
2/111

2


3/111

3


4/111

GSM Network Areas...

MSC / VLR Area

Location Area

e

4


5/111


u c an o e e wor

5


6/111


MSC/VLR Service Area:

6


7/111

...

:

MSC/VLR Service Area : . Location U date . . Paging Location Area .

7


8/111

GSM Network Areas...Cell: Location Area Cell Cell.

)(CGI .

(BSIC) Cell .

CGI : Cell

Global

ID

BSIC : Basic Station Identity Code 8


9/111

Addressing and Numbering plan

IMSI (International Mobile Station Identity) TMSI (Temporary Mobile Station Identity)

ersona en y um er

PUK (Personal Unblocking Key) PIN

KI (Individual Subscriber Authentication Key)

9


10/111

INTERNATIONAL MOBILE SUBSCRIBER IDENTITY IMSI

The IMSI is a unique identifying code allocated to each subscriberallowin correct identification over the radio ath and throu h theWCDMA Systems PLMN network.

It is used for all identification signaling in the PLMN and all network

.The IMSI is stored in the UMTS Subscriber Identity Module (USIM), aswell as in the HLR and the VLR.

cons s s o ree eren par sIMSI = MCC + MNC + MSIN

MCC = Mobile Country Code= o e e wor o e

MSIN = Mobile Subscriber Identification Number

According to

the

WCDMA

specifications,

IMSI

can

have

a maximum

length

of

15

.

Examples: IMSI = 432 20 XXXXXXXXXX

10


11/111

The MSISDN is a number that uniquely identifies a mobile telephone su scr pt on w t n t e Pu c Sw tc e Te ep ony Networ PSTN numbering plan.In WCDMA Systems the MSISDN is composed of :

MSISDN = CC + NDC + SNCC = Country Code

= a ona es na on o eSN = Subscriber Number

Examples: MSISDN = +98 920 XXXXXXX

11


12/111

12


13/111

The TMSI can be used to keep subscriber information confidentialon the air interface. It also increases paging capacity, as the lengthof the TMSI is shorter than the length of the IMSI.The TMSI is relevant on the local MSC/VLR level only and is changed

at certain events or time intervals. Each local operator can define his own TMSI structure.

within a Location Area (LA), for example, for paging. When a cellwithin a new Location Area (LA) is entered, the Location Area

update.

13


14/111

LOCATION AREA IDENTITY (LAI)

e , use or pag ng, n ca es o e n w clocation area the UE is operating. It is also used for

location updating of mobile subscribers.The LAI contains the following:

LAI = MCC + MNC + LAC

MNC = Mobile Network Code Identical to IMSI MNCLAC = Location Area CodeThe maximum length of LAC is 16 bits, enabling 65,536different location areas to be defined in one PLMN.

ROUTING AREA IDENTITY RAIThe Routing Area Identity is exactly the same as theLocation Area Identity (LAI).

14


15/111

INTERNATIONAL MOBILE EQUIPMENT IDENTITY (IMEI)The IMEI uniquely identifies User Equipment (UE) as a piece or assembly of equipment. Using the IMEI stolen or not type approved, mobiles causingsevere malfunctions can be barred. The IMEI consists of 15 digits.

e cons sts o t e o ow ng:

IMEI = TAC + FAC + SNR + spTAC= Type Approval CodeDetermined by a central WCDMA body, TAC identifies the type of equipment.

The FAC identifies the manufacturer of the equipmentSNR = Serial Number,

e s an n v ua ser a num er o s x g s w c un que y en es aequipment within each TAC and FAC.

sp = spare part for future use; this digit should always be zero whenit is transmitted by the UE.Example:IMEI= 357,087,008,609,717 (USSD= *#06#)

15


16/111


17/111

2G Mobile terminating call e.g. from PSTN

- e a ng n orma on s rece ve y e.g. v a n e ga ewayMSC The dialing information is converted in the gateway MSC.

2- A so-called "interrogation" is started as a response; i.e. a MAP message is sent to - .the location routing label i.e. the MSC/VLR by the "location update" and relays thequery there.

via the HLR to the gateway MSC.4- The gateway MSC converts this temporary directory number and sets up a circuit

VLR owing to the cross-connection between temporary directory number andmobile subscriber.5- The visited MSC now sends a " a in " to all BSCs situated in the location area.The BSC in which the subscriber is currently situated answers with a "pagingresponse".6- The MSC makes the connection to the called subscriber.

