Technical Manual-System Function

Chapter 1 Introduction to Functions and Services ......................................
1-1
Chapter 2 Security Management .................................................................... 2-1

2.1 Authentication ......................................................................................... 2-1
2.1.1 Introduction to Authentication ........................................................ 2-1
2.1.2 Authentication Parameters ............................................................. 2-1
2.2 Authentication Theory ............................................................................ 2-3
2.2.1 Comparison of the Parameters ...................................................... 2-4
2.2.2 Basic Authentication Operations .................................................... 2-5
2.3 Common Authentication Messages ........................................................ 2-6
2.4 Authentication Procedures ..................................................................... 2-7
2.4.1 Authentication upon Access ........................................................... 2-7
2.4.2 SSD Update ................................................................................... 2-10
2.4.3 Unique Challenge .......................................................................... 2-14
Chapter 3 Mobility Management..................................................................... 3-1
3.1 Location Management ............................................................................ 3-1
3.1.1 Common Messages ....................................................................... 3-1
3.1.2 Major Location Management Procedures ...................................... 3-5
3.2 VLR Functions ........................................................................................ 3-7
3.3 Handoff ................................................................................................... 3-9
3.3.1 Introduction to Handoff ................................................................... 3-9
3.3.2 Classification .................................................................................. 3-9
3.3.3 Handoff Procedures ....................................................................... 3-10
3.4 Roaming Restriction ............................................................................... 3-16
3.4.1 Basic Roaming Restriction ............................................................. 3-16
3.4.2 Enhanced Roaming Restriction ..................................................... 3-16
3.4.3 Application of Roaming Restriction ................................................ 3-16
Chapter 4 Call Control ..................................................................................... 4-1
4.1 Call Connection ...................................................................................... 4-1
4.2 Number Saving and Translating ............................................................. 4-1
4.3 Route Selection ...................................................................................... 4-2
4.4 Call Duration Monitoring and Forced Call Disconnect ............................ 4-3
4.5 Overload Control .................................................................................... 4-3
4.6 Echo Cancellation .................................................................................. 4-4
4.7 Tone Play ............................................................................................... 4-5
4.8 Call Procedures ...................................................................................... 4-6
4.8.1 Intra-MSC Call ............................................................................... 4-7
4.8.2 Inter-MSC Call ............................................................................... 4-9
4.8.3 Mobile-PSTN Call .......................................................................... 4-11
4.8.4 PSTN-Mobile Call .......................................................................... 4-12
Chapter 5 Short Message Services ................................................................ 5-1
5.1 Service Procedures ................................................................................ 5-1
5.1.1 MS Short Message Origination ...................................................... 5-1
5.1.2 MS Short Message Termination .................................................... 5-1
5.1.3 Short Message Notification ............................................................ 5-3
5.1.4 Short Message Broadcast .............................................................. 5-6
Chapter 6 Charging ......................................................................................... 6-1
6.1 Charging Flow ........................................................................................ 6-1
6.2 Sorting of Bills ........................................................................................ 6-2
6.2.1 MOC Bill and MTC Bill ................................................................... 6-3
6.2.2 Call Forwarding Bill ........................................................................ 6-3
6.2.3 Call Attempt Bill.............................................................................. 6-4
6.2.4 Roaming Bill ................................................................................... 6-4
6.2.5 Gateway Outgoing Bill ................................................................... 6-4
6.2.6 Transit Bill ...................................................................................... 6-4
6.2.7 Bills for Other Supplementary Services ......................................... 6-4
6.2.8 Short Message Bill ......................................................................... 6-5
6.2.9 Trunk Metering Bill ......................................................................... 6-5
6.2.10 Emergency Call Bill ...................................................................... 6-5
6.2.11 RFC Bill ........................................................................................ 6-5
6.2.12 PDSN Bill ..................................................................................... 6-5
6.2.13 PRA Originated/Terminated Call Bill ............................................ 6-5
6.2.14 Long-Duration Call Bill ................................................................. 6-5
6.2.15 Common Call Bills........................................................................ 6-6
6.3 Bill Backup .............................................................................................. 6-7
6.3.1 Purpose.......................................................................................... 6-7
6.3.2 Classification .................................................................................. 6-7
6.4 Bill Processing ........................................................................................ 6-8
6.4.1 Sorting and Filtering of Bills ........................................................... 6-8
6.4.2 Format Conversion ........................................................................ 6-9
Chapter 7 IN Services ...................................................................................... 7-1
Chapter 8 Data Services .................................................................................. 8-1
Chapter 9 Supplementary Services ............................................................... 9-1
Chapter 10 Optional Services ......................................................................... 10-1
Chapter 11 Networking.................................................................................... 11-1

Chapter 12 Number Analysis .......................................................................... 12-1
Appendix A Abbreviations and Acronyms .................................................... A-1

HUAWEI
HUAWEI M800 CDMA Mobile Switching Center

Technical Manual - System Function
V610R003
HUAWEI M800 CDMA Mobile Switching Center
Technical Manual
Volume System Function
Manual Version T2-030240-20040401-C-6.30
Product Version V610R003
BOM 31026240
Huawei Technologies Co., Ltd. provides customers with comprehensive technical support
and service. Please feel free to contact our local office or company headquarters.
Huawei Technologies Co., Ltd.
Address: Administration Building, Huawei Technologies Co., Ltd.,
Bantian, Longgang District, Shenzhen, P. R. China
Postal Code: 518129
Website: http://www.huawei.com
Email: support@huawei.com
Copyright © 2004 Huawei Technologies Co., Ltd.
All Rights Reserved
No part of this manual may be reproduced or transmitted in any form or by any

means without prior written consent of Huawei Technologies Co., Ltd.
Trademarks
, HUAWEI, C&C08, EAST8000, HONET, , ViewPoint, INtess, ETS, DMC,

TELLIN, InfoLink, Netkey, Quidway, SYNLOCK, Radium, M900/M1800,
TELESIGHT, Quidview, Musa, Airbridge, Tellwin, Inmedia, VRP, DOPRA, iTELLIN,
HUAWEI OptiX, C&C08 iNET, NETENGINE, OptiX, iSite, U-SYS, iMUSE, OpenEye,
Lansway, SmartAX, infoX, TopEng are trademarks of Huawei Technologies Co.,
Ltd.
All other trademarks mentioned in this manual are the property of their respective
holders.
Notice
The information in this manual is subject to change without notice. Every effort has
been made in the preparation of this manual to ensure accuracy of the contents, but
all statements, information, and recommendations in this manual do not constitute
the warranty of any kind, express or implied.
About This Manual
Release Notes
This manual applies to HUAWEI M800 CDMA Mobile Switching Center V610R003
Related Manuals
The set of documentation for HUAWEI M800 CDMA Mobile Switching Center is listed
in the table below.
Manual Content
HUAWEI M800 CDMA Mobile Switching Describes structure, major contents of manuals and
Center Documentation Guide retrieval methods of package of documents.
HUAWEI M800 CDMA Mobile Switching
Basic information on architecture, features, technical
Center Technical Manual-System
indices, functions and external interface attributes.
Description
Introduction to architecture, functional modules, and the
Center Technical Manual-System
signal and message flows.
Architecture
Introduction to signaling system structure and explanation
Center Technical Manual-Signaling
of messages.
System
HUAWEI M800 CDMA Mobile Detailed description on basic functions and their
Switching Center Technical theories, and briefing on the provision of various
Manual-System Function services.
HUAWEI M800 CDMA Mobile Switching Introduction to hardware, including cabinets, subracks,
Center Hardware Description Manual boards and cables.
HUAWEI M800 CDMA Mobile Switching Instruction on operation and maintenance at various
Center Operation Manual-Routine terminals and common administrative operations on the
Operation system.
HUAWEI M800 CDMA Mobile Switching Introduction to principles for data configuration, including
Center Operation Manual-Data sequence of data configuration and principles for
Configuration numbering, as well as data configuration commands, and
notes on data configuration.
Introduction to theories, operations, examples and
Center Operation Manual-Performance
common performance measurement tasks.
Measurement
HUAWEI M800 CDMA Mobile Switching Introduction to provision of services other than basic
Center Operation Manual-Feature services, including theories of realization, data
Description configuration, service interworking and service flows.
Manual Content
Introduction to requirements of routine maintenance and
Center Maintenance Manual-Routine
instructions on routine maintenance.
Maintenance
HUAWEI M800 CDMA Mobile Switching Instructions on replacement procedures of boards,

Center Maintenance Manual-Parts backplanes, terminal system parts replacement and notes
Replacement on replacement.
Instructions on analysis of service provision faults and
Center Maintenance
troubleshooting with the results of such analysis.
Manual-Troubleshooting
Instructions on installation of hardware and methods of
Center Installation Manual-Hardware
verification after installation.
Installation
Instructions on installation of software and remote
Center Installation Manual-Software
maintenance configuration.
Installation
HUAWEI M800 CDMA Mobile Switching Instructions on debugging after successful installation of
Center Installation Manual-System hardware and software, as well as description on initial
Commissioning verification, cutover, upgrading, patch loading, and online
capacity expansion.
HUAWEI iGateway Bill User Manual Introduction to theories, installation, operation,

maintenance and troubleshooting of iGWB.
Organization
This manual introduces the basic functions of Huawei M800 CDMA MSC, such as the
security management, roaming management, call control and service provision.
There are twelve chapters and one appendix in the manual.
Chapter 1 Introduction to Functions and Services introduces the contents of this

manual.
Chapter 2 Security Management details the security management of the MSC from
the aspect of authentication.
Chapter 3 Mobility Management introduces the mobility management functions of

the system in terms of roaming and handoff.
Chapter 4 Call Control describes the basic call control functions and call procedures
of the MSC.
Chapter 5 Short Message Services presents short messages services supported by

the system, along with their signal flows.
Chapter 6 Charging introduces the charging functions of the system, including bill
sorting and charging theory.
Chapter 7 IN Services lists the IN services provided by the system.
Chapter 8 Data Services lists the data services provided by the system.
Chapter 9 Supplementary Services lists the supplementary services provided by

the system.
Chapter 10 Optional Services lists the optional services provided by the system.
Chapter 11 Networking introduces the various networking schemes supported by

the system.
Chapter 12 Number Analysis describes the various applications of number analysis,

including number conversion and number adaptation.
Appendix A Abbreviations and Acronyms lists the abbreviations and acronyms

used in the manual.
Intended Audience
The manual is intended for the following readers:

z Technical marketing specialists
z Installation engineers and technicians
z Operation and maintenance personnel
Conventions
The manual uses the following conventions:
I. General conventions
Convention Description
Arial Normal paragraphs are in Arial.
Arial Narrow Warnings, Cautions, Notes and Tips are in Arial Narrow.
Boldface Headings are in Boldface.
Courier New Terminal Display is in Courier New.
II. Symbols
Eye-catching symbols are also used in the manual to highlight the points worthy of
special attention during the operation. They are defined as follows:
Caution: Means reader be extremely careful during the operation.
Note: Means a complementary description.

HUAWEI M800 CDMA Mobile Switching Center Table of Contents
Table of Contents
Chapter 1 Introduction to Functions and Services.................................................................... 1-1
Chapter 2 Security Management.................................................................................................. 2-1

2.1 Authentication .................................................................................................................... 2-1
2.1.1 Introduction to Authentication.................................................................................. 2-1
2.1.2 Authentication Parameters...................................................................................... 2-1
2.2 Authentication Theory........................................................................................................ 2-3
2.2.1 Comparison of the Parameters ............................................................................... 2-4
2.2.2 Basic Authentication Operations ............................................................................. 2-5
2.3 Common Authentication Messages ................................................................................... 2-6
2.4 Authentication Procedures................................................................................................. 2-7
2.4.1 Authentication upon Access.................................................................................... 2-7
2.4.2 SSD Update .......................................................................................................... 2-10
2.4.3 Unique Challenge.................................................................................................. 2-14
Chapter 3 Mobility Management .................................................................................................. 3-1

3.1 Location Management ....................................................................................................... 3-1
3.1.1 Common Messages ................................................................................................ 3-1
3.1.2 Major Location Management Procedures ............................................................... 3-5
3.2 VLR Functions ................................................................................................................... 3-7
3.3 Handoff .............................................................................................................................. 3-9
3.3.1 Introduction to Handoff............................................................................................ 3-9
3.3.2 Classification ........................................................................................................... 3-9
3.3.3 Handoff Procedures .............................................................................................. 3-10
3.4 Roaming Restriction ........................................................................................................ 3-16
3.4.1 Basic Roaming Restriction .................................................................................... 3-16
3.4.2 Enhanced Roaming Restriction............................................................................. 3-16
3.4.3 Application of Roaming Restriction ....................................................................... 3-16
Chapter 4 Call Control................................................................................................................... 4-1

4.1 Call Connection.................................................................................................................. 4-1
4.2 Number Saving and Translating ........................................................................................ 4-1
4.3 Route Selection.................................................................................................................. 4-2
4.4 Call Duration Monitoring and Forced Call Disconnect....................................................... 4-3
4.5 Overload Control................................................................................................................ 4-3
4.6 Echo Cancellation .............................................................................................................. 4-4
4.7 Tone Play........................................................................................................................... 4-5
4.8 Call Procedures ................................................................................................................. 4-6
4.8.1 Intra-MSC Call......................................................................................................... 4-7
i
4.8.2 Inter-MSC Call......................................................................................................... 4-9

4.8.3 Mobile-PSTN Call.................................................................................................. 4-11
4.8.4 PSTN-Mobile Call.................................................................................................. 4-12
Chapter 5 Short Message Services ............................................................................................. 5-1

5.1 Service Procedures ........................................................................................................... 5-1
5.1.1 MS Short Message Origination ............................................................................... 5-1
5.1.2 MS Short Message Termination.............................................................................. 5-1
5.1.3 Short Message Notification ..................................................................................... 5-3
5.1.4 Short Message Broadcast....................................................................................... 5-6
Chapter 6 Charging ....................................................................................................................... 6-1

