What is an IMSI?

The IMSI (International Mobile Subscriber Identity) is a unique 15-digit code used to identify an individual

user on a GSM network.

The IMSI consists of three components:

Mobile Country Code (MCC)

Mobile Network Code (MNC)

Mobile Subscriber Identity Number (MSIN)

The IMSI is stored in the Subscriber Identity Module (SIM).

What is an IMEI?

The IMEI (International Mobile Equipment Identity) is a unique 15 or 17 digit code used to identify an

individual mobile station to a GSM or UMTS network. The IMEI number facilitates an important function; it

easily identifies a mobile phone being used on a GSM (Global System for Mobile Communications) network.

The IMEI is a useful tool to stop a phone that is stolen from accessing a network and being used. Mobile

phone owners that have their phones stolen can contact their mobile network provider and ask them to ban

or shut off a phone using its IMEI number. With an IMEI number, the phone can be banned from the network

quickly and easily. It is important to note that swapping a SIM card will not stop a phone from being banned.

An IMEI device is only used to identify the device and does not usually relate to a specific individual or

organization. Other numbers such as ESN (Electronic Serial Numbers) and MEID (Mobile Equipment

Identifiers) can link an individual to a phone. Usually, an IMSI number stored on a SIM card can identify the

subscriber on a network.

There are a few ways in which you can locate your mobile phone's IMEI number, it can usually be found on

the handset, beneath the battery, sometimes printed on a small white label. Another way to easily locate

your IMEI phone is to dial the following sequence of numbers into the handset: *#06#. If you have a Sony

Ericsson mobile phone, you can retrieve the IMEI by pressing the following key sequence: right,*, left, left,*,

left, *, left.

The Structure of an IMEI Number

IMEI numbers either come in a 15 digit or 17 digit sequences of numbers. These numbers can identify a

handset. Currently the format of the IMEI is AA-BBBBBB-CCCCCC-D.

These two digits are for the Reporting Body Identifier, indicating the GSMA approved group that

allocated the TAC (Type Allocation Code).

BBBBBB- The Remainder of the TAC

CCCCCC- Serial Sequence of the Model

D- Luhn Check Digit of the entire model or 0 (This is an algorithm that validates the ID number)

What are the components of a GSM network?

Subscriber Equipment

Mobile Station (MS) - The mobile telephone.

The Switching System (SS)

Home Location Register (HLR) - A database which stores data about GSM subscribers, including the

Individual Subscriber Authentication Key (Ki) for each Subscriber Identity Module (SIM).

Mobile Services Switching Center (MSC) - The network element which performs the telephony switching

functions of the GSM network. The MSC is responsible for toll ticketing, network interfacing, common

channel signaling.

Visitor Location Register (VLR) - A database which stores temporary information about roaming GSM

subscribers.

Authentication Center (AUC) - A database which contains the International Mobile Subscriber Identity (IMSI)

the Subscriber Authentication key (Ki), and the defined algorithms for encryption.

Equipment Identity Register (EIR) - A database which contains information about the identity of mobile

equipment in order to prevent calls from stolen, unauthorized, or defective mobile stations.

The Base Station System (BSS)

Base Station Controller (BSC) - The network element which provides all the control functions and physical

links between the MSC and BTS. The BSC provides functions such as handover, cell configuration data,

and control of radio frequency (RF) power levels in Base Transceiver Stations.

Base Transceiver Station (BTS) - The network element which handles the radio interface to the mobile

station. The BTS is the radio equipment (transceivers and antennas) needed to service each cell in the

network.

The Operation and Support System (OSS)

Message Center (MXE) - A network element which provides Short Message Service (SMS), voice mail, fax

mail, email, and paging.

Mobile Service Node (MSN) - A network element which provides mobile intelligent network (IN) services.

Gateway Mobile Services Switching Center (GMSC) - A network element used to interconnect two GSM

networks.

GSM Interworking Unit (GIWU) - The network element which interfaces to various data networks.

What are locking and unlocking?

