Gsm Traffic Management

SYSTEM TRAINING

GSM Traffic Management Training Document

6-66866 v 2.0

© Nokia Oyj

1 (60)

GSM Traffic Management

The information in this document is subject to change without notice and describes only the product defined in the introduction of this documentation. This document is intended for the use of Nokia Networks' customers only for the purposes of the agreement under which the document is submitted, and no part of it may be reproduced or transmitted in any form or means without the prior written permission of Nokia Networks. The document has been prepared to be used by professional and properly trained personnel, and the customer assumes full responsibility when using it. Nokia Networks welcomes customer comments as part of the process of continuous development and improvement of the documentation.

The information or statements given in this document concerning the suitability, capacity, or performance of the mentioned hardware or software products cannot be considered binding but shall be defined in the agreement made between Nokia Networks and the customer. However, Nokia Networks has made all reasonable efforts to ensure that the instructions contained in the document are adequate and free of material errors and omissions. Nokia Networks will, if necessary, explain issues which may not be covered by the document.

Nokia Networks' liability for any errors in the document is limited to the documentary correction of errors. Nokia Networks WILL NOT BE RESPONSIBLE IN ANY EVENT FOR ERRORS IN THIS DOCUMENT OR FOR ANY DAMAGES, INCIDENTAL OR CONSEQUENTIAL (INCLUDING MONETARY LOSSES), that might arise from the use of this document or the information in it.

This document and the product it describes are considered protected by copyright according to the applicable laws.

NOKIA logo is a registered trademark of Nokia Corporation.

Other product names mentioned in this document may be trademarks of their respective companies, and they are mentioned for identification purposes only.

Copyright © Nokia Oyj 2003. All rights reserved.

2 (60) © Nokia Oyj

6-66866v 2.0

Contents

Contents

1 Module objectives ..................................................................................5

2 Introduction ............................................................................................6

3 Locating a subscriber ............................................................................7 3.1 Registration and database .......................................................................7 3.2 Location update – first time ......................................................................8

4 Call set-up in a GSM network..............................................................11 4.1 PSTN originated – Mobile terminated call set-up ...................................11 4.1.1 Locating and paging the subscriber .......................................................17 4.1.2 PSTN originated – Mobile terminated call set-up process .....................19 4.2 Mobile originated call..............................................................................20

5 Location update....................................................................................22 5.1 Types of location update ........................................................................22 5.2 Procedures.............................................................................................24

6 Handover...............................................................................................26 6.1 Intra cell − Intra-BSC handover ..............................................................26 6.2 Inter-cell − Intra-BSC handover..............................................................27 6.3 Inter-cell − Inter-BSC handover..............................................................28 6.4 Inter-MSC handover ...............................................................................28

7 Charging ...............................................................................................31 7.1 What to charge?.....................................................................................31 7.2 Subscription charge................................................................................31 7.3 Renting of service...................................................................................31 7.4 Charge for using the network .................................................................32 7.5 Whom to charge?...................................................................................33 7.6 Charging procedure in GSM...................................................................34 7.6.1 Distributed charging ...............................................................................36

8 Security in the GSM network...............................................................38 8.1 Authentication principle ..........................................................................38 8.2 Security algorithms.................................................................................39 8.3 Ciphering / speech encryption................................................................42 8.4 User confidentiality .................................................................................43

9 Services ................................................................................................44 9.1 What are services?.................................................................................44 9.2 Classification of services ........................................................................44 9.3 Teleservices ...........................................................................................46 9.3.1 Speech (telephony) and emergency calls ..............................................46

6-66866 v 2.0

© Nokia Oyj

3 (60)


9.3.2 Short Message Services: Mobile Originated, Mobile Terminated and Cell Broadcast ................................................................................ 47

9.3.3 Facsimile transmission (T61 and T62) .................................................. 53 9.4 Bearer services...................................................................................... 54 9.5 Supplementary services ........................................................................ 56

10 Review questions ................................................................................ 57

4 (60) © Nokia Oyj

6-66866v 2.0

Module objectives

1 Module objectives After completing this module, the participant should be able to:

• Explain the mobility concept (handover, location update, paging)

• List the three numbers in the authentication triplet and the use for each of them

• List at least four teleservices

• List and explain the operation of at least four supplementary services offered by GSM networks

without using any references.

6-66866 v 2.0

© Nokia Oyj

5 (60)


2 Introduction In this module we will take the GSM network into use. First we will cover what happens the first time a mobile subscriber switches on the mobile station. Then we will see what happens when the user receives and makes phone calls.

It is also important to understand how we can manage the fact that subscribers are constantly on the move. Therefore we will discuss the meaning of the terms location update, paging, and handovers.

Security and charging are two very important areas for both subscribers and operators. These topics are the two last ones in this module.

6 (60) © Nokia Oyj

6-66866v 2.0

Locating a subscriber

3 Locating a subscriber

3.1 Registration and database

A new subscriber has just bought a mobile telephone and he switches it on for the first time. He can be almost anywhere in the world since he connects to the network over a wireless radio link.

BTS

Figure 1. Mobile phone user

On the other hand, a connection through the mobile network is possible only if there is a point-to-point connection between the caller and the person who is called. Therefore, it is absolutely necessary that the network knows the subscriber’s location. The network keeps track of the subscribers’ location with the help of various databases, more precisely the SIM, the VLR, and the HLR.

Now, the new subscriber switches on his phone in an area where a local operator provides network service. The area is connected through an air interface to the Visitor Location Register (VLR), which is integrated into the Mobile services Switching Centre (MSC).

The home operator of the subscriber also needs to know the location of the subscriber. Therefore it maintains another register – the Home Location Register (HLR).

6-66866 v 2.0

© Nokia Oyj

7 (60)


VLRMSC

GSM network

SIM

HLR

Figure 2. Subscriber information databases in the GSM network

As mentioned earlier, the HLR stores the basic data of the subscriber on a permanent basis. The only variable information in the HLR is the current location of the subscriber (the VLR address). The VLR address is needed, because the HLR needs to know from what MSC/VLR to ask for routing information in case of a mobile terminated call (a call to the mobile station).

When the subscriber moves to another VLR area, its data is erased from the old VLR and stored in the new VLR.

3.2 Location update – first time

As an owner of a mobile phone, the subscriber does not stay in one place, but keeps moving from one place to another. No matter how often or how fast he moves, the network must be able to locate him continuously in case somebody wants to call him. The transaction that enables the network to keep track of the subscriber is called a location update.

The mobile phone constantly receives information sent by the network. This information includes identification (ID) of the VLR area in which the mobile is currently located. In order to keep track of its location, the mobile stores the ID of the area in which it is currently registered. Every time the network broadcasts the ID of the area, the mobile compares this information to the area ID stored in its memory. When the two IDs are no longer the same, the mobile sends the network a request, that is, a registration inquiry to the area it has just entered. The network receives the request and registers the mobile in the new VLR area. Simultaneously, the subscriber's HLR is informed about the new VLR location and the data concerning the subscriber is cleared from the previous VLR.

8 (60) © Nokia Oyj

6-66866v 2.0

Locating a subscriber

VLR

MSC(old)

VLRMSC(new)

HLR

SIM

LocationUpdate

Mobile moves

Figure 3. Elements involved in location update

The following figure briefly describes the types of messages that are exchanged the very first time a subscriber makes a location update, that is, the first time the mobile station (MS) is switched on with the SIM card inserted. A similar exchange of messages takes place when a subscriber switches on the MS for the first time when roaming in another GSM network than the home PLMN (Public Land Mobile Network).

6-66866 v 2.0

© Nokia Oyj

9 (60)


BSS MSC VLR HLR

REQUEST AUTHENTICATION INFO

MS

LOCATION UPDATE REQUEST

SEND SUBSCRIBER ID

REQUEST SUBSCRIBER ID

SEND AUTHENTICATION INFO

AUTHENTICATION

AUTHENTICATION RESPONSELOCATION UPDATE MESSAGE

ACKNOWLEDGEMENT, SUBSCRIBER INFORMATIONLOCATION UPDATE OK

ACKNOWLEDGEMENT

Figure 4. Location update procedures

In this way, the network can keep track of the subscriber all the time. This is, however, only a part of the job! Things become more complicated when it becomes necessary to set up a call. Let us start with a call originating in a fixed telephone network, a Public Switched Telephone Network (PSTN originated – mobile terminated call).

