TableofContents

PLMNNetworkStructure
AddressingandNumberingplan
Add
i
dN b i
l
GSMNetworkEvolution
UMTSNetworkEvolution
UMTS Network Evolution
CORENetworkNodes
2G/3GAuthentication
ShortMessageService
LocationUpdate
Handover
H d

PLMN Network Structure

PLMNNetworkStructure

GSMNetworkAreas...
Public Land Mobile Network (PLMN)
MSC / VLR Area
Location Area
C ll
Cell

GSMNetworkAreas...

P bli L d M bil N t
PublicLandMobileNetwork(PLMN)
k (PLMN)

GSMNetworkAreas...
:MSC/VLRServiceArea

MSC
MSC

GSM Network Areas...

GSMNetworkAreas
:LocationArea
Location Area
MSC/VLRServiceArea :
.

LocationUpdate
p

.
. Paging LocationArea .

GSMNetworkAreas...
:Cell

. Cell


Cell

Location Area
) (CGI .
) (BSIC Cell
.

CGI:CellGlobalID
BSIC:BasicStationIdentityCode

AddressingandNumberingplan

MSISDN (Mobile Subscriber ISDN Number)

MSISDN(MobileSubscriberISDNNumber)
IMSI(InternationalMobileStationIdentity)
TMSI(TemporaryMobileStationIdentity)
PIN (P
PIN(PersonalIdentityNumber)
l Id tit N b )
PUK(PersonalUnblockingKey)

PIN

KI(IndividualSubscriberAuthenticationKey)

INTERNATIONALMOBILESUBSCRIBERIDENTITY(IMSI)
(
)
The IMSI is a unique identifying code allocated to each subscriber
allowing correct identification over the radio path and through the
WCDMA Systems PLMN network.
It is used for all identification signaling in the PLMN and all network
related subscriber information is connected to it.
it
The IMSI is stored in the UMTS Subscriber Identity Module (USIM), as
well as in the HLR and the VLR.
It consists of three different parts
IMSI=MCC+MNC+MSIN
MCC =MobileCountryCode
MNC =MobileNetworkCode
M bil N t
kC d
MSIN =MobileSubscriberIdentificationNumber
AccordingtotheWCDMAspecifications,IMSIcanhaveamaximumlengthof15
digits.
digits
Examples:IMSI=43220XXXXXXXXXX

10

MOBILE STATION ISDN NUMBER (MSISDN)

MOBILESTATIONISDNNUMBER(MSISDN)
TheMSISDNisanumberthatuniquelyidentifiesamobiletelephone
subscriptionwithinthePublicSwitchedTelephonyNetwork(PSTN)
b i i
i hi h P bli S i h d T l h
N
k (PSTN)
numberingplan.
InWCDMASystemstheMSISDNiscomposedof:

MSISDN=CC+NDC+SN
CC =CountryCode
NDC =NationalDestinationCode
N ti
l D ti ti C d
SN =SubscriberNumber
Examples:MSISDN=+98920XXXXXXX

11

12

TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI)

TEMPORARYMOBILESUBSCRIBERIDENTITY(TMSI)
TheTMSIcanbeusedtokeepsubscriberinformationconfidential
ontheairinterface.Italsoincreasespagingcapacity,asthelength
oftheTMSIisshorterthanthelengthoftheIMSI.
TheTMSIisrelevantonthelocalMSC/VLRlevelonlyandischanged
/
y
g
atcertaineventsortimeintervals.Eachlocaloperatorcandefinehis
ownTMSIstructure.
The TMSI should not consist of more than four octets when used
TheTMSIshouldnotconsistofmorethanfouroctetswhenused
withinaLocationArea(LA),forexample,forpaging.Whenacell
within a new Location Area (LA) is entered, the Location Area
Identity (LAI) must be added to the four octets to perform a location
Identity(LAI)mustbeaddedtothefouroctetstoperformalocation
update.