6.1 Charging Flow.................................................................................................................... 6-1
6.2 Sorting of Bills .................................................................................................................... 6-2
6.2.1 MOC Bill and MTC Bill ............................................................................................ 6-3
6.2.2 Call Forwarding Bill ................................................................................................. 6-3
6.2.3 Call Attempt Bill ....................................................................................................... 6-4
6.2.4 Roaming Bill ............................................................................................................ 6-4
6.2.5 Gateway Outgoing Bill............................................................................................. 6-4
6.2.6 Transit Bill................................................................................................................ 6-4
6.2.7 Bills for Other Supplementary Services .................................................................. 6-4
6.2.8 Short Message Bill .................................................................................................. 6-5
6.2.9 Trunk Metering Bill .................................................................................................. 6-5
6.2.10 Emergency Call Bill ............................................................................................... 6-5
6.2.11 RFC Bill ................................................................................................................. 6-5
6.2.12 PDSN Bill............................................................................................................... 6-5
6.2.13 PRA Originated/Terminated Call Bill ..................................................................... 6-5
6.2.14 Long-Duration Call Bill .......................................................................................... 6-5
6.2.15 Common Call Bills ................................................................................................. 6-6
6.3 Bill Backup ......................................................................................................................... 6-7
6.3.1 Purpose ................................................................................................................... 6-7
6.3.2 Classification ........................................................................................................... 6-7
6.4 Bill Processing ................................................................................................................... 6-8
6.4.1 Sorting and Filtering of Bills .................................................................................... 6-8
6.4.2 Format Conversion.................................................................................................. 6-9
ii
Chapter 7 IN Services ................................................................................................................... 7-1
Chapter 8 Data Services ............................................................................................................... 8-1
Chapter 9 Supplementary Services ............................................................................................. 9-1
Chapter 10 Optional Services .................................................................................................... 10-1
Chapter 11 Networking ............................................................................................................... 11-1
Chapter 12 Number Analysis ..................................................................................................... 12-1
Appendix A Abbreviations and Acronyms .................................................................................A-1
iii
HUAWEI M800 CDMA Mobile Switching Center Chapter 1 Introduction to Functions and Services
Chapter 1 Introduction to Functions and Services
This manual gives an introduction to the basic functions and services provided by
M800 CDMA Mobile Switching Center (hereinafter referred to as the MSC).
I. Basic Functions
Chapters 2 to 6 describe the basic functions of the MSC, including:

z Security Management
This chapter focuses on the authentication functions of the MSC. Details are given on
the classification of authentication, authentication parameters and authentication
message flows.
z Mobility Management
This chapter focuses on the mobility management of the MSs. Details are given on
the location management, VLR function, handoff function and roaming restriction.
z Call Control
This chapter focuses on the control functions performed by the MSC in the process of
a call. Details are given on the following flows:
– Intra-MSC call
– Inter-MSC call
– Mobile-PSTN call
– PSTN-mobile call
z Short Message Service
This chapter focuses on the common short message flows. Details are given on the
following short message flows:
– MS short message origination
– MS short message termination
– Short message notification
– Short message broadcast

z Charging
This chapter focuses on the charging flow. Details are given on the classification,
backup, picking, filtering and format conversion of bills.
1-1
HUAWEI M800 CDMA Mobile Switching Center Chapter 1 Introduction to Functions and Services
II. Service Provision
Chapters 7 to 12 describe the services provided by the MSC. Each chapter

introduces one service category.
z IN services
z Data services
z Supplementary services
z Optional services
z Networking
z Number analysis
For more information about the service provision, see M800 CDMA Mobile Switching
Center Operation Manual – Feature Description.
1-2
HUAWEI M800 CDMA Mobile Switching Center Chapter 2 Security Management
Chapter 2 Security Management
The security management of HUAWEI M800 CDMA Mobile Switching Center

(hereinafter referred to as “MSC”) involves authentication and encryption.
Authentication helps to protect the system resources from being used by illegal users.
Whether and when to perform authentication can be set in the Operation and
Maintenance (O&M) system of the MSC.
The MSC supports Cellular Authentication and Voice Encryption (CAVE) algorithm.
Encryption helps to to secure the signaling channels and safeguard the subscriber
identification information and authentication data. The MSC provides subscriber
information (both signaling message and voice) encryption algorithm interface.
In brief, authentication serves as a means of verification on the legitimacy of the

subscribers, while encryption, is a means of protection on subscriber information.
2.1 Authentication
This section gives an introduction on the classification of authentication and

authentication parameters including the name, algorithm, storage and transmission of
these parameters.
2.1.1 Introduction to Authentication
The MSC performs authentication to determine whether a subscriber is authorized to

access the mobile communication network. Illegal subscribers will be rejected from
accessing the network.
The MSC performs the following authentications:

z Authentication upon location registration.
z Authentication upon call origination.
z Authentication upon call termination.
z Shared Secrete Data (SSD) update.
z Unique challenge.
2.1.2 Authentication Parameters
This section gives an introduction to various authentication parameters.
2-1
I. A_Key
A_Key is a 64-bit encryption key. It is a permanent key shared by the Mobile Station
(MS) and the Authentication Center (AC). When an account is opened for a
subscriber, A_Key will be stored in the MS and the AC permanently, and will never be
transmitted by any means or to any entity.
II. SSD
SSD is a 128-bit encryption key. It is actually a temporary key used in authentication.
Unlike A_Key, SSD can be modified and regenerated by the network side, since it is
only semi-permanent. SSDs are saved in the MSs and the AC, sometimes in the
Visitor Location Register (VLR). Whether SSD is saved in the VLR is determined
jointly by: 1) Whether the VLR supports CAVE algorithm; and 2) Whether the AC
allows SSD to be shared by the VLR.
If the VLR supports CAVE and the AC allows the sharing of SSD in the VLR,
authentication will be performed at the VLR upon the access attempt of a subscriber.
This is referred to as “SSD shared”. If the VLR does not support CAVE, or the AC
does not allow the sharing of SSD with the VLR, authentication will be performed in
the AC instead, and this is referred to as “SSD unshared”.
In SSD-shared authentication, the signaling procedure is simple. There is no need for

the AC to perform authentication each time a subscriber makes an access attempt. In
this case, the SSD saved in the MS should be the same as that saved at the network
side (the VLR or the AC), otherwise SSD update will be initiated by the latter.
SSD is not transferred on the air interface. It is a random number obtained by

executing CAVE algorithm with A-Key, Electronic Serial Number (ESN) and
RANDSSD (another random number shared between the MS and the network side).
SSD_A and SSD_B, two 64-bit numbers are generated after this calculation. SSD_A
is used in authentication, while SSD_B, in the encryption of voice, data and
signalings.
III. RAND/RANDU/RANDBS/RANDSSD
z RAND: A 4-byte random number generated by the Base Station Controller (BSC)
that is broadcast to the MSs on the control channel. It is used to calculate
AUTHR in authentication upon access.
z RANDU: A 3-byte random number generated by the network side, used to
calculate AUTHU in a unique challenge.
z RANDBS: A 4-byte random number generated by the MS, used to calculate
AUTHBS in a base station challenge.
z RANDSSD: A 7-byte random number generated by the network side, used to
calculate SSD in an SSD update.
2-2
IV. RANDC
RANDC is the most significant byte of RAND. An MS obtains RANDC from RAND and
sends it to the BSC.
Upon the access request of an MS, the BSC sends RANDC and RAND to the MSC.
Then the MSC checks whether RANDC is the same as the most significant byte of
RAND, and determines whether the MS has calculated AUTHR with the specified
RAND. If RANDC is different from the most significant byte of RAND, the
authentication will fail.
V. AUTHR/AUTHU/AUTHBS
These are all 3-byte parameters.

z AUTHR is generated from RAND with CAVE algorithm. It is used for
authentication upon access.
z AUTHU is generated from RANDU with CAVE algorithm. It is used for unique
challenges.
z AUTHBS is generated from RANDBS with CAVE algorithm. It is used for base
station challenge.
VI. COUNT
COUNT is the total number of calls initiated by a subscriber. Upon the access request
of an MS, COUNT will be sent to the AC, which compares it with the one it saves.
Authentication will fail if the two are not the same.
VII. AUTHDATA
AUTHDATA is a 3-byte authentication parameter. It is used in location registration,

mobile origination, mobile termination and authentication. It is the input of CAVE
algorithm during the authentication. In location registration or call termination,
AUTHDATA is obtained from Mobile Identification Number (MIN), while in call
origination, from Mobile Directory Number (MDN). AUTHDATA can be sent by the MS
to the MSC upon access to the system, or generated by the MSC itself.
VIII. NOSSD
NOSSD is a parameter sent by the AC to the VLR to indicate that the previously
provided SSD is no longer valid.
2.2 Authentication Theory
For the calculations carried out by different entities using the same algorithm, if the
parameters used by the entities are the same, the results should also be the same.
2-3
The basic theory of CDMA authentication is as follows: The same authentication

algorithm (CAVE) is used at both the MS and the network sides. If the results of the
calculations turn out to be the same, the authentication is successful; else it fails.
2.2.1 Comparison of the Parameters
This section gives an introduction to the authentication algorithms and the

comparision between authentication parameters of the network side and of the MS.
I. AUTHR
z MS side
Authentication algorithm: CAVE.
Input: RANDC (generated from random number RAND), AUTHDATA (generated from
called subscriber MDN), and SSD and ESN saved in the MS.
Output: AUTHR.
z Network side
Upon access to the system, the MS sends the RAND, the called number, MIN, ESN,
RANDC and AUTHDATA to the BSC, which forwards these parameters to the MSC.
The MSC first determines whether the RAND and RANDC match. If not, the
authentication fails; otherwise, the MSC sends the RANDC, AUTHDATA, MIN, ESN
and AUTHR to the VLR (if SSD is shared) or the AC (if SSD is not shared), where the
subsequent calculation is performed.
Authentication algorithm: CAVE.
Input: RANDC (generated from random number RAND), AUTHDATA (generated from
called subscriber MDN), and SSD and ESN saved at the network side.
Output: AUTHR.
z Comparison
The MSC compares the AUTHR received from the MS with that obtained in the
calculation made at the network side. Authentication will fail if the two are not the
same.
The same algorithm is employed at the MS and at the network side, and the input
parameters are also the same. Therefore, if the AUTHRs at both sides differ, it could
be that the SSD saved at the two sides are not the same. In this case, the network
side will initiate SSD update.
II. Comparison of AUTHU
The comparison procedure of AUTHU is similar to that of AUTHR.
2-4
The AUTHU is generated from the RANDU for unique challenge.
The RANDU is generated at the network side (by the VLR or the AC), and sent to the
MS. The MS, upon receiving the RANDU, calculates and generates the AUTHU, and
sends it back to the network side. The network side then compares the AUTHU
received from the MS with the one it saves. Authentication will fail if the two are not
the same.
III. Comparison of AUTHBS
The comparison procedure of AUTHBS is similar to that of AUTHR.
The AUTHBS is generated from the RANDBS for base station challenge. The
RANDBS is generated by the MS and sent to the network side. The network side,
upon receiving the RANDBS, calculates and generates the AUTHBS, and sends it
back to the MS. The MS then compares the AUTHBS received from the network side
with the one it saves. Authentication will fail if the two are not the same.
2.2.2 Basic Authentication Operations
Authentication operations are performed to guarantee the legitimacy of both the

network and the MS.
A unique challenge is performed to verify the legitimacy of an MS, and base station
challenge, that of the BS.
SSD update is conducted to guarantee the consistency of SSD parameters between

the MS and the BSS, since in such an update the SSD parameters saved in an MS
are changed into the same with those in the BSS.
I. Unique challenge
Unique challenge is initiated by the network side to check if an MS is legitimate. It can

be initiated by the AC directly, or after SSD update. However, each SSD update is
followed by a unique challenge.
The network side (VLR or AC) generates the RANDU and sends it to the MS. The MS,
upon receiving the RANDU, calculates and generates the AUTHU, and sends it back
to the network side. The network side then compares the AUTHU received from the
MS with the one it saves. Unique challenge will fail if the two are not the same.
II. Base station challenge
Base station challenge is initiated by an MS to check if the network side is legitimate.

Base station challenge is not carried out separately. It is made within a SSD update.
Each SSD update contains a base station challenge.
2-5
The RANDBS is generated by the MS and sent to the network side. The network side,
upon receiving the RANDBS, calculates and generates the AUTHBS, and sends it
back to the MS. The MS then compares the AUTHBS received from the network side
with the one it saves. Base station challenge will fail if the two are not the same.
III. SSD update
SSD update is initiated by the network side to update the SSD saved in the MS. It can
be initiated upon the failure of access authentication, or directly by the HLR or AC.
The RANDSSD is generated by the network side and sent to the MS. The MS, upon
receiving the RANDSSD, calculates and generates a new SSD. Then it generates a
new AUTHBS, and initiates a base station challenge with this AUTHBS. If the
challenge succeeds, the MS discards the old SSD, saves the SSD newly generated,
and informs the network side of the successful SSD update. The network side then
generates a new AUTHU with the SSD received from the MS, and initiates a unique
challenge to verify if the SSD update is successful.
2.3 Common Authentication Messages
This section gives an introduction to the common authentication messags and their
application.
I. AUTHDIR
Authentication directive (AUTHDIR) is initiated by the HLR for

z SSD update.
z Unique challenge.
II. AUTHREQ
Authentication request (AUTHREQ) is initiated by MSC for MS access authentication.
Authentication request is initiated during

z Location registration, including MS power up/down location registration and
periodic location registration.
z Call origination, including that of voice call, short messages, and Short Data
Burst (SDB) service.
z Call termination, including that of voice call and Packet Data Serving Node
(PDSN) service.
Service processing will proceed if the authentication succeeds. If the authentication
fails, SSD update and unique challenge will be initiated.
2-6
III. ASREPORT
Authentication status report (ASREPORT) is initiated by the MSC to report the status
of SSD update and unique challenge to the HLR, for example, whether to perform
SSD update, whether SSD update is successful, whether to perform unique challenge,
and whether unique challenge is successful.
IV. AFREPORT
Authentication failure report (AFREPORT) is initiated by the MSC after MS access

authentication fails so as to report authentication failure to the HLR and AC.
Authentication failure report may be initiated in the following cases:
z The BSC reports authentication failure.
z The MSC (VLR) supports authentication, but the MS lacks necessary
authentication parameters.
z The RANDC and RAND do not match.
z Authentication at the VLR fails when SSD is shared.
2.4 Authentication Procedures
To guarantee system security, authentication is conducted upon MS access. This

section gives an introduction to the various authentication procedures.
Also included in this section is an introduction to SSD update flow and unique
challenge flow.
2.4.1 Authentication upon Access
Authentication upon access occurs in the following cases:

z Location registration.
z Call origination.
z Call termination.
I. Authentication upon location registration
The procedure of authentication upon location registration is shown in Figure 2-1.
2-7
BSS MSC/VLR HLR/AC
LOCATION_UPDATE_REQUEST(RANDC,RAND, AUTHR,COUNT)
a
AUTHREQ( RAND,AUTHR,COUNT)
b
authreq
c
REGNOT
d
reqnot
e
LOCATION_UPDATE_ACCEPT
f
BSS: Base Station Subsystem

MSC/VLR: Mobile Switching Center/Visitor Location Register
HLR/AC: Home Location Register/Authentication Center
Figure 2-1 Authentication upon location registration
a. The MS sends a LOCATION_UPDATE to the MSC/VLR, containing the RANDC,

RAND, AUTHR and COUNT.
b. The MSC/VLR sends an AUTHREQ to the HLR/AC, containing the RAND, AUTHR,
and COUNT.
c. The HLR/AC performs the authentication to check the legitimacy of the MS, and
returns an authreq to the MSC/VLR, including the results of the authentication.
d. Upon receipt of the authreq, the MSC/VLR determines whether to allow the access
of the MS based on the results of the authentication contained in the message. In
Figure 2-1, the MSC/VLR sends a REGNOT to the HLR/AC after the authentication
succeeds.
e. The HLR/AC then returns a regnot.
f. The MSC/VLR sends a LOCATION_UPDATE_ACCPET to the Base Station

