Mobile originated call and mobile terminated call in

GSM
This page explains the main functionalities of GSM networks, including mobile-
originated and mobile-terminated voice calls, mobility, handover, SMS, and
international roaming.

Mobile-originated call
A call originating from a mobile device (MS) in the GSM network is routed
through the core network to the destination party. To connect to the GSM
network, an MS first connects to a radio network, which is in charge of handling
messaging between devices and the core network. An MS is constantly
communicating with the Base Station Subsystem of the radio network to send
and receive signals. The steps to establishing a GSM voice call are illustrated
below.

1. to initiate a call, the MS sends a request for radio resource allocation to

the BSS, which mediates further connection to the Mobile Switching
Center (MSC). The BSS assigns the MS a channel with a given frequency
and time slot, which constitutes the communication route between the MS
and the BSS.
2. once the MS confirms the established channel, the BSS can initiate the
connection to the MSC.
3. once the MS has connected to the network, the subscriber needs to be
authenticated. This can be done using the IMSI number stored in the SIM
 card, which allows the Authentication Center in the core network to verify
the subscriber’s identity. After this step, the MS and the MSC can start
communicating.

To make sure the data sent over the radio network between the BSS and
MS/MSC is secure, the MSC initiates a ciphering procedure which is transmitted
to the BTS, which in turn forwards the message to the MS. The MS enables
ciphering towards the BTS; as the BTS starts receiving ciphered data, it will start
the ciphered transmission of information, finalizing the encryption procedure.

4. in order to initiate the call setup, the MSC verifies that the requested service is
allowed for the subscriber. This information is available in the Virtual Location
Register, which maintains temporary subscriber data (location, preferences,
allowed services). Once the VLR confirms the service requested by the
originating MS, the MSC starts the call setup.

5. for the call to take place, the MSC allocates a voice channel between the MSC
and the BSS. The BSS notifies the MS about the change to voice mode, and the
MS returns a confirmation message. The MSC routes the call to the dialled
number. When the call is received in the PSTN, the MSC is notified that the
called subscriber is being alerted, at which point the originating MS receives a
ring notification.

To disconnect the call by either party, a disconnect message is sent to the MSC,
which releases the communication channels created with the PSTN and the BSS.

Mobile-terminated call
A terminated call (showed on the right side of the diagram above) in the GSM
network is a call received on a mobile device. For an MT to be placed, it is
necessary to locate the network to which the called subscriber is currently
connected, and, once this is done, to route the call towards the destination MS.

1. when a call is placed from the PSTN towards a given phone number, the
PSTN uses the information in the phone number (country and if available,
operator) to locate gateway MSC leading to the MSC where the subscriber
is registered.
 2. the GMSC can request information about the subscriber’s core network
and current location by interrogating the HLR (Home Location Register).
3. the HLR constantly updates locations of the MS stored in the VLRs of the
networks the MS visits. In the HLR, the subscriber MSISDN (phone
number) is associated with the IMSI number of the SIM card, which was
used to authenticate the subscriber in the visited network as they
registered. Since authentication is communicated to the MSC, the HLR is
aware of the visited MSC/VLR of the MS at a given time.
4. In order for the GMSC to pass the call to the MSC, the HLR asks a
temporary roaming phone number from the MSC (Mobile Station
Roaming Number – MSRN).
5. the MSRN is sent back from the HLR to the GMSC.
6. the GMSC forward the call to the MSC using the assigned MSRN.
7. having received the call, the MSC pages all the BSCs in the area that it
serves.
8. the BSC, in turn, page the BTSs assigned to them.
9. the called MS responds to the paging from the BTS, asking to establish a
radio channel to the BTS.
10.the response is forwarded to the MSC, which, once notified, authenticates
the MS and initiates the ciphering of the call using the same procedure as
in MO calls.
11.when the MSC sends back to the radio network the call confirmation
message, the called MS starts to ring.

At the other end, the MSC notifies the GMSC, which notifies the PSTN that the
destination number is being alerted.

Mobility and handover in the GSM networks

Mobility and handover functions are required whenever MS location changes
occur, and depend on whether the device is engaged in a call session (when
handover is required) or not (mobility management). In GSM networks the
location of a device is always known to the network and updated whenever
necessary. Location updating is needed in the case an MS roams to a different
location area. An MS is constantly listening to signals from the radio network (to
detect whether it is paged for an incoming message) and in its turn
communicates its location to the radio network whenever it enters a new location
area. When not in a call, the MS connects to the cell that has the strongest signal,
and when it detects a stronger signal from a different cell, it will disconnect from
the current one and connect to the new one. If the MS moves to a new cell of the
same location area, it is not necessary for it to reconnect (authenticate) to the
network. If instead it goes into the range of a new Location Area, a location
update procedure is initiated. Essentially, the MSC/VLR in the home network
must register the new location so that the device can be available to other
devices trying to send it a communication. Mobility procedures are shown in
orange below:

1. to communicate to the network, the MS establishes the connection to the

radio network, and sends a location update request to the current BSS. The
BSS forwards the request to the MSC, which finds that the device was
registered to a different MSC/VLR.
2. the current MSC contacts the previous MSC to get information about the
MS, by sending it the Temporary Mobile Subscriber Identity.
3. in the old MSC, the IMSI is associated with the TMSI, so that the IMSI
parameter is be sent to the new MSC. Once it reaches the MSC, the
current location of the device is updated in the HLR; having the IMSI
 number, the HLR will be able to provide information about the subscriber
(services allowed, preferences etc) to the new MSC.
4. the new VLR location is updated in the HLR. Information from the
previous MSC/VLR is deleted.
5. once the updates are communicated by the HLR to the new MSC,
authentication is performed using the SIM card IMSI. After
authentication, the MSC initiates ciphering and allocates a new temporary
identity that will be used to update the subscriber’s next location.

