Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Standards

3GPP2 C.S0016-D v2.0 April 2012

Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Standards

© 2012 3GPP2

3GPP2 and its Organizational Partners claim copyright in this document and individual Organizational Partners may copyright and issue documents or standards publications in individual Organizational Partner’s name based on this document. Requests for reproduction of this document should be directed to the 3GPP2 Secretariat at [email protected]. Requests to reproduce individual Organizational Partner’s documents should be directed to that Organizational Partner. See www.3gpp2.org for more information.

3GPP2 C.S0016-D v2.0

Revision History

Revision Description of Changes Date

C.S0016-0 Release 0 May 1998

C.S0016-A v2.0

Release A December 2001

C.S0016-B v1.0

Release B October 2002

C.S0016-C v1.0

Release C October 2004

C.S0016-D v1.0

Release D

January 2010

C.S0016-D v2.0

Point Release April 2012

3GPP2 C.S0016-D v2.0

CONTENTS

i

1 INTRODUCTION ........................................................................................................ 1-1 1

1.1 Scope ..................................................................................................................... 1-1 2

1.2 Terms and Numeric Information ............................................................................. 1-1 3

1.2.1 Terms ............................................................................................................... 1-1 4

1.2.2 Numeric Information ........................................................................................ 1-6 5

1.2.3 Constants ......................................................................................................... 1-9 6

1.3 References ............................................................................................................ 1-10 7

1.3.2 Normative References ..................................................................................... 1-10 8

1.3.2 Informative References ................................................................................... 1-12 9

1.4 Requirements Language ....................................................................................... 1-13 10

2 MESSAGE TRANSPORT PROTOCOL ........................................................................ 2-15 11

2.1 General ................................................................................................................ 2-15 12

2.2 Analog Transport Protocol .................................................................................... 2-15 13

2.2.1 OTASP Data Message Encapsulation ............................................................... 2-15 14

2.2.2 OTASP Data Message Segmentation ................................................................ 2-16 15

2.2.3 Mobile Station Procedures .............................................................................. 2-18 16

2.2.3.1 OTASP Transport Message Acknowledgment and Re-transmission ............ 2-18 17

2.2.3.2 Message Transmission .............................................................................. 2-19 18

2.2.3.3 Message Reception .................................................................................... 2-19 19

2.2.3.4 Reverse Voice Channel Message Format .................................................... 2-22 20

2.2.3.4.1 OTASP Transport Message ................................................................... 2-22 21

2.2.3.4.2 OTASP Transport Confirmation Message ............................................... 2-24 22

2.2.4 Base Station Procedures ................................................................................. 2-25 23

2.2.4.1 Message Transmission .............................................................................. 2-25 24

2.2.4.2 Message Reception .................................................................................... 2-26 25

2.2.4.3 Forward Voice Channel Message Format ................................................... 2-27 26

2.2.4.3.1 OTASP Transport Message ................................................................... 2-27 27

2.2.4.3.2 OTASP Transport Confirmation Message ............................................... 2-30 28

2.3 CDMA Transport Protocol ..................................................................................... 2-31 29

3 MOBILE STATION PROCEDURES .............................................................................. 3-1 30

3GPP2 C.S0016-D v2.0

CONTENTS

ii

3.1 Initial Values and NAM Parameters ........................................................................ 3-1 1

3.2 Initiation of the Programming Procedures ............................................................... 3-2 2

3.2.1 User-Initiated Procedure ................................................................................. 3-2 3

3.2.2 Network-Initiated Procedure ........................................................................... 3-5 4

3.2.2.1 Initiation of OTAPA in the CDMA Mobile Station Idle State .......................... 3-5 5

3.2.2.2 Connection of the OTAPA Service Option .................................................... 3-5 6

3.2.2.3 Starting the OTAPA session ........................................................................ 3-7 7

3.3 Programming Procedure ........................................................................................ 3-7 8

3.3.1 OTASP Data Message Processing ....................................................................... 3-7 9

3.3.1.1 Configuration Request Message Processing ................................................. 3-8 10

3.3.1.2 Download Request Message Processing ....................................................... 3-8 11

3.3.1.3 Commit Request Message Processing .......................................................... 3-9 12

3.3.1.4 Re-Authenticate Request Message Processing ........................................... 3-11 13

3.3.1.5 MS Key Request Message Processing ........................................................ 3-11 14

3.3.1.6 Key Generation Request Message Processing ............................................ 3-13 15

3.3.1.7 Protocol Capability Request Message Processing ....................................... 3-14 16

3.3.1.8 SSPR Configuration Request Message Processing ..................................... 3-14 17

3.3.1.9 SSPR Download Request Message Processing ........................................... 3-15 18

3.3.1.10 Validation Request Message Processing .................................................. 3-17 19

3.3.1.11 OTAPA Request Message Processing ....................................................... 3-19 20

3.3.1.12 PUZL Configuration Request Message Processing .................................... 3-20 21

3.3.1.13 PUZL Download Request Message Processing ......................................... 3-23 22

3.3.1.14 3GPD Configuration Request Message Processing ................................... 3-26 23

3.3.1.15 3GPD Download Request Message Processing ......................................... 3-27 24

3.3.1.16 Secure Mode Request Message Processing .............................................. 3-30 25

3.3.1.17 MMD Configuration Request Message Processing .................................... 3-30 26

3.3.1.18 MMD Download Request Message Processing ......................................... 3-31 27

3.3.1.19 System Tag Configuration Request Message Processing .......................... 3-32 28

3.3.1.20 System Tag Download Request Message Processing ................................ 3-33 29

3.3.1.21 Service Key Generation Request Message Processing .............................. 3-35 30

3GPP2 C.S0016-D v2.0

CONTENTS

iii

3.3.1.22 MMS Configuration Request Message Processing .................................... 3-35 1

3.3.1.23 MMS Download Request Message Processing .......................................... 3-36 2

3.3.1.24 MMSS Configuration Request Message Processing .................................. 3-37 3

3.3.1.25 MMSS Download Request Message Processing ........................................ 3-38 4

3.3.2 Mobile Station SSD Update and Re-authentication ......................................... 3-40 5

3.3.3 Activation of Message Encryption ................................................................... 3-41 6

3.3.4 Activation of Voice Privacy .............................................................................. 3-42 7

3.3.5 System Selection for Preferred Roaming .......................................................... 3-42 8

3.3.6 Service Programming Lock .............................................................................. 3-42 9

3.3.7 Subscriber Parameter Administration Security Mechanism ............................ 3-43 10

3.3.8 Secure Mode ................................................................................................... 3-44 11

3.3.8.1 Generation of Secure Mode Ciphering Key ................................................ 3-44 12

3.3.8.2 Encryption and Decryption of messages in Secure Mode ........................... 3-45 13

3.3.9 System Tag Indicator ...................................................................................... 3-45 14

3.3.10 Generation of Service Keys ............................................................................ 3-46 15

3.3.10.1 Generation of Intermediate Key ............................................................... 3-46 16

3.3.10.2 Generation of Service Keys ...................................................................... 3-46 17

3.4 Termination of the Programming Procedure .......................................................... 3-47 18

3.5 Reverse Link Message Formats ............................................................................. 3-48 19

3.5.1 Message Contents ........................................................................................... 3-50 20

3.5.1.1 Configuration Response Message .............................................................. 3-50 21

3.5.1.2 Download Response Message .................................................................... 3-51 22

3.5.1.3 MS Key Response Message ........................................................................ 3-55 23

3.5.1.4 Key Generation Response Message ........................................................... 3-55 24

3.5.1.5 Re-Authenticate Response Message .......................................................... 3-56 25

3.5.1.6 Commit Response Message ....................................................................... 3-57 26

3.5.1.7 Protocol Capability Response Message ...................................................... 3-57 27

3.5.1.8 SSPR Configuration Response Message ..................................................... 3-62 28

3.5.1.9 SSPR Download Response Message .......................................................... 3-63 29

3.5.1.10 Validation Response Message ................................................................. 3-64 30

3GPP2 C.S0016-D v2.0

CONTENTS

iv

3.5.1.11 OTAPA Response Message ...................................................................... 3-65 1

3.5.1.12 PUZL Configuration Response Message ................................................... 3-66 2

3.5.1.13 PUZL Download Response Message ......................................................... 3-67 3

3.5.1.14 3GPD Configuration Response Message .................................................. 3-69 4

3.5.1.15 3GPD Download Response Message ........................................................ 3-70 5

3.5.1.16 Secure Mode Response Message ............................................................. 3-71 6

3.5.1.17 Extended Protocol Capability Response Message ..................................... 3-72 7

3.5.1.17.1 Capability Information Record ........................................................... 3-74 8

3.5.1.17.1.1 Operating Mode Information ........................................................ 3-74 9

3.5.1.17.1.2 CDMA Band Class Information .................................................... 3-75 10

3.5.1.17.1.3 MEID ........................................................................................... 3-76 11

3.5.1.17.1.4 ICCID .......................................................................................... 3-76 12

3.5.1.17.1.5 EXT_UIM_ID ................................................................................ 3-77 13

3.5.1.17.1.6 MEID_ME .................................................................................... 3-77 14

3.5.1.18 MMD Configuration Response Message ................................................... 3-78 15

3.5.1.19 MMD Download Response Message......................................................... 3-79 16

3.5.1.20 System Tag Configuration Response Message ......................................... 3-80 17

3.5.1.21 System Tag Download Response Message ............................................... 3-81 18

3.5.1.22 Service Key Generation Response Message ............................................. 3-82 19

3.5.1.23 MMS Configuration Response Message ................................................... 3-82 20

3.5.1.24 MMS Download Response Message ......................................................... 3-84 21

3.5.1.25 MMSS Configuration Response Message ................................................. 3-85 22

3.5.1.26 MMSS Download Response Message ....................................................... 3-88 23

3.5.2 NAM Parameter Blocks ................................................................................... 3-90 24

3.5.2.1 CDMA/Analog NAM Parameter Block ........................................................ 3-91 25

3.5.2.2 Mobile Directory Number .......................................................................... 3-94 26

3.5.2.3 CDMA NAM Parameter Block .................................................................... 3-95 27

3.5.2.4 IMSI_T Parameter Block ............................................................................ 3-97 28

3.5.2.5 eHRPD IMSI Parameter Block ................................................................... 3-98 29

3.5.3 SSPR Parameter Blocks .................................................................................. 3-99 30

3GPP2 C.S0016-D v2.0

CONTENTS

v

3.5.3.1 Preferred Roaming List Dimensions Parameter Block .............................. 3-100 1

3.5.3.2 Preferred Roaming List Parameter Block ................................................. 3-101 2

3.5.3.3 Extended Preferred Roaming List Dimensions Parameter Block .............. 3-103 3

3.5.4 Reserved ....................................................................................................... 3-104 4

3.5.5 Preferred Roaming List and Extended Preferred Roaming List ....................... 3-104 5

3.5.5.1 Preferred Roaming List CRC Calculation ................................................. 3-109 6

3.5.5.2 Acquisition Records ................................................................................ 3-109 7

3.5.5.2.1 Acquisition Record Formats .............................................................. 3-111 8

3.5.5.2.1.1 Cellular Analog System Acquisition Record ................................. 3-111 9

3.5.5.2.1.2 Cellular CDMA and JTACS CDMA System Acquisition (Standard 10

Channels) Record .......................................................................................... 3-112 11

3.5.5.2.1.3 Cellular CDMA and JTACS CDMA System Acquisition (Custom 12

Channels) Record .......................................................................................... 3-113 13

3.5.5.2.1.4 Cellular CDMA Preferred System Acquisition Record ................... 3-114 14

3.5.5.2.1.5 PCS CDMA System Acquisition (Using Blocks) Record ................. 3-114 15

3.5.5.2.1.6 PCS CDMA and 2 GHz Band CDMA System Acquisition (Using 16

Channels) Record .......................................................................................... 3-115 17

3.5.5.2.1.7 JTACS CDMA System Acquisition (Standard Channels) Record ... 3-116 18

3.5.5.2.1.8 JTACS CDMA System Acquisition (Custom Channels) Record ..... 3-116 19

3.5.5.2.1.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 3-117 20

3.5.5.2.2 Extended Acquisition Record Format ................................................ 3-118 21

3.5.5.2.2.1 Cellular Analog System Acquisition Record ................................. 3-118 22

3.5.5.2.2.2 Cellular CDMA System Acquisition (Standard Channels) Record . 3-119 23

3.5.5.2.2.3 Cellular CDMA System Acquisition (Custom Channels) Record ... 3-119 24

3.5.5.2.2.4 Cellular CDMA Preferred System Acquisition Record ................... 3-120 25

3.5.5.2.2.5 PCS CDMA System Acquisition (Using Blocks) Record ................. 3-120 26

3.5.5.2.2.6 PCS CDMA System Acquisition (Using Channels) Record ............ 3-121 27

3.5.5.2.2.7 JTACS CDMA System Acquisition (Standard Channels) Record ... 3-122 28

3.5.5.2.2.8 JTACS CDMA System Acquisition (Custom Channels) Record ..... 3-122 29

3.5.5.2.2.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 3-123 30

3.5.5.2.2.10 Generic Acquisition Record for cdma2000 1x and IS-95 ............ 3-123 31

3GPP2 C.S0016-D v2.0

CONTENTS

vi

3.5.5.2.2.11 Generic Acquisition Record for HRPD ........................................ 3-124 1

3.5.5.2.2.12 Reserved for Obsolete Identification Record Types ..................... 3-124 2

3.5.5.2.2.13 Common Acquisition Table Record for UMB .............................. 3-124 3

3.5.5.2.2.14 Generic Acquisition Record for UMB .......................................... 3-126 4

3.5.5.3 System Record and Extended System Record Format ............................. 3-127 5

3.5.5.3.1 System Record Format ...................................................................... 3-127 6

3.5.5.3.2 Extended System Record Format ...................................................... 3-129 7

3.5.5.3.2.1 Common Subnet Table for the HRPD Extended System Record ... 3-135 8

3.5.5.3.2.2 Type-specific System ID Record of type ‘0011’ ............................. 3-135 9

3.5.6 PUZL Parameter Blocks ................................................................................ 3-139 10

3.5.6.1 PUZL Dimensions Parameter Block ......................................................... 3-141 11

3.5.6.2 PUZL Priorities Parameter Block ............................................................. 3-145 12

3.5.6.3 User Zone Parameter Block ..................................................................... 3-146 13

3.5.6.4 Preferred User Zone List Parameter Block ............................................... 3-147 14

3.5.7 Preferred User Zone List (PUZL) .................................................................... 3-148 15

3.5.7.1 User Zone Type Specific Fields ................................................................ 3-156 16

3.5.7.1.1 User Zone Type 1: Broadcast – RF Coverage Based ............................. 3-156 17

3.5.7.1.2 User Zone Type 2: Broadcast – Geo-based ......................................... 3-156 18

3.5.7.1.2.1 Circle .......................................................................................... 3-157 19

3.5.7.1.2.2 Segmented Linear ....................................................................... 3-159 20

3.5.7.1.2.3 Polygon ...................................................................................... 3-161 21

3.5.7.1.3 User Zone Type 3: Mobile Specific – RF Coverage Based - Overhead 22

Parameter Determined ..................................................................................... 3-163 23

3.5.7.1.3.1 SID Only ..................................................................................... 3-163 24

3.5.7.1.3.2 SID and NID ............................................................................... 3-164 25

3.5.7.1.3.3 SID and BASE_ID ........................................................................ 3-165 26

3.5.7.1.3.4 Base Station Latitude and Longitude .......................................... 3-166 27

3.5.7.1.3.5 User Zone Center Point and Radius ............................................ 3-166 28

3.5.7.1.4 User Zone Type 4: Mobile Specific – Geo-Based ................................. 3-167 29

3.5.7.1.5 User Zone Type 5: Mobile Specific – Geo-Based – Separate Carrier .... 3-167 30

3.5.7.1.6 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based ...... 3-169 31

3GPP2 C.S0016-D v2.0

CONTENTS

vii

3.5.7.1.6.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – 1

System Information ....................................................................................... 3-175 2

3.5.7.1.6.1.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – 3

System Information for 1x ............................................................................. 3-176 4


System Information for HRPD ....................................................................... 3-178 6

3.5.7.1.6.2 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – 7

Acquisition Information ................................................................................. 3-179 8


Acquisition Information for 1x and HRPD ...................................................... 3-179 10

3.5.7.1.6.3 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – UZ 11

RF Information .............................................................................................. 3-180 12


UZ RF Information for 1x .............................................................................. 3-181 14


UZ RF Information for HRPD ......................................................................... 3-184 16

3.5.8 3GPD Parameter Blocks ................................................................................ 3-187 17

3.5.8.1 3GPD Operation Capability Parameters .................................................. 3-188 18

3.5.8.2 3GPD Operation Mode Parameters .......................................................... 3-189 19

3.5.8.3 Simple IP Capability Parameters ............................................................ 3-190 20

3.5.8.4 Mobile IP Capability Parameters ............................................................. 3-191 21

3.5.8.5 Simple IP User Profile Parameters ........................................................... 3-193 22

3.5.8.6 Mobile IP User Profile Parameters ........................................................... 3-195 23

3.5.8.7 Simple IP Status Parameters ................................................................... 3-198 24

3.5.8.8 Mobile IP Status Parameters ................................................................... 3-198 25

3.5.8.9 Simple IP PAP SS Parameters .................................................................. 3-199 26

3.5.8.10 Simple IP CHAP SS Parameters ............................................................. 3-200 27

3.5.8.11 Mobile IP SS Parameters ....................................................................... 3-201 28

3.5.8.12 HRPD Access Authentication Capability Parameters ............................. 3-202 29

3.5.8.13 HRPD Access Authentication User Profile Parameters ........................... 3-203 30

3.5.8.14 HRPD Access Authentication CHAP SS Parameters ............................... 3-204 31

3.5.8.15 eHRPD AKA Algorithm Capability Parameters ....................................... 3-205 32

3.5.8.16 eHRPD MILENAGE Algorithm Parameters ............................................. 3-205 33

3GPP2 C.S0016-D v2.0

CONTENTS

viii

3.5.9 MMD Parameter Block .................................................................................. 3-206 1

3.5.9.1 MMD Application Parameters .................................................................. 3-207 2

3.5.10 System Tag Parameter Blocks ..................................................................... 3-209 3

3.5.10.1 Home System Tag ................................................................................. 3-209 4

3.5.10.2 Group Tag List Dimensions ................................................................... 3-210 5

3.5.10.3 Group Tag List Parameter Block ........................................................... 3-211 6

3.5.10.4 Specific Tag List Dimensions ................................................................. 3-212 7

3.5.10.5 Specific Tag List Parameter Block ......................................................... 3-213 8

3.5.10.6 Call Prompt List Dimensions ................................................................. 3-214 9

3.5.10.7 Call Prompt Tag List Parameter Block ................................................... 3-215 10

3.5.11 Group Tag List, Specific Tag List and Call Prompt List ................................ 3-216 11

3.5.11.1 Group Tag List, Specific Tag List, and Call Prompt List CRC Calculation3-220 12

3.5.11.2 Group Tag Records ............................................................................... 3-220 13

3.5.11.2.1 Group Tag Record Format ............................................................... 3-220 14

3.5.11.2.1.1 Group Tag Record – Single Entry ............................................... 3-220 15

3.5.11.2.1.2 Group Tag Record – Range ........................................................ 3-222 16

3.5.11.3 Specific Tag Records ............................................................................. 3-224 17

3.5.11.3.1 Specific Tag Record Format ............................................................. 3-225 18

3.5.11.3.1.1 Specific Tag Record – Single Entry ............................................. 3-225 19

3.5.11.3.1.2 Specific Tag Record – Range ...................................................... 3-226 20

3.5.11.4 Call Prompt Record Format ................................................................ 3-228 21

3.5.12 MMS Parameter Block ................................................................................ 3-230 22

3.5.12.1 MMS URI Parameters ............................................................................ 3-230 23

3.5.12.2 MMS URI Capability Parameters ........................................................... 3-231 24

3.5.13 MMSS Configuration Parameter Blocks ...................................................... 3-232 25

3.5.13.1 AIR_INT_TYPE SUPPORTED Parameter Block ....................................... 3-232 26

3.5.13.2 MMSS MODE SETTINGS Parameter Block ............................................ 3-233 27

3.5.13.3 MMSS Location Associated Priority List (MLPL) Parameter Block .......... 3-234 28

3.5.13.4 MMSS System Priority List (MSPL) ........................................................ 3-240 29

3.5.13.5 MMSS WLAN Configuration Parameters ................................................ 3-245 30

3GPP2 C.S0016-D v2.0

CONTENTS

ix

4 BASE STATION PROCEDURES .................................................................................. 4-1 1

4.1 Reserved ................................................................................................................. 4-1 2