10 (60) © Nokia Oyj

6-66866v 2.0

Call set-up in a GSM network

4 Call set-up in a GSM network We will go through two call set-up cases. The first is a PSTN (Public Switched Telephone Network) originated – mobile terminated call, and the second is a mobile originated – PSTN terminated call. Setting up a call appears to be a fast and simple operation, but if we study the process more closely, we discover that it consists of a considerable number of sub-operations. These operations include signalling between switching centres, identifying and locating the subscriber who is being called, making routing decisions and traffic connections, etc.

4.1 PSTN originated – Mobile terminated call set-up

As already indicated, this section contains a step-by-step analysis of setting up a connection between a telephone in a fixed network and a GSM mobile station.

1. A subscriber in a fixed network dials the number of a mobile station. This can be either a national or an international number. An example of a national number is:

040 2207959

As you can see, there is no country code in this number. The following is an example of an international number:

+358 40 2207959

The dialled number is called an MSISDN (Mobile Subscriber International ISDN Number), which contains the following elements:

MSISDN = CC + NDC + SN

• CC = Country code (33=France, 358=Finland, 48=Poland, etc.)

• NDC = National Destination Code

• SN = Subscriber Number

PSTNMSISDN

Figure 5. PSTN originates the call

6-66866 v 2.0

© Nokia Oyj

11 (60)


2. The PSTN exchange analyses the dialled number. The result of the analysis is the routing information required for finding the mobile network (Public Land Mobile Network, PLMN) in which the called subscriber has made his subscription. The PSTN identifies the mobile network with the NDC, after which it accesses the mobile network via the nearest Gateway Mobile services Switching Centre (GMSC).

VLR

GMSC

GSMNetwork

MSISDNPSTN

HLR

Figure 6. Incoming call from the PSTN to a GSM network

3. The GMSC analyses the MSISDN in the same way as the PSTN exchange did. As a result of the analysis, it obtains the HLR address to the HLR where the subscriber is permanently registered. Notice that the GMSC itself does not have any information about the location of the called subscriber. The subscriber’s location can only be determined by the two databases, the HLR and the VLR. At this stage however, the GMSC only knows the HLR address, so it sends a message (containing the MSISDN) to the HLR. In practice this message is a request for locating the called subscriber in order to set up a call. This is called an HLR Enquiry.

4. The HLR analyses the message. It identifies the called subscriber on the basis of the MSISDN and then checks its database to determine the subscriber's location. As you remember, the HLR is informed every time the subscriber moves from one VLR area to another, that is, the HLR always knows in which VLR area the subscriber is currently registered.

It has to be pointed out that the HLR does not handle network traffic at all. A traffic connection requires two network elements that are able to provide speech connections. A speech connection is a network service


6-66866v 2.0


and it can only be handled by an MSC. Therefore, to enable the traffic connection, perhaps two MSCs will have to be connected. The first MSC is the Gateway MSC, which is contacted by the PSTN exchange. The HLR acts as a co-ordinator to set up the connection between the GMSC and the destination MSC (which could of course be the GMSC itself).

VLR

GMSC

GSMNetwork

MSISDNPSTN

HLR

VLR

MSC

HLREnquiry

Figure 7. Routing the call inside the GSM network

Let us have a look at the contents of an HLR database to discover how it locates the called subscriber. We will use an Italian subscriber as an example:

HLR

MSISDN: 39 347 220759

IMSI: 222 10 1234567890

VLR address: xyz

Subscriber data services…

As you can see, the first field contains the identity numbers of the subscriber. The MSISDN has already been explained, but there is also another identification number involved in the process known as the International Mobile Subscriber Identity (IMSI). The purpose of IMSI is to identify the subscriber in the mobile network. The total length of the IMSI is up to 15 digits and it consists of the following elements:

IMSI = MCC + MNC + MSIN

6-66866 v 2.0

© Nokia Oyj

13 (60)


• MCC = Mobile Country Code (always three digits)

• MNC = Mobile Network Code (always two digits)

• MSIN = Mobile Subscriber Identification Number (up to ten digits)

The IMSI number is used for registering a user in the Public Land Mobile Network (PLMN). To locate the subscriber and to enable the traffic connection, the HLR has to associate the MSISDN with the IMSI of the mobile subscriber. But why do we need the IMSI? Why not simply use the MSISDN both for network registration and for setting up a call? The reason for this can be explained with an example. Let us suppose that three subscribers from three countries (Finland, Italy and the USA) are in the same location and their mobile stations try to register with the same VLR. Let us also assume that they try to register using their MSISDN (which is actually not the case):

• John, from the USA, MSISDN = + 1 XYZ 1234567

• Ilkka, from Finland, MSISDN = + 358 AB 6543210

• Claudio, from Italy, MSISDN = + 39 GHI 1256890

Notice that the length of, for example, the country code is different for each number. If the MSISDN numbers were used in registering the subscribers, we would also need a length indicator for each field to prevent the various parts of the number from getting mixed up with each other - and that would be very complicated. If the length of the Mobile Country Code (MCC) and Mobile Network Code (MNC) fields are the same for all countries, no extra information is needed and the identification process is relatively simple. Another reason for using the IMSI is that the MSISDN identifies the service used such as speech, data, fax, etc. Therefore, one subscriber may need several MSISDNs depending on the type of services he uses, whereas he has only one IMSI.

To get back to the HLR database: one data field is reserved for the address of the MSC/VLR where the called subscriber is currently registered. (Normally the VLR and the MSC have the same address.) This is needed in the next phase of establishing the connection.

5. Now the HLR interrogates the MSC/VLR that is currently serving the called subscriber. But why do we need to interrogate instead of connecting right away? First of all, the current status of the mobile station is stored in the VLR database and we need to know the status to avoid setting up a call to a subscriber whose phone is switched off. Secondly, we need to have some sort of information that enables the GMSC to route the call to the target MSC, wherever in the world it may be.


6-66866v 2.0


6. In terms of routing the call, the serving MSC/VLR is the destination of the call. This means that we must direct the call to it by using the following procedure: after receiving the message from the HLR, the serving MSC/VLR generates a temporary Mobile Station Roaming Number (MSRN) and associates it with the IMSI. The roaming number is used to initiate the connection and it has the following structure:

MSRN = CC + NDC + SN

• CC = Country Code (of the visited country)

• NDC = National Destination Code (of the serving network)


VLR

VLR

Routinginformationrequest message

HLR

Gateway MSC

Target MSC

Figure 8. MSRN request from HLR to the serving MSC

If we compare the MSRN and the MSISDN, we notice that they have the same structure, though they are used for different purposes. The MSISDN is used to interrogate the HLR, whereas the MSRN is the response given by the serving MSC/VLR and it is used for routing the call. The SN field of the MSRN is actually an internal number that is temporarily associated with the IMSI. The MSRN does not merely identify the subscriber; it also points to the exchange itself so that all intermediate exchanges, if there are any, know where the call is to be routed. Since the roaming number is

6-66866 v 2.0

© Nokia Oyj

15 (60)


temporary, it is available for establishing another traffic connection after the call has been set up. In essence, the SN field in the MSISDN points to a database entry in the HLR, and the SN field in the MSRN points to a database entry in the VLR.

Let us take a look at an example with real numbers. This time the called subscriber is roaming in Finland.

VLR

IMSI: 222 10 1234567890

MSRN: 358 50 456456

Data: abc...

7. The MSC/VLR sends the roaming number to the HLR.

The HLR does not analyse the roaming number, because the MSRN is used for traffic transactions only and the HLR does not handle traffic, it is only a database that helps in locating subscribers and co-ordinates call set-up. Therefore, the HLR simply forwards the MSRN to the GMSC that originally initiated the process.

