CALL & MOBILITY MANAGEMENT

Call And Mobility Management RF channel overview & Modes of Mobile Station. MS Initialization ( Network Attachment ) Mobility Management and MM Procedures Authentication & Location Updating Procedure Connection Management (CM) Call Processing – MO & MT Calls

Modes Mobile Station ( MS ) MS Switched Off - can not receive incoming paging messages. - can not make outgoing call. - No dedicated channel is associated with it. MS Switched On - can receive incoming paging messages. And in Idle Mode - can make outgoing call. - No dedicated channel is associated with it. MS in Dedicated Mode -MS is in conversation and a dedicated traffic channel TCH is associated with it.

RF Channels Overview Broadcast Control Channels - BCCH P-MP FCCH SCH Common Control Channels PCH P-P RACH AGCH Dedicated Control Channels - SDCCH P-P FACCH SACCH

FCCH Burst Normal Burst CC SMS SS CM CC SMS SS CM 3 T 8.25 GP 142 Fixed Bits 3 T CM FCCH Burst 3 T 57 Encrypted 8.25 GP CC 57 Encrypted SMS SS 1S 26 Training 1 S 3 T CM Normal Burst

Possible Channel Combinations On RT in One Cell Timeslots 1 2 3 4 5 6 7 RT 0 BCCH SDCCH CCCH TCH CCCH TCH CCCH TCH RT 1 TCH TCH TCH TCH TCH TCH TCH TCH RT 2 SDCCH TCH TCH TCH TCH TCH TCH TCH CC SMS SS RT 3 TCH TCH TCH TCH TCH TCH TCH TCH CM

Channel Combination IV :main BCCH ( GSM 05.01) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 . . . 49 50 FCCH FCCH SCH SCH IDLE BCCH CCCH BCCH Down-link RACH RACH RACH Up-link . . . CC SMS SS CM Channel Combination IV :main BCCH ( GSM 05.01)

Technical Terms Used w.r.t. MM (Mobility Management ) IMSI – International Mobile Subscriber Identity IMSISDN – Mobile Subscriber ISDN number IMEI – International Mobile Equipment Identity TMSI – Temporary Mobile Subscriber Identity MSRN – Mobile Subscriber Roaming Number LAI – Location Area Identity A3 – Authentication Algorithm A5 – Ciphering Algorithm A8 – Kc Generation Algorithm

Location Related Identities 1. MSRN – Mobile Subscriber Roaming Number It is a temporary number used for routing the call to MS. Format : MSRN = CC + NDC + SN CC = Country Code NDC = Network Destination Code SN = Subscriber Number For example for Patna MSC in IMPCS network MSRN looks like 91 98750 00100.

Location Related Identities MSRN MSISDN MSISDN PSTN 2 GMSC 1 HLR MSRN 6 MSRN IMSI MSRN 7 3 5 VLR MSC IMSI 4 MSRN

Location Related Identities 2. Location Area Identity (LAI ) - Each location area in a GSM PLMN is identified by a Location Area Identity ( LAI ). Location area consist of one or more than one cell which may be served by one or more BSC s. All the cells in a Location area are served by single VLR.

Location Area MSC 1 SS 7 HLR MSC 2 BSC LA 1 BSC VLR 1 LA 2 BSC LA 3 BTS MSC 1 BSC LA 1 BTS BSC BTS VLR 1 LA 2 SS 7 BTS HLR BSC MSC 2 BTS LA 3 BTS BSC VLR 2 Location Area

Location Related Identities 2 digits 2 octets max 3 digits ( 16 bits ) MCC MNC LAC LAI LAI = MCC + MNC + LAC MCC - Mobile Country Code. MNC - Mobile Network Code. LAC - Location Area Code . Maximum length of LAC is 16 bits. Thus there can be maximum of 65,536 Location Areas defined in one GSM PLMN.

MS Initialization / Network Attachment 1. MS Powered on. 2. Frequency Synchronization - MS scans entire 124 carriers and monitors RF levels. - several readings are taken to get accurate estimate the channel power. - MS then searches for Frequency Correction burst (FCCH) on the channel with strongest RF level. - FCCH present in time slot T0 & has a fixed pattern of 142 0’s. - After tuning to FCCH MS synchronizes in time with SCH .

MS Initialization / Network Attachment 3. Synchronization in Time - SCH occurs in next frame in same time slot as FCCH. - The occurrence of SCH is eight burst period ( BP’s ) later than FCCH. - SCH contains precise timing information and current frame number to which MS is synchronized. - After successful synchronization the MS will read the TDMA frame number and Base Station Identity Code BSIC . - BSIC consists of - PLMN colour code ( 3 bits ) - BS colour code ( 3 bits ).