Subsystem (BSS).
II. Authentication upon call origination
The procedure of authentication upon call origination is shown in Figure 2-2.
2-8
BSS MSC/VLR HLR/AC
CM_SERVICE_REQUEST(RANDC,RAND, AUTHR,COUNT,DIGITSDIALED)
a
AUTHREQ(DIGITSDIALED, RAND,AUTHR,COUNT)
b
authreq
c
ASSIGNED_REQUEST
d
ASSIGNED_COMPLETE
e

Figure 2-2 Authentication upon call origination
a. The MS sends a CM_SERVICE_REQUEST to the MSC/VLR, containing the

RANDC, RAND, AUTHR, COUNT and DIGITSDIALED.
b. The MSC/VLR sends an AUTHREQ to the HLR/AC, containing the RAND, AUTHR,
COUNT and DIGITSDIALED.
c. The HLR/AC performs the authentication to check the legitimacy of the MS, and
returns an authreq to the MSC/VLR, containing the results of the authentication.
d. Upon receipt of the authreq, the MSC/VLR determines whether to allow the access
of the MS based on the results of the authentication contained in the message. The
MSC/VLR sends an ASSIGN_REQUEST to the BSS if the authentication succeeds.
e. The BSS returns an ASSIGN_COMPLETE to the MSC/VLR.
III. Authentication upon call termination
The procedure of authentication upon call termination is shown in Figure 2-3.
2-9
BSS MSC/VLR HLR/AC
PAGING_REQUEST
a
PAGING_RESPONSE(RANDC,RAND ,AUTHR,COUNT)
b
AUTHREQ( RAND,AUTHR,COUNT)
c
authreq
d
ASSIGN_REQUEST
e
ASSIGN_COMPLETE
f

Figure 2-3 Authentication upon call termination
a. The MSC/VLR sends a PAGING_REQUEST to the BSS.
b. The MS returns a PAGING_RESPONSE containing the RANDC, RAND, AUTHR,

and COUNT.
c. The MSC/VLR sends an AUTHREQ to the HLR/AC, containing the RAND, AUTHR,
and COUNT.
d. The HLR/AC performs the authentication to check the legitimacy of the MS, and
returns an authreq to the MSC/VLR, containing the results of the authentication.
e. Upon receipt of the authreq, the MSC/VLR determines whether to allow the access
of the MS based on the results of the authentication contained in the message. In
Figure 2-3, the MSC/VLR sends an ASSIGN_REQUEST to the HLR/AC after the
authentication succeeds.
f. The BSS returns an ASSIGN_COMPLETE to the MSC/VLR.
2.4.2 SSD Update
SSD update can be initiated upon authentication request failure or directly by the AC.
I. SSD update upon authentication request failure
Figure 2-4 shows the procedure of SSD update initiated upon authentication request
failure.
2-10
BSS MSC VLR HLR/AC
AUTHREQ
a
authreq(RANDSSD , AUTHU , RANDU)
b
SSD_UPDATE_REQUEST(RANDSSD)
c
BS_CHALLENGE(RANDBS)
d
BSCHAll(RANDBS)
e
bschall(AUTHBS)
f
BS_CHALLENGE_RESPONSE(AUTHBS)
g
SSD_UPDATE_RESPONSE
h
AUTH_REQUEST(RANDU)
i
AUTH_RESPONSE(AUTHU)
j
ASREPORT(SSDURPT,UCHALRPT)
k
asreport
l
m
asreport
n
BSS: Base Station Subsystem MSC: Mobile Switching Center

HLR/AC: Home Location Register/Authentication Center VLR: Visitor Location Register
Figure 2-4 SSD update upon authentication request failure
a. The MSC sends an AUTHREQ to the HLR/AC.
b. The HLR/AC performs authentication, and replies with an authreq to initiate SSD
update after the authentication fails. The authreq contains the RANDSSD (used to
generate SSD), AUTHU and RANDU (used to generate AUHTU).
c. The MSC sends an SSD_UPDATE_REQUESTSSD to the MS with the RANDSSD

(used to generate the new SSD).
d. The MS returns a BS_CHALLENGE_REQUEST containing the RANDBS to

demand a verification of network legitimacy.
e. The MSC sends a BSCHALL with the RANDBS to HLR/AC.
f. The HLR/AC returns a bschall with the RANDBS to the MSC.
2-11
g. The MSC sends a BS_CHALLANGE_RESPONSE with the AUTHBS to the MS.
h. The MS checks and accepts the message, and updates the SSD it saves. Then it
sends an SSD_UPDATE_RSPONSE to the MSC.
i. A unique challenge is then initiated after the SSD update. The MSC sends an
AUTH_REQUEST to the BSS with the RANDU.
j. The MS calculates and generates the AUTHU with the updated SSD and RANDU,
and reports it in an AUTH_RESPONSE to the MSC/VLR.
k. The MSC sends an ASREPORT to the VLR, containing the SSDUPRT and
UCHRPT.
l. The VLR returns an asreport to the MSC.
m. The MSC sends an ASREPORT to HLR/AC, containing the SSDUPRT and

UCHRPT.
n. The HLR/AC returns an asreport to the MSC.
II. SSD update directly initiated by AC
Figure 2-5 shows the procedure of SSD update directly initiated by the AC.
2-12
BSS MSC VLR HLR/AC
AUTHDIR(RANDSSD,RANDU,AUTHU)
a
authdir
b
SSD_UPDATE_REQUEST(RANDSSD)
c
BS_CHALLENGE_RESPONSE(RANDBS)
d
BSCHAll(RANDBS)
e
bschall(AUTHBS)
f
BS_CHALLENGE_RESPONSE(AUTHBS)
g
SSD_UPDATE_RESPONSE
h
AUTH_REQUEST(RANDU)
i
j
k
asreport
l
m
asreport
n

Figure 2-5 SSD update directly initiated by AC
a. The HLR/AC sends an SSD update request to the MSC, containing the RANDSSD
(used to generate the SSD), AUTHU and AUTHU (used to generate the RANDU).
b. The MSC returns an authdir.
c. The MSC sends an SSD_UPDATE_REQUESTSSD to the MS with the RANDSSD

(which is used to generate the new SSD).
d. The MS sends a BS_CHALLENGE_REQUEST to the MSC, containing the

RANDBS to demand a verification of network legitimacy.
e. The MSC forwards the BS_CHALLENGE_REQUEST to the HLR/AC.
f. The HLR/AC returns an AUTHBS to the MSC.
2-13
g. The MSC returns the AUTHBS in a BS_CHALLENGE_RESPONSE to the MS.
h. The MS checks and accepts the message, and updates the SSD it saves. Then it
sends an SSD_UPDATE_RESPONSE to the MSC to report on the update of SSD.
i. A unique challenge is then initiated after the SSD update. The MSC sends an
AUTH_REQUEST to the BSS with the RANDU to request for a unique challenge.
j. The MS calculates and generates the RANDU with the SSD and AUTHU received,
and reports it in an AUTH_RESPONSE to the MSC.
k. The MSC sends an ASREPORT to the VLR, containing the SSDUPRT and
UCHALRPT.
l. The VLR returns an asreport.
m. The MSC sends an ASREPORT to the HLR/AC, containing the SSDUPRT and
UCHALRPT.
n. The HLR/AC returns an asreport.
2.4.3 Unique Challenge
Unique challenge can be initiated upon authentication request failure or directly by the
AC.
I. Unique challenge upon authentication request failure
Figure 2-6 shows the procedure of unique challenge upon authentication request
failure.
2-14
BSS MSC VLR HLR/AC
AUTHREQ
a
authreq(RANDU,AUTHU)
b
AUTH_REQUEST(RANDU)
c
d
ASREPORT(UCHALRPT)
e
asreport
f
ASREPORT(UCHALRPT)
g
asreport
h

Figure 2-6 Unique challenge upon authentication request failure
a. The MSC sends an AUTHREQ to the HLR/AC.
b. The HLR/AC returns an authreq after the authentication fails. The authreq contains
the AUTHU and RANDU (which is used to generate the AUTHU).
c. The MSC sends an AUTH_REQUEST to the BSS with the RANDU to request for a
unique challenge.
d. The MS calculates and generates the AUTHU with the SSD and RANDU received,
e. The MSC sends an ASREPORT to the VLR with the SSDUPRT and UCHALRPT.
f. The VLR returns an asreport.
g. The MSC sends an ASREPORT to the HLR/AC with the UCHALRPT.
h. The HLR/AC returns an asreport.
II. Unique challenge directly initiated by AC
Figure 2-7 shows the procedure of unique challenge directly initiated by AC.
2-15
BSS MSC VLR HLR/AC
AUTHDIR(RANDU,AUTHU)
a
authdir
b
AUTH_REQUEST(RANDU)
c
d
ASREPORT(UCHALRPT)
e
asreport
f
ASREPORT(UCHALRPT)
g
asreport
h

Figure 2-7 Unique challenge directly initiated by AC
a. The HLR/AC sends an AUTHDIR to the MSC. The AUTHDIR contains the AUTHU
and RANDU (which is used to generate the AUTHU).
b. The MSC returns an authdir.
c. The MSC sends an AUTH_REQUEST to the BSS with the RANDU to request for a
unique challenge.
d. The MS calculates and generates the AUTHU with the SSD and RANDU received,
e. The MSC sends an ASREPORT to the VLR with the UCHALRPT.
f. The VLR returns an asreport.
g. The MSC sends an ASREPORT to the HLR/AC, containing the UCHALRPT.
h. The HLR/AC returns an asreport.
2-16
HUAWEI M800 CDMA Mobile Switching Center Chapter 3 Mobility Management
Chapter 3 Mobility Management
The mobility management on the MSs is crucial to the mobile communications

network, since mobility management helps to locate a particular MS and guarantee
the best communication between the MS and the network.
The ability for an MS to function when the serving network is different from their home
network is called roaming. When an MS is roaming, the mobility management then is
embodied in location management and handoff management.
3.1 Location Management
This chapter gives an introduction on the common messages and flows of location
management.
3.1.1 Common Messages
The MSC and VLR are physically integrated in one entity (MSC/VLR). They
communicate with the HLR over the same interface. This section gives an
introduction to the common messages transmitted between the MSC/VLR and the
HLR.
I. Registration Notification (REGNOT)/Implicit Location Registration
When an MS initiates a location registration or implicit location registration, the

MSC/VLR sends a REGNOT to the HLR to refresh the location information and other
information about the MS saved in the HLR. The HLR then returns a regnot. The
message flow is shown in Figure 3-1.
MSC/VLR HLR
REGNOT
regnot
HLR: Home Location Register

MSC /VLR: Mobile Switching Center/Visitor Location Register
Figure 3-1 Registration notification/ implicit location registration
3-1
II. Qualification Request (QUALREQ)
When an MS requests for a certain service but the necessary information (such as
authentication or call authority information) is not provided as expected, the MSC/VLR
sends a QUALREQ to the HLR to request for such information. The HLR then returns
a qualreq. The message flow is shown in Figure 3-2.
MSC/VLR HLR
QUALREQ
qualreq

Figure 3-2 Qualification request
III. Qualification Directive (QUALDIR)
When the information of an MS (including the authorization information and the profile
information) is changed in the HLR, the HLR will send a QUALDIR to the MSC/VLR to
inform the VLR of the change. The MSC/VLR then returns a qualdir. The message
flow is shown in Figure 3-3.
MSC/VLR HLR
QUALDIR
qualdir

Figure 3-3 Qualification directive
3-2
IV. MS Inactive (MSINACT)
When an MS is powered down or when no operation (including call

origination/termination, location registration and periodic location registration) is made
by the MS, the status of the MS will then be changed into “inactive”, and the status of
the MS in the HLR will be also changed as a result. The MSC/VLR sends an
MSINACT to the HLR to inform the HLR of the change of MS status, and the HLR
returns a misinact. The message flow is shown in Figure 3-4.
MSC/VLR HLR
MISINACT
misinact

Figure 3-4 MS inactive
V. Registratoin Cancellation (REGCANC)
When an MS roams from one MSC/VLR (MSC A) to another MSC/VLR (MSC B), or
when the account for this MS is to be cancelled at the HLR, this HLR will send a
REGCANC to the MSC/VLR (MSC A) to request for the deletion of subscriber
information. The MSC/VLR then returns a regcanc. The message flow is shown in
Figure 3-5.
MSC/VLR HLR
REGCANC
regcanc

Figure 3-5 Registration cancellation
3-3
VI. Bulk Deregistration (BULKDEREG)
When the subscriber information saved in the HLR can no longer accurately indicate
the locations and statuses of the MSs after VLR restarts, the MSC/VLR sends a
BULKDEREG to the HLR to request that the HLR deletes the data of all roaming MSs
associated with the VLR. This is to ensure data consistency between the HLR and the
VLR upon the next registration of the MSs. The HLR then returns a bulkdereg. The
message flow is shown in Figure 3-6.
MSC/VLR HLR
BULKDEREG
bulkdereg

Figure 3-6 Bulk deregistration
VII. Unreliable Roamer Data Directive (UNRELDIR)
When the subscriber information saved in the VLR can no longer accurately indicates
the information of the MSs after the HLR restarts, the HLR sends an UNRELDIR to
the MSC/VLR to inform the MSC/VLR to delete all relevant information saved in the
HLR. This is to ensure the data consistency between the HLR and the VLR upon the
next registration of the MSs. The MSC/VLR returns an unreldir. The message flow is
shown in Figure 3-7.
MSC/VLR HLR
UNRELDIR
unreldir

Figure 3-7 Unreliable roamer data directive
3-4
3.1.2 Major Location Management Procedures
I. Location registration
There are several types of location registrations:

z Power-up location registration.
z Zone-based location registration. In this case, the MS has left the Location Area
(LA) where it can be paged by the current BSC.
z Distance-based location registration. In this case, the cell that the MS is currently
in is of a certain distance from the home cell of the MS. However, the MS is still
in the same LA and therefore can still be normally paged by the current BSC.
z Parameter-change location registration. In this case, some of the parameters
defined for successful call connection are changed.
z Periodic location registration. Initiated by an MS regularly.
z Power-down location registration.
The following sections detail the messages flows of some of the registrations.
1) Power-up location registration
The message flow for power-up location registration is shown in Figure 3-8.
BSC
BSS MSC/VLR HLR
Location Updating Request

a
REGNOT
b
regnot
c
Location Updating Accept d
HLR: Home Location Register MSC /VLR: Mobile Switching Center/Visitor Location Register
Figure 3-8 Power-up location registration
a. The MS sends a Location Updating Request to the BSS. The BSS then forwards
the request to the MSC/VLR to request that the MS data be updated.
b. The MSC/VLR sends a REGNOT to the HLR, requesting for updating of MS data in
the HLR.
c. The HLR updates the MS data as requested, and returns a regnot to the MSC/VLR.
3-5
d. The MSC/VLR then returns Location Updating Accept to the BSS to inform it of
successful location updating.
Note:
The message flows of other types of location registrations are the same as the one described above,
except that of power-down location registration.
2) Power-down location registration

