Tanvir Ahmad NiaziTanvir.niazi@mail.au.edu.pk

Air University, Islamabad

Objectives

• Learning the basic procedures, the main call procedures, mobility and roaming features that GSM operates.

• After completing this lesson you will be able to:– List the GSM procedures that can be activated from MS

switch-on until MS switch-off– Explain the main procedures: cell selection, location

update, call set-up, call release, handover

2

Descriptors Stored in SIM-Card

3

Descriptors Stored in SIM-Card

• These descriptors are used in different phases of call setup:– International Mobile Subscriber Identity (IMSI) is the proprietary identifier of the mobile

subscriber within the GSM network and is permanently assigned to him; it consists of MCC, MNC and MSIN:• - Mobile Country Code (3 digits) is allocated to the operator country,• - Mobile Network Code (2 or 3 digits) is allocated to each operator,• - Mobile Subscriber Identification Number (8 digits) is allocated by the GSM network (HLR).

– GSM network can assign a Temporary Mobile Subscriber Identity (TMSI) to identify the mobile on a local basis (within VLR), allocated to visiting mobile subscribers and correlated with IMSI.

– Location Area Identity (LAI) defines a part of a MSC/VLR service area in which a MS can move freely without updating location; it consists of MCC, MNC and LAC.

– National Mobile Subscriber Identity (NMSI) consists of the MNC and the MSIN.

4

Descriptors Stored in the Network

5

Descriptors Stored in the Network

• The Mobile Subscriber ISDN Number (MS-ISDN) is the number that the calling party dials in order to reach the GSM subscriber. It is used by the land networks to route calls toward an appropriate GSM network. MSISDN is stored in HLR.

• The Mobile Subscriber Roaming Number (MSRN) is allocated on a temporary basis when the MS roams into another numbering area. Thus the MSRN shall have the same structure as international ISDN number in the area in which it is allocated. Visited MSC allocates a MSRN upon the VLR request which in turn was requested by the HLR. Upon reception of the MSRN, HLR sends it to the GMSC, which can now route the call to the MSC/VLR exchange where the called subscriber is currently registered.

• HO number is used for inter-MSC Handovers, to establish a circuit from the serving MSC to the new MSC.

6

Descriptor Embodied in the MS

7

Descriptor Embodied in the MS

• Stored inside the Mobile Equipment.• Used instead of IMSI or TMSI when both are unavailable (example:

Emergency calls without SIM card) or when required by the network (for maintenance).

• Can be used for EIR database updating (when it exists):– TAC = 6 digits describing the type of equipment.– FAC = 2 digits for identification of the factory.– SNR = 6 digits for the serial number of the device.

• IMEI may be temporary stored within MSC/VLR to minimize signaling within the Network.

8

Cell Selection

9

Cell Selection• MS scans the whole spectrum and stores the strongest level carriers

(30 in GSM 900, 40 otherwise).• MS tunes to the frequency correction channel (FCCH) of the strongest

carrier (BTS-1).• MS reads data from the synchronization channel (SCH).• MS reads data from broadcast channel (BCCH).• MS camps on this BCCH if it is suitable for the MS; otherwise it tries

selection on the next strongest beacon carrier.

10

Immediate Assignment

11

Immediate Assignment• The Immediate Assignment procedure is always initiated by the MS and may be triggered by a

Paging Request or by a Mobile Originating Service request.• Procedure• The MS sends a CHANNEL REQUEST message (RACH).• The BTS decodes this message and indicates it to BSC through CHANNEL REQUIRED message.• The BSC asks BTS to activate a dedicated channel: SDCCH or TCH (if no SDCCH available).• Acknowledgement by BTS• The BSC sends an IMMEDIATE ASSIGNMENT COMMAND message to the MS (via the BTS); the MS

has to seize the indicated dedicated channel including these values: initial Timing Advance and initial maximum transmission power.

• Then the MS can request a service on the dedicated channel through:– SERVICE REQUEST message including the access reason (call setup, paging etc.),– LOCATION UPDATING REQUEST message for location.

12

Registration: the Very First Location Update

13

Registration: the Very First Location Update

• Channel allocation (Connection request procedure):– the MS sends (on RACH) a CHANNEL REQUEST message,– the network responds with IMMEDIATE ASSIGNMENT (on dedicated channel).

