Table of Contents

PLMN Network Structure Add i d N b i l Addressing and Numbering plan GSM Network Evolution UMTS Network Evolution UMTS Network Evolution CORE Network Nodes 2G/3G Authentication Short Message Service Location Update  H d Handover

1

PLMN Network StructurePLMN Network Structure

2

3

GSM Network Areas...

Public Land Mobile Network (PLMN)

MSC / VLR Area

Public Land Mobile Network (PLMN)

C ll

Location Area

Cell

4

GSM Network Areas...

P bli L d M bil N t k (PLMN)Public Land Mobile Network (PLMN)

5

GSM Network Areas...

MSC/VLR Service Area :ك ط ت ك نشا ا ك ش ا ة نا ا نطق شMSCك ا شش پوشش داده مي شود MSCيك منطقه يا ناحية سرويس از شبكه را نشان مي دهد كه توسط يك

6

GSM Network AreasGSM Network Areas...

Location Area Location Area ::كه در اين محدودهاست MSC/VLR Service Areaي از يك بخش

.افتداتفاق نميLocation Updateعمليات ،موبايلمشتركبا جابجايي١. يي بج ج يلرب يpيوب ق

.مي شودپخش  Location Areaدر آن براي يافتن مشترك  Pagingپيام٢.

7

GSM Network Areas...Cell:

Locationيك AreaچندينبهCellهر.شودمي تقسيمCell،ينبي كهاستراديويي پوششبامنطقةيك شبيروييمچ يوييپو ر.شود مي تعيين )(CGI سلول هويت شماره وسيلهب آن هويت

از كه هايي Cell بين(BSIC)ايستگاه هويت شماره و ايستگاه هويت كد از استفاده با موبايل گوشي.گذاردميتفاوتكنند، مياستفادهمشابهكاريرفركانسهاي

CGI : Cell Global ID  BSIC : Basic Station Identity Code 8

Addressing and Numbering plan

MSISDN (Mobile Subscriber ISDN Number) تماس س MSISDN (Mobile Subscriber ISDN Number)شماره ر

IMSI (International Mobile Station Identity) شماره سيم کارت TMSI (Temporary Mobile Station Identity) شماره سيم کارت موقت PIN (P l Id tit N b ) ت کا ز ا PIN (Personal Identity Number) ش شماره رمز سيم کارت

PUK (Personal Unblocking Key)               PIN شماره بازيابی

شماره رمز سری برای تشخيص هويت سيم کارت KI (Individual Subscriber Authentication Key)

9

INTERNATIONAL MOBILE SUBSCRIBER IDENTITY (IMSI)( )

The IMSI is a unique identifying code allocated to each subscriberallowing correct identification over the radio path and through theallowing correct identification over the radio path and through theWCDMA Systems PLMN network.It is used for all identification signaling in the PLMN and all network‐related subscriber information is connected to itrelated subscriber information is connected to it.The IMSI is stored in the UMTS Subscriber Identity Module (USIM), aswell as in the HLR and the VLR.It consists of three different partsIt consists of three different parts

IMSI = MCC + MNC + MSINMCC = Mobile Country CodeMNC M bil N t k C dMNC = Mobile Network CodeMSIN = Mobile Subscriber Identification NumberAccording to the WCDMA specifications, IMSI can have a maximum length of 15 digitsdigits.

Examples: IMSI = 432 20 XXXXXXXXXX

10

MOBILE STATION ISDN NUMBER (MSISDN)MOBILE STATION ISDN NUMBER (MSISDN)

The MSISDN is a number that uniquely identifies a mobile telephone b i i i hi h P bli S i h d T l h N k (PSTN)subscription within the Public Switched Telephony Network (PSTN) 

numbering plan.In WCDMA Systems the MSISDN is composed of :

MSISDN = CC + NDC + SNCC    = Country CodeNDC N ti l D ti ti C dNDC = National Destination CodeSN = Subscriber Number

Examples: MSISDN = +98 920 XXXXXXX

11

12

TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI)TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI)

The TMSI can be used to keep subscriber information confidentialon the air interface. It also increases paging capacity, as the lengthof the TMSI is shorter than the length of the IMSI.The TMSI is relevant on the local MSC/VLR level only and is changed / y gat certain events or time intervals. Each local operator can define his own TMSI structure.The TMSI should not consist of more than four octets when usedThe TMSI should not consist of more than four octets when usedwithin a Location Area (LA), for example, for paging. When a cellwithin  a  new  Location  Area  (LA)  is  entered,  the  Location  Area Identity (LAI) must be added to the four octets to perform a locationIdentity (LAI) must be added to the four octets to perform a location update.