The message flow for power-down location registrationis shown in Figure 3-9.
BSS MSC/VLR HLR
Location Updating Request

a
MSINACT
b
msinact
c
Location Updating Accept

d
Figure 3-9 Power-down location registration
a. The MS sends a Location Updating Request to the BSS. The BSS then forwards
the request to the MSC/VLR to request that the status of the subscriber be changed
into “inactive”.
b. The MSC/VLR sends an MSINACT to the HLR to inform the HLR of the change of
the MS status.
c. The HLR changes the MS status data into “inactive” as requested, and returns a
msinact to the MSC/VLR.
d. The MSC/VLR then returns a Location Updating Accept to the BSS to inform it of
successful location updating.
3-6
II. Implicit location registration
When an MS initiates a call origination request before location registration is

performed, the MSC will initiate the implicit location registration. In this case, the
Location Updating Request is not sent at the A-interface.
The message flow is shown in Figure 3-10.
BSS MSC/VLR HLR
CM Serv ice Request

a
REGNOT
b
regnot
c
Figure 3-10 Implicit location registration
a. The MS sends a call origination request to the BSS, which then sends a CM
Service Request to the MSC/VLR.
b. The MSC/VLR sends a REGNOT to the HLR to request for updating of subscriber
data in the HLR.
c. The HLR updates the subscriber information as requested, and returns a regnot to
the MSC/VLR. Call connection then will be continued.
3.2 VLR Functions
The VLR is a distributed database. It is responsible for the management over

temporary data of the subscribers roaming to the local MSC. The temporary data
saved in VLR are referred to during call procedure and authentication.
I. Subscriber data management
All data of the MSs in the current MSC/VLR are saved in the VLR, including:
z Subscriber information: International Mobile Subscriber Identity (IMSI), Electronic
Serial Number (ESN), Mobile Directory Number (MDN), roaming attributes,
subscriber status and home Location Area (LA).
3-7
z Basic service information.

z Supplementary service information.
Other data can also be saved in the VLR as required by the development of services.
The capacity of the VLR can meet the requirements to provide all supplementary
services to every subscriber.
II. Subscriber data search
During the setup of a call, the VLR searches the subscriber information in its
database by IMSI, ESN, MDN or MIN according to the request from the MSC, and
returns the desired information to the MSC.
III. Location registration
z After the location update, call origination request, or supplementary service

requests by an MS, the VLR initiates location registration to HLR if necessary.
z After the VLR has finished or cancelled location registration, it requests the HLR
for subscriber information.
z The VLR will delete data of a subscriber when requested by the HLR or when
this subscriber does not appear in the area served by the current MSC/VLR
within 24 hours (the time duration is configurable).
IV. Authentication
The VLR supports SSD-shared authentication and SSD-unshared authentication.
In SSD-shared authentication, VLR keeps SSD in itself and supports the

authentication algorithm.
V. TLDN provision
When an MS is called, the VLR of the terminating MSC requests for Temporary Local
Directory Number (TLDN) from the Visited MSC (VMSC) upon the request of the HLR
of the called subscriber, and sends it to the HLR of the calling subscriber.
VI. MS deactivation
The VLR deactivates an MS when no interaction (such as location registration

request, call initiation or termination or short message initiation) is made between this
MS and the network for a long time (determined by relevant setting in data
configuration).
3-8
VII. MS information clearance
Upon the power down of an MS, the VLR determines with reference to the data
configuration whether to delete the information of the MS. If yes, VLR informs HLR of
setting the status of the MS as "cleared".
3.3 Handoff
3.3.1 Introduction to Handoff
As long as good network signals (from the BSS) are available to an MS, mobile
communication is available regardless of the position of the MS. To ensure that an
MS always gets the best network signals possible, handoff is performed.
The quality of voice in a call may drop due to the attenuation of signals or the
interference from the signaling channels. When this happens, the ongoing call of the
affected MS will be handed off to another channel which provides better signals. The
connection between the MS and the current BSC on the air interface will be released,
and a new connection will be set up between the MS and the target BSC of the
handoff or the target channel of the same BSC.
3.3.2 Classification
By whether frequency is changed or synchronization re-establish is needed, handoffs

can be classified into
z Hard handoff: A handoff that requires the mobile station to change its frequency
or to re-establish synchronization. It is usually applied in inter-BSC handoffs.
z Soft handoff: A handoff that does not require the mobile station to change its
frequency or to re-establish synchronization. It is usually applied in inter-BTS
(intra-BSC) handoffs.
z Softer handoff: It takes place between the different sectors of the same BTS. It is
an intra-BTS handoff.
By the position of the MS during the process, handoffs can be classified into
z Intra-BTS handoff: It takes place between two different sectors of a BTS (Softer
handoff). It can be performed through BTS power control independently.
z Intra-BSC handoff: It takes place between two cells of a BSC (generally soft
handoff).
z Inter-BSC (intra MSC) handoff: It takes place between two BSCs of an MSC
(generally hard handoff).
z Intra-MSC handoff: It that takes place between two cells of two MSCs (generally
hard handoff).
3-9
3.3.3 Handoff Procedures
Intra-BTS handoff is performed at the BSS side. This section only describes
procedures of intra-BSC, inter-BSC (intra-MSC) and inter-MSC handoffs.
I. Intra-BSC handoff
When the source and target cells in a handoff are managed by the same BSC, it is
referred to as an intra-BSC soft handoff. Such handoff is performed under the
administration of the BSC, and does not involve the MSC. Only when the handoff is
finished will the BSC inform the MSC of it with a Handoff Performed message. This
message brings with it the cause of handoff and the list of cells (No detailed
description is available here on the operations within BSC).
MS BSS MSC
Soft Handoff
a
Handoff Performed
b
MS: Mobile Station MSC: Mobile Switching Center

Figure 3-11 Intra-BSC handoff
a. The MS and the BSS exchange soft handoff messages and perform the handoff.
b. The BSS informs the MSC of the success of the handoff.
Note:
Only after the handoff is successfully finished will the BSC send the Handoff Performed (soft handoff)
message to the MSC.
II. Inter-BSC (Intra-MSC) handoff
When the source and target cells of a handoff are managed by different BSCs of an
MSC, it is referred to as an inter-BSC (intra-MSC) handoff. It is a hard handoff,
performed under the control of the MSC (which makes it different from a soft handoff
because the latter is performed under the control of the BSC).
3-10
Source BSC MSC Target BSC
Handoff Required
a
Handoff Request
b
Handoff Request Ack
c
Handoff Command
d
Handoff Commenced
e
Handoff Complete
f
Clear Command
g
Clear Complete
h
Source BSC: Source Base Station Controller MSC: Mobile Switching Center
Target BSC: Target Base Station Controller
Figure 3-12 Intra-MSC handoff
a. The MS reports on the detection of a signal stronger than that provided by the
current BSC. The source BSC then recommends several cells (of another BSC of the
same MSC), and sends a Handoff Required to the MSC with target cell IDs.
b. The MSC sends a Handoff Request with IS-95 or IS-2000 channel parameters and
other necessary parameters to the target BSC.
c. The target BSC returns a Handoff Request Acknowledge to the MSC.
d. Upon receiving the Handoff Request Acknowledge, the MSC prepares for the
handoff of the MS from the source BSC to the target BSC. It sends a Handoff
Command to the source BSC with the parameter Service Option that is contained in
the Handoff Request Acknowledgement.
e. The source BSC returns a Handoff Commenced to inform the MSC of the handoff
attempt to migrate the service processing for the MS to the target BSC channels.
f. The target BSC sends a Handoff Complete to the MSC to inform it of the successful
completion of the handoff.
g. The MSC sends a Clear Command to the source BSC to request for clearing call
resources seizure by the MS.
3-11
h. The source BSC replies with a Clear Complete to inform the MSC of successful
release of call resources.
III. Inter-MSC handoff
When the source and target cells of a handoff are in different MSCs, it is referred to
as an inter-MSC handoff, which is also known as "inter-system handoff". There are
three types of inter-MSC handoffs: handoff-forward, handoff-back and
handoff-to-third.
The MSC that is the first to assign a traffic channel to a Mobile Originated Call (MOC)
or Mobile Terminated Call (MTC) is called the Anchor MSC (AMSC). This MSC will
always be regarded as the AMSC for the MS during a call, regardless of the number
of handoffs that take place during the call.
During a call, an MS might be handed off to another MSC (other than the AMSC).
This MSC is referred to as the Serving MSC (SMSC). The SMSC changes in
inter-MSC handoffs.
An MS may again be handed off to another MSC after it is handed off to an SMSC.
After the handoff, the original SMSC will then be referred to as the Tandem MSC
(TMSC), and the MSC that the MS is handed off to, is referred to as the new SMSC.
There may be several TMSCs in a call.
Figure 3-13 shows the relation between AMSC, SMSC and TMSC.
AMSC SMSC
First handoff-forward
AMSC TMSC SMSC

Second handoff-forward
AMSC TMSC TMSC SMSC

Third handoff-forward
AMSC: Anchor Mobile Switching Center SMSC: Serving Mobile Switching Center
TMSC: Tandem Mobile Switching Center
Figure 3-13 Relation between AMSC, SMSC and TMSC
1) Handoff-forward
A handoff-forward is one in which the MS is handed off from the AMSC to the SMSC,
or from one SMSC to another SMSC. The source and target MSCs in a
handoff-forward are neighboring to one another.
The message flow for the handoff-forward from the AMSC to the SMSC is shown in
Figure 3-14.
3-12
SBSC AMSC SMSC TBSC
Handoff Required
a
FACDIR2 b
Handoff Request
c
Handoff RequestAck
d
facdir2
e
Handoff Command
f
Handoff Commenced
g
Handoff Complete
h
MSONCH
i
Clear Command
j
Clear Complete
k
SBSC: Source Base Station Controller AMSC: Anchor Mobile Switching Center
SMSC: Serving Mobile Switching Center TBSC: Target Base Station Controller
Figure 3-14 Handoff-forward
There is no difference in the message flows at the A-interface for a handoff-forward

and an intra-BSC (inter-MSC) handoff, except that three more messages are sent in
an inter-MSC handoff-forward (as described in the following).
b. The AMSC sends a FACDIR2 directing the SMSC to initiate a handoff-forward task.
e. If a traffic channel of the SMSC is available, the SMSC replies to the AMSC with a
facdir2, and the handoff will then be started.
i. The traffic channel is successfully set up between the MS and the SMSC, and the
latter then sends an MSONCH to the AMSC to inform it of the successful handoff.
2) Handoff-back
A handoff-back is one in which the MS is handed off from an SMSC to an AMSC or a
TMSC.
The message flow for a handoff-back from an SMSC to an AMSC is shown in Figure
3-15.
3-13
SBSC SMSC AMSC TBSC
Handoff Required
a
HANDBACK2
b
Handoff Request
c
Handoff RequestAck
d
handback2
e
Handoff Command
f
Handoff Commenced
g
Handoff Complete
h
FACREL
i
Clear Command
j
Clear Complete
k
facrel
l
SBSC: Source Base Station Controller AMSC: Anchor Mobile Switching Center
SMSC: Serving Mobile Switching Center TBSC: Target Base Station Controller
Figure 3-15 Handoff-back (SMSC to AMSC)
There is no difference in the message flows at the A-interface for a handoff-back and
an intra-MSC handoff, except that four more inter-MSC messages are sent in the
former, as described below.
b. The SMSC sends a HANDBACK2 directing the AMSC to initiate a handoff-back

task.
e. If a traffic channel of the AMSC is available, the AMSC replies to the SMSC with a
handback2 , and the handoff will then be started.
i. The traffic channel is successfully set up between the MS and the AMSC, and the
latter then sends a FACREL to the SMSC to request that the SMSC release its
connection to the MS.
l. The SMSC releases the connection between itself and the MS, and sends a facrel
to the AMSC to inform the latter of successful disconnection.
3) Handoff-to-third
A handoff-to-third is one in which the MS is handed off to a third MSC from the SMSC
via the AMSC or TMSC.
3-14
SBSC SMSC AMSC SMSC' TBSC
Handoff Required
a
HANDTHIRD2 b
FACDIR2 c
Handoff Request d
Handoff RequestAck
e
facdir2
f
handthird2
g
Handoff Command
h
Handoff Commenced i
Handoff Complete
j
MSONCH k
FACREL
l
Clear Command m
Clear Complete n
facrel
o
SBSC : Source Base Station Controller AMSC : Anchor Mobile Switching Center
SMSC : Serving Mobile Switching Center TBSC : Target Base Station Controller
Figure 3-16 Handoff-to-third
There is no difference in the message flows at the A-interface for a handoff-to-third

and an intra-MSC handoff, except that seven more inter-MSC messages are sent in
the former, as described below.
b. The SMSC1 sends a HANDTHIRD2 to request that the AMSC start the
handoff-to-third.
c. Upon receiving the HANDTHIRD2, the AMSC requests that SMSC2 initiate a
handoff-to-third task.
f. If a traffic channel of the SMSC2 is available, SMSC2 replies to the AMSC with a
facdir2, and the handoff will then be started.
g. The AMSC sends a facdir2 to the SMSC1 to indicate that the handoff-to-third can
be started.
k. The traffic channel is successfully set up between the MS and the SMSC2, and the
latter then sends an MSONCH to the AMSC to inform it of the successful channel
setup.
l. The AMSC sends a FACREL to the SMSC1 after it receives the MSONCH,
requesting that the SMSC release the connection between itself and the MS.
3-15
o. The SMSC1 releases the connection between itself and the MS, and sends a facrel
to the AMSC to inform the latter of successful disconnection.
3.4 Roaming Restriction
There are two types of roaming restrictions available for MSC subscribers: basic
roaming restriction and enhanced roaming restriction.
3.4.1 Basic Roaming Restriction
Upon location registration of an MS, the MSC will check the roaming authority of the
subscriber.
In a basic roaming restriction, when the MS enters a new MSC, the ID of the current
MSC is sent to its HLR in the location registration message. The HLR then
determines whether the MS is allowed to roam in this MSC.
Basic roaming restrictions are performed to restrict the roaming of MSs in a relatively
larger scope (for example, an MSC area).
3.4.2 Enhanced Roaming Restriction
Enhanced roaming restrictions are performed to restrict the roaming of MSs in a

