC within the PLMN + associated switch
Caller must dial special NDC number (the switch!)

I.e. must know the MS is roaming in the PLMN

Additional devices and protocol modifications required

Extensions toVLR or to GMSC
Details in Lin-Chlamtac
Giuseppe Bianchi

24

RLC at ISC - Location Registration

and call management
RLC

3 bis

PLMN 2

ISC

VLR

(UK)

(UK)

MSC

PLMN 1
ISC
(ITA)

(ITA)

HLR

Giuseppe Bianchi

Short Message Service

SM S:
messages up to 160 bytes
Message concatenation allowed
Tr a n sm it t e d on a ir in t e r fa ce ove r :
SACCH (when user in conversation)
SDCCH (when user in idle state)
Tw o t r a n sm ission m ode s in a ce ll:
Point-to-point
cell broadcast
Con n e ct ion le ss se r vice
message switching (store&forward)
Implemented through the Short Message Service Center
Giuseppe Bianchi

25

SMS routing management

MSC

PLMN

Internet, PSDN

IWMSC
Short Message
Service Center

Get routing info

for terminating MS

SMS-GMSC

HLR

PLMN
MSC
Giuseppe Bianchi

Protocol hierarchy
MS
Short Message
Application Layer
(SM-AL)

SM-SC

Short Message Transfer Protocol (SM-TP)

Short Message
Transfer Layer
(SM-TL)

MSC

IW-MSC

Short Message
Relay Layer
(SM-RL)

Short Message
Short Message
Relay Entity Short Message Relay Entity
Relay Protocol
(SMR)
(SMR)
(SM-RP)
Connection
Short Message Short Message Short Message
Management
Control Entity Control Protocol Control Entity
Sublayer (CM-sub)
(SMC)
(SMC)
(SM-CP)

Quite complex signalling involved (see specific texts)

Giuseppe Bianchi

26

Number portability
Su bscr ibe r m a y sw it ch ope r a t or w it h ou t
ch a n gin g h is n u m be r
Fir st im ple m e nt e d in fix e d n e t w or k
Recently (may 2002) extended to mobile networks
Esse n t ia l for fa ir com pe t it ion a m on g
n e t w or k ope r a t or s
UK survey: 42% of corporate subscribers were willing to
change mobile operator; but 96% were, if number could be
ported
Re sist e n ce fr om le a din g ope r a t or s
Number portability helps newer operators to compete with
traditional ones
Giuseppe Bianchi

Notation
D on or sw it ch
The switch corresponding to a ported telephone
number
Re cipie n t sw it ch
The switch to which the ported number is attached

Giuseppe Bianchi

27

Technical solutions
a) call forwarding
Originating network

Donor network

switch

switch

switch
Recipient network
Originating switch sets-up trunk to donor switch
Donor switch sets-up trunk to recipient switch
Simplest solution, as call forwarding is a feature available in virtually all switches

But extremely inefficient routing and trunking resource consumption!

Giuseppe Bianchi

Technical solutions
b) query on release
Originating network

Donor network
SS7 ISUP IAM

switch

switch
SS7 ISUP REL

Number
Portability
DataBase

switch
Recipient network

Donor switch blocks incoming call with a release message (REL)

REL carries a QoR cause value, stating that called party number is ported
Originating switch then queries Number Portability database
Giuseppe Bianchi

28

Technical solutions
c) all-call query
Originating network

Donor network

switch

Number
Portability
DataBase

switch

switch
Recipient network

Originating switch queries Number Portability database for every call!!

- best solution if majority of numbers are ported (no interaction with donor)
- but very high DB load, as EVERY number must be looked-up!
Giuseppe Bianchi

Mobile Number Portability

Sa m e ide a s a s fix e d n u m be r por t a bilit y

The donor switch is the GMSC of the donor network
D onor GM SC Ca ll for w a r din g ( if m or e e fficie n t
fix e d num be r por t a bilit y n ot su ppor t e d)
While porting number, may also get MSRN!
Recipient network
MSC

GMSC

MSRN

IRN

HLR

Note: If path must cross GMSC:

Use Intermediate Routing Number

MSRN
(or IRN)

Incoming call
GMSC

Signaling relay
function

HLR

Donor network
Clearly, still suffers of tromboning!
Giuseppe Bianchi

29

Mobile Number Portability

(with all call query approach)
approach)

Recipient network
Query MSRN

MSC

GMSC

Return MSRN

HLR

IRN

Incoming call
Query IRN

switch

Return IRN

Number
Portability
DataBase

Giuseppe Bianchi

Mobile Number Portability

improved (with all call query approach)
approach)
Recipient network
MSC

GMSC

HLR

MSRN
Signaling relay
function

Incoming call
Query MSRN

switch

Return MSRN

Number
Portability
DataBase

Giuseppe Bianchi

30