Post on 28-Apr-2015
1
1
Fundamentals of SS7and GSM protocol
architecture and proceduresGiuliano Paris
(TILS)email: giuliano.paris@ telecomitalia.it
Rio de Janeiro, September 2005
2
Outline
• Background on Signaling
• SS7 Characteristics and Protocol Architecture
• CCITT #7 Application Parts: TUP/ISUP and TCAP/ASEs
• GSM Protocol Architecture
GSM radio channels (signaling and Traffic channel)
GSM radio signaling channels (BCCH, RACH, etc)
Examples of procedures (location update, handover, call scenario,
roaming, SMS, etc.)
2
3
Some background on Some background on SignalingSignaling
� Signaling is defined as the exchange of informationspecifically concerned with the establishment, releaseand other control of calls, and network management, in automatic telecommunication operation (ITU definition).
� Channel Associated Signaling (CAS) • A signaling method in which the signals necessary for the control of a
single user channel (e.g. speech channel) are transmitted in the channel itself or in a signaling channel permanently dedicated to it.
� Common Channel Signaling (CCS)• A signaling technique in which signaling information relating to a
multiplicity of circuits, and other information such as that used for the network management, is conveyed over a single channel by addressedmessages.
4
CAS and CCSCAS and CCS
UI UI UI UI S S S S
1 2 3 ….. M
UI UI UI UI S
CommonChannel
UI = User Information
S= Signaling
1 2 3 ….. N 1 2 3 N
Channel Associated Signaling (CAS)
Common Channel Signaling (CCS)
3
5
CAS and CCSCAS and CCS
� In telephony CAS traditionally consisted of strictly necessary signals(very poor vocabolary) to handle a call (off-hook/on hook, calledparty number, dial tones and busy signals). It was defined forelectromechanical switching systems (based on selectors and xpoints). The subscriber dials '958'
� CAS is relatively slow (long call setup time), it offers a poverty of signals (messages) and no error detection and recovery for signalinginformation and finally it has been subjected to frauds.
� The introduction of electronic processors in the switching systems(SPC switches) and the development of data communictiontechniques and protocols have given the possibility to implement the concept of CCS (named CCITT #7, or CCS #7, or SS7).
� CCS #7 enables all the network element (i.e. SPC switches, network databases, etc.) to exchange signaling information in a reliable, fast, secure (protections from fraud), flexible (in terms of number of signals) and standardised (worldwide use) manner.
6
CAS CAS signalingsignaling CallCall
SEIZURE
CAS CAS
off-hook
first digits
last digitDIGITS
PROCEED TO SEND
SEIZURE
ringing
off-hook
DIGITS
PROCEED TO SEND
on-hook
ANSWER
CONVERSATION
on-hook CLEAR BACK CLEAR BACK
dial tone.
ADDRESS COMPLETEADDRESS COMPLETE
RINGING TONE
ANSWER
CLEAR FORWARD CLEAR FORWARDRELEASE GUARD RELEASE GUARD
post
dialling
delay
4
7
N
1
2
P. S.
N
1
2
P. S.
N
1
2
M. Transfer
N
1
2
M. TransferCCS link
signaling messages
speech + signaling
speech
From CHANNEL ASSOCIATED SIGNALING ....
... To COMMON CHANNEL SIGNALING
control
control control
control
8
Common Common ChannelChannel SignalingSignaling ModesModes
SP SP
SP SP
STP Speech TrunksSignaling link
Associated Mode
Non Associated Mode
SP= Signaling PointSTP= Signaling Transfer Point
5
9
CCS #7 CCS #7 ProtocolProtocol ArchitectureArchitecture
� MTP 1: Equivalent to OSI layer 1 (generally 64Kb/s)
� MTP 2: Error detection and recovery, flow control (basedon HDLC, equivalent to OSI layer 2 )
� MTP 3: Provides message routing without lost or duplicated packets even in case of network failures or congestion (Equivalent to lower half of OSI layer 3)
MTP Level 1MTP Level 2MTP Level 3
USER PART USER PART
10
ContentsContents of of RecommendationsRecommendations(Q.701(Q.701--Q.707) Q.707) relatingrelating toto the MTPthe MTP
Recommendation Q.701 contains a functional description and overview of the Message Transfer Part of SS No. 7.Recommendation Q.702 details the requirements of a signallingdata link to support SS No. 7.Recommendation Q.703 describes the signalling link functions.Recommendation Q.704 describes signalling network functionsand messages.Recommendation Q.706 defines and specifies values for MTP performance parameters.Recommendation Q.707 describes the testing and maintenancefunctions applicable to the MTP.
6
11
CircuitCircuit RelatedRelated ApplicationsApplications� The signaling message coming from the USER Part
(i.e. TUP) includes the related Circuit IdentificationCode
�� ��������������� ����� �� ��� �� ��� ����������������� ��������� ���������������� ��������������������������
��������������
�� �������������������������������������������� ������ ��������������� ������� ������ �������������� ��� ���� ��� �� ����� �����
���� !� ���� !� ����������" ����������" ���� !� ���� !� ��� ���� � ������������ ����������������������������!�!�������#�#�
MTP Level 1
MTP Level 3
MTP Level 2
ISDN-UP/TUP
TransportSession
Presentation
Application
Physical
Data Link
Network
12
MTP-2
MTP-3
ISUPTUP/ISUP Message
MSU
ISUP
Switch A Switch B
The messages originated from a switch’s User Part (UP) are carried by the functional block MTP in a “Message Signalling Unit” (MSU) and delivered to the other switch’s UP.
MTP-3
MTP-2
MTP-1 MTP-1
callcontrol
callcontrol
CIC Signaling payloadDPC OPC
DPC: Destination Point Code
OPC: Originating Point Code
CIC: Circuit Identification Code
7
13
A
B
T
(a)
(b)
Call Example with CCS (TUP/ISUP)
speech trunksSignaling circuit
(a) Calling party(b) Called party
switch with SP and STP function
switch with SP function
14
signaling regionA
SPSTP
signalinglink
QUAD
QUAD Model : non associated mode (stand-alone STP )
speech
signaling regionB
8
15
ConceptualConceptual modelsmodels: : transporttransport and control and control networksnetworks
switch
SP
SP
SP
SP
switch
switchswitch
SP
switch
STP
STP STP
STP
Signalling Network
Transport Network
16
SignallingSignalling data linkdata link : : levellevel 1 (MTP1 (MTP--1)1)• Level 1 defines the physical, electrical and functional characteristics of a signalling data link and the means to access it. The level 1 elementprovides a bearer for a signalling link.• The standard channel time slot for the use of a signalling data link is time slot 16 (when available) in 2.048 Mbit/s digital path.• The access to the signalling data link can be realized by a semipermanent connection through the switching network
MTP-2
MTP-3Switch BMTP-3
MTP-2
2 Mb/s PCM path
16
16
Switch A
Switch matrix
MTP-1Switch matrix
9
17
SERVICE INDICATOR (SI)0000 Signalling network management messages0001 Signalling network testing and management messages0011 SCCP0100 Telephone User Part (TUP)0101 ISDN User Part (ISUP)0110 Data User Part (DUP).....