13

LOCATIONAREAIDENTITY(LAI)
The LAI,
Th
LAI used
d for
f paging,
i
i di t to
indicates
t the
th MSC in
i which
hi h
location area the UE is operating. It is also used for
location updating of mobile subscribers.
The LAI contains the following:

LAI=MCC+MNC+LAC
MCC =MobileCountryCodeIdenticaltoIMSIMCC
= Mobile Country Code Identical to IMSI MCC
MNC =MobileNetworkCodeIdenticaltoIMSIMNC
LAC =LocationAreaCode
The maximum length of LAC is 16 bits, enabling 65,536
different location areas to be defined in one PLMN.

ROUTINGAREAIDENTITY(RAI)
( )
The Routing Area Identity is exactly the same as the
Location Area Identity (LAI).

RAI = MCC + MNC + LAC

14

INTERNATIONALMOBILEEQUIPMENTIDENTITY(IMEI)
The IMEI uniquely identifies User Equipment (UE) as a piece or assembly of
equipment. Using the IMEI stolen or not type approved, mobiles causing
severe malfunctions can be barred. The IMEI consists of 15 digits.
Th IMEI consists
The
i off the
h following:
f ll i

IMEI=TAC+FAC+SNR+sp
TAC = Type Approval Code
Determined by a central WCDMA body, TAC identifies the type of equipment.

FAC = Final Assembly Code

The FAC identifies the manufacturer of the equipment

SNR = Serial Number,

The SNR is
Th
i an individual
i di id l serial
i l number
b off six
i digits
di it which
hi h uniquely
i
l identifies
id tifi allll
equipment within each TAC and FAC.

sp

= spare part for future use; this digit should always be zero when
it is transmitted by the UE.
Example:IMEI=357,087,008,609,717 (USSD= *#06#)

15

MOBILESTATIONROAMINGNUMBER(MSRN)
When a mobile terminatingg call is to be set up,
p, the HLR of the called
subscriber requests the current MSC/VLR to allocate a MSRN to the
called subscriber. This MSRN is returned via the HLR to the GMSC. The
GMSC routes the call to the MSC/VLR exchange where the called
subscriber is currently registered. The routing is done using the MSRN.
When the routing is completed, the MSRN is released.
The MSRN is built up like an MSISDN
TheMSRNisbuiltuplikeanMSISDN.
InWCDMASystems,theMSRNiscomposedofthefollowing:

MSRN=CC+NDC+SN
S N CC N C SN
CC =CountryCode
NDC =NationalDestinationCode
= National Destination Code
SN =SubscriberNumber

16

2G Mobile terminating call e.g. from PSTN

1- The
1
Th dialing
di li iinformation
f
ti iis received
i db
by PSTN e.g. via
i ISUP in
i the
th PLMN gateway
t
MSC The dialing information is converted in the gateway MSC.
2- A so-called "interrogation" is started as a response; i.e. a MAP message is sent to
the HLR in order to obtain location
location-specific
specific routing information
information. The HLR knows
the location routing label i.e. the MSC/VLR by the "location update" and relays the
query there.
3- The MSC/VLR makes a temporary directory number available and sends it back
via the HLR to the gateway MSC.
4- The gateway MSC converts this temporary directory number and sets up a circuit
connection (ISUP) to the visited MSC. The location area is specified in the MSC/
VLR owing to the cross-connection between temporary directory number and
mobile subscriber.
5- The visited MSC now sends a "paging"
p g g to all BSCs situated in the location area.
The BSC in which the subscriber is currently situated answers with a "paging
response".
6- The MSC makes the connection to the called subscriber.
17

IMSI

MSISDN

MSCAddress

2- MSISDN
PSTN

1- MSISDN

GMSC

HLR

5- MSRN

3- IIMSI

4-M
MSRN

MSC/VLR

7-Paging

18

GSM Network Evolution

GSMNetworkEvolution

GSM

GPRS

EDGE

19

BasicGSMnetwork
20

GSM&ValueAddedService
21

22

HSCSD(HighSpeedCircuitSwitchedData),
23

SGSN(ServingGPRSSupportNode)
GGSN (Gateway GPRS Support Node)
GGSN(GatewayGPRSSupportNode)

24

IncreasingspeedwithEDGE

25

26

RAN
RadioAccessNetwork

GSM BSS
GSMBSS

CN
CoreNetwork

CSDomain

Entitiescommon
totheCS&PSDomain

UE

External
N t
Networks
k

UTRAN
PS D
PSDomain
i

UMTS(UniversalMobileTelecommunicationsSystem)

