Basic Procedures

Outlines
6.1Numbers-Identities-Codes 6.1.1Mobile Subscriber ISDN Number (MSISDN) 6.1.2International Mobile Subscriber Identity (IMSI) 6.1.3 HLR Entries 6.1.4Mobile Station Roaming Number (MSRN) 6.1.5Handover Number (HON) 6.1.6Temporary Mobile Subscriber Identity (TMSI) and Location Area Identity (LAI) 6.1.7International Mobile Equipment Identity (IMEI) 6.1.8Cell Global Identity (CGI) 6.1.9Base Station Identity Code (BSIC) 6.2Procedures 6.2.1Registration of the Mobile Station on the Network 6.2.2Location Update and Authentication 6.2.3Mobile Terminated Call (MTC) and Encoding 6.2.4Mobile Originated Call (MOC) and IMEI Checking 6.2.5Handover6.2.6Intra Cell - Intra BSC Handover 6.2.7Inter Cell - Intra BSC Handover 6.2.8Inter Cell - Inter BSC Handover 6.2.9Inter MSC Handover

In GSM there is a range of numbers and identity codes which are required for the provision of the basic procedures in a digital mobile network. The following aspects must be considered:
The identity of a subscriber The services required by the subscriber The national or international location of a subscriber The localization of the subscriber in relation to various base stations or other network elements The mobile station used by the subscriber There are several numerical identities for these aspects that will be introduced in the course of this chapter.

The international telephone number of a mobile GSM customer is his Mobile Subscriber ISDN Number, or MSISDN. The number is only stored in the HLR of the home network, and is never intended to be transmitted on the air interface. How do you dial this number from a Public Switched Telephone Network, or PSTN? First, dial a prefix to distinguish between national and international calls. For national calls, the prefix is usually zero. For international calls, it is 2 zeros, and two or three digits, depending on the country. In GSM networks, it is sufficient simply to enter a ''+'' sign instead of the double zero.

The second part of the MSISDN, the Mobile Country Code MCC, provides the code for the relevant country. The MCC consists of two digits and does not have to be entered when making national calls. The third part of the number is the Network Destination Code NDC. It identifies the appropriate national network operator. The Mobile Subscriber Identification Number MSIN forms the fourth part of the MSISDN. The first three digits of this number determine the logical HLR where the GSM customer is stored and which is used to locate him/her. The remaining digits identify the individual subscriber, with different services like speech, fax and data services requiring differing MSINs.

To identify a GSM subscriber in a mobile network, each subscriber has his own International Mobile Subscriber Identity (IMSI). The IMSI is of a standard length of 15 digits and is composed of the following elements:
A Mobile Country Code (MCC) with three digits, A Mobile Network Code (MNC) with two digits and A Mobile Subscriber Identification Number (MSIN) with 10 digits.

The IMSI is required for registration in a PLMN, because it is defined as an individual number code with a uniform string length of digits. The MSISDN, by comparison, has differing lengths of digits, depending on the country, and therefore cannot be considered for a simple registration procedure. Furthermore, a customer has different MSISDNs for every service, but only one IMSI that can uniquely identify him internationally.

MSISDN and IMSI are stored as permanent database entries in the Home Location Register (HLR) of the customer's home network. The HLR also contains information on the services for which the customer is registered These are static entries. In addition, a database field is reserved for the current VLR address. This entry is dynamic, and is updated depending on the Location Area where the subscriber is. In this way, the HLR always knows the current location of the subscriber, and thus enables the routing of calls to the relevant MSC.

The Mobile Station Roaming Number (MSRN) is a temporary number produced for routing the call in case of a Mobile Terminated Call. MSRN is generated within the serving MSC/VLR, that is where the mobile station just happens to be at that moment. In order for a called subscriber to be identifiable, the MSRN is linked to the International Mobile Subscriber Identity (IMSI). In the event of an incoming call, the MSRN is transmitted via the HLR to the Gateway MSC (GMSC) to inform it where the call has finally to be routed. The MSRN has the same structure as the MSISDN. It consists of the Country Code (CC), the National Destination Code (NDC), and a Subscriber Number (SN) that is different to the SN in the MSISDN. While the MSISDN only establishes a connection to the HLR, the MSRN is used to route the call to its actual destination.