13

LOCATION AREA IDENTITY (LAI)

Th LAI d f i i di t t th MSC i hi hThe LAI, used for paging, indicates to the MSC in whichlocation area the UE is operating. It is also used forlocation updating of mobile subscribers.The LAI contains the following:

LAI = MCC + MNC + LACMCC = Mobile Country Code Identical to IMSI MCCMCC = Mobile Country Code Identical to IMSI MCCMNC = Mobile Network Code Identical to IMSI MNCLAC = Location Area CodeThe maximum length of LAC is 16 bits, enabling 65,536different location areas to be defined in one PLMN.ROUTING AREA IDENTITY (RAI)( )The Routing Area Identity is exactly the same as theLocation Area Identity (LAI).

RAI = MCC + MNC + LACRAI = MCC + MNC + LAC

14

INTERNATIONAL MOBILE EQUIPMENT IDENTITY (IMEI)The IMEI uniquely identifies User Equipment (UE) as a piece or assembly ofequipment. Using the IMEI stolen or not type approved, mobiles causingsevere malfunctions can be barred. The IMEI consists of 15 digits.Th IMEI i f h f ll iThe IMEI consists of the following:

IMEI = TAC + FAC + SNR + spTAC = Type Approval CodeDetermined by a central WCDMA body, TAC identifies the type of equipment.FAC = Final Assembly CodeFAC = Final Assembly CodeThe FAC identifies the manufacturer of the equipmentSNR = Serial Number,Th SNR i i di id l i l b f i di it hi h i l id tifi llThe SNR is an individual serial number of six digits which uniquely identifies allequipment within each TAC and FAC.sp = spare part for future use; this digit should always be zero whenit is transmitted by the UE.Example:IMEI=357,087,008,609,717 (USSD= *#06#)

15

MOBILE STATION ROAMING NUMBER (MSRN)

When a mobile terminating call is to be set up, the HLR of the calledg p,subscriber requests the current MSC/VLR to allocate a MSRN to thecalled subscriber. This MSRN is returned via the HLR to the GMSC. TheGMSC routes the call to the MSC/VLR exchange where the calledGMSC routes the call to the MSC/VLR exchange where the calledsubscriber is currently registered. The routing is done using the MSRN.When the routing is completed, the MSRN is released.The MSRN is built up like an MSISDNThe MSRN is built up like an MSISDN.In WCDMA Systems, the MSRN is composed of the following:

S N CC N C SNMSRN = CC + NDC + SNCC = Country CodeNDC = National Destination CodeNDC = National Destination CodeSN = Subscriber Number

16

2G Mobile terminating call e.g. from PSTN

1 Th di li i f ti i i d b PSTN i ISUP i th PLMN t1- The dialing information is received by PSTN e.g. via ISUP in the PLMN gatewayMSC The dialing information is converted in the gateway MSC.2- A so-called "interrogation" is started as a response; i.e. a MAP message is sent tothe HLR in order to obtain location specific routing information The HLR knowsthe HLR in order to obtain location-specific routing information. The HLR knowsthe location routing label i.e. the MSC/VLR by the "location update" and relays thequery there.3- The MSC/VLR makes a temporary directory number available and sends it back3- The MSC/VLR makes a temporary directory number available and sends it backvia the HLR to the gateway MSC.4- The gateway MSC converts this temporary directory number and sets up a circuitconnection (ISUP) to the visited MSC. The location area is specified in the MSC/connection (ISUP) to the visited MSC. The location area is specified in the MSC/VLR owing to the cross-connection between temporary directory number andmobile subscriber.5- The visited MSC now sends a "paging" to all BSCs situated in the location area.p g gThe BSC in which the subscriber is currently situated answers with a "pagingresponse".6- The MSC makes the connection to the called subscriber.