17


18/111

MSISDN IMSIIMSI MSC AddressMSC Address

PSTNPSTN GMSCHLR

11-- MSISDNMSISDN--

55-- MSRNMSRN

3 3 --4 4 --M

S I

M S I

S R N S R N

MSC/VLR

77--PagingPaging 18


19/111

GSM GPRS EDGE

19


20/111

Basic GSM network

20


21/111

GSM & Value Added Service21


22/111

22


23/111

HSCSD (High Speed Circuit Switched Data), 23


24/111

SGSN (Serving GPRS Support Node)GGSN Gatewa GPRS Su ort Node

24


25/111

Increasing speed with EDGE 25


26/111

26


27/111

Radio Access Network Core Network

CS Domain

External

e wor sEntities common

to the CS & PS Domain

UTRANUE

oma n

UMTS(Universal Mobile Telecommunications System) 27


28/111

CDMA) Core network evolves from GSM onl to su ort GSM

GPRS and new WCDMA facilities 3GPP Release 99

s ra os 3GPP Release 4

3GPP Release 5

First IP Multimedia Services IMS w SIP & oS 3GPP Release 6

All IP network; contents of r6 still being defined

28


29/111

e .

rc ec ure

a os

CN2G MS (voice only)

BSS

PSTNAbisA

E PSTN

SS7BTS

BSC MSCVLR

GMSCCDGs

H2G+ MS (voice & data)

Gb

HLR AuC GcGr

Gn Gi

RNS

IubATM

IuPS

IPSGSN GGSN

3G UE (voice & data)

Node B

RNC

BSS Base Station SystemBTS Base Transceiver StationBSC Base Station Controller

RNS Radio Network SystemRNC Radio Network Controller

CN Core Network MSC Mobile service Switching ControllerVLR Visitor Location RegisterHLR Home Location RegisterAuC Authentication ServerGMSC Gateway MSC

SGSN Serving GPRS Support NodeGGSN Gateway GPRS Support Node

UMTS Universal Mobile Telecommunication System

29


30/111

e . rc ec ure o w c ng

CN2G MS (voice only)

BSS

PSTNAbis A NcMc

CSMGW

CSMGWNb

PSTNMc

SS7BTS

BSC MSC ServerVLR

GMSC serverCDGbGs

H2G+ MS (voice & data)

IP/ATMHLR AuC GcGr

Gn Gi

RNS

Iub IuPS

ATM

SGSN GGSN

BSS Base Station S stem CN Core Network SGSN Servin GPRS Su ort Node

Node B

RNC

3G UE (voice & data)

BTS Base Transceiver StationBSC Base Station Controller

RNS Radio Network SystemRNC Radio Network Controller

MSC Mobile service Switching ControllerVLR Visitor Location RegisterHLR Home Location RegisterAuC Authentication ServerGMSC Gateway MSC

GGSN Gateway GPRS Support Node

30


31/111

UMTS Release 99 Core Network

CN (Core Network)RAN

circuit switched (CS) domain

MSC/VLR GMSC PSTN/GERAN ISDN

network elementHLREIR ACCSE

UTRAN GGSNSGSNPDN

IP-

packet switched (PS) domain WAPCGBG

BillingCentre

Inter-PLMN

Network 31


32/111

32


33/111

3G R99 Networking

33


34/111

Difference between 3G R4 and 3G R99

34


35/111

Huawei mobile softswitch solution

GGSN: Gatewa GPRS Su ort NodeHLR: Home Location RegisterMGW: Media GatewayMSC server: Mobile Switching Center ServerCN: Core NetworkCS: Circuit Switched domainSGSN: Serving GPRS Support NodePS: Packet Switched domainPSTN: Public Switched Tele hone NetworkUTRAN: UMTS Terrestrial Radio Access NetworkBSS: Base Station SubsystemVoBB:Voice over broadband.