4.2 Initiation of the Programming Procedures ............................................................... 4-1 3

4.2.1 User-Initiated Procedure ................................................................................... 4-1 4

4.2.2 Network-Initiated Procedure. ............................................................................ 4-2 5

4.3 Programming Data Download ................................................................................ 4-2 6

4.3.1 OTA Data Message Processing .......................................................................... 4-2 7

4.3.1.1 Configuration Request Message Processing ................................................. 4-3 8

4.3.1.2 Download Request Message Processing ....................................................... 4-3 9

4.3.1.3 Commit Request Message Processing .......................................................... 4-3 10

4.3.1.4 Re-Authenticate Request Message Processing ............................................. 4-3 11

4.3.1.5 MS Key Request Message Processing .......................................................... 4-3 12

4.3.1.6 Key Generation Request Message Processing .............................................. 4-3 13

4.3.1.7 Protocol Capability Request Message Processing ......................................... 4-3 14

4.3.1.8 SSPR Configuration Request Message Processing ....................................... 4-4 15

4.3.1.9 SSPR Download Request Message Processing ............................................. 4-4 16

4.3.1.10 Validation Request Message Processing .................................................... 4-4 17

4.3.1.11 OTAPA Request Message Processing ......................................................... 4-5 18

4.3.1.12 PUZL Configuration Request Message Processing ...................................... 4-5 19

4.3.1.13 PUZL Download Request Message Processing ........................................... 4-5 20

4.3.1.14 3GPD Configuration Request Message Processing ..................................... 4-5 21

4.3.1.15 3GPD Download Request Message Processing ........................................... 4-5 22

4.3.1.16 Secure Mode Request Message Processing ................................................ 4-5 23

4.3.1.17 MMD Configuration Request Message Processing ...................................... 4-6 24

4.3.1.18 MMD Download Request Message Processing ........................................... 4-6 25

4.3.1.19 System Tag Configuration Request Message Processing ............................ 4-6 26

4.3.1.20 System Tag Download Request Message Processing .................................. 4-6 27

4.3.1.21 Service Key Generation Request Message Processing ................................ 4-6 28

4.3.1.22 MMS Configuration Request Message Processing ...................................... 4-6 29

4.3.1.23 MMS Download Request Message Processing ............................................ 4-6 30

3GPP2 C.S0016-D v2.0

CONTENTS

x

4.3.1.24 MMSS Configuration Request Message Processing .................................... 4-6 1

4.3.1.25 MMSS Download Request Message Processing .......................................... 4-7 2

4.3.2 SSD Update and re-authentication ................................................................... 4-7 3

4.3.3 Activation of Message Encryption ..................................................................... 4-7 4

4.3.4 Activation of Voice Privacy Mode ....................................................................... 4-7 5

4.3.5 Secure Mode ..................................................................................................... 4-8 6

4.3.5.1 Generation of Secure Mode Ciphering Key .................................................. 4-8 7

4.3.5.2 Encryption and Decryption of Messages in Secure Mode ............................. 4-9 8

4.3.6 Generation of Service Keys................................................................................ 4-9 9

4.3.6.1 Generation of Intermediate Key ................................................................... 4-9 10

4.3.6.2 Generation of Service Keys ........................................................................ 4-10 11

4.4 Termination of the Programming Procedure .......................................................... 4-10 12

4.5 Forward Link Message Formats ............................................................................ 4-11 13

4.5.1 Message Contents ........................................................................................... 4-13 14

4.5.1.1 Configuration Request Message ................................................................ 4-13 15

4.5.1.2 Download Request Message ...................................................................... 4-14 16

4.5.1.3 MS Key Request Message .......................................................................... 4-15 17

4.5.1.4 Key Generation Request Message .............................................................. 4-16 18

4.5.1.5 Re-Authenticate Request Message ............................................................ 4-17 19

4.5.1.6 Commit Request Message ......................................................................... 4-17 20

4.5.1.7 Protocol Capability Request Message ........................................................ 4-18 21

4.5.1.8 SSPR Configuration Request Message ....................................................... 4-19 22

4.5.1.9 SSPR Download Request Message ............................................................. 4-20 23

4.5.1.10 Validation Request Message .................................................................... 4-21 24

4.5.1.11 OTAPA Request Message ......................................................................... 4-22 25

4.5.1.12 PUZL Configuration Request Message ..................................................... 4-22 26

4.5.1.13 PUZL Download Request Message ........................................................... 4-24 27

4.5.1.14 3GPD Configuration Request Message .................................................... 4-25 28

4.5.1.15 3GPD Download Request Message .......................................................... 4-26 29

4.5.1.16 Secure Mode Request Message ................................................................ 4-27 30

3GPP2 C.S0016-D v2.0

CONTENTS

xi

4.5.1.17 Reserved ................................................................................................. 4-28 1

4.5.1.18 MMD Configuration Request Message ..................................................... 4-28 2

4.5.1.19 MMD Download Request Message ........................................................... 4-29 3

4.5.1.20 System Tag Configuration Request Message ............................................ 4-30 4

4.5.1.21 System Tag Download Request Message ................................................. 4-31 5

4.5.1.22 Service Key Generation Request Message ................................................ 4-31 6

4.5.1.23 MMS Configuration Request Message ..................................................... 4-32 7

4.5.1.24 MMS Download Request Message ........................................................... 4-33 8

4.5.1.25 MMSS Configuration Request Message ................................................... 4-34 9

4.5.1.26 MMSS Download Request Message ......................................................... 4-35 10

4.5.2 NAM Parameter Blocks ................................................................................... 4-38 11

4.5.2.1 CDMA/Analog NAM Download .................................................................. 4-39 12

4.5.2.2 Mobile Directory Number .......................................................................... 4-41 13

4.5.2.3 CDMA NAM Download .............................................................................. 4-42 14

4.5.2.4 IMSI_T Parameter Block ............................................................................ 4-44 15

4.5.2.5 eHRPD IMSI Download ............................................................................. 4-45 16

4.5.3 SSPR Parameter Blocks .................................................................................. 4-46 17

4.5.3.1 Preferred Roaming List Parameter Block ................................................... 4-46 18

4.5.4 Validation Parameter Blocks ........................................................................... 4-47 19

4.5.4.1 Verify SPC ................................................................................................. 4-47 20

4.5.4.2 Change SPC .............................................................................................. 4-48 21

4.5.4.3 Validate SPASM ........................................................................................ 4-49 22

4.5.5 Reserved ......................................................................................................... 4-49 23

4.5.6 PUZL Parameter Blocks .................................................................................. 4-49 24

4.5.6.1 User Zone Insert and User Zone Update .................................................... 4-50 25

4.5.6.2 User Zone Delete ....................................................................................... 4-51 26

4.5.6.3 User Zone Priority Change ........................................................................ 4-51 27

4.5.6.4 PUZL Flags ............................................................................................... 4-53 28

4.5.7 3GPD Parameter Blocks .................................................................................. 4-55 29

4.5.7.1 3GPD Operation Mode Parameters ............................................................ 4-56 30

3GPP2 C.S0016-D v2.0

CONTENTS

xii

4.5.7.2 Simple IP User Profile Parameters ............................................................. 4-56 1

4.5.7.3 Mobile IP User Profile Parameters ............................................................. 4-58 2

4.5.7.4 Simple IP Status Parameters ..................................................................... 4-61 3

4.5.7.5 Mobile IP Status Parameters ................................................................... 4-61 4

4.5.7.6 Simple IP PAP SS Parameters ................................................................... 4-62 5

4.5.7.7 Simple IP CHAP SS Parameters ............................................................... 4-63 6

4.5.7.8 Mobile IP SS Parameters .......................................................................... 4-64 7

4.5.7.9 HRPD Access Authentication User Profile Parameters ............................... 4-65 8

4.5.7.10 HRPD Access Authentication CHAP SS Parameters ................................. 4-65 9

4.5.7.11 eHRPD MILENAGE Algorithm Parameters ............................................... 4-66 10

4.5.8 MMD Parameter Block .................................................................................... 4-67 11

4.5.8.1 MMD Application Parameters .................................................................... 4-67 12

4.5.9 System Tag Parameter Blocks ......................................................................... 4-69 13

4.5.9.1 Home System Tag Parameter Block ........................................................... 4-69 14

4.5.9.2 Group Tag List Parameter Block ............................................................... 4-71 15

4.5.9.3 Specific Tag List Parameter Block ............................................................. 4-73 16

4.5.9.4 Call Prompt List Parameter Block ............................................................. 4-74 17

4.5.10 MMS Parameter Block .................................................................................. 4-75 18

4.5.10.1 MMS URI Parameters .............................................................................. 4-75 19

4.5.11 MMSS Parameter Blocks ............................................................................... 4-76 20

4.5.11.1 MMSS Mode Settings Parameter Block .................................................... 4-77 21

4.5.11.2 MMSS Location Associated Priority List (MLPL) Parameter Block ............ 4-77 22

4.5.11.3 MMSS System Priority List (MSPL) Parameter Block ................................ 4-78 23

4.5.11.4 MMSS WLAN Download PARAM .............................................................. 4-81 24

5 KEY EXCHANGE PROCEDURES ............................................................................. 5-85 25

5.1 Mobile Station Requirements for A_KEY_P_REV < ‘00000011’ .............................. 5-85 26

5.1.1 Random Number Generation .......................................................................... 5-85 27

5.1.2 Mobile Station Result ...................................................................................... 5-85 28

5.1.3 A-key Computation ......................................................................................... 5-85 29

5.2 Base Station Requirements for A_KEY_P_REV < ‘00000011’ ................................. 5-85 30

3GPP2 C.S0016-D v2.0

CONTENTS

xiii

5.2.1 Generation of the Key Exchange Parameters ................................................... 5-85 1

5.2.2 Base Station Result ........................................................................................ 5-86 2

5.2.3 A-key Computation ......................................................................................... 5-86 3

5.3 Mobile Station Requirements for A_KEY_P_REV = ‘00000011’ or ‘00000100’ ........ 5-86 4

5.3.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure ....... 5-86 5


5.3.3 A-key and Root Key Computation for A_KEY_P_REV = ‘00000011’ .................. 5-87 7

5.3.4 Root Key Computation for A_KEY_P_REV = ‘00000100’ ................................... 5-87 8

5.4 Base Station Requirements for A_KEY_P_REV = ‘00000011’ or ‘00000100’ ........... 5-87 9

5.4.1 Generation of the Key Exchange Parameters Root Key .................................... 5-87 10


5.4.3 A-key and Root Key Computation for A_KEY_P_REV = ‘00000011’ .................. 5-88 12

5.4.4 Root Key K Computation for A_KEY_P_REV = ‘00000100’ ............................... 5-89 13

5.5 Mobile Station Requirements for A_KEY_P_REV = ‘00000101’ .............................. 5-89 14

5.5.1 Random Number Generation and Key Generation Parameters ........................ 5-89 15


5.5.3 Root Key Computation for A_KEY_P_REV = ‘00000101’ ................................... 5-90 17

5.6 Base Station Requirements for A_KEY_P_REV = ‘00000101’ ................................. 5-90 18



5.6.3 3G Root Key K Computation ........................................................................... 5-91 21


5.7.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure ....... 5-92 23


5.7.3 eHRPD Root Key Computation for A_KEY_P_REV = ‘00000111’ ....................... 5-92 25

5.8 Base Station Requirements for A_KEY_P_REV = ‘00000111’ ................................. 5-92 26

5.8.1 Generation of the Key Exchange Parameters Root Key .................................... 5-92 27


5.8.3 eHRPD Root Key eHRPD_K Computation for A_KEY_P_REV = ‘00000111’ ....... 5-92 29


3GPP2 C.S0016-D v2.0

CONTENTS

xiv



5.9.3 eHRPD Root Key Computation for A_KEY_P_REV = ‘00001000’ ....................... 5-93 3

5.10 Base Station Requirements for A_KEY_P_REV = ‘00001000’ ............................... 5-94 4

5.10.1 Random Number Generation and Key Generation Parameters ...................... 5-94 5

5.10.2 Base Station Result ...................................................................................... 5-94 6

5.10.3 eHRPD Root Key eHRPD_K Computation ...................................................... 5-94 7

ANNEX A VOID ........................................................................................................ A-1 8

ANNEX B VOID ........................................................................................................ B-1 9

ANNEX C (INFORMATIVE) SYSTEM SELECTION AND ACQUISITION ....................... C-1 10

C.1 Introduction .......................................................................................................... C-1 11

C.2 Accelerated System Selection ................................................................................. C-2 12

C.2.1 Using Positive and Negative Systems ................................................................ C-2 13

C.2.2 PCS Block Mode System Selection .................................................................... C-3 14

C.2.3 Special Cases and Considerations .................................................................... C-3 15

C.3 Preferred Roaming List Maintenance ...................................................................... C-4 16

ANNEX D (INFORMATIVE) SYSTEM SELECTION AND THE PREFERRED USER ZONE 17

LIST D-1 18

ANNEX E (INFORMATIVE) MULTIMODE SYSTEM SELECTION ................................ E-1 19

E.1 Introduction ........................................................................................................... E-1 20

E.1.1 MMSS Location Associated Priority List (MLPL) ................................................ E-1 21

E.1.2 MMSS System Priority List (MSPL) .................................................................... E-4 22

E.1.2.1 MMSS System Priority List (MSPL) Example ............................................... E-8 23

E.1.2.2 MMSS System Priority List (MSPL) with Specific System_Types................... E-9 24

E.1.2.3 MMSS System Priority List (MSPL) Examples of Higher Priority Search TimeE-11 25

26

3GPP2 C.S0016-D v2.0

FIGURES

xv

Figure 2.2.1-1 OTASP Data Message Encapsulation ...................................................... 2-15 1

Figure 2.2.1-2 OTASP Data Message CRC ..................................................................... 2-16 2

Figure 2.2.2-1 OTASP Data Message Capsule Segmentation on the Forward Analog Voice 3

Channel. ................................................................................................................. 2-17 4

Figure 2.2.2-2 OTASP Data Message Capsule Segmentation on the Reverse Analog Voice 5

Channel .................................................................................................................. 2-18 6

7

3GPP2 C.S0016-D v2.0

TABLES

xvi

Table 3.2.2.2-1 Valid Service Configuration Attributes for Service Option 18 .................. 3-6 1

Table 3.2.2.2-2 Valid Service Configuration Attributes for Service Option 19 .................. 3-6 2

Table 3.3.6-1 Service Programming Code Values ........................................................... 3-43 3

Table 3.3.10.2-1 Key Identifier Table ............................................................................. 3-47 4

Table 3.5-1 Reverse Link Messages ............................................................................... 3-48 5

Table 3.5.1.2-1 Result Codes ......................................................................................... 3-53 6

Table 3.5.1.7-1 Feature Identifier .................................................................................. 3-59 7

Table 3.5.1.7-2 Band/mode Capability Information ....................................................... 3-62 8

Table 3.5.1.13-1 UZ Type According to UZ_ID ............................................................... 3-68 9

Table 3.5.1.17.1-1 Capability Information Record Types ................................................ 3-74 10

Table 3.5.1.17.1.1-1. OP_MODE .................................................................................... 3-75 11

Table 3.5.1.17.1.5-1. EXT_UIM_ID Field Setting ............................................................ 3-77 12

Table 3.5.2-1 NAM Parameter Block Types .................................................................... 3-90 13

Table 3.5.3-1 SSPR Parameter Block Types ................................................................. 3-99 14

Table 3.5.5.2-1 Acquisition Record Type Values .......................................................... 3-110 15

Table 3.5.5.2-2 Extended Acquisition Record Type Values ........................................... 3-111 16

Table 3.5.5.2.1.1-1 Cellular System A/B Selection Type Values .................................. 3-112 17

Table 3.5.5.2.1.2-1 Cellular CDMA and JTACS CDMA Standard Channel Selection Type 18

Values .................................................................................................................. 3-113 19

Table 3.5.5.2.1.5-1 PCS CDMA Frequency Blocks ....................................................... 3-115 20

Table 3.5.5.2.1.7-1 JTACS CDMA Standard Channel Selection Type Values ................ 3-116 21

Table 3.5.5.3-1 NID_INCL Values ................................................................................ 3-128 22

Table 3.5.5.3.2-1 Type-specific system ID record ......................................................... 3-130 23

Table 3.5.5.3.2-2 Type-specific system ID record ......................................................... 3-132 24

Table 3.5.5.3.2-3 NID_INCL Values ............................................................................. 3-132 25

Table 3.5.5.3.2.2-1 Type-specific system ID record ...................................................... 3-135 26

Table 3.5.5.3.2.2-2 SYS_RECORD_SUBTYPE Values ................................................... 3-136 27

Table 3.5.5.3.2.2-3 Subtype Dependent record for Subtype ‘000’ ................................ 3-136 28



3GPP2 C.S0016-D v2.0

TABLES

xvii


Table 3.5.6-1. PUZL Parameter Block Types ............................................................... 3-140 2

Table 3.5.7-1 User Zone Type Values .......................................................................... 3-155 3

Table 3.5.7.1.2-1 Geo Type Values .............................................................................. 3-156 4

Table 3.5.7.1.3-1 Overhead Parameter (OHP) Type Values ........................................... 3-163 5

Table 3.5.8-1 3GPD Parameter Block Types ................................................................ 3-187 6

Table 3.5.8.2-1 Operation Mode .................................................................................. 3-189 7

Table 3.5.8.3-1 AUTH_ALGORITHM Parameter Values ................................................ 3-191 8

Table 3.5.8.4-1 MN-AAA_AUTH_ALGORITHM Parameter Values .................................. 3-192 9

Table 3.5.8.4-2 MN-HA_AUTH_ALGORITHM Parameter Values ................................... 3-193 10

Table 3.5.8.5-1 Authentication Algorithm Parameter Values for Simple IP ................... 3-194 11

Table 3.5.8.6-1 Authentication Algorithm Parameter Values ........................................ 3-197 12

Table 3.5.8.12-1 AUTH_ALGORITHM Parameter Values .............................................. 3-203 13

Table 3.5.8.13-1 Authentication Algorithm Parameter Values ...................................... 3-204 14

Table 3.5.9-1 MMD Parameter Block Types ................................................................. 3-206 15

Table 3.5.10-1 System Tag Parameter Block Types ...................................................... 3-209 16

Table 3.5.11.2-1 Group Tag Record Type Values ......................................................... 3-220 17

Table 3.5.11.3-1 Specific Tag Record Type Values ....................................................... 3-225 18

Table 3.5.12-1 MMS Parameter Block Types ................................................................ 3-230 19

Table 3.5.13-1 MMSS Configuration Parameter Block Types ....................................... 3-232 20

Table 3.5.13.3-1 LOC_PARAM_TYPE ........................................................................... 3-236 21

Table 3.5.13.3-2 LOC_PARAM_VAL ............................................................................. 3-237 22

Table 3.5.13.4-1 System Type ..................................................................................... 3-242 23

Table 3.5.13.4-2 Higher Priority Search Time .............................................................. 3-243 24

Table 3.5.13.4-3 Network Capability ........................................................................... 3-244 25

Table 3.5.13.5-1 WLAN Air Interface Types .................................................................. 3-246 26

Table 4.3.6.2-1 Key Identifier Table ............................................................................... 4-10 27

Table 4.5-1 Forward Link Messages .............................................................................. 4-12 28

Table 4.5.1.22-1 Key Identifier Table ............................................................................. 4-32 29

Table 4.5.2-1 NAM Parameter Block Types .................................................................... 4-38 30

Table 4.5.3-1 SSPR Parameter Block Types ................................................................... 4-46 31

3GPP2 C.S0016-D v2.0

TABLES

xviii

Table 4.5.4-1 Validation Parameter Block Types ............................................................ 4-47 1

Table 4.5.4.1-1. BCD Mapping ..................................................................................... 4-48 2

Table 4.5.6-1 PUZL Parameter Block Types ................................................................... 4-50 3

Table 4.5.7-1 3GPD Parameter Block Types .................................................................. 4-55 4

Table 4.5.8-1 MMD Parameter Block Types ................................................................... 4-67 5

Table 4.5.9-1 System Tag Parameter Block Types ........................................................ 4-69 6

Table 4.5.10-1 MMS Parameter Block Types .................................................................. 4-75 7

Table 4.5.11-1 MMSS Download Parameter Block Types ............................................... 4-76 8

Table C.1-1 Preferred Roaming List ................................................................................. C-1 9

Table C.1-2 Acquisition Table .......................................................................................... C-1 10

Table C.1-3 System Table ................................................................................................ C-2 11

Table E.1.1-1 MLPL ......................................................................................................... E-1 12

Table E.1.1-2 MLPL using MNC ....................................................................................... E-2 13

Table E.1.1-3 MLPL with SYS_LOC TAG .......................................................................... E-3 14

Table E.1.1-5 MLPL with different levels of granularity .................................................... E-4 15

Table E.1.2-1 Simplified cdma2000 PRL example for one GEO ........................................ E-6 16

Table E.1.2-2 PLMN selector example .............................................................................. E-7 17

Table E.1.2.2-1 MSPL Example E.1.2.2-1 ........................................................................ E-9 18

Table E.1.2.2-2 MSPL Index 1 for Example E.1.2.2-2 .................................................... E-10 19

Table E.1.2.2-3 Simplified cdma2000 PRL for Example E.1.2.2-2 .................................. E-10 20

Table E.1.2.2-4 Simplified PLMN Selector List for Example E.1.2.2-2 ............................ E-10 21

Table E.1.2.2-5 MLPL for Example E.1.2.2-2 ................................................................. E-11 22

Table E.1.2.3-1 MSPL Example 1 for Higher Priority Search Time ................................. E-11 23



