ZTE数据产品系列

CDMA Service and

MAP Signaling Flow
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 HLR SCP

MAP MAP CAP

TUP/ISUP
MSC/VLR TUP/ISUP MSC/VLR/SSP
TO PSTN
MAP
BSSAP BSSAP

BSS BSS

络
 MAP signaling
MAP protocols include interfaces among MSC, VLR, HLR, AUC
and SC. MAP signaling realizes the information exchange between
entities by means of protocol stipulations. Most signalings are interacted
by one transmission and one receipt simultaneously. MAP signaling is
transmitted via SS7, and lies on the upper side of MTP, SCCP and TCAP
layers.
Its main function is to switch non circuit-related data and signaling
between MSC,HLR and VLR and so on.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 Mobility management

This function is developed in line with the specialty of mobile

Communication network and meets the special requirements of mobile
communication .

1. The Registration/De-registration Function

2. MS inactive function
When a registered roaming MS is confirmed to be inactive, the
MSC/VLR will initiate an MS inactive operation to release the
resources occupied by such subscriber.
 Mobility management
the main signaling involved:
1. REGNOT
it initiates from VLR to HLR , Report the new registration location
of MS, and meanwhile approves MS, and acquires the profile of
MS.
2. REGCAN
HLR sends to the original VLR that the ms belongs to, Report that
the formerly-registered MS is beyond its service.
3. CANDEN
VLR sends to the HLR ,it denys deleting ms’s data from database
4. MSINACT
VLR notices to the HLR that the ms is inactive(stop activities)
 Mobility management
1. Mobile station registration
 Mobility management

a．When the BS receives the registration request from the mobile station, it
sends a Location Update Request message to the current service system
(MSC/VLR2) to start the registration process;

b．The current service system sends the registration notification message

REGNOT to the MS's HLR.
purpose：
1）report MS’s location（MSCID,VLRID,VLRIN）；
2）report MS’s status（activation，inactive）；
3）get MS’s approvable information ；
4）get MS’s profile
 Mobility management

c．If the MS has previously registered elsewhere, the HLR will send the
registration cancellation notification message REGCANC to the previous
system MSC/VLR1, and MSC/VLR1 will delete all the records of the
involved MS from the database.

d．MSC/VLR1 returns the registration cancellation result to the HLR.

e．HLR returns the registration notification result to MSC/VLR2, include

the user’s profile or approval information.

f．If the registration is successful, MSC/VLR2 will send the Location

Update Accept message to the BS indicating the successful registration of
MS.
Registration signaling tracer
2.MS de-registration
a．The serving MSC/VLR determines to perform de-registration based
on the MS's shutdown (power off) indication or other inactive
reasons.
b．The serving MSC/VLR deletes all the records of the involved MS
and sends the MSINACT message with the cancelled registration
type parameters to the HLR.
c. The HLR deletes the pointer that points to the MSC/VLR from the
MS data and sends a null MSINACT to the MSC/VLR to confirm
operation..

MS MSC/ VL R HRL / AU

Po we r of f
a
MSI NACT ( DEREG)
b

ms i n a c t
c
3. MS Inactive
When a registered roaming MS is confirmed to be inactive, the
MSC/VLR will initiate an MS inactive operation to release the
resources occupied by such subscriber.
MSC/ VL R HRL / AU

MSI NACT ( DEREG)

a

ms i n a c t
b

a．When a registered roaming MS is confirmed to be no longer active, the

MSC/VLR marks the MS as deactivated, and sends the MSINACT message
to the HLR.

b．The HLR sets the MS as deactivated, deletes the pointer of the

MSC/VLR, and then sends the msinact to the MSC/VLR to confirm
the operation.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
basic conception:
1.the calling:the user who initiates a call;
2.the called: the user who receive a call;
3.local office call: the calling and the called are in the same msc/vlr;
4.inter-office call :the calling and the called are not in the same msc/vlr;

the main signaling involved:

1.LOCREQ(Location Request):
The initiating MSC adopts this message to acquire data for call handling from HLR. This call
is identified by the number in the called mobile station directory received by MSC.