MS Initialization / Network Attachment MS location is determined by cell identification of strongest BCCH signal received by MS. MS regularly measures the received signal strength of BCCH at least once every 6 sec ( Superframe Duration). MS stores at least six strongest BCCH and their cell identification in SIM. MS decodes information on BCCH and gets Location Area Identity ( LAI ). If the information stored on SIM does not match with the information MS thinks that it has moved to new location and sends LA update request to BSS.

Network Attachment Process Switch -on MS Measure strongest BCCH channels PLMN Selection Limited Service Mode . Cell should be of selected PLMN. Cell Selection . Cell should not be “ barred “. . Radio path loss between BTS and the MS must be below a threshold set by the operator. Location Update ( Register its presence to the network. ) Idle-Mode

GSM Signaling Protocols Overview BTS BSC MSC DTAP CM RIL3 - CM M RIL3 - MM DTAP MM A I P S RIL 3-RR RIL3 - RR BSSMAP BSSMAP TCAP U RR BTSM BTSM SCCP SCCP SCCP P LAPD m MTP LAPD m LAPD LAPD MTP Layer 1 Layer 1 Layer 1 Layer 1 Um A bis A link BCDEFG GSM Signaling Protocols Overview

What is Mobility Management ( MM ) ? Subscriber Data management at MSC/VLR Subscriber data from HLR are retrieved by MM at the time of first location up-dating of a subscriber. Dynamic data changes by subscriber are also managed by MM at MSC/VLR. Operator initiated data changes for a subscriber are also managed by MM. Services Provided to Upper Layers MM sub-layer provides basic services to upper layer CM sub-layer. MM handover procedures provide smooth transition from one radio link to other.

What is Mobility Management ( MM ) ? Subscriber Authentication and Confidentiality management MM procedures ensure authenticity of a subscriber. MM procedures ensure data confidentiality at radio interface.

MM Procedures MM Common Procedures : TMSI Reallocation Procedure. Authentication Procedure. Identification Procedure. IMSI Detach Procedure. Ciphering Procedure. Abort Procedure. MM Specific Procedures : Location Updating Procedure. IMSI Attach Procedure.

MM Procedures A MM specific procedure can only be started if no other MM specific procedure is running. During the lifetime of a MM specific procedure if a MM connection establishment is requested by a CM entity, the request will either be rejected or delayed until the running of MM specific procedure is terminated. Any MM common procedure Procedure ( except IMSI detach) may be initiated during MM specific procedure. The MS side should wait for release of RR connection used for a MM specific procedure before a new MM specific procedure or MM connection establishment is started.

Authentication is used to check the validity of a mobile subscriber. At MS At N/W Ki Ki RAND( 128 bits ) A3 A3 SRES SRES ( 32 bits ) =? AUTHENTICATION

Ki ( 128 bits) : Identification Key - Purpose : Ki is used to calculate SRES and Kc. - Ki is stored in SIM and HLR. - Ki is never transmitted over signaling network. RAND ( 128 bits ):Random Number - Purpose : RAND is used to calculate SRES and Kc. Kc ( 64 bits ) : Ciphering Key - Purpose : Kc is used to encrypt data over radio interface. SRES ( 32 bits) :Signed Response

Ciphering is used to encrypt data on radio interface. RAND Ki Kc generation is done at the time of Authentication. A8 Frame No. (22 bits ) Kc ( 64 bits) A5 Ciphering Stream Ciphered Bits XOR Information Bits ( 114 bits ) CIPHERING

AUTHENTICATION PROCEDURE Authentication procedure is always initiated and controlled by the n/w. The purpose of authentication procedure is two fold : . To check identity provided by the MS. . To supply n/w parameters to MS to calculate Kc. Authentication Request TIME Authentication Response Authentication Reject MS N/W AUTHENTICATION PROCEDURE

Authentication Procedure Authentication Triplets : - At n/w side, authentication procedure requires authentication triplets. - Authentication triplets contains -RAND ( 128 bits ). - SRES ( 32 bits ). - Kc ( 64 bits ). - The network can have more than one triplets. - The operator can allow reuse of triplets. - The index of currently used triplet is called CKSN ( Ciphering Key Sequence Number ).

This is a general procedure which is used for following purposes - Location Updating Procedure This is a general procedure which is used for following purposes - Normal Location Updating - MS moves to new LA. Periodic Location Updating - To notify periodic availability of MS to the network. IMSI Attach - MS switched on for first time in new LA or MS switched off and on.

