GSM Mobility Management

Rashmi Nigalye
Mouloud Rahmani
Aruna Vegesana
Garima Mittal

December 5, 2001

EL604: Wireless & Mobile Networking

1
 Outline

• GSM architecture overview

– Network layout
– Protocols
– Addresses & identifiers
• Handover management
– Talk and Move
• Location management
– Move only, without conversation
2
 GSM NETWORK LAYOUT

GSM Network (PLMN)

MSC region MSC region

Location area Location

BSC area
BSC
BTS BTS MSC region

3
GSM NETWORK LAYOUT
PLMN
INTERNATIONAL

ISC
OMC PSTN
ISDN

BSC
MSC GMSC
E
Abis
BTS BSC A B,C

HLR
EIR
BTS VLR
AUC
BTS Um
4
 Interfaces in GSM

MSC or
BSC HLR or
MS BTS MSC VLR

Radio A- interface
A-bis SS7 GSM MAP
interface

5
 GSM Protocol layers
(GSM has MAP just like IS41)

• To perform network control operations unique to personal

communications, GSM adds a Mobile Application Part
(MAP) to SS7.
• MAP makes use of the Transactions Capabilities Part
(TCAP) transport protocol.
• MAP functions:
– Updating of residence information in VLR
– Storage of routing information in HLR
– Updating and supplementing of user profiles in HLR
– Handoff of connections between MSCs

6
 What is a location area (LA)?

• A powered-on mobile is informed of an incoming call by a paging

message sent over the PAGCH channel of a cell
• One extreme is to page every cell in the network for each call, which
results in a waste of radio bandwidth
• Other extreme is to have a Mobile notify the system via location
updating messages of its current location at the individual cell level.
This requires paging messages to be sent to exactly one cell, but this is
wasteful due to the large number of location updating messages.
• Hence, in GSM, we group cells into Location Areas (Neighborhoods).

7
 Addresses and Identifiers
• International Mobile Station Equipment Identity
(IMEI)
- It is similar to a serial number. It is allocated by equipment
manufacturer, registered by network, and stored in EIR
• International Mobile Subscriber Identity (IMSI)
CC MNC MSIN
-CC: Country Code
-MNC: Mobile Network Code
-MSIN: Mobile Subscriber Identification Number (ID in home net.)
When subscribing for service with a network, subscriber receives (IMSI)
and stores it in the SIM (Subscriber Identity Module) card. The IMSI has
the unique subscriber id that identifies the HLR of the MS. It is never
made public
8
 Addresses and Identifiers
• Mobile Subscriber ISDN (MSISDN)
CC NDC SN
-NDC: National Destination Code, SN:Subscriber Number,CC:
Country Code
-The “real telephone number”, assigned to the SIM
-The SIM can have several MSISDN numbers for selection of
different services like voice, data, fax
• Mobile Station Roaming Number (MSRN)
CC NDC SN
-It is temporary location dependent ISDN number
-It is assigned by local VLR to each MS in its area. 9
 Addresses and Identifiers

• Location Area ID(LAI)

CC MNC LAC
- CC: Country Code, MNC:Mobile Network Code, LAC: Location Area Code
-LAI is broadcast regularly by Base Station on BCCH
-Each cell is identified uniquely as belonging to an LA by its LAI
• Temporary Mobile Subscriber Identity (TMSI)
-It is an alias of the IMSI and is used in its place for privacy.
-It is used to avoid sending IMSI on the radio path.
It is an temporary identity that is allocated to an MS by the VLR at inter-VLR
registration, and can be changed by the VLR
--TMSI is stored in MS SIM card and in VLR.
• MSCs and location registers (HLR,VLR) are addressed with
ISDN numbers. In addition, they may have a Signaling Point
Code (SPC) within a PLMN to address them uniquely in SS#7.
10
 TMSI vs IMSI vs MSRN vs MSISDN

• TMSI is used during location update and registration for find, paging and call routing.
Instead of using IMSI, the MS sends the TMSI to the BSS, which forwards it to the MSC.

• MSRN is the routing number that identifies the current location of the called MS.
• MSRN is temporary network identity assigned during the call establishment to a mobile
subscriber.
• MSRN is the address to the serving MSC/VLR.
• MSRN is used during call termination (Incoming call to the MS).

• MSISDN is dialed during call termination.

• MSISDN points to the subscribers records in the HLR that contains information to locate the
MSC where the subscriber is currently located.
• MSISDN is the telephone number.

• There is an association between IMSI and MSISDN in the HLR.

11
 Types of handover
(same as “handoff”)
• There are four different types of handover in the GSM
system. Handover involves transferring a call between:
– Channels (time slots) in the same cell
– Cells (Base Transceiver Stations) under the control of
the same Base Station Controller (BSC),
– Cells under the control of different BSCs, but belonging
to the same Mobile services Switching Center (MSC),
and
– Cells under the control of different MSCs.