Most GSM Mobile Stations (MS) are sold to be used on a specific GSM network. The Mobile Stations are

"locked" to only accept a Subscriber Identity Module (SIM) from the GSM carrier that sold the Mobile Station.

There are several situations where you would want to unlock your Mobile Station. For example, you might

wish to switch GSM service providers and keep your current Mobile Station. Or, you may have purchased a

new Mobile Station and you want to sell your old Mobile Station to someone who is subscribed to a different

GSM service provider. A third situation is if you are travelling extensively in another GSM service providers

area and you would like to get local GSM service instead of paying roaming charges.

There are two methods of unlocking Mobile Stations. The first method, which requires no equipment, is to

enter the unlock code for your Mobile Station from the keypad. Your GSM service provide will be able to give

you this unlock code, but may not be willing to do so. The second method is to use dedicated unlocking

hardware which plugs into your Mobile Station and unlocks it. You may purchase this hardware, or send

your Mobile Station to an unlocking service which will unlock it for a small fee.

What is a Subscriber Identity Module (SIM)?

The Subscriber Identity Module (SIM) is a small smart card which contains both programming and

information.

The A3 and A8 algorithms are implemented in the Subscriber Identity Module (SIM).

Subscriber information, such as the IMSI (International Mobile Subscriber Identity), is stored in the

Subscriber Identity Module (SIM).

The Subscriber Identity Module (SIM) can be used to store user-defined information such as phonebook

entries.

One of the advantages of the GSM architecture is that the SIM may be moved from one Mobile Station to

another. This makes upgrades very simple for the GSM telephone user.

How can I find my IMEI?

The IMEI (International Mobile Equipment Identity) number can be displayed on most phones by dialing the code *# 06 #.

The IMEI is also usually printed on the compliance plate under the battery.

Introduction to GSM

What is GSM?

Global System for Mobile Communication (GSM) is a set of ETSI standards specifying the infrastructure for a digital cellular service. The standard is used in approx. 85 countries in the world including such locations as Europe, Japan and Australia1.

Home Location Register (HLR)

A Home Location Register (HLR) is a database that contains semi-permanent mobile subscriber information for a wireless carriers' entire subscriber base. HLR subscriber information includes the International Mobile Subscriber Identity (IMSI), service subscription information, location information (the identity of the currently serving Visitor Location Register (VLR) to enable the routing of mobile-terminated calls), service restrictions and supplementary services information.

The HLR handles SS7 transactions with both Mobile Switching Centers (MSCs) and VLR nodes, which either request information from the HLR or update the information contained within the HLR. The HLR also initiates transactions with VLRs to complete incoming calls and to update subscriber data.

Traditional wireless network design is based on the utilization of a single Home Location Register (HLR) for each wireless network, but growth considerations are prompting carriers to consider multiple HLR topologies.

Visitor Location Register (VLR)

A Visitor Location Register (VLR) is a database which contains temporary information concerning the mobile subscribers that are currently located in a given MSC serving area, but whose Home Location Register (HLR) is elsewhere.

When a mobile subscriber roams away from his home location and into a remote location, SS7 messages are used to obtain information about the subscriber from the HLR, and to create a temporary record for the subscriber in the VLR. There is usually one VLR per MSC.

International Mobile Subscriber Identity (IMSI) Number

The IMSI is a unique non-dialable number allocated to each mobile subscriber in the GSM system that identifies the subscriber and his or her subscription within the GSM network. The IMSI resides in the Subscriber Identity Module (SIM), which is transportable across Mobile Station Equipment (MSE). The IMSI is made up of three parts (1) the mobile country code (MCC) consisting of three digits, (2) the Mobile Network Code (MNC) consisting of two digits, and (3) the Mobile Subscriber Identity Number (MSIN) with up to 10 digits.

Mobile Subscriber ISDN (MSISDN) Number

The MSISDN is the dialable number that callers use to reach a mobile subscriber. Some phones can support multiple MSISDNs - for example, a U.S.-based MSISDN and a Canadian-based MSISDN. Callers dialing either number will reach the subscriber.