27

UMTS Network Evolution

UMTSNetworkEvolution
3GPP
3GPPdefiningmigrationfromGSMtoUMTS(W
defining migration from GSM to UMTS (W
CDMA)
Core
CorenetworkevolvesfromGSM
network evolves from GSMonly
onlytosupportGSM,
to support GSM,
GPRSandnewWCDMAfacilities

3GPPRelease99
Adds3Gradios
Add 3G di

3GPPRelease4
Addssoftswitch/voicegateways
Adds softswitch/ voice gateways andpacketcore
and packet core

3GPPRelease5
FirstIPMultimediaServices(IMS)w/SIP&QoS
First IP Multimedia Services (IMS) w/ SIP & QoS

3GPPRelease6
AllIPnetwork;contentsofr6stillbeingdefined
28

3G R l 99 A hit t
3GRel.99Architecture(UMTS)3GRadios
(UMTS) 3G R di
2GMS(voiceonly)

CN
BSS
E

Abis

PSTN

PSTN

B
BSC
Gb

BTS

MSC
Gs

VLR

GMSC

SS7
H

2G+MS(voice&data)

IuCS
RNS

Gr

HLR

ATM
Iub

IuPS
RNC

AuC

Gc

Gn
SGSN

Gi

IP

PSDN

GGSN

NodeB
3GUE(voice&data)
BSS BaseStationSystem
BTS BaseTransceiverStation
BSC BaseStationController
RNS RadioNetworkSystem
RNC RadioNetworkController

CN Core Network
MSC MobileserviceSwitchingController
VLR Visitor LocationRegister
HLR HomeLocationRegister
AuC Authentication Server
GMSC GatewayMSC

SGSN ServingGPRSSupportNode
GGSN GatewayGPRSSupportNode

UMTS UniversalMobileTelecommunicationSystem

29

3G R l 4 A hit t
3GRel.4Architecture(UMTS)
(UMTS) SoftSwitching
S ft S it hi
2GMS(voiceonly)

CN

CSMGW

Abis

Nc
Mc

BSC
Gb

BTS

CSMGW

Nb

BSS

PSTN

B
C

MSCServer
Gs

PSTN
Mc

VLR

GMSCserver

SS7
H

2G+MS(voice&data)
(
)

IuCS
RNS

Gr

HLR

ATM
Iub

IuPS
RNC

AuC

IP/ATM
Gc

Gn
SGSN

Gi

PSDN

GGSN

NodeB
3GUE(voice&data)
y
BSS BaseStationSystem
BTS BaseTransceiverStation
BSC BaseStationController
RNS RadioNetworkSystem
RNC RadioNetworkController

CN Core Network
MSC MobileserviceSwitchingController
VLR Visitor LocationRegister
HLR HomeLocationRegister
AuC Authentication Server
GMSC GatewayMSC

g
pp
SGSN ServingGPRSSupportNode
GGSN GatewayGPRSSupportNode

30

UMTSRelease99CoreNetwork
CN (Core Network)

RAN

circuit switched (CS) domain

G
GERAN

MSC/VLR

CSE EIR

UTRAN

SGSN

GMSC

HLR

PSTN/
ISDN
S

Common CS & PS
AC network element

IPbackbone

GGSN

WAP

packet switched (PS) domainBG CG

Inter-PLMN
Network

PDN

Billing
Centre

31

32

3GR99Networking
33

Differencebetween3GR4and3GR99

34

Huaweimobilesoftswitchsolution

GGSN:GatewayGPRSSupportNode
y
pp
HLR:HomeLocationRegister
MGW:MediaGateway
MSCserver:MobileSwitchingCenterServer
CN:CoreNetwork
CS:CircuitSwitcheddomain
SGSN:ServingGPRSSupportNode
PS:PacketSwitcheddomain
PSTN:PublicSwitchedTelephoneNetwork
p
UTRAN:UMTSTerrestrialRadioAccess
Network
BSS:BaseStationSubsystem
VoBB:Voiceoverbroadband.