relatively smaller scope (in comparison with basic roaming restriction). In an
enhanced roaming restriction, restriction is imposed on particular group of subscribers
to prohibit them from roaming within the designated LAs or cells.
To realize enhanced roaming restriction, subscribers with the same roaming attributes
are grouped according to their IMSIs, MINs or MDNs, and roaming-restricted LAs and
cells are specified.
When the MSC performs enhanced roaming restriction check on the MSs, it will first
determine the No. of the subscriber group with the MIN, IMSI or MDN of the
subscriber. Then it checks the No. of the LA/cell where the MS is and checks if the
LA/cell is in the list of roaming-restricted LAs or cells for that subscriber group.
Enhanced roaming restrictions help to impose restrictions more conveniently.
3.4.3 Application of Roaming Restriction
Basic and enhanced roaming restrictions are usually applied jointly.
Before the MSC performs roaming authority check on an MS according to its IMSI or
MIN, it will first perform enhanced roaming authority check on the MS. If enhanced
roaming restriction is imposed, MSC will reject the location registration/call request;
3-16
otherwise, basic roaming authority check will be performed, and the MS will be able to
roam in the area if no basic roaming restriction is imposed.
Before the MSC performs roaming authority check on an MS according to its MDN, it
will first determine whether the MS has basic roaming authority. If not, the MSC will
reject the subscriber's request; otherwise, the MSC performs enhanced roaming
authority check to see if the MS is allowed to roam in the current area.
3-17
HUAWEI M800 CDMA Mobile Switching Center Chapter 4 Call Control
Chapter 4 Call Control
The MSC provides various call control (also called call processing) functions to
connect various types of calls (including ordinary and IN services).
4.1 Call Connection
The MSC connects the calls for legal local subscribers. It is responsible for the
processing of local calls, outgoing calls, incoming calls and forwarded calls. That is,
the MSC may function as any of the following: Visited MSC (VMSC), Gateway MSC
(GMSC), Tandem MSC (TMSC) or the combination of VMSC and GMSC
(VMSC/GMSC).
The following are the basic functions of MSC:

z Determining the location of the called MS with the TLDN of the called MS and
then connecting the call to the corresponding VMSC.
z Initiating paging according to IMSI and the ID of the current BSC.
z Sending the expected calling number and calling number type to other MSC and
Public Switched Telephone Network (PSTN).
z Supporting the provision of special call services defined by the carriers.
z Supporting the provision of emergency alarming, and the sending of calling
number, called number and the start and end time of calls.
z Supporting ringing delay. It enables a subscriber to terminate a misdialed call of
a certain special service number within a specified period before the ringing
starts.
z Releasing circuits upon call failure, and playing failure announcement to the
calling subscriber accordingly.
z Supporting the setup of 64kbit/s Semi-Permanent Connections (SPCs) initiated
using Man-Machine Language (MML) command.
z Supporting incoming and outgoing call authority check on ordinary calls.
z Supporting the forced disconnect of ongoing illegal calls.
4.2 Number Saving and Translating
The MSC provides powerful number analysis function, which serves as the basis for
providing various services, such as Intelligent Network (IN) service and Internet
Protocol (IP) service.
Specifically, with the number analysis function, the MSC is capable of:
4-1
z Receiving and saving 24-digit numbers, and the analysis of numbers with the
maximum length of 24 digits.
z Adding and deleting of particular digits of the calling and called numbers and the
translation of these numbers in the process of number analysis.
z Converting the calling or called numbers based on the relations of the called and
calling numbers as expected and configured by the carriers.
z Supporting the conversion of calling subscriber type, calling subscriber address
attribute indication, called subscriber address attribute indication in the
inter-MSC Initial Address Message (IAM) or Initial Address Message with
Information (IAI).
z Receiving numbers sent either in groups or in overlay mode.
z Supporting the definition of maximum and minimum number length. A number
received will not be analyzed unless digits more than the minimum number
length are received. Moreover, when a number received has more digits than the
maximum number length, only the digits within the maximum number length will
be analyzed. The rest of the digits will be ignored.
z Supporting the processing of irregular numbers. For example, some of the
forwarded-to numbers received from the HLR may be irregular. Also, the
structure of numbers in PSTN-to-MSC calls may be inconsistent with the address
attribute indication.
4.3 Route Selection
Route selection includes intra-office route selection (routing to a particular BSC of the
MSC, performed when the called party is a local MSC subscriber) and inter-office
route selection (routing to a particular MSC or PSTN, performed when the called party
is a subscriber of the foreign MSC or PSTN).
I. Intra-office route selection
In intra-office route selection, the MSC selects a voice channel for call connection
according to the current location of the called subscriber, which is specified by the
BSC Destination signaling Point Code (DPC).
II. Inter-office route selection
The MSC provides abundant route selection functions. Voice channels are selected
according to the information of the calling or called subscriber.
Calling subscriber information refers to the location information of the calling

subscriber. When the calling party is a local MSC subscriber, the calling subscriber
information includes the ID of the LA or cell where the subscriber is. When the calling
party is a non-local MSC subscriber, the calling subscriber information then is
4-2
represented by the trunk circuit seized in the call which is ultimately reflected by the
route selection source code.
Called subscriber information refers to the location information of the called

subscriber which is contained in the called number. This information is represented by
the route selection code.
With the route selection source code and route selection code, the MSC determines
the route from the calling party to the called party in the call connection procedure.
A route is the collection of paths from one Network Element (NE) to another NE. Each
of these paths is referred to as a subroute. The MSC is capable of dynamic route
selection according to the configuration of routes and subroutes, the distribution of
traffic and the statuses of the subroutes (whether they are available). With the
dynamic route selection, a successful call connection can be guaranteed even if
some of the routes fail. Thus, the MSC is also able to assign the closest route
possible for emergency calls.
4.4 Call Duration Monitoring and Forced Call Disconnect
The MSC provides call duration monitoring function, that is, the MSC monitors the
duration of calls, and generates an alarm when a particular call lasts for too long (the
threshold for call duration is determined by data configuration). Sometimes a call may
last for a long period of time because the subscribers forget to hook on. In such cases,
the MS still occupies the radio resources and trunk resources even if the conversation
between the subscribers is finished. Once the MSC detects such calls, it will generate
alarms accordingly.
The operator then can forcefully terminate the call and release the resources. This is
referred to as a forced disconnect. Forced disconnect helps efficiently allocate system
resources.
4.5 Overload Control
The load of a MSC is in direct proportion to the number of ongoing calls. With the
increase of subscribers, the system load will naturally be increased. When the load
reaches a certain degree, it may cause consequences to the normal operation of the
switch, and thus affecting the quality of service.
Therefore, when the load of the MSC reaches the preset threshold (overload
threshold), the MSC will perform restrict subsequent calls. Call restriction will be
cancelled only after the load of the MSC drops to a designated degree (recovery
threshold).
4-3
To avoid frequent commencement and termination of call restriction, it is

recommended to set the overload threshold a little higher than the recovery threshold.
For example, if the overload threshold is set as "80%", the recovery threshold is
recommended to be "70%".
4.6 Echo Cancellation
I. Generation of echoes
Echoes are generated in the PSTN. There are electrical echoes and acoustic echoes.
When the path of echo exceeds 30ms, the echoes generated at the PSTN side will be
heard by the subscribers at the other end, and the quality of voice will be affected.
Although echo is not generated in Public Land Mobile Network (PLMN), calls between
a PSTN subscriber and a mobile subscriber may still suffer from the echoes because
the delay path of the echoes is extended to about 64ms due to the causes described
later. Therefore, Echo Cancellation (EC) equipment is necessary in the CDMA
system.
Causes of echo delay in the CDMA system:

z Delay in information transmission on radio link
z Delay set at the BSS or MS to avoid the negative impact brought about by
multi-path fading.
II. EC equipment
MSC provides two types of EC equipment: embedded EC equipment and

independent EC equipment.
Embedded EC equipment works on the basis of exclusive resource seizure, that is,
each trunk cable is configured with one set of EC equipment. GECS board is actually
a type of embedded EC equipment. It is responsible for the echo cancellation on the
16 E1s.
Independent EC equipment works on the basis of resource sharing. All EC equipment

is placed in the EC Pool, and is applied for when there is the need for echo
cancellation. After the echo cancellation is performed, the EC resources will be
released so that other applicants can have access to the EC resources. Number of
independent EC equipment sets is determined by the possible amount of echoes
generated by the trunk equipment. One GECP can provide the echo cancellation for 8
E1s that are globally shared.
From the perspective of the system resource occupation, GECP needs to occupy
interface subrack slot. For a service connection in need of EC, independent EC
equipment, if applied, would occupy four switching timeslots on the CNET (one for
4-4
incoming E1 timeslot, one for outgoing E1 timeslot and the other two for EC timeslots),
as shown in Figure 4-1.
However, only two switching timeslots are needed for embedded EC equipment (with
one for incoming timeslot and the other for outgoing timeslot), as shown in Figure 4-2.
The independent EC equipment realizes global sharing of the EC resources by

occupying more system resources than the embedded EC equipment.
E1
GE16/
GSTU CNET
GE16/ E1
GSTU
GECP
Figure 4-1 Network resource occupation of independent EC equipment
E1 GE16/ CNET
GSTU
GECS E1
Figure 4-2 Network resource occupation of embedded EC equipment
4.7 Tone Play
Prompt tones are played during the process of calls. Such tones can be classified by
either the pre-condition or by the mode of tone-playing.
I. Number tone and failure tone
In terms of the completion of connections, there are number tones and failure tones.
z The number tone corresponds to the call successfully connected. Through data
configuration, the carriers can decide whether to play a certain announcement
for the specified number dialed.
z The failure tone corresponds to the call which is not successfully connected.
When the call connection fails, the system will play an announcement to inform
the subscriber of the cause. The default tone play of the MSC can relate each
4-5
failure cause to an announcement. But this relation is subject to modification by

the carrier through data configuration.
II. Synchronous tone and asynchronous tone
In terms of the mode of tone play, there are synchronous tones and asynchronous
tones.
z Synchronous tone is played from the beginning each time, and the tone play
stops after it is played for specified times. Relatively more tone channel
resources are needed, as one tone channel is seized by one call only.
z Asynchronous tone may be played from the actual beginning or any other place.
Relatively fewer tone channel resources are needed, as multiple calls can share
one asynchronous tone channel simultaneously.
In theory, every tone can be set to synchronous play mode or asynchronous play
mode. In practice, the regular signal tones, such as busy tone (450Hz, -10±3dBm0.
0.35s on/0.35s off), ringback tone (450Hz, -10±3dBm0. 1.0s on/4.0s off) and
congestion tone (450Hz, -10±3dBm0. 0.7s on/0.7s off), are generally configured with
asynchronous mode. The irregular tones are configured with the synchronous mode.
The MSC supports loading of voice files. First the tones are recorded and saved into
voice files through independent recording equipment. Then the format of these voice
files is changed by special software so that they can be loaded to the tone play
equipment. After necessary data configuration, these new tones can be put into use.
4.8 Call Procedures
Calls can be classified by the properties of calling and called numbers.
Different types of calls employ different call procedures
4-6
4.8.1 Intra-MSC Call
BSC MSC/VLR HLR BSC
CM_SERVICE_REQ
a
ASS_REQ
b
LOCREQ_REQ
c
ASS_CMP
d
locreq
e
PAGE_REQ
f
PAGE_RSP
g
ASS_REQ
h
ASS_CMP
i
CONNECT
j
CLEAR_REQ
k
CLEAR_CMD
l
CLEAR_CMD
m
CLEAR_CMP
n
CLEAR_CMP
o
BSC: Base Station Controller MSC/VLR: Mobile Switching Center/Visitor Location Register
Figure 4-3 Intra-MSC call
a. An MS originates a CM_SERVICE_REQ to the BSC, which forwards it to the

MSC/VLR.
b. The MSC/VLR issues an ASS_REQ to the BSC.
c. The MSC/VLR performs called number analysis and triggers a LOCREQ_REQ.
d. The BSC sends an ASS_CMP to the MSC/VLR.
e. The HLR returns a locreq.
f. The MSC/VLR sends a PAGE_REQ to the terminating BSC.
g. The terminating BSC returns a PAGE_RSP to the MSC/VLR.
h. The MSC/VLR sends an ASS_REQ to the terminating BSC.
4-7
i. The terminating BSC sends an ASS_CMP to the MSC/VLR.
j. The called MS answers the call. The MSC receives a CONNECT message. The
calling and called parties start conversation.
k. The calling MS releases the call. The MSC receives a CLEAR_REQ.
l. The MSC/VLR sends a CLEAR_CMD to the originating BSC.
m. The MSC/VLR sends a CLEAR_CMD to the terminating BSC.
n. The MSC/VLR receives a CLEAR_CMP from the originating BSC.
o. The MSC/VLR receives a CLEAR_CMP from the terminating BSC. The call is
released.
4-8
4.8.2 Inter-MSC Call
BSC MSC/VLR HLR MSC/VLR BSC
CM_SERVICE_REQ
a
ASS_REQ
b
LOCREQ_REQ
c
ROUTREQ
d
Routreq
e
ASS_CMP
f
Locreq
g
IAI / IAM
h
PAGE_REQ
i
PAGE_RSP
j
CC
k
ASS_REQ
l
ASS_CMP
m
ACM
n
CONNECT
o
ANC p
CLEAR_REQ
q
CLF
r
CLEAR_CMD
s
RLG
t
CLEAR_CMP
u
CLEAR_CMD
v
CLEAR_CMP
w
BSC: Base Station Controller MSC/VLR: Mobile Switching Center/Visitor Location Register
Figure 4-4 Inter-MSC call

MSC/VLR.
b. The originating MSC/VLR sends an ASS_REQ to the originating BSC.
c. The originating MSC/VLR sends a LOCREQ_REQ to the HLR.
d. The HLR sends a ROUTREQ to the terminating MSC/VLR, requesting a TLDN for
the called MS.
e. The terminating MSC/VLR allocates a TLDN and returns it to the HLR in a Routreq.
4-9
f. The originating BSC returns an ASS_CMP to the originating MSC/VLR.
g. The HLR returns a Locreq to the originating MSC/VLR and sends the allocated
TLDN to the originating MSC/VLR.
h. Upon receipt of the Locreq, the originating MSC/VLR sends an IAI/IAM and enters
the outgoing flow. The outgoing called number is the TLDN allocated to the called
MS.
i-m. Paging and channel assignment for the called MS are performed.
n. Upon completion of channel assignment to the called MS, the terminating

MSC/VLR sends an ACM to the originating MSC/VLR.
o. The called MS hooks off. A CONNECT is reported.
p. The terminating MSC/VLR sends an ANC (Answer signal, Charge) to the

originating MSC/VLR. The calling and called parties start conversation.
q. The calling MS releases the call. The originating MSC/VLR receives a

