Escolar Documentos
Profissional Documentos
Cultura Documentos
Version
15.10.08
0.1
Name
Change comment
Tanti Adriyani
Initial Draft
Objectives
After completing this module, the participant can:
Describe the Mobility Management states
Describe signalling procedures related to Mobility
Management
Explain the 2G-3G interworking inside SGSN
Purge
Security
Authentication
subscriber identity confidentiality
Ciphering (2G only)
Identity check.
Location management
3G-specific procedures:
Radio Access Bearer (RAB) management
SRNS Relocation (3G only)
Service Request (3G only)
Security mode control (3G only)
PS Paging
Normal/periodic routing area update.
Subscriber Management
Implicit detach or
cancel location
GPRS Attach
GPRS Detach
OR
Cancel Location
READY
READY timer expiry
OR
Force to standby
OR
Abnormal RLC
condition
STANDBY
6
PDU reception
MM states in SGSN
PMMDETACHED
PMMDETACHED
Detach
Detach,
RAU reject
GPRS attach
Detach
PMMCONNECTED
Iu connection established
Detach,
RAU reject
Iu connection
release
Iu connection released
PMM- IDLE
GPRS attach
(RAU request)
PMM- IDLE
PMMCONNECTED
Packet rcvddownlink
Serving RNC
relocation
Attach
3G
MSC
Node
B
3G
HLR
RNC
IP
SS
7
SGSN
SGSN
DNS
Gn
BSC
RNC
SGSN
SGSN
BTS
RA1
Gb/Iu
RA2
SS7
3G
IP
SGSN
2
DNS
GGSN
2G 3G Interworking
10
GPRS DETACH
The MS is detached from GPRS either explicitly or implicitly:
Explicit detach:
detach The network or the MS explicitly requests
detach specifying the cause for it
Implicit detach:
detach The network detaches the MS after the mobile
reachable timer expired or after an irrecoverable radio error
causes disconnection of the logical link
After a successful detach:
MM context and PDP context in PAPU are removed;
P-TMSI - IMSI association is not removed from PAPU;
The Visiting GPRS subscriber data may be deleted from SMMU;
otherwise the data from SMMU is removed when "Detached
subscriber storage time" timer expires. Also the IMSI-P-TMSI
association from PAPU is removed and a "Purge" message is sent to
HLR.
11
MS/UE-initiated detach
3G
SGSN
1
Gb/Iu
12
GGSN
IP
Network-Initiated Detach
SGSN-Initiated Detach procedure: The PAPU starts the detach
procedure every time an error occurred in the network.
Network-Initiated Detach procedures: HLR uses this procedure for
operator-determined purposes to request the removal of a
subscribers MM and PDP contexts at the SGSN.
When the network initiates a GPRS detach procedure for a
subscriber, the following happens:
MM aborts any data transfer for the subscriber
MM asks Session Management to deactivate the subscriber's PDP
contexts
MM informs the MS of a network-requested GPRS detach
MM informs the HLR that the subscriber is detached from the
GPRS network
13
GGSN
SGSN1
MSC2
MSC1
RNC2
RNC1
LA2, RA2
LA1, RA1
UE
14
SGSN2
HLR
MM-I
DLE
GGSN
SGSN1
MSC2
MSC1
RNC2
RNC1
LA2, RA2
LA1, RA1
UE
15
SGSN2
Service request
Service request is a term
for different MM and SM
operations, like:
establishment of data
connection
3G
MSC
Node
B
establishment of
signalling connection
paging towards the UE
3G
HLR
RNC
IP
SS
7
SGSN
SGSN
DNS
Gn
16
GGSN
17
3G
HLR
SS7
Purge function
The Purge function allows an SGSN (SMMU) to inform the HLR that it
has deleted the subscriber information of a detached MS stored in
Visiting GPRS subscriber database.
3G
HLR
SS7
SGSN
SGSN
18
Authentication
MS/UE
RAN
PAPU
SMMU
HLR/AuC
IMSI
IMSI
2. GMM.Authentication Request
SRES/XRES
2. GMM.Authentication Response
19
Authentication
vectors
Authentication
vectors
Generate RAND
SQN
RAND
AMF
Aut Mgmt Field
f1
f2
f3
f4
f5
Message
Authentication
Code (MAC)
Expected
Response
(XRES)
Cipher Key
(CK)
Integrity Key
(IK)
Anonimity Key
(AK)
from VLR/SGSN
RAND
F5
K in USIM
SQ
N
=?