F CK SIF SIO LIFIB
FSNBIB
BSN F
8 16 8n (n>2) 4+4 2 6 1 7 1 7 8
MSU (Message Signal Unit)
Legenda:F = FlagCK = Check bits (CRC)SIF = Signalling Information FieldSIO = Service Indicator OctetLI = Length IndicatorFIB = Forward Indicator BitFSN = Forward Sequence NumberBIB = Backward Indicator BitBSN = Backward Sequence NumberSLS = Signaling Link Selection
UP Messagelabel
routingSINI
parts of interest to levels 3 and 4
SLS OPC DPC
SignallingSignalling link link functionsfunctions: : levellevel 2 (MTP2 (MTP--2)2)
NETWORK INDICATOR (NI)
00XX international network
01XX spare for international network
10XX national network
11XX spare for national network
18
MTPMTP--2 2 signalsignal unitsunits: FISU, LSSU, MSU: FISU, LSSU, MSU
LI Value Signal Unit Type
0 Fill-In Signal Unit (FISU)
1..2 Link Status Signal Unit (LSSU)
3..63 Message Signal Unit (MSU)
10
19
SignallingSignalling network network functionsfunctions: : levellevel 3 (MTP3 (MTP--3)3)
MESSAGE DISTRIBUTION
MESSAGEDISCRIMINATION
MESSAGEROUTING
MESSAGE HANDLING
SIGNALING NETWORK MANAGEMENT
SIGNALINGTRAFFIC
MANAGEMENT
SIGNALINGLINK
MANAGEMENT
MTP-3USER PARTS MTP-2
Message Flows
Control and Indication
SIGNALINGROUTE
MANAGEMENT
20
SignallingSignalling network network functionsfunctions: : levellevel 3(MTP3):3(MTP3):SignallingSignalling TrafficTraffic Management Management ProceduresProcedures
•Changeover
•Changeback
•Forced Rerouting
•Controlled Rerouting
•Signalling Point Restart
•Signalling Traffic Flow Control
11
21
SLS=XXX1
SLS=XXX0
A B
A BD E
F C
XXX0
XXX1
SIGNALING TRAFFIC LOAD SHARING (I) SIGNALING TRAFFIC LOAD SHARING (I)
Load sharing within a link set
Load sharing between link sets
22
SIGNALING TRAFFIC MANAGEMENTSIGNALING TRAFFIC MANAGEMENT((ExampleExample of of changeoverchangeover))
12
23
SIGNALING ROUTE MANAGEMENTSIGNALING ROUTE MANAGEMENT(EXAMPLE: Transfer (EXAMPLE: Transfer ProhibitedProhibited Procedure )Procedure )
6
13
19 89
STP sents a transfer prohibited message (TFP) to each of SPs.
the message has the following information:• Destination Point (DPC) = 6, 19, 13• Origin Point (OPC) = 9• Message Indication = TFP• TFP related Destination = 8
The 3 SPs (6,19,13), once received the TFP message, will execute a forcedrerouting procedure
STP
i
24
MTP performance MTP performance requirementsrequirementsThe availability and dependability objectives for the transport of signalling messages by the MTP are:
• No more than one in 10E+7 (1 in 10,000,000) messages should be lost.
• No more than one in 10E+10 messages should be delivered out of sequence or duplicated.
• No more than one in 10E+9 message errors should remain undetected.
• The signalling route between an origination and destination SP should be available99.9998% of the times or better. This implies a maximum permissible downtime or unavailability of 10 minutes per year per route.
• Though there are no specific end-to-end delay objectives for SS7, they are specified forspecific services or uses of the SS7 protocol. Further there are delay objectives for some network components, and others can be calculated. Thus an estimate can be made forany given network configuration.
13
25
Background: Background: ““WhatWhat isis ISDN?ISDN?””
“It represents the evolution of the IntegratedDigital Network (IDN), it offers an end-to-end 64 kbit/s digital connectivity in order to provide a very large set of voice and data services, through a limited number of standardisedaccess interfaces. ISDN provides the access toboth circuit and packet switched networks and services”.
26
Background: Background: ISDN Network ISDN Network ArchitectureArchitecture
packet switchednetwork
circuit switchednetwork
...other networksISDNlocal
exchange
14
27
Background: Background: ISDN Services ISDN Services CharacteristicsCharacteristics
� Bearer:
• end-to-end 64 kbit/s digital connectivity (circuit mode)
• speech and 3.1 KHz audio (circuit mode)
• packet connectivity
� Teleservices (examples):
• fax (G.3 and G.4), telephone, videoconference,etc.
� Supplementary services (examples):
• Call Completion Busy Subscriber (CCBS)
• Closed User Group (CUG)
• Calling Line Identity, etc.
28
Background: ISDN Access Background: ISDN Access TypesTypes
�� $%&��$� ��%����&��� ���$%&��$� ��%����&��� ��� '�$�(����'�$�(����������� �������
�$)�*+��$)�*+�, �, �- �- �������� ������� �!�����)�.*��!�����)�.*�, �, �- �- ������� ������ ���������-������-���
����������
�� �%&���%&�������"�����"%����&��� �%����&��� �/�01�$�(����/�01�$�(����������� �������
�$)�*+��$)�*+�, �, �- �- �������� ������� �!�����)�*+��!�����)�*+�, �, �- �- ������� ������ ��������!��!
PABX
ISDN
NTBRA
BRA
PRA
NT
TA
15
29
� DSS1 (Digital Subscriber Signalling N. 1) is the ISDN standard access (user-network) protocol and ISUP-CCITT #7 is the network protocol (network-network).
� limitations of such an architecture for broadbandservices
NN--ISDN ISDN protocolprotocol architecturearchitecture
access protocol
(DSS1)
access protocol
(DSS1)
networkprotocol(ISUP/
CCITTn.7)
networkprotocol(ISUP/
CCITTn.7)
Network
ISDN Switch
30
DSS1 DSS1 ProtocolProtocol
LAP-D (layer 2)
Q.931 (layer 3)(call handling)
Physical (layer 1)• 2 wires for BRA 2B1Q code• 4 wires for PRA HDB3 code
Q.931 provides the means to establish, mantain,and release network connections across anISDN between signaling entities. It alsoprovides procedures for the invocation and theoperation of supplementary services
LAP-D (Q.921) is the data link protocol usedover the D-channel. It provides frame error detection and error recovery, flow control, SAPI and TEI addressing (SAPI + TEI = DLCI)
16
31
TUP and ISUPTUP and ISUP
ISUP comprehends, beyond all the capabilities provided by TUP, a set of capabilities needed to support ISDN services (i.e. beares services (speech,. 3.1 khz audio, 64 Kb/s unrestricted) and supplementary services (CLIP, CLIR, CUG, subaddressing, user to user signaling, etc.)
ISUP capabilitiesTUP capabilities
ISUP Reccomandations: Q.761 - Q.768
32
Routing label
Circuit identification code
Message type code (es. IAM, ACM, etc.)