VLR

MSRN No.to HLR

VLR

HLR

358 50 456456

Gateway MSC

Target MSC

Figure 9. MSRN is sent via HLR to GMSC

8. When the GMSC receives the message containing the MSRN, it analyses the message. The roaming number identifies the location of the called subscriber, so the result of this analysis is a routing process, which identifies the destination of the call - the serving MSC/VLR.


6-66866v 2.0


9. The final phase of the routing process is taken care of by the serving MSC/VLR. In fact, the serving MSC/VLR also has to receive the roaming number so that it knows that this is not a new call, but one that is going to terminate here – that is, a call to which it has already allocated an MSRN. By checking the VLR it recognises the number, so it is then able to trace the called subscriber.

Now the routing of the call is done to the destination MSC/VLR, and it is time for the MSC to initiate the paging process. In the following, we will discuss how the GSM network is able to locate the subscribers. After that, we will wrap up the whole call set up process in one figure.

4.1.1 Locating and paging the subscriber

The GMSC/VLR and the MSC/VLR have now been connected via a traffic and signalling channel and the call set-up has almost been completed. The caller is connected to the PSTN exchange, the PSTN is connected to the GMSC, the GMSC is connected to the MSC/VLR that is serving the called subscriber, but we have not yet established a connection to the called subscriber. In order to set up the connection, we first have to understand how to locate the subscriber.

As we do not know the exact location of the subscriber, it seems as if we must search for him in the entire VLR service area, which would require lot of work from the MSC/VLR. We can therefore define more geographically limited areas where we can look for a certain subscriber. These are called location areas (LAs) and they are managed by the MSC/VLR.

LA 1

VLRMSC

LA 5

LA 4

LA 3 LA 2

Figure 10. Location areas under one MSC/VLR

6-66866 v 2.0

© Nokia Oyj

17 (60)


Each MSC/VLR typically contains many location areas. We can define a LA as an area in which we search for the subscriber in case there is a call for him.

Let us take a look at the data in the VLR and then get back to establishing the connection with the called subscriber:

VLR

IMSI: 222 10 1234567890

LAC: 262 15 0987

Data: abc...

MSRN: 358 50 456456

Each LA is identified by a Location Area Identity (LAI), and it has the following structure:

LAI = MCC + MNC + LAC

• MCC = Mobile Country Code (of the visited country)

• MNC = Mobile Network Code (of the serving PLMN)

• LAC = Location Area Code

Now that we know the LA of the subscriber, we can start searching for him. To locate the subscriber, a paging process is initiated in the location area. Paging is a signal that is transmitted by all the cells in the LA. It contains the identification of the subscriber. Even if the paging signal is received by several mobile stations in the LA, only one of them recognises the identification and answers to it. As a consequence of this answer, a point-to-point connection is established. Now the two subscribers are connected, and traffic can be carried through the network.

BTS BTS

Paging

BTS

Mobile responds to paging

Location Area

Paging

Paging

Figure 11. The paging process


6-66866v 2.0


Let us sum up the process in one picture, which explains each step when a call is set up from a fixed to a GSM mobile phone.

4.1.2 PSTN originated – Mobile terminated call set-up process

PSTN GMSC HLR MSC/VLRA-Subscriber

CALL SETUP (MSISDN)

CALL SETUP (MSISDN)

MSISDN

IMSI

MSRNMSRN

CALL SETUP (MSRN)

PAGING

ANALYSE NUMBER

Figure 12. Simplified steps in setting up a call

1. A fixed network subscriber dials a number to a mobile phone (MSISDN).

2. The Public Switched Telephone Network (PSTN) exchange analyses the number and contacts the Gateway MSC (GMSC).

3. The Gateway MSC analyses the MSISDN and sends a message to the Home Location Register (HLR).

4. The HLR checks its database to determine the current location of the called subscriber.

5. The HLR interrogates the MSC/VLR (Visitor Location Register) that is currently serving the called subscriber.

6. The serving MSC/VLR generates a temporary MSRN (Mobile Station Roaming Number).

7. The MSC/VLR sends the MSRN to the HLR and the HLR forwards the MSRN to the GMSC.

6-66866 v 2.0

© Nokia Oyj

19 (60)


10. The GMSC identifies the serving MSC/VLR as the destination for routing the call.

11. The destination MSC/VLR receives the MSRN. It identifies the number that is called and traces the called subscriber.

12. The destination MSC/VLR initiates a paging process in the Location Area to locate the called subscriber. The mobile phone of the called subscriber recognises the paging signal and answers it.

4.2 Mobile originated call

The case we just studied was the process of setting up a PSTN originated call. We also introduced how to locate the subscriber. Now it is time to investigate another case: how is a connection established when the call is initiated by a mobile subscriber?

Figure 13. Initiating a mobile originated call

The mobile subscriber dials a number. In other words, the subscriber issues a service request to the network in which he is currently registered as a visitor. After receiving the request, the network analyses the data of the calling subscriber in order to do three things:

• Authorise or deny the use of the network.

• Activate the requested service.

• Route the call.

The call may have two types of destinations: a mobile station or a telephone in a fixed network. If the call is addressed to a telephone in a fixed telephone network, it is routed to the PSTN, which in turn routes it to the destination. If the called number is another mobile station in the same network, the MSC starts the HLR Enquiry procedure, which is processed in the same way as in the example of a PSTN originated call.


6-66866v 2.0


The different steps in the call set-up procedure are illustrated in the following figure.

EXC GMSC HLR MSC VLR BSS MS

1. channel assignment

2. security procedures

3. call setup

4. check services etc.

5. all ok

6. call is proceeding

7. traffic channel allocated

8. set up the call

9. call set up complete

10. alert

11. B answers

Figure 14. Mobile originated call procedure

Two key preconditions of setting up a point-to-point connection are to identify and locate the subscriber. The MSISDN fulfils the purpose of identification, but locating requires a quick and comprehensive system for keeping track of the subscriber. If the network does not have up-to-date information about the subscriber’s current location, setting up a call would mean paging large network areas in order to find the subscriber, and that would be a complex and time-consuming task. To avoid this, the GSM network monitors and records the movements of the subscribers all the time. This process is called location update. We have already discussed it briefly, but we will analyse it in detail in the following chapter.

6-66866 v 2.0

© Nokia Oyj

21 (60)


5 Location update

5.1 Types of location update

In practice, there are three types of location updates:

• location registration (power on)

• generic

• periodic.

Location registration takes place when a mobile station is turned on. This is also known as IMSI Attach, because as soon as the MS is switched on, it informs the Visitor Location Register (VLR) that it is now back in service and is able to receive calls. As a result of a successful registration, the network sends the MS two numbers that are stored in the SIM (Subscriber Identity Module) card of the mobile station.

These two numbers are the Location Area Identity (LAI) and the Temporary Mobile Subscriber Identity (TMSI). The network sends the LAI via the control channels of the air interface. The TMSI is used for security purposes, so that the IMSI of a subscriber does not have to be transmitted over the Air Interface. The TMSI is a temporary identity, which regularly gets changed.

A Location Area Identity (LAI) is a globally unique number.

A Location Area Code (LAC) is only unique in a particular network.


6-66866v 2.0

Location update

V L RM SC

LA 2LA 1

Every time the mobile receives data through the control channels, it reads the LAI and compares it with the LAI stored in its SIM card. A generic location update is performed if they are different. The mobile starts a location update process by accessing the MSC/VLR that sent the location data.

A channel request message is sent that contains the subscriber identity (that is, IMSI/TMSI) and the LAI stored in the SIM card. When the target MSC/VLR receives the request, it reads the old LAI, which identifies the MSC/VLR that has served the mobile phone up to this point. A signalling connection is established between the two MSC/VLRs and the subscriber’s IMSI is transferred from the old MSC to the new MSC. Using this IMSI, the new MSC updates the VLR and HLR after successful authentication. It also receives the subscriber data from the HLR.

Air A

O & M

VLRMSC

HLR

Figure 15. Network elements involved in generic location update

6-66866 v 2.0

© Nokia Oyj

23 (60)


Periodic location update is carried out when the network does not receive any location update request from the mobile in a specified time. Such a situation is created when a mobile is switched on, but no traffic is carried, in which case the mobile is only reading and measuring the information sent by the network. If the subscriber is moving within a single location area, there is no need to send a location update request.