UMTS CN Release 4

35

UMTS CN R l 4 CS D i


36/111

UMTS CN Release 4 CS DomainApplications and Services

CAPCAP

Call ControlLevelHLR

PS DomainPS Domain

Call Control Mobility Management MGW Control VLR functionality

MSCServer

GMSCServer

Nc (e.g. BICC)

compared to R`99

compared to R`99

CDRs (HLRInterrogation)

Bearer LevelGERAN

Mc (H.248/MEGACO)Mc (H.248/MEGACOA

Iu

PSTN/ISDN

CSMGW

CSMGWUTRAN

Nb (e.g. ATM, IP)Iu

A

MEGACO: Media Gateway Control protocol

MGW: Bearer Control Transmission Resource Management Data Format Conversion TranscodingCDR: Call Data Records

. MGW: Media Gateway

36


37/111

Separation of planes ( MSC Server System )

MSC Server System separates call control & signaling and traffic in twoseparate network elements:

MSC Server

Control &

MSC

MSC Server System

Speech & DataMGW

TraditionalMobile Switch

Signalling

Speech & Data

37


38/111

38


39/111

The MSC Server System saves transmission costs by local

, .

39


40/111

The benefits with a layered architecture are many:

Reduced traffic load in the backbone network throu hremote switching with the M MGw close to the localtraffic. As much as 70% of the total traffic could be local

which could be routed within the M MGw instead of entering the backbone network; therefore, significantsavings in transmission can be achieved.

40


41/111

CORE NETWORK NODES

3GMSC

RNCCore NetworkRadio Access

HLR

AuC Service Information

3GSGSN GGSN

3GMSC

Supplementary Services Location Updating

3G

Locating the Subscriber

database, which containsinformation about the

RNCForeign Network

,service information.

Authentication information

3GSGSN

GGSN

s a so store n t e .

41

HLR& A C


42/111

HLR & AuC

CS Domain Subscriber Registration Storing/Managementsubscriber profiles

Deliver rofiles to VLR/SGSN Storing secret Keys

GMSCVLR Storing Location Information

(VLR / SGSN) MTC: Deliver Routinginformation to GMSC / GGSN

Associated with AuC

: Security Algorithm

Generating Security Parameter(GSM: Triples; UMTS: Quintets)

Deliver Parameter to VLR / SGSN (via HLR)

HLR AuC

Associated with HLR

Gr Gc

GGSNSGSN

PS Domain

BS: Bearer ServiceTS: Tele ServiceSS: Supplementary Service

Subscriber data (Examples): Semi permanent Data: MSISDN, IMSI, Services

(BS, TS, SS), QoS Profile, CSI, Service Restrictions,..

QoS: Quality of ServiceIMSI: International Mobile Subscriber IdentityMSISDN: Mobile Station ISDN NumberMSRN: Mobile Station Roaming Number

,MS Non Reachable flag, MSRN, SMS flags ,..

42


43/111

43


44/111

BSG: Broadband Signaling GatewayCCU: Call Control UnitDBMS: Database Management System

DRU: Data Routin Unit

Logical structure of the HLR9820 DSU: Data Service UnitNMS: Network Management SystemPGW: Provisioning Gateway OMU: O eration and Maintenance Unit

44


45/111

The AuC is responsible to store the secret Keys of the subscribers and thesecurity algorithm, which are necessary for the generation of the GSM andUMTS security parameters. On request o t e VLR respective y t e SGSN t eAuC generates the security parameters. They are delivered via HLR to VLR /

SGSN to enable Authentication, Ciphering and Integrity Check.The AuC is always associated with an HLR (communication via a proprietaryinterface).

45


46/111

46


47/111

Interfaces of 3G-SGSN

(HPLMN)

RNC

3G SGSN3G SGSNGr

HLR & AUCGp3G Core Network

VPLMN

Gf

GdGa SMSCCG

47


48/111

Logical structure of the SGSN9810

48


49/111

49


50/111

50


51/111

Huawei mobile MSC Server solution

The MSOFTX3000 provided by Huawei serves as an MSC server

51


52/111

52


53/111

53


54/111

VMSC Networking & GMSC Networking

54


55/111

TMSC Networking

55


56/111

GMSC/VMSC/TMSC Combined Networking56


57/111

MSC Pool Networking

57

MainVLR

Visitor Location Register VLR


58/111

VLRtasks:

storing Subscriber profilesFor all UEs in MSC Area

Mobility Management storing Location Information controlling

Security Features*

VLR as MSCs Data Base : Subscriber Profile,

e.g. IMSI, MSISDN, Services (TS, BS, SS),..

Temporary Subscriber Datae.g. LMSI, TMSI, MSRN,

Security Parameter, Location Information, IMSI attach/detach,..