Mandatory fixed part
Mandatory variable part
Optional part
ISDN User Part (ISUP) : ISDN User Part (ISUP) : messagemessage formatformat12345678
T1148210-92/d14
Order of bit transmission
Order of octettransmission
Routine label
Circuit identification code
Message type code
Mandatory parameter A
Mandatory parameter F
Pointer to parameter P
Pointer to start of optional part
Length indicator of parameter M
Pointer to parameter M
Parameter M
Length indicator of parameter P
Parameter P
Parameter name = X
Length indicator of parameter X
Parameter X
Parameter name = Z
Length indicator of parameter Z
Parameter Z
End of optional parameter field
Mandatoryfixed part
Mandatoryvariable part
Optional part
(12 bits)
17
33
M essage type: Initial address
Param eter Reference Type Length(octets)
M essage type
Nature of connection indicators
Forward call indicators
Calling party's category
Transm ission m edium requirem ent
Called party num ber
Calling party num ber
Optional forward call indicators
Closed user group interlock code
User-to-user inform ation
Access transport
User service inform ation
End of optional param eters
2.1
3.23
3.20
3.9
3.35
3.7
3.8
3.25
3.13
3.38
3.2
3.36
3.17
F
F
F
F
F
V
O
O
O
O
O
O
O
1
1
2
1
1
4-11
4-12
3
6
3-131
3-?
4-13
1
ISUP ISUP messagemessage: IAM (: IAM (InitialInitial AddressAddress MessageMessage))
34
64 Kbit/s call between ISDN users(en-bloc dialing and automatic answer)
IAM (# # # #) IAM(# # # #)
CONNECT CONNECT
DSS1 ISUP
SETUP(#...#)SETUP
CONNECTCONNECT
CONVERSATION (data transfer)
DISCONNECTRELEASE
RLCRELEASE
RLC
DISCONNECT RELEASE
REL. COMPLETERELEASE
REL. COMPLETE
ISUP DSS1
18
35
ISUP: ISUP: CallCall betweenbetween POTS POTS subscriberssubscribers
IAM (# # # #) IAM(# # # #)
ISUP
CONVERSATIONSUS
ISUP
OFF-HOOK
First digits.
Last digit SAM
SAM
SAM
SAM
ringing
Off-hookANMANM
ACMACM
On-hookSUS
Off-hookRESRES
CONVERSATIONOn-hook REL REL
RLG RLG
36
LocalExchange
1) IAM 2) REL (*)
3) IAM
CONGESTION
REL(*) = the message has a parameter informing that cranck-back is possible (Crank-backindicator)
AutomaticAutomatic ReroutingRerouting ((CrankCrank--backback))
LocalExchange
TransitExchange
TransitExchange
19
37
Example: outgoing trunk failure
IAM IAM IAM IAM
ACM ACM ACM ACM
REL (cause) REL (cause)REL (cause)REL (cause)
RLC RLC RLC RLC
CallCall failurefailure: : ISUP Cause and LocationISUP Cause and Location
• ISUP provides exact information on the failure cause of a call
• Cause value
• Cause indicators parameter
• Location
SGU SGTSGU
ISUP ISUP ISUP ISUP
38
0000001 (1) unallocated (unassigned) number0000011 (3) no route to destination0000100 (4) send special information tone0010000 (16) normal call clearing0010001 (17) user busy0010010 (18) no user responding0010011 (19) no answer from user (user alerted)0010101 (21) call rejected0010110 (22) number changed0011011 (27) destination out of order0011100 (28) address incomplete0011101 (29) facility rejected0011111 (31) normal unspecified0100010 (34) no circuit/channel available0100110 (38) network out of order0101001 (41) temporary failure0101010 (42) switching equipment congestion0101100 (44) requested channel not available0101111 (47) resource unavailable - unspecified0110111 (55) incoming calls barred within CUG0111001 (57) bearer capability not authorized0111010 (58) bearer capability not presently available0111111 (63) service/option not available - unspecified1000001 (65) bearer capability not implemented1001111 (79) service or option not implemented - unspecified1010111 (87) user not member of CUG1011000 (88) incompatible destination1011111 (95) invalid message - unspecified1100110 (102) recovery on timer expiry1101111 (111) protocol error - unspecified1111111 (127) interworking unspecified
Example: Cause value field (ISUP-S)
20
39
Service Provisioning EvolutionCLASS
Services based on DB (SCP) queries
- I.N. Services- Personal Mobility Services- UPT services- .....
- Call forwarding- Call waiting- Itemised Billing- Three-way calling- Centralized Answering
Machine- ........
- Call Completion BusySubscriber (CCBS)
- ....
- Closed User Group (CUG)
- Calling Line IdentificationPresentation (CLIP) &CLIR
Supplementary Services
40
NonNon--CircuitCircuit RelatedRelated ApplicationsApplications� Transaction-oriented services
�� �22����22������������������� 2���������2��������������2���������2����������������������������������������3������3����0!�0!������ ����� �����4��������4���
������,�������,���"����"������������"����������"!�!��������������� ����� ����� ���� ��� ���� ��� ����2#4#�����2#4#� ���� ����
�� �2&����2&������� ��������� �����2��� ��� 2��� ��� &��������&����������������������������� ����� �������� ��������������� �������������������������
�������������� ������������������ ������ ����������������,�����������,����� ����
�� &�5��&�5��&��������&������������������5������5����������������� ����� �������� ����� �����������������������������������
���������������������� ���� ��#�#�611���#�#�611���� ����� ����������������,���������,������ ������� ����������������������� ����� ����
null
SCCP
ASE
TCAP
MTP Level 1
MTP Level 3
MTP Level 2
ISDN-UP/TUP
Physical
Data Link
Network
TransportSession
Presentation
ApplicationASE
21
41
SignallingSignalling Connection Control Part (SCCP)Connection Control Part (SCCP)and and TransactionTransaction CapabilitiesCapabilities ApplicationApplication Part (TCAP) Part (TCAP)
• Enhance MTP for connection oriented and connectionlesscontrol• Identify subsytems in Signaling Points• Global Title Translation (GTT): translation of network address (eg Dialed Digits) to Point Code• Used for database access (eg 800) and Direct end-to-endinformation
• TCAP supports the exchange of non-circuit related data between applications across the SS7 network using the SCCP connectionless service. Queries and responses sentbetween SSPs and SCPs are carried in TCAP messages. Forexample, an SSP sends a TCAP query to determine the routing number associated with a dialed 800 number and tocheck the personal identification number (PIN) of a callingcard user.
42
ExamplesExamples implementingimplementing ASEsASEs
� GSM Networks
• MAPs (Mobile Application Parts): set of protocolsthat provides the information exchange betweenMSC, HLR, VLR, etc., necessary for mobile capabilities
� Intelligent Networks
• ASE-RI, INAP: protocol that supports the informationtransfer between Service Switching Points and specialized nodes (Service Control Points)
22
43
WhyWhy SERVICES SERVICES providedprovided by the by the INTELLIGENT NETWORK ? INTELLIGENT NETWORK ?
� Simplicity, “time to market” introduction
� Customer Tailored
� Flexible Access (trasportability)
� Customer control
� Creation flexibility
� Manufacturer independency ??
44
IntelligentIntelligent Network (IN) ServicesNetwork (IN) Services
� Green Number (800 service-USA)
� Private Virtual Network
� Premium Charge (in Italy 144, 166)
� Split Charging
� Mass Calling
� Televoting
� Calling card
� Personal Number
� Universal Number
� . . . . .