BTSBTS

Location UpdateRequest

Figure 16. Example of periodic location update

A timer controls the periodic updates, and the operator of the VLR sets the timer value. The network broadcasts this timer value so that a mobile station knows the periodic location update timer values. Therefore, when the set time is up, the mobile station initiates a registration process by sending a location update request signal. The VLR receives the request and confirms the registration of the mobile in the same location area. If the mobile station does not follow this procedure, it could be that the batteries of the mobile are exhausted or the subscriber is in an area where there is no network coverage. In such a case, the VLR changes the location data of the mobile station to “unknown”.

5.2 Procedures

The following figure briefly describes the generic location update process when the subscriber moves from one location area under an MSC/VLR to another location area under a new MSC/VLR.


6-66866v 2.0

Location update

MS BSS MSC VLRnew VLRold HLR1. channel assignment

3. request subscriber identity

4. send subscriber identity and security information5. security procedures

2. location update request

6. update HLR

7. acknowledgement, subscriber information

8. cancel old location

9. location cancelling accepted

10. location update acknowledgement, new TMSI

11. TMSI acknowledgement

Figure 17. Location update procedures

Compare this generic location update process with the location update for the first time, that is, when the MS is switched on in the own or a visited GSM network. The main differences are that the subscriber identification (IMSI number) and security information (authentication triplets) are sent by the old VLR in this case. Furthermore, HLR has the additional task of cancelling the old location as soon as the new VLR has informed the HLR that the location update was successful.

6-66866 v 2.0

© Nokia Oyj

25 (60)


6 Handover In a mobile communications network, the subscriber can move around. How can we maintain the connection in such cases? To understand this, we must study the process of handing over the calls.

Maintaining the traffic connection with a moving subscriber is made possible with the help of the handover function. The basic concept is simple: when the subscriber moves from the coverage area of one cell to another, a new connection with the target cell has to be set up and the connection with the old cell has to be released. There are two reasons for performing a handover:

• Handover due to measurements occurs when the quality or the strength of the radio signal falls below certain parameters specified in the BSC. The deterioration of the signal is detected by the constant signal measurements carried out by both the mobile station and the BTS. As a consequence, the connection is handed over to a cell with a stronger signal.

• Handover due to traffic reasons occurs when the traffic capacity of a cell has reached its maximum or is approaching it. In such a case, the mobile stations near the edges of the cell may be handed over to neighbouring cells with less traffic load.

The decision to perform a handover is always made by the BSC that is currently serving the subscriber, except for the handover for traffic reasons. In the latter case the MSC makes the decision. There are four different types of handover and the best way to analyse them is to follow the subscriber as he moves:

6.1 Intra cell − Intra-BSC handover

The smallest of the handovers is the intra-cell handover where the subscriber is handed over to another traffic channel (generally in another frequency) within the same cell. In this case, the BSC controlling the cell makes the decision to perform handover.


6-66866v 2.0

Handover

Air A

TCBTS BSC

New Channel

Old Channel

Figure 18. Intra-cell − Intra-BSC handover

6.2 Inter-cell − Intra-BSC handover

The subscriber moves from cell 1 to cell 2. In this case, the handover process is controlled by the BSC. The traffic connection with cell 1 is released when the connection with cell 2 is set up successfully.

Air A

TCBTS

BTS

BSC

Old Cell / BTS New Cell / BTS

Figure 19. Inter-cell - Intra-BSC handover

6-66866 v 2.0

© Nokia Oyj

27 (60)


6.3 Inter-cell − Inter-BSC handover

The subscriber moves from cell 2 to cell 3, which is served by another BSC. In this case, the handover process is carried out by the MSC, but the decision to make the handover is still done by the first BSC. The connection with the first BSC (and BTS) is released when the connection with the new BSC (and BTS) is set up successfully.

Air A

BTS

Old Cell / BTS

New Cell / BTS

BTS

BSC TC

BSC TC

VLRMSC

Figure 20. Inter-cell − Inter-BSC handover

6.4 Inter-MSC handover

The subscriber moves from a cell controlled by one MSC/VLR to a cell in the domain of another MSC/VLR. This case is a bit more complicated. Considering that the first MSC/VLR is connected to the GMSC via a link that passes through PSTN lines, it is evident that the second MSC/VLR can not take over the first one just like that.

The MSC/VLR currently serving the subscriber (also known as the anchor MSC) contacts the target MSC/VLR and the traffic connection is transferred to the target MSC/VLR. As both MSCs are part of the same network, the connection is established smoothly. It is important to notice, however, that the target MSC and the source MSC are two telephone exchanges. The call can be transferred between two exchanges only if there is a telephone number identifying the target MSC.


6-66866v 2.0

Handover

Air A

BTS

Old Cell / BTS

New Cell / BTS

BTS

BSC TC

BSC TCVLRMSC

VLRMSC

Figure 21. Inter-cell − Inter-MSC handover

Such a situation makes it necessary to generate a new number, the Handover Number (HON). The generation and function of the HON are explained in the following.

The anchor MSC/VLR receives the handover information from the BSS. It recognises that the destination is within the domain of another MSC and sends a Handover Request to the target MSC via the signalling network. The target MSC answers by generating a HON and sends it to the anchor MSC/VLR, which performs a digit analysis in order to obtain the necessary routing information. This information allows the serving MSC/VLR to connect the target MSC/VLR. When the two MSCs are connected, the call is transferred to a new route.

In practice, the handover number is similar to the roaming number. The subscriber number identifies the serving MSC and it is only in temporary use during the handover. Moreover, the roaming number and the handover number have a similar purpose, that is, connecting two MSCs. The structure of the handover number is shown below:

HON = CC + NDC + SN

• CC = Country Code

• NDC = National Destination Code (of the serving network)


6-66866 v 2.0

© Nokia Oyj

29 (60)


The call will not last forever and the connection has to be released sooner or later. To understand the process of releasing the connection, we must consider a few things such as: Who pays for the call, which exchange takes care of the charging operation, and where is the subscriber data stored. This will be discussed in the next section, but before that, let us sum up the stages of inter-MSC handover.

MS BSSold MSCold MSCnew BSSnew MS (after HO)

1. measurement reports

3. request HON

5. radio resources reserved

6. provide HON and target cell info

7. set up speech connection (HON)

2. handover required

4. request for radio resources

8. handover command9. handover complete

10. handover complete11. connect

12. release old connections

Figure 22. Inter-MSC handover procedure


6-66866v 2.0

Charging

7 Charging

7.1 What to charge?

Charging in GSM networks follows similar principles to those used in fixed telephone networks. In addition to a standard fee, subscribers have to pay for the calls they make and the services they use. However, there are a few differences in how the costs are calculated and who is liable to pay them.

Note that the information presented in this chapter outlines only the basic features of charging. The actual charging practices vary considerably from one network operator to another.

7.2 Subscription charge

When a person joins a GSM network, he receives a personal SIM card from the network operator and his basic information (phone number, type of ordered services, etc.) is recorded in the network databases such as the HLR. To cover the costs of these operations, network operators often charge the subscriber an initial subscription charge.

7.3 Renting of service

After the subscription has been made and the subscriber has become a customer of the particular network, he is usually charged for the availability of the network services and the right to use them. This is a regular fee, which is charged irrespective of whether the subscriber makes any calls or not. This kind of charge is also known as renting the service of the network.

6-66866 v 2.0

© Nokia Oyj

31 (60)


• Installation fee

• Renting of the service

• Use of the network

Figure 23. Different ways of charging a subscriber

7.4 Charge for using the network

The third charging type is applied for the use of the network on a call-by-call basis. There are many factors that affect how the subscriber is charged for making (and, sometimes, receiving) a call. Parameters that can be used as a basis for charging the subscribers are shown in the following list:

• Type of service, for example speech, short message service

• Duration of the call

• Time of day when the call was made, for example working hours, evening, night

• Destination of the call (to whom are we calling)

• Origin of the call (where do we call from), for example a certain cell

• Use of networks, for example the PSTN (Public Switched Telephone Network)

• Use of supplementary services such as call forwarding and call barring, Intelligent Network services

• Use of radio resources (for instance when performing handovers)

• International roaming leg (explained later).