UMTSCNRelease4
35

UMTSCNRelease4CSDomain
ApplicationsandServices
CAP

CAP

CallControl
Level

HLR

PSDomain
unchanged
unchanged
comparedtoR`99

MSC
Server

GMSC
Server

Nc (e.g.BICC)

Mc (H.248/MEGACO

Iu

(G)MSCServer:
G )MSC Server:
CallControl
MobilityManagement
MGWControl
VLRfunctionality
CDRs
(HLRInterrogation)

Mc (H.248/MEGACO)

BearerLevel

GERAN
A

UTRAN

Iu

CS
MGW

Nb(e.g.ATM,IP)

CS
MGW

PSTN/
ISDN

MGW:
BearerControl
CDR:CallDataRecords
BICC: Bearer Independent Call Control
BICC:BearerIndependentCallControl
MGW:MediaGateway

TransmissionResourceManagement
DataFormatConversionTranscoding

MEGACO:MediaGatewayControlprotocol
H 248: ITU protocol for Media Gateway Control
H.248:ITUprotocolforMediaGatewayControl

36

Separation of planes (MSC Server System)

MSC Server System separates call control & signaling and traffic in two
separate network elements:
MSC Server
Multimedia Gateway (MGW)

MSC
SC S
Server S
System

MSC
Control &
Signalling
Traditional
Mobile Switch

Speech & Data

MSC Server
MGW

Control & Signalling

Speech & Data

37

Layered Core Network Model Showing the Logical Network Nodes

LayeredCoreNetworkModelShowingtheLogicalNetwork
38

Benefit of the solution

The MSC Server System saves transmission costs by local
switching when the call is managed by a single
single, local MGW
MGW.

39

The benefits with a layered architecture are many:

Reduced traffic load in the backbone network through
g
remote switching with the MMGw close to the local
traffic. As much as 70% of the total traffic could be local
which could be routed within the MMGw instead of
enteringg the backbone network; therefore, significant
g
savings in transmission can be achieved.

40

CORENETWORKNODES
3G
MSC
Radio Access

Core Network
RNC

Supplementary Services Location Updating

3G
MSC

HLR
AuC
EIR

Service Information
3G
SGSN

HLR/AC
The HLR is a centralized
database, which contains
information about the
subscriber location and
subscriber,
service information.
Authentication information
is
the HLR
HLR.
i also
l stored
t d iin th

GGSN

Locating the Subscriber

3G
MSC

RNC

Foreign Network
3G
SGSN
GGSN

41

HLR&AuC
SubscriberRegistration
Storing/Management
subscriberprofiles
DeliverprofilestoVLR/SGSN
p
/
StoringLocationInformation
(VLR/SGSN)
MTC:DeliverRouting
informationtoGMSC/GGSN
AssociatedwithAuC

CSDomain
MSC//
MSC
VLR

GMSC

HLR

AuC

Gr

Gc

SGSN

GGSN

PSDomain
Subscriberdata (Examples):
SemipermanentData:MSISDN,IMSI,Services
(BS,TS,SS),QoSProfile,CSI,ServiceRestrictions,..
TemporaryData:VLR/SGSNaddress,
Temporary Data: VLR / SGSN address
MSNonReachableflag,MSRN,SMSflags,..

StoringsecretKeys
(counterpart USIM) &
(counterpart:USIM)&
SecurityAlgorithm
GeneratingSecurityParameter
(GSM:Triples;UMTS:Quintets)
DeliverParametertoVLR/
SGSN(viaHLR)
AssociatedwithHLR

BS:BearerService
TS:TeleService
SS:SupplementaryService
CSI: CAMEL Subscription Information
CSI:CAMELSubscriptionInformation
QoS: QualityofService
IMSI:InternationalMobileSubscriberIdentity
MSISDN:MobileStationISDNNumber
MSRN:MobileStationRoamingNumber

42

43

LogicalstructureoftheHLR9820

BSG:BroadbandSignalingGateway
CCU:CallControlUnit
DBMS:DatabaseManagementSystem
DRU: Data Routing Unit
DRU:DataRoutingUnit
DSU:DataServiceUnit
NMS:NetworkManagementSystem
PGW:ProvisioningGateway
OMU:OperationandMaintenanceUnit
p
44

Authentication Center AuC

AuthenticationCenterAuC
The AuC is responsible to store the secret Keys of the subscribers and the
security algorithm, which are necessary for the generation of the GSM and
UMTS security parameters. On request off the
h VLR respectively
l the
h SGSN the
h
AuC generates the security parameters. They are delivered via HLR to VLR /
SGSN to enable Authentication, Ciphering and Integrity Check.
The AuC is always associated with an HLR (communication via a proprietary
interface).