If a mobile subscriber, while making a call, moves from one MSC area to another that is covered by a different VLR/MSC, an Inter-MSC-Handover is required, that is the transfer of the call from a currently serving MSC, or the Anchor MSC, to the new MSC, the Target MSC. The Anchor MSC stays responsible for all call control activities, so it has to know where to route the call. To support this, the Target MSC generates the Handover Number HON, and sends it to the Anchor MSC. Using this number, it can now create a connection to the Target MSC. Like the Roaming Number, it is made up of the Country Code CC, the National Destination Code NDC and a Subscriber Number SN (which is also different from that of the MSISDN).

The Temporary Mobile Subscriber Identity (TMSI) and the Location Area Identity (LAI) are required for the Location Update of a mobile station. The TMSI is generated in the VLR of the relevant hosting network after the first Location Update, and then linked to the IMSI. From then on, the IMSI is no longer transmitted for data security reasons. Instead, the TMSI is transmitted via the air interface. This is the temporary identity of the mobile radio user. It is assigned for the mobile's presence within the Location Area. The Location Area Identity (LAI) is a unique number worldwide. The net sends it via the control channels of the air interface to the mobile station so the mobile station recognizes its current position and can store it on the SIM card.

The International Mobile Equipment Identity (IMEI) is stored on the hardware of the mobile station, and is used to check the validity of the relevant terminal used. In the Equipment Identity Register (EIR), the same number is stored to check number compliance. This equipment check is optional in GSM, and not every network operator offers this service. The IMEI contains a check code (the Type Approval Code), a terminal number (the Final Assembly Code), and the serial number of the mobile station.

The Cell Global Identity (CGI) is a number code used to identify each cell within a Location Area of a GSM network. The CGI consists of the relevant Mobile Country Code (MCC) of a country, the Mobile Network Code (MNC) for a relevant network, the Location Area Code (LAC) of a Location Area, and the Cell Identity (CI), which indicates the relevant cell within this Location Area. Using this code, the traffic data relevant to a cell, for example, can be evaluated statistically in the Network Management Center (NMC).

If a mobile subscriber is at a certain location, his mobile phone usually receives frequencies from different network operators. In order for his mobile phone to synchronize to the frequency of its own network operator, each base station must be able to identify itself. This identity is the Base Station Identity Code (BSIC). It is broadcast by every BTS, and compared with the appropriate entry on the SIM card of the subscriber. Only after verification that the broadcast BSIC is identical with the entry on the SIM card can a mobile station be registered on the network. Furthermore, the BSIC has to make a distinction between the serving cell and those other cells that use the same frequency as the serving cell. It consists of the Network Color Code (NCC) and the Base Station Color Code (BCC).

In order for a user to be able to use a mobile station, it must be registered on the network. After a subscriber has switched on his mobile phone, he first enters his PIN. The PIN is stored on the SIM card. This step will not access the network. The mobile station only begins communications with the network after successful PIN query. "Network search" appears on the display of the mobile station. To select the radio cell, the mobile station measures all Broadcast Control Channels that have been sent on all frequencies from all network operators. Then, a suitable network PLMN that is authorized for the subscriber is selected. In the home country, this at first is only the network of a subscriber's own network operator, then the network of a contract partner. Now the mobile can select a suitable cell from several possible cells. After a successful Location Update, the mobile station is in Idle Mode. Let's have a closer look at the Location Update procedure.

Irrespective of where a mobile subscriber happens to be, a caller must always be able to contact him/her. This means the mobile network must always know the subscriber's current location so it can put through calls. By ''subscriber's current location'' we understand in this context the appropriate Location Area, that is the area controlled by a certain VLR. A VLR controls at least one Location Area. However, in order to define as accurately as possible a subscriber's current location, the VLR area usually consists of several logical Location Areas. The process that keeps the network up to date as regards this current location is called Location Update.

 A Location Update is carried out:

When a mobile customer switches on his/her mobile station When a mobile customer changes his/her Location Area At regular intervals after a mobile customer has not moved his/her mobile station for some time.

What information is exchanged between which network elements during Location Update?

The mobile station sends, via the BSS and the appropriate serving MSC, a Location Update Request to the controlling VLR. This then requests the subscriber ID stored on the SIM card of the mobile station, which is sent immediately to the VLR. Now the VLR can request the authentication data, also called the authentication triplet, from the subscriber's HLR/AUC. After receiving the reply from the HLR, the VLR sends the authentication data to the mobile station. After successful authentication, the Location Update, in the form of the VLR address, can be sent to the HLR of the subscriber as the current location.