6-66866v 2.0

Charging

Call forwarding and roaming leg are factors that not only affect the amount of charge, but also bring up the issue of who is liable to pay. This is a major difference when compared to fixed telephone networks, which is why we have to take a closer look at it in the following chapter.

7.5 Whom to charge?

Calling Party

Where is thecalled party?

Bill to subscriber

PSTN

BCPath ofthe call

MSC

BC

HLR

Charging

Transfer ofCharging data

Billing

MSC

BSC

PLMN 1

PLMN 2

Figure 24. PSTN - GSM call path

Let us take a closer look at the number dialled by the calling subscriber. The number includes the national destination code, which identifies the called subscriber’s home network. If the called subscriber is registered in a location

6-66866 v 2.0

© Nokia Oyj

33 (60)


area belonging to his home network, the connection is established as explained in the previous chapter and the calling subscriber pays for the call.

If, however, the called subscriber is outside the service area of his home network (in a foreign country, for instance) and is connected to another network, then the call has to be routed to him using the services of one or more foreign networks. In such a case, we talk about international roaming leg, which refers to the connection between the home network and the subscriber via a foreign network. In such a case, the charge for the call will be shared according to the following principle:

• The calling subscriber pays for the connection to the number he dialled (MSISDN).

• The called subscriber pays for the international roaming leg.

The same principle is applied when the mobile subscriber has forwarded incoming calls to another number. The calling subscriber is only responsible for the costs incurred by calling to the mobile station, and the mobile user pays for the forwarded call. This may seem strange and complicated, but the reason is quite clear: the calling subscriber does not necessarily know the location of the called subscriber or the services and connections that are required to access him. The calling subscriber only knows that he is dialling a number in a certain mobile network, and therefore he can only be charged for the services that he is aware of. The called subscriber knows - at least he should know - whether he is using the services of a foreign network or some chargeable supplementary services of his home network, and therefore he is liable to pay for them.

Collect call is the third case in which the called subscriber pays for the call. A collect call in a GSM network is similar to a collect call in a fixed network. First the called subscriber has to accept the call, after which he is responsible for all the costs.

7.6 Charging procedure in GSM

In the fixed network, the charging is normally determined by collecting metering pulses, by which the exchange can calculate the price of the call. This method is called time charging. The calling subscriber (subscriber A) is normally the one who pays for the call. In the mobile network the called subscriber is normally also charged for the so-called roaming leg, because A does not necessarily know where B is located.

In the GSM network there are so many different ways to define the charging that it is sensible to create a record in the MSC or/and HLR about every event that can be a basis for charging. These events can be the defined call cases or other possible chargeable events, such as location updates. The record containing the information about one chargeable event is called the charging data record (CDR) or Toll Ticket (TT). These records are stored primarily as charging files in the MSC or HLR, and these files are then transferred to a


6-66866v 2.0

Charging

separate Billing Centre. The serving operator controls the entire charging process. The process begins when a call is set up and at the same time, a charging record is opened in the serving MSC/VLR. In general, the first and the last MSC involved in a call set up collect the charging record.

BTS

BSC

HLR

PSTNGMSC

Charging Data Record

Figure 25. GMSC is responsible for creating charging records

As the call continues, the subscriber moves in the service area of the operator and enters the service area of another MSC/VLR, and thus an inter-MSC handover is performed. The charging record is not transferred to the new MSC during the handover. Instead, the first MSC keeps record of the call as long as it lasts.

BTS

BSC

HLR

GMSC

BSC

MSC

PSTN

Figure 26. Elements involved in call handling

6-66866 v 2.0

© Nokia Oyj

35 (60)


When the call has been released, the charging record is closed. When a sufficient number of charging records have been accumulated, they are sent to a Billing Centre in one bulk via an X.25 or Ethernet connection.

BTSBSC

MSC

HLR

X.25 orEthernet

GMSC

PSTN

Figure 27. Transfer of charging data to the Billing Centre

As the actual charging is affected by a variety of factors, the charging record contains all the events that can be used as a basis for determining the charge.

Information for one customer is collected from many MSCs and Billing Centres that the mobile has visited, and is presented as one bill.

7.6.1 Distributed charging

In order to produce bills for each subscriber, Billing Centres should collect detailed charging data from all the MSCs within the PLMN.

With international roaming, this operation should be extended to cover all the PLMNs where a roaming contract is signed. Charging information must be collected from the Billing Centres (BC) of all the networks that subscribers have been visited, and passed to the Billing Centre of the home network.


6-66866v 2.0

Charging

Home Billing Centre

Figure 28. Distributed charging

When two GSM operators sign a “roaming contract”, they agree how often they will transfer charging data between each other. The home Billing Centre analyses the charging information collected from all the networks where a roaming contract exists, and produces a bill for each customer.

6-66866 v 2.0

© Nokia Oyj

37 (60)


8 Security in the GSM network Large efforts have been made to provide good security in the GSM network. In this section, we will first discuss how an operator can ensure that all the SIM cards currently located in the network are entitled to use the network (authentication). A second measure is to provide secure transmission of speech and data in the Air Interface through ciphering. A third security feature is to allocate temporary subscriber numbers. By doing so, we do not need to broadcast of the real identity number so often.

8.1 Authentication principle

Authentication is a procedure used in checking the validity and integrity of subscriber data. With the help of the authentication procedure the operator prevents the use of false SIMs in the network. The authentication procedure is based on an identity key, Ki, which is issued to each subscriber when his data is established in the HLR. The authentication procedure verifies that the Ki is exactly the same on the subscriber side and on the network side.

A

VLRMSC

Air

* IMSI

* Ki

* IMSI

* Ki

ACSIMcard

Figure 29. Authentication

Authentication is performed by the VLR at the beginning of every call establishment, location update, and call termination (on the called subscriber side). In order to perform the authentication, the VLR needs the basic authentication information. If the mobile station was asked to broadcast its Ki, this would undermine the principle of authentication, because identification data would be sent across the air. The trick is to compare the Ki stored in the mobile with the one stored in the network without actually having to transmit it over the radio Air Interface. The Ki is processed by a random number with a


6-66866v 2.0

Security in the GSM network

“one-way” algorithm called A3 and the result of this processing is sent to the network. Due to the type of the algorithm A3, it is easy to get the result on the basis of Ki and a random number, but it is virtually impossible to get the Ki on the basis of the result and random number (hence the name “one way” algorithm).

Since the security issue concerns confidentiality as well, the network uses more than one algorithm. The algorithms are introduced in the following sections.

8.2 Security algorithms

The GSM system uses three algorithms for the purposes of authentication and ciphering. These algorithms are A3, A5 and A8. A3 is used in authentication, A8 is used in generating a ciphering key and A5 is used in ciphering.

AA ir

V L RMSCB T S

T CB SC

ME + SIM

ACA3 A8

A3 A8A5

A5

Figure 30. Security algorithms

Algorithms A3 and A8 are located in the SIM module and in the Authentication Centre (AC). A5 is located in the mobile station and in the BTS.

Before an operator starts to use the security functions, the mobile subscriber is created in the Authentication Centre. The following information is required when creating the subscriber:

• IMSI of the subscriber

• Ki of the subscriber

• algorithm version used.

6-66866 v 2.0

© Nokia Oyj

39 (60)


The same information is also stored in the mobile subscriber's SIM. The basic principle of GSM security functions is to compare the data stored by the network with the data stored in the subscriber’s SIM. The IMSI number is the unique identification of the mobile subscriber. Ki is an authentication key with a length of 32 hexadecimal digits. The algorithms A3 and A8 use these digits as a basic value in authentication.

The Authentication Centre generates information that can be used for all the security purposes during one transaction. This information is called an authentication triplet. The authentication triplet consists of three numbers:

• RAND

• SRES

• Kc.