CLEAR_REQ.
r. The originating MSC/VLR sends a CLF (Clear Forward signal) to the terminating
MSC/VLR.
s. The originating MSC/VLR sends a CLEAR_CMD to the originating BSC.
t. The terminating MSC/VLR returns a RLG (Release Guard signal).
u. The originating MSC/VLR receives a CLEAR_CMP.
v. The terminating MSC/VLR sends a CLEAR_CMD to the terminating BSC.
w. The terminating BSC returns a CLEAR_CMP to the terminating MSC/VLR.
4-10
4.8.3 Mobile-PSTN Call
BSC MSC/VLR PSTN
CM_SERVICE_REQ
a
ASS_REQ
b
ASS_CMP
c
IAI/IAM
d
ACM
e
ANC
f
CBK
g
CLEAR_CMD
h
CLF
i
CLEAR_CMP
j
RLG
k
BSC: Base Station Controller:

PSTN: Public Switched Telephone Network
Figure 4-5 Mobile-PSTN call

MSC/VLR.
b. The MSC/VLR issues an ASS_REQ to the BSC.
c. The MSC/VLR receives an ASS_CMP from the BSC.
d. The MSC/VLR determines the called number is a PSTN number through called
number analysis. The MSC/VLR sends an IAI/IAM to the terminating PSTN and
enters the outgoing flow.
e. When the called party is alerted, the PSTN sends an ACM (Address Complete
signal) to the originating MSC/VLR.
f. The called party answers, and the PSTN sends an ANC to the originating
MSC/VLR.
g. The called party hooks up, and the PSTN sends a CBK (Clear Back signal) to the
originating MSC/VLR.
h. The MSC/VLR sends a CLEAR_CMD to the BSC.
4-11
i. The BSC returns a CLEAR_CMP to the MSC/VLR.
j. The originating MSC/VLR sends a CLF to the terminating PSTN.
k. The terminating PSTN sends a RLG to the originating MSC/VLR.
4.8.4 PSTN-Mobile Call
PSTN GMSC/VLR HLR MSC/VLR BSC
IAI a
LOCREQ_REQ
b
ROUTREQ
c
Routreq
d
locrsp e
IAI f
PAGE_REQ g
PAGE_RSP
h
CC i
ASS_REQ j
ASS_CMP k
ACM l
ACM
m
CONNECT n
ANC
o
ANC
p
CLF q
CLF
r
CLEAR_CMD s
RLG
t
CLEAR_CMP
u
RLG v

GMSC/VLR: Gateway Mobile Switching Center/Visitor Location Register
BSC: Base Station Controller
Figure 4-6 PSTN-Mobile call
a. The PSTN originates an IAI containing the called number to the GMSC/VLR.
4-12
b. The GMSC/VLR performs number analysis and then sends a LOCREQ_REQ to

the HLR.
c. The HLR obtains routing information and the TLDN allocated to the called MS from
the terminating MSC/VLR.
d. The terminating MSC/VLR allocates a TLDN to the called MS and returns it to the
HLR in a Routreq.
e. The HLR returns a locreq to the GMSC/VLR.
f. The GMSC sends an IAI to the terminating MSC/VLR and enters the incoming flow.
g-k. The terminating MSC/VLR pages the called MS.
l. The called MS is alerted. The terminating MSC/VLR sends an ACM to the

GMSC/VLR.
m. The GMSC/VLR relays the ACM to the PSTN.
n. The called MS hooks off. A CONNECT is reported.
o. The terminating MSC/VLR sends an ANC to the GMSC/VLR.
p. The GMSC/VLR relays the ANC to the PSTN. The calling and called parties start
conversation.
q. The calling party hooks up. The GMSC/VLR receives a CLF from the PSTN.
r. The GMSC/VLR relays the CLF to the terminating MSC/VLR.
s. The terminating MSC/VLR sends a CLEAR_CMD to the terminating BSC.
t. The terminating MSC/VLR returns a RLG to the GMSC/VLR.
u. The terminating BSC returns a CLEAR_CMP to the terminating MSC/VLR.
v. The GMSC/VLR relays the RLG to the originating PSTN.
Note:
The GMSC and the originating or terminating MSC may be the same MSC.
4-13
HUAWEI M800 CDMA Mobile Switching Center Chapter 5 Short Message Services
Chapter 5 Short Message Services
The Short Message Service (SMS) supported by the MSC includes MS Point-To-Point
(PTP) short message origination and termination, short message broadcast, and
short message notification.
5.1 Service Procedures
5.1.1 MS Short Message Origination
MS short message origination procedure is shown in Figure 5-1.
BSS MSC/VLR MC
ADDS Deliv er / ADDS Transfer

a
SMSDPP
b
smsdpp
c
ADDS Deliv er Ack/ ADDS Transfer Ack

d
BSS: Base Station Subsystem MSC/VLR: Mobile Switching Center/Visitor Location Register
MC: Message Center
Figure 5-1 MS short message origination procedure
a. The originating MS formulates and sends a short message via the BSS to the
MSC/VLR.
b. The MSC/VLR converts the short message received into an SMSDPP message,
and sends it to the home Message Center (MC) of the originating MS.
c. Upon receiving the SMSDPP, the MC sends an smsdpp message to the MSC/VLR.
d. The smsdpp message is then converted into air interface message, which is
subsequently sent to the originating MS via the BSS.
5.1.2 MS Short Message Termination
MS short message termination procedure is shown in Figure 5-2.
5-1
BSS MSC VLR HLR MC SME
LOCATION_UPDATE_REQUEST
a
REGNOT(SMSADDR)
b
REGNOT(SMSADDR)
c
regnot
d
regnot
e
SMDPP
f
smdpp g
SMSREQ(MDN)
h
SMSREQ(MIN,ESN)
i
SMSREQ(MIN,ESN)
j
smsreq(SMSADRR)
k
smsreq(SMSADRR)
l
smsreq(SMSADRR)
m
SMSDPP
n
ADDS Deliv er /ADDS Page
o
ADDS Deliv er Ack / ADDS Page Ack
p
smsdpp
q
BSS: Base Station Subsystem VLR: Visitor Location Register

HLR: Home Location Register MSC: Mobile Switching Center
MC: Message Center SME: Short Message Entity
Figure 5-2 Mobile short message termination procedure
a. An MS registers in the system, and initiates location registration.
b. The MSC sends a REGNOT to the VLR with the address of the MS.
c. The VLR forwards the REGNOT to the HLR.
d. The HLR records the SMS delivery address for the MS, and responds with a regnot
to the VLR containing the subscriber information of the MS.
e. The VLR forwards the regnot to the MSC serving the MS.
f. The MC receives an SMSDPP requesting delivery of an SMS message to the

destination Short Message Equipment (SME), that is, the destination MS, by the
originating SME.
g. The MC responds with an smsdpp indicating that it has received the short message
from the originating SME.
5-2
h. If the MC does not know the current position of the destination SME, then steps h
to m will be performed. The MC sends an SMSREQ to the HLR to ask for the address
of the destination SME.
i. If the HLR does not know the current position of the destination SME, then steps i to
l will be performed. The HLR sends an SMSREQ to the VLR to ask for the address of
the destination SME.
j. The VLR forwards the SMSREQ to the MSC serving the destination SME to ask for
the address of the SME.
k. The MSC responds with an smsreq to the VLR containing the address of the
destination SME (i.e., the MSCIN of this MSC).
l. The VLR forwards the smsreq to the HLR.
m. The HLR forwards the smsreq to the MC.
n. The destination MC sends an SMSDPP to the MSC serving the destination SME.
o. The short message then is sent to the destination SME via the BSS.
p. The destination SME responds with an automatic acknowledgment that it has

received the short message.
q. The MSC translates the acknowledgement message into an smsdpp message and
sends it to the MC.
5.1.3 Short Message Notification
When the destination SME is unable to receive short messages due to network
causes (e.g., poor network signals) or when the SME is powered down, the short
messages will be saved in the MC for the specified period of time. When the status of
the destination SME is changed (powered up again) or when the network signals gets
strong enough again, the MSC or the HLR will initiate the short message notification
flow to inform the MC. The MC then will send these messages to the destination
SME.
There are two types of short message notification procedures:

z VLR-based short message notification procedure
When the data of the current MSC serving the destination SME are saved in the HLR:
The MC will first send an SMDPP message to the MSC when it is about to send an
SMS message to the destination SME. However, if due to network causes (e.g., poor
network signals) the delivery fails, the VLR then will add an SMS delivery pending flag
in the subscriber data (i.e., destination SME data). In this case, short message
notification flow will be initiated upon the next location registration of the destination
SME.
5-3
z HLR-based short message notification procedure

When the data of the current MSC serving the destination SME are not saved in the
HLR (e.g., when the destination SME is powered down): The MC will first send an
SMSREQ message to the HLR to ask for the address of the destination SME when it
is about to send a short message to the destination SME. However, since the
destination SME is powered down, the flow will be terminated and the HLR will then
add an SMS delivery pending flag in the subscriber data (i.e., destination SME data).
In this case, short message notification flow will be initiated by the HLR next time the
destination SME initiates location registration flow.
The following sections describe the two procedures in details.
I. VLR-based short message notification procedure
The procedure of VLR-based short message notification is shown in Figure 5-3.
BSS MSC VLR HLR MC
LOCATION UPDATE REQUEST

a
REGNOT
b
REGNOT
c
regnot
d
regnot
e
location update accept

f
SMSNOTIFY
g
smsnotify
h
SMSDPP
i
j
ADDS Deliv er Ack / ADDS Page Ack k
smsdpp
l

MC: Message Center
Figure 5-3 VLR-based short message notification procedure
a-f. Location registration procedure. (Note that the regnot message sent by the VLR
to the MSC as the location registration response carries the short message waiting
5-4
flag that indicates there are still short messages saved in the MC for the destination
SME.)
g. The MSC sends an SMSNOTIFY to the MC to inform it that the destination SME is
now able to receive short messages.
h. The MC responds with an smsnotify to the MSC.
i-l. The MC delivers the unsent short messages to the destination SME.
II. HLR-based short message notification procedure
The procedure of HLR-based short message notification is shown in Figure 5-4.
BSS MSC VLR HLR MC
LOCATION UPDATE REQUEST

a
REGNOT
b
REGNOT
c
regnot
d
regnot
e
location update accept

f
SMSNOTIFY
g
smsnotify
h
SMSDPP
i

j
ADDS Deliv er Ack / ADDS Page Ack

k
smsdpp
l

MC: Message Center
Figure 5-4 HLR-based short message notification procedure
a-f. Location registration procedure.
g. The HLR sends an SMSNOTIFY to the MC to inform it that the destination SME is
able to receive messages.
5-5
h. The MC responds with an smsnotify to the HLR.
i-l. The MC delivers the unsent short messages to the destination SME.
5.1.4 Short Message Broadcast
Short message broadcast based on MC is performed by the MC by sending the

messages to the local MSC. The MSC then will broadcast the short message to its
MSs.
Short message broadcast can be performed once or regularly. It is usually used to

broadcast service notifications or other urgent notices to MSs in a large area.
The procedure of short message broadcast is shown in Figure 5-5.
5-6
MS-SMEs
in MSCs MSC-n MSC-2 MSC-1 MC SME
1,2,...n
SMDPP [SMS_BearData, SMS_OriginalOriginatingAddress,

SMS_Teleserv iceIdentfier, SMS_BTTI]
a
smdpp [ACK]
b
c
smdpp [ ]
d
e
smdpp [ ]
f

g
smdpp [ ]
h
SMD-REQs
i

j
smdpp [ ]
k

l
smdpp [ ]
m

n
smdpp [ ]
o
SMD-REQs
p
MS: Mobile Station MSC: Mobile Switching Center

MC: Message Center SME: Short Message Entity
Figure 5-5 MC-based short message broadcast
a. The originating SME sends an SMDPP message to the MC, requesting for a short
message broadcast to MSs.
5-7
b. The MC responds with an smdpp as a positive acknowledgement on receiving the

message.
c, e, g: The broadcasting period is determined by the MC (with the parameter

BroadcastMessagePeriodicity). The MC sends the SMDPP message to the MSC at the
designated broadcast start time.
The difference between short message broadcast and ordinary short message is that
the messages are sent to different receivers. Ordinary short messages are sent to a
particular SME (MS), while the receiver of a short message broadcast could be the
MSs in an entire area (determined by the parameter BroadcastZoneIdentifierList or
BroadcastZoneIdentifier), or all the MSs of the current MSC.
d, f, h: Upon receiving the SMDPP, the MSC responds with an smdpp to the MC as a
positive acknowledgement.
i. If the MSC finds it is a short message broadcast request, it will send the message to
all MSs in the designated area.
j-p: Repeat steps c to j.
Note:
The short message can also be broadcast by the MC directly. In this case, steps a and b are not
performed.
5-8
HUAWEI M800 CDMA Mobile Switching Center Chapter 6 Charging
Chapter 6 Charging
In charging management, the occupation of network resources and the provision of

services are measured. This is achieved through sorting and saving of bills, since
charging on subscribers is based on the bills.
During each call, the MSC collects the detailed call data and generates bills. These
bills are referred to by the relevant carriers to generate more detailed
subscriber-oriented bills for the charging on the subscribers and the accounting
among the carriers.
The Charging Gateway (CG) is responsible for the collecting, saving, sorting and
converting of original bills generated by the MSC. It provides an interface to the billing
center so that the later can fetch the bills and create the bills that are in required
format.
At the bill console, bills can be browsed, queried or printed. The status of the Bill
Server can also be queried.
z Bill browsing: Viewing the contents of the bills.
z Bill query: Viewing bills meeting the specified conditions.
z Bill printing: Printing specified bills.
z Bill Server information query: Querying the status information of the Bill Server.
6.1 Charging Flow
The charging flow is actually the process of bill generation, processing and
transmission: Bills are generated at the MSC, processed at the charging gateway,
and sent to the billing center in the end. Bills are generated at the MSC each time a
call is made with at least one of the two parties being a mobile subscriber.
When a mobile subscriber is involved in a call, the charging module of the home MSC
for this subscriber will be activated, and the bill is generated during the session or
after the session is completed. The bill then is sent to the charging gateway, where it
is saved and sorted, and ultimately sent to the billing center through the specified
interface.
The structure of the charging system is shown in Figure 6-1.
At the billing center, more detailed bills are generated for the network carriers to
charge the subscribers for the sessions.
6-1
Active Standby Active Standby
G G G G
S S S S
P P P P
C C C C
MSC side
Active HUB Standby HUB
Billing Center
Link2 Link3
Link0 Link1
Heartbeat path
Active iGWB Server iGWB Server Standby HUB

com
HUB
Browse Iby using IE at the terminal
iGWB Server: Charging gateway server

Figure 6-1 Charging system
The following information is included in an original bill:

z Occupation of resources (such as MSC ID., incoming trunk group No.).
z Basic service information (such as the origination place, termination place, date,
time and duration of a call, and the bearer service applied).
z Supplementary service information (such as call forwarding).
z Relevant subscriber numbers (such as MDN, IMSI and TLDN).
6.2 Sorting of Bills
The supported types of bills include:

z Mobile Originated Call bill (MOC).
z Mobile Terminated Call bill (MTC).
z Call Forwarding bill (CF).
z Call Attempt bill (CALL ATTEMPT).
z Roaming bill (ROAM).
z Gateway Outgoing bill (GATEWAY OUTGOING).
6-2
z Transit bill (TRANSIT).