45

46

Interfaces of 3G-SGSN

RNC

Iu

Gn

3G Core Network
(HPLMN)

3G Core Network

Gp

((VPLMN))

3G SGSN

Gr
HLR & AUC

3G SGSN
Gf

NMS

EIR
Ga

CG

Gd

SMSC

47

LogicalstructureoftheSGSN9810

48

49

50

HuaweimobileMSCServersolution

TheMSOFTX3000providedbyHuaweiservesasanMSCserver
51

52

53

VMSCNetworking&GMSCNetworking
54

TMSCNetworking
55

GMSC/VMSC/TMSCCombinedNetworking
56

MSCPoolNetworking
57

VisitorLocationRegisterVLR

Main

VLR
tasks:
ForallUEsinMSCArea
storingSubscriberprofiles
MobilityManagement
storingLocationInformation
controlling
SecurityFeatures*

VLRasMSCsDataBase:
SC

SubscriberProfile,
e.g.IMSI,MSISDN,
Services(TS,BS,SS),..
TemporarySubscriberData
p
y
e.g.LMSI,TMSI,MSRN,
SecurityParameter,
LocationInformation,
IMSIattach/detach,..

VLR

MSC
LocationUpdates(SubscriberProfiles VLR)
SecurityParameter(viaHLR VLR)
Interrogation(MSRNviaHLRtoGMSC)

TS:TeleServices
BS:BearerServices
SS:SupplementaryServices
MSRN:MobileStationRoamingNumber

*e.g.Authentication,Authorization,
Cipher&IntegrityStart

AuC
HLR
D
IMSI:InternationalMobileSubscriberIdentity
LMSI:LocalMobileSubscriberIdentity
p
y
y
TMSI:TemporaryMobileSubscriberIdentity

58

59

SMSGMSC&SMSIWMSC
Allorsomedesignated
All
d i
d
MSCscanactas
SMSGMSC/IWMSC
(Networkoperator
dependent)

CS
Domain

MSC//
MSC
VLR

External
Networks

SMSGMSC
SMSGatewayMSC

SMSIWMSC
SMSInterworkingMSC

SMSC
SM
SC
ShortMessage
ServiceCenter

Gd
PS
Domain

SGSN

60

61

Mobility Management procedures

MobilityManagementprocedures
Location Registration

(Circuit and Packet Switched)

Location Update

(Circuit Switched)

IMSI Attach/Detach

(Circuit Switched)

g Area Update
p
Routing

((Packet Switched))

Cell Attach/Detach

(Packet Switched)

Location Info Retrieval

(Circuit and Packet Switched)

Paging

(Circuit Switched)

Paging

(Packet Switched)

Authentication Procedure (Circuit/Packet Switched)

Ciphering Procedure

(Circuit/Packet Switched)

UE Identity
Id tit Ch
Checking
ki

(Ci it/P k t S
(Circuit/Packet
Switched)
it h d)

UE Hardware (IMEI) Checking

(Circuit/Packet Switched)

62

Functions of 2G/3G Authentication

The network and an MS can perform validity verification on each other.

63

SIEMENS

SIEMENS

MGW

NodeB
RNC

Service Protection
Confidentiality

64

Authentication
ut e t cat o
The rand is relayed to the mobile station. This generates the SRES with
the help of the parameter Ki stored on the SIM card and A3 (SRES =A3(ki
,rand)).
rand)) The SRES is sent back to the MSC/VLR and there compared with
the SRES of the triple. If both SRES are the same, the authentication is
successful. If they are different, the SIM card is rejected, An authentication
i performed
is
f
d when
h
an MS initiates
i iti t
a service
i
request,
t such
h as a call,
ll
location update, and activation of a supplementary service. and only
emergency calls are possible depending on the project.