2. ROUTREQ(Route Request): this message is only used when the calling and the called are
not in the same msc/vlr.
Used to request the determination of route for a specific ms .
1. Local office calL(mobile user to mobile user)

BSS MSC/ VLR/ SSP HLR/ AUC

CM_Ser vi ce_Request
a
Assi gnment Request
b
Assi gnment Compl et e
c
Locat i on Request
d
Locat i on Resul t
e
Page Request
f
Page Response
g
Assi gnment Request
h
Assi gnment Compl et e
i
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the calling is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the calling.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR will give a Location Result message correspondingly informing the MSC of
the present location of the called party. In this example, both the calling and the called
parties are subscribers of a same MSC.
F. After that, MSC sends the paging request message to the BS where the called MS is
located

G. The BS sends the paging response message to the MSC.

H. The BS performs assignment of ground circuit and air channel.

I. Upon the BS's completion of such an assignment, the called phone rings. IF the called
party hooks off, the conversation starts.
Call Signaling Tracer of the same msc/vlr
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR find the called and the calling are not in the same msc/vlr through mscid(vlrin),
So HLR send the route request message to the msc/vlr of the called requesting the called’s
Route information.
f. The msc/vlr of the called returns the roureq message ,include the TLDN allocated by the
Msc/vrl of the called.
g. HLR returns the the locreq response message ,include the location information of the
Called and indicates the call type is inter-office;
h. The original msc/vlr send the IAI message to the destination msc/vlr according to the
TLDN
i. MSC sends the paging request message to the BS where the called MS is located.
j. The BS sends the paging response message to the MSC.
k. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.
l. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.
m. The msc/vlr of the called send ACM message ,the calling hears ring- back tone.
n. The called hooks off, BSC send connect message to msc/vlr
O .Msc/vlr of the called send ANC message to the calling , conversation begins.
2. Inter- office calL(mobile user to mobile user)
3. Outgoing Call ( MOBILE USER TO FIXED USER)

BSC MSC/ VLR PSTN

CMser vi ceReq( I MSI , ESN, MI N, Cal l edNum, Mobi l e I dent i t y)

a

Assi gnReq( Channel Type, CI C)

b
Assi gnCmp( Channel Number , LAI , CI )
c
I AI
d
ACM
e

ANC
f
Conver sat i on
A. The BS sends the CM Service Request message to the MSC, carrying the called
number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC will send the Assignment Request message to
the BS, and start to assign ground circuit and instruct the BS to assign service channels
for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D, E and F attempt to connect with the called party via TUP or ISUP signaling until
getting through.
4. Incoming Call (FIXED USER TO MOBILE USER)

PSTN MSC/ VLR HLR BSC

I AI
a
LOCREQ( MSCI D, BI LLI D, DGTSDI AL, Sy s t emTy peCode)
b
l oc r eq( MSCI D, MI N, ESN, TERMLI ST, REDI ND)
c
PageReq( I MSI , LAI )
d
PageRs p( I MSI , ESN)
e
As s i gnReq( Channel Ty pe, CI C)
f
As s i gnCmp( Channel Number , LAI , CI )
g
ACM
h

Connec t
i
ANC
j
Conv er s at i on
A. GMSC sends the IAI message with the called address to the called party

B. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical locati

c. The HLR will give a Location Result message correspondingly informing the MSC of
the present location of the called party.

d. MSC sends the paging request message to the BS where the called MS is located.

e. The BS sends the paging response message to the MSC.

f. f and g assign ground circuit and air channel.

h. The BS sends the ACM message to the calling, and the calling hears the ring-back tone.

i. The called hooks off, BSC send connect message to msc/vlr

J. Msc/vlr send ANC message to PSTN, conversation begins.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 Security manmagement

Authentication parameters：

A-KEY 、 MIN 、 ESN 、 SSD and authentication

algorithm 。
This function is designed to protect legal subscribers and prevent phony
subscribers from "invasion". Each registered subscriber has been given a
subscriber number, mobile station identification number (MIN) and an
authentication key (A-KEY). The MIN and A-KEY are written into the
subscriber's mobile phone by means of air activation service or special equipment.
By means of SSD updating, a Shared Secret Data (SSD), which is to be used future
authentication and encryption algorithm calculation, is generated in both the AUC
and the subscriber's mobile phone to be used for. If the VLR visited supports SSD
sharing, this SSD is also saved in the VLR.
The 128-bit SSD is divided into two parts, 64-bit SSD_A for authentication
calculation and the 64-bit SSD_B for the encryption calculation respectively.
 RAND_CALLENGE ESN AUTH_DATA SSD_AUTH
RANDSSD ESN A- Key
56 32 64 RAND ESN MI N1 SSD_A_NEW
32 32 24 64