26

3GPP2 C.S0016-D v2.0

FOREWORD

xix

(This foreword is not part of this DocumentStandard) 1

These technical requirements form a specificationstandard for Over-the-Air Service 2

Provisioning of mobile stations. A mobile station operating in either the analog or the 3

spread spectrum (CDMA) mode conforming with various versions of the CDMA standardair-4

interface specifications, such as TIA/EIA/IS-2000-A, TIA/EIA/IS-2000, TIA/EIA-95-B, 5

TIA/EIA/IS-95-A (inclusive of TSB74), or ANSI J-STD-008 and this specificationstandard 6

can be activated over the air in any system conforming with these specificationstandards. 7

The scope of this standard specification covers over-the-air provisioning of mobile station 8

operational parameters. This specificationstandard does not address the quality or 9

reliability of Over-the-Air Service Provisioning, nor does it cover equipment performance or 10

measurement procedures. 11

12

SECTION SUMMARY 13

1. Introduction. This section defines the terms, references, protocols and network 14

reference model used in this document. 15

2. Message Transmission Procedures. This section describes the lower-layer 16

procedures used for transmission of messages for Over-the-Air Service Provisioning. 17

3. Mobile Station Procedures. This section describes the processing of messages 18

received by the MS from the base station and the generation of messages to be 19

transmitted by the MS to the base station.This section describes the mobile station 20

procedures for Over-the-Air Service Provisioning. 21

4. Base Station Procedures. This section describes the processing of messages 22

received by the Base Station from the MS and the generation of messages to be 23

transmitted by the Base Station to the MS.This section describes the base station 24

procedures for Over-the-Air Service Provisioning. 25

5. Key Exchange Procedures. This section describes the requirements for key 26

exchange procedures. 27

3GPP2 C.S0016-D v2.0

NOTES

xx

1. The following verbal forms are used: “Shall” and “shall not” identify requirements to 1

be followed strictly to conform to the standard and from which no deviation is 2

permitted. “Should” and “should not” indicate that one of several possibilities is 3

recommended as particularly suitable, without mentioning or excluding others; that 4

a certain course of action is preferred but not necessarily required; or that (in the 5

negative form) a certain possibility or course of action is discouraged but not 6

prohibited. “May” and “need not” indicate a course of action permissible within the 7

limits of the standard. “Can” and “cannot” are used for statements of possibility and 8

capability, whether material, physical, or causal. 9

2. Footnotes appear at various points in this specification to elaborate and further 10

clarify items discussed in the body of the specification. 11

3. Unless indicated otherwise, this document presents numbers in decimal form. 12

Binary numbers are distinguished in the text by the use of single quotation marks. 13

In some tables, binary values may appear without single quotation marks if table 14

notation clearly specifies that values are binary. The character ‘x’ is used to 15

represent a binary bit of unspecified value. For example ‘xxx00010’ represents any 16

8-bit binary value such that the least significant five bits equal ‘00010’. 17

Hexadecimal numbers (base 16) are distinguished in the text by use of the form 18

0xhh where hh represents a string of hexadecimal digits. For example, 0x2fa1 19

represents a number whose binary value is ‘0010111110100001’ and whose decimal 20

value is 12193. Note that the exact number of bits in the binary representation of a 21

hexadecimal number strictly depends on the implementation requirements for the 22

variable being represented. 23

4. Numeric information is used to describe the operation of the mobile station. The 24

following subscripts are used in this document to clarify the use of the numeric 25

information: 26

• “s” indicates a value stored in a mobile station’s temporary memory. 27

• “r” indicates a value received by a mobile station over a forward analog channel 28

or a CDMA Forward Channel. 29

• “p” indicates a value set in a mobile station’s permanent security and 30

identification memory. 31

• “s-p” indicates a value stored in a mobile station’s semi-permanent security and 32


5. The term “mobile station” is equivalent to the term “personal station.” 34

56. IMSI_T Parameter Block does not apply for the mobile station conforming with 35

TIA/EIA/IS-95-A (inclusive of TSB74) or ANSI J-STD-008. 36

67. IMSI_M in this document is equivalent to IMSI defined in TIA/EIA/IS-95-A 37

(inclusive of TSB74) or ANSI J-STD-008. 38

3GPP2 C.S0016-D v2.0

xxi

78. Each mobile station is assigned either a single unique 32-bit binary serial number 1

(ESN) or a single unique 56-bit binary serial number (MEID) that cannot be changed 2

by the subscriber without rendering the mobile station inoperative. 3

8. The vertical bar symbol (|) signifies concatenation of bit strings in this specification. 4

3GPP2 C.S0016-D v2.0

xxii

The following standards contain provisions that, through reference in this text, constitute 1

provisions of this Standard. At the time of publication, the editions indicated were valid. 2

All standards are subject to revision, and parties to agreements based upon this Standard 3

are encouraged to investigate the possibility of applying the most recent editions of the 4

standards indicated below. ANSI and TIA maintain registers of currently valid national 5

standards published by them. 6

– Normative References: 7

1. TIA-95-B, “Mobile Station-Base Station Compatibility Standard for Wideband Spread 8

Spectrum Cellular Systems”, October 2004. 9

2. S.S0053-0, “Common Cryptographic Algorithms”, May 2009. 10

3. Reserved. 11

4. See Informative References. 12

5. C.S0002-E, “Physical Layer Standard for cdma2000 Spread Spectrum Systems”, 13

September 2009. 14

6. C.S0004-E, “Signaling Link Access Control (LAC) Standard for cdma2000 Spread 15

Spectrum Systems”, September 2009. 16

7. C.S0005-E, “Upper Layer (Layer 3) Signaling Standard for cdma2000 Spread Spectrum 17

Systems”, September 2009. 18

8. S.S0055 “Enhanced Cryptographic Algorithms, Rev. A”, January 2002. 19

9. C.S0024-B, “cdma2000 High Rate Packet Data Air Interface Specification”, September 20

2009. 21

10. IETF RFC 1334, “PPP Authentication Protocols”, October 1992. 22

11. IETF RFC 1994, “PPP Challenge Handshake Authentication Protocol (CHAP)”, August 23

1996. 24

12. IETF RFC 2002, “IP Mobility Support”, October 1996. 25

13. IETF RFC 2344, “Reverse Tunneling for Mobile IP”, August 1996. 26

14. IETF RFC 2486, “The Network Access Interface”, January 1999. 27

15. IETF RFC 3012, “Mobile IPv4 Challenge/Response Extensions”, November 1999. 28

16. National Bureau of Standards, Federal Information Processing Standards Publication 29

180-1; “Secure Hash Standard”, April 1995. 30

17. X.S0013, “ALL-IP Core Network Multimedia Domain”, December 2007 . 31

18. 3GPP TS 25.101, “UE Radio Transmission and Reception (FDD)”, March 2003. 32

19. X.S0016-310, “MMS MM1 Stage 3 Using OMA/WAP”, July 2004. 33

20. X.S0016-311, “MMS MM1 Stage 3 Using M-IMAP for Message Submission and Retrieval”, 34

May 2003. 35

21. X.S0016-312, “MMS MM1 Using SIP”, July 2004. 36

3GPP2 C.S0016-D v2.0

xxiii

22. C.S0006-D, “Analog Signaling Standard for cdma2000 Spread Spectrum Systems – 1

Release D”, March 2004. 2

23. C.S0057-D, “Band Class Specification for cdma2000 Spread Spectrum Systems”, 3

September 2009. 4

24. C.S0023-D, “Removable User Identity Module for Spread Spectrum Systems,” July 2009. 5

25. 3GPP TS 22.011 V7.9.0, “Technical Specification Group Services and System Aspects; 6

Service accessibility (Release 7)”, March 2008. 7

26. 3GPP TS 31.102 V7.12.0, “Technical Specification Group Core Network and Terminals; 8

Characteristics of the Universal Subscriber Identity Module (USIM) application (Release 7)”, 9

March 2008. 10

27. C.S0084-0, “Ultra Mobile Broadband Air Interface Specification”, Parts 0 to 9, September 11

2007. 12

28. X.S0057, “E-UTRAN - eHRPD Connectivity and Interworking: Core Network Aspects”, April 13

2009. 14

29. 3GPP TS 35.205 V8.0.0, “3G Security; Specification of the MILENAGE algorithm set: An 15

example algorithm set for the 3GPP authentication and key generation functions f1, f1*, f2, 16

f3, f4, f5 and f5*; Document 1: General”, December 2008. 17

30. National Institute of Standards and Technology: "Secure Hash Standard", FIPS 180-2, 18

With Change Notice 1 dated February 2004, August 2002. 19

31. 3GPP TS 24.008 V8.7.0, “Technical Specification Group Core Network and Terminals; 20

Mobile radio interface Layer 3 specification; Core network protocols (Release 8), Sept 21

2009. 22

32. C.S0065-A, “cdma2000 Application on UICC for Spread Spectrum Systems,” August 17, 23

2009. 24

See Informative References. 25

See Informative References. 26

33. X.S0011-002-E v1.0, “cdma2000 Wireless IP Network Standard: Simple IP and Mobile IP 27

Access Services,” Nov. 2009. 28

29

3GPP2 C.S0016-D v2.0

xxiv

– Informative References: 1

4. C.R1001-G, “Administration of Parameter Value Assignments for cdma2000 Spread 2

Spectrum Standards, Release G”, June 2009. 3

33. X.S0059 “cdma2000 Femto-cell Network”. 4

C.S0024-300-C v2.0, “Medium Access Layer for cdma2000 High Rate Packet Data Air 5

Interface Specification,” July, 2011. 6

7

8

9

3GPP2 C.S0016-D v2.0

1-1

1 INTRODUCTION 1

1.1 Scope 2

Over-the-Air Service Provisioning (OTASP) consists of the following features provisioned 3

over-the-air: 4

• Download of NAM operational parameters. 5

• Electronic Key Exchange for securely establishing the A-key and Root Key. 6

• System Selection for Preferred Roaming (SSPR) for providing mobile stations with 7

information allowing acquisition of the preferred system in an area. 8

• Preferred User Zone List (PUZL) for providing mobile stations which support the 9

optional User Zone feature with information allowing usage of the preferred user 10

zone in an area. 11

• Download of 3G packet data operational parameters. 12

Download of Multimode System Selection (MMSS) parameters. 13

Service Programming Lock (SPL), if provided, prevents the over-the-air provisioning of 14

certain mobile station parameters by an unauthorized network entity. 15

This document describes Over-the-Air Service Provisioning in CDMA and analog systems. 16

The procedures defined are intended to be extendable and flexible enough to be used with 17

future air interface specifications. The procedures in this document do not require support 18

for continuation of the service provisioning process following a CDMA-to-analog handoff. 19

1.2 Terms and Numeric Information 20

1.2.1 Terms 21

3GPD. Third Generation Packet Data 22

AC. See Authentication Center. 23

Access Authentication. A procedure in which the Access Terminal (AT) is authenticated 24

by the AN-AAA (Access Network Authentication, Authorization and Accounting entity). 25

Access Point (AP). A station used for communicating with mobile stations. Depending 26

upon the context, the term access point may refer to a base station [7], an access network 27

[9], or a Femtocell Access Point (FAP) [33]. An access point may be capable of supporting 28

multiple radio access technologies. 29

Activation Code. A user-entered combination of a specified Feature Code (*FC) and 30

defined group of at least two dialed digits (System Selection Code) that specify the user 31

selection of a Band and a Block operated by the selected service provider. 32

A-key. A secret, 64-bit pattern stored in the mobile station and HLR/AC. It is used to 33

generate/update the mobile station’s Shared Secret Data and to validate SPASM. 34

3GPP2 C.S0016-D v2.0

1-2

Analog Voice Channel. An analog channel on which a voice conversation occurs and on 1

which brief digital messages may be sent from a base station to a mobile station or from a 2

mobile station to a base station. 3

Authentication. A procedure used by a base station to validate a mobile station’s identity. 4

Authentication Center (AC). An entity that manages the authentication information 5

related to the mobile station. 6

Base Station. A fixed station used for communicating with mobile stations. Depending 7

upon the context, the term base station may refer to a cell, a sector within a cell, an MSC, 8

an OTAF, or other part of the wireless system. (See also MSC and OTAF.) 9

BCMCS Root Key. A secret 128-bit pattern used for BCMCS services. 10

CRC. See Cyclic Redundancy Code. 11

Cyclic Redundancy Code (CRC). A class of linear error detecting codes which generate 12

parity check bits by finding the remainder of a polynomial division. 13

Electronic Serial Number (ESN). A 32-bit number assigned by the mobile station 14

manufacturer, uniquely identifying the mobile station equipment. 15

eHRPD. See Evolved HRPD. 16

eHRPD IMSI. IMSI used to identify eHRPD-capable stations in the land mobile service as 17

specified in [28]. 18

eHRPD Root Key for A_Key_P_REV = ‘00000111’ or ‘00001000’. A secret 128-bit 19

pattern shared between the eHRPD mobile station and the Evolved Packet Core (EPC) 20

network [28]. 21

ESN. See Electronic Serial Number. 22

Evolved HRPD (eHRPD). The eHRPD network supports attachment to the EPC (evolved 23

packet core) of 3GPP. The eHRPD network optionally supports seamless handoffs between 24

E-UTRAN and evolved HRPD with single-radio terminals. 25

Forward CDMA Channel. A CDMA Channel from a base station to mobile stations. The 26

Forward CDMA Channel contains one or more code channels that are transmitted on a 27

CDMA frequency assignment using a particular pilot PN offset. 28

Forward Analog Voice Channel (FVC). An analog voice channel used from a base station 29

to a mobile station. 30

Forward Traffic Channel. A code channel used to transport user and signaling traffic 31

from the base station to the mobile station. 32

FRESH. A 15-bit value used by the mobile station and the base station as the 33

cryptographic synchronizer for encrypting parameter data in Secure Mode. FRESH may be 34

set by the encrypting side to any value, including a monotonically incremented counter, as 35

long as this value is not repeated for the duration of the Secure Mode in progress. 36

HLR. See Home Location Register. 37

3GPP2 C.S0016-D v2.0

1-3

Home Location Register (HLR). The location register to which a MIN/IMSI is assigned for 1

record purposes such as subscriber information. 2

Home System. The cellular system in which the mobile station subscribes for service. 3

HRPD. High Rate Packet Data. See [9]. 4

IMPI. IMS Private Identity. See [17]. 5

IMPU. IMS Public Identity. See [17]. 6

IMS Root Key. A secret 128-bit pattern used for IMS services. 7

IMSI. See International Mobile Station Identity. 8

IMSI_M. MIN based IMSI using the lower 10-digits to store the MIN. 9

IMSI_O. The operational value of IMSI used by the mobile station for operation with the 10

base station. 11

IMSI_T. IMSI not associated with MIN. 15-digits or fewer. 12

International Mobile Station Identity (IMSI). A method of identifying stations in the 13

land mobile service as specified in ITU-T Recommendation E.212. 14

Location Grouping. A set of systems/networks associated with a geo-location. 15

Long Code Mask. A 42-bit binary number that creates the unique identity of the long 16

code. See also Public Long Code, Private Long Code, Public Long Code Mask and Private 17

Long Code Mask. 18

LSB. Least significant bit. 19

MCC. See Mobile Country Code. 20

MEID. See Mobile Equipment Identifier. 21

MIN. See Mobile Identification Number. 22

MMD. Multimedia Domain. 23

MMS. Multimedia Messaging Service. 24

MMSS. Multimode System Selection. 25

MNC. See Mobile Network Code. 26

Mobile Country Code (MCC). A part of the E.212 IMSI identifying the home country. See 27

ITU-T Recommendation E.212. 28

Mobile Equipment Identifier (MEID). A 56-bit number assigned by the mobile station 29

manufacturer, uniquely identifying the mobile station equipment. 30

Mobile Directory Number. A dialable directory number which is not necessarily the same 31

as the mobile station’s air interface identification, i.e., MIN, IMSI_M or IMSI_T. 32

Mobile Identification Number (MIN). The 34-bit number that is a digital representation of 33

the 10-digit number assigned to a mobile station. 34

3GPP2 C.S0016-D v2.0

1-4

Mobile Network Code (MNC). A part of the E.212 IMSI identifying the home network 1

within the home country. See ITU-T Recommendation E.212. 2

Mobile Station. A station, fixed or mobile, which serves as the end user’s wireless 3

communication link with the base station. Mobile stations include portable units (e.g., 4

hand-held personal units) and units installed in vehicles. 5

Mobile Station Originated Call. A call originating from a mobile station. 6

Mobile Station Terminated Call. A call received by a mobile station (not to be confused 7

with a disconnect or call release). 8

Mobile Switching Center (MSC). A configuration of equipment that provides wireless 9

radiotelephone service. Also called the Mobile Telephone Switching Office (MTSO). 10

MSB. Most significant bit. 11

MSC. See Mobile Switching Center. 12

Multimode System Selection (MMSS). A feature that supports system selection across 13

cdma2000®1 and non-cdma2000 systems based on a set of parameters stored in the mobile 14

station in the form of a MMSS Location Associated Priority List (MLP_LISTs-p) and MMSS 15

System Priority List (MSP_LISTs-p). 16

NAM. See Number Assignment Module. 17

Network. A network is a subset of a wireless system, such as an area-wide wireless 18

network, a private group of base stations, or a group of base stations set up to handle a 19

special requirement. A network can be as small or as large as needed, as long as it is fully 20

contained within a system. See also System. 21

Network Identification (NID). A number that uniquely identifies a network within a 22

wireless system. See also System Identification. 23

NID. See Network Identification. 24

Number Assignment Module (NAM). A set of MIN/IMSI-related parameters stored in the 25

mobile station. 26

OTAF. See Over-the-Air Service Provisioning Function. 27

Over-the-Air Service Provisioning Function (OTAF). A configuration of network 28

equipment that controls OTASP functionality and messaging protocol. 29

OTAPA. See Over-the-Air Parameter Administration. 30

OTASP. See Over-the-Air Service Provisioning. 31

Over-the-Air Parameter Administration (OTAPA). Network initiated OTASP process of 32

provisioning mobile station operational parameters over the air interface. 33

1 “cdma2000® is the trademark for the technical nomenclature for certain specifications and

standards of the Organizational Partners (OPs) of 3GPP2. Geographically (and as of the date of

publication), cdma2000® is a registered trademark of the Telecommunications Industry Association

(TIA-USA) in the United States.”