If the MS is engaged in a call session and changes location, the connection must
continue uninterrupted and transfer to the new location must be done seamlessly
to the subscriber. If the MS roams from one BSC to a new one, both managed by
the same MSC, the MSC will be the one managing the handover. As the BSC is
informed by the MS of the location change, the BSC sends a handover request to
the MSC, including the code of the current location area (LAC) and the cell
identifier, which uniquely identifies the cell in the network. Once the MSC
receives the coordinates of the new BSC, it messages it requesting the
assignation of a speech channel. The MSC then sends a request to the current
BSC to perform the handover to the new cell. The BSC sends the MS the new
time slot and frequency requirements for the new channel.

A handover may also be requested between 2 different MSCs. This case scenario
is illustrated in the diagram above in green color.

1. when the BSC is informed of the location change and finds that the new
location is not in its area, it forwards the handover request to the MSC,
which acknowledges that the subscriber has roamed to a different MSC.
The MSC has access to the LACs of neighboring MSCs, therefore it can
determine the network in which the subscriber has roamed.
2. the old MSC sends the request to the target MSC, which asks the
corresponding BSC to establish the speech channel to the MS.
3. the MS receives handover request via the initially established channel;
4. communication is moved to the new created channel of the second MSC.
The MSC that initially assigned the MSRN for setting up the call is called
an anchor MSC and is responsible for all the inter-MSC handover
procedures that may occur during a call.
 5. in the case of a handover between different MSCs, a new authentication of
the MS will also be performed in the new network.

Short Message Service

A short message service is handled in the network by the short message service
center (SMSC) found in the core network, which is in charge of storing and
routing messages between subscribers.

The process is illustrated in the diagram below.

1. to send an SMS, the MS connects to the MSC, which performs the

authentication of the subscriber and ciphers the communication in the
same way as in the case of voice calls.
2. after the MSC receives the message, it queries the VLR to check the
allowed services for the subscriber.
3. if the service is allowed, the MSC forwards the message to the SMSC.

Like in the case of voice calls, the HLR uses the IMSI to locate the current
MSC/VLR in which the subscriber has registered.

1. next, the HLR asks the MSC to assign a temporary MSRN number, which
is passed to the GMSC.
 2. the GMSC then forwards the message to the MSC using this number. The
MSC sends out a paging to all the BSCs in its area, which then page all
the base stations serving them.
3. the SMS is delivered to the MS after it responds to the BTS paging.

USSD (Unstructured Supplementary Service Data) allows an MS to

communicate directly with the service provider’s system in order to obtain
various information in real time. Unlike SMS, USSD doesn’t require a center to
store and forward the message to the target party. Once the USSD message
originated from the MS reaches the MSC, the MSC determines whether the
service is authorized for the subscriber and if so, forwards the message either to
a USSD gateway or to the HLR, depending on the requested service. The USSD
gateway forwards the message from the GSM core network to the relevant
application, which replies to the MS.

International roaming
Communication between two different mobile operators networks is possible
based on the existence of roaming agreements between them. These can be direct
bilateral agreements or, to simplify, agreements with a clearing house. An
international transit network allows the exchanging of data between different
operators, and its services are usually regulated by a clearing house, which acts
as an intermediary between networks. It stores usage and call data records
generated in the visited network, that are used for billing in the subscriber’s
home network. This way, an international roaming subscriber is allowed to use
the services of the visited network but is charged by the home network.

Voice call flow

In GSM networks, when a call is placed from a visited network outside the MS
home country, the call must go from the visited network to the home network of
the called subscriber. If the subscriber has authenticated to the visited network,
the location and user preferences will already be known to the v-MSC from the
HLR. If a roaming subscriber receives a call, since the HLR knows the VLR/v-
MSC where the MS is registered, it sends out a request to the visited MSC to
assign the MSRN number to which the GMSC will then route the call. The
MSRN is returned to the HLR, which sends it to the GMSC, which routes the
call to the v-MSC. The MSRN contains the current visited country code and the
current MSC code, so that the call can be routed accordingly to the MS.

Data transfer

In GPRS, a GPRS Roaming Exchange is used to connect network operators from

different countries. Once the MS is attached to the visited core network, it sends
a request for data access to the visited SGSN. The message includes the APN
and the v-SGSN tries to locate IP address of the GGSN. Since it can’t do that, it
forwards the request to the GRX, which forwards it to the home DNS. The IP
address of the home GGSN is identified and communicated to the v-SGSN,
which then sends the PDP request to the home GGSN, which assigns the IP and
the data transfer tunnel is created.

IMS network

In VoLTE calls, since the communication is sent in the network over IP

protocols, an IP Exchange network, similar to the GRX in GSM/GPRS networks,
is needed to ensure the communication channel. A Transit and Routing Function
directs and anchors the route of SIP signals over the IP exchange. The P-CSCF
adds the TRF address in the SIP Invite request sent to the I-CSCF of the home
network. The I-CSCF is the first contact point in the home network, and its
location is obtained using the DNS; the I-CSCF contacts the HSS to locate the S-
CSCF location and forward it the request.The S-CSCF sends the request to the
indicated TRF, which finds the destination operator and passes the invite to the
S-CSCF.

SMS

International roaming MO SMS involves the message being routed through the
home SMSC. The subscriber connects to the visited network and sends the SMS
to the vMSC. Via the international exchange, the SMS is sent to the SMSC
address which is configured in the MS. Using the destination address received
from the originating MS, the SMSC queries the HLR to find the current location
and network where the target MS is registered. After the SMS reaches the MSC,
it is sent to the radio network and the subscriber receives the message.