Request Access

The MS sends a Channel Request (CHAN_REQ) message on the RACH. 

The BSS responds with a radio resource assignment (IMM_ASS_CMD) on the AGCH. 
The MS sends a Service Request (CM_SERV_REQ) message to the BSS on the SDCCH. (CM = Connection
Management)

Authentication
Before the network will provide any services to the MS, the network will require the MS to authenticate itself. The BSS
sends an Authentication Request (AUTH_REQ) message to the MS. The RAND serves as the "challenge" for
authentication.

The MS calculates the proper SRES based on the RAND that was given and sends the SRES to the BSS in
anAuthentication Response (AUTH_RESP) message.

The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed access to the network.
The BSS will send a Service Accept (CM_SERV_ACC) message letting the MS know that the service request was
received and processed.

Once authenticated, the BSS orders the MS to switch to cipher mode with the CIPH_MOD_CMD message.

Initial Call Setup

Ciphering is one of the security procedures designed to protect the subscriber identity and data. It is an optional
procedure in GSM. When ciphering is active, all information exchanged between the mobile and the network on the
dedicated radio channels is encrypted. The key previously set between the network and the MS is used to encipher
and to decipher the encrypted information.

During the ciphering procedure the ciphering key Kc is set between the network and the MS. Ciphering is initiated
after the ciphering key is set on the dedicated signalling channel (SDCCH or FACCH).

The GSM uses stream ciphering, which means that the data flow transmitted on the SDCCH/TCH is the binary bit by
bit addition of the user data flow to a ciphering bit stream.

If ciphering algorithm is changed during Assignment or Handover then BSC passes the cipher mode setting to the MS
in Assignment Command or Handover Command message.

In an MSC-controlled handover, the MSC tells the new BSS whether encryption is required in the HANDOVER
REQUEST message.

In a BSC-controlled handover, the BSC passes the encryption information to the target BTS on the activation of the
channels if the encryption information was received from the MSC.

CIPHER MODE COMMAND message

The MSC sends the CIPHER MODE COMMAND message (a) to the BSC to indicate whether ciphering is required
and if so, to indicate the ciphering key.
The CIPHER MODE COMMAND message (from the MSC to the BSC) contains the following data:
 message type
 layer 3 header information
 encryption information: permitted algorithms and ciphering key
 cipher response mode.
The message contains the encryption instructions and the L3 header information for the MS.
When ciphering is required, the encryption information element contains information for the BTS to load the
encryption device with the appropriate key.

ENCRYPTION COMMAND message

On receiving the CIPHER MODE COMMAND message, the BSC selects the algorithm to be used according to the
list of permitted algorithms included in the message and the algorithms that are supported by that particular BSS. See
Support for different ciphering algorithms for details.
Regardless of whether ciphering is to be activated, the BSC stores the encryption information, including the selected
algorithm for possible subsequent handovers, and passes the encryption information to the BTS in the ENCRYPTION
COMMAND message (b).

The ENCRYPTION COMMAND message contains the following data:

 message header
 encryption information: selected algorithm and ciphering key
 link identifier
 L3 ciphering mode command to MS
 message header
 cipher mode setting: no ciphering/start ciphering
 cipher response: the cipher response element is used if received from the MSC (optional).

The BTS analyses the ENCRYPTION COMMAND message. If encryption is required, the BTS activates the
demodulator to decipher. Regardless of whether ciphering is required, the BTS sends the CIPHER MODE
COMMAND message (c) to the MS.

CIPHER MODE COMPLETE message

The MS starts to decipher and to encipher using its available ciphering key. It then returns to the BTS, in encrypted
form, the CIPHER MODE COMPLETE message (d) or the next message it is due to send. The message includes the
IMEI, if required by the MSC.

On receiving the CIPHER MODE COMPLETE message (or any correctly enciphered layer 2 frame), the BTS starts
enciphering and forwards the message via the BSC to the MSC.

If the ciphering procedure fails, the MSC takes the appropriate action.

Support for different ciphering algorithms

The MSC may send a list of permitted ciphering algorithms to the BSC in the CIPHER MODE COMMAND message.
The BSC selects the algorithm to be used from this list according to the algorithms that are supported by the BSS. If
the BSS supports several algorithms, the BSC makes the selection according to the following preference:

1. A5/3 
2. A5/1 
3. A5/0 (no ciphering)

Algorithms other than the ones mentioned above cannot be used.

If the BSS does not support any of the permitted algorithms, the BSC sends the CIPHER MODE REJECT message
to the MSC. The MSC then decides on further action.
-----------------------------------------------------------------------------------------------------------------------------------------------------------
The MS will immediately switch to cipher mode and send a Cipher Mode Complete (CIPH_MOD_COM) message.

The MS then sends a Call Setup (SETUP) message to the BSS. The message includes the address information
(MSISDN) of the called party.

The BSS assigns a TCH to the MS by sending an Assignment Command (ASS_CMD) message. This message
includes which Transceiver (TRX) and which Time Slot (TS) to use.

The BSS does not actually assign a TCH to the MS until the MSC sends a Call Proceeding (CALL_PROC) message
to the BSS indicating that the IAM has been sent.
The MS immediately switches to the assigned TCH. The MS sends an Assignment Complete (ASS_COM) message
back to the BTS on the FACCH.