Ciphering
For the ciphering, the rand is also used in the MS. The key kc is generated
(Kc =A8(Ki,
A8(Ki, Rand)) with the help of the parameter ki stored on the SIM card
and A8.
The ciphering is thereupon carried out with the algorithm 5 stored in the
mobile equipment and the key kc.
kc
The key kc contained in the triple is meanwhile relayed to the BSS. The
algorithm A5 is also available here, so that the ciphering can be carried out
here as well.
ell
65

2GAuthentication

SRES=SignedResponse
66

2GCiphering

67

RelationBetweenthe2GAuthenticationParameters
68

2GUserConfidentiality(privacy):
Methodsforensuringuserconfidentialityareusedbothinthemobilestationandin
g
y
thenetwork.Themobilestationsecuresitselfagainstmisusebyaskingforafourdigit
Personal Identification Number (PIN) when the MS is switched on. The PIN code is
permanently stored in
permanentlystored
inthe
the SIM
SIMcard.
card Only
Onlywhen
when the
thePIN
PIN entered
enteredby
by the
thesubscriber
subscriber is
is
correct,theMSisunlockedandreadyforuse.
On the network side, sensitive signaling information (IMEI, IMSI, directory numbers,
etc ) is
etc.)
is not
not allowed
allowed to
to be
be transmitted
transmitted over
over the
the air
air interface
interface before
before the
the encryption
encryption
processbetweenMSandBTSisinitiated.
The subscriber is identified by means of a temporarily allocated Temporary Mobile
S b ib Identity
Subscriber
Id i (TMSI)
(TMSI) before
b f
the
h encryption
i
process is
i started.
d The
Th TMSI
TMSI is
i
allocated by the network after a successful first time location update, and is
reallocated (renewed) after every successful authentication verification. When the
mobile station is switched off, the current TMSI is stored in the SIM and is available
whentheMSisswitchedonagain.

69

70

71

72

73

74

EIR:Equipment Identity Register

StoringIMEIs

CSDomain
MSC/
VLR

(counterpart:ME)
onWhite/Gray/Black List
PerformingIMEICheck
onVLR/SGSNrequest
optionalnetworkfunction
p

EIR
Gf
SGSN

PSDomain

InternationalMobilestation
EquipmentIdentity(IMEI)
q p
y(
)

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

UMTSAuthenticationParameters
UMTS
Authentication Parameters
AuthenticationQuintuple
RAND
The RAND is a random number provided by the network for a UE. The UE uses the
RAND to generate the authentication response RES or RES+RES_EXT, IK, and CK. The
RAND has 16 bytes.
AUTN
The AUTN is sent to a UE for authenticating the network. The AUTN has 16 bytes.
XRES
The XRES is the authentication response expected from the UE. If the RES or
RES+RES_EXT generated by the UE is the same as the XRES, the authentication is
passed The XRES has 4 to 16 bytes.
passed.
bytes
CK
The CK is the UMTS cipher key in a UMTS network. The CK has 16 bytes.
IK
The IK is the integrity key in a UMTS network. The IK has 16 bytes.

93

AuthenticationParametersStoredonaUSIMCard
h
d
d
IMSI
KI
A th ti ti
Authenticationandencryptionalgorithms(f1,f2,f3,f4,f5,f1*,f5*,UIE,andUIA)OPorOPc
d
ti
l ith (f1 f2 f3 f4 f5 f1* f5* UIE
d UIA) OP OP
SQNMS
AuthenticationParametersStoredontheHLR/AuC
Authentication
Parameters Stored on the HLR/AuC
IMSI
KI
K4
CKSN
Authenticationandencryptionalgorithms(f1,f2,f3,f4,f5,f1
Authentication
and encryption algorithms (f1, f2, f3, f4, f5, f1*,,andf5
and f5*))
AMF
OPorOPc
SQN
Q HE

94

RelationBetweenthe3GAuthenticationParameters

95

EIR:Equipment Identity Register

StoringIMEIs

CSDomain
MSC/
VLR

(counterpart:ME)
onWhite/Gray/Black List
PerformingIMEICheck
onVLR/SGSNrequest
optionalnetworkfunction
p

EIR
Gf
SGSN

PSDomain

InternationalMobilestation
EquipmentIdentity(IMEI)
q p
y(
)