23
45
IntelligentIntelligent Network Network GoalsGoals
� Migration of service control software out of switchingnode (in the Service Control Points)
� Service Creation Environment (SCE) in order topersonalize the services
� Standardized Interfaces between the network elements
46
I.N. I.N. FunctionalFunctional ArchitectureArchitecture
SCF
CCF CCFCCF
SSF SSF
SDF
SRF
SMF
SMAF
SCEF
���� ������������� ���
����� ���� ���� ������
���� ���� ���������
���� ���� ����������� ���� ��������������
����� ���� ����� ������
����� ���� �������
�����������
���� ��� ������������ ���
24
47
I.N. Network I.N. Network ArchitectureArchitecture
SCPSCP
SMSSMS
CustomerControl
SCEServiceManager
switchednetwork
PSTN
CCS n.7 network
SMS = Service Management System SCP = Service Control Point
SSP = Service Switching PointSCE=Service Creation Environment
SSPSSP
48
CCS#7 CCS#7 ProtocolProtocol ArchitectureArchitecture forforIntelligentIntelligent NetworkNetwork
SSP STP SCP
ASE
TCAP
SCCP
MTP MTP
SCCP
MTP
SCCP
TCAP
ASE
25
49
ExampleExample: Green : Green NumberNumber (800(800--service)service)
SDF
SSP
SCF
SSF
CCF CCF
SCP
SMFSMS
!!""""""
����� ���� ���� ������� ���
���� ���� ���������� ���
���� ���� �������� ���
���� ������������� ������� ���� �������������� ���
1
2
3
50
ISUP ISUP ApplicationsApplicationsInterconnection Interconnection betweenbetween operatorsoperators::
i.e. i.e. CarrierCarrier SelectionSelection
LELE
TETE
10xy-06-7654321
OLOOLOswitchswitch
OLO network
OLOOLOswitchswitchISUP with CLI
CLI check
Telecom Italia Network
LE: Local ExchangeTE: transit Exchange
TIM network
GMSCMSC
Subscriberdatabase
CLI: Calling Line Identity.OLO: Other Licensed Operator
26
51
HLR
GSM Network GSM Network ArchitectureArchitecture
MSC
BTS
BSC BSC
VLRVLR
BTSBTS
BTS
MSC
BSC BSC
PSTN/ISDN
AUC
LAi
LAj
access
coverage
switching
“intelligence”
52
GSM GSM ProtocolProtocol ArchitectureArchitecture
CM
MM
RR
LAPDm
TDMAFDMA
SCCP
Radio interfaceBSSMS MSC
LAPDm
RR
TDMAFDMA
BSSAP
MTP
CM
MM
SCCP
BSSAP
SCCP
TCAP
MAP
MTP MTP
A- interface
to the othernetwork elementsand PSTN
MAPTUP/ISUP
27
53
$�2$�2 78%78% �������� 98%98%3�23�298%98%3�23�2
2323
3333
%%%%
8&���8&���
��#8�"����#8�"��
8&���8&���
��#8�"����#8�"��
%%%% $��&�$��&�
��������
2323
3333�2&��2&�
�22��22�
33&���&�����
�22��22�
3��3��
.����&�.����&�'��$��3&�'��$��3&�
3��3��::
$��&�$��&�
.
3��3��::3��3��
��������
�22��22�
3��3��
33&���&�����
�2&��2&� �22��22�
3��3��
�2&��2&�
��������
33&���&�����
���� &&�� && 2-�2-�
��������
5-;5-;
3�3�
'
$��$��
�22��22�::
$���3�2�$���3�2��� 98%�98%�
GSM: GSM: interfacesinterfaces and and signalingsignaling protocolsprotocols
54
GSM GSM SignalingSignaling ProtocolsProtocols: : standard standard interfacesinterfaces
MSC MSC
HLREIR VLR VLR
BTSBSC
BSS
E
F C B
D G
A
Abis radio interface
PSTN
ISDN
ISUP /TUPMTP
MAPTCAPSCCPMTP
28
55
FixedFixed--MobileMobile CallCall(mobile (mobile terminatingterminating))
MSC
GMSC
HLR
PSTN
BTS
BSC
BTSBTS
BTS
BSC
LAi
LAj
VLR
VLR2
MSISDN3
1
IMSI
MSRN4 MSRN
5
6
ISUP /TUPMTP
MAPTCAPSCCPMTP
= 1,6
= 2,3,4,5
: Send Routing Information2
3 : Provide Roaming Number
56
���������������� �������� ���� ��� ������������� ��� ������� ���� ������� ����
�������� �������� �� �������� ����� �
����������� ��� �������� ������� ������������������������� �� ������
��� ��
�! ��� ��� "����"��� ����� �� �
�#���������#�� ����� ��
$�����$�������� �������� ����� �������� ���������� ���� ������� ��
� ����������!������������ �������� ��
� %������%��������������� �������� ��
� �$�������� ���� ��$�������� �������� ��
GSM GSM SignallingSignalling channels (I)channels (I)
29
57
&'����(��� � ����������������������������'���! �� �
) "��������������*���������������������� �� �������� ���� �
������ �� ������
�#������� �� ������������ ������� ��
�$������������*������������ �$��������������*����������������� ���� �������� ��������� �� ��� ���� �������� ��������� ��
&��������������*�����������������
+����)����������������� ���� ���������
�%����
��������� ��
&���������������*��������������������
+����)����������������� ���� ���������
�%����
��������� ��
GSM GSM SignallingSignalling channels (II)channels (II)
58
GSM radio signaling channelsBroadcast channels (BCH)
� - Broadcast Control CHannel (BCCH) continually broadcasts, on the downlink (unidirectional) informationincluding Country and network identities, Location Area ID, Cell ID, etc. This channel is continuously active, with dummy bursts when there is no information to transmit, because its signal strengths are monitored by mobile stations for handover determination; BCCH is a low capacity channel(23 bytes each 0.235 sec. = 782 b/s). Each cell has one BCCH channel (or BTS) (time slot 0).
� - Frequency Correction CHannel (FCCH) and Synchronization CHannel (SCH): information sent from BSS for carrier and frame synchronization respectively;
30
59
Mobile Mobile initializationinitialization• Prior to establishing any communicationlinks to other parties, the MS must first acquire synchronization with the GSM system. This process begins after the MS isturned on in a PLMN. The first step of the process is for the MS to search for and acquire a frequency control channel(FCCH) burst on some common control frequency channel. The mobile will scan allor part of 124 RF channels and obtain the average signal strength of each channel
• After the frequency correction burst isdetected, the MS will try to synchronizewith the time synchronization burstsynchronization channel (SCH). The SCH always occurs in the next frame in the same time slot as the FCCH. This is eightburst periods later than the FCCH. The SCH contains precise timing information on the timeslot boundaries to permit refining the received slot timing. The SCH message alsocontains the current frame number to which the MS synchronizes
60
GSM radio signaling channelsCommon Control Channels (CCCH)
Common Control CHannels (CCCH) are used for transmitting signalinginformation between all mobiles and the BSS for call originating and call paging functions:
uplink
- Random Access CHannel (RACH): slotted aloha channel used by the mobile to request access to the network;
downlink
- Paging CHannel (PCH): used to alert the mobile station of incoming call;
- Access Grant CHannel (AGCH): used to allocate a dedicated control channel to a mobile following a request on the RACH.