• The MS sends to BSS a LOCATION UPDATING REQUEST message with IMSI.• The VLR triggers and monitors the Authentication procedure and can also

activate Ciphering procedure.• The VLR stores the LA of the MS and informs the HLR which:

– stores VLR identity,– downloads the subscriber profile, if the MS is allowed to roam.

• The VLR may assign a TMSI and sends it to the MS in the LOCATION UPDATING ACCEPT message.

• The MSC releases the connection.

14

Intra-VLR Location Update

15

Intra-VLR Location Update• Channel allocation (Connection request procedure).• The MS sends to the BSS a LOCATION UPDATING

REQUEST message (with TMSI and old LAI), relayed to the VLR through the MSC.

• The VLR stores the new Location Area Identity, then if required assigns a new TMSI and responds to the MS with LOCATION UPDATING ACCEPT message.

• The MSC releases the connection.

16

Inter-VLR Location Update

17

Inter-VLR Location Update• Channel allocation (connection request procedure).• The MS sends to BSS a LOCATION UPDATING REQUEST message, (with

TMSI + old LAI) relayed to the VLR through MSC.• The new VLR asks the old VLR for MS identity and ciphering items.• The old VLR backs new VLR IMSI, RAND, SRES, Kc.• The new VLR assigns a TMSI and sends it to the MS over a LOCATION

UPDATING ACCEPT message (with cipher mode if required).• The new VLR informs the HLR which sends subscriber data and asks

the old VLR to erase the previous MS data.• The MSC releases connection.

18

IMSI Attach

19

IMSI Attach• The IMSI attach procedure is used (if required by the network), to indicate the IMSI as

active in the network and is performed by using the Location updating procedure.• Procedure

– MS requests (on RACH) a dedicated channel with CHANNEL REQUEST message using a random number.

– BSS assigns a dedicated channel (on AGCH) with IMMEDIATE ASSIGNMENT message using this random number.

– MS sends (over this dedicated channel) a LOCATION UPDATING REQUEST message including its identity and the IMSI Attach cause.

– Authentication procedure (if required by the network).– MSC responds by sending a LOCATION UPDATING ACCEPT message.– In the VLR, a flag is set to indicate that the subscriber is active.

• This procedure is used only if the update status is updated and if the stored LAI is the same as the one which is actually broadcast on the BCCH of the current serving cell.

20

IMSI Detach

21

IMSI Detach• The IMSI detach procedure may be invoked by a MS:

– if the MS is switched off,– if the SIM card is detached.

• Procedure• MS requests (on RACH) a dedicated channel with CHANNEL REQUEST

message.• BSS assigns a dedicated channel (on AGCH) with IMMEDIATE

ASSIGNMENT message.• The MS sends IMSI DETach INDication message to the VLR.• The VLR sets a flag to indicate that this MS is no longer available; no

paging will be done to that MS until IMSI ATTach occurs.

22

Authentication

23

Authentication• Purpose: authentication of the subscriber, to prevent access of unregistered

users:– Authentication is performed by requiring from an algorithm A3 the correct answer

to a random number input.– Eavesdropping recording of signaling is inefficient since there is never twice the

same request.– A3 algorithm is operator-dependent.

• Principle• The NSS transmits a non-predictable number RAND to the MS.• The SIM card and the NSS compute the signature SRESm, using algorithm A3,

from the RAND and a secret key Ki.• The MS transmits its signature SRESm to the NSS.• The NSS tests the two SRES for validity.• Each time authentication A3 algorithm runs, concurrently A8 algorithm is used

to produce a ciphering key Kc.

24

Authentication

25

Authentication• Procedure

– The VLR sends a Map Send Parameters message to the HLR which relays this– message to the AUC.– The AUC then generates some RAND numbers and applies algorithms A3 and A8 to provide

the authenticated signature SRES and the cipher key Kc.– The AUC returns the triplets (RAND, SRES, Kc) to HLR which relays them to the VLR.– The VLR now sends a Map Authenticate message to the MSC which in turn sends to the MS

an AUTHENTICATION REQUEST message containing Rand; the Kc is also sent but stops at the BTS.

– The SIM-Card calculates the required response SRESm, using RAND, algorithm A3 and authentication key Ki.

– The MS returns SRESm to VLR in AUTHENTICATION RESPONSE.– VLR checks SRES = SRESm, then sends to the MSC a MM Service accept message; otherwise

VLR denies access: the MS will receive an AUTHENTICATION REQUEST.

