Professional Documents
Culture Documents
SSNC: Signaling
Trunks and LTG System
SS7 Links PCM30/24
Network
Control
LTG LTG: Line Trunk
High Speed SN B Group
SS7 Links SN: Switching
Network
MB: Message
NetM Buffer Typ D
SSNC IOP: Input/Output
207Mb/s Processor
MB D AMP: ATM Bridge
Processor
207Mb/s CP: Coordination
Processor
AMPC IOP:MB NetM: Net Manager
CP
MSC structure
Access
Switching
DLU LTG SN
LTG
Signaling Coordination
System
Network SYP
SSNC
Control MB CP
CCG
Some terms of the Circuit Switched Exchange Telephony
Switching
Exchange Switching
Transit Call and Exchange
1 Outgoing Traffic
3
Switching
Lines Trunks Exchange
2
Incoming
Calling Party Traffic
(A Subscriber)
Originating
Call Transit
Exchange
Switching
Exchange Switching
Exchange
Busy
4
5
Originating Idle
Exchange Terminating
Exchange
Called Party
Note: The network shown here is only an example.
(B Subscriber)
Routing
Routing in general is the method, how to find a way through a network
for a given Routing Information.
In the personalization center (PCS), the SIM cards are produced on the one hand and the
database for the subscriber are generated in the authentication center on the other.
The following parameters are necessary on the SIM card along with the IMSI for
authentication and ciphering:
Ki General key
A3 Algorithm 3. Used for generating the authentication code
A8 Algorithm 8. Used for generating the ciphering key
The following parameters are necessary in the database commands along with theIMSI for
authentication and ciphering:
KiA4 General key, however enciphered with algorithm A4 and additional key K4
A3 version Version of the algorithm 3 stored in the AC and to be used.
A8 Version Version of the algorithm 8 stored in the AC and to be used.
The KiA4 is deciphered in the AC with the help of algorithm A4 and key K4 (Ki=A4(K4,KiA4))
and is stored, enciphered again (KiA2=A2(K2,Ki)), in the subscriber database as KiA2 with
A2 and K2.
As soon as the subscriber is set up in the HLR, the AC begins with the generation of the
security parameters. These consist of three values: the rand (a random value), the Sres or
signed response (electronic signature for authentication) and the kc (key for the ciphering on
the radio interface). These three values are designated "triples". A reserve of 6 "triples" are
provisioned.
Authentication and ciphering execution (part2)
Authentication
• The Rand is relayed to the mobile station. This generates the Sres with
the help of the parameter Ki stored on the SIM card and A3 (Sres
=A3(ki ,rand)). The Sres is sent back to the MSC/VLR and there
compared with the Sres of the triple. If both Sres are the same, the
authentication is successful. If they are different, the SIM card is
rejected, and only emergency calls are possible depending on the
project.
Ciphering
• For the ciphering, the Rand is also used in the MS. The key Kc is
generated (Kc=A8(Ki, Rand)) with the help of the parameter Ki stored
on the SIM card and A8. The ciphering is thereupon carried out with the
algorithm 5 stored in the mobile equipment and the key Kc. The key Kc
contained in the triple is meanwhile relayed to the BSS. The algorithm
A5 is also available here, so that the ciphering can be carried out here
as well.
Location Registration
Since subscribers can change their locations in the PLMN any number of times, it is
absolutely necessary to log the current site to a central position for the availability of
the subscriber. This central position is the HLR of the respective subscriber.
Therefore the routing label of the visited MSC/VLR is entered there.
Allocate
new TMSI
ciphered(new TMSI)
Acknowledgement
• While staying in the old MSC area, the identification code of the location area (LAI location area ID) is
noted on the SIM card (subscriber identity Module)
• If the subscriber now moves to a new MSC area and thus also to a new location area, the mobile
subscriber receives a new LAI from the MSC/VLR.
• Since the new LAI is different from the old LAI, the mobile subscriber sends both LAIs back to the MSC.
• If the new MSC knows the old LAI or the corresponding old MSC/VLR, it requests from there the security
parameters not used (triples) and the subscriber identification IMSI (international mobile subscriber identity).
• Hereupon the new location area is transmitted to the HLR from the new VLR/MSC.
• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
in the VLR.
Location up-date –
TMSI unknown
MS BS/MSC/VLR
old LAI & old TMSI
old TMSI
unknown
ID request
IMSI
Allocate
new TMSI
ciphered(new TMSI)
Acknowledgement
Location Update with Location Change to an
Unknown MSC/VLR
• While staying in the old MSC area, the identification code of the location area
• (LAI location area ID) is noted on the SIM card (subscriber identity Module)
• If the subscriber now moves to a new MSC area and thus also to a new location
• area, the mobile subscriber receives a new LAI from the MSC/VLR.
• Since the new LAI is different from the old LAI, the mobile subscriber sends both
• LAIs back to the MSC.