F1
f2
f3
f4
Message
Authentication
Code (XMAC)
Expected
Response
(XRES)
Cipher Key
(CK)
Integrity Key
(IK)
comparison
UMTS Authentication
Enhanced support for GSM-UMTS
roaming
Better security for UMTS
subscribers
Optimized signaling load
Release 99+
HLR/AuC
Quintets
CK, IKKc
CK, IKKc RES SRES
[Kc]
UTRAN
RAND
AUTN
RES
RAND
AUTN
RES
R99+ ME
CK, IK
Kc
[Kc]
Release 98VLR/SGSN
[Kc]
GSM BSS
CK, IK
Kc
RAND
SRES
RAND
SRES
R98- ME
R99+ ME
or
R98- ME
Kc
Kc
22
Triplets
CK
IK
CK, IK Kc
RES SRES
Identity Check
MS/UE
RAN
1. GMM.Identity Request
PAPU
SMMU
EIR
Identity
Type=IMEI
IMEI
IMEI
1. GMM.Identity Response
2. DX200.Check IMEI
IMEI
2. DX200.IMEI Check
23
old SMMU
HLR
24
Appendix
Mobility Management Features
Appendix
Interaction to MSC/VLR
Interaction to MSC/VLR
The interaction between SGSN and MSC/VLR is
realised by supporting a standard "Gs interface" in
MSC/VLR.
3G
MSC
A
BSC
RNC
VLR
SS
7
Gs
BTS
Gb
SGSN
SGSN
GPRS MS
Class A,B
27
RA1
MS 1
SGSN 1
Ms 1: VLR 1
Ms 2: VLR 2
MS 2
28
MSC/VLR 2
RA2
Ms 2: SGSN 1
BSSAP+ procedures
29
BSS
PAPU
SMMU
1. BSSAP+.Paging Request
2. DX200.Paging Request
MSC/VLR
2. BSSGP.Paging CS
3. Paging CS
4. SABM (Paging Response)
5. SCCP Connection Request (Paging Response)
30
31
Appendix
Equivalent PLMN
34
The same operator may have both GSM and UMTS radio
networks but for regulatory reasons, the two radio systems may
have to broadcast different PLMN codes
35
Appendix
HLR-based 2G/3G access control
each subscriber
Allow 3G access for subscribers that do not have a USIM
Information is passed in new parameter within the
InsertSubscriberData Response MAP message from the HLR
during location update
Similar functionality has been possible with controlled roaming,
but the granularity was based on IMSI prefixes instead of
individual subscribers
3GPP Release 6 functionality
Requires a licence
2G Allowed
BTS
BS
37
GSM
Access
HLR
SGSN
SS7
Network
WCDMA
Access
3G Allowed
MML
parameter
11
PLMN
12
LA
13
ROAM
14
GPRS
15
CELL
No suitable cells in LA
NO
38
Cause
PLMN not allowed
Location Area not allowed
Not used
Appendix
Controlled Roaming
Allowed
Not
Allowed
Operator A (City)
40
Operator A
(Countryside)
Appendix
MultiSIM
MultiSIM
This feature allows one subscriber to have several mobile
stations simultaneously, each with its own SIM card, under the
same Mobile Subscriber International ISDN Number (MSISDN)
42
Appendix
SMS over GPRS
The operator can also disable all SMSs over GPRS with MML
command
44
RAN
PAPU
SMMU
HLR
IW-MSC
SMSC
1. Message transfer
2 Authentication
3. IMEI checking
4 .DX200. Forward short message
4 .MT Forward short message
5. Message Transfer
5. Delivery Report
6 .Forward short message result
6 . DX200.Forward short message result
7. Delivery Report
45
RAN
PAPU
SMMU
HLR
G-MSC
SMSC
1. Message Transfer
2. Send routing info for SM
2. Send routing info for SM Result
3 .MT Forward short message
3 .Forward short message
4 Authentication
5. IMEI checking
6. Message transfer
7 .Forward short message result
7 .Forward short message result
8. Delivery Report
46
Analysis for:
PID
(Protocol
Identifier)
Short Message
SMSIWMSC 2
Prefix
SGSN
SMSIWMSC 3
Result = Fax
47
SMS barring
A-number prevention
barring is based on the
MSISDN of the subscriber.
When using number
portability,
portability it may not be
possible to bar all
subscribers from a certain
country or PLMN. This can
also lead to a situation
where also unwanted
subscribers are barred
when barring is based on
the CC or NDC prefix.
48
Barring
MO SMS
A-number
prevention
SMSC denial
analysis
MT SMS
SMSC denial
analysis
Appendix
Multi Operator Core Network (MOCN)
50
Successful Attach
51
52
CS/PS Coordination
53