SSD_Gener at i on Aut h_Si gnat ur e

Pr ocedur e Pr ocedur e

AUTHR
SSD_A_NEW SSD_B_NEW 18
64 64

SSD generation algorithm authentication algorithm

The authentication data in AUC:
MIN,ESN,A-Key,SSD(SSD-A and SSD-B)

The authentication data in VLR when VLR supports SSD sharing :

MIN,ESN,SSD(SSD-A and SSD-B)

SSD: shared secret data

It is generated by A-Key,ESN,RandSSD and CAVE algorithm。It can not be
transmitted between MSC/VLR and BSC .it can be stored in AUC,MS and
VLR (support ssd sharing)
 Signaling involved:

1.AUTHREQ(authentication request):authenticate an MS with authentication capabiity

It initiates from VLR to AUC when the ms is needed

2.AUTHDIR(authentication direction):Modify
direction) MS authentication parameter
Through this message ，AUC can initiate unique inquiry、SSD update
or VLR initiates unique inquiry .

3.BSCHALL(Base station inquiry):

respond to the base station inquiry command received from ms.

4.ASREPORT :Report the result of an authentication operation

5.AFREPORT: report MS authentication failure

1. Gloable challenge

Taking registration for example

MS MSC/ VLR HLR/ AUC

OMT( AUTH=1, RAND)

a
Loc at i on Updat a Reques t
( RANDC, AUTHR, COUNT)
b

AUTHREQ( RAND, AUTHR, COUNT)

c
aut hr eq
d
REGNOT
e

r egnot
f
 A. The AUTH=1 in the OMT message of air interface means that
authentication is required when access to the system. The RAND used in
authentication is provided by the BS. The MS, using the RAND and the SSD/-A
and MIN/ESN data in its own memory, executes the CAVE algorithm to obtain
the authentication result AUTHR.

B. The MS registers in the new serving MSC/VLR, and provides

authentication parameters such as MIN/ESN, AUTHR, RANDC etc. in the
Location Update Request message.

C. MSC/VLR sends the authentication request message AUTHREQ to the

HLR/AUC, and the HLR/AUC executes the CAVE algorithm using the
MIN/ESN, RAND and currently stored SSD-A to calculate the authentication
result AUTHR, and compares the result with the MS-sent AUTHR.

D. HLR/AUC returns the authentication result "authreq" to the MSC/VLR.

E. If the authentication is successful, the MSC/VLR will initiate the
registration service.

F. HLR returns the registration result.

2. Unique inquiry:
This procedure can be initiated by AUC and VLR(only SSD is shared)

MS MSC/ VLR HLR/ AUC

AUTHDI R
[ mi n, esn, r andssd, r andu, aut hu] a
aut hdi r [ ] b

Unique random inquiry request c

Unique random response d

ASREPORT[ mi n, esn] e
asr epor t [ ] f
 A. HLR/AUC selects a unique inquiry random number (RANDU), and generates an
authentication response by executing CAVE with the currently stored SSD-A, ESN,
MIN1 and MIN2. HLR/AUC sends an AUTHDIR to MSC/VLR that currently accessed
by MS.

B. MSC/VLR sends a null authdir to HLR/AUC. Authdir is only used to notify

HLR/AUC of receipt of messages.

C. The serving MSC/VLR adopts RANDU provided by AUTHDIR (Step a) to send a

unique inquiry direction.

D. MS employs RANDU and currently stored SSD-A, ESN, MIN1 and MIN2 to
execute the CAVE program for the purpose of generating an authentication response
(AUTHU), and then sends AUTHU to the service MSC/VLR.

E. The serving MSC/VLR compares the AUTHU value provided by AUTHDIR (Step
a) with that received by MS. The service MSC/VLR sends an ASREPORT to HLR/AUC,
reporting the success or failure of unique inquiry.

F. HLR/AUC sends an asreport to the service MSC/VLR.

3.SSD updating:
when the SSD valuses of the MS don not match with those In the AUC ,or in
consideration of security,AUC need to perfom SSD updating to the MS.