12
 Attributes of radio-link handover
• Hard handover
• MAHO
• Backward
• Handover messages
• Channel allocation schemes

• COS selection scheme: static

• Cross-over switch: anchor switch

• Does GSM cross-over fit the generic scheme?

– Yes
–Circuit switching
•No buffering
13
 Handover (MAHO)
• Handovers are initiated by the BSS/MSC (as a means of
traffic load balancing).
• During its idle time slots, the mobile scans the Broadcast
Control Channel of up to 16 neighboring cells, and forms a
list of the six best candidates for possible handover, based
on the received signal strength.
• This information is passed to the BSC and MSC, at least
once per second, and is used by the handover algorithm.

14
 Integrated/Overlay Handover

• Integrated
– ISUP messages used for selecting inter-switch
channel

15
 Messages Exchanged in
Mobile Assisted Handover
Mobile Base Logical
station Station Channel
Conversation
Conversation TCH
TCH
MEASUREMENT REPORT
SACCH
Conversation
TCH
MEASUREMENT REPORT SACCH
Conversation
TCH
HANDOVER COMMAND
FACCH

16
 Cont’d
Mobile Station Base Station Logical Channel

HANDOVER ACCESS
New TCH
HANDOVER ACCESS
TCH
HANDOVER ACCESS
TCH
HANDOVER ACCESS
TCH
PHYSICAL INFORMATION
FACCH
HANDOVER COMPLETE
FACCH
Conversation
TCH
Conversation
TCH

17
 Handover procedures in GSM
8
Connection route

MSC-A MSC-B
MSC-C
1
6 8
BSC
4 3

BTS 1 BSC
BSC
BTS 2

2
BTS 3
BTS 3
5 7 18
 Inter MSC basic handover
MS/BSS 1 MSC-A MSC-B VLR-B
Handover required Perform Handover Allocate Handover number

Handover report
Radio chan. Ack
IAM MS/BSS 2
ACM
HA Indication HB Indication

HB Confirm
Send End Signal

ANS

End of Call REL

RLC
End Signal Handover report
19
 Subsequent handover from MSC-B to MSC-A
MS/BSS 1 MSC-A MSC-B MS/BSS 2

HA Required
Perform subsequent
Handover

Subseq. Handover
HB Indication
Acknowledge

HB Confirm
HA Indication
End Signal VLR-B
Handover report
End of Call REL

RLC

20
Subsequent handover from MSC-B to MSC-C
MSC-A MSC-B MS

Perform subsequent HA Request

Handover

MSC-C VLR-C

Perform Handover
Allocate Handover
Number

Send Handover report

Radio chan. Ack.

IAM

ACM
HB Indication
(Contd…)
21
 (…contd) Subsequent handover from MSC-B to MSC-C

MSC-A MSC-B MS

Perform subsequent
HA Indication
Acknowledge

MSC-C
HB Confirm
Send End Signal
ANS

MSC-B VLR-B
End Signal

Handoff Report
REL

RLC

22
 Location management

• Set of procedures to:

– track a mobile user
– find the mobile user to deliver it calls
• Current location of MS maintained by 2-
level hierarchical strategy with HLRs and
VLRs.

23
 MS BSS/MSC VLR HLR AUC

IMSI Ki
Loc.Upd.Req
Location registration
Upd Loc.Area
(IMSI,LAI) Aut.Par.Req
(IMSI,LAI)
(IMSI)
Authenticate Aut. Info.
Authentic. Req (IMSI,Kc,
(RAND)
(RAND) RAND,SRES) Auth.Info.Req

Ki RAND (IMSI)

SRES Auth.Info
A3 & A8
(IMSI,Kc,
Kc SRES
Auth.Resp. Auth.Resp RAND,SRES)
(SRES)
(SRES) Update
Location
(IMSI,MSRN)
Generate Contd...
TMSI 24
 (…contd) Location registration.

MS BSS/MSC VLR HLR AUC

Generate
TMSI

Start Ciph. Ins.Subsc.Data

(Kc) (IMSI)
Forw. New TMSI
Subs.Dat.Ins.Ack
(TMSI)
Ciph.Mod.Com. Loc.Upd.Accept
Kc Message M Loc.Upd.Accept (IMSI)
A5
Kc(M) Ciph.Mod.

Kc(M) Kc Kc(M)

A5
M
TMSI Realloc.Cmd.

Loc.Upd.Accept
TMSI Realloc.Ack
TMSI.Ack
25
 Location registration
• MS has to register with the PLMN to get communication services
• Registration is required for a change of PLMN
• MS has to report to current PLMN with its IMSI and receive new
TMSI by executing Location Registration process.
• The TMSI is stored in SIM, so that even after power on or off, there is
only normal Location Update.
• If the MS recognizes by reading the LAI broadcast on BCCH that it is
in new LA, it performs Location Update to update the HLR records.
• Location update procedure could also be performed periodically,
independent of the MS movement.
• The difference in Location Registration and Location Update is that in
location update the MS has already been assigned a TMSI.