MSC* e.g. Authentication, Authorization,

Cipher & Integrity Start

D Location Updates (Subscriber Profiles VLR) Security Parameter (via HLR VLR) Interrogation (MSRN via HLR to GMSC)

Location Updates (Subscriber Profiles VLR) Security Parameter (via HLR VLR) Interrogation (MSRN via HLR to GMSC) HLR AuC

TS: Tele ServicesBS: Bearer ServicesSS: Supplementary Services

IMSI: International Mobile Subscriber IdentityLMSI: Local Mobile Subscriber IdentityTMSI: Temporary Mobile Subscriber Identity

MSRN: Mobile Station Roaming Number

58


59/111

59

SMSGMSC & SMSIWMSC


60/111

CSExternal

VLRDomain

or some es gnateMSCs can act as

SMSGMSC/IWMSC(Network operator

SMSGMSC

epen en

Short MessageService Center

SMS Gateway MSC

SMSIWMSCSMS Interworking MSC

Gd

SGSNDomain

60


61/111

61


62/111

Location Registration (Circuit and Packet Switched)

IMSI Attach/Detach (Circuit Switched)

Routin Area U date Packet Switched Cell Attach/Detach (Packet Switched)

Location Info Retrieval (Circuit and Packet Switched)

Paging (Circuit Switched)

Paging (Packet Switched)

Authentication Procedure (Circuit/Packet Switched)

Ciphering Procedure (Circuit/Packet Switched)

en y ec ng rcu ac e w c e

UE Hardware (IMEI) Checking (Circuit/Packet Switched)

62


63/111

Functions of 2G/3G Authentication

The network and an MS can perform validity verification on each other.

63

MGW

SIEMENS SIEMENS


64/111

NodeB

Confidentiality

Service Protection

64

Authentication


65/111

Authentication

The rand is relayed to the mobile station. This generates the SRES withthe help of the parameter Ki stored on the SIM card and A3 (SRES =A3(ki, .the SRES of the triple. If both SRES are the same, the authentication issuccessful. If they are different, the SIM card is rejected, An authentications per orme w en an n a es a serv ce reques , suc as a ca ,location update, and activation of a supplementary service. and onlyemergency calls are possible depending on the project.Ciphering

For the ciphering, the rand is also used in the MS. The key kc is generated=

and A8.The ciphering is thereupon carried out with the algorithm 5 stored in the

.The key kc contained in the triple is meanwhile relayed to the BSS. Thealgorithm A5 is also available here, so that the ciphering can be carried out

ere as we .

65

2G Authentication


66/111

SRES =Signed Response66

2G Ciphering


67/111

67


68/111

Relation Between the 2G Authentication Parameters68

2G User Confidentiality (privacy):


69/111

Methods for ensurin user confidentialit are used both in the mobile station and inthe network. The mobile station secures itself against misuse by asking for a four digitPersonal Identification Number (PIN) when the MS is switched on. The PIN code is

. correct, the MS is unlocked and ready for use.On the network side, sensitive signaling information (IMEI, IMSI, directory numbers,

.

process between

MS

and

BTS

is

initiated.

The subscriber is identified by means of a temporarily allocated Temporary Mobile

u scr er ent ty e ore t e encrypt on process s starte . e s allocated by the network after a successful first time location update, and is reallocated (renewed) after every successful authentication verification. When the mobile station is switched off, the current TMSI is stored in the SIM and is available when the MS is switched on again.

69


70/111

70


71/111

71


72/111

72


73/111

73


74/111

74

EIR:Equipment Identity Register


75/111

Storing IMEIs(counterpart: ME)

on White / Gray / Black List Performing IMEI Check

on VLR / SGSN request

optional network

function

MSC /CS Domain

VLR

F

EIR

Gf

SGSNInternational Mobile stationEquipment Identity (IMEI)

PS Domain

75


76/111

76


77/111

77


78/111

78


79/111

79


80/111

80


81/111

81


82/111

82


83/111

83


84/111

84


85/111

85


86/111

86


87/111

87


88/111

88


89/111

89


90/111

90


91/111

91


92/111

92

u en ca on arame ers

Authentication Quintuple


93/111

Authentication QuintupleRANDThe RAND is a random number provided by the network for a UE. The UE uses theRAND to generate the authentication response RES or RES+RES_EXT, IK, and CK. TheRAND has 16 bytes.AUTNThe AUTN is sent to a UE for authenticating the network. The AUTN has 16 bytes.XRESThe XRES is the authentication response expected from the UE. If the RES or

RES+RES_EXT generated by the UE is the same as the XRES, the authentication is. .