• Since in this case the old MSC/VLR is unknown in the new MSC/VLR, the MSC/
• VLR requests the subscriber identification number (IMSI international subscriber
• identity) from the mobile subscriber and transmits the new location to the HLR.
• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
• in the VLR.
Mobile Originated Call (MOC) in D900
A-interface Signalling
BSSAP e g by ISUP, TUP, MFCR2
based on SCCP
VLR
Visited Transit Transit Terminating
BSC B B B B
MSC switch switch exchange
number number number number
Air interface
A-side
Mobile Station
MOC macro
VLR
Visited Transit Transit Terminating
BSC B B B B
MSC switch switch exchange
number number number number
Air interface
A-side
Mobile Station
Mobile Terminating Call e.g. from PSTN
• The dialing information is received by PSTN e.g. via ISUP in the PLMN
gateway MSC
• The dialing information is converted in the gateway MSC.
• A so-called "interrogation" is started as a response; i.e. a MAP message
is sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
• The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the gateway MSC.
• The gateway MSC converts this temporary directory number and sets up
a circuit connection (ISUP) to the visited MSC. The location area is
specified in the MSC/VLR owing to the cross-connection between
temporary directory number and mobile subscriber.
• The visited MSC now sends a "paging" to all BSCs situated in the location
area.
• The BSC in which the subscriber is currently situated answers with a
"paging response".
• The MSC makes the connection to the called subscriber.
Mobile Terminating Call
A-side
terminal A-interface
equipment Signalling BSSAP
e g by ISUP (TUP, MFCR2) Mobile based on SCCP
Terminating
Traffic
BSC
Transit MSISDN Gateway MSRN Transit MSRN Visited
MSISDN
switch MSC switch MSC MSRN
local
Outgoing VLR
exchange Transit Call
Interrogation Traffic
Outgoing BTS
SendRoutingInfo
Originating Call Traffic
Outgoing Traffic Provide
MSRN MSRN RoamingNr
Air interface
HLR
A-side
terminal
equipment Signalling Transit
e g by ISUP (TUP, MFCR2) switch
HLR
MAP signalling
based on SCCP and TCAP
Call Forwarding Unconditional
A-side
terminal
equipment Signalling
e g by ISUP (TUP, MFCR2)
C-side
B side (mobile) to terminal
HLR C side equipment
MAP signalling
based on SCCP and TCAP
Mobile to Mobile Call (Mobile Subscribers in
different MSC/VLRs)
• The dialing information is received via BSSAP in the MSC
• An audit of possible subscriber restrictions takes place in the MSC/VLR
• The dialing information is converted in the visited MSC of the calling
subscriber.
• A so-called "interrogation" is started as a response; i.e. a message is
sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
• The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the MSC of the calling subscriber.
• The MSC of the calling subscriber converts this temporary directory
number and sets up a circuit connection (ISUP) to the visited MSC. The
location area is specified in the MSC/VLR owing to the cross-connection
between temporary directory number and mobile subscriber.
• The visited MSC now sends a "paging" to all BSCs situated in the
location area. The BSC in which the subscriber is currently situated
answers with a "paging response".
• The MSC makes the connection to the called subscriber.
MIC LOOP: (Mobile Internal Call Loop)
MS BSSAP - LTG
CP
MOC
LOOP - LTG
MTC
CP
MS BSSAP - LTG
MIC-Code would be
neccesary
The ORIG1 Story
When we need to perform different actions in differnet callsetup-states with the
same digits, then we use the ORIG1 parameter in command CR CPT
The ORIG1 can be imagined as an additional digit suffix. It is copied into the CPB
and is together with the digits an additional input for the digittranslator.
There are two kinds, how an ORIG1 can be assigned to a call (and copied to the
CPB):
a) assignment via incoming trunk group
b) assignment within specific callsetup
In specific cases during call setup, the assignement occurs with a procedural
access to preadministered ORIG1 values for MSRN, CF, IN Loop, NP,...
(see MML command ENTRMPRDDAT)
Quiz
• Q1: Does the HLR know the respective location of the subscriber?
• Q2: Does the AC generate the mobile station roaming number?
• Q3: Does the MSC serve to through connect the call from the BSC
to other MSCs?
• Q4: Which number serves to identify the subscriber and is stored on
the SIM card?
• Q5: With which number can the subscriber be internationally dialed?
• Q6: Which number is transmitted to the equipment identification
register for auditing?
• Q7: Which number is used instead of the IMSI in order to avoid
unnecessary interchange of the IMSI via the radio interface?
• Q8: Which three components does a so-called triple comprise?
• Q9: Which parameter of the triple compares the MSC/VLR for the
authentication test?
• Q10: Did you find this course interesting/usefull?
Answers
• A1: Yes
• A2: No
• A3: Yes
• A4: IMSI
• A5: MSISDN
• A6: IMEI
• A7: TMSI
• A8: Sres, rand, kc
• A9: Sres
• A10: Of course