31
61
GSM radio GSM radio channelschannels (bit rate)(bit rate)
62
ExampleExample: BCCH: BCCH
BCCH
By means of BCCH, one BTS continuously transmits, among others, the Location Area Identification (LAI), la cell identification, by whichMS can realize its position.
LAI = MCC + MNC + LACCGI = LAI + CI
MCC (*)= Mobile Country Code (3 digits)MNC= Mobile Network Code (2 digits)LAC= Location Area Code (2 digits)CGI= Cell Global IdentityCI = Cell Identity (2 bytes)
(*) MCC for Italy = 222
32
63
ExampleExample: RACH and AGCH: RACH and AGCH
AGCH (DCCH provided)
When a Mobile Station (MS) has to send, over the air, the phone numberdigits to make a call, prior the digits could be sent to the BTS, MS mustrequire, through RACH (common control channel), a dedicated control channel (SDCCH). The BSC assigns such a channel through the AGCH (common control channel). Over the SDCCH, all the signalling informationare exchanged for the call setup (authentication, dialing digits, TCH assignment, etc.)
+39335 …...
RACH(DCCH request)
64
DedicatedDedicated control control channelschannels� Stand Alone Dedicated Control CHannel (SDCCH): it is an eighth rate
traffic channel (TCH/8) used for the transfer of call control signaling to and
from the mobile during call setup, before the TCH is assigned (i.e. for
authentication, location update, ecc.); capacity of about 10 messages/sec.
� Slow Associated Control CHannel (SACCH): associated to a traffic
channel, it may carry about 2 messages/s and it used for non urgent
procedures (i.e. radio measurements concerning handover). It is
implemented on frame 12 and there is one dedicated signaling channel for
each of the 8 TCH channels.
� Fast Associated Control CHannel (FACCH): it is obtained on demand by
stealing from traffic channel (during call setup and release phases, no user
data are transmitted and therefore signaling may use the channel without
conflict). It carries information to indicate the call setup progress, or to
authenticate the subscriber, to command a handover, etc.
33
65
GSM radio GSM radio channelschannels
66
Control Control ChannelsChannels (i.e. 51 (i.e. 51 slotsslots framesframes))downlink uplink
34
67
Location Location updatingupdating
68
Location Location UpdatingUpdating (GSM 3.12)(GSM 3.12)
• Channel Request (RACH)• Channel Assignment (AGCH)• Request for Location Updating (SDCCH)• Authentication Request (SDCCH)• Authentication Response (SDCCH)• Ciphering Command (SDCCH)• Ciphering Complete (SDCCH)
•Location updating confirm, including new TMSI (optional) (SDCCH)
• new location andTMSI Ack (SDCCH)
• Channel release by the network (SDCCH)
MS Base Station
• Periodic location updating (6 min.-24 h)• Location updating on LA crossing
35
69
MobileMobile--OriginatedOriginated CallCall
70
Chiamata Chiamata MobileMobile--OriginatedOriginated (MOC)(MOC)
• Channel Request (RACH)• Channel Assignment (AGCH)• Call establishment Request (SDCCH)• Authentication Request (SDCCH)• Authentication Response (SDCCH)• Ciphering Command (SDCCH)• Ciphering Complete (SDCCH) • Setup message (includes called party number) (SDCCH)• Call Proceeding (SDCCH)• Traffic channel Assignment (SDCCH)• Assignment complete (FACCH)• Alerting (ringing on the called side) (FACCH)• Connect (called party answers) (FACCH)• Connect Ack (FACCH)• conversation phase (TCH)
MSBase
Station
14 signaling messages are exchanged before a conversation can begin
remark:
(*)
(*) optionallyTMSI reallocation
36
71
$�2$�2 78%78% �������� 98%98%3�23�298%98%3�23�2
2323
3333
%%%%
8&���8&���
��#8�"����#8�"��
8&���8&���
��#8�"����#8�"��
%%%% $��&�$��&�
��������
2323
3333�2&��2&�
�22��22�
33&���&�����
�22��22�
3��3��
.����&�.����&�'��$��3&�'��$��3&�
3��3��::
$��&�$��&�
.
3��3��::3��3��
��������
�22��22�
3��3��
33&���&�����
�2&��2&� �22��22�
3��3��
�2&��2&�
��������
33&���&�����
���� &&�� && 2-�2-�
��������
5-;5-;
3�3�
'
$��$��
�22��22�::
$���3�2�$���3�2��� 98%�98%�
GSM: GSM: interfacesinterfaces and and signalingsignaling protocolsprotocols
72
ReviewReview on DSS1 on DSS1 ProtocolProtocol (ISDN)(ISDN)
LAP-D (layer 2)
Q.931 (layer 3)(call handling)
Physical (layer 1)• 2 wires for BRA 2B1Q code• 4 wires for PRA HDB3 code
Q.931 provides the means to establish, mantain,and release network connections across anISDN between signaling entities. It alsoprovides procedures for the invocation and theoperation of supplementary services
LAP-D (Q.921) is the data link protocol usedover the D-channel. It provides frame error detection and error recovery, flow control, SAPI and TEI addressing (SAPI + TEI = DLCI)
37
73
GSM: radio GSM: radio protocolprotocol ArchitectureArchitectureThe signaling protocol in GSM is structured into 3 layers.
We have to be careful in not confusing layer 3 protocol functions defined by GSM with what is formally defined to be the layer 3 functions in the OSI model.The GSM layer 3 protocols are used for the communication of network resources, mobility, and call related management messages. Since, in the OSI model, some of these functions are actually provided by the higher layers, the term “message layer” may be more appropriate term for the layer 3 in the GSM.
• The message layer consists of 3 sublayers::
• Radio Resource (RR) implemented over the link between the MS and the BSS;• Mobility Management (MM) and• Connection Management (CM) sublayers providing the communication between the mobile station and the MSC .
74
GSM GSM ProtocolProtocol ArchitectureArchitectureRadio Interface (Radio Interface (UmUm -- betweenbetween MS and BSS) MS and BSS)
PhysicalPhysical and Data and Data LinkLink layerslayers• The physical layer, based on FDMA/TDMA, has been discussed in the radio interface channels section.• The data link layer is based on a LAPD- like protocol, called LAPDm, that has been modified for operation within the constraints set by the radio path. • LAPDm uses no flags for frame delimitation, since it is done by the physical layer. • LAPDm, uses no cyclic redundancy check bits for error detection. Error recovery and detection mechanisms are provided by a combination of block and convolutional coding used in the physical layer• Over the LAPDm two information flows coexist: signaling messages(SAPI=0) and Short Message Services (SAPI=3). The LAP-D layer, originally defined for the ISDN network, in the GSM network is used in the Abis (BTS- BSC interface).
38
75
The Radio Resource (RR) management performs the functions ofestablishing physical connections over the radio path for the purpose oftransmitting call related signaling information such as the establishment of signaling and traffic channels between a specific mobile user and the BSS. The RR management functions are basically implemented in the BSS. Moreover RR sublayer is also involved in handover procedures.Examples of signaling channels use at this layer are RACH, AGCH, PCH.