Location Update Scenario Each time MS moves to new LA corresponding VLR is informed. Case - I Old LA and new LA in same VLR area MS given new TMSI . Location updated in VLR memory. Case - II Old LA and new LA in different VLR area HLR updates. old VLR erases data. new VLR records relevant parameters. MS is given new TMSI.

Location Update Scenario Phases of Location Update Scenario Request for service. Authentication Ciphering HLR/ VLR updation TMSI reallocation.

LOCATION UPDATE SCENARIO - I Request For Service Old MSC/ VLR New MSC/ VLR HLR /AUC MS BSS Channel Request 1 RACH SDCCH Assignment 2 AGCH Location Update Request ( TMSI , LAI 0 ) 3 SDCCH Request IMSI ( TMSI ) 4 Send IMSI

LOCATION UPDATE SCENARIO - II Authentication and Ciphering New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS 5 Get Authentication Parameters ( IMSI ) Authentication Parameters Authenticate MS ( RAND ) ( RAND,Kc,SRES ) SDCCH 6 Authentication Response ( SRES ) SDCCH Cipher Radio Channel 7 ( Kc ) Cipher Up Link Channel SDCCH

LOCATION UPDATE SCENARIO - III Authentication and Ciphering New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Up Link Ciphered 8 SDCCH BSS Ciphers Down link Channel . 9 Ciphering Complete

LOCATION UPDATE SCENARIO - IV Update HLR/VLR & TMSI Reallocation New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Update Location 10 De Register Mobile 11 Mobile De-registered 12 Location Updated Location Updated Accept TMSI 13 SDCCH

LOCATION UPDATE SCENARIO - V Update HLR/VLR & TMSI Reallocation New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Location Updated Complete 14 SDCCH Clear Signaling Connection 15 Clear Complete 16 Release Radio Signaling Channel SDCCH

ND Mobile moves to CA and Powers on MS LOCATION UPDATION Listens BCCH/FCCH ND Mobile moves to CA and Powers on MS Update Location HLR GMSC MSC Location Update TAX CA ND CA ( TMSI, LAI ) LU Accept MS LU Accept VLR Update Location ( New TMSI) 9810098111 New VLR records subscriber data. CA VPLMN LU Accept HLR HPLMN ND LU Accept ( Update Location/ Authentication ) GMSC MSC/VLR TAX ND ND LU Accept (Subs data) Update Location ACK from old MSC/VLR VLR De register Mobile to Old VLR

SETUP PHASE RINGING PHASE CONVERSATION PHASE RELEASE PHASE Mobile To Land Call Set-up Scenario Phases of Mobile To Land Call ( Mobile Originated Call- MO Call ) SETUP PHASE RINGING PHASE CONVERSATION PHASE RELEASE PHASE

SETUP PHASE Mobile To Land Call Set-up Scenario - REQUEST FOR SERVICE ( CHANNEL ) BY MS - CM SERVICE REQUEST - AUTHENTICATION - CIPHERING - EQUIPMENT VALIDATION ( EIR CHECK ) - SETUP MESSAGE - VALIDATION AT VLR - ASSIGNMENT

MOBILE TO LAND CALL - I Request For Service MSC/VLR BSS MS Channel Request 1 RACH SDCCH Assignment 2 AGCH CM Service Request 3 SDCCH CM Service Accept 4

Mobile To Land Call Set-up Scenario CM SERVICE REQUEST - The Call Control (CC) entity of MS initiates the establishment of CC connection by requesting MM sub-layer of the mobile to establish MM sub-layer connection. - Upon establishment of MM connection CM SERVICE ACCEPT message is received from n/w. SETUP MESSAGE - CC entity sends a setup message to its peer entity.

MOBILE TO LAND CALL - II Call Setup MSC/VLR BSS MS Call Setup Request 5 SDCCH Call Proceeding 6 SDCCH Assign Trunk and radio Assign TCH 7 SDCCH Radio Assignment Complete SDCCH Trunk and Radio Assignment Complete

Mobile To Land Call Set-up Scenario Call Setup message MSC/VLR Release Complete message to MS Is the requested basic service provisioned for the subscriber ? No Yes Release Complete message to MS Preliminary Digit Analysis Yes Is the number of digits less than the minimum expected? 1. Check of ODB( BAOC/BOIC/ BOIC Ex HC ) No 2. Subscriber call barring checks ( BAOC/BOIC etc. ) ASSIGNM ENT

Mobile To Land Call Set-up Scenario ASSIGNMENT - A BSSMAP message ‘Assignment Command ’ is sent by MSC to BSS. - The message contains a free CIC on A-Interface for terrestrial channel allocated by MSC. - A free TCH is allocated by the BSS and MS is informed to attach to this TCH. - On receiving a response from BSS MSC switches the speech path towards the calling MS. Note : Mobile has not connected user connection as yet.