17

MSISDN IMSIIMSI MSC AddressMSC Address

22 MSISDNMSISDN

PSTNPSTN GMSCHLR

11-- MSISDNMSISDN22-- MSISDNMSISDN

55-- MSRNMSRN

33--II

44--MM IMSI

IMSI

MSR

NM

SRN

MSC/VLR

77--PagingPaging 18

GSM Network EvolutionGSM Network Evolution

GSM GPRS EDGE

19

Basic GSM network

20

GSM & Value Added Service21

22

HSCSD (High Speed Circuit Switched Data), 23

SGSN (Serving GPRS Support Node)GGSN (Gateway GPRS Support Node)GGSN (Gateway GPRS Support Node) 

24

Increasing speed with EDGE25

26

RAN CNRANRadio Access Network

CNCore Network

CS DomainGSM BSS

ExternalN t k

GSM BSS

NetworksEntities common

to the CS & PS Domain

PS D iUTRANUE

PS Domain

UMTS(Universal Mobile Telecommunications System) 27

UMTS Network EvolutionUMTS Network Evolution

• 3GPP defining migration from GSM to UMTS (W• 3GPP defining migration from GSM to UMTS (W‐CDMA)– Core network evolves from GSM‐only to support GSM,Core network evolves from GSM only to support GSM, GPRS and new W‐CDMA facilities

• 3GPP Release 99Add 3G di– Adds 3G radios

• 3GPP Release 4Adds softswitch/ voice gateways and packet core– Adds softswitch/ voice gateways and packet core

• 3GPP Release 5– First IP Multimedia Services (IMS) w/ SIP & QoSFirst IP Multimedia Services (IMS) w/ SIP & QoS

• 3GPP Release 6– “All IP” network; contents of r6 still being defined

28

3G R l 99 A hit t (UMTS) 3G R di3G Rel.99 Architecture (UMTS) ‐3G Radios

CN2G MS (voice only)

BSS

PSTNAbis

B

AE PSTN

SS7BTS

BSC MSCVLR

GMSCCD

Gs

B

H2G+ MS (voice & data)

Gb

IuCS

HLR AuC

PSDN

GcGr

Gn Gi

RNS

Iub

IuCS

ATM

IuPS

IPSGSN GGSN

PSDN

3G UE (voice & data)

Node B

RNC

BSS — Base Station SystemBTS — Base Transceiver StationBSC —Base Station Controller

RNS — Radio Network SystemRNC —Radio Network Controller

CN — Core NetworkMSC —Mobile‐service Switching ControllerVLR —Visitor Location RegisterHLR —Home Location RegisterAuC— Authentication ServerGMSC —Gateway MSC

SGSN — Serving GPRS Support NodeGGSN —Gateway GPRS Support Node

UMTS —Universal Mobile Telecommunication System

29

3G R l 4 A hit t (UMTS) S ft S it hi3G Rel.4 Architecture (UMTS) — Soft Switching

CN2G MS (voice only)

BSS

PSTNAbis

B

A Nc

Mc

CS‐MGW

CS‐MGWNb

PSTNMc

SS7BTS

BSC MSC ServerVLR

GMSC serverCDGb

Gs

B

H2G+ MS (voice & data) IuCS

IP/ATMHLR AuC

PSDN

GcGr

Gn Gi

( )

RNS

Iub

IuCS

IuPS

ATM

SGSN GGSN

PSDN

BSS — Base Station System CN — Core Network SGSN — Serving GPRS Support Node

Node B

RNC

3G UE (voice & data)y

BTS — Base Transceiver StationBSC —Base Station Controller

RNS — Radio Network SystemRNC —Radio Network Controller

MSC —Mobile‐service Switching ControllerVLR —Visitor Location RegisterHLR —Home Location RegisterAuC— Authentication ServerGMSC —Gateway MSC

g ppGGSN —Gateway GPRS Support Node

30

UMTS Release 99 Core Network

CN (Core Network)RANcircuit switched (CS) domain

GMSC/VLR GMSC PSTN/

S

Common CS & PS

GERAN ISDN

Common CS & PSnetwork elementHLREIR ACCSE

UTRAN GGSNSGSNPDNIP-

backbone

packet switched (PS) domain WAPbackbone

CGBG

BillingCentre

Inter-PLMNNetwork

31

32

3G R99 Networking

33

Difference between 3G R4 and 3G R99 

34

Huawei mobile softswitch solution 

GGSN: Gateway GPRS Support Nodey ppHLR: Home Location RegisterMGW: Media GatewayMSC server: Mobile Switching Center ServerCN: Core NetworkCS: Circuit Switched domainSGSN: Serving GPRS Support NodePS: Packet Switched domainPSTN: Public Switched Telephone NetworkpUTRAN: UMTS Terrestrial Radio Access NetworkBSS: Base Station SubsystemVoBB:Voice over broadband.