26

Ciphering

27

Ciphering• Radio path ciphering, in particular ciphering of all subscriber information, aims to prevent third party

tapping (eavesdropping).• What is encrypted?:

– Signaling (Subscriber Id.).– Speech or data.

• The encryption of signaling and user speech or data, is performed at the MS as well as at the BTS (symmetric encryption) using the same Kc and the A5 algorithm.

• Each time a Mobile Station is authenticated, this MS and the Network also compute the ciphering key Kc (algorithm A8) with the same inputs RAND and Ki as for the SRES (algorithm A3). The Frame Number FN of the current TDMA frame (within a hyperframe) is another input for the A5 besides the Kc.

• The output of Encryption algorithm A5 is a ciphering sequence of 114 bits. Exclusive OR operation is applied between data to be ciphered and the ciphering sequence in order to produce either ciphered or deciphered data.

• Algorithm A5 is not operator dependent to achieve international roaming between any Mobile Station and BSS infrastructure whatever the operator.Two types of ciphering algorithms are available: A5/1 et A5/2, but only one ciphering algorithm A5 is supported at a time in a BTS.

• The BSC checks the availability of the A5 algorithms in the MS. If the BSS does not support the same ciphering algorithm as the MS, the calls will be unencrypted. The ciphering BSS capability is an O&M parameter defined for all the BTS of the BSC.

28

Ciphering

29

Ciphering• Ciphering is normally required for all user transactions over the RF link when the

subscriber has been authenticated by the system. It is worth noting that this is an optional feature and it is dependent of the operator.

• Procedure– Ciphering begins with the VLR sending the MSC a SET CIPHER MODE (MAP message)

containing the value of Kc.– The MSC sends the ciphering key to the BSS (actually the BTS) in a CIPHER MODE COMMAND

(BSSMAP message).– The BSS in turn sends an CIPHERING MODE COMMAND (RR message) to the MS.– The MS switches to encrypted transmission and reception, then sends back to BSS an

CIPHERING MODE COMPLETE (RR message).– After the BSS receives this message, it switches to encrypted transmission and reception for

subsequent burst.– The BSS then sends a CIPHER MODE COMPLETE (BSSMAP message) to the MSC.

30

Mobile Originating Call

31

Mobile Originating Call• The MS originates the call by sending a CHANNEL REQUEST message (on RACH).• Immediate assignment: channel allocation with TCH / FACCH or SDCCH.• The VLR launches authentication (if required) and completes ciphering.• The MS initiates call establishment by sending a SETUP message (called party number) to the MSC.• The MSC in turn checks mobile subscriber capabilities with VLR for desired service.• If it agrees, the MSC relays the called number over an ISUP Initial Address Message.• The MSC also sends a CALL PROCEEDING message to the MS (assigning TCH / FACCH EA in case of Early

Assignment).• Recipient PSTN switch rings the land telephone and returns an ISUP Address Complete Message to the

MSC.• Upon receiving this message, the MSC alerts the MS with an ALERTING message.• Called party goes off hook, thus PSTN sends to the MSC an ISUP ANswer Message. MSC then connects MS

(assigning a TCH in case of OACSU).• Call is accepted (CONNECT/CONNECT ACK) and the conversation starts.

In case of Emergency MO Call, the SETUP message (basic call) is replaced by the EMERGENCY one.

32

Mobile Terminating Call

33

Mobile Terminating Call• Main difference with MO Call procedure is the Paging of the Mobile Station.• When the MS is in Idle mode, the network do not knows the cell but only the Location

Area where the MS is located. Since RR sessions are only established at the initiative of the MS, the role of the Paging procedure is to trigger that operation.

Principle• Call from the fixed network (PSTN) is switched to the Gateway MSC (GMSC).• The GMSC reads in the HLR the identity of the MSC/VLR (or Visitor MSC) handling the

Location Area of the Mobile Station.• The GMSC routes the call to the VMSC.• The VMSC reads the LA where the MS is located, into its VLR.• The VMSC sends instructions to one or several BSC (BSC1 and BSC2) to page the MS in

the different cells of LA1.• BSC1 and BSC2 page the MS in the BTSs of the Location Area LA1. (BTS11, BTS12,

BTS21).