RAND is a Random number, SRES (Signed Response) is a result that the algorithm A3 produces on the basis of certain source information, and Kc is a ciphering key that A8 generates on the basis of certain source information.

VLR

Random Number Generator Ki

RAND

Authentication Triplet


AC A8A3

SRES Kc

RAND SRES Kc

Figure 31. Authentication triplet

All the values included in the authentication triplet depend on each other; that is, a certain RAND inserted to the algorithms with a certain Ki always produces a certain SRES and a certain Kc.


6-66866v 2.0


When the VLR has this kind of three-value combination and the mobile subscriber authentication procedure is initiated, the VLR sends the random number RAND through the BSS to the SIM in the mobile station. As the SIM has (or it should have) exactly the same algorithms as used in the triplet generation on the network side, the RAND number that the SIM receives and inserts to the algorithm should produce exactly the same SRES value as the one generated on the network side.

RANDSRES Kc


BSC

BTS

A3

A8K i Kc

RAND

Kc

SRES

MS

SIM

VLRComparison

Figure 32. Authentication procedure

If the SRES value in the authentication triplet is the same as the SRES calculated and sent by the mobile station, the authentication procedure is successful.

6-66866 v 2.0

© Nokia Oyj

41 (60)


8.3 Ciphering / speech encryption

Ciphering is used across the air interface to provide traffic and signalling encryption. When the authentication procedure has been completed successfully, the BTS and the mobile station are ready to start the ciphering procedure for further signalling and speech / data transmission.

The speech of the user, the TDMA frame number (Time Division Multiple Access) and the ciphering key, Kc, are processed by the ciphering algorithm (A5), which produces the coded speech signal.

SPEECH/DATA

BTS

A5

A5

TDMA

Kc

A5

A5

TDMA

Kc

ENCRYPTEDSPEECH/DATA

SPEECH/DATA

Figure 33. Speech encryption


6-66866v 2.0


8.4 User confidentiality

User confidentiality in general refers to methods of ensuring that nobody calls at the expense of another person. From the end user's point of view, the mobile station secures itself against misuse by asking for the Personal Identification Number (PIN) when the station is turned on. If the PIN entered by the subscriber is correct, the phone is unlocked and ready for use. User identity is kept confidential by using Temporary Mobile Subscriber Identity (TMSI) numbers. After a successful first time location update, a mobile subscriber is allocated a Temporary Mobile Subscriber Identity (TMSI). The next time a transaction between the GSM network and the MS is initiated, the subscriber is identified by the use of the TMSI. This is carried out in the case of both mobile originating transactions (such as channel request) and network originating transactions (such as paging). TMSI is reallocated after every successful authentication verification. The format of a TMSI is operator dependent. It is a 32 bit binary number and these TMSI numbers are reallocated in a ciphered format.

6-66866 v 2.0

© Nokia Oyj

43 (60)


9 Services

9.1 What are services?

In the broadest sense of the concept, any subscriber action that uses the facilities provided and supported by the GSM system can be categorised as a service. Therefore, a person who has access to a GSM mobile phone and wishes to make a call is trying to access the speech service provided by the system.

9.2 Classification of services

GSM is a multiservice system that allows various types of communication that can be distinguished by the nature of the transmitted information. Generally, based on the nature of the transmitted information, services can be grouped as speech services, where the transmitted data is speech, and data services that covers the rest of the information types such as text, facsimile, etc.

Services

TeleservicesBearer

services

Basicservices

Supplementaryservices

However, if a person registers as a GSM subscriber and buys a mobile station, he takes it for granted that at least the speech service is guaranteed (after all, that is the reason why he bought the phone in the first place).


6-66866v 2.0

Services

This raises another distinction in services:

• Basic Services, which are individual functions and may be automatically available and included in the basic rights of the subscriber as soon as he registers.

• Supplementary Services, which are extra services that are not included as basic features, but are associated with the basic services by enhancing, and/or adding extra features to, the basic services.

As an example, take a person who has a subscription for two basic services, Speech and Group 3 fax. In association with the fax service the subscriber may request a supplementary service of Call Forwarding On Mobile Subscriber Not Reachable, so that his data calls will be forwarded to another destination.

When a user subscribes for more than one basic service, he will have a different MSISDN for every basic service to which he subscribes. In the example above, the calling party has to dial a different number depending on whether he wants to talk or send a fax.

When these services are provided as a basic or supplementary service, it is not only important to know what is transmitted. How the transmission is carried out plays a major role, too. In addition, there is the question of whether sufficient resources are available to support the service from end to end. It may be that the service is available at one end, but the target user may not have access to it and hence the use of this service is not possible. Basically, there are three essential points that need to be fulfilled before a service becomes available.

• Whether the subscriber has access to the service or not?

• Whether the GSM network from where the user is getting the service has the necessary resources or not?

• Whether the equipment owned by the user is capable of supporting the service or not?

The second and third points raise an interesting scenario: using a service that is provided by a network that is independent of the end user equipment. An example of this is the use of facsimile in PSTN. It utilises the basic network resources, but the transmitted information is data, which appears to be speech as far as the network is concerned.

This brings us to the standard classification of services as described in the GSM 900 and GSM 1800 Technical Specifications. The first group is Teleservices, which provide the full communication capacity by means of terminals and network functions as well as those provided by dedicated centres. The other group is Bearer Services, which provide the capability of transmitting signals between a GSM network access point and an appropriate access point in the terminating network. The latter allows the use of the network resources only.

6-66866 v 2.0

© Nokia Oyj

45 (60)


9.3 Teleservices

The various types of teleservices that are provided by a GSM network can be summarised as shown in the following table.

Table 1. Teleservices

Service Description GSM Spec. Code Characteristics

Speech (Telephony) T11 The most important service for mobile systems, normal speech service, including emergency calls.

Speech, Emergency calls T12 Emergency calls are possible automatically.

Short Message Service (Mobile terminated)

T21 For the reception of short messages.

Short Message Service (Mobile originated)

T22 For sending a short message to another GSM subscriber.

Short Message Service

(Cell broadcast)

T23 For the reception of broadcast short messages.

Group 3 Facsimile transmission (with alternate speech)

T61 Not supported by NOKIA.

Automatic Group 3 Facsimile transmission

T62 For sending and receiving facsimile messages.

9.3.1 Speech (telephony) and emergency calls

These are the most common teleservices used in the GSM network. Speech is also the basic service that each subscriber is guaranteed to.

Telephony is a teleservice offering normal, traditional voice calls. The normal security procedures apply to all such calls, except in the case of emergency calls that are processed regardless of possible security violations (up to the point that emergency calls can be made with a normal GSM mobile equipment that is not equipped with a SIM card). It is worth remembering that 112, the standard emergency number in most fixed networks is also used in GSM networks, even if 112 is not necessarily the standard emergency number in every country.


6-66866v 2.0

Services

9.3.2 Short Message Services: Mobile Originated, Mobile Terminated and Cell Broadcast

The Short Message Services (SMS) Mobile Originated (SMS-MO) and Mobile Terminated (SMS-MT), enable the transmission of alphanumeric messages of up to 160 characters between mobile subscribers. Many operators and vendors nowadays support the transmission to external systems, such as e-mail, paging and voice mail systems.

SMS uses a Short Message Service Centre (SMS Centre), which stores and forwards short messages. The SMS Centre relays short messages to and from the GSM network through the Mobile Switching Centre (MSC).

SMS appeared on the European wireless scene in 1991 at the same time as the current GSM standard. In contrast to existing text transmission services such as alphanumeric paging, SMS elements have been designed to guarantee delivery of text messages to the destination. In addition, an active mobile station is capable of receiving a short message at any time, even when a voice or data call is in progress.

Nowadays, the Short Message Service represents the most successful mobile data service. Approximately 27 Billion SMS messages were transmitted worldwide every month in the second quarter of 2002.

SMS supports three different alphabets:

• The default 7-bit alphabet accommodates 128 (27) characters. For SMS, we have a data limit of 140 octets per message. We thus obtain the maximum length of 160 characters, since the single default alphabet character takes up 7/8th of an octet (without compression).