z Trunk metering bill.
z Supplementary service bill.
z Mobile terminated short message bill.
z Mobile originated short message bill.
z Emergency call bill.
z RFC bill.
z PDSN bill.
z PRA bill.
z Long-duration call bill.
6.2.1 MOC Bill and MTC Bill
In a Mobile-Originated Call (MOC), if the called subscriber answers the call, bill is
then generated during the call or after the call is completed.
In a Mobile-Terminated Call (MTC), bill is generated during the call or after the call is
completed.
Bills provide the following information: date, time and duration of the call, service type
(basic communications service or supplementary service), source and destination of
the call, and supplementary service code.
6.2.2 Call Forwarding Bill
With call forwarding service, the calls can be forwarded to designated numbers. Call
forwarding bills are generated when calls are forwarded. The original called
subscriber (i.e., the subscriber that determines the forwarding) is also to be charged.
Three parties are involved in a CF bill: calling party, original called party (i.e., the
subscriber that determines the call forwarding), and the called party (the actual called
party, i.e., the subscriber that the call is forwarded to).
The original called party is charged as the calling party for the section of call between
himself and the forwarded-to subscriber. That is, the original called party is not
charged as a calling party. Therefore the “calling party” in a CF bill refers to the
original called number, the “called party” is the forwarded-to party, and the
“third-party” is the original calling party. The IMSI, ESN and MIN in a CF bill are that of
the calling party, i.e., the original called party.
Also, the call forwarding type will be recorded in a CF bill, such as:
z Call Forwarding - Unconditional (CFU).
z Call Forwarding - Busy (CFB).
z Call Forwarding - No Answer (CFNA).
z Call Forwarding - Default (CFD).
6-3
6.2.3 Call Attempt Bill
When a call has seized the necessary trunk resource, but the subsequent connection
fails, a call attempt bill will be generated.
The “call duration” in the bill refers to the duration of trunk resource seizure. Carriers
can determine whether call attempt bills are to be generated for particular trunk
resources by modifying data configuration accordingly.
6.2.4 Roaming Bill
Roaming bills (ROAM) are generated for the calls initiated by PSTN subscribers or
subscribers of other mobile networks to the local mobile subscriber Such bills are
generated at the GMSC.
Roaming bills serve as a reference for charging the calling subscribers in the PSTN or
other mobile network, or for the accounting for the seizure of incoming trunk.
Carriers can determine whether or not roaming bills are to be generated through
online data configuration.
6.2.5 Gateway Outgoing Bill
If a call is routed to another mobile network or to a PSTN office through the GMSC,
Gateway Outgoing bill is then generated at the GMSC. Such bills serve as a
reference in the accounting on outgoing trunk seizure.
Carriers can determine whether or not gateway outgoing bills are to be generated
through online data configuration.
6.2.6 Transit Bill
Transit bill is generated when a call (neither initiated nor terminated by local MSC
subscriber) is routed to the local MSC.
Transit bills are usually generated at the TMSC. They serve as a reference in the
accounting on trunk seizure.
6.2.7 Bills for Other Supplementary Services
Supplementary service bills are integrated into the MOC or MTC bills. They are
generated upon the provision of call waiting, conference call, etc.
6-4
6.2.8 Short Message Bill
Short message bills (M_SMS) include those generated for both mobile originated and
mobile terminated short messages.
6.2.9 Trunk Metering Bill
Trunk metering bills are generated for charging on the seizure of trunk resources. The
meter counts one each time a counting period is passed. The meter counting serves
as the basis of trunk metering bill.
6.2.10 Emergency Call Bill
Emergency call bills are generated when local MSC subscriber initiates emergency
calls.
6.2.11 RFC Bill
Remote Feature Control (RFC) bills are generated when local MSC subscriber
initiates RFC operation.
6.2.12 PDSN Bill
PDSN bills are generated when local MSC subscriber initiates PDSN service calls.
6.2.13 PRA Originated/Terminated Call Bill
Primary Rate Access (PRA) originated call bills are generated when a PRA subscriber
calls a local MSC subscriber.
PRA terminated call bills are generated when a local MSC subscriber calls a PRA
subscriber.
6.2.14 Long-Duration Call Bill
An intermediate bill is generated every 30 minutes when a call lasts for a long period
of time. The interval for generating intermediate bill can be determined through data
configuration. The first of these bills is referred to as the “first bill”, the last one is the
“last bill”, and the others are the “intermediate bills”.
Bills generated for a particular long call can be consolidated according to the
parameter “serial No. of the first bill” on the bills.
6-5
6.2.15 Common Call Bills
Figure 6-2 shows the bills generated for calls without call forwarding. Note that the
bills generated in the PSTN office are not illustrated here.
Originating Tandem Serving

MSC MSC MSC
MOC Bill Transit Bill MTC Bill
Originating
GMSC PSTN
MSC
MOC Bill Gateway Outgoing Bill
PSTN Serving
GMSC
MSC
Roaming Bill MTC Bill

GMSC: Gateway Mobile Switching Center
Figure 6-2 Bills generated for calls without call forwarding
Note:
The Originating MSC and Serving MSC in Figure 6-2 can be the same MSC.
Figure 6-3 shows the bills generated for a call with call forwarding.
Originating Tandem Serving

MSC MSC MSC
MOC Bill Transit Bill MTC Bill

CF Bill
Originating
GMSC PSTN
MSC
MOC Bill Gateway Outgoing Bill

CF Bill
PSTN Serving
GMSC
MSC
Roaming Bill MTC Bill

CF Bill

GMSC: Gateway Mobile Switching Center
Figure 6-3 Bills generated for a call with call forwarding
6-6
6.3 Bill Backup
To guarantee the security of charging data, powerful bill backup functions are
provided at the charging gateway.
6.3.1 Purpose
Bill backup is performed to save the bills in the backup media for long-term storage.
When the bills in the billing center are damaged, and the billing center needs to fetch
the bills again from the charging gateway, but the bills are no longer saved at the
billing gateway, the backup bills will be copied to the charging gateway, and then to
the billing center. However, if these bills are still saved at the charging gateway, then
the billing center will copy these bills instead of the backup bills.
In some cases, the backup bills are directly sent to the billing center. Two copies then
will be made out of the bills, one of which to be sent to the billing center, and the other
to be saved at the charging gateway.
6.3.2 Classification
Bills backup operations can be classified as follows:

z In terms of the backup mode, there are automatic bill backup and semi-automatic
bill backup.
z In terms of the object of bill backup, there are original bill backup and final bill
backup.
z In terms of the activation mode for automatic backup, there are scheduled
automatic bill backup (fully automatic bill backup) and user-determined bill
backup (semi-automatic bill backup).
z In terms of the mode and purpose of backup, there are complete bill backup and
incomplete bill backup. Complete bill backup refers to the backup of all bills
saved at the charging gateway, while incomplete backup, that of particular bills.
Note:
Semi-automatic bill backup and fully automatic bill backup cannot be performed at the same time.
Only one backup task for the same type of bills can be performed at a time in a fully automatic bill
backup mode.
6-7
6.4 Bill Processing
Flexible and powerful bill sorting and conversion functions are provided at the
charging gateway. Data configuration can be made to determine whether sorting and
conversion are to be performed. The bill processing is shown in Figure 6-4.
Original
Bills
Sorting Format Conversion
Final
Bills
Figure 6-4 Bill processing
6.4.1 Sorting and Filtering of Bills
To classify bills means to save the bills to different paths according to the different
processing flows. Channels are the conditions configured for the classification. When
bills are classified, they are separated according to the sorting conditions set by the
user so that they can be processed separately.
The setting of sorting conditions (i.e., channels) is flexible. The description of sorting
conditions can be made in the format similar to C++ syntax. Sorting conditions are set
on the basis of bill contents. Any index in a bill can be the key index for sorting bills.
Bills are filtered while they are classified. You can discard a certain type of bills by
setting the sorting conditions.
Bill sorting for the MSC is rather simple. Bills are sorted into three groups: ordinary
bills, trunk metering bills and other bills. That means three channels are configured:
Ordinary bill channel, trunk metering bill channel and other bill channel.
After the bills are sorted, they are saved in different directories for further processing.
6-8
6.4.2 Format Conversion
Format conversion of bills is performed at the charging gateway, where bills are
converted into the desired format for the billing center to save.
6-9
HUAWEI M800 CDMA Mobile Switching Center Chapter 7 IN Services
Chapter 7 IN Services
The Intelligent Network (IN) services supported by the MSC are listed in Table 7-1.
Table 7-1 IN services
Service Description
Pre-Paid Charging (PPC) is an account service. The subscriber
establishes an account by paying a certain sum beforehand or buying
the card (e.g. rechargeable card) of fixed face value for usage of voice
telecommunication services. The system accepts or rejects the call
establishment request according to the account balance.
Pre-Paid Charging (PPC) Charges for voice services or other services are applied to the PPC
account by decrementing the account in real time. When the account
balance is below the threshold, the call will be disconnected and a
recorded announcement will be played.
The PPC in Overlay mode is realized by the existing IN equipment in
PSTN based on the MSC system.
Freephone (FPH) permits a mobile user to originate calls to a
Freephone directory number.
The called party pays all charges associated with the call, including
roaming charges, radio channel charges, and inter-office charges. The
Freephone Service (FPH) calling party does not pay for any portion of the call.
The FPH directory numbers are in unified format. When a PPC
subscriber originates an FPH call, the MSC should process PPC
request first. If the account balance is not sufficient, the FPH call
origination request will be rejected.
Incoming Call Screening (ICS) provides for alternative routing, blocking,
or allowing of specific incoming calls.
Incoming Call Screening Screening factors include calling number, password call acceptance,
(ICS) time-of-day, called party location, etc.
ICS service helps to save the costs of the subscribers and increase the
QoS.
7-1
HUAWEI M800 CDMA Mobile Switching Center Chapter 7 IN Services
Service Description
Location Service (LCS) is provided to locate the position of the MS
using dedicated mobile positioning technology so as to provide
location-based services.
With LCS, an MS can be located to a particular cell. Therefore, it is
widely applied in security management, charging, information provision
Location Service (LCS) service, tracing management, etc.
Specifically, LCS is significant to the provision of public security
services (such as emergency service and emergency alarming service),
location-based charging and tracing, location-based information
provision (such as travel and tourism information service, broadcasting
and mobile yellow pages).
7-2
HUAWEI M800 CDMA Mobile Switching Center Chapter 8 Data Services
Chapter 8 Data Services
The data services of CDMA system are realized at the Base Station Subsystem (BSS)
side, with the support by the MSC.
The data services are listed in Table 8-1.
Table 8-1 Data services
Service Description
A Packet Data Serving Node (PDSN) is needed to transfer the data
between the PSTN and the air interface.
The PDSN connects the BSS through a Packet Control Function (PCF).
The MSC supports packet data service in the following aspects:
Packet Data Service z Service subscription
z Connection setup and release
z Maintenance and management of subscriber status
z Service query
z Traffic measurement
z Bills
z Subscriber tracing, interface tracing and tracing interpretation
Circuit data service, or InterWorking Function (IWF) service, enables
circuit-typed data calls (asynchronous data or Group 3 fax) between data
terminals and other (e.g. PSTN, and mobile) terminals, and allows mobile
Circuit Data Service terminals to access Internet directly.
The IWF services are implemented by the BSC. The MSC coordinates
with the BSC in the authorization of data (fax) service and alternation from
speech service to data (or fax) service.
8-1
HUAWEI M800 CDMA Mobile Switching Center Chapter 9 Supplementary Services
Chapter 9 Supplementary Services
Huawei M800 CDMA MSC supports a wide variety of supplementary services, which
supplements basic telecommunication services. They either allow subscribers to
choose how incoming/outgoing calls shall be processed by the network, or provide
certain information to help subscribers make the best use of the basic services.
The supplementary services should be provided along with one or more basic
services as they cannot serve subscribers independently.
The supplementary services provided by the MSC are listed in Table 9-1.
Table 9-1 Supplementary services
Service Description
CFU allows a called subscriber to have the system send incoming
calls addressed to the called subscriber's Directory Number to
Call Forwarding—Unconditional another Directory Number (forward-to number) or to the called
(CFU) subscriber's voice mailbox.
If this feature is active, all incoming calls are forwarded regardless
of the condition of termination.
CFB allows a called subscriber to have the system send incoming
Call Forwarding—Busy (CFB) another Directory Number (forward-to number) or to the called
subscriber's designated voice mailbox, when the subscriber is
engaged in a call or service.
CFNA allows a called subscriber to have the system send
incoming calls addressed to the called subscriber's Directory
Number to another Directory Number (forward-to number) or to
the called subscriber's voice mailbox when:
Call Forwarding—No Answer z The subscriber does not respond to paging or does not
(CFNA)
answer the call within a specified period after being alerted;
z The subscriber is reported as inactive;
z The subscriber's location is not known;
z The subscriber is otherwise inaccessible (e.g. with Do Not
Disturb active).
CFD allows a called subscriber to have the system send incoming
another Directory Number (forward-to number) or to the called
subscriber's voice mail box when:
z The subscriber is engaged in a call;
Call Forwarding—Default (CFD) z The subscriber does not respond to paging or does not
answer the call within a specified period after being alerted;
z The subscriber is reported as inactive;
z The subscriber's location is not known;
z The subscriber is otherwise inaccessible (e.g. with Do Not
Disturb active).
9-1
Service Description
CNIP provides the number identification of the calling party to the
Calling Number Identification
called subscriber. It applies when the subscriber is the called
Presentation (CNIP)
party.
CNIR is provided for the calling party. If the calling subscriber has
Calling Number Identification
CNIR active, the calling number will not be presented to the called
Restriction (CNIR)
party even when the called party has CNIP active.
CNIR-Over is provided for the called party. If the called subscriber
Calling Number Identification has CNIR-Over active, the calling number will be presented to the
Restriction Over (CNIR-Over) called party no matter whether the calling party has CNIR active
or not.
CW provides notification to a controlling subscriber of an incoming
call while the subscriber's call is in the 2-way state. Subsequently,
the controlling subscriber can either answer or ignore the
Call Waiting (CW) incoming call.
If the controlling subscriber answers the second call, it may
alternate between the two calls by pressing the SEND key.
CT enables the subscriber to transfer an in-progress established