96

EquipmentIdentityRegisterEIR
The EIR is an optional feature in GSM and UMTS. It has been defined to enable theft
TheEIRisanoptionalfeatureinGSMandUMTS.Ithasbeendefinedtoenabletheft
prophylaxis.StolenornonvalidMobileEquipmentMEcanbeblockedfromfurther
usage.
TheEquipmentIdentityRegisterEIRisthelogicalentity,whichisresponsiblefor
q p
y g
g
y,
p
storinginthenetworktheInternationalMobileEquipmentIdentitiesIMEIs(TS
23.002).AnIMEIclearlyidentifiesauniqueMobileEquipmentMEandcontains
informationabouttheplaceofmanufacture,devicetypeandtheserialnumberofthe
equipment.
TheMobileEquipmentMEisclassifiedas"whitelisted","greylisted","blacklisted"or
itmaybeunknownasspecifiedinTS22.016andTS29.002.
TheEIRperformsIMEIChecksonVLRrespectivelySGSNrequesttocheckwhether
theMEisstolenornonvalid.
TheEIRisconnectedto:
TheSGSNviaGf interface
TheVLRviaFinterface

97

ShortMessageServices

98

2
1

SIEMENS

SIEMENS

SIEMENS

MSC

SIEMENS

VLR

5
5
3
SIEMENS

(SMMO)Shortmessage
(SMMO)
Short message
mobileorigination

SIEMENS

Interworking
MSC

MSCfunction
(MAPMSC)usually
I t
Integratedinthe
t d i th
SMSCenteritself

5
5Deliveryreport
4
PBX

SMS
Center

99

(SMMT)Shortmessagemobile
termination

1BMSISDN+SMS
2InterrogateHLR(BMSISDN+SMSC)
3MSCID+BIMSI
4IMSI+SMS+SMSC
5,6CheckingIMSI
7P i
7Paging
8SMStoMS
100

LocationUpdate

101

Location Updating
LocationUpdating
LA-1

Location update is
performed when there
is a boundary crossing.
crossing

LA-2
No location
update
Location update

102

Location Update
LocationUpdate
In practice, there are three types of location updates:
1. LocationRegistration(PowerOn)
g
(
)
2. Generic
3. Periodic

Location registration:
takes place when a mobile station is turned on. This is also known as IMSI Attach
because as soon as the mobile station is switched on, it informs the Visitor Location
Register(VLR)that it is now back in service and is able to receive calls.
calls As a result of a
successful registration, the network sends the mobile station two numbers that are
stored in the SIM(Subscriber Identity Module)card of the mobile station.

Generic:
Every time the mobile receives data through the control channels, it reads the LAI
and compares it with the LAI stored in its SIM card. A Generic location update is
performed if they are different. The mobile starts a location Update process by
accessing the MSC/VLR that sent the location data.

Periodic:
Periodic Location Update is carried out when the network does not receive any
location update
p
request
q
from the mobile in a specified
p
time.
103

104

Handover/Relocation

105

Handover
Handover is the means of maintaining a call when a user moves
outside the coverage area of the serving cell.
cell
The call must be switched to an alternative cell to provide service,
automatically and without loss of service.
Handover is a complex process requiring synchronisation of events
between the mobile station and the network.
In particular, there is the need to route the call to the new cell before
handover can be effected whilst maintaining the old connection until
the new connection is known to have succeeded.
Handover is a time critical process requiring action to be taken before
the existing radio link degrades to such an extent that the call is lost.

106

Handover

107

Intracell Handover
IntracellHandover

BTS

BTS

108

Intercell
Inter
cellIntra
IntraBSC
BSCHandover
Handover

BSC/RNC

BTS
NodeB

109

BSC/
RNC

BTS
NodeB

InterBSC/RNCIntraMSCHandover
BSC

MSC
VLR

B
T
S
B
T
S

BSC

B
T
S
B
T
S

B
T
S

B
T
S
B
T
S

B
T
S
B
T
S

110

InterBSC/RNCInterMSCHandover
BSC
MSC1
VLR

B
T
S
B
T
S
B
T
S
B
T
S

MSC2

B
T
S

VLR

BSC
B
T
S

B
T
S

B
T
S
B
T
S

111