Let's have a closer look at the authentication process. A new serving VLR requests authentication from the SIM card used. This request is forwarded to the Authentication Center (AUC) of the home network, which will provide the VLR with an "Authentication Triplet". The triplet consists of a random number (RAND), a Signed Response (SRES), and a key (Kc). SRES is the calculation result of the algorithm A3 combining the individual key Ki stored in the AUC and the random number RAND. Kc is generated in the same way by the algorithm A8 using RAND. Several of these triplets produced this way are transmitted to the enquiring VLR.

The VLR first stores both parameters from the triplet Kc and SRES for later use, and only transmits the random number RAND to the mobile station. Using this number and the information stored on the SIM card - that is the algorithms A3 and A8, and the key Ki, the mobile station can produce the same parameters as the AUC, namely SRES and Kc. For authentication, the mobile station sends the SRES it has produced back to the VLR. The key Kc is used later for channel encoding. Now the VLR can compare both SRES numbers: one from the mobile station, and one produced by the AUC. If both parameters tally, authentication was successful. Finally, the TMSI is transmitted in encoded form.

We refer to a Mobile Terminated Call (MTC) when a mobile subscriber is being called. Let us look at the MTC using a call from a PSTN as an example:
A PSTN customer dials the number of a mobile phone. The number dialed is the MSISDN. The exchange of the Public Switched Telephone Network (PSTN) analyses this number and contacts the Gateway Mobile Services Switching Center (GMSC), that is the link between the PSTN and the mobile network. The GMSC does not know the current location of the called subscriber, and therefore starts an appropriate inquiry to the HLR of the called subscriber. The HLR checks its database entries to find the current location or the currently serving MSC/VLR of the called subscriber. Now the HLR asks the serving MSC/VLR for the routing information necessary for the call connection.

The serving VLR now generates the temporary Mobile Subscriber Roaming Number (MSRN) and sends it via the HLR to the GMSC. The GMSC now has the routing information it needs, and transmits the call onwards to the serving MSC. The VLR makes the LAI available to the called subscriber To locate the called subscriber, the MSC initiates a Paging Process within the Location Area.

Let's have a closer look at this process.

The MSC initiates the paging in the entire Location Area using the Temporary Mobile Subscriber Identity (TMSI). This is made available by the VLR and is also known to the called mobile station. It's been allocated to a subscriber after the first Location Update of his mobile station, and is used instead of the IMSI for data security reasons. Within the relevant Location Area, the TMSI of the called mobile station is broadcast on the air interface via the Paging Channel (PCH). However, as the TMSI is clearly allocated within the VLR area, and thus also within the Location Area, only the called mobile station can identify the Paging Channel, and react accordingly.

The called mobile station reacts to the Paging Channel with a request to the network for a free channel. This request is sent via the Random Access Channel (RACH) in an uplink to the BSS. This allocates, through the Access Grant Channel (AGCH), a Stand-alone Dedicated Control Channel (SDCCH) to the mobile station. This communicates with the BSS via the SDCCH, which exists both in the uplink and the downlink, until a traffic channel is allocated to the mobile station. Parameters for authentication and encoding, as well as the new TMSI, are transmitted via the SDCCH to the mobile station. If this is concluded successfully, the actual call set-up is initiated. For this purpose, a voice link is established between the mobile station and the BSS, by allocating a traffic channel on the air interface. Let's have a more detailed look at the various steps of call set-up.

1. First, the mobile station is informed that an incoming call requires a call set-up. This set-up message is sent to the mobile station via the SDCCH 2. The mobile station confirms this set-up inquiry in the uplink via the same channel. 3. Now the MSC selects a terrestrial channel of the A interface, also called a trunk, for the transmission to the BSS. It sends a message, an Assignment Request Message, to the BSS, asking it to allocate a free resource on the air interface. This message contains information on the trunk used, so later on the data stream functions perfectly. 4. After receiving the Assignment Request Message, the BSS allocates a suitable traffic channel, and transmits this allocation via the SDCCH to the mobile station. This must now prepare itself for a configuration of its air channel.

5.

The mobile now takes over the allocated traffic channel and transmits the confirmation of the allocation to the BSS via the FACCH. Now, the subscriber is informed for the first time by the Man Machine Interface (MMI) of the incoming call, in other words: the telephone rings. The BSS transmits a final confirmation message to the MSC, about the successful allocation of the air and terrestrial resources. If the channel allocation is unsuccessful, the BSS sends an appropriate error message to the MSC about the reason for the failure. Possible reasons for a failure are that either air or terrestrial resources were reserved previously, and are thus unavailable.