34

Mobile Terminating Call

35

Mobile Terminating CallProcedure• The caller subscriber access the ISDN by dialing the called MS-ISDN number.• Transmission of MS-ISDN number to GMSC through IAM (Initial Address Message).• Transmission of MS-ISDN number to HLR through SRI (Send Routing Information).• The HLR interrogates the VLR (Visitor MSC) that is currently serving the user.• The VLR returns a routing number (MSRN) to the HLR, which passes it back to the GMSC.• The MSRN is transmitted to GMSC (address of appropriate VMSC).• The GMSC calls VMSC through IAM (with MSRN).• The MSC asks VLR to establish where the called party is located.• The VLR gives location information (LA) to MSC with PAGE message.• The VMSC alerts with PAGING REQUEST message, all BSCs in charge of cells belonging to this LA.• All the BTS page the MS over PCH; depending upon the paging type message, up to four different

TMSI may be contained in the page command.

36

Mobile Terminating Call

• There are three types of PAGING REQUEST message:– Type 1: sent on the PCH to up two MSs, to trigger channel by

these; MSs are identified by their TMSI or IMSI.– Type 2: sent on the PCH to two or three MS; two of the MS are

identified by their TMSI while the third is identified either by its IMSI or its TMSI.

– Type 3: sent on the PCH to four MS which are identified by their TMSIs.

37

Mobile Terminating Call

38

Mobile Terminating CallProcedure• PSTN sends an IAM (with the MSISDN) to the GMSC.• GMSC sends an IAM (with the MSRN) to the VMSC.• The VMSC sends a PAGING REQUEST MM message to the BSS.• The BSS sends a PAGING REQUEST (with IMSI or TMSI) to the MS.• The MS must request a channel (CHANNEL REQUEST message with paging cause) over

the RACH, within 0.5 second.• The BSS complies and assigns (on AGCH) a dedicated channel to the MS with

IMMEDIATE ASSIGNMENT message.• The MS sends a PAGING RESPONSE to the VMSC via the BSS.• Authentication and Ciphering procedures (if required).• Setup, Assignment, Alerting procedures (see MS Originating Call).• Alerting is sent to PSTN with an ACM (ISUP message).• CONNECT and ANM messages are sent to the PSTN: call is completed.

39

Call Release

40

Call Release• Call release can be initiated by either the PSTN user or the mobile user. BSC is responsible for BSS

resources, MSC is responsible for NSS and PSTN connection.Procedure• Call is currently in progress.• The MS initiates the release of a call by sending a DISCONNECT message to the MSC.• The MSC returns to the MS a RELEASE message.• The MS acknowledges with a RELEASE COMPLETE message.• The MSC can send the Release message to the PSTN without waiting for the RELEASE COMPLETE

MM message from the MS.• The BSC requests the MS to return to Idle mode with CHANNEL RELEASE message.• The BTS informs the BSC with RELEASE INDICATION that signaling link is disconnected.• BSC requests BTS to de-activate RF Channel (TCH): Channel Release.• The PSTN informs the land terminal with appropriate tone.• Abnormal termination is monitored by a set of timers (operator configurable) to ensure resources

are not unused/unavailable.

41

Call Release

42

Call ReleaseProcedure• The call is in progress.• The release process starts with an ISUP Release message from the

land network.• Upon receiving this message, the MSC initiates the release of the call

by sending a DISCONNECT message to the MS.• MS replies by sending a RELEASE CHANNEL message to the MSC.• MSC in turn, backs to the MS a RELEASE COMPLETE message and

sends to the PSTN a Release Complete message.

43

Reasons for Handover

44

Reasons for Handover

Decision criteria• Bad quality.• Weak signal strength.• Cell boundaries (Distance).• Power budget (optimization).• Traffic constraints.

45

Mobility and Handover

46

Mobility and Handover1. Intra-Cell Handover: the MS is handed over to another channel on the

same cell, under the same BTS.2. Intra-BTS Handover: the MS is handed over to another channel on a

different cell, under the control of the same BTS.3. Intra-BSC Handover: the MS is handed over to another channel on a

different cell, under the control of a different BTS of the same BSC.4. Inter-BSC Handover: the MS is handed over to another channel on a

different cell, under the control of a different BSC of the same MSC.5. Inter-MSC Handover: the MS is handed over to another channel on

different cell, under another MSC of the same PLMN.

47

Handover Preparation

48

Handover Preparation• To avoid losing a call in progress, when the Mobile Station leaves the

radio coverage of the cell in charge.• Procedure: Three steps:

– Handover decision (based on measurements results).– Choice of the target cell.– Handover execution.