Some of the procedures involved in RR sublayer are:
• channels assignment and release• handover• frequencies change and hopping sequences• power control management
• ...
Radio Interface (Radio Interface (UUmm -- betweenbetween MS and BSS) MS and BSS) LayerLayer 3 3 -- Radio Radio ResourcesResources sublayersublayer
76
Radio Resource Management (RR)Mobility Management (MM)Connection Management (CM)Call Control (CC)Short Message Service (SMS)Supplementary Services (SS)Protocol Discriminator (PD)Service Access Point Identifier (SAPI)
CM
Legenda:
Radio Interface Radio Interface -- LayerLayer 3 (3 (messagemessage layerlayer) )
SDCCH e SACCH are the channels forthe transport of SMS messages
Note:Protocol Discriminator (PD) is used to addressRR sublayers (PD=06), MM (PD=05), CM(PD=03 for CC, SS e SMS)).
39
77
GSM: GSM: ProtocolProtocol ArchitectureArchitectureA Interface A Interface ((betweenbetween BSS and MSC)BSS and MSC) (GSM 8.0X)(GSM 8.0X)
• As mentioned earlier, over the radio interface an ISDN-like protocol is used (LAPDm), while at this interface the protocols used are based on Common Channel Signaling (CCS). The lower layers are based on MPT(1-3) and SCCP protocol (that is mainly involved in the Global Title Translation (GTT))..The A interface is used for messages between BSC and MSC as well for
messages to and from MS (using CC or MM protocol discriminator) therefore the BSSAP (BSS Application Part) layer must be able to detect messages addressed to the MS and to BSS:
- messages addressed to the MS are relayed transparently by the DTAP (Direct Transfer Application Part) sublayer;
- messages addressed to the BSS related to radio resources are handled by the BSSMAP (BSS management Application Part sublayer (for instance BSSMAP is involved in the handover when it occurs between different BSSs, and in the assignment/release of traffic channels over the A interface).
•
78
A InterfaceA Interface
At the physical layer the A interface is made of 2 Mb/s with traffic channelsof 64 K/s (transcoding 16->64 Kb/s in the TRAU).
TRAU= Transcodingand Adaption Unit
40
79
A Interface: DTAP and BSSMAPA Interface: DTAP and BSSMAP
MS B
SS
MSCBSSMAP
RadioResource
mngmt (RR)
DTAPCall Control (CC)
Mobility Mngmt (MM)
BSSMAP Message example : Assignmentthe request is sent during the connection setup phase (i.e.. Mobile terminating) in order to assing a channel over the A interface and over radio link; the message does not specify the radio channel “number”, while it identifies the (CIC) over the A interface;assign. complete is the positive answer to the TCH assignment
80
GSM: GSM: ProtocolProtocol ArchitectureArchitectureA InterfacceA Interfacce((betweenbetween BSS and MSC)BSS and MSC)
• The Mobility Management (MM) layer is built on top of RR layer (in the MS side) and it handles the functions that arise from the mobility of thesubscriber, as well as the authentication and security aspects. Locationmanagement is concerned with the procedures that enable the system to know the current location area of a powered-on mobile station so that incoming call routing can be completed.
• The Communication Management (CM) layer is responsible for call control, supplementary service management, and short message service. Each of these may be considered as a separate sublayer within the CM layer.The CM layer manages the call control in very similar way to Q.931 protocol of ISDN.
41
81
FunctionalFunctional DistinctionDistinction betweenbetweenBase Station Base Station SubsystemSubsystem(BSS) and MSC(BSS) and MSC
continued
82
GSM: GSM: ProtocolProtocol ArchitectureArchitectureInterfacesInterfaces betweenbetween MSC and MSC and otherother network network entitiesentities
• The MM and CM sublayers are both terminated within the MSC.
• The MSC performs the interrelaying functions between the CM, MM, and BBSMAP entities and the Application entities of SS7, such as ISUP, Mobile Application Part (MAP). In particular MAP requires the services provided by SCCP and TCAP in order to interrogate databases (HLR, VLR) in a similar way as the Intelligent Network services. MAP handles non call-related signaling among the different entities of the GSM network. • There are different protocols according the entities involved in the signaling exchange (MAP/A between BSS and MSC, MAP/B between MSC and VLR, etc..).
42
83
MAP MAP ProtocolsProtocols (TS (TS -- GSM 09.02)GSM 09.02)
MSC
HLRVLR
MSC
VLR GMSC
MAP/D
MAP/CMAP/E MAP/G
(B)
(B)
B (MSC-VLR)- Location registration- Incoming e outgoing call setup- Authentication- Management of security services- Operation of supplementary services
C (MSC-HLR)- Routing information
D (HLR-VLR)- Location registration and updating
E (MSC-MSC)- Handover inter-MSC
F (MSC-EIR)- Blacklist of MS equipment
G (VLR-VLR)- location updating using TMSI
Subscriber data (IMSI, authenticationparameters.)
EIRMAP/F
84
SCCP SCCP protocolprotocol
� In the SS7 two methods of addressing are possible
� The first one is based on the MTP3 addressing level using the so called Signaling Point Code (SPC) ed in particular Originating Point Code (OPC) and Destination Point Code (DPC). This scheme has a limited scope, such as one SS#7 national network. Within this scope, the networking function of the MTP3 are able to route messages with the DPC.
� The second method is based on the concept of global title. It is used in SCCP, where it provides in GSM (but also in other networks such as the Intelligent Network) the addressing capacity needed for the transport of MAP messages between network entities (MSC, HLR, VLR etc.).
� The global title may be a number with no direct relationship with SS#7, such as a PSTN number (E.164), a data number (X.121) or a GSM subscriber identity (an IMSI), etc. It does not contain explicit information on the way to route the message, and an SCCP translation function(called Global Title Translation, GTT) is required to know the MTP address from the global title, at least at each network border.
43
85
SS7: SCCP SS7: SCCP layerlayer
MAP/C
TCAP
SCCP
MTP
MSC STP
SCCP
MTP
MAP/C
TCAP
SCCP
MTP
HLR
= MSU, Message Segnaling Unit
86
MTP, SCCP and TCAP MTP, SCCP and TCAP MessagesMessagesF FCS SIF SIO LI FSN BSN F
Component Portion TransactionPortionComponent n Component 1. . .
MTP
SCCP
TCAP
User message/dataSCCPmessageheader
MessageType RL
C-ingPA+C-edPA+MFD
UD= User DataF= FlagFCS= Frame Check SequenceC-ingPA= Calling Party AddressC-edPA= Called Party AddressSIF= Signalling Information FieldMFD = Mandatory Fixed PartSIO = Service Information OctetMTC = Message Type CodeLI = Length IndicatorRL = Routing LabelFSN = Forward Sequence NumberBSN = Backward Sequence Number* = parte opzionale
Legenda:
44
87
SCCP SCCP layerlayer : : the the GlobalGlobal TitleTitle TranslationTranslation (GTT)(GTT)
MSC/ VLR
STP "B"
HLR
. . .
. . . .
“A”
“C”DPC + SSNGT
GTT
. . . . . OPC=ADPC=B
OPCSSN GT . .
RLC-edPA
C-ingPA
OPC=BDPC=C. . . . . . OPC
SSN SSN . . .