3GPP2 C.S0016-D v2.0

1-5

Over-the-Air Service Provisioning (OTASP). A process of provisioning mobile station 1

operational parameters over the air interface. 2

Parity Check Bits. Bits added to a sequence of information bits to provide error detection, 3

correction, or both. 4

P-CSCF. Proxy Call Session Control Function. 5

Preferred User Zone List (PUZL). A list that provides the mobile station with the 6

information for the User Zones to which the mobile user is subscribed. 7

PDSN. Packet Data Service Node. 8

Private Long Code. The long code characterized by the private long code mask. 9

Private Long Code Mask. The long code mask used to form the private long code. 10

Pseudo-ESN (P-ESN). A 32-bit number derived from MEID and used in place of ESN. 11

Pseudo-UIMID (P-UIMID). A 32-bit number derived from EUIMIDEUIM_ID using a specific 12

algorithm. 13

Public Long Code. The long code characterized by the public long code mask. 14

Public Long Code Mask. The long code mask used to form the public long code. The 15

mask contains the ESN of the mobile station. See also Private Long Code Mask. 16

PUZL. See Preferred User Zone List. 17

Release. A process that the mobile station and base station use to inform each other of 18

call disconnect. 19

Reverse CDMA Channel. The CDMA Channel from the mobile station to the base station. 20

From the base station’s perspective, the Reverse CDMA Channel is the sum of all mobile 21

station transmissions on a CDMA frequency assignment. 22

Roamer. A mobile station operating in a wireless system (or network) other than the one 23

from which service was subscribed. 24

Secure Mode. Network initiated mode of communicating operational parameters between 25

a mobile station and network based provisioning entity in an encrypted form. 26

SIP. Session Initiation Protocol. 27

SMCK. Secure Mode Ciphering Key. 28

Service Option. A service capability of the system. Service options may be applications 29

such as voice, data, or facsimile. See [4]. 30

Service Programming Code (SPC). A secret code assigned to the mobile station and 31

known to the authorized network entity. 32

Service Programming Lock (SPL). A protection provided for preventing the over-the-air 33

provisioning of certain mobile station parameters by unauthorized network entity by way of 34

verifying the Service Programming Code (SPC). 35

Shared Secret Data (SSD). A 128-bit pattern stored in the mobile station (in semi-36

permanent memory) and known by the base station. SSD is a concatenation of two 64-bit 37

3GPP2 C.S0016-D v2.0

1-6

subsets: SSD_A, which is used to support the authentication procedures, and SSD_B, 1

which serves as one of the inputs to the process generating the encryption mask and 2

private long code. 3

SID. See System Identification. 4

SPASM. See Subscriber Parameter Administration Security Mechanism. 5

SPC. See Service Programming Code. 6

SPL. See Service Programming Lock. 7

SSD. See Shared Secret Data. 8

SSPR. See System Selection for Preferred Roaming. 9

Subscriber Parameter Administration Security Mechanism (SPASM). Security 10

mechanism protecting parameters and indicators of active NAM from programming by an 11

unauthorized network entity during the OTAPA session. 12

System. A system is a wireless telephone service that covers a geographic area such as a 13

city, metropolitan region, county, or group of counties. See also Network. 14

System Identification (SID). A number uniquely identifying a wireless system. 15

System Selection Code. A part of the Activation Code that specifies the user selection of a 16

Band and a Block operated by the selected service provider. 17

System Selection for Preferred Roaming (SSPR). A feature that enhances the mobile 18

station system acquisition process based on the set of additional parameters stored in the 19

mobile station in the form of a Preferred Roaming List (PR_LISTs-p). 20

Traffic Channel. A communication path between a mobile station and a base station used 21

for user and signaling traffic. The term Traffic Channel implies a Forward Traffic Channel 22

and Reverse Traffic Channel pair. See also Forward Traffic Channel and Reverse Traffic 23

Channel. 24

UMB. Ultra Mobile Broadband. See [27] 25

User Zone (UZ). CDMA Tiered Service Offerings are defined by User Zones that are 26

geographical groupings of services. 27

UZ. See User Zone. 28

Voice Channel. See Analog Voice Channel. 29

Voice Privacy. The process by which user voice transmitted over a CDMA Traffic Channel 30

is afforded a modest degree of protection against eavesdropping over the air. 31

WLAN Root Key. A secret 128-bit pattern used for WLAN services. 32

1.2.2 Numeric Information 33

Numeric information is used to describe the operation of the mobile station. The following 34

subscripts are used to clarify the use of the numeric information: 35

• “s” indicates a value stored in a mobile station’s temporary memory. 36

3GPP2 C.S0016-D v2.0

1-7

• “r” indicates a value received by a mobile station over a forward analog control 1

channel or a CDMA Forward Channel. 2

• “p” indicates a value set in a mobile station’s permanent security and identification 3

memory. 4

• “s-p” indicates a value stored in a mobile station’s semi-permanent security and 5


This section defines numeric information specifically related to the OTASP. 7

A_KEYP - A secret 64-bit pattern permanently stored in the mobile station. 8

A_KEY_P_REVp - Protocol revision of the mobile station Key Exchange procedure. 9

A_KEY_TEMPs - A secret 64-bit pattern temporarily stored in the mobile station. 10

AUTH_OTAPAs - The computed 18-bit result AUTH_SIGNATURE used for validating 11

SPASM. 12

BCMCS_Kp - A secret 128-bit pattern permanently stored in the mobile station. 13

BS_PARAM – A variable used in the base station procedure for 3G Root Key computation. 14

BS_PW – A 128-bit user password that is stored in the base station. It has the same value 15

as the MS_PW. 16

BS_PW_HASH – The computed 1152-bit hash of the base station user password BS_PW. 17

BS_RESULT - Base station result 18

CUR_MMSS_P_REVs-p - Protocol revision of the mobile station’s current MMSS Lists. This 19

information is used to parse MLP_LISTs-p and MSP_LISTs-p. Retained by the mobile 20

station when the power is turned off. 21

CDMABANDS. CDMA band class. The CDMA band class currently used by the mobile 22

station [7]. 23

CDMACHS. CDMA Channel number. The CDMA Channel number currently used by the 24

mobile station [7] [23]. 25

CUR_PUZL_P_REVs-p – Protocol revision of the mobile station’s current preferred user 26

zone list. This information is used to parse PUZLs-p. Retained by the mobile station when 27

the power is turned off. 28

CUR_SSPR_P_REVs-p – Protocol revision of the mobile station’s current preferred roaming 29

list. This information is used to parse PRLs-p. Retained by the mobile station when the 30

power is turned off. 31

DATA_P_REVp - Protocol revision of the mobile station NAM Download procedure. 32

eHRPD_Kp – A secret 128-bit pattern permanently stored in the mobile station. 33

eHRPD_K_TEMPs - A secret 128-bit pattern temporarily stored in the mobile station. 34

G – Generator for Diffie-Hellman key exchange procedure 35

IMS_Kp - A secret 128-bit pattern permanently stored in the mobile station. 36

3GPP2 C.S0016-D v2.0

1-8

ITM_KEY – An intermediate key used in the procedure for calculating service keys. 1

MLP_LISTs-p – MMSS Location Associated Priority List. Contains location information to 2

assist the mobile station in multimode system selection. Retained by the mobile station 3

when the power is turned off. 4

MMSS_P_REVp - Protocol revision of the mobile station MMSS Download procedure. 5

MSP_LISTs-p – MMSS System Priority List. Contains system priority information to assist 6

the mobile station in multimode system selection. Retained by the mobile station when 7


MS_PARAM – A variable used in the mobile station procedure for 3G Root Key 9

computation. 10

MS_PW – A 128-bit user password that is stored in the mobile station. It has the same 11

value as the BS_PW. 12

MS_PW_HASH – The computed 1152-bit hash of the mobile station user password MS_PW. 13

MS_RESULT - Mobile station result 14

NAM_LOCKS-PNAM_LOCKp - The locking indicator set in the mobile station by the base 15

station that defines SPASM protection of the programmable parameters in the active NAM 16

during the OTAPA session. 17

NULL - A value that is not in the specified range of the field or variable. 18

NAM_LOCKs - A network controlled status of the SPASM protection of the active NAM for 19

the subsequent OTAPA session. 20

NAM_LOCK_STATE - a locking state of the mobile station programmable parameters for 21

OTAPA. If the NAM_LOCK_STATE = ‘1’, the parameters are locked for network initiated 22

programming. 23

P - Prime number for Diffie-Hellman key exchange procedure 24

PARAM_G - Key exchange parameter G. 25

PARAM_Gs - Key exchange parameter G. 26

PARAM_P - Key exchange parameter P. 27

PARAM_Ps - Key exchange parameter P. 28

PR_LISTs-p - Preferred Roaming List. Contains information to assist the mobile station 29

system selection and acquisition process. Retained by the mobile station when the power 30

is turned off. 31

PRL_BLOCK_ID_CURRENTs – Parameter Block Identifier for the current Preferred 32

Roaming List temporarily stored in the mobile station. 33

PUZLs-p – Preferred User Zone List. Contains information to assist the mobile station 34

during user zone selection and acquisition process. Retained by the mobile station when 35


PUZL_P_REVp - Protocol revision of the mobile station PUZL Download procedure. 37

3GPP2 C.S0016-D v2.0

1-9

RAND_SEED – A secret 128-bit pattern temporarily stored in the mobile station. 1

RKp - A secret 128-bit pattern permanently stored in the mobile station. 2

RK_TEMPs - A secret 128-bit pattern temporarily stored in the mobile station. 3

SPCp - Service Programming Code. A secret code assigned to the mobile station and 4

known to the authorized network entity. The base station uses the code equal to the SPCp 5

for unlocking the mobile station parameters for programming or reprogramming. 6

SPCs - Service Programming Code temporarily stored in the mobile station. 7

SPL_P_REVp - Protocol revision of the mobile station Service Programming Lock. 8

SP_LOCK_STATE - A locking state of the mobile station programmable parameters. If the 9

SP_LOCK_STATE = ‘1’, the parameters cannot be programmed are locked for programming. 10

SSDS – A 128-bit pattern for Shared Secret Data temporarily stored in the mobile station. 11

SSDS-P – A 128-bit pattern for Shared Secret Data stored in the mobile station. Retained by 12

the mobile station when the power is turned off. 13

SSPR_P_REVp - Protocol revision of the mobile station SSPR Download procedure and the 14

PRL format. 15

SECURE_MODE_INDS- Secure Mode indicator. If SECURE_MODE_INDS = ‘1’, current 16

programming session is in Secure Mode. 17

SERVSYSS. Selected serving system indicator for Band Class 0. Set to SYS_A if the mobile 18

station operates in system A; otherwise, set to SYS_B [7]. 19

SMCKs – Secure Mode Ciphering Key. 20

WLAN_Kp - A secret 128-bit pattern permanently stored in the mobile station. 21

X - Random number generated by mobile station 22

Y - Random number generated by base station 23

24

1.2.3 Constants 25

NULLPRL_BLOCK_ID – The NULL value for PRL_BLOCK_ID_CURRENTS, defined as ‘01111111’. 26

NULLSMCK – The NULL value for SMCKS, defined as a 128-bit field of all zeros. 27

NULLSYS_TAG_BLOCK_ID – The NULL value for SYS_TAG_BLOCK_ID_CURRENTS, defined as 28

‘01111111’. 29

NULLUZ_PRIORITY – The NULL value for UZ_PRIORITY, defined as ‘1111’. 30

31

3GPP2 C.S0016-D v2.0

1-10

1.3 References 1

The following specifcations contain provisions that, through reference in this text, 2

constitute provisions of this document. At the time of publication, the editions indicated 3

were valid. All specifications are subject to revision, and parties to agreements based upon 4

this document are encouraged to investigate the possibility of applying the most recent 5

editions of the specifications indicated below. ANSI and TIA maintain registers of currently 6

valid national standards published by them. 7

8

1.3.2 Normative References 9

1. TIA-95-B, Mobile Station-Base Station Compatibility Standard for Wideband Spread 10

Spectrum Cellular Systems, October 2004. 11

2. 3GPP2 S.S0053-0 v2.0, Common Cryptographic Algorithms, May 2009. 12

3. Reserved. 13


5. 3GPP2 C.S0002-E v3.0, Physical Layer Standard for cdma2000 Spread Spectrum 15

Systems, June 2011. 16

6. 3GPP2 C.S0004-E v3.0, Signaling Link Access Control (LAC) Standard for cdma2000 17

Spread Spectrum Systems, June 2011. 18

7. 3GPP2 C.S0005-E v3.0, Upper Layer (Layer 3) Signaling Standard for cdma2000 Spread 19

Spectrum Systems, June 2011. 20

8. 3GPP2 S.S0055 Enhanced Cryptographic Algorithms, Rev. A, January 2002. 21

9. 3GPP2 C.S0024-B v3.0, cdma2000 High Rate Packet Data Air Interface Specification, 22

September 2009. 23

10. IETF RFC 1334, PPP Authentication Protocols, October 1992. 24

11. IETF RFC 1994, PPP Challenge Handshake Authentication Protocol (CHAP), August 1996. 25

12. IETF RFC 2002, IP Mobility Support, October 1996. 26

13. IETF RFC 2344, Reverse Tunneling for Mobile IP, August 1996. 27

14. IETF RFC 2486, The Network Access Interface, January 1999. 28

15. IETF RFC 3012, Mobile IPv4 Challenge/Response Extensions, November 1999. 29

16. National Bureau of Standards, Federal Information Processing Standards Publication 30

180-1; Secure Hash Standard, April 1995. 31

17. 3GPP2 X.S0013, ALL-IP Core Network Multimedia Domain. 32

18. 3GPP TS 25.101, UE Radio Transmission and Reception (FDD), March 2003. 33

19. 3GPP2 X.S0016-310-0 v2.0, MMS MM1 Stage 3 Using OMA/WAP, July 2004. 34

3GPP2 C.S0016-D v2.0

1-11

20. 3GPP2 X.S0016-311-0 v1.0, MMS MM1 Stage 3 Using M-IMAP for Message Submission 1

and Retrieval, May 2003. 2

21. 3GPP2 X.S0016-312-0 v1.0, MMS MM1 Using SIP, July 2004. 3

22. 3GPP2 C.S0006-D v2.0, Analog Signaling Standard for cdma2000 Spread Spectrum 4

Systems – Release D, October 2005. 5

23. 3GPP2 C.S0057-E v1.0, Band Class Specification for cdma2000 Spread Spectrum 6

Systems, October 2010. 7

24. 3GPP2 C.S0023-D v2.0, Removable User Identity Module for Spread Spectrum Systems, 8

December 2011. 9

25. 3GPP TS 22.011 V7.9.0, Technical Specification Group Services and System Aspects; 10

Service accessibility (Release 7), March 2008. 11

26. 3GPP TS 31.102 V7.12.0, Technical Specification Group Core Network and Terminals; 12

Characteristics of the Universal Subscriber Identity Module (USIM) application (Release 7), 13

March 2008. 14

27. 3GPP2 C.S0084-0 v3.0, Ultra Mobile Broadband Air Interface Specification, Parts 0 to 9, 15

August 2008. 16

28. 3GPP2 X.S0057-A v1.0, E-UTRAN - eHRPD Connectivity and Interworking: Core Network 17

Aspects, April 2011. 18

29. 3GPP TS 35.205 V8.0.0, 3G Security; Specification of the MILENAGE algorithm set: An 19

example algorithm set for the 3GPP authentication and key generation functions f1, f1*, f2, 20

f3, f4, f5 and f5*; Document 1: General, December 2008. 21

30. National Institute of Standards and Technology: Secure Hash Standard, FIPS 180-2, 22

With Change Notice 1 dated February 2004, August 2002. 23

31. 3GPP TS 24.008 V8.7.0, Technical Specification Group Core Network and Terminals; 24

Mobile radio interface Layer 3 specification; Core network protocols (Release 8), Sept 25

2009. 26

32. 3GPP2 C.S0065-B v2.0, cdma2000 Application on UICC for Spread Spectrum Systems, 27

January 2011. 28



35. 3GPP2 X.S0011-002-E v1.0, cdma2000 Wireless IP Network Standard: Simple IP and 31

Mobile IP Access Services, Nov. 2009. 32


34

3GPP2 C.S0016-D v2.0

1-12

1.3.2 Informative References 1

4. 3GPP2 C.R1001-H, Administration of Parameter Value Assignments for cdma2000 2

Spread Spectrum Standards, July 2011. 3

33. 3GPP2 X.S0059 cdma2000 Femto-cell Network. 4

34. 3GPP2 C.S0024-300-C v2.0, Medium Access Layer for cdma2000 High Rate Packet Data 5

Air Interface Specification, July, 2011. 6

7

3GPP2 C.S0016-D v2.0

1-13

1.4 Requirements Language 1

“Shall” and “shall not” identify requirements to be followed strictly to conform to this 2

document and from which no deviation is permitted. “Should” and “should not” indicate 3

that one of several possibilities is recommended as particularly suitable, without 4

mentioning or excluding others, that a certain course of action is preferred but not 5

necessarily required, or that (in the negative form) a certain possibility or course of action 6

is discouraged but not prohibited. “May” and “need not” indicate a course of action 7

permissible within the limits of the document. “Can” and “cannot” are used for statements 8

of possibility and capability, whether material, physical or causal. 9

10

3GPP2 C.S0016-D v2.0

1-14

1

2

3

4

5

6

7

8

9

This page left intentionally blank.No text. 10

11

3GPP2 C.S0016-D v2.0

2-15

2 MESSAGE TRANSPORT PROTOCOL 1

2.1 General 2

OTASP Data Messages (see Sections 3 and 4) can be sent over the analog voice channel or 3

the CDMA Traffic Channel. In either case, the OTASP Data Messages are sent using a 4

Layer 2 protocol that provides reliable delivery and duplicate detection. 5

The delivery of OTASP Data Messages does not require sequential delivery of messages by 6

the Layer 2 protocol because the Over-the-Air Service Provisioning procedures ensure that 7

only one OTASP Data Message is outstanding at any time. 8

During the analog mode of operation, OTASP Data Messages are sent using the analog 9

transport protocol (see 2.2). During the CDMA mode of operation, OTASP Data Messages 10

are sent using the CDMA transport protocol (see 2.3). 11

2.2 Analog Transport Protocol 12

OTASP Data Messages are transmitted over an analog voice channel using the OTASP 13

Transport Message. Signaling on the analog voice channel does not have a Layer 2 protocol 14

defined in [1, 1]. Because of the large amount of data transported for Over-the-Air Service 15

Provisioning, this standard specification defines a Layer 2 protocol to ensure OTASP Data 16

Message integrity. This protocol provides message segmentation, segment 17

acknowledgment, error detection and re-transmission. 18

2.2.1 OTASP Data Message Encapsulation 19

Each OTASP Data Message Unit transmitted on an analog voice channel shall consist of an 20

8-bit message length field (MSG_LENGTH), an OTASP Data Message, as defined in 3.5 and 21

4.5, and a 16-bit CRC, in that order (see Figure 2.2.1-1). 22

CRC

8 bits 1 6 b it s

OTA SP Dat a Mes sa ge Ca psu le

OTAS P Data Me ss age Un it Pa d din g

8 - 2 01 6 bits

MSG_LENGTH

a s requ ir ed8 MSG_LENGTH bits

OTAS P Data Mes sa ge

23

Figure 2.2.1-1 OTASP Data Message Encapsulation 24

3GPP2 C.S0016-D v2.0

2-16

The MSG_LENGTH field shall be set to the number of octets in the OTASP Data Message 1

plus three. 2

The 16-bit CRC is calculated on the MSG_LENGTH field and the OTASP Data Message bits. 3

The generator polynomial for this CRC shall be as follows: 4

g(x) = x16 x12 x5 x0 5

The 16-bit CRC shall be computed according to the following procedure using the logic 6

shown in Figure 2.2.1-2: 7

• Initially, all shift register elements shall be set to logical one and the switches shall 8

be set in the position ‘A’. 9

• The register shall be clocked with each OTASP Data Message bit as an input, most 10

significant bit first. 11

• The switches shall be set in the position ‘B’, and the register shall be clocked an 12

additional 16 times. The 16 additional output bits shall be the CRC bits. 13

• The 16 CRC bits shall be transmitted in the order calculated. 14

Position ‘A’ for first k bits

Position ‘B’ for last 16 bits

Input

Outputx15x12x5x1x0

‘1’

‘0’

Denotes modulo-2 addition

Denotes one-bit storage element

A

B

A

B

A

B

15

Figure 2.2.1-2 OTASP Data Message CRC 16

Padding consisting of zero or more ‘0’ bits shall be added immediately following the OTASP 17

Data Message Unit. The length of the padding shall be such that the resulting OTASP Data 18

Message Capsule fits into the minimum possible integral number of OTASP Transport 19

Messages (see 2.2.2). 20

2.2.2 OTASP Data Message Segmentation 21

Each OTASP Data Message Capsule (see 2.2.1) sent on an analog voice channel shall be 22

segmented and transmitted in one or more OTASP Transport Messages, as defined in 23

2.2.3.4 and 2.2.4.3. Figures 2.2.2-1 and 2.2.2-2 illustrate the segmentation process for the 24

forward and reverse analog voice channels, respectively. 25

26

3GPP2 C.S0016-D v2.0

2-17

...

...