Mobile Station Equipment (MSE) Subscription Services

GSM carriers typically order Mobile Station Equipment (MSE) (or GSM phones) from their suppliers (Nokia, Motorola, Sony, etc.) in large quantities (e.g. 1000 Units). After receiving an order, the equipment supplier will program the ordered MSE SIMs with a range of IMSI numbers.

Example: ABC Communications Inc. orders 1000 MSE Units with the following range of IMSIs.

  MCC MNC MSIN

Unit #1 310 68 4451000

Unit #1000 310 68 4451999

Once the range of IMSI numbers has been determined, the HLR can be populated with the new IMSI records that will be configured and activated at a future date by authorized sales or service subscription representatives. The fact that the HLR can be populated with ranges or blocks of IMSI numbers creates efficiencies in the storage and retrieval of routing information.

The wireless carrier distributes the Mobile Station Equipment to Sales Outlets that sell GSM subscription services. When a new subscriber orders a GSM phone at one of the outlets, the service representative will create a Service Order (SO) to enter the new subscriber's service subscription information, including the MSISDN number. The key to the Service Order is the IMSI that is programmed in the SIM. The SO is sent to the HLR, where the IMSI record is created. It can either be set to an active state immediately, allowing the new subscriber to send and receive telephone calls or it can be activated at a future date.

Note that the MSISDN numbers are assigned one at a time as each new customer subscribes. The MSISDN numbers are therefore provisioned individually, rather than in blocks, which complicates the MSISDN based routing of messages. The ramifications of MSISDN provisioning are discussed further in the example found at the end of this document.

GSM Call Routing

Mobile Subscriber Roaming

When a mobile subscriber roams into a new location area (new VLR), the VLR automatically determines that it must update the HLR with the new location information, which it does using an SS7 Location Update Request Message. The Location Update Message is routed to the HLR through the SS7 network, based on the global title translation of the IMSI that is stored within the SCCP Called Party Address portion of the message. The HLR responds with a message that informs the VLR whether the subscriber should be provided service in the new location.

Mobile Subscriber ISDN Number (MSISDN) Call Routing

When a user dials a GSM mobile subscriber's MSISDN, the PSTN routes the call to the Home MSC based on the dialed telephone number. The MSC must then query the HLR based on the MSISDN, to attain routing information required to route the call to the subscribers' current location.

The MSC stores global title translation tables that are used to determine the HLR associated with the MSISDN. When only one HLR exists, the translation tables are trivial. When more than one HLR is used however, the translations become extremely challenging; with one translation record per subscriber (see the example below). Having determined the appropriate HLR address, the MSC sends a Routing Information Request to it.

When the HLR receives the Routing Information Request, it maps the MSISDN to the IMSI, and ascertains the subscribers' profile including the current VLR at which the subscriber is registered. The HLR then queries the VLR for a Mobile Station Roaming Number (MSRN). The MSRN is essentially an ISDN telephone number at which the mobile subscriber can currently be reached. The MSRN is a temporary number that is valid only for the duration of a single call.

The HLR generates a response message, which includes the MSRN, and sends it back across the SS7 network to the MSC. Finally, the MSC attempts to complete the call using the MSRN provided.

Adding a Second HLR to the GSM Network

As a GSM wireless carrier's subscriber base grows, it will eventually become necessary to add a second HLR to their network. This requirement might be prompted by a service subscription record storage capacity issue, or perhaps an SS7 message processing performance issue. It might possibly be prompted by a need to increase the overall network reliability.

The new HLR can be populated with service subscription records as new subscribers are brought into service or existing service subscription records can be ported from the old HLR to the new HLR to more evenly distribute the SS7 traffic load.