• Handover topology– Intra BTS (intra and inter cell).– Inter BSC.– Inter MSC including (subsequent).– Microcellular environment.

49

Handover Decision

50

Handover Decision

• Handover is initiated by the network based on radio subsystem criteria (RF level, quality, distance) as well as network directed criteria (current traffic loading per cell, maintenance requests, etc.).

• In order to determine if a handover is required, due to RF criteria, the MS shall take radio measurements from neighboring cells; these measurements are reported to the serving cell on a regular basis.

51

Handover Execution

52

Intra-BSC Handover

53

Intra-BSC Handover1- The BTS1 triggers HandOver by sending a HandOver INDICATION message to the BSC.2- The BSC allocates if available a new channel from the BTS2.3- The BTS2 establishes this channel, and responds to the BSC.4/5- The BSC sends a HandOver COMMAND to the MS (on the FACCH) via the BTS1,

assigning a new channel, its characteristics, the power level to use, the frequency hopping set, the Timing Advance TA if possible, and whether to use synchronous or asynchronous HO.

6a- In synchronous mode, MS sends to the BTS2 in successive multiframe slots (on the FACCH) four HandOver ACCESS messages. It then activates the new channel in both directions.

6b- In asynchronous mode, MS starts sending to the BTS2 a continuous stream of HandOver ACCESS messages, by sending access bursts on TCH until it receives the TA to apply.

8- In asynchronous mode, MS receives the TA.10/11- In both cases, MS replies with a HandOver COMPLETE message to the BSC over the

new FACCH.13/14- BSC in turn directs BTS1 to release the previous channel by sending a RF CHANNEL

RELEASE message with ACKnowledgment from the BTS1.

54

Inter-BSC Handover

55

Inter-BSC Handover• A communication is established between the mobile subscriber and

another user. The Mobile Station moves towards another cell (BTS1 to BTS2). The MSC controls the call, the mobility management and the radio resources, before, during and after the HO.

1- The BTS1 triggers HO by sending a HandOver INDICATION message to the BSC1.

2/3- The BSC1 makes a channel allocation request to the BSC2, via the MSC; HANDOVER REQUIRED shall contain a list of cells, or a single cell, to which the MS can be handed over.

4/6- The BSC2 allocates a channel if available, and responds to the MSC.

7/9- The MSC requests the MS (via BSC1 and BTS1) to connect to the BTS2.

56

Inter-BSC Handover10- The MS requests a radio resource to BTS2: HO ACCESS.11/12- The BTS2 informs the MSC that it accept the handover.13- The BTS2 establishes the connection with the MS.14- The BTS2 orders the BSC2 that the radio link with the MS is

established.15- The MSC switches the call to the MS, (via BSC2 and BTS2) and the MS

acknowledges with HO COMPLETE.16/17- The BTS2 (via BSC2) informs the MSC that the connection is successful.18- The MSC informs the BSC1 to release radio resource with BTS1:

CLEAR COMMAND.19/21- The BSC1 releases BTS1 radio resource: RF CHANNEL RELEASE.

57

Inter-MSC Handover

58

Inter-MSC Handover• A communication is established between the mobile subscriber and another user.

– The Mobile Station moves towards another cell (BTS 2b to BTS 3a).– The BTS 2b sends an HANDOVER INDICATION to BSC2 which informs MSC1.– The MSC1 sends a Transfer Request to MSC2.– The MSC2 requests the BSC3 to allocate a traffic channel (TCH).– The MSC2 informs the MSC1 that the channel has been successfully allocated.– The MSC1 requests the BSC2 to hand over the call.– The BSC2 requests the MS, via BTS 2b, to connect via BSC3 to BTS 3a.– The MS establishes a connection with BTS 3a via BSC3.– The BSC3 informs the MSC2 that the connection is successful.– The MSC1 is informed too, via MSC2.– The MSC1 switches the call to MSC2.– The MSC2 routes the call to the MS, via BSC3 and BTS 3a.– The MSC1 releases BSC2 radio resources.

59

Exercise• Cite the GSM procedures successively involved in the following

situations (the IMSI Attach/Detach function is enabled).• Indicate the radio channels types used in every procedure.1. Switch-on the MS and move in Idle mode from one LA to an other one.2. Establish a call and move in communication from one cell to an other.3. MS in Idle mode. Reception of a Short Message.4. Switch-off the MS.

60