UMTS CN Release 4

35

UMTS CN Release 4 CS Domain

Applications and Services

CAPCAP (G )MSC Server:Call Control

LevelHLRCD

PS DomainunchangedPS Domainunchanged

(G‐)MSC Server:• Call Control•Mobility Management•MGW Control• VLR functionality

MSCServer

GMSCServer

Nc (e.g. BICC)

CDunchanged compared to R`99

unchanged compared to R`99

• CDRs• (HLR‐Interrogation)

Bearer LevelGERAN

Mc (H.248/MEGACO)Mc (H.248/MEGACOA

Iu

PSTN/ISDN

CS‐MGW

CS‐MGWUTRAN

Nb (e.g. ATM, IP)Iu

A

MEGACO: Media Gateway Control protocolH 248: ITU protocol for Media Gateway Control

MGW:• Bearer Control• Transmission Resource Management• Data Format Conversion TranscodingCDR: Call Data Records

BICC: Bearer Independent Call Control H.248: ITU protocol for Media Gateway ControlBICC: Bearer Independent Call ControlMGW: Media Gateway

36

Separation of planes (MSC Server System)

MSC Server System separates call control & signaling and traffic in two separate network elements:

• MSC Server

• Multimedia Gateway (MGW)Multimedia Gateway (MGW)

SC S S

MSC Server Control & SignallingControl &MSC

MSC Server System

MSC Server Control & Signalling

Speech & DataMGWTraditionalMobile Switch

Control & Signalling

Speech & Data

37

Layered Core Network Model Showing the Logical Network NodesLayered Core Network Model Showing the Logical Network Nodes

38

Benefit of the solutionBenefit of the solutionThe MSC Server System saves transmission costs by local switching when the call is managed by a single local MGWswitching when the call is managed by a single, local MGW.

39

The benefits with a layered architecture are many:• Reduced traffic load in the backbone network throughgremote switching with the M‐MGw close to the localtraffic. As much as 70% of the total traffic could be localwhich could be routed within the M‐MGw instead ofentering the backbone network; therefore, significantg gsavings in transmission can be achieved.

40

CORE NETWORK NODES

3GMSC

RNCCore NetworkRadio Access

HLR AuCEIR

Service Information

HLR/AC

3GSGSN GGSN

3GMSC

EIRSupplementary Services Location Updating

HLR/AC

The HLR is a centralized3GMSC

Locating the Subscriber

The HLR is a centralized database, which contains information about the subscriber location and

RNC

MSC

Foreign Network

subscriber, location and service information. Authentication information i l t d i th HLR

3GSGSN

GGSN

is also stored in the HLR.41

HLR & AuC

MSC /

CS Domain• Subscriber Registration• Storing/Managementsubscriber profiles• Deliver profiles to VLR/SGSN • Storing „secret Keys“

(counterpart USIM) &GMSCMSC /VLR

C

p /• Storing Location Information• (VLR / SGSN)• MTC: Deliver Routinginformation to GMSC / GGSN• Associated with AuC

(counterpart: USIM) &Security Algorithm• Generating Security Parameter(GSM: Triples; UMTS: Quintets)• Deliver Parameter to VLR / SGSN (via HLR)D

HLR AuC

C• Associated with HLR

D

Gr Gc

GGSNSGSN

PS Domain•BS: Bearer Service•TS: Tele Service•SS: Supplementary Service•CSI: CAMEL Subscription Information

Subscriber data (Examples):• Semi‐permanent Data: MSISDN, IMSI, Services (BS, TS, SS), QoS Profile, CSI, Service Restrictions,..

• Temporary Data: VLR / SGSN address

•CSI: CAMEL Subscription Information•QoS: Quality of Service•IMSI: International Mobile Subscriber Identity•MSISDN: Mobile Station ISDN Number•MSRN: Mobile Station Roaming Number

• Temporary Data: VLR / SGSN address,MS Non‐Reachable flag, MSRN, SMS flags,..