Typically, when new subscribers are brought into service, the second HLR will be populated with blocks of IMSI numbers that are allocated when new MSE equipment is ordered. As the following example shows, this grouping of IMSI numbers within a single HLR simplifies the routing translations that are required within the SS7 network for VLR to HLR Location Update Request transactions. Global Title Translation (GTT) tables will contain single translation records that translate an entire range of IMSIs numbers into an HLR address. Even if some individual records are moved between the HLRs, as shown in the example, the treatment of IMSIs as blocks results in a significant simplification of the Global Translation tables.

Much more complicated SS7 message routing Global Title Translations are required for Routing Information Request transactions between the MSCs distributed over the entire wireless carrier serving area and the two or more HLRs. MSC Routing Information Requests are routed to the appropriate HLR based on the dialed MSISDN and not the IMSI. Unlike the IMSI numbers, the MSISDN numbers can not easily be arranged in groups to reside within a single HLR and therefore, the MSC must contain an MSISDN to HLR address association record for every mobile subscriber homed on each of the MSCs. As the example illustrates, the MSC routing tables quickly grow much more extensive than the STP tables. The network administration becomes increasingly complex and prone to error.

Example: Simple Network with two MSCs and two HLRs

The following example illustrates the issues relating to GSM network routing table administration with multiple HLRs. A simple GSM network is shown, with the various routing tables following:

HLR Datafill

HLR #1 is populated with IMSI Range 310-68-4451000 to 310-68-4451005 and is populated with service subscribers from two different MSCs.

HLR #1

IMSI MSISDN Other Subscriber Data

310-68-4451000 813-567-1234

~~~~~~~~~~~~

310-68-4451001 813-567-4355

~~~~~~~~~~~~

310-68-4451002 813-567-8479

~~~~~~~~~~~~

310-68-4451003 415-457-0238

~~~~~~~~~~~~

310-68-4451004 415-457-2332

~~~~~~~~~~~~

310-68-4451005 415-387-6325

~~~~~~~~~~~~

310-68-5568099 415-387-8884

~~~~~~~~~~~~

New HLR#2 is populated with IMSI Range 310-68-5568095 to 310-68-5568100 and is populated with new service subscribers from the same two MSCs. One subscriber has been moved from HLR #2 to HLR #1 (IMSI = 310-68-5568099).

HLR #2

IMSI MSISDN Other Subscriber Data

310-68-5568095 415-457-1235 ~~~~~~~~~~~~

310-68-5568096 415-387-4444 ~~~~~~~~~~~~

310-68-5568097 415-457-1236

~~~~~~~~~~~~

310-68-5568098 415-457-4444

~~~~~~~~~~~~

310-68-5568100 813-567-0055

~~~~~~~~~~~~

STP Datafill

The STPs route SS7 messages to these HLRs based on the IMSI numbers which are usually provisioned in blocks. In this case, the STPs (which have identical GTT tables) are provisioned to route one block of IMSIs to the each HLR. Note that individual records can be moved between HLRs with the addition of another record in the routing table which specifies the individual IMSI. Individual records take precedence over IMSI block entries.

STP #1, #2

IMSI HLR

310-68-4451XXX 1

310-68-5568XXX 2

310-68-5568099 1

MSC Datafill

When a GSM subscriber receives a phone call, the call attempt messages are routed to the subscriber's MSC, based on the dialed numbers (the MSISDN). The MSC is provisioned

with routing tables which relate each MSISDN to an HLR. Note that the MSISDN numbers cannot be assigned in convenient blocks like the IMSI numbers.

MSC #1

MSISDN HLR

813-567-1234 1

813-567-4355 1

813-567-8479 1

813-567-0055 2

MSC #2

MSISDN HLR

415-457-1235 2

415-387-4444 2

415-457-1236 2

415-457-4444 2

415-387-8884

1

415-457-2332 1

415-457-0238 1

415-387-6325 1

Performance Technologies offers a GSM Signaling Platform that provides SS7 signal processing and network interworking that supports enhanced GSM roaming applications. Our GSM platforms have been used by some of the largest national and international carriers throughout the world. Visit the GSM Signaling Platform overview page to learn more.