Segment 1 Segment 2 Segment N

OTASP Data Message Capsule

OTASP Transport Message

...Word 1 Word 2 Word 3 Word 4 Word n

Note: The Contents of theOTASP Data MessageCapsule is segmentedinto OTASP_DATA fieldsof the Words 3 – n of theOTASP Transport Message

OTASP_DATA fields for Word 3of the OTASP Transport Message

OTASP_DATA fields for Word n ofthe OTASP Transport Message

OTASP_DATA fields for Word 4 ofthe OTASP Transport Message

1

Figure 2.2.2-1 OTASP Data Message Capsule Segmentation on the Forward Analog 2

Voice Channel. 3

4

3GPP2 C.S0016-D v2.0

2-18

...Segment 1 Segment 2 Segment N

OTASP Data MessageCapsule

OTASP_DATA fields for Word 2 ofthe OTAPA Transport Message

OTASP Transport Message

Word 1 Word 2 Word 3 Word 4



Note: The contents of theOTASP Data MessageCapsule is segmented intothe OTASP_DATA fields ofWord 2-4 of the OTASPTransport Message

1

Figure 2.2.2-2 OTASP Data Message Capsule Segmentation on the Reverse Analog 2

Voice Channel 3

2.2.3 Mobile Station Procedures 4

OTASP Data Messages are sent and received on analog voice channels only when the 5

mobile station is in the Conversation Task (see 2.6.4.4 of [1]). The mobile station shall 6

transmit OTASP Transport Messages in accordance with the procedures in 2.7.2 of [1]. 7

Mobile stations implementing the Over-the-Air Service Provisioning feature shall comply 8

with the following requirements in addition to those of 2.6.4.4 of [1]. 9

2.2.3.1 OTASP Transport Message Acknowledgment and Re-transmission 10

When the mobile station sends an OTASP Transport Message, it starts the OTASP 11

acknowledgment timer. The timer is disabled when an OTASP Transport Confirmation 12

Message is received. 13

After sending an OTASP Transport Message, the mobile station shall not send a new OTASP 14

Transport Message until it has received an OTASP Transport Confirmation Message 15

acknowledging the message that has been sent. 16

If the OTASP acknowledgment timer expires and the OTASP Transport Message has been 17

sent fewer than three times, the mobile station shall resend the OTASP Transport Message 18

and reset the OTASP acknowledgment timer to two seconds. If the OTASP acknowledgment 19

timer expires and the OTASP Transport Message has been sent three times, the mobile 20

station shall enter the Release Task (see 2.6.4.5 of [1]). 21

3GPP2 C.S0016-D v2.0

2-19

2.2.3.2 Message Transmission 1

While the mobile station is in the Conversation Task, the following messages can be sent in 2

addition to those listed in 2.6.4.4 of [1]: 3

1. OTASP Transport Message: 4

After sending the message, the mobile station shall set the OTASP acknowledgment 5

timer to two seconds. The mobile station shall construct the OTASP Transport 6

Message as follows: 7

• If the OTASP_DATA field of the OTASP Transport Message contains an entire 8

OTASP Data Message Capsule, the mobile station shall set TX_SEQ_NUMs to 9

‘00000’, shall set the SEQ_NUM field equal to TX_SEQ_NUMs, and shall set the 10

value of the B/F field to ‘11’. 11

• If the OTASP_DATA field of the OTASP Transport Message contains the first 12

segment of the segmented OTASP Data Message Capsule, the mobile station 13

shall set TX_SEQ_NUMs to ‘00000’, shall set the SEQ_NUM field equal to 14

TX_SEQ_NUMs and shall set the value of the B/F field to ‘10’. 15

• If the OTASP_DATA field of the OTASP Transport Message contains a segment 16

other than the first segment of the segmented OTASP Data Message Capsule, the 17

mobile station shall perform the following: 18

- If the OTASP_DATA field of the OTASP Transport Message contains a 19

segment other than the final segment of the OTASP Data Message Capsule, 20

the mobile station shall set TX_SEQ_NUMs to (TX_SEQ_NUMs + 1) modulo 21

32, shall set the SEQ_NUM field equal to TX_SEQ_NUMs and shall set the 22


- If the OTASP_DATA field of the OTASP Transport Message contains the final 24

segment of the OTASP Data Message Capsule, the mobile station shall set 25

TX_SEQ_NUMs to (TX_SEQ_NUMs + 1) modulo 32, shall set the SEQ_NUM 26

field equal to TX_SEQ_NUMs and shall set the value of the B/F field to ‘01’. 27

The mobile station shall remain in the Conversation Task. 28

2. OTASP Transport Confirmation Message: 29

The mobile station shall set the SEQ_ACK field and DMU_CRC_OK field as specified 30

in 2.2.3.3. The mobile station shall remain in the Conversation Task. 31

2.2.3.3 Message Reception 32

While the mobile station is in the Conversation Task, the following messages can be 33

received in addition to those listed in 2.6.4.4 of [1]. When any message is received, the 34

mobile station shall perform all actions specified in 2.6.4.4 of [1] that apply to a message 35

reception. The mobile station shall take the actions specified below for each message: 36


If the value of ESNr received in the OTASP Transport Message does not match the 38

ESNp that identifies the mobile station, the mobile station shall turn off the 39

3GPP2 C.S0016-D v2.0

2-20

transmitter and then enter the Serving-System Determination Task (see 2.6.3.12 of 1

[1]). 2

If the value of ESNr received in the OTASP Transport Message matches the ESNp, 3

the mobile station shall do the following: 4

• The mobile station shall send an OTASP Transport Confirmation Message within 5

750 ms after receiving the last bit of the OTASP Transport Message. The mobile 6

station shall set the SEQ_ACK field equal to SEQ_NUMr received in the OTASP 7

Transport Message. The mobile station shall set the DMU_CRC_OK field as 8

specified below. 9

• If the value of the B/F field of the received message is ‘11’, the OTASP_DATA 10

field of the received message contains an OTASP Data Message Capsule in its 11

entirety (i.e., contains an unsegmented OTASP Data Message Capsule). The 12

mobile station shall discard any incomplete OTASP Data Message Capsule being 13

reassembled. If the CRC of the OTASP Data Message Unit checks (see 2.2.1), 14

the mobile station shall set the DMU_CRC_OK field of the OTASP Transport 15

Confirmation Message to ‘1’, and shall process the OTASP Data Message as 16

specified in Section 3; otherwise, the mobile station shall set the DMU_CRC_OK 17

field of the OTASP Transport Confirmation Message to ‘0’, and shall discard the 18

OTASP Data Message Capsule. 19

• If the value of the B/F field of the received message is ‘10’, the mobile station 20

shall discard any incomplete OTASP Data Message Capsule being reassembled, 21

and shall store the OTASP_DATA field of the received message as the first 22

segment of an OTASP Data Message Capsule to be reassembled. The mobile 23

station shall set RX_SEQ_NUMs to the value of the SEQ_NUM field of the 24

received message. The mobile station shall set the DMU_CRC_OK field of the 25

OTASP Transport Confirmation Message to ‘0’. 26

• If the value of the B/F field of the received message is ‘00’ and a segmented 27

OTASP Data Message Capsule is being reassembled, the mobile station shall 28

perform the following: 29

- If (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field 30

of the received message, the mobile station shall store the OTASP_DATA field 31

of the received message as the next segment of the OTASP Data Message 32

Capsule being reassembled, and shall increment RX_SEQ_NUMs, modulo 33

32. 34

- If RX_SEQ_NUMs is equal to the value of the SEQ_NUM field of the received 35

message, the mobile station shall discard the OTASP_DATA field of the 36

received message. 37

- If neither RX_SEQ_NUMs nor (RX_SEQ_NUMs + 1) modulo 32 is equal to the 38

value of the SEQ_NUM field of the received message, the mobile station shall 39

discard the OTASP_DATA field of the received message and shall discard the 40

incomplete OTASP Data Message Capsule being reassembled. 41

3GPP2 C.S0016-D v2.0

2-21

- The mobile station shall set the DMU_CRC_OK field of the OTASP Transport 1

Confirmation Message to ‘0’. 2

• If the value of the B/F field of the received message is ‘00’, and if no segmented 3


discard the OTASP_DATA field of the received message. The mobile station shall 5

set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to ‘0’. 6

• If the value of the B/F field of the received message is ‘01’ and if a segmented 7



- If (RX_SEQ_NUMs + 1) modulo 32 is equal to the value of the SEQ_NUM field 10

of the received message, the mobile station shall store the OTASP_DATA field 11

of the received message as the last segment of the OTASP Data Message 12

Capsule being reassembled and shall increment RX_SEQ_NUMs, modulo 32. 13

If the CRC of the OTASP Data Message Unit checks (see 2.2.1), the mobile 14

station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation 15

Message to ‘1’ and shall process the OTASP Data Message as specified in 16

Section 3; otherwise, the mobile station shall set the DMU_CRC_OK field of 17

the OTASP Transport Confirmation Message to ‘0’ and shall discard the 18

OTASP Data Message Capsule. 19

- If RX_SEQ_NUMs is equal to the value of the SEQ_NUM field of the received 20

message, the mobile station shall discard the OTASP_DATA field of the 21

received message. If the CRC of the OTASP Data Message Unit checks (see 22

2.2.1), the mobile station shall set the DMU_CRC_OK field of the OTASP 23

Transport Confirmation Message to ‘1’; otherwise, the mobile station shall set 24

the DMU_CRC_OK field to ‘0’. 25

- If neither RX_SEQ_NUMs nor (RX_SEQ_NUMs + 1) modulo 32 is equal to the 26

value of the SEQ_NUM field of the received message, the mobile station shall 27

discard the OTASP_DATA field of the received message and shall discard the 28

incomplete OTASP Data Message Capsule being reassembled. The mobile 29

station shall set the DMU_CRC_OK field of the OTASP Transport Confirmation 30

Message to ‘0’. 31

• If the value of the B/F field of the received message is ‘01’, and if no segmented 32


discard the OTASP_DATA field of the received message. The mobile station shall 34

set the DMU_CRC_OK field of the OTASP Transport Confirmation Message to ‘0’. 35

The mobile station shall remain in the Conversation Task. 36


If the SEQ_ACK field is equal to TX_SEQ_NUMs, the mobile station shall disable the 38

OTASP acknowledgment timer; otherwise, the mobile station shall ignore the 39

message. The mobile station shall remain in the Conversation Task. 40

3GPP2 C.S0016-D v2.0

2-22

2.2.3.4 Reverse Voice Channel Message Format 1

2.2.3.4.1 OTASP Transport Message 2

When the mobile station sends the OTASP Transport Message on the Reverse Voice Channel 3

(RVC), it shall use the following format: 4

• Word 1 of the OTASP Transport Message: 5

Information Element Length (bits)

F=1 1

NAWC 2

T=1 1

MSG_TYPE=00000 5

ORDQ=000 3

ORDER=11010 5

SEQ_NUM 5

B/F 2

ESN_4 8

RSVD=0000 4

P 12

6



F=0 1

NAWC 2

T=1 1

ESN_3 8

ESN_2 8

ESN_1 8

OTASP_DATA 8

P 12

8

3GPP2 C.S0016-D v2.0

2-23

• Words 3 and 4 of the OTASP Transport Message: 1


F=0 1

NAWC 2

T=1 1

OTASP_DATA 32

P 12

2

F - First word field. The mobile station shall set this field to ‘1’ in the 3

first word of the message, and to ‘0’ in all other words. 4

NAWC - Number of additional words coming field. The mobile station shall 5

set this field in each word of the message to the number of remaining 6

words not including the current word. 7

T - T field. The mobile station shall set this field to ‘1’. 8

MSG_TYPE - Message Type field. The mobile station shall set this field to ‘00000’. 9

ORDQ - Order qualifier field. The mobile station shall set this field to ‘000’. 10

ORDER - Order field. The mobile station shall set this field to ‘11010’. 11

SEQ_NUM - Message Sequence Number. The mobile station shall set this field to 12

the message sequence number of this OTASP Transport Message. 13

B/F - Begin/Final. This field is used to specify whether the OTASP Data 14

Message Capsule has been segmented into multiple OTASP Transport 15

Messages. If the OTASP Data Message Capsule is completely 16

contained in a single OTASP Transport Message, the mobile station 17

shall set this field to ‘11’. For an OTASP Data Message Capsule 18

contained in multiple OTASP Transport Messages, the mobile station 19

shall set the value of this field in the first segment to ‘10’, the value of 20

this field in all intermediate segments to ‘00’, and the value of this 21

field in the final segment to ‘01’. 22

ESN_4 - The mobile station shall set this field to the most significant octet 23

(bits d31-d24) of the mobile station ESN. 24

ESN_3 - The mobile station shall set this field to the next to the most 25

significant octet (bits d23-d16) of the mobile station ESN. 26

ESN_2 - The mobile station shall set this field to the next to the least 27

significant octet (bits d15-d8) of the mobile station ESN. 28

ESN_1 - The mobile station shall set this field to the least significant octet 29

(bits d7-d0) of the mobile station ESN. 30

3GPP2 C.S0016-D v2.0

2-24

RSVD - Reserved for future use; the mobile station shall set all bits as 1

indicated. 2

OTASP_DATA - The mobile station shall set these fields to the corresponding octets 3

of the OTASP Data Message Capsule. 4

P - Parity field. The mobile station shall set this field as specified in 5

2.7.2 of [1]. 6

2.2.3.4.2 OTASP Transport Confirmation Message 7

The mobile station Reverse Voice Channel (RVC) OTASP Transport Confirmation Message 8

has the following format: 9


F=1 1

NAWC=00 2

T=1 1

MSG_TYPE=00001 5

ORDQ=000 3

ORDER=11010 5

SEQ_ACK 5

DMU_CRC_OK 1

RSVD=0000000000000 13

P 12

F - First word field. The mobile station shall set this field to ‘1’. 10

NAWC - Number of additional words coming field. The mobile station shall 11

set this field to ‘00’. 12

T - T field. The mobile station shall set this field to ‘1’. 13

MSG_TYPE - Message Type field. The mobile station shall set this field to ‘00001’. 14

ORDQ - Order qualifier field. The mobile station shall set this field to ‘000’. 15

ORDER - Order field. The mobile station shall set this field to ‘11010’. 16

SEQ_ACK - Sequence Number for Acknowledgment by the OTASP Transport 17

Confirmation Message. The mobile station shall set this field to the 18

value of SEQ_NUM in the OTASP Transport Message being 19

acknowledged. 20

DMU_CRC_OK - OTASP Data Message Unit CRC status flag. The mobile station shall 21

set this field as specified in 2.2.3.2 to indicate whether or not the 22

OTASP Data Message Unit CRC checks. 23

RSVD - Reserved for future use; the mobile station shall set all bits as 24

indicated. 25

3GPP2 C.S0016-D v2.0

2-25

P - Parity field. The mobile station shall set this field as specified in 1

2.7.2 of [1]. 2

2.2.4 Base Station Procedures 3

OTASP Data Messages are sent and received on the analog voice channel only when the 4

base station is in the Conversation Task (see 3.6.4.4 of [1]). The base station shall transmit 5

OTASP Transport Messages as specified in 3.7.2 of [1]. Base stations implementing the 6

Over-the-Air Service Provisioning feature should comply with the following requirements in 7

addition to those of 3.6.4.4 of [1]. 8

2.2.4.1 Message Transmission 9

While the base station is in the Conversation Task, the following messages can be sent in 10

addition to those listed in 3.6.4.4 of [1]: 11


The base station should construct the OTASP Transport Message as follows: 13

• If the OTASP_DATA field of the OTASP Transport Message contains an entire 14

OTASP Data Message Capsule, the base station should set the value of the 15

SEQ_NUM field to ‘00000’ and the value of the B/F field to ‘11’. 16

• If the OTASP_DATA field of the OTASP Transport Message contains the first 17

segment of the segmented OTASP Data Message Capsule, the base station 18

should set the value of the SEQ_NUM field to ‘00000’ and the value of the B/F 19

field to ‘10’. 20

• If the OTASP_DATA field of the OTASP Transport Message contains a segment 21

other than the first segment of the segmented OTASP Data Message Capsule, the 22

base station should perform the following: 23

- If the OTASP_DATA field of the OTASP Transport Message contains a 24

segment other than the final segment of the OTASP Data Message Capsule, 25

the base station should increment SEQ_NUM modulo 32 and should set the 26


- If the OTASP_DATA field of the OTASP Transport Message contains the final 28

segment of the OTASP Data Message, the base station should increment 29

SEQ_NUM modulo 32 and should set the value of the B/F field to ‘01’. 30

The base station should remain in the Conversation Task. 31


The base station should set the SEQ_ACK field to the value of the SEQ_NUM field 33

received in the OTASP Transport Message being acknowledged, and should remain 34

in the Conversation Task. 35

36

3GPP2 C.S0016-D v2.0

2-26

2.2.4.2 Message Reception 1

While the base station is in the Conversation Task, the following messages can be received 2

autonomously from the mobile station, in addition to those listed in 3.6.4.4 of [1]. When 3

any message is received, the base station should perform all actions specified in 3.6.4.4 of 4

[1] that apply to a message reception. The base station shall take the actions specified 5

below for each message: 6


If the value of ESN received in the OTASP Transport Message does not match the 8

ESN that identifies the mobile station being activated, the base station should 9

ignore the message. 10

If the value of ESN received in the OTASP Transport Message matches the ESN that 11

identifies the mobile station being activated, the base station should do the 12

following: 13

• The base station should send an OTASP Transport Confirmation Message. 14

• If the value of the B/F field of the received message is ‘11’, the OTASP_DATA 15

field of the received message contains the OTASP Data Message Capsule in its 16

entirety. The base station may discard any incomplete OTASP Data Message 17

being reassembled, and should process the OTASP Data Message as specified in 18

Section 4. 19

• If the value of the B/F field of the received message is ‘10’, the base station may 20

discard any incomplete OTASP Data Message being reassembled, and should 21

store the OTASP_DATA field of the received message as the first segment of an 22

OTASP Data Message Capsule to be reassembled. The base station should 23

store the value of the SEQ_NUM field of the received message in RX_SEQ_NUM. 24


OTASP Data Message Capsule is being reassembled, the base station should 26


- If (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field 28

of the received message, the base station should store the OTASP_DATA field 29

of the received message as the next segment of the OTASP Data Message 30

being reassembled, and increment RX_SEQ_NUM modulo 32. 31

- If RX_SEQ_NUM is equal to the value of the SEQ_NUM field of the received 32

message, the base station may discard the OTASP_DATA field of the received 33

message. 34

- If neither RX_SEQ_NUM nor (RX_SEQ_NUM + 1) modulo 32 is equal to the 35

value of the SEQ_NUM field of the received message, the base station may 36

discard the OTASP_DATA field of the received message and may discard the 37

incomplete OTASP Data Message being reassembled. 38

3GPP2 C.S0016-D v2.0

2-27

• If the value of the B/F field of the received message is ‘00’, and no segmented 1

OTASP Data Message Capsule is being reassembled, the base station may 2

discard the OTASP_DATA field of the received message. 3


OTASP Data Message Capsule is being reassembled, the base station should 5


- If (RX_SEQ_NUM + 1) modulo 32 is equal to the value of the SEQ_NUM field 7

of the received message, the base station should store the OTASP_DATA field 8

of the received message as the last segment of the OTASP Data Message 9

Capsule being reassembled, should increment RX_SEQ_NUM modulo 32, 10

and should process the OTASP Data Message as specified in Section 4. 11

- If RX_SEQ_NUM is equal to the value of the SEQ_NUM field of the received 12

message, the base station may discard the OTASP_DATA field of the received 13

message. 14

- If neither RX_SEQ_NUM nor (RX_SEQ_NUM + 1) modulo 32 is equal to the 15

value of the SEQ_NUM field of the received message, the base station may 16

discard the OTASP_DATA field of the received message and may discard the 17

incomplete OTASP Data Message Capsule being reassembled. 18

• If the value of the B/F field of the received message is ‘01’, and no segmented 19

OTASP Data Message Capsule is being reassembled, the base station may 20

discard the OTASP_DATA field of the received message. 21

The base station should remain in the Conversation Task. 22


If SEQ_ACK is equal to the sequence number of the last OTASP Transport Message 24

sent, the base station may transmit the next OTASP Transport Message; otherwise, 25

the base station should ignore the message. If the DMU_CRC_OK field indicates 26

that the CRC of the OTASP Data Message Unit did not check at the mobile station 27

(see 2.2.3.3), the base station should resend the OTASP Data Message. The base 28

station should remain in the Conversation Task. 29

2.2.4.3 Forward Voice Channel Message Format 30

2.2.4.3.1 OTASP Transport Message 31

When the base station sends an OTASP Transport Message on the Forward Voice Channel 32

(FVC), it shall use the following variable-length message format: 33

3GPP2 C.S0016-D v2.0

2-28



T1T2 = 10 2

SCC=11 2

PSCC 2

EF=0 1

SEQ_NUM 5

DATA_WORDS 3

MSG_TYPE=00000 5

ORDQ=000 3

ORDER=11010 5

P 12

2



T1T2 = 01 2

B/F 2

ESN_4 8

ESN_3 8

ESN_2 8

P 12

4



T1T2 = 01 2

RSVD=00 2

ESN_1 8

OTASP_DATA 16

P 12

6

3GPP2 C.S0016-D v2.0

2-29

• Word 4 through N of the OTASP Transport Message: 1


T1T2 = 01 2

RSVD=00 2

OTASP_DATA 24

P 12

2

T1T2 - Type field. The base station shall set this field to ‘10’ in the first word 3

of the message, and to ‘01’ in all other words. 4

SCC - SAT color code for new channel. The base station shall set this field 5

to ‘11’. 6

PSCC - Present SAT color code. The base station shall set this field to 7

indicate the SAT color code associated with the present channel as 8

specified in the Table 3.7.1.1-2 of [1]. 9

EF - Extended Protocol Forward Channel Indicator. The base station shall 10


SEQ_NUM - Message Sequence Number. The base station shall set this field to 12

the message sequence number of this OTASP Transport Message. 13

DATA_WORDS - The number of words in the OTASP Transport Message containing the 14

OTASP_DATA field. The base station shall set this field to the 15

number of words in the OTASP Transport Message, not including 16

Word 1 and Word 2. 17

MSG_TYPE - Message Type field. The base station shall set this field to ‘00000’. 18

ORDQ - Order qualifier field. The base station shall set this field to ‘000’. 19

ORDER - Order field. The base station shall set this field to ‘11010’. 20

B/F - Begin/Final. This field is used to specify whether the OTASP Data 21

Message Capsule has been segmented into multiple OTASP Transport 22

Messages. If the OTASP Data Message Capsule is completely 23

contained in a single OTASP Transport Message, the base station 24

shall set this field to ‘11’. For an OTASP Data Message Capsule 25

contained in multiple OTASP Transport Messages, the base station 26

shall set the value of this field in the first segment to ‘10’, the value of 27

this field in all intermediate segments to ‘00’, and the value of this 28

field in the final segment to ‘01’. 29

ESN_4 - The base station shall set this field to the most significant octet (bits 30

d31-d24) of the mobile station ESN. 31

ESN_3 - The base station shall set this field to the next to the most significant 32

octet (bits d23-d16) of the mobile station ESN. 33

3GPP2 C.S0016-D v2.0

2-30

ESN_2 - The base station shall set this field to the next to the least significant 1

octet (bits d15-d8) of the mobile station ESN. 2

ESN_1 - The base station shall set this field to the least significant octet (bits 3

d7-d0) of the mobile station ESN. 4

OTASP_DATA - The base station shall set these fields to the corresponding octets of 5

the OTASP Data Message Capsule. 6

RSVD - Reserved for future use; the base station shall set all bits as 7

indicated. 8

P - Parity field. The base station shall set this field as specified in 3.7.2 9

of [1]. 10

2.2.4.3.2 OTASP Transport Confirmation Message 11

When the base station sends an OTASP Transport Confirmation Message on the Forward 12