MOBILE TO LAND CALL - III Call Setup MSC/VLR GMSC BSS HLR PSTN MS Network Setup ( Dialed Digits ) 8 Network Alerting Alerting 9 FACCH Connect Start Billing 10 Connect FACCH Connect Acknowledge 11 FACCH

MOBILE TO LAND CALL - IV Call Release MSC/VLR GMSC BSS HLR PSTN MS Disconnect 12 Network Release Release 13 FACCH Release Complete 14 FACCH Clear Command 15 Channel Release FACCH Release Complete

Land To Mobile Call Set-up Scenario Phases of Land To Mobile Call ( Mobile Terminating - MT Call ) Routing Analysis Paging Authentication Ciphering Call-Setup Call Release

Architecture For Mobile Terminated Call VISITING PLMN A- Interface MSC-B IAM ( ISUP ) BSS-B GMSC- B Air Interface VLR-B ACK ( MSRN ) SRI ( MSISDN ) PRN ACK ( MSRN ) MS HLR-B

Routing Analysis LAND TO MOBILE CALL - I HLR MSC/VLR GMSC PSTN Incoming Call 1 ( MSISDN ) Get Route 2 Get Route ( MSISDN ) 3 ( IMSI ) Routing Information 4 ( MSRN ) Routing Information ( MSRN ) Incoming Call 5 ( MSRN )

Paging LAND TO MOBILE CALL - II BSS MS MSC (TMSI) PCH ( RACH ) Perform Page Page (TMSI) 6 PCH Channel Request 7 ( RACH ) 8 Access Granted ( AGCH ) Paging Response ( TMSI, LAI ) 9 SDCCH Page Response

LAND TO MOBILE CALL - III Call Set-up BSS MSC MS Call Set Up 10 SDCCH Call Set Up Confirm 11 SDCCH Assign Trunk & Radio Channel Assign Radio Channel 12 SDCCH Radio Channel Assigned SDCCH Trunk and Radio Channel Assignment Complete

LAND TO MOBILE CALL - IV Call Setup MSC/VLR GMSC BSS HLR PSTN MS Mobile Alerting 13 FACCH Network Alerting Connect ( off-hook ) 14 FACCH Start Billing Connect Connect Acknowledge 15

LAND TO MOBILE CALL - V Call Release MSC/VLR GMSC BSS HLR PSTN MS Network Release Disconnect 16 Stop Billing FACCH Release 17 Release Complete FACCH Release Complete 18 FACCH Clear Command 19 Clear Channel Clear Complete FACCH

1. ND PSTN Subscriber Dials ND Mobile Subscriber in ND. Page(TMSI) ND HLR MS GMSC MSC/VLR SRI 9810098100 ND TAX ND MSRN ND MSISDN PRN to MSC/VLR ND MSISDN ACK from MSC/VLR ND (MSRN) MSISDN TANDEM LE

2. ND PSTN Subscriber Dials CA Mobile Subscriber in CA. TANDEM HLR MSISDN MSISDN GMSC MSC/VLR TAX ND LE ND ND MSISDN CA HLR MSISDN SRI GMSC MSC/VLR TAX CA MSRN CA CA PRN to MSC/VLR CA ACK from MSC/VLR CA (MSRN) Page(TMSI) MS 9881098300

3. ND PSTN Subscriber Dials ND Mobile Subscriber in CA. HLR GMSC MSC/VLR ND TAX CA MS MSRN CA CA 9810098200 Page(TMSI) MSRN HLR MSRN SRI GMSC MSC/VLR ND TAX ND MSRN ND MSISDN PRN to MSC/VLR CA ACK from MSC/VLR CA (MSRN) MSISDN MSISDN TANDEM LE

4. CA PSTN Subscriber Dials ND Mobile Subscriber in CA. TANDEM HLR MSISDN MSISDN GMSC MSC/VLR TAX CA LE CA 9810098400 MSRN ND Page(TMSI) CA MSISDN MS MSRN ND HLR MSRN SRI GMSC MSC/VLR TAX ND MSRN ND MSISDN PRN to MSC/VLR CA ACK from MSC/VLR CA (MSRN)

THANKS !