MS MSC/ VLR HLR/ AUC

AUTHDI R[ mi n, es n, r ands s d, r andu, aut hu]

a
aut hdi r [ ]
b
SSD updati ng request
c
B ase stati on request
d
BSCHALL[ mi n, es n, r andbs ]
e
bs c hal l [ aut hbs ]
f
B ase stati on response
g
SSD updati ng response
h
U ni que random i nqui ry request
i
U ni que random response
j
ASREPORT[ mi n, es n]
k
as r epor t [ ]
l
a. AUC determines whether it is necessary to update the shared secret data
(SSD) in MS. This determination can be made according to some reasons
such as AUC management procedure or AUC authentication timer timeout.
AUC applies ESN, A-key, and RANDSSD provided by AUC to execute CAVE to
generate a new SSD value. 。
note:：Ac must save the new SSD and the old SSD until receive the updating rusult infomed by
VLR.

AUC sends authentication direction message (AUTHDIR) to MSC/VLR where MS is

currently located.

b. Service MSC/VLR delivers authdir to HLR/AUC .

c. The service MSC/VLR employs the RANDSSD value provided by HLR/AUC to send
an SSD updating direction.
d. MS applies ESN, A-key, and RANDSSD provided by SSD updating direction to
execute CAVE to generate a new SSD value. MS selects a random number RANDBS,
and sends the base station inquiry direction to the service MSC, RANDBS included.
Then, MS executes CAVE by adopting the new SSD-A, ESN, MIN1 and the random
number (RANDBS) to generate an authentication result (AUTHBS).
e. The service MSC/VLR sends BSCHALL to HLR/AUC.

f. Then, HLR/AUC executes CAVE by adopting the new SSD-A, ESN, MIN1 and the
random number (RANDBS) provided by BSCHALL to generate an authentication
result (AUTHBS). AUTHBS value returns to MSC/VLR when returning the base
station inquiry message results (bschall).

g. Service MSC/VLR sends the calculation results of AUC to the MS contained in the
base station inquiry response message.

h. If AUTHBS result provided by AUC complies with the calculation value of MS, the MS
saves the new SSD, and will use it in future execution of CAVE. Then, sends SSD to
the service MSC/VLR to update acknowledgement messages.

i. The service MSC/VLR sends a special inquiry direction to the MS with RANDU
provided by AUTHDIR (Step C).
 j. MS employs RANDU, and currently saved SSD-A, ESN,
MIN1 and MIN2 to execute CAVE for generating a unique
inquiry authentication response (AUTHU); then, sends
AUTHU to MSC/VLR. The service MSC/VLR compares the
AUTHU provided by AUTHDIR with that received from the
MS.

K. The service MSC/VLR sends an ASREPORT to

MSC/VLR, reporting the success or failure of SSD updating
and unique inquiries.

L. The new SSD will be saved by HLR/AU and used for future
execution of CAVE. The asreport sent from HLR/AUC to
MSC/VLR specifies the services available for MS.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
1. Call forwarding services
1) Call forward unconditional (CFU)
When this supplementary service has been activated, all the incoming
calls to the subscriber concerned will be unconditionally forwarded
to a third party subscriber registered by such called subscriber.
2) Call forward busy (CFB)
With this service activated, all incoming calls to a mobile subscriber
will be forwarded to a third subscriber registered by such
subscriber when he is busy.
3)Call forward no answer (CFNA)
No answer means that the called mobile subscriber does not hook off
for a long time after the MS rings. When the CFNA service has been
activated, incoming calls of the subscriber will be forwarded to a
third party if the mobile subscriber does not answer.
 4) Call Forward Default (CFD)
By CFD (call forward default), in case of no paging response or no
answer of a mobile subscriber, or the mobile subscriber is
unavailable due to he is in a blind area, the system will forward
the call to a third party. This function is actually a combination of
CFB and CFNA.
2. of Call barring services
Call barring services include originating call barring services and
incoming call barring services.
1) Subscriber PIN access (SPINA)
When this service has been activated, the subscriber will not be able
to access to the MS unless he can provide the correct -PIN.
2) Subscriber PIN interrupter (SPINI)
When this service is activated, the subscriber dials a certain number,
meeting the predefined conditions such as local call, national call,
international call etc., the corresponding PIN must be inputted
before the call can be continued.
3) Password calling acceptance (PCA)
PCA service provides a call filtering function. When the MS that has
subscribed for this service acts as the called party, the calling
subscriber must input the correct password before the call can be
accepted.
4) Selective Call Acceptance (SCA)
The SCA service also provides a call filtering function. With this service
activated, the subscriber can accept only calls from the numbers
specified in the SCA filtration list, and all other calls will be rejected.
5) Do-Not-Disturb Service (DND)
Once this service has been activated, the subscriber will not receive
any incoming calls.
 3. Number identification server
1) Calling Number Identification Presentation (CNIP)
This service is a called-party-initiated service. If a subscriber has subscribed
for the CNIP service, he will receive the calling number at the same time when
he receives an incoming call.