Call Transfer (CT) call to a third party. The call to be transferred may be an incoming
or outgoing call.
3WC provides the subscriber the capability of adding a third party
to an established two-party call, so that all three parties may
communicate in a three-way call.
If either of the two non-controlling parties to an established
Three-Way Calling (3WC)
three-way call disconnects, the remaining party is re-connected to
the controlling subscriber as a normal two-party call.
If the controlling subscriber of a three-way call disconnects, the
conference circuit and all other parties are released.
CC provides the subscriber with the ability to have a
multi-connection call, i.e., a simultaneous communication between
three or more parties (conferees).
If any of the conferees to a conference call disconnects, the
Conference Calling (CC)
remaining parties remain connected.
If the controlling subscriber of a conference call disconnects, the
conference circuit and all conferees are released. CC remains in
effect until the controlling subscriber disconnects.
RFC permits a calling subscriber to perform some supplementary
service feature operations such as forwarded-to number
modification and barring of toll call.
This service is accessible from any terminal equipment (MS or
Remote Feature Control (RFC)
PSTN telephone).
To prevent fraudulent use, the subscriber should provide a
Personal Identification Number (PIN) after dialing one access
number so as to be identified as an authorized one.
9-2
Service Description
SPINA is a feature to protect the subscribers in case of MS loss.
After this service is activated, the MS is completely locked.
Subscriber PIN Access (SPINA)
Any mobile-originated call or service operation is unavailable until
it is deactivated.
SPINI feature enables a subscriber to restrict outgoing call

origination usage of their mobile.
Subscriber PIN Intercept The subscriber is required to enter a SPINI Personal Identification
(SPINI) Number (PIN) authorization code (i.e., a subscriber-specific string
of digits) in order to originate calls meeting a specified criteria. If
the correct SPINI PIN authorization code (or, simply PIN) is
entered, call originations are allowed.
DND prevents a called subscriber from receiving calls and sends
service denial tone to the calling subscriber. DND also blocks
Do Not Disturb (DND) other alerting, such as CFU alerting and MWN alerting.
DND does not impact a subscriber's ability to originate calls.
PL provides the subscriber the ability to specify the language for
Preferred Language (PL)
network services. PL is associated with network services.
Call Forwarding to Voice Mailbox service can forward the call to
Call Forwarding to Voice
the subscriber's voice mailbox through various call forwarding
Mailbox
services (CFU, CFB, CFNA and CFD).
VMR permits a subscriber to retrieve messages from a Voice

Message System (VMS).
Voice Message Retrieval (VMR)
The subscriber can dial his own number or the VMR feature code
to retrieve voice messages.
MWN informs enrolled subscribers when a voice message is
Message Waiting Notification available for retrieval.
(MWN) MWN may use pip tone or alert pip tone to inform a subscriber of
an unreceived voice message.
Subscriber lock service allows the subscriber to actively apply for
barring an MS from originating or receiving calls.
With incoming lock active, the MS can originate calls but cannot
receive calls.
With outgoing lock active, the MS can receive calls but cannot
Subscriber Lock
originate calls.
With both incoming call and outgoing call active, the MS can
neither originate calls nor receive calls.
The voice services of the subscriber can be restricted or allowed
through changing the subscriber lock status.
Feature code service allows the subscriber to register, activate or

Feature code service deactivate a certain feature by dialing the corresponding feature
code.
9-3
HUAWEI M800 CDMA Mobile Switching Center Chapter 10 Optional Services
Chapter 10 Optional Services
In addition to the basic services and supplementary services based on protocols,

M800 CDMA MSC also provides various optional services.
These optional services are listed in Table 10-1.
Table 10-1 Optional services
Service Description
With this service, several Mobile Terminals (MT) can be reached by dialing the
same number. This number is referred to as pilot number, and those MTs,
member terminals of ONLY service.
One Number Link A pilot number can be the number originally assigned to any of the number
You (ONLY) terminals, or one that is not allocated to any ME yet, while an MT can be either
an MS or a PSTN terminal.
When a subscriber dials a pilot number, all the members will be alerted. Once
any of them answers the call, the others will stop ringing.
Wireless pay phone communicates with the BSS through the air interface. It
functions similarly as a PSTN pay phone terminal.
To subscribers, wireless pay phone is similar to a PSTN terminal, but to
Wireless Pay carriers, it is actually a mobile terminal.
Phone
Since a wireless public phone communicates with the BSS over the air
interface like a mobile terminal, extra equipment is not necessary for wireless
pay phones on the basis of the wireless communications network. This helps to
save the costs of carriers.
Several subscribers are grouped as an iWAC group that is identified with a
group No.
The iWAC subscribers within a group can call one another by a short number,
Integrated Wide
and the calling number displayed is also the short number. The fees for such
Area Centrex
calls are also lower than those for calls with one of the two parties not in the
(iWAC)
same iWAC group.
When an iWAC subscriber wants to call a subscriber that is not within the
group, he can dial the out-group prefix with the full number of that subscriber.
Carrier selection refers to free selection of network carriers by subscribers.

It enables equal competition between different toll network carriers.
Carrier Selection Each of the carriers that provide toll call service is assigned with a Carrier
Identification Code (CIC). After subscribing to this service with a toll network
carrier, a subscriber can select the network provided by this carrier by adding
the CIC of this carrier when dialing called numbers.
RFC bills may be generated after RFC access numbers are dialed.
RFC Bill
This service allows carriers to control whether to charge a RFC call.
10-1
HUAWEI M800 CDMA Mobile Switching Center Chapter 10 Optional Services
Service Description
Number change notification category services include number change
notification service, temporary number change notification service and new
number notification service.
When a call is originated to a subscriber of number change notification service,
the system will play number change announcement to the calling party and
then connect the call to the new number if the called party has also subscribed
to the corresponding service.
Number Change
When a call is originated to a subscriber of temporary number change
Notification
notification service, the call is processed in the same way as a call to a number
Category
change notification service subscriber.
This service is different from number change notification service. When a
subscriber with no roaming authority has to go out of the local area, the
subscriber can register a local number as the new number.
When a call is originated to a new number notification service subscriber, an
announcement will be played before call forwarding. Subscribers are allowed
to determine whether to connect the call after the announcement or not.
Free call service allows a defaulting subscriber to call certain charge-free

numbers. The call procedure is the same as that of ordinary calls except that it
also controls whether to trigger the free call from an IN defaulting subscriber to
the SCP.
Free Call
The charge-free numbers aforementioned refer to the customer service
numbers.
Free calls are different from emergency calls. An invalid MS is allowed to make
emergency calls but not free calls.
10-2
HUAWEI M800 CDMA Mobile Switching Center Chapter 11 Networking
Chapter 11 Networking
Thanks to its unit networking plans, Huawei M800 CDMA MSC can serve more than
one local networks and provide a large number of links and voice channels to other
offices. It also supports the play of announcements in different languages.
The networking plans supported by M800 CDMA MSC are listed in Table 11-1.
Table 11-1 Networking plans
Plan Description
With virtual MSC function, multiple MSC IDs can be assigned to one
Virtual MSC physical MSC which covers multiple local networks, thus facilitating
charging and roaming.
With the development of networks and increase of subscribers, there
are greater demands for processing capability.
However, restricted by ITU-T specifications, the numbers of links and
voice channels between two offices (each of which has only one SP)
Multiple Signaling Point are limited (Maximum links: 16; Maximum speech channels: 4096).
To solve this problem, the concept of virtual multiple signaling point
(multi-SP) is brought into the MSC. In compliance with the ITU-T
specifications, it is the best solution for large-capacity trunks and heavy
traffic between offices.
For subscribers in the same area, some may prefer announcements to

Multi-national be played in English and then their native languages, but for some
Announcement others, it may be the contrary.
Adaptation Multinational announcement adaptation satisfies this requirement by
providing different announcement play plans.
11-1
HUAWEI M800 CDMA Mobile Switching Center Chapter 12 Number Analysis
Chapter 12 Number Analysis
The number analysis function of the MSC covers a variety of applications, including
number normalization and number conversion. It can satisfy various number analysis
requirements and make adjustment to different numbering plans and dialing
regulations in different countries.
The number analysis applications provided by the MSC are listed in Table 12-1.
Table 12-1 Number analysis applications
Application Description
It refers to flexible number conversion between the MSC and other
network entities, such as adding the number initial or deleting the
Number Normalization number.
For example, the country code can be added to or deleted from the
MDN contained in the response messages from the HLR.
It refers to the conversion of the calling numbers and original called
numbers of the TUP/ISUP incoming and outgoing signaling messages
Trunk Number at the trunk side.
Normalization This kind of normalization is based on certain conditions related to the
trunk group, message direction, number prefix, number attribute and
number type.
It refers to conversion of calling and called numbers when certain
conditions for both of them are satisfied.
Calling and Called
Number Related Related conversion means that calling numbers are converted only
Conversion when certain conditions for the corresponding called numbers are
satisfied, and it is just the other way around for conversion of the called
numbers.
To adjust to different numbering plans and dialing habits in various
countries, multinational number adaptation is supported.
Number Adaptation
The MSC can process numbers of different formats or attributes as
required.
With this function, the MSC can allocate Temporary Local Directory
Flexible Allocation of Numbers (TLDNs) randomly, by number segment, by location area, or
TLDN by MSC ID.
One MSC can use only one TLDN allocation plan.
12-1
HUAWEI M800 CDMA Mobile Switching Center Appendix A Abbreviations and Acronyms
Appendix A Abbreviations and Acronyms
3WC Three-Way Calling

AC Authentication Center
A-Key A-key
AMP Main Processing Board
AMSC Anchor MSC
BSC Base Station Controller
BSS Base Station Subsystem
CAVE Cellular Authentication and Voice Encryption
CDMA Code Division Multiple Access
CENTREX Central Office Exchange Service
CF Call Forwarding
CFB Call Forwarding - Busy
CFD Call Forwarding - Default
CFNA Call Forwarding - No Answer
CFU Call Forward - Unconditional
CIC Carrier Identification Code
CNIP Calling Number Identification Presentation
CNIR Calling Number identification Restriction
CT Call Transfer
CW Call Waiting
DND Do Not Disturb
ECPOOL Echo Cancellation Pool
ESN Electronic Serial Number
FPH Freephone
GECP 8-port Echo Canceller Board
GECS 16-port Echo Canceller Trunk Board
GMSC Gateway Mobile Switching Center
IAI Initial Address Message with Information
IAM Initial Address Message
ICS Incoming Call Screening
A-1
IMSI International Mobile Station Identity

IS-2000 Interim Standards 2000
IS-95 Interim Standards 95
ISUP Integrated Services Digital Network User Part/ISDN User Part
International Telecommunication Union - Telecommunication Standardization
ITU-T
Sector
IWF InterWorking Function
LCS Location Service
LMT Local Maintenance Terminal
MC Message Center
MDN Mobile Directory Number
MIN Mobile Identification Number
MOC Mobile Originated Call
MS Mobile Station
MSC Mobile Switching Center
MSCID MSC Identification
MTC Mobile Terminated Call
MWN Message Waiting Notification
PCF Packet Control Function
PDSN Packet Data Service Node
PIN Personal Identification Number
PL Preferred Language
PLMN Public Land Mobile Network;
PPC Pre-Paid Charging
PRA Primary Rate Access
PSTN Public Switched Telephone Network
RFC Remote Feature Control
SCP Service Control Point
SDB Short Data Burst
SIM Subscriber Identity Module
SIN Sender Identification Number
SME Short Message Entity
SMS Short Message Service
SMSC Serving MSC
A-2
SPINA Subscriber Personal Identification Number Access

SPINI Subscriber Personal Identification Number Interception
SSD Shared Secret Data
TLDN Temporary Mobile Directory Number
TMSC Tandem MSC
TUP Telephone User Part
VLR Visitor Location Register
VMR Voice Message Retrieval
VMSC Visited Mobile Switching Center
A-3

Technical Manual-System Function

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Technical Manual-System Function

Uploaded by

Copyright:

Available Formats

Chapter 1 Introduction to Functions and Services ......................................

Chapter 2 Security Management .................................................................... 2-1

Chapter 8 Data Services .................................................................................. 8-1

Chapter 9 Supplementary Services ............................................................... 9-1

Chapter 10 Optional Services ......................................................................... 10-1

Chapter 11 Networking.................................................................................... 11-1

Appendix A Abbreviations and Acronyms .................................................... A-1

HUAWEI M800 CDMA Mobile Switching Center

Volume System Function

Manual Version T2-030240-20040401-C-6.30

Product Version V610R003

Huawei Technologies Co., Ltd.

Address: Administration Building, Huawei Technologies Co., Ltd.,

Bantian, Longgang District, Shenzhen, P. R. China

Postal Code: 518129

All Rights Reserved

No part of this manual may be reproduced or transmitted in any form or by any

, HUAWEI, C&C08, EAST8000, HONET, , ViewPoint, INtess, ETS, DMC,

HUAWEI M800 CDMA Mobile Switching Instructions on replacement procedures of boards,

HUAWEI iGateway Bill User Manual Introduction to theories, installation, operation,

There are twelve chapters and one appendix in the manual.

Chapter 1 Introduction to Functions and Services introduces the contents of this

Chapter 3 Mobility Management introduces the mobility management functions of

Chapter 5 Short Message Services presents short messages services supported by

Chapter 7 IN Services lists the IN services provided by the system.

Chapter 9 Supplementary Services lists the supplementary services provided by

Chapter 11 Networking introduces the various networking schemes supported by

Chapter 12 Number Analysis describes the various applications of number analysis,

Appendix A Abbreviations and Acronyms lists the abbreviations and acronyms

The manual is intended for the following readers:

The manual uses the following conventions:

Caution: Means reader be extremely careful during the operation.

Note: Means a complementary description.

Chapter 1 Introduction to Functions and Services.................................................................... 1-1

Chapter 2 Security Management.................................................................................................. 2-1

Chapter 3 Mobility Management .................................................................................................. 3-1

Chapter 4 Call Control................................................................................................................... 4-1

4.8.2 Inter-MSC Call......................................................................................................... 4-9

Chapter 5 Short Message Services ............................................................................................. 5-1

Chapter 6 Charging ....................................................................................................................... 6-1

Chapter 7 IN Services ................................................................................................................... 7-1

Chapter 8 Data Services ............................................................................................................... 8-1

Chapter 9 Supplementary Services ............................................................................................. 9-1

Chapter 10 Optional Services .................................................................................................... 10-1

Chapter 11 Networking ............................................................................................................... 11-1

Chapter 12 Number Analysis ..................................................................................................... 12-1

Appendix A Abbreviations and Acronyms .................................................................................A-1

Chapter 1 Introduction to Functions and Services

Chapters 2 to 6 describe the basic functions of the MSC, including:

– MS short message origination

– MS short message termination

– Short message notification

– Short message broadcast

II. Service Provision

Chapters 7 to 12 describe the services provided by the MSC. Each chapter

Chapter 2 Security Management

The security management of HUAWEI M800 CDMA Mobile Switching Center

In brief, authentication serves as a means of verification on the legitimacy of the

This section gives an introduction on the classification of authentication and

2.1.1 Introduction to Authentication

The MSC performs authentication to determine whether a subscriber is authorized to

The MSC performs the following authentications:

2.1.2 Authentication Parameters

This section gives an introduction to various authentication parameters.