• The 8-bit data alphabet is user-defined, that is, no standardised character table exists. 8-bit data is used for data other than text, for example Over-The-Air (OTA) applications.

• UCS2 (Universal multiple-octet coded Character Set v2) is an international character coding system based on a 16-bit code set. UCS2 accommodates the many thousands of characters used in international texts, providing unique codes for more than 65,000 characters. As a single UCS2 takes up 2 octets, the number of characters in the user data flied cannot exceed 70 characters.

6-66866 v 2.0

© Nokia Oyj

47 (60)


A ir A

VL RMSC

SMS

Alfas kop m346 Alfas kop m346 Alfask op m34 6

Short M essage Service,M obile T erminated

Short M essage Serv ice,M obile O riginated

Figure 34. Short Message Service, MO and MT

The services of SMSC are not required in the third type of SMS service, Cell Broadcast, as the BSC is equipped with the necessary SMSC functions. The maximum length of a cell broadcast SMS is 93 characters.

O & M

Al fas k opm346

Alfask op m346

Alfas k opm346

Air A

BTS

BTS

BTS

BTS

BTS

BSC

Short Message Service,Cell Broadcast

Figure 35. Short Message Service, Cell Broadcast


6-66866v 2.0

Services

SMS Architecture The following Network Entities are specified for SMS:

• The SMS-Gateway Mobile Switching Centre (SMS-GMSC) is an MSC element that receives a short message from the SMS Centre. It also interrogates the Home Location Register (HLR) for routing information and delivers the short message to the MSC that the recipient mobile station was last connected with.

• The SMS-Interworking Mobile Switching Centre (SMS-IWMSC) is an MSC element that receives a short message from the GSM network and submits it to the appropriate SMS Centre.

The SMS-GMSC and SMS-IWMSC may be integrated with the SMS Centre. The Short Message Service Centre (SMS Centre) acts as a store and forward centre for short messages. The SMS Centre relays the short messages to and from the GSM network through the Mobile Switching Centre (MSC). In the same way as a post office stamps new letters, the SMS Centre inserts the time and date of arrival into each short message it receives from the GSM network. The SMS Centre also converts the short message destination address into the correct format and delivers it to its destination (the default destination is a mobile station).

The Validity Period (VP) is the time period for which the short message is valid. The SMS Centre will attempt to deliver the short message until the validity period has expired. If the message is not delivered successfully (for example because the MS was switched off) within its validity period, it is discarded. Each short message contains a date and a time in the message. The SMS Centre adds date and time information when the originator submits the message for delivery. The service centre time stamp is similar to the post office stamp on a new letter (done before delivery to its destination). The information is in the form of year, month, day, hours, minutes, seconds and time zone. The time is the local SMS Centre time, and the time zone is an offset to GMT.

BSC

BTS

BTS

TRAU

BSS NSSM SC/VLR

HLREIR ACM S Ext.

Appl.

SM SCSM S-

IW M SC

SM S-GM SC

Figure 36. SMS Architecture

Nowadays it is possible to connect external applications to the SMS Center, or to enable interworking with other networks. For instance, SMS transfer between the Internet and MSs is often supported. External applications, such as the Nokia Messaging Platform, provide access to a number of Value Added Services to support the operator’s own applications, 3rd party applications, and E-mail connectivity. Please note, that these platforms are not specified.

6-66866 v 2.0

© Nokia Oyj

49 (60)


SMS Transfer Examples

SMSCSMS-IWMSCMSCMS

VLR HLR

1

2

3

4

5 6

789

Figure 37. SMS-MO, successful transfer

The SMS Mobile Originated (SMS-MO) transfer can be decomposed into nine steps:

1. The MS makes a service request for an SMS transfer. A mutual communication between MS and MSC takes place to perform authentication, cipher setting, etc.

2. The MSC requests subscriber data from the VLR. The interaction is required to get necessary information for authentication, cipher setting, barring of services, etc.

3. The SMS message is transferred to MSC, which confirms the message.

4. The MSC requests additional subscriber information regarding the SMS-service. This is necessary, because the SMS service may be restricted. For instance, a subscriber may be allowed to send SMS messages only nationally, but not internationally.

5. The MSC forwards the short message to the SMS-IWMSC.

6. The SMS-IWMSC forwards the short message to the SMS Center.

7. The SMS Center confirms the arrival of the SMS message to the SMS-IWMSC.

8. The confirmation message is forwarded to the MSC.

9. The MSC forwards it to the MS.


6-66866v 2.0

Services

The figure below illustrates a Mobile Terminated Short Message Delivery where the mobile station is temporarily unreachable. The mobile station might be switched off, or located in an area with poor network coverage. The VLR returns a failure report, which is forwarded to the SMS Centre. The SMS Centre stores the undelivered short message for retry later when the mobile station becomes reachable.

Figure 38. SMS-MT, unsuccessful transfer

Nokia SMS Architecture The Nokia Short Message Service Centre acts as a store and forward centre for short messages. Since its inception, the SMS Centre has developed into an important network element. Nokia has developed many new services that make short messaging more comfortable for both mobile subscribers and the operators. The Nokia SMS Centre supports among others:

SM SCSM S-G M SC

M SC /SG SN

M S

H LRV LR

1

2

3

6

7

8

45

SM SCSM S-G M SC

M SC /SG SN

M S

H LRV LR

1

2

3

6

7

8

45

• Priority classes Priority class is a priority mechanism defined by the Nokia SMS Centre. Priority classes range from 1 to 9, 1 being the highest. Priority classes are specific to the message type; this means a mobile originated short message may have priority class 2, whereas status reports may have priority class 4. Consequently, mobile originated short messages precede status reports in the destination queue and arrive first. If there are two short messages destined for the same address, the message with a higher priority class precedes messages with a lower class.

• Tariff classes Tariff class is a feature of the Nokia SMS Centre that allows operators to set different costs for different services. For instance, sending an ordinary short message can cost 30 cents, whereas fetching a new ringing tone can cost 1 euro. The operator may also decide to charge

6-66866 v 2.0

© Nokia Oyj

51 (60)


nothing for services such as status reports. When the SMS Centre creates a Charging Data Record (CDR) for the Billing Centre (BC), the different SMS services are billed according to their tariff classes. If the tariff class is zero, the service is not charged and the charging data is not transferred to minimise the loading of the billing system.

The Application Server (ASE) is a Nokia SMS Centre computer application interface that allows gateway applications to connect to the SMS Centre in order to send and retrieve short messages. These gateway applications are called ASE subscribers or Short Message Entities (SMEs). The gateway applications can be connected to the Application Server via TCP/IP, CMD2, modem or X.25 physical interface. In a networked SMS Centre configuration, it is possible to connect a single ASE to multiple SMS Centre kernels and vice versa. This many to many-relationship between the ASE and the SMS Centre kernel is realised using Packet Switch (PSW).

Figure 39. Nokia SMSC


6-66866v 2.0

Services

9.3.3 Facsimile transmission (T61 and T62)

Facsimile transmission is a teleservice that sets requirements for terminal equipment and their adaptation. There is one predefined case in which the mobile station needs to be interfaced with a computer equipped with a fax modem. However, because it is used for data transmission, there has to be a provision for the bearer service in order to define the characteristics of the bearer such as data transmission rate and Air Interface error correction protocol.

In the case of T61 facsimile transmission, the receiver is either not aware that the incoming call is addressed to the fax, so he has to establish the nature of the call by talking with the calling party first, or the receiver knows that it is a facsimile call, but still wants to talk with the calling party. In both cases, the nature of the transmitted information is data (group 3 facsimile) and speech alternately (during the same call). As shown in the table, Nokia does not currently support this service.

The T62 automatic facsimile is an automatic fax service where the receiver has a different MSISDN for the fax service and all calls to this number are purely data transmission calls.

AAir

BTS

HLR EIRAC

BSC TC MSC VLR

IWF

Transparent /Non Transparent

Modems/Rate Adaptation

Figure 40. Facsimile transmission (T61/transparent, T62/non transparent)

6-66866 v 2.0

© Nokia Oyj

53 (60)


9.4 Bearer services

Bearer services come into the picture when data transmission services are needed and there are a number of different types of data services available. The distinctions between these data services are based on the users (who can be connected to the PSTN, ISDN or a PSPDN network) and the mode of transmission (packet or circuit switched, whether end-to-end digital or not, synchronous or asynchronous).