2) Calling Number Identification Restriction (CNIR)

This is of calling initiating service for restricting the calling line identification
representation for the connected line.
4. Other supplementary servers
1) Call Waiting (CW)
With this service subscribed for, when no channel is available for an incoming call, the
called subscriber will be notified and the call will be holding on. The called subscriber
can decided whether to answer the call. Only one waiting call is acceptable at a time.
2) Conference call (CC)
This service permits calls among more than two subscribers. With this service subscribed
for, the subscriber can hold a telephone conference at any time as the controlling party.
The controlling party can add the members of the conference by inputting telephone
numbers one by one.
3) Call transfer (CT)
When a two-party call is ongoing, one of the subscribers can transfer the call to a third
party and disconnect himself, so that the other subscriber continues the conversation
with the third subscriber.
4) Three-Way Calling (3WC)
This service allows the telephone conversation among three parties.
5) Remote service control (RSC)
By means of this service, the subscribers can perform certain operations, such as call
forwarding services etc., on other own terminals (fixed telephone set or mobile handset).
1.Call forward busy (CFB): A B C ;A and B not in the same msc/vlr,A and
C in the same msc/vlr;
BSC MSC/ VLR HLR MSC/ VLR

CMser vi ceReq( I MSI , ESN, MI N, Cal l edNum, Mobi l e I dent i t y)

a
Assi gnReq( Channel Type, CI C)
b
Assi gnCmp( Channel Number , LAI , CI )
c
LOCREQ( MSCI D, BI LLI D, DGTSDI AL, Syst emTypeCode)
d
ROUTREQ( MSCI D, BI LLI D, NI N, ESN, Syst emTypeCode)
e
r out r eq( MSCI D, AccDenRsn)
f
l ocr eq( MSCI D, MI N, ESN, TERMLI ST, REDI ND)
g

LOCREQ( MSCI D, BI LLI D, DGTSDI AL, Syst emTypeCode)

h
l ocr eq( MSCI D, MI N, ESN, TERMLI ST, REDI ND)
i
PageReq( I MSI , LAI )
j
PageRsp( I MSI , ESN)
k
Assi gnReq( Channel Type, CI C)
l
Assi gnCmp( Channel Number , LAI , CI )
m

Connect
n
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR find the called and the calling are not in the same msc/vlr through mscid,
So HLR send the route request message to the msc/vlr of the called requesting the called’s
Route information.
f. The msc/vlr of the called returns the roureq message ,include the user’s status is busy.
g. HLR returns the the locreq response message ,include the forward number and indicates
the forward type is busy;
h. When the orignal MSC confirms the forward user is a mobile subscriber through numbe
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the forward user requesting its physical location.
i. The HLR will give a Location Result message ,including the location information of the
forward user; In this example, both the calling and the forward user are subscribers of a
same MSC.
j. MSC sends the paging request message to the BS where the called MS is located.
k. The BS sends the paging response message to the MSC.
l. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.
m. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.
n. Upon the BS's completion of such an assignment, the called phone rings. IF the called
party hooks off, the conversation starts.
2. Call forward no answer (CFNA)

MSC/ VLR/ SSP( 1) HLR MSC/ VLR/ SSP( 2)

Or i gi nat i on Cal l

Locat i onReq( Cal l ed number )

Rout eReq( Cal l ed number )

Rout eResul t ( TLDN)

Locat i onResul t ( TLDN)

Connect t o cal l ed number but Ti meout f or cal l ed no answer

Tr ansToNumReq( For war dr eason, MI N)

Tr ansToNumRsp( f or war d number )

Connect t o t he f or war d number