Remember that a FACCH is not a separate channel; it is simply a stolen time slot from the TCH that is used for
signaling data instead of voice traffic.
 

Call Setup
The MSC sends an Initial Address Message (IAM) to the GMSC. The IAM contains the MSISDN of the called party as
the MS dialed it.

The MSC will also send a Call Proceeding (CALL_PROC) message down to the BSS and this is when the BSS would
assign a TCH to the MS, as described in step 10 above.

 Based on the dialed number, the GMSC decides where to route the IAM within the PSTN.

The PSTN will continue to route the IAM until it reaches the correct Switching Center and the call routing is complete.
The PSTN will then establish the call circuit and send an Address Complete Message (ACM) back to the GMSC.

The GMSC then forwards the ACM back to the responsible MSC indicating that the call circuit has been established

Call Establishment
Once the MSC receives the ACM, it sends an ALERT message to the MS indicating that the call is going through.
The BSS sends the ALERT message on the FACCH. Once the MS receives the ALERT, it will generate the ringing
sound in the earpiece. The BSS sends an alerting message the subscriber will hear the line ringing.

Once the called party answers the phone, the PSTN will send an Answer message to the MSC. The MSC forwards
this to the MS in a Connection (CON) message.

Once the MS receives the CON message, it switches over to voice and begins the call. All voice traffic occurs on the
assigned TCH.

Call Termination
When either the caller or the called party hangs up, the call will be disconnected. Either party can initiate the
disconnect. In this example, the MS initiates the disconnect. The MS sends a Disconnect (DISC) message to the BTS
on the FACCH.

The BSS forwards the DISC to the MSC. Once the MSC receives the DISC message, it sends a Release (REL)
message through the GMSC to the PSTN as well as down through the BSS to the MS.

The MS responds by sending a Release Complete (REL_COM) message to the BSS on the FACCH. The BSS
forwards the REL_COM message up to the MSC. Once the MSC receives the REL_COM message the call is
considered ended from the call control perspective.

Although the call has ended, the BSS still has a TCH allocated to the MS. The MSC sends a Channel Release
(CHAN_REL) message to the BSS. The BSS forwards the CHAN_REL message to the MS.

The MS responds with a DISC (LAPDm) message and returns to an idle mode. The BSS reallocates the channel for
other call or releases the TRX. 

External Resource
Call Flow Mesage Details:-

1. CM Service Request – Message contains Global Cell Identity, Kind of Service

required by subscriber e.g Voice, SMS, Fax, USSD. Mobile Identity e.g TMSI/IMSI.
2. CM Service Accept – Message is in reponse of CM Service Request.
3. Set Up - Message contains dailed number from Mobile A (i.e Mob B number) and
speech Codec.
4. Send Routing Info-Request (SRI) - After analysis of dialed numbers received
from A in set up message, MSC recognises its own MSISDN series and send SRI to
HLR to get the Mobile station roaming number(MSRN). This messge contains B
MSISDN, Interrogation type e.g Basic Call etc.
5. Assignment Request - Message is to seize a channel for voice call for Mob A
between MSC and BSC. Message contains Circuit Identification Code(CIC).
6. Assignment Complete - Acceptance from BSC end that same CIC has been seized.
7. Provide Roaming Number Request - HLR checks in its database to which VLR,
Mob B is registered & ask for roaming number from that VLR. Message contains
IMSI, MSISDN, VLR ID of Mob B.
8. Provide Roaming Number Response - Message is response of roaming no.
request and contains roaming number of Mob B. This message is for HLR. In this VLR
checks its database & allocate one free MSRN from its MSRN pool for B number.
9. Send Routing Info-Response - In this HLR forward same roaming number which it
receives in above message to MSC.
 10. Paging Request - In this VLR checks the MSRN recieved from HLR & search which
MSISDN is against that MSRN, now MSC checks the VLR database of that MSISDN to
get the LAC & TMSI/IMSI of that MSISDN (Mob B) & initiates the paging request
message to that particular LAC on the basis of TMSI/IMSI in that BSC. BSC now page
to that LAC on the basis of IMSI/TMSI of Mob B. Message contains LAC, IMSI/TMSI,
DPC of BSC.
11. Paging Response - Mob B response to that paging with GCI (Global Cell Identity) to
BSC that inturn forwarded to MSC.
12. Assignment Request - Message is to seize a channel for voice call for Mob B
between MSC and BSC. Message contains Circuit Identification Code(CIC).
13. Assignment Complete - Acceptance from BSC end that same CIC has been seized.
14. Set Up - It is used to display Mob A number on Mob B handset.
15. Alert - This message indicates Mob A that Mob B is connected & its ringing. The Ring
Back Tone is send from MSC to Mob A.
16. Connect - Mob B answers the call & connect message from Mob B is send to MSC,
inturn MSC sends connect message to Mob A indiacting that phone has been
answered & connects those 2 voice channels which were seized during the
assignment complete message.
17. Connect Acknowledge - To acknowledge the connection.

Read more at http://telecomtigers.blogspot.com/2009/10/gsm-mobile-to-mobile-call-flow-

within.html#FLBfwwUmub6EF0rD.99