Bearer Services (BS) supported by the GSM system only provide the capability of transmitting signals between the originating and terminating access points. There are no recommendations on the end user terminals. At the moment, the bearer services are divided into 10 categories, each of which describes the characteristics of the bearer.

It is necessary to characterise the bearer (specifying the data rates and type of modem to be used).

There are four terms that are important to be familiar with:

• Transparent

• Non-transparent

• Synchronous

• Asynchronous

The terms transparent and non-transparent identify whether a second layer of error correction protocol is employed in the air interface or not.

A non-transparent service employs re-transmission in case of errors. In other words, the GSM network can correct the detected errors.

A transparent service, on the other hand, does not employ re-transmission. The terminals may, however, perform error detection. In this case the terminal then decides to re-transmit the data.

In asynchronous transmission the bit flow through the network is not continuous. The transmitting and the receiving data terminals keep up their synchronisation over one single character at a time. Start and stop bits must be used so that the transmitting and receiving data terminals can operate at exactly the same speed.

In synchronous transmission the bit flow through the network is continuous, and the transmitting and receiving data terminals are bit-synchronised. Start and stop bits are not needed.

Multimedia applications and video are examples of synchronous services. File transfer and e-mail are examples of asynchronous services, as we are not bothered by small delays in the transmission of this kind of information.

The radio characteristics of the air interface are based on a special speech coding algorithm that ensures the best quality with the lowest possible bit rate, normally 13 Kbits/s, which makes it incompatible for modem signals. Thus, a


6-66866v 2.0

Services

GSM user will never need a modem for data communication. The connection between the mobile station and the GSM network is fully digitised. Within the GSM network, the digital signal passes through a suitable modem to make the signal compatible for the addressed equipment in, for instance, the PSTN. Alternatively, modem signals coming from the PSTN will be demodulated into digital signals in the GSM network and the data will be forwarded to the mobile user. The modems are located in the MSC. For connections to an ISDN network, no modems are needed, but rate adaptation needs to be performed in the MSC.

AAir

BTS

HLR EIRAC

BSC TC MSC VLR

IWF

Transparent /Non Transparent

Modems /Rate Adaptation

Synchronous /Asynchronous

Figure 41. Data services

At the moment it is possible to achieve 14.4 Kbits/s data connections thanks to new channel coding. It is also possible to use more than one traffic channel in the Air Interface to achieve even higher data rates. We will discuss more about HSCSD (High Speed Circuit Switched Data) later.

6-66866 v 2.0

© Nokia Oyj

55 (60)


9.5 Supplementary services

Supplementary services enhance or supplement the basic telecommunication services. The same supplementary services may or may not be employed by a number of different basic services, such as basic telephony or T62 automatic facsimile service. The following list covers most of the common services, as well as the essential supplementary services.

• Advice of charge – AOC

• Alternate Line Service (ALS) – personal or business

• Barring of all incoming calls – BAIC

• Barring of all incoming calls when roaming outside the HPLMN

• Barring of incoming calls when abroad

• Barring of outgoing calls – BOC

• Barring of outgoing international calls – BOIC

• Barring of outgoing international calls excluding those directed to the HPLMN country

• Call forwarding on mobile subscriber busy – CFB

• Call forwarding on no answer – CFNA

• Call forwarding unconditional – CFU

• Call hold

• Call waiting – CW

• Calling line identification presentation – CLIP

• Calling line identification restriction – permanent or per-call – CLIR

• Centrex services

• Closed user group – CUG

• Conference call – CONF

• Explicit call transfer

• Operator determined barring – ODB


6-66866v 2.0

Review questions

10 Review questions In the following questions, please select the alternative you think is the best answer for the particular question.

1. The location update procedure is initiated by the:

a. Mobile Station (MS)

b. Mobile services Switching Centre (MSC)

c. Base Station Controller (BSC)

d. Home Location Register (HLR)

2. The format of the International Mobile Subscriber Identity (IMSI) is:

a. CC + NDC + SN

b. MCC + MNC + MSIN

c. MCC + MNC + LAC

d. Operator-specific 32-bit binary number

3. Which of the following cases result in an HLR enquiry?

a. PSTN originated PSTN terminated call

b. Mobile originated PSTN terminated call

c. PSTN originated mobile terminated call

d. None of the above

4. A location area:

a. Is the geographical area under one Base Station Controller (BSC).

b. Is equal to one MSC area.

c. Is equal to one cell.

d. Is identified by a unique Location Area Identity.

6-66866 v 2.0

© Nokia Oyj

57 (60)


5. Initiation of the paging process for a mobile station is done by:

a. The MSC over a location area.

b. All Base Transceiver Stations in a location area.

c. A Base Station Controller over one BSC area.

d. A Base Transceiver Station in one cell.

6. In a mobile terminated call a traffic channel from the NSS in the terminating side to the called mobile station is reserved when:

a. The MS user answers the ringing of the phone.

b. The B-subscriber accepts the international roaming leg charging.

c. The MSRN analysis is done and the location area of the subscriber is known.

d. The mobile station answers the paging signal.

7. Why is it necessary to check the calling subscriber’s data before allowing the call to proceed in the originating NSS side?

a. To make sure that s/he has the correct IMSI.

b. To make sure that s/he is provisioned the requested service.

c. To make sure that s/he has the correct TMSI number.

d. To make sure that the NSS knows whom to charge for the call.

8. If in a GSM/DCS network the periodic location update timer is set as 10 hours, then a periodic location update is done:

a. 10 hours after the last periodic location update.

b. 10 hours after the last power on location update.

c. 10 hours after the last generic location update.

d. 10 hours after the last transaction of any kind with the NSS.

9. In an inter-VLR location update, the new VLR asks the old VLR for some information about the mobile subscriber. The old VLR responds to this query by providing which of the following information?

a. IMSI and authentication triplets.

b. IMSI, TMSI and subscribed services.

c. IMSI and last location update time.

d. IMSI and HLR address in case of a roaming subscriber.


6-66866v 2.0

Review questions

10. If a handover occurs during a call:

a. The new frequency resource always belongs to a cell other than the current one.

b. A handover number is always required.

c. The initial speech path is not disconnected until a successful message comes from the mobile station on the new channel.

d. The subscriber always has to pay extra for the additional network operation required to maintain his/her call.

11. Charging records can be generated in:

a. The MSC.

b. The HLR.

c. Both in the MSC and the HLR.

d. Charging records are not generated in the GSM network.

12. Which network element creates bills for the subscriber?

a. The HLR with information from the MSC.

b. The MSC with information from the Billing Centre.

c. The Billing Centre with information from the MSC.

d. The Billing Centre with information from the Transcoder.

13. Authentication means:

a. Verifying the mobile phone user

b. Verifying the mobile equipment

c. Verifying the TMSI number

d. Verifying the SIM card

14. The contents of the authentication triplet are:

a. SRES, RAND, A3

b. SRES, RAND, Kc

c. A3, A5, A8

d. RAND, A3, A8

6-66866 v 2.0

© Nokia Oyj

59 (60)


15. What is the result when you use Ki and RAND as inputs through A8?

a. Encoded speech

b. Signed response

c. Authentication triplet

d. Kc

16. What is SRES and Kc used for, respectively?

a. SRES is used for speech encryption and Kc is used for authentication.

b. SRES is used for speech encryption and Kc is used for frame alignment.

c. SRES is used for authentication and Kc is used for speech encryption.

d. Both SRES and Kc are used for speech encryption.

17. Which of the following is not a basic service?

a. SMS-MO

b. Speech, emergency

c. CLIP

d. 14.4 Kbits per second synchronous transparent

18. Which two of the following services are supplementary?

a. Call Forwarding Unconditional.

b. Speech, emergency calls.

c. Conference call.

d. Facsimile transmission.


6-66866v 2.0

Documents

Gsm Traffic Management