Speech and signalling data are not transmitted in their original state on the air interface, but are encoded. Only after successful authentication can the BTS and the mobile station start the encoding process. The 114-bit key used for encoding and decoding at both ends of the air transmission is produced at the BTS and at the mobile station using the encoding algorithm A5. For this purpose, A5 uses the 64bit key Kc that was generated during the authentication process, and a 22-bit TDMA frame number in order to encode and decode speech and signalling data.

We refer to a Mobile Originated Call, or MOC, when a mobile telephone subscriber calls a subscriber on the Public Switched Telephone Network (PSTN) or on a Public Land Mobile Network (PLMN). The mobile caller dials a number. This means he starts a call service inquiry in the net where he is currently a visitor. Then the net analyses the caller's subscriber data to do three things:
To authorise or refuse the use of the network To activate the requested service To route the call

If the call is addressed to the same mobile network, the MSC turns to the relevant HLR via the dialed MSISDN to send the call to its destination. If the call is to the PSTN or to a different PLMN, it is routed there via the Gateway MSC (GMSC) and sent on to the target subscriber.

If a call is made to a PSTN, the following communication procedures take place between the network elements. First, the BSS and the mobile station agree on channel allocation. When this is done, necessary safety checks relating to the subscriber are carried out between the mobile station and the serving MSC/VLR. The mobile check is optional, depending on the network operator. The IMEI, which is transmitted in encoded form through the air by the mobile station, is sent to the Equipment Identity Register (EIR) that checks the authorization of the terminal used. Only after the security checks have been carried out can the mobile station start the call set-up via the MSC. This now checks in the connected VLR whether the subscriber is authorized for the desired service. If the VLR sends back a positive reply, the call set-up can be carried out, and a traffic channel can be allocated to the connection. The serving MSC sends the call via the relevant GMSC to the exchange of the PSTN. If a confirmation of successful call set-up is sent from there, the caller is informed by his MSC, and he hears the calling signal on his telephone. The conversation can start.

We know already that the GSM network is of a cellular design. If a subscriber moves from one cell to a neighboring cell, the current connection must be maintained without any interruption. To ensure this, there is the Handover - that is the neighboring cell takes over the coverage tasks in a sort of "substitution without stopping", and the connection to the original cell is interrupted. Handovers occur in the following cases: 1. A handover due to transmission measuring results occurs when the signal strength or its quality is too low, or the distance from the mobile station to the BTS is too great. The call is then transferred to a neighboring cell. 2. A handover due to high traffic volume within the cell occurs when the capacity of the cell is exhausted and the call is transferred into a neighboring cell which is less busy. 3. When necessary, a handover can be forced by the OMC - due to maintenance work in the cell, for example. A distinction is made between various handover types. We'll look at them in more detail in the following lessons.

 The smallest of all handover types is the handover within a cell, the Intra cell - Intra BSC handover. In this case, a subscriber is diverted to a different traffic channel within the same cell. Generally, this channel is generated with a different frequency or time slot. The decision about the handover is made by the BSC that controls the cell.

 The Inter cell - Intra BSC handover takes place when a mobile user moves from one cell into a neighboring cell, both controlled by the same BSC. The traffic connection to the old cell is discontinued as soon as the connection set-up to the new cell is successfully completed. This process is controlled by the BSC.

 We refer to an Inter Cell - Inter BSC handover when a mobile user moves from one cell to a neighboring cell that is controlled by a different BSC, with both BSCs being supervised by the same MSC. This type of handover is carried out by the operating MSC, but the decision about the handover is made by the old BSC. The connection to the old BSC area is only interrupted when the new connection has been successfully established.

If a mobile phone user changes over to a new cell operated by a different MSC, we refer to an inter MSC handover. This is a bit more complicated: Based on the signal measuring results supplied by the mobile station, the old BSS can detect the need for a handover to a neighboring cell. The old BSS informs the MSC that is still serving of the required handover. This MSC is also called the Anchor MSC. Next, the Anchor MSC requests the Handover Number (HON), from the new MSC, or Target MSC. After receiving this request, the Target MSC asks the new BSS to provide free resources at the air interface.

When terrestrial and air resources have been re-allocated, the Target MSC can make the required HON available to the Anchor MSC. With this number, the Anchor MSC can establish a connection to the Target MSC. The Anchor MSC now sends the handover command to the mobile station via the old BSS. When the handover is successful, the mobile station sends an appropriate success message to the new BSS, which passes the message on to the Target MSC. The Target MSC informs the Anchor MSC via the current connection that the old connection to the mobile station can now be interrupted. The Anchor MSC re-releases the channel allocation by notifying the old BSS.