Strati MTP
Strato SCCP
UD= User Data F= FlagC-ingPA= Calling Party Address FCS= Frame Check SequenceC-edPA= Called Party Address SIF= Signalling Information FieldMFD= Mandatory Fixed Part SIO= Service Information OctetMTC= Message Type Code LI= Length IndicatorRL= Routing Label FSN= Forward Sequence Number*= parte opzionale BSN= Backward Sequence Number
Legenda:In the example MSC/VLR and HLR belong todifferent PLMNs.IMSI (Racc. E.212) è used to derive the MGT bythe Gateway entity.
IMSI = MCC + MNC + MSIN
88
A GW A
(MSC/VLR)
Signaling Point (SP)
Signaling Transfer Point (STP)
STP Gateway (GW) with SCCP Function (performs GTT)
BGW B
international SS7 NetNational SS7 network(country A)
National SS7 network(country B)
called SCCP = M. Global Title (derived from IMSI of MS)
OPC = A; DPC = GWA
SCCPlayer
OPC = GWA; DPC = GWB OPC=GWB; DPC=B
(HLR)
MTPlayer
GlobalGlobal TitleTitle TranslationTranslation (GTT)(GTT)
A B
GW A
45
89
HowHow toto obtainobtain the the Mobile Mobile GlobalGlobal TitleTitle (MGT) (MGT)
STRUCTURE:
MGT = CC + NDC + MSIN
E.164 E.212
MGT is obtained from IMSI:
IMSI = MCC + MNC + MSIN
MGT = CC + NDC + MSIN
CC: Country Code (39 for Italy);NDC: National Destination Code (339 for TIM);MSIN: Mobile Station Identification Number (10 digits).
• Example: a MS is roaming in a visiting PLMN, when it has to register in a such network, the only available information to VLR, to address the HLR of the MS is IMSI, from which the MGT is derived
90
Mobile Mobile terminatedterminated callcall (I)(I)
MSC
GMSC
HLR
PSTN
BTS
BSC
BTSBTS
BTS
BSC
LAi
LAj
VLR
VLR2
MSISDN3
1
MSRN Request (via IMSI)
MSRN4
MSRN
5
6
2
3
: Send Routing Information
: Provide Roaming Number
46
91
Mobile Mobile terminatedterminated callcall (II)(II)
92
PSTN (origin of the call)
GMSC
HLR
MSCVLR Speech Path
signaling
ISUPMAP/DISUP
COUNTRY VISITED BY THE COUNTRY VISITED BY THE CALLED PARTYCALLED PARTY
International routing for International routing for a roaming subscribera roaming subscriber
HOME COUNTRY OF HOME COUNTRY OF THE CALLED PARTYTHE CALLED PARTY
47
93
PSTN origin of the call
GMSC
HLR
MSC VLR
country B
country A
signaling
GSM: GSM: withoutwithout optimaloptimal routingrouting (2)(2)
ISUP
MAP/C
ISUP
MAP/D
Speech path
HOME COUNTRY OF HOME COUNTRY OF THE CALLED PARTYTHE CALLED PARTY
COUNTRY VISITED BY THE COUNTRY VISITED BY THE CALLED PARTYCALLED PARTY
94
PSTN origin of the call
GMSC
HLR
signaling
MSC VLR
country B
country A
GSM: GSM: optimaloptimal routingrouting (3)(3)
ISUP
MAP/C
MAP/D Speech routing
HOME COUNTRY OF HOME COUNTRY OF THE CALLED PARTYTHE CALLED PARTY
COUNTRY VISITED BY THE COUNTRY VISITED BY THE CALLED PARTYCALLED PARTY
(visited PLMN)
48
95
InterInter--system system RoamingRoaming
Source: http://www.ericsson.com/about/publications/review/1999_02/article52.shtml
• So far Cellular networks have handled (macro)mobility with a verticalapproach (radio access technology dependent: i.e. “direct” roaming is impossiblebetween GSM e TDMA/AMPS handsets) unless…..
96
CallCall delivery delivery toto a GSM a GSM subscribersubscriberroamingroaming in a TDMA/AMPS networkin a TDMA/AMPS network.
Source: http://www.ericsson.com/about/publications/review/1999_02/article52.shtml
3 = Send routing information invoke
4 = Provide roaming number invoke
5 = Routing request invoke
6 = Routing request return result
7 = Provide roaming number result
8 = Send routing information result
9 = Call delivery (voice trunk)
10 = Mobile terminal call setup
GAIT (GSM/ANSI136 Interoperability Team) is born in order to facilitate roaming between ANSI-136 and GSM
49
97
Location Location UpdatingUpdating (VLR (VLR changechange and and usingusing TMSI)TMSI)
If the subscriber identity is a TMSI, the VLR checks whether the previous location area identification (LAI) provided in the primitive received from MSC belongs to an area of thisVLR: - if so, the TMSI will be checked. In case of location area change within a VLR, the TMSI should be known and the processmay continue with the authentication check. - if the TMSI is not known or the subscriberdata stored are incomplete, e.g. because the new LA belongs to a different VLR or due toVLR restoration, the indicator "Confirmedby VLR" is set to "Not Confirmed" to initiateHLR updating later on.If the subscriber has not already beenregistered in the VLR, i.e. the previous LAI belongs to a different VLR, the indicators"Confirmed by HLR" and "Location Information Confirmed in HLR" are set to"Not Confirmed" and the VLR checkswhether the identity of the Previous VLR (PVLR) is derivable from the previous LAI:- if so, the IMSI and authenticationparameters are requested from that VLR
98
Location Location UpdatingUpdating (VLR (VLR changechange and and usingusing IMSI)IMSI)
/ AuC
VLR1= PVLR
50
99
MS BSS MSC VLR HLR GMSCPSTN
exchange
IAMSEND ROUTING INFO
ROUTING INFOIAM
PROVIDE R.N.
R.N. ACK
SEND INFO FOR I/CCALL SETUP
SEND PARAM. FROM HLR
CALL DATA ACK
PAGE MSPAGINGPAGING REQCHAN REQ
IMM ASSPAGE RESPONSE COMPLETE
LAYER 3 INFO
PROCESS ACCESS REQ.AUTHENTICATEAUTHENTIC. REQUEST
AUTHENTIC. RESPONSE AUTHENTIC. RESPONSE
START CIPHERINGCIPHER
TMSI TMSI ACKSETUPCALL CONF
ASSIGN REQASSIGN CMDASSIGN COM ASSIGN COMP
ALERT ADDRESS COMPLETE MESSAGE (ACM) ACMCONNECT ANSWER ANS
CONNECT ACK
FixedFixed toto Mobile Mobile callcall scenarioscenario
(*)
(*)= passi semplificati (alcuni messaggi non presenti)
100
MS BSS MSC VLR HLR CHIAMATO
PSTNexchange
CHAN REQIMM ASS
COMPLETE LAYER 3 INFO
PROCESS ACCESS REQ.
AUTHENTICATEAUTHENTIC. REQUESTAUTHENTIC. RESPONSE AUTHENTIC.