26
MS BSS/MSC VLR HLR AUC

IMSI, TMSI
Location update
Ki, Kc, LAI
Loc.Upd.Req
Update Loc.Area
(TMSI,LAI)
(TMSI,LAI)

Authentication
Update Location
(IMSI,MSRN)

Generate
TMSI

Start ciphering Insert Subscriber. data

(Kc) IMSI
Subs. Data Insert Ack
Start ciphering. (contd..)

27
 (..contd) Location update.

MS BSS/MSC VLR HLR AUC

Start ciphering.

Forward new TMSI

(TMSI)
Loc. Upd. Acept
(IMSI)
Loc. Upd. Acept

TMSI Realloc. Cmd.

Auth. Para. Req
(IMSI)
Loc. Upd. Acept
Auth. Info.
Auth.Info.Req
(IMSI,Kc, RAND,SRES)
TMSI Reallocation TMSI Ack (IMSI)
Complete Auth.Info
(IMSI,Kc, RAND,SRES)
28
 Ways to obtain MSRN
1. Obtaining at location update– MSRN for the MS is
assigned at the time of each location update which is
stored in the HLR. This way the HLR is in a position to
supply immediately the routing info (MSRN) needed to
switch a call through to the local MSC.
2. Obtaining on a per call basis– This case requires that the
HLR has at least an identification for the currently
responsible VLR. When routing info is requested from
the HLR, it first has to obtain the MSRN from the VLR.
This MSRN is assigned on a per call basis, i.e. each call
involves a new MSRN assignment

29
 Call routing to a Mobile Station
1
MSISDN

GMSC ISDN
LA 1 4 1
MSRN

2
3
MSISDN
BSC MSRN MSC
BTS MSC HLR
7
TMSI

5
7
MSRN
TMSI
LA 2
BSC
EIR
BTS
8 7
TMSI TMSI
VLR
AUC
6
MS BTS
TMSI 30
 Call Origination

VLR
2
u1
3

PSTN MSC 1
4

PSTN
VLR MSC MS
1.call origination request
2. MAP_SEND_INFO_FOR_OUTGOING_CALL
3. MAP_SEND_INFO_FOR_OUTGOING_CALL_ack

4. IAM
31
 Call Termination
1 GMSC 5 4
PSTN
2 HLR 3 VLR

6
Target
MSC

Target
Originating MSC
Switch HLR VLR
GMSC
1. ISUP IAM
2. MAP_SEND_ROUTING_INFO
3. MAP_PROVIDE_ROAMING_NUMBER

4. MAP_PROVIDE_ROAMING_NUMBER_ack

5. MAP_SEND_ROUTING_INFO_ack
6. ISUP IAM 32
 Find Operation

• Inter-LA
– Both LA’s belong to same MSC, call/packets
will be routed directly
• Inter-MSC
• Inter-VLR

33
 Find operation in GSM
• ISDN switch recognizes from the MSISDN that the call
subscriber is a mobile subscriber. Therefore, forward the
call to the GMSC of the home PLMN (Public Land
Mobile Network)
• GMSC requests the current routing address (MSRN)
from the HLR using MAP
• By way of MSRN the call is forwarded to the local MSC
• Local MSC determines the TMSI of the MS (by
querying VLR) and initiates the paging procedure in the
relevant LA
• After MS responds to the page the connection can be
switched through.
34
 Location update for inter LA, inter VLR
MS BSS/MSC VLR new HLR VLR old

IMSI, TMSI
Ki, Kc, LAI
Loc.Upd.Req
Update Loc.Area
(TMSI,LAI) Send para. From VLR new
(TMSI,LAI) (TMSI, LAI)
IMSI response
(IMSI,RAND,SRES,Kc
Authentication
Update Location
(IMSI,MSRN)
Cancel Location
Generate (IMSI)
TMSI Cancel location ack
(IMSI)
Start ciphering Insert Subscriber. data
(Kc) IMSI
Forward new TMSI Subs. Data Insert Ack
(TMSI)
Location update accept
35
 VLR Overflow
• Too many mobile users move into the LA
in a short period
• If VLR is full when mobile arrives:
– User fails to “register” in the database
– It cannot receive cellular services
• VLR Overflow Resolutions

36
 Abbreviations
• ISC: International switching center
• OMC: Operations and maintenance center
• GMSC: Gateway switching center
• MSC: Mobile switching center
• VLR: Visitor location register
• HLR: Home Location register
• EIR: Equipment Identification register
• AUC: Authentication center
• BSC: Base station controller
• BTS: Base transceiver station
• MS: Mobile subscriber
• TMSI: Temporary Mobile Subscriber Identity
• IMSI: International Mobile Subscriber Identity

37
 Reference Material

• Wireless and Mobile Network Architectures by Yi-Bing Lin & Imrich

Chlamtac
• The GSM Sytem for Mobile communications by Mouly & Pautet
• Wireless Personal Communications Systems by Dr. Goodman
• GSM Switching, Services and Protocols by Jorg Eberspacher and
Hans-Jorg Vogel

38