42

43

BSG: Broadband Signaling GatewayCCU: Call Control UnitDBMS: Database Management SystemDRU: Data Routing Unit

Logical structure of the HLR9820 

DRU: Data Routing UnitDSU: Data Service UnitNMS: Network Management SystemPGW: Provisioning Gateway OMU: Operation and Maintenance Unitp

44

Authentication Center AuCAuthentication Center AuCThe AuC is responsible to store the secret Keys of the subscribers and thesecurity algorithm, which are necessary for the generation of the GSM and

f h l h hUMTS security parameters. On request of the VLR respectively the SGSN theAuC generates the security parameters. They are delivered via HLR to VLR /SGSN to enable Authentication, Ciphering and Integrity Check.The AuC is always associated with an HLR (communication via a proprietaryinterface).

45

46

Interfaces of 3G-SGSN

Gn 3G Core NetworkIu Gn 3G Core Network

(HPLMN)

IuRNC

3G SGSN3G SGSN3G SGSN

GrHLR & AUC

Gp3G Core Network

(VPLMN) 3G SGSNGf

EIR

( )

NMS

Gd

EIRNMS

GaSMSCCG

47

Logical structure of the SGSN9810 

48

49

50

Huawei mobile MSC Server solution 

The MSOFTX3000 provided by Huawei serves as an MSC server

51

52

53

VMSC Networking & GMSC Networking

54

TMSC Networking

55

GMSC/VMSC/TMSC Combined Networking56

MSC Pool Networking

57

MainVLR

Visitor Location Register VLRtasks:

• storing Subscriber profilesFor all UEs in MSC Area

SC “ •Mobility Management• storing Location Information• controllingSecurity Features*

VLR as „MSCs Data Base“:• Subscriber Profile,e.g. IMSI, MSISDN, 

Services (TS, BS, SS),..• Temporary Subscriber Datap ye.g. LMSI, TMSI, MSRN, 

Security Parameter, Location Information, IMSI attach/detach,..

VLRB VLRMSC

B

* e.g. Authentication, Authorization, Cipher & Integrity Start

D• Location Updates (Subscriber Profiles  VLR)• Security Parameter  (via HLR  VLR)• Interrogation (MSRN via HLR to GMSC)

• Location Updates (Subscriber Profiles  VLR)• Security Parameter  (via HLR  VLR)• Interrogation (MSRN via HLR to GMSC) HLR AuC

•TS: Tele Services•BS: Bearer Services•SS: Supplementary Services

•IMSI: International Mobile Subscriber Identity•LMSI: Local Mobile Subscriber Identity•TMSI: Temporary Mobile Subscriber Identity

•MSRN: Mobile Station Roaming Numberp y y

58

59

SMS‐GMSC & SMS‐IWMSC

MSC /CSAll d i d

ExternalNetworksMSC /

VLRDomain

E

All or some designatedMSCs can act as

SMS‐GMSC/IWMSC(Network operator

dependent)

Networks

E

SM‐SCSMS‐GMSC

dependent)

SM SCShort MessageService Center

SMS Gateway MSC

SMS‐IWMSCSMS Interworking MSC

PS

Gd

SGSNPSDomain

60

61

Mobility Management proceduresMobility Management procedures• Location Registration (Circuit and Packet Switched)

• Location Update (Circuit Switched)• Location Update (Circuit Switched)

• IMSI Attach/Detach (Circuit Switched)

• Routing Area Update (Packet Switched)g p ( )

• Cell Attach/Detach (Packet Switched)

• Location Info Retrieval (Circuit and Packet Switched)

• Paging (Circuit Switched)

• Paging (Packet Switched)

• Authentication Procedure (Circuit/Packet Switched)

• Ciphering Procedure (Circuit/Packet Switched)

UE Id tit Ch ki (Ci it/P k t S it h d)• UE Identity Checking (Circuit/Packet Switched)

• UE Hardware (IMEI) Checking (Circuit/Packet Switched)

62

Functions of 2G/3G Authentication

The network and an MS can perform validity verification on each other.

63

MGW

SIEMENS SIEMENS

NodeB

RNCRNC

Confidentiality

Service Protection

64

Authenticationut e t cat oThe rand is relayed to the mobile station. This generates the SRES withthe help of the parameter Ki stored on the SIM card and A3 (SRES =A3(kirand)) The SRES is sent back to the MSC/VLR and there compared with,rand)). The SRES is sent back to the MSC/VLR and there compared withthe SRES of the triple. If both SRES are the same, the authentication issuccessful. If they are different, the SIM card is rejected, An authenticationi f d h MS i iti t i t h llis performed when an MS initiates a service request, such as a call,location update, and activation of a supplementary service. and onlyemergency calls are possible depending on the project.CipheringFor the ciphering, the rand is also used in the MS. The key kc is generated(Kc =A8(Ki, Rand)) with the help of the parameter ki stored on the SIM card(Kc A8(Ki, Rand)) with the help of the parameter ki stored on the SIM cardand A8.The ciphering is thereupon carried out with the algorithm 5 stored in themobile equipment and the key kcmobile equipment and the key kc.The key kc contained in the triple is meanwhile relayed to the BSS. Thealgorithm A5 is also available here, so that the ciphering can be carried outhere as ellhere as well.

65

2G Authentication

SRES =Signed Response66

2G Ciphering

67

Relation Between the 2G Authentication Parameters68

2G User Confidentiality (privacy):

Methods for ensuring user confidentiality are used both in the mobile station and ing ythe network. The mobile station secures itself against misuse by asking for a four digitPersonal  Identification Number  (PIN) when  the MS  is  switched  on.  The  PIN  code  is permanently stored in the SIM card Only when the PIN entered by the subscriber ispermanently stored  in the SIM card. Only when  the PIN entered by  the subscriber  is correct, the MS is unlocked and ready for use.On  the network  side,  sensitive  signaling  information  (IMEI,  IMSI, directory numbers, etc ) is not allowed to be transmitted over the air interface before the encryptionetc.)  is  not  allowed  to  be  transmitted  over  the  air  interface  before  the  encryption process between MS and BTS is initiated. The  subscriber  is  identified  by means  of  a  temporarily  allocated  Temporary Mobile S b ib Id i (TMSI) b f h i i d Th TMSI iSubscriber  Identity  (TMSI)  before  the  encryption  process  is  started.  The  TMSI  is allocated  by  the  network  after  a  successful  first  time  location  update,  and  is reallocated  (renewed)  after  every  successful  authentication  verification. When  the mobile station  is switched off,  the current TMSI  is stored  in  the SIM and  is available when the MS is switched on again.

69

70

71

72

73

74

EIR:Equipment Identity Register

• Storing IMEIs(counterpart: ME)on White / Gray / Black List• Performing IMEI Checkon VLR / SGSN request• optional network functionMSC /

CS Domainp

VLR

F

EIR

Gf

SGSNInternational  Mobile stationEquipment  Identity (IMEI)

PS Domainq p y ( )

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

UMTS Authentication ParametersUMTS Authentication ParametersAuthentication QuintupleRANDThe RAND is a random number provided by the network for a UE. The UE uses theRAND to generate the authentication response RES or RES+RES_EXT, IK, and CK. TheRAND has 16 bytes.AUTNThe AUTN is sent to a UE for authenticating the network. The AUTN has 16 bytes.XRESThe XRES is the authentication response expected from the UE. If the RES orRES+RES_EXT generated by the UE is the same as the XRES, the authentication ispassed The XRES has 4 to 16 bytespassed. The XRES has 4 to 16 bytes.CKThe CK is the UMTS cipher key in a UMTS network. The CK has 16 bytes.IKIKThe IK is the integrity key in a UMTS network. The IK has 16 bytes.

93

h d dAuthentication Parameters Stored on a USIM CardIMSIKIA th ti ti d ti l ith (f1 f2 f3 f4 f5 f1* f5* UIE d UIA) OP OPAuthentication and encryption algorithms (f1, f2, f3, f4, f5, f1*, f5*, UIE, and UIA) OP or OPcSQNMS

Authentication Parameters Stored on the HLR/AuCAuthentication Parameters Stored on the HLR/AuCIMSIKIK4K4CKSN

Authentication and encryption algorithms (f1, f2, f3, f4, f5, f1*, and f5*)Authentication and encryption algorithms (f1, f2, f3, f4, f5, f1 , and f5 )AMFOP or OPcSQNHEQ HE

94

Relation Between the 3G Authentication Parameters

95

EIR:Equipment Identity Register

• Storing IMEIs(counterpart: ME)on White / Gray / Black List• Performing IMEI Checkon VLR / SGSN request• optional network functionMSC /

CS Domainp

VLR

F

EIR

Gf

SGSNInternational  Mobile stationEquipment  Identity (IMEI)

PS Domainq p y ( )

96

Equipment Identity Register EIRThe EIR is an optional feature in GSM and UMTS. It has been defined to enable theftThe EIR is an optional feature in GSM and UMTS. It has been defined to enable theftprophylaxis. Stolen or non‐valid Mobile Equipment ME can be blocked from furtherusage.The Equipment Identity Register EIR is the logical entity, which is responsible forq p y g g y, pstoring in the network the International Mobile Equipment Identities IMEIs (TS23.002). An IMEI clearly identifies a unique Mobile Equipment ME and containsinformation about the place of manufacture, device type and the serial number of theequipment.The Mobile Equipment ME is classified as "white listed", "grey listed", "black listed" orit may be unknown as specified in TS 22.016 and TS 29.002.The EIR performs IMEI Checks on VLR respectively SGSN request to check whetherthe ME is stolen or non‐valid.The EIR is connected to:

• The SGSN via Gf interface• The VLR via F interface

97

Short Message Services

98

SIEMENS SIEMENS SIEMENS SIEMENS1

2

MSC VLR1

5

3

5

SIEMENS SIEMENS

InterworkingMSC

3

MSC function(MAPMSC) usuallyI t t d i th(SMMO) Short message

5

Integrated in theSMS‐Center itself

(SMMO) Short message mobile origination

PBX

45‐Delivery report

PBX

SMSCenter

99

1‐BMSISDN+SMS2‐Interrogate HLR(BMSISDN+SMSC)

(SMMT) Short message mobile termination

3‐MSCID+BIMSI4‐IMSI+SMS+SMSC5,6‐Checking IMSI7 P i7‐Paging8‐SMS to MS

100

Location  Update

101

Location UpdatingLocation Updating…

LA-1 Location update is performed when there is a boundary crossing

LA-2

is a boundary crossing.

No location update

Location update

102

Location Update

In practice, there are three types of location updates:1. Location Registration (Power On)

Location Update 

g ( )2. Generic3. Periodic

Location registration:• takes place when a mobile station is turned on. This is also known as IMSI Attach

because as soon as the mobile station is switched on, it informs the Visitor LocationRegister(VLR)that it is now back in service and is able to receive calls As a result of aRegister(VLR)that it is now back in service and is able to receive calls. As a result of asuccessful registration, the network sends the mobile station two numbers that arestored in the SIM(Subscriber Identity Module)card of the mobile station.

Generic:• Every time the mobile receives data through the control channels, it reads the LAI

and compares it with the LAI stored in its SIM card. A Generic location update isperformed if they are different. The mobile starts a location Update process byaccessing the MSC/VLR that sent the location data.accessing the MSC/VLR that sent the location data.

Periodic:• Periodic Location Update is carried out when the network does not receive any

location update request from the mobile in a specified time.p q p

103

104

Handover/Relocation

105

Handover…

• Handover is the means of maintaining a call when a user movesoutside the coverage area of the serving celloutside the coverage area of the serving cell.

• The call must be switched to an alternative cell to provide service,automatically and without loss of service.

• Handover is a complex process requiring synchronisation of eventsbetween the mobile station and the network.

• In particular, there is the need to route the call to the new cell beforehandover can be effected whilst maintaining the old connection untilthe new connection is known to have succeeded.the new connection is known to have succeeded.

• Handover is a time critical process requiring action to be taken beforethe existing radio link degrades to such an extent that the call is lost.

106

Handover…

107

Intra‐cell HandoverIntra‐cell Handover

BTS BTS

108

Inter‐cell Intra‐BSC HandoverInter cell Intra BSC Handover

ا ل ل ك ا ا ك مشترك سياراز محدوده يك سلول خارج مي شود•به مشترك يك كانال فركانس راديوئي جديد داده مي شود•كنترل مي شود BSC/RNCاين عمل توسط •

BSC/BSC/

و ل وين ي رلكانالي كه قبال مورد استفاده قرار داشت آماده اختصاص به يك مشترك جديد •

استRNCRNC

BTSBTSNodeBNodeB

BTSBTSNodeBNodeB

109

Inter‐BSC/RNC Intra‐MSC Handover

MSCMSCVLR

BSCBSC

BBTTSS

BSCBSC

BBTTSS

BBTT

BBTTSS

BBTTSS

SS

BBTTSS

BBTTSS

BBTT

BBTTSS

SS

TTSS

110

Inter‐BSC/RNC Inter‐MSC Handover 

BSCBSC

MSC1MSC1VLRBB

TTSS

BBTTSS

BBTT

MSC2MSC2VLR

TTSS

BBTTSS

BSCBSCBBTTSS

BBTTSS

BBTT

BBTTSS

SSBBTTSS

111