CKThe CK is the UMTS cipher key in a UMTS network. The CK has 16 bytes.

The IK is the integrity key in a UMTS network. The IK has 16 bytes.

93

Authentication Parameters Stored on a USIM Card

IMSI


94/111

IMSIKIu en ca on an encryp on a gor ms , , , , , , , , an or c

SQNMS

IMSIKI

CKSN

* * AMFOP or OPcSQN

94

Relation Between the 3G Authentication Parameters


95/111

95

EIR:Equipment Identity Register


96/111

Storing IMEIs(counterpart: ME)

on White / Gray / Black List Performing IMEI Check

on VLR / SGSN request optional network functionMSC /

CS Domain

VLR

F

EIR

Gf

SGSNInternational Mobile stationEquipment Identity (IMEI)

PS Domain

96

Equipment Identity Register EIR


97/111

Equipment Identity Register EIR

prophylaxis. Stolen or non valid Mobile Equipment ME can be blocked from furtherusage.The E ui ment Identit Re ister EIR is the lo ical entit which is res onsible forstoring in the network the International Mobile Equipment Identities IMEIs (TS23.002). An IMEI clearly identifies a unique Mobile Equipment ME and containsinformation about the place of manufacture, device type and the serial number of theequipment.

The Mobile

Equipment

ME

is

classified

as

"white

listed",

"grey

listed",

"black

listed"

orit may be unknown as specified in TS 22.016 and TS 29.002.

The EIR performs IMEI Checks on VLR respectively SGSN request to check whetherthe ME is stolen or non valid.The EIR is connected to:

The SGSN via Gf interface The VLR via F interface

97


98/111

Short Message Services

98

SIEMENS SIEMENS SIEMENS SIEMENS

1

2

MSC VLR

5


99/111

5

SIEMENS SIEMENS

InterworkingMSC

MSC function(MAPMSC) usually

5

n egra e n eSMSCenter itself

mobile origination

PBX

45Delivery report

SMSCenter

99


100/111

1BMSISDN+SMS2Interrogate HLR(BMSISDN+SMSC)

(SMMT) Short message mobile termination

3MSCID+BIMSI4IMSI+SMS+SMSC5,6 Checking IMSI

ag ng8SMS to MS

100


101/111

Location Update

101


102/111

LA-1 Location update isperformed when there

LA-2 .

No locationupdate

Location update

102

In practice, there are three types of location updates:1 L i R i i P O


103/111

1. Location Re istration Power On2. Generic3. Periodic

Location registration : takes place when a mobile station is turned on. This is also known as IMSI Attach

because as soon as the mobile station is switched on, it informs the Visitor Location.

successful registration, the network sends the mobile station two numbers that arestored in the SIM(Subscriber Identity Module)card of the mobile station.

Generic: Every time the mobile receives data through the control channels, it reads the LAI

and compares it with the LAI stored in its SIM card. A Generic location update isperformed if they are different. The mobile starts a location Update process by

Periodic: Periodic Location Update is carried out when the network does not receive any

location update request from the mobile in a specified time.

103


104/111

104


105/111

Handover/Relocation

105

Handover

Handover is the means of maintaining a call when a user moves


106/111

.

The call must be switched to an alternative cell to provide service,automatically and without loss of service.

Handover is a complex process requiring synchronisation of eventsbetween the mobile station and the network.

In particular, there is the need to route the call to the new cell before

handover can be effected whilst maintaining the old connection until

Handover is a time critical process requiring action to be taken beforethe existing radio link degrades to such an extent that the call is lost.

106

Handover


107/111

107


108/111

BTS BTS

108


109/111

BSC/RNC

BSC/ BSC/

RNCRNC

BTSBTSNodeBNodeB

BTSBTSNodeBNodeB

109

Inter BSC/RNC Intra MSC Handover


110/111

MSCMSCVLR

BSCBSC

BBTTSS

BSCBSC

BBTTSS

BBTT

BBTTSS

BBTTSS

SS

BBTT

BBTTSS

BB

BBTTSS

SS

110

Inter BSC/RNC Inter MSC Handover

BSCBSC


111/111

MSC1MSC1VLRBB

TTSS

BBTTSS

BBTT

MSC2MSC2 VLR

SS

BBTT

SS

BSCBSCBBTTSS

BBTTSS

BBTT

BBTTSS

SSBBTTSS

111

1- UMTS Network Structure.pdf

Documents

Transcript of 1- UMTS Network Structure.pdf