Voice Channel (FVC), it shall use the following fixed-length message format: 13

14


T1T2 = 10 2

SCC=11 2

PSCC 2

EF=0 1

SEQ_ACK 5

RSVD=000 3

MSG_TYPE=00001 5

ORDQ=000 3

ORDER=11010 5

P 12

T1T2 - Type field. The base station shall set this field to ‘10’. 15

SCC - SAT color code for new channel. The base station shall set this field 16

to ‘11’. 17

PSCC - Present SAT color code. The base station shall set this field to 18

indicate the SAT color code associated with the present channel as 19

specified in the Table 3.7.1.1-2 of [1]. 20

EF - Extended Protocol Forward Channel Indicator. The base station shall 21


3GPP2 C.S0016-D v2.0

2-31

SEQ_ACK - Sequence Number for Acknowledgment by the OTASP Transport 1

Confirmation Message. The base station shall set this field to the 2

value of SEQ_NUM in the OTASP Transport Message being 3

acknowledged. 4

MSG_TYPE - Message Type field. The base station shall set this field to ‘00001’. 5

ORDQ - Order qualifier field. The base station shall set this field to ‘000’. 6

ORDER - Order field. The base station shall set this field to ‘11010’. 7

RSVD - Reserved for future use; the base station shall set all bits as 8

indicated. 9

P - Parity field. The base station shall set this field as specified in 3.7.2 10

of [1]. 11

2.3 CDMA Transport Protocol 12

The messages defined in 3.5 and 4.5 shall be sent in the CHARi fields of Data Burst 13

Messages (see 6.7.2.3.2.4 and 7.7.3.3.2.4 of [1] and 2.7.2.3.2.4 and 3.7.3.3.2.4 of [1]). The 14

BURST_TYPE field of Data Burst Messages carrying OTASP Data Messages shall be set to 15

‘000100’ (as assigned in [4]). The MSG_NUMBER and NUM_MSGS fields shall be set to 1 16

and the NUM_FIELDS field shall be set to the number of octets in the OTASP Data Message. 17

The base station should send Data Burst Messages carrying OTASP Data Messages only on 18

CDMA Traffic Channels. Mobile stations shall ignore Data Burst Messages with the 19

BURST_TYPE field equal to ‘000100’ that are received on CDMA channels other than CDMA 20

Traffic Channels. Data Burst Messages carrying OTASP Data Messages shall be sent as 21

messages requiring Layer 2 acknowledgment (see 6.6.4.1.3.1 and 7.6.4.1.3.1 of [1] or as 22

messages requiring delivery in assured mode see 1.3.2.1 and 1.3.2.2 of [7]). 23

24

3GPP2 C.S0016-D v2.0

2-32

1

2

3

4

5

6

7

8

9

This page left intentionally blank.No text. 10

3GPP2 C.S0016-D v2.0

3-1

3 MOBILE STATION PROCEDURES 1

3.1 Initial Values and NAM Parameters 2

Mobile stations support one or more Number Assignment Modules (NAM). The NAM 3

includes certain numeric indicators, as defined in Annex F of [1, 1]. The standard NAM 4

indicators, stored in the mobile station’s permanent and semi-permanent memory, are 5

defined in F.3 of [1, 1]. Manufacturer-specific NAM parameters may be defined within a 6

Parameter Block Type reserved for manufacturer-specific parameter definitions (see Tables 7

3.5.2-1 and 4.5.2-1). 8

Mobile stations supporting Service Programming Lock shall maintain a single additional 9

indicator, SPCp (see 3.3.6). 10

Mobile stations supporting the Over-the-Air Parameter Administration (OTAPA) shall 11

maintain an additional indicator for each NAM, NAM_LOCKS-PNAM_LOCKp (see 3.2.2). 12

The NAM indicators and parameters that can be assigned values using Over-the-Air Service 13

Provisioning are specified in 4.5.2, 4.5.3, 4.5.4 and 4.5.6. Note that 14

IMSI_M_PROGRAMMED and IMSI_T_PROGRAMMED, defined in [1] and [7], are set 15

according to the rules defined in [24]. 16

A mobile station shall have a single NAM selected for use at all times. If a mobile station 17

supports more than one NAM, the mobile station manufacturer shall provide a means for 18

the user to select the NAM to be activated. 19

When a mobile station is manufactured, and whenever a NAM is created or cleared: 20

• IMSI_M_CLASSp shall be set to 0. 21

• MCC_Mp, IMSI_M_11_12p and IMSI_M_Sp shall be set to the coded value of the 22

IMSI_M with the four least-significant digits set to ESNp, converted directly from 23

binary to decimal, modulo 10000. The other digits shall be set to 0. 24

• IMSI_M_ADDR_NUMp shall be set to ‘000’. 25

• IMSI_T_CLASSp shall be set to 0. 26

• MCC_Tp, IMSI_T_11_12p and IMSI_T_Sp shall be set to the coded value of the 27

IMSI_T with the four least-significant digits set to ESNp, converted directly from 28

binary to decimal, modulo 10000. The other digits shall be set to 0. 29

• IMSI_T _ADDR_NUMp shall be set to ‘000’. 30

• ACCOLCp shall be set as specified in 6.3.5 of [1] or 2.3.5 of [1]. 31

• Apersistence[i], for terminals that also support HRPD, shall be set as specified in 32

Sections 9.4.6.1.4.1.4 and 9.5.6.1.4.1.4 of [9]. 33

• HOME_SIDp, if present, shall be set to 0. 34

• All other indicators of the selected NAM may be set to manufacturer-defined default 35

values. All configuration indicator values shall be set within their valid range (see 36

F.3 of [1, 1]). 37

3GPP2 C.S0016-D v2.0

3-2

Mobile stations may perform any function allowable by applicable specificationsstandards, 1

including system accesses, whether the selected NAM is activated or not. 2

3

3.2 Initiation of the Programming Procedures 4

Over-the-air service provisioning (OTASP) can be initiated in two ways: by the user and by 5

the network. 6

The user-initiated procedure provides a tool for the mobile station user to select a wireless 7

service provider, to activate a mobile station, and to update NAM indicators and 8

parameters. 9

The network-initiated procedure, also known as Over-The-Air Parameter Administration 10

(OTAPA), is also built upon the over-the-air programming protocol and procedures that 11

support the OTASP feature. OTAPA provides a tool for the wireless service provider to 12

update NAM indicators and parameters. 13

3.2.1 User-Initiated Procedure 14

The mobile station shall initiate programming procedures only when directed to do so by 15

the user. The procedure for user initiation of the programming procedure is manufacturer-16

defined. Upon initiation of the programming procedure, the mobile station shall set 17

PRL_BLOCK_ID_CURRENTs to NULLPRL_BLOCK_ID. As part of this procedure, the mobile 18

station shall permit the user to enter a choice of the service provider. At a minimum, the 19

mobile station shall permit the user to manually enter the activation code for the selected 20

system using the following sequence: 21

*FC + XX + SEND 22

*FC - Feature Code (*ACT or *228). This feature code indicates the 23

activation call type to the base station. 24

XX - System Selection Code. This code indicates the system 25

selected by the user. See Table 1.4-1 in [23]. 26

The user may append additional digits after the System Selection Code. 27

The activation code consists of the Feature Code, the System Selection Code and any 28

additional digits that the user appends. 29

The mobile station shall use the preferred roaming list to select the system if either of the 30

following sets of conditions hold: 31

• Set #1: 32

- The mobile station supports the Service Programming Lock feature, and 33

- The SPCp is set to any value other than the default value (see 3.3.6), and 34

- The mobile station supports SSPR and the PR_LIST_SIZE is greater than zero 35

(see 3.5.5). 36

• Set #2: 37

3GPP2 C.S0016-D v2.0

3-3

- The user has entered the feature code (*FC) only (no system selection code or 1

any additional digits have been entered), and 2

- The mobile station supports SSPR and the PR_LIST_SIZE is greater than zero 3

(see 3.5.5). 4

Otherwise, the mobile station shall use the system selection code (see Table 1.4-1 in [23]) 5

to acquire the system. 6

When the user directs the mobile station to begin the programming procedure, and if the 7

mobile station is not already monitoring a selected system, the mobile station shall enter 8

the System Determination Substate of the Mobile Station Initialization State with a 9

provisioning indication. 10

If the mobile station enters the System Determination Substate of the Mobile Station 11

Initialization State with a provisioning indication the mobile station shall perform the 12

following: 13

If a CDMA system with CDMABANDS = ‘00000’ or ‘00011’ is selected for 14

provisioning, it shall perform the following 15

- If the mobile station is to use System A, it shall set SERVSYSS to SYS_A. If 16

the mobile station is to use System B, it shall set SERVSYSS to SYS_B. 17

- The mobile station shall set CDMACHS either to the Primary or Secondary 18

CDMA Channel number (see [5]) for the selected serving system 19

(SERVSYSS). If the mobile station fails to acquire a CDMA system on the 20

first CDMA Channel it tries, the mobile station should attempt to acquire on 21

the alternate CDMA Channel (Primary or Secondary) for the selected serving 22

system before attempting other alternatives. 23

- If a CDMA system with CDMABANDS = ‘00000’ is selected for provisioning 24

and if the mobile station fails to acquire a CDMA system on either the 25

Primary or Secondary CDMA Channel for the selected serving system 26

(SERVSYSS), the mobile station may attempt to acquire an analog system as 27

specified in [22], using the current setting of SERVSYSS. 28

If a CDMA system with CDMABANDS other than ‘00000’ or ‘00011’ is selected for 29

provisioning, it shall perform the following: 30

- The mobile station shall set CDMACHS to a preferred CDMA Channel number 31

(see [5]) within the selected frequency block. If the mobile station fails to acquire 32

a CDMA system on the preferred CDMA channel it tries, the mobile station 33

should set CDMACHS to an alternate preferred CDMA Channel number within 34

the selected frequency block and should attempt to acquire a CDMA system. 35

The mobile station should continue attempting to acquire different preferred 36

CDMA Channels until it acquires a CDMA system or until it exhausts all 37

preferred CDMA Channels within the selected frequency block. 38

3GPP2 C.S0016-D v2.0

3-4

- If the mobile station fails to acquire a system, or if the selected band is not 1

supported by the mobile station, the mobile station shall terminate the 2

programming procedure and shall retain the NAM indicator values and 3

parameters specified in 3.1, in effect prior to the initiation of the programming 4

procedure. 5

6

Once the selected system is acquired, the mobile station shall originate a call as follows: 7

• If the mobile station is in the CDMA mode, the mobile station shall perform the 8

Mobile Station Origination Operation, as defined in 6.6.2.5 of [1] or 2.6.2.5 of [1], using 9

the activation code as the dialed digits. The mobile station should request either a 10

voice or an async data service option in the Origination Message. The mechanism 11

used for the service option selection (either voice or async data) is vendor specific. 12

The mobile station shall format each message sent on the CDMA Access Channel, 13

Enhanced Access Channel, or Reverse Common Control Channel using an MSID 14

field format that contains the mobile station’s ESN or MEID.2 15

• If the mobile station is in the analog mode, the mobile station shall enter the System 16

Access Task with an “origination” indication, using the activation code as the dialed 17

digits. Regardless of the value of the Ss bit, the mobile station shall send Serial 18

Number Word C in all Reverse Analog Control Channel messages. 19

If the mobile station responds to a page and the mobile station does not support 20

concurrent services, the mobile station shall terminate the programming procedure and 21

shall retain the NAM indicator values and parameters, specified in 3.1, in effect prior to the 22

initiation of the programming procedure. 23

If the mobile station does not support Service Programming Lock, the mobile station shall 24

set mobile station locking state SP_LOCK_STATE to ‘0’. 25

If the mobile station supports Service Programming Lock, and if SPCp is equal to ‘0’ (the 26

default value), the mobile station shall set SP_LOCK_STATE to ‘0’; otherwise, the mobile 27

station shall set SP_LOCK_STATE to ‘1’. 28

The mobile station shall set SPCs = SPCp. 29

When the mobile station supports OTAPA and the programming session was initiated by 30

the user, the mobile station shall set the NAM_LOCK_STATE to ‘0’ to indicate that SPASM 31

does not protect access to the NAM parameters and indicators. 32

2For systems defined in [1] or [7], this means the MSID_TYPE field must be set to ‘000’ or ‘011’. For systems defined in [1] or [7], the use of a pseudo ESN can potentially conflict with another pseudo ESN in the network performing the mobile provisioning. The system should implement protective procedures to guard against this case.

3GPP2 C.S0016-D v2.0

3-5

3.2.2 Network-Initiated Procedure 1

An OTAPA-capable mobile station should support a manufacturer-specific means by which 2

the user may disable and enable OTAPA for a given NAM. OTAPA should be enabled by 3

default. When enabled, OTAPA may be initiated by the network. 4

OTAPA procedures can be conducted when the mobile station is in the CDMA Conversation 5

Substate or the analog Conversation Task (see 3.2.2.3). All OTASP Data Messages during 6

the OTAPA session are exchanged between the base station and the mobile station using 7

signaling traffic. 8

If the mobile station is in the CDMA Mobile Station Idle State the base station can place the 9

mobile station on the CDMA Traffic Channel for the purpose of conducting OTAPA 10

procedure (see 3.2.2.1). 11

3.2.2.1 Initiation of OTAPA in the CDMA Mobile Station Idle State 12

The network can initiate OTAPA by placing a mobile terminated call to the mobile station 13

indicating the OTAPA service option in the General Page Message. The OTAPA Service 14

Option when using Multiplex Option 1 is called Service Option 18. The OTAPA Service 15

Option when using Multiplex Option 2 is called Service Option 19. The mobile station shall 16

respond to paging as defined in 6.6 of [1] or 2.6 of [1] and perform service negotiation. 17

3.2.2.2 Connection of the OTAPA Service Option 18

A service option is connected when primary traffic data are being processed in accordance 19

with the requirements of the service option. 20

The negotiated service configuration shall include only valid attributes for the negotiated 21

service option consistent with those specified in Tables 3.2.2.2-1 and 3.2.2.2-2. 22

3GPP2 C.S0016-D v2.0

3-6

Table 3.2.2.2-1 Valid Service Configuration Attributes for Service Option 18 1

Service Configuration Attribute Valid Selections

Forward Multiplex Option Multiplex Option 1

Reverse Multiplex Option Multiplex Option 1

Forward Transmission Rates Rate Set 1 with all four rates enabled

Reverse Transmission Rates Rate Set 1 with all four rates enabled

Forward Traffic Type None. This service option does not use nor generate any forward traffic other than signaling.

Reverse Traffic Type None. This service option does not use nor generate any reverse traffic other than signaling.

2

Table 3.2.2.2-2 Valid Service Configuration Attributes for Service Option 19 3

Service Configuration Attribute Valid Selections

Forward Multiplex Option Multiplex Option 2

Reverse Multiplex Option Multiplex Option 2

Forward Transmission Rates Rate Set 2 with all four rates enabled

Reverse Transmission Rates Rate Set 2 with all four rates enabled

Forward Traffic Type None. This service option does not use nor generate any forward traffic other than signaling.

Reverse Traffic Type None. This service option does not use nor generate any reverse traffic other than signaling.

If the mobile station accepts a service configuration, as specified in a Service Connect 4

Message, that includes a service option connection using Service Option 18 or 19, then the 5

service option connection shall become part of the current service configuration at the 6

action time associated with the Service Connect Message. Service Option 18 or 19 is 7

considered connected when the current service configuration includes a service option 8

connection for it. 9

If Service Option 18 or 19 is connected when the mobile station enters the Waiting for 10

Mobile Station Answer Substate, or while the mobile station is in the Waiting for Mobile 11

Station Answer Substate, the mobile station shall send a Connect Order to the base station 12

as a message requiring acknowledgment without waiting for the user to explicitly command 13

the call to be answered. The mobile station shall enter the Conversation Substate. 14

When Service Option 18 or 19 is connected, the Service Option shall discard all primary 15

traffic data bits received from the multiplex sublayer, and the mobile station shall transmit 16

null traffic channel data. 17

3GPP2 C.S0016-D v2.0

3-7

3.2.2.3 Starting the OTAPA session 1

If the mobile station supports OTAPA and OTAPA is enabled (see 3.2.2), the mobile station 2

shall start the OTAPA session when it receives the OTAPA Request Message with the 3

START_STOPr equal to ‘1’, while in the CDMA Conversation Substate or the analog 4

Conversation Task. 5

Upon starting the OTAPA session, the mobile station shall set PRL_BLOCK_ID_CURRENTs 6

to NULLPRL_BLOCK_ID. 7

During the OTAPA session, access to individual parameters of the active NAM is controlled 8

by the Subscriber Parameter Administration Security Mechanism (SPASM). 9

If the programming session was initiated by the user as described in 3.2.1, SPASM does 10

not protect access to the NAM parameters and indicators; otherwise, upon invocation of the 11

OTAPA session the mobile station shall set the NAM_LOCKs = NAM_LOCKS-PNAM_LOCKp 12

and NAM_LOCK_STATE = NAM_LOCKS-PNAM_LOCKp. The NAM_LOCK_STATE being set to 13

‘0’ indicates that SPASM protection of the mobile station’s active NAM is disabled. The 14

NAM_LOCK_STATE being set to ‘1’ indicates that SPASM protection of the mobile station’s 15

active NAM is enabled. 16

If the mobile station does not support Service Programming Lock, the mobile station shall 17

set mobile station locking state SP_LOCK_STATE to ‘0’. 18

If the mobile station supports Service Programming Lock, and if SPCp is equal to ‘0’ (the 19

default value), the mobile station shall set SP_LOCK_STATE to ‘0’; otherwise, the mobile 20

station shall set SP_LOCK_STATE to ‘1’. 21

The mobile station shall set SPCs = SPCp. 22

3.3 Programming Procedure 23

3.3.1 OTASP Data Message Processing 24

The mobile station shall discard all OTASP Data Messages received, if the programming 25

procedure is not initiated as described in 3.2 or when the mobile station is in any state, 26

substate or task other than the CDMA Conversation Substate or the analog Conversation 27

Task. If the mobile station is in the Mobile Station Control on the Traffic Channel State, the 28

mobile station shall send the Mobile Station Reject Order with ORDQ equal to ‘00000010’. 29

While in the CDMA Conversation Substate or the analog Conversation Task, the mobile 30

station shall process OTASP Data Messages as described in the following sub-sections. 31

If the mobile station receives an OTASP Data Message that it does not recognize or which 32

requires a capability that is not supported, the mobile station shall discard the message 33

and shall send a Mobile Station Reject Order with ORDQ set to ‘00000110’ within T56m 34

seconds (see [7]). 35

The mobile station shall ignore bits at the end of an OTASP Data Message that do not exist 36

in the revision of this specification supported by the mobile station.follows: 37

3GPP2 C.S0016-D v2.0

3-8

3.3.1.1 Configuration Request Message Processing 1

1. Configuration Request Message: The mobile station shall send a 2

Configuration Response Message within 750 ms after receiving the message. 3

If either SP_LOCK_STATE = ‘1’, or NAM_LOCK_STATE = ‘1’, or both are set to ‘1’, 4

the mobile station shall set the RESULT_CODE in all corresponding returned 5

confirmation blocks to ‘00001010’, “Rejected - Mobile station locked.” The 6

mobile station shall include all requested parameter blocks with the 7

BLOCK_LEN field set to ‘00000000’. 8

If both SP_LOCK_STATE and NAM_LOCK_STATE are set to ‘0’, then: 9

- If the mobile station does not support a requested parameter block, the 10

mobile station shall set RESULT_CODE in the corresponding returned 11

confirmation block to ‘00000111’, “Rejected - BLOCK_ID value not 12

supported.” The mobile station shall include the parameter block with the 13


- If the requested data blocks exceed the allowable message length, the mobile 15

station shall set RESULT_CODE in the corresponding returned confirmation 16

block to ‘00000000’, “Accepted - Operation successful” for each Parameter 17

Block included in the message. The mobile station shall include data 18

blocks, in the order requested, up to the maximum number of blocks that fit 19

into the message. If SECURE_MODE_INDS = ‘1’, the mobile station shall set 20

the FRESH_INCL field to ‘1’, include the FRESH field and set it to a 15-bit 21

value selected according to 3.3.8. The mobile station shall encrypt as 22

specified in 3.3.8 each PARAM_DATA field of all Parameter Blocks included 23

in the Configuration Response Message. All the encrypted Parameter Blocks 24

and FRESH field shall fit into the Configuration Response Message. 25

- Otherwise, the mobile station shall set RESULT_CODE to ‘00000000’, 26

“Accepted - Operation successful” for each Parameter Block included in the 27

corresponding confirmation block. The mobile station shall include 28

complete data blocks, in the order requested, in the Configuration Response 29

Message. If SECURE_MODE_INDS = ‘1’, the mobile station shall set the 30

FRESH_INCL field to ‘1’, include the FRESH field and set it to a 15-bit value 31

selected according to 3.3.8. The mobile station shall encrypt as specified in 32

3.3.8 each PARAM_DATA field of all Parameter Blocks included in the 33

Configuration Response Message. 34

35

3.3.1.2 Download Request Message Processing 36

2. Download Request Message: The mobile station shall respond to the message 37

with a Download Response Message within 750 ms. 38

3GPP2 C.S0016-D v2.0

3-9

• If FRESH_INCLr = ‘1’ and the SECURE_MODE_INDS = ‘1’, the mobile station 1

shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each 2

PARAM_DATA field of all Parameter Blocks received in the Download Request 3

Message. 4

• If the Download Request Message contains an OTASP Parameter Block with a 5

BLOCK_ID that is not supported by the mobile station, the mobile station shall 6

set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 7

‘00000111’, “Rejected - BLOCK_ID value not supported;” 8

• If the Download Request Message contains an OTASP Parameter Block having a 9

size different from that supported by the mobile station, the mobile station shall 10

set BLOCK_ID to the received parameter block identifier and RESULT_CODE to 11

‘00000010’, “Rejected - Data size mismatch;” 12

• If the Download Request Message contains an OTASP Parameter Block with a 13

parameter value that is out-of-range, the mobile station shall set BLOCK_ID to 14

the received parameter block identifier and RESULT_CODE to ‘00000100’, 15

“Rejected - Invalid parameter;” 16

• If the Download Request Message contains an OTASP Parameter Block with 17

N_SID_NIDMAX_SID_NID larger than that supported by the mobile station, the 18

mobile station shall set BLOCK_ID to the received parameter block identifier 19

and RESULT_CODE to ‘00000101’, “Rejected - SID/NID length mismatch;” 20

• If the Download Request Message is not accepted for any other reason, the 21


and RESULT_CODE to ‘00000001’, “Rejected - Unknown reason;” 23

• Otherwise, the mobile station shall store the message data in temporary 24

memory, set BLOCK_ID to the received parameter block identifier and set 25

RESULT_CODE to ‘00000000’, “Accepted - Operation successful.” Then, if the 26

mobile station supports the optional NAM indicators (see F.3 of [1, 1]), the 27

mobile station should also store values for CDMA_PREF_SERVp and 28

ANALOG_PREF_SERVp equal to the serving system selected for activation in 29

temporary memory. If more than one Download Request Message or parameter 30

block is received containing values for the same indicators, the mobile station 31

shall retain only the most recently received values. If the received data includes 32

SID/NID pairs, the mobile station shall retain only the SID/NID pairs from the 33

most recently received message. 34

3.3.1.3 Commit Request Message Processing 35

3. Commit Request Message: The mobile station shall send a Commit Response 36

Message within 10 seconds after receiving the message. 37

• If either SP_LOCK_STATE = ‘1’, or NAM_LOCK_STATE = ‘1’, or both are set to ‘1’, 38

the mobile station shall not move data from temporary memory to permanent 39

memory. The mobile station shall set RESULT_CODE to ‘00001010’, “Rejected 40

- Mobile station locked;” otherwise, 41

3GPP2 C.S0016-D v2.0

3-10

- If the mobile station is able to move data from temporary memory to 1

permanent memory successfully, the mobile station shall set the 2

RESULT_CODE to ‘00000000’, “Accepted - Operation successful.” 3

- If the mobile station is not able to move data from temporary memory to 4

permanent memory for any other reason, the mobile station shall set the 5

RESULT_CODE to ‘00000001’, “Rejected - Unknown reason.” 6

- If the mobile station has received configuration parameters in one or more 7

Download Request Messages, it shall set the NAM indicators to the values 8

contained in the received configuration parameters data. The mobile station 9

shall not change the value of any NAM indicator for which no data has been 10

received. If the received data includes SID/NID pairs, the mobile station 11

shall set the NAM indicators to include only the SID/NID pairs received. 12

- If the mobile station has received Preferred Roaming List parameters in one 13

or more SSPR Download Request Messages, it shall set the permanent 14

Preferred Roaming List parameters to the values contained in the received 15

data. The mobile station shall set the CUR_SSPR_P_REVs-p according to the 16

following rules: 17

- If PRL_BLOCK_ID_CURRENTs is set to ‘00000000’ (Preferred Roaming 18

List Parameter Block), then the mobile station shall set the 19

CUR_SSPR_P_REVs-p to ‘00000001’. 20

- If PRL_BLOCK_ID_CURRENTs is set to ‘00000001’ (Extended Preferred 21

Roaming List Parameter Block), then the mobile station shall set the 22

CUR_SSPR_P_REVs-p to the value of CUR_SSPR_P_REV in the Extended 23

Preferred Roaming List (see Section 3.5.5). 24

- If the mobile station has received 3GPD parameters in one or more 3GPD 25

Download Request Messages, it shall set the permanent 3GPD parameters to 26

the values contained in the received data. 27

- If the mobile station has received Preferred User Zone List parameters in one 28

or more PUZL Download Request Messages, it shall set the permanent 29

Preferred User Zone List parameters to the values contained in the received 30

data. 31

- If the mobile station has received User Zone Delete parameter blocks in one 32

or more PUZL Download Request Messages, it shall remove the identified 33

user zone entry(s) from the current Preferred User Zone List. 34

- If the received data includes SID/NID pairs, the mobile station shall set the 35

NAM indicators to include only the SID/NID pairs received. 36

- If the mobile station has stored A_KEY_TEMPs after receiving a Key 37

Generation Request Message, it shall set the value of the A_KEYp NAM 38

indicator equal to A_KEY_TEMPs. 39

3GPP2 C.S0016-D v2.0

3-11

- If the mobile station has stored RK_TEMPs after receiving a Key Generation 1

Request Message, it shall set the value of the RKp NAM indicator equal to 2

RK_TEMPs. 3

- If the mobile station has stored eHRPD_K_TEMPs after receiving a Key 4

Generation Request Message, it shall set the value of the eHRPD_Kp NAM 5

indicator equal to eHRPD_K_TEMPs. 6

- If the mobile station has generated the SSDs as a result of an SSD update 7

procedure based on the A_KEY_TEMPs, the mobile station shall store the 8

SSDs in SSDs-p. 9

- If the mobile station has stored temporary service keys after receiving a 10

Service KeyGeneration Request Message, it shall store the service keys to 11

permanent memory. 12

- If the mobile station has stored the SPCs after receiving a Validation Request 13

Message, it shall set the value of the SPCp parameter equal to SPCs. 14

- If the mobile station has stored the NAM_LOCKs after receiving a Validation 15

Request Message, it shall set the value of the NAM_LOCKS-PNAM_LOCKp 16

parameter equal to NAM_LOCKs. 17

- If the mobile station has received System Tag List parameters in one or more 18

System Tag Download Request Messages, it shall set the permanent System 19

Tag List parameters to the values contained in the received data. The mobile 20

station shall set the TAG_P_REVs-p to TAG_P_REVr. 21

3.3.1.4 Re-Authenticate Request Message Processing 22

4. Re-Authenticate Request Message: The mobile station shall send a Re-23

Authenticate Response Message within 750 ms after receiving the message. The 24

mobile station shall set RANDs = RANDr. The mobile station shall perform the re-25

authentication procedures specified in 3.3.2. 26

3.3.1.5 MS Key Request Message Processing 27

5. MS Key Request Message: The mobile station shall send a MS Key Response 28

Message within 30 seconds after receiving the message. 29

• If the value of A_KEY_P_REV in the MS Key Request Message is not 30

supported by the mobile station, the mobile station shall indicate the error 31

condition by setting RESULT_CODE to ‘00000011’, “Rejected - Protocol version 32

mismatch.” In this case, the mobile station shall send an MS Key Response 33

Message within 750 ms of receiving the MS Key Request Message. 34

The mobile station shall set PARAM_Ps = PARAM_Pr and PARAM_Gs = PARAM_Gr 35

if A_KEY_P_REV received in the MS Key Request Message = ‘00000010’. 36

If A_KEY_P_REV received in the MS Key Request Message = ‘00000011’, 37

‘00000100’, or ‘00000111’, the mobile station shall set PARAM_Ps and 38

PARAM_Gs to the values as specified in 5.3.1, respectively. 39

3GPP2 C.S0016-D v2.0

3-12

• If A_KEY_P_REV received in the MS Key Request Message = 1

‘00000101’ or ‘00001000’, the mobile station shall set PARAM_Ps to the value 2

specified in 5.3.1 and PARAM_Gs to the value specified in 5.5.1, respectively. 3

4

• If the value of A_KEY_P_REV in the MS Key Request Message is not supported 5

by the mobile station, the mobile station shall indicate the error condition by 6

setting RESULT_CODE to ‘00000011’, “Rejected - Protocol version mismatch.” 7

The mobile station shall send an MS Key Response Message within 750 ms after 8

receiving this message. 9

• If the value of A_KEY_P_REV in the MS Key Request Message is supported by 10

the mobile station, the mobile station shall set RESULT_CODE to ‘00000000’, 11

“Accepted - Operation successful.” The mobile station shall compute the 12

MS_RESULT value according to the value of A_KEY_P_REV received in the MS 13

Key Request Message as follows: 14

‘00000010’, calculate MS_RESULT in accordance with 5.1.2; 15





‘00001000’, calculate MS_RESULT in accordance with 5.9.2. 20

The mobile station shall send an MS Key Response Message within 30 seconds 21

after receiving this message.If A_KEY_P_REV is one of the values in column 1 of 22

the following table and is supported by the mobile station, the mobile station 23

shall set PARAM_Ps to the corresponding value in column 2 of the table and 24

shall set PARAM_Gs to the corresponding value in column 3 of the table, and 25

shall attempt to calculate MS_RESULT in accordance with the corresponding 26

section in column 4 of the following table. 27

28

A_KEY_P_REV PARAM_PS PARAM_GS MS_RESULT

‘00000010’ PARAM_Pr PARAM_Gr 5.1.2

‘00000011’ As specified in section 5.3.1

As specified in section 5.3.1

5.3.2

‘00000100’


5.5.2


5.7.2


5.9.2

3GPP2 C.S0016-D v2.0

3-13

1

• If the mobile station was able to compute the MS_RESULT value it shall set 2

RESULT_CODE to ‘000000000’ “Accepted – Operation successful”. 3

4

• If the mobile station is unable to compute the MS_RESULT value in accordance 5

with 5.1.2, 5.3.2, 5.5.2, 5.7.2 or 5.9.2, the mobile station shall set 6

RESULT_CODE to ‘00000001’, “Rejected - Unknown reason.” 7

The mobile station shall send an MS Key Response Message with the specified 8

RESULT_CODE. 9

The mobile station shall send an MS Key Response Message within 30 seconds 10

after receiving this message. 11

3.3.1.6 Key Generation Request Message Processing 12

The mobile stations shall send a Key Generation Response Message within 30 13

seconds after receiving this message. 14

Upon receipt of a Key Generation Request Message the MS shall: 15

6. Key Generation Request Message: 16

• If the mobile station has not previously received a MS Key Request Message, has 17

responded to the most recent MS Key Request Message with a RESULT_CODE 18

other than ‘000000000’, or has already received a Key Generation Request 19

Message after the most recent MS Key Request Message that was received, 20

thenIf the mobile station has not received an MS Key Request Message, the 21

mobile station shall indicate anthe error condition by setting RESULT_CODE to 22

‘00000110’, “Rejected - Message not expected in this mode.” The mobile station 23

shall send a Key Generation Response Message within 750 ms after receiving 24

this message. 25

• If the mobile station has received an MS Key Request Message and returned 26

RESULT CODE other then ‘00000000’, “Accepted - Operation successful,” the 27

mobile station shall indicate the error condition by setting RESULT_CODE to 28


shall send a Key Generation Response Message within 750 ms after receiving 30

this message. 31

If the mobile station has received an Key Generation Request Message with the 32

value of BS_RESULT is equal to 0, the mobile station shall set RESULT_CODE 33

to ‘00000001’, “Rejected - Unknown reason.” The mobile station shall then send 34

a Key Generation Response Message within 750 ms after receiving this message. 35

• Otherwise, the mobile station shall compute the value of the A-key, A-key and 36

Root Key combination, Root Key, or eHRPD Root Key if the value of 37

A_KEY_P_REV received in the MS Key Request Message equals to: 38

‘00000010’, calculate A-key in accordance with 5.1.3; 39

3GPP2 C.S0016-D v2.0

3-14

‘00000011’, calculate A-key and Root Key in accordance with 5.3.3; 1

‘00000100’, calculate Root Key in accordance with 5.3.4; 2

‘00000101’, calculate Root Key in accordance with 5.5.3; 3

‘00000111’, calculate eHRPD Root Key in accordance with 5.7.3; 4

‘00001000’, calculate eHRPD Root Key in accordance with 5.9.3. 5

• If the mobile station has does not successfully calculated the A-key, A-key and 6

Root Key combination, Root Key, or eHRPD Root Key in accordance with 5.1.3, 7

5.3.3, 5.3.4, 5.5.3, 5.7.3 and 5.9.3, respectively, the mobile station shall set 8

RESULT_CODE to ‘00000001’, “Rejected - Unknown reason.” The mobile station 9

shall then send a Key Generation Response Message within 30 seconds after 10

receiving this message. 11

• If the mobile station has successfully calculatesd the A-key, A-key and Root Key 12

combination, Root Key, or eHRPD Root Key in accordance with 5.1.3, 5.3.3, 13

5.3.4, 5.5.3, 5.7.3 and 5.9.3, respectively, the mobile station shall set 14

RESULT_CODE to ‘00000000’, “Accepted - Operation successful”. The mobile 15

station shall then send a Key Generation Response Message within 30 seconds 16

after receiving this message. 17

3.3.1.7 Protocol Capability Request Message Processing 18

7. Protocol Capability Request Message: If the Protocol Capability Request Message 19

contains the OTASP_P_REV field and the mobile station is able to parse it, then the 20

mobile station shall send the Extended Protocol Capability Response Message within 21

750 ms after receiving the message; otherwise, the mobile station shall send a 22

Protocol Capability Response Message within 750 ms after receiving the message. 23

3.3.1.8 SSPR Configuration Request Message Processing 24

8. SSPR Configuration Request Message: The mobile station shall send an SSPR 25



the mobile station shall set RESULT_CODE in the SSPR Configuration Response 28

Message to ‘00001010’, “Rejected - Mobile station locked”. The mobile station 29

shall include the requested parameter block with the BLOCK_LEN field set to 30

zero. 31

• If both SP_LOCK_STATE and NAM_LOCK_STATE are set to ‘0’, then: 32

- If the mobile station does not support the requested parameter block, the 33


parameter block to ‘00000111’, “Rejected - BLOCK_ID value not supported.” 35

The mobile station shall include the parameter block with the BLOCK_LEN 36

field set to zero. 37

3GPP2 C.S0016-D v2.0

3-15

- If the SSPR Configuration Request Message contains the request for the 1

Preferred Roaming List Dimension Parameter Block (BLOCK_ID = 2

‘00000000’) and if the mobile station supports SSPR_P_REV greater than or 3

equal to ‘00000011’ and stores preferred roaming list associated with 4

SSPR_P_REV greater than or equal to ‘00000011’, then, the mobile station 5

shall set the RESULT_CODE in the SSPR Configuration Response Message to 6

‘00100011’, “Rejected – PRL format mismatch.” The mobile station shall 7

include the parameter block with the BLOCK_LEN field set to zero. 8

- If the REQUEST_OFFSETr received in the message specifies an offset which 9

is invalid for the current preferred roaming list, the mobile station shall set 10

the RESULT_CODE in the corresponding returned parameter block to 11

‘00000010’, “Rejected - Data size mismatch.” 12

The mobile station shall set the BLOCK_ID to the corresponding parameter 13

block identifier, the SEGMENT_OFFSET in the returned Parameter Block to 14

the value of the REQUEST_OFFSETr, the SEGMENT_SIZE to ‘00000000’, 15

and shall include no octets of the preferred roaming list in the returned 16

Parameter Block. 17

- Otherwise, if the SSPR Configuration Request Message contains the request 18

for the Preferred Roaming List Parameter Block (BLOCK_ID = ‘00000001’), 19

and if the REQUEST_OFFSETr received in the message is valid for the 20

current preferred roaming list, the mobile station shall set the 21

RESULT_CODE in the SSPR Configuration Response Message to ‘00000000’, 22

“Accepted - Operation successful” for the Parameter Block included in the 23

message. 24

The mobile station shall include the preferred roaming list data (PR_LISTs-p) 25

starting at the offset corresponding to the REQUEST_OFFSETr and not 26

exceeding a maximum number of octets corresponding to the 27

REQUEST_MAX_SIZEr received in the message. 28

The mobile station shall set the SEGMENT_OFFSET in the returned 29

Parameter Block to the value of the REQUEST_OFFSETr received in the 30

message. 31

The mobile station shall set the SEGMENT_SIZE field to the number of 32

octets of the preferred roaming list included in the returned Parameter 33

Block. If the Parameter Block contains the last segment of the preferred 34

roaming list data, the mobile station shall set the LAST_SEGMENT field to 35

‘1’; otherwise the mobile station shall set the LAST_SEGMENT field to ‘0’ in 36

the returned Parameter Block. 37

3.3.1.9 SSPR Download Request Message Processing 38

9. SSPR Download Request Message: The mobile station shall respond to the 39

message with an SSPR Download Response Message within 750 ms. 40


shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each 42

3GPP2 C.S0016-D v2.0

3-16

PARAM_DATA field of all Parameter Blocks received in the SSPR Download 1

Request Message. 2

• If the SSPR Download Request Message contains an SSPR Parameter Block with 3

a BLOCK_ID that is not supported by the mobile station, the mobile station 4

shall set the RESULT_CODE in the SSPR Download Response Message to 5

‘00000111’, “Rejected - BLOCK_ID value not supported” and shall set the 6

BLOCK_ID to the received parameter block identifier. 7

o If the BLOCK_ID is ‘00000000’ or ‘00000001’, tThe The mobile station shall 8

set the SEGMENT_OFFSET and the SEGMENT_SIZE in the SSPR Download 9

Response Message to 0x0000 and 0x00, respectively‘00000000’. 10

• If the SSPR Download Request Message contains an SSPR Parameter Block 11

having a size different from that supported by the mobile station, the mobile 12

station shall set the RESULT_CODE in the SSPR Download Response Message to 13

‘00000010’, “Rejected - Data size mismatch” and shall set the BLOCK_ID to the 14

received parameter block identifier. 15

o The mobile station shall set SEGMENT_OFFSET to the value of 16

SEGMENT_OFFSET received in the message. The mobile station shall set 17

SEGMENT_SIZE to the value of SEGMENT_SIZE received in the message. 18

• If the SSPR Download Request Message does not contain an SSPR Parameter 19

Block with a BLOCK_ID of either ‘00000000’ (Preferred Roaming List) or 20

‘00000001’ (Extended Preferred Roaming List), the mobile station shall omit the 21

SEGMENT_OFFSET and SEGMENT_SIZE. 22

• Otherwise, if the BLOCK_ID field in the SSPR Download Request Message is 23

equal to ‘00000000’ or ‘00000001’ (Preferred Roaming List Parameter Block or 24

Extended Preferred Roaming List Parameter Block, respectively), the mobile 25

station shall perform the following: 26

- The mobile station shall set SEGMENT_OFFSET to the value of 27



- If PRL_BLOCK_ID_CURRENTs is not NULLPRL_BLOCK_ID and the value of the 30

BLOCK_IDr field is not equal to PRL_BLOCK_ID_CURRENTs, the mobile 31


+ Set the RESULT_CODE in the SSPR Download Response Message to 33

‘00100010’, “Rejected – Unexpected PRL BLOCK_ID change”. 34

+ In the SSPR Download Response Message, set the BLOCK_ID to the 35

received parameter block identifier and set the SEGMENT_OFFSET and 36

the SEGMENT_SIZE to ‘00000000’. 37

+ Discard all the SEGMENT_DATA octets that have been received in an 38

SSPR Download Request Message with the BLOCK_ID field set to 39

‘00000000’ or ‘00000001’. 40

+ Set the PRL_BLOCK_ID_CURRENTs to NULLPRL_BLOCK_ID. 41

3GPP2 C.S0016-D v2.0

3-17

- Otherwise, the mobile station shall perform the following: 1

+ Set the PRL_BLOCK_ID_CURRENTs to the value of the BLOCK_ID field 2

received in the SSPR Download Request Message. 3

+ If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are 4

inconsistent with the preferred roaming list storage capabilities of the 5

mobile station, the mobile station shall set the RESULT_CODE to 6

‘00001000’, “Rejected - Preferred roaming list length mismatch” and 7

shall set the BLOCK_ID to the received parameter block identifier. 8

+ Otherwise, if SEGMENT_OFFSET andin conjunction with 9

SEGMENT_SIZE are consistent with the preferred roaming list storage 10

capabilities of the mobile station, the mobile station shall store the 11

SEGMENT_DATA octets in temporary memory. 12

o If LAST_SEGMENT is equal to ‘0’, the mobile station shall set the 13

RESULT_CODE to ‘00000000’, “Accepted - Operation successful” and 14


o If LAST_SEGMENT is equal to ‘1’, the mobile station shall calculate 16

the CRC, as specified in Section 3.5.5.1 for the preferred roaming list 17

stored in temporary memory. If the CRC checks, the mobile station 18

shall set the RESULT_CODE to ‘00000000’, “Accepted - Operation 19

successful;” otherwise, the mobile station shall set the 20

RESULT_CODE to ‘00001001’, “Rejected - CRC error” and shall 21

discard this segment and all previously assembled segments of the 22

preferred roaming list from the temporary memory. The mobile 23

station shall set the BLOCK_ID to the received parameter block 24

identifier. 25

3.3.1.10 Validation Request Message Processing 26

10. Validation Request Message: The mobile station shall send a Validation 27

Response Message within 750 ms after receiving the message. 28

• If the Validation Request Message contains a Validation Parameter Block with a 29


set the BLOCK_ID to the received parameter block identifier and shall set the 31

RESULT_CODE to ‘00000111’, “Rejected - BLOCK_ID value not supported;” 32

• If the Validation Request Message contains a Validation Parameter Block having 33

a size different from that supported by the mobile station, the mobile station 34

shall set the RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch” and 35


• If the Validation Request Message contains a Validation Parameter Block with a 37

parameter value that is out-of-range, the mobile station shall set the 38

RESULT_CODE to ‘00000100’, “Rejected - Invalid parameter” and the 39


3GPP2 C.S0016-D v2.0

3-18

• If the Validation Request Message is not accepted for any other reason, the 1

mobile station shall set the RESULT_CODE to ‘00000001’, “Rejected - Unknown 2

reason” and shall set the BLOCK_ID to the received parameter block identifier. 3

• If the Validation Request Message contains the Verify SPC Parameter Block, the 4

mobile station shall compare the SPCr received in the message with the SPCs. 5

- If the comparison results in a mismatch, the mobile station shall set the 6

RESULT_CODE to ‘00001011’, “Rejected - Invalid SPC” and shall set the 7


- Otherwise, if the comparison results in a match, the mobile station shall set 9

the RESULT_CODE to ‘00000000’, “Accepted - Operation successful” and 10

shall set the BLOCK_ID to the received parameter block identifier. The 11

mobile station shall set the SP_LOCK_STATE to ‘0’. 12

• If the Validation Request Message contains the Change SPC Parameter Block, 13

the mobile station shall do the following: 14

- If SP_LOCK_STATE = ‘1’, the mobile station shall set the RESULT_CODE to 15

‘00001010’, “Rejected - Mobile station locked” and shall set the BLOCK_ID 16

to the received parameter block identifier. 17

- If SP_LOCK_STATE = ‘0’ and SPCs is set to the default value, the mobile 18

station shall do the following: 19

+ If the mobile station is programmed by the user to accept SPC change 20

(see 3.3.6), the mobile station shall set the RESULT_CODE to 21

‘00000000’, “Accepted - Operation successful” and shall set the 22

BLOCK_ID to the received parameter block identifier. The mobile station 23

shall set SPCs to SPCr received in the message. 24

+ If the mobile station is programmed by the user to deny SPC change, the 25

mobile station shall set the RESULT_CODE to ‘00001100’, “Rejected - 26

SPC change denied by the user” and shall set the BLOCK_ID to the 27


- Otherwise, if SP_LOCK_STATE = ‘0’ and if the SPCs is not set to the default 29

value, the mobile station shall set SPCs = SPCr received in the message and 30

shall set the RESULT_CODE to ‘00000000’, “Accepted - Operation 31

successful” and the BLOCK_ID to the received parameter block identifier. 32

• If the Validation Request Message contains both the Verify SPC Parameter Block 33

and the Change SPC Parameter Block, the mobile station shall process the 34

Verify SPC Parameter Block first. 35

• If the Validation Request Message contains the Validate SPASM Parameter 36

Block, the mobile station shall do the following: 37

- If the programming session was initiated by the user as described in 3.2.1, 38

the mobile station shall set the RESULT_CODE to ‘00001110’, “Rejected - 39

BLOCK_ID not expected in this mode” and shall set the BLOCK_ID to the 40


3GPP2 C.S0016-D v2.0

3-19

- If the NAM_LOCK_STATE = ‘0’, the mobile station shall set the 1

RESULT_CODE to ‘00000000’, “Accepted - Operation successful” and shall 2

set the BLOCK_ID to the received parameter block identifier. The mobile 3

station shall set NAM_LOCKs = NAM_LOCKr received in the message. 4

- If the NAM_LOCK_STATE = ‘1’, the mobile station shall compare the 5

AUTH_OTAPAr received in the message with the AUTH_OTAPAs calculated 6

using SPASM Validation Procedure defined in 3.3.7. 7

+ If the comparison results in a mismatch, the mobile station shall set the 8

RESULT_CODE to ‘00001101’, “Rejected - Invalid SPASM” and shall set 9

the BLOCK_ID to the received parameter block identifier. 10

+ If the comparison results in a match, the mobile station shall set the 11


shall set the BLOCK_ID to the received parameter block identifier. The 13

mobile station shall set the NAM_LOCK_STATE to ‘0’ and the 14

NAM_LOCKs = NAM_LOCKr. 15

3.3.1.11 OTAPA Request Message Processing 16

11. OTAPA Request Message: The mobile station shall send the OTAPA 17

Response Message within 750 ms after receiving the message. 18

• If the programming session was initiated by the user as described in 3.2.1, the 19

mobile station shall indicate the error condition by setting RESULT_CODE to 20


shall set the NAM_LOCK_IND field to ‘0’ and shall omit the RAND_OTAPA field in 22

the OTAPA Response Message. 23

• If the mobile station does not support OTAPA, or if the OTAPA was disabled by 24

the user as described in 3.2.2, the mobile station shall indicate the error 25

condition by setting RESULT_CODE to ‘00000110’, “Rejected - Message not 26

expected in this mode.” The mobile station shall set the NAM_LOCK_IND field to 27

‘0’ and shall omit the RAND_OTAPA field in the OTAPA Response Message. 28

• If the START_STOPr field received in the message is equal to ‘1’, the mobile 29



NAM_LOCK_IND field to ‘1’, RAND_OTAPA field to a randomly generated 32-32

bit value, and shall set the RESULT_CODE to the ‘00000000’, “Accepted - 33

Operation successful” in the OTAPA Response Message. The mobile station 34

shall generate the AUTH_OTAPAs as specified in 3.3.7. 35


NAM_LOCK_IND field to ‘0’, the RESULT_CODE to the ‘00000000’, “Accepted 37

- Operation successful”, and shall omit the RAND_OTAPA field in the OTAPA 38

Response Message. 39

- The mobile station shall start the OTAPA session (see 3.2.2.3). 40

3GPP2 C.S0016-D v2.0

3-20

• If the START_STOPr field received in the message is equal to ‘0’, the mobile 1

station shall set the NAM_LOCK_IND field to ‘0’, the RESULT_CODE to the 2

‘00000000’, “Accepted - Operation successful”, and shall omit the RAND_OTAPA 3

field in the OTAPA Response Message. The mobile station shall terminate the 4

OTAPA session (see 3.4). 5

3.3.1.12 PUZL Configuration Request Message Processing 6

12. PUZL Configuration Request Message: The mobile station shall send a PUZL 7



the mobile station shall set RESULT_CODE in the PUZL Configuration Response 10

Message to ‘00001010’, “Rejected - Mobile station locked”. The mobile station 11

shall set BLOCK_ID to the received value and set BLOCK_LEN to zero. 12



mobile station shall set RESULT_CODE in the PUZL Configuration Response 15

Message to ‘00000111’, “Rejected - BLOCK_ID value not supported”. The 16

mobile station shall set BLOCK_ID to the received value and set BLOCK_LEN 17

to zero. 18

- If the PUZL Configuration Request Message contains the request for the PUZL 19

Priorities Parameter Block (BLOCK_ID = ‘00000001’), and the 20

REQUEST_INDEX value received in the message specifies an index that is 21

invalid for the current preferred user zone list, the mobile station shall set 22

RESULT_CODE in the PUZL Configuration Response Message to ‘00000010’, 23

“Rejected – Data size mismatch”. 24

The mobile station shall set BLOCK_ID to the received parameter block 25

identifier, set SEGMENT_INDEX in the returned parameter block to the 26

value of the REQUEST_INDEX, set NUM_ENTRIES to ‘00000000’ and 27

include no UZ_ID, UZ_SID and UZ_PRIORITY field data. 28

- Otherwise, if the PUZL Configuration Request Message contains the request 29

for the PUZL Priorities Parameter Block (BLOCK_ID = ‘00000001’), and the 30

REQUEST_INDEX value received in the message specifies an index which is 31

valid for the current preferred user zone list, the mobile station shall set 32


“Accepted – Operation successful” and shall set BLOCK_ID to the received 34

parameter block identifier. 35

The mobile station shall include the UZ_ID, UZ_SID and UZ_PRIORITY 36

values starting at the user zone entry in the current preferred user zone list 37

corresponding to the REQUEST_INDEX value and not exceeding the 38

maximum number of user zone entries specified by the 39

REQUEST_MAX_ENTRIES value received in the message. 40

3GPP2 C.S0016-D v2.0

3-21

The mobile station shall set SEGMENT_INDEX in the returned parameter 1

block to the value of the REQUEST_INDEX received in the message. 2

The mobile station shall set the NUM_ENTRIES field to the number of user 3

zone entries for which ID, SID and priority information has been included in 4

the returned parameter block. If the parameter block contains the 5

information for the last user zone entry of the current preferred user zone 6

list, the mobile station shall set the LAST_SEGMENT field to ‘1’; otherwise, 7

the mobile station shall set the LAST_SEGMENT field to ‘0’ in the returned 8

parameter block. 9

- If the PUZL Configuration Request Message contains the request for the User 10

Zone Parameter Block (BLOCK_ID = ‘00000010’), and if the user zone entry 11

identified by the UZ_ID and UZ_SID values received in the message is not 12

present in the current preferred user zone list, the mobile station shall set 13


“Rejected – User Zone not in PUZL”. The mobile station shall set BLOCK_ID 15

to the received value and set BLOCK_LEN to zero. 16

- If the PUZL Configuration Request Message contains the request for the User 17

Zone Parameter Block (BLOCK_ID = ‘00000010’), and if the 18

REQUEST_OFFSET value received in the message specifies an offset which 19

is invalid for the user zone entry, the mobile station shall set RESULT_CODE 20

in the PUZL Configuration Response Message to ‘00000010’, “Rejected – Data 21

size mismatch”. 22


identifier, set SEGMENT_OFFSET in the returned parameter block to the 24

value of the REQUEST_OFFSET, set UZ_ID and UZ_SID to the values 25

received in the message, set SEGMENT_SIZE to ‘00000000’ and include no 26

octets of the user zone entry in the returned parameter block. 27


for the User Zone Parameter Block (BLOCK_ID = ‘00000010’), and if the 29


is valid for the specified user zone entry, the mobile station shall set 31


“Accepted – Operation successful”, and shall set BLOCK_ID to the received 33


The mobile station shall include the user zone entry of the preferred user 35

zone list starting at the offset corresponding to the REQUEST_OFFSET and 36

not exceeding a maximum number of octets corresponding to the 37

REQUEST_MAX_SIZE received in the message. 38

The mobile station shall set SEGMENT_OFFSET in the returned parameter 39

block to the value of the REQUEST_OFFSET received in the message and set 40

UZ_ID and UZ_SID to the values received in the message. 41

3GPP2 C.S0016-D v2.0

3-22

The mobile station shall set SEGMENT_SIZE to the number of octets of the 1

user zone entry included in the returned parameter block. If the parameter 2

block contains the last segment of the user zone entry, the mobile station 3

shall set the LAST_SEGMENT field to ‘1’; otherwise, the mobile station shall 4

set the LAST_SEGMENT field to ‘0’ in the returned parameter block. 5

- If the PUZL Configuration Request Message contains the request for the 6

Preferred User Zone List Parameter Block (BLOCK_ID = ‘00000011’), and if 7

the REQUEST_INDEX value received in the message specifies an index 8

which is invalid for the current preferred user zone list, the mobile station 9

shall set RESULT_CODE in the PUZL Configuration Response Message to 10

‘00000010’, “Rejected – Data size mismatch”. 11


identifier, set NUM_ENTRIES to ‘1’ in the returned parameter block, set 13

SEGMENT_INDEX to the value of the REQUEST_INDEX, set 14

SEGMENT_OFFSET to the value of REQUEST_OFFSET, set SEGMENT_SIZE 15

to ‘00000000’ and include no octets of the preferred user zone list in the 16

returned parameter block. 17

- If the PUZL Configuration Request Message contains the request for the 18

Preferred User Zone List Parameter Block (BLOCK_ID = ‘00000011’), and if 19

the REQUEST_OFFSET value received in the message specifies an offset 20

which is invalid for user zone entry identified by REQUEST_INDEX of the 21

current preferred user zone list, the mobile station shall set RESULT_CODE 22

in the PUZL Configuration Response Message to ‘00000010’, “Rejected – Data 23

size mismatch”. 24


identifier, set NUM_ENTRIES to ‘1’ in the returned parameter block, set 26

SEGMENT_INDEX to the value of the REQUEST_INDEX, set 27

SEGMENT_OFFSET to the value of REQUEST_OFFSET, set SEGMENT_SIZE 28

to ‘00000000’ and include no octets of the preferred user zone list in the 29



for the Preferred User Zone List Parameter Block (BLOCK_ID = ‘00000011’), 32

and if the REQUEST_INDEX value received in the message specifies an index 33

which is valid for the current preferred user zone list, and if the 34


is valid for the user zone entry identified by REQUEST_INDEX, the mobile 36

station shall set RESULT_CODE to ‘00000000’, “Accepted – Operation 37

successful”, and shall set BLOCK_ID to the received parameter block 38

identifier. 39

The mobile station shall include the user zone entry specified by 40

REQUEST_INDEX of the preferred user zone list starting at the offset 41

corresponding to REQUEST_OFFSET and not exceeding a maximum number 42

of octets corresponding to REQUEST_MAX_SIZE received in the message. 43

3GPP2 C.S0016-D v2.0

3-23

The mobile station shall set SEGMENT_INDEX in the returned parameter 1

block to the value of REQUEST_INDEX received in the message and shall set 2

SEGMENT_OFFSET to the value of REQUEST_OFFSET. 3

The mobile station shall set SEGMENT_SIZE to the number of octets of the 4

user zone entry included in the returned parameter block. If the parameter 5

block contains the last segment of the user zone entry, the mobile station 6

shall set the LAST_SEGMENT field to ‘1’; otherwise, the mobile station shall 7

set the LAST_SEGMENT field to ‘0’ in the returned parameter block. 8

If the last segment of a user zone entry is included in the returned 9

parameter block and if the REQUEST_MAX_SIZE number of octets has not 10

been included, the mobile station shall include a segment of the next user 11

zone entry of the preferred user zone list. When including the start of a 12

subsequent user zone entry, the mobile shall set the SEGMENT_OFFSET to 13

‘00000000’ and shall not include a segment of less than four octets. The 14

SEGMENT_INDEX shall be set appropriately and the LAST_SEGMENT and 15

SEGMENT_SIZE shall be set as described above. 16

The mobile station shall set NUM_ENTRIES to the number of user zone entry 17

segments included in the returned parameter block. 18

- If the PUZL Configuration Request Message contains the request for a valid 19

parameter block and if there is no entry in the current preferred user zone 20

list, the mobile station shall set the RESULT_CODE in the PUZL 21

Configuration Response Message to ‘00010001’, “Rejected – No entries in 22

PUZL”, and shall set the BLOCK_ID to the received parameter block 23

identifier 24

- Otherwise, if SECURE_MODE_INDS = ‘1’, the mobile station shall set the 25

FRESH_INCL field to ‘1’, and include the FRESH field set to a 15-bit value 26


3.3.8 each PARAM_DATA field of all Parameter Blocks included in the PUZL 28


3.3.1.13 PUZL Download Request Message Processing 30

13. PUZL Download Request Message : The mobile station shall send a PUZL 31

Download Response Message within 750 ms after receiving the message. 32


shall set FRESHS = FRESHr and decrypt as specified in 3.3.8 each PARAM_DATA 34

field of all Parameter Blocks received in the PUZL Download Request Message. 35

• If the PUZL Download Request Message contains a PUZL Parameter Block with a 36


set BLOCK_ID to the received parameter block identifier, set RESULT_CODE to 38

‘00000111’, “Rejected - BLOCK_ID value not supported”, and set IDS_PRESENT 39

to ‘0’. The UZ_ID and UZ_SID fields shall not be included in the returned 40

parameter block. 41

3GPP2 C.S0016-D v2.0

3-24

• If the PUZL Download Request Message contains a PUZL Parameter Block having 1

a size different from that supported by the mobile station, the mobile station 2

shall set BLOCK_ID to the received parameter block identifier, set 3

RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch”, and set 4

IDS_PRESENT to ‘0’. The UZ_ID and UZ_SID fields shall not be included in the 5


• If the PUZL Download Request Message contains a PUZL Parameter Block with a 7

parameter value that is out-of-range, the mobile station shall set BLOCK_ID to 8

the received parameter block identifier, set RESULT_CODE to ‘00000100’, 9

“Rejected - Invalid parameter” and shall set IDS_PRESENT to ‘0’. The UZ_ID and 10

UZ_SID fields shall not be included in the returned parameter block. 11

• If the PUZL Download Request Message is not accepted for any other reason, the 12

mobile station shall set BLOCK_ID to the received parameter block identifier, set 13

RESULT_CODE to ‘00000001’, “Rejected - Unknown reason”, and set 14



• If the PUZL Download Request Message contains the User Zone Insert Parameter 17

Block and the User Zone ID/System ID pair already exists in the current 18

preferred user zone list, the mobile station shall set BLOCK_ID to the received 19

parameter block identifier, set RESULT_CODE to ‘00001111’, “Rejected – User 20

Zone already in PUZL”, and set IDS_PRESENT to ‘1’. The mobile station shall 21

include the UZ_ID and UZ_SID fields in the returned parameter block containing 22

the values received. 23

- Otherwise, the mobile station shall store the parameter block data in 24

temporary memory, set BLOCK_ID to the received parameter block identifier, 25

set RESULT_CODE to ‘00000000’, “Accepted - Operation successful”, and 26

set IDS_PRESENT to ‘1’. The mobile station shall include the UZ_ID and 27

UZ_SID fields in the returned parameter block containing the values 28

received. If more than one PUZL Download Request Message or parameter 29

block is received containing the same user zone entry segment, the mobile 30

station shall retain only the most recently received data. 31

• If the PUZL Download Request Message contains the User Zone Update 32

Parameter Block and the User Zone ID/System ID pair does not exist in the 33

current preferred user zone list, the mobile station shall set BLOCK_ID to the 34

received parameter block identifier, set RESULT_CODE to ‘00010000’, “Rejected 35

– User Zone not in PUZL”, and set IDS_PRESENT to ‘1’. The mobile station shall 36



3GPP2 C.S0016-D v2.0

3-25







block is received containing the same user zone entry segment, the mobile 7

station shall retain only the most recently received data. 8

• If the PUZL Download Request Message contains the User Zone Delete Parameter 9

Block, and if the User Zone ID/System ID pair does not exist in the current 10

preferred user zone list, the mobile station shall set BLOCK_ID to the received 11

parameter block identifier, set RESULT_CODE to ‘00010000’, “Rejected – User 12

Zone not in PUZL”, and shall set IDS_PRESENT to ‘1’. The mobile station shall 13



- Otherwise, the mobile station shall mark the specified user zone entry to be 16

deleted, set BLOCK_ID to the received parameter block identifier, set 17

RESULT_CODE to ‘00000000’, “Accepted - Operation successful”, and set 18

IDS_PRESENT to ‘1’. The mobile station shall include the UZ_ID and 19


received. 21

• If the PUZL Download Request Message contains the User Zone Priority Change 22

Parameter Block and the User Zone ID/System ID pair does not exist in the 23

current preferred user zone list, the mobile station shall set BLOCK_ID to the 24

received parameter block identifier, set RESULT_CODE to ‘00010000’, “Rejected 25

– User Zone not in PUZL”, and set IDS_PRESENT to ‘1’. The mobile station shall 26









block is received for the same user zone, the mobile station shall retain only 35

the most recently received data. 36

• If the PUZL Download Request Message contains the PUZL Flags Parameter 37

Block, the mobile station shall store the parameter block data in temporary 38

memory, set BLOCK_ID to the received parameter block identifier, set 39

RESULT_CODE to ‘00000000’, “Accepted - Operation successful”, and set 40


returned parameter block. If more than one PUZL Download Request Message or 42

parameter block is received, the mobile station shall retain only the most 43

recently received data. 44

3GPP2 C.S0016-D v2.0

3-26

3.3.1.14 3GPD Configuration Request Message Processing 1

14. 3GPD Configuration Request Message : The mobile station shall send 2

a 3GPD Configuration Response Message within 750 ms after receiving the message. 3

If Secure Mode is not active and the 3GPD Configuration Request Message 4

contains a SimpleIPSimple IP PAP Parameter Block, SimpleIPSimple IP CHAP SS 5

Parameter Block, MobileIPMobile IP SS Parameter Block, HRPD Access 6

Authentication CHAP SS Paramater Block or