RESPONSESTART CIPHERINGCIPHER
TMSI REAL COMP TMSI ACK
SETUP
CALL PROC
ASSIGN REQASSIGN CMDASSIGN COM ASSIGN COMP
ALERT
INITIAL ADDRESS MESSAGE (IAM)
CONNECT ANSWER
CONNECT ACK
Mobile Mobile toto FixedFixed callcall scenarioscenario
SENDING INFO FOR O/G CALL
COMPLETE CALL
ADDRESS COMPLETE MESSAGE (ACM)
CM SERV REQ
(*)
(*)= semplified steps (some message are not present)
51
101
102
52
103
104
53
105
MS BSS_A MSC1
HND REQUIRED
interMSCinterMSC HandoverHandoverMSC2
PERFORM HANDOVER
HND REQ
HND CMD
HND CMD HND REQ ACK
PHYS INFO
HANDO ACCESS
CHAN REL CRL CMD
IAM
SEND END SIGNAL
BSS_B VLR
ALLOCATE HANDOVER NUMBER
SEND HANDOVER REPORT
RADIO CHAN ACK
ACMHND CMD
HND DETECT
HANDOVER COMHND CMPANS
CRL COM FORWD ACC. SIGNAL.CALL CONTROL OR MOBILITY MANAGEMENT MESSAGE
ACKNOWLEDGEMENT
CALL CONTROL OR MOBILITY MANAGEMENT MESSAGE
PROCESS ACC. SIGNAL
..END SIGNAL
HANDOVER REPORT
106
MS BSS 1 MSC
HND RQD
intraMSCintraMSC HandoverHandoverBSS 2
HND REQ
HND REQ ACKHND CMD
HND CMD
HANDO ACCESS
HND DETECT
PHYS INFO
HANDO COM
CHAN REL CRL CMD
CRL COM
HND CMP
54
107
radio channels used by SMS
Short Short MessageMessage ServiceService (SMS)(SMS)architecturearchitecture
SME
SMSC
SME
SME
SME
SMSGW-MSC MSC BSSCSS7
SMSC: Short Message Service CenterSMS-GW-MSC: SMS Gateway MSC
(usually integrated in the SMSC)SME: Short Message Entity (entity that
is able to Tx or Rx short messages; SME may be in the fixed network, maybe a MS, or other services center
HLR VLR
(Stand-by mode)
(Dedicated mode)
Outside the scope of GSM standard
108
Short Message Service (SMS)Short Message Service (SMS)
Mobile Originated
BSS
MSCMSC IWMSCIWMSC1 2 3 4SMSSMS--CC
BSSMSCMSCGMSCGMSC
14
78
2?
info3
5?
info6
HLR VLR
Mobile Terminated
55
109
Mobile Mobile OriginatedOriginated Short Short MessageMessage (MO (MO -- SM)SM)
110
Mobile Mobile TerminatedTerminated Short Short MessageMessage (MT (MT -- SM)SM)
56
111
QoSQoS requirements of traffic typesrequirements of traffic types
Jitter DelayConversational
Loss
Streaming
Interactive
Background
Voce
Video
Signaling
Internet
112
Network Network EvolutionEvolution: : simplifiedsimplified modelsmodels
STP
STP STP
STP
SS7 network(packet switching)
Telephone Network(Circuit switching)
VoiceServices
Signaling(+ SMS of GSM)
router
routerrouter
router
routerinternet (IP)(packet switching)
Data Services
57
113
RELIABLE
MAX DELAY
Current transport Protocols over IP
TCP
UDP
SIGNALINGREQUIREMENTS
NON REAL TIME
NON RELIABLE “FAST”
LIGHT
RELIABLE
“FAST” LIGHT
New Transport Protocol: SCTP(Stream Control Transmission Protocol) ;
Signaling over IP (Signaling over IP (SoIPSoIP))How to fulfill signaling requirements ?How to fulfill signaling requirements ?
ANSWER
114
ArchitecturalArchitectural ViewView of SCTP (RFC2960) of SCTP (RFC2960) •SCTP is viewed as a layer between the SCTP user application ("SCTP user" for short) and a connectionless packet network service such asIP. •The basic service offered by SCTP is the reliable transfer of usermessages between peer SCTP users.. It offers acknowledged error-freenon-duplicated transfer of datagrams (messages). Detection of data corruption, loss of data and duplication of data is achieved by usingchecksums and sequence numbers. A selective retransmissionmechanism is applied to correct loss or corruption of data• It performs this service within the context of an association betweentwo SCTP endpoints.•SCTP is connection-oriented in nature, but the SCTP association is a broader concept than the TCP connection.• SCTP provides the means for each SCTP endpoint to provide the other endpoint (during association startup) with a list of transportaddresses (i.e., multiple IP addresses in combination with an SCTP port) through which that endpoint can be reached and from which it willoriginate SCTP packets. The association spans transfers over all of the possible source/destination combinations which may be generated fromeach endpoint's lists.
58
115
MTP
1-3
M3UA/
SCTP/IP
SG MGC
ISUP
M3UA/
SCTP/
IP
PSTN/ISDN
DSS1MTP
1-3
ISUP
n:n
MGC
ISUP
M3UA/
SCTP/
IP/
IP network
n:n
MTP
1-3
M3UA/
SCTP/
IP
SGn:n
n:n
Signaling Transport over IP (I)Signaling Transport over IP (I)
MTP3 function resides in the
Signaling Gateway (SG)
116
MTP
1-2
M2UA/
SCTP/
IP/
SG
MGCPSTN/ISDN
1:nDSS1 MTP
1-2
ISUP
MTP3
ISUP
M2UA
SCTP/
IP/
MTP3
IP network
1:nASP
ASP
Signaling Transport over IP (I)Signaling Transport over IP (I)M2UA (RFC3331) provides an equivalent functionality to its users asMTP2 provides to MTP3. It is used between a SG and a MGC. UnlikeM2UA, M2PA (IETF draft) supports complete MTP3 messagehandling and network management between any two SS7 nodescommunicating over an IP network.
59
117
SignalingSignaling over IP over IP
IP Transfer Point (ITP), known in the industry as a Signaling Gateway (SG)
SEP: Signaling End Point
118
offload of SMS traffic from transit offload of SMS traffic from transit exchanges (TR/STP) exchanges (TR/STP) -- SMS over IPSMS over IP
Traffic from SMS procedures
Traffic from mobility procedures, Call handling and supplementary services
IP UNIGATEnetwork
MSC-VLR
STP STP
STP STP
SMS-C
SMS-C
HLR
HLR
SGw SGw
SGw SGw
MSC-VLR
60
119
Cisco Architecture: M2PA Cisco Architecture: M2PA adaptionadaptionprotocolprotocolSP SG (STP)
SS7Appl
MTP3
MTP2
MTP1
MTP2M2PA
SCTP
MTP1 IP
M2PA
SCTP
IP
SS7 IP
��������
Peer to PeerMTP3
SP
SS7Appl
MTP3
MTP2
MTP1
MTP3
MTP2
MTP1
SG (STP)SS7
Transport
SCCP SCCPGTTGTT GTTGTT
SCTP Stream Control Transmission Protocol (RFC 2960)M3UA MTP3 User Adaptation (RFC 3332)M2UA MTP2 User Adaptation (RFC 3331)M2PA MTP2 Peer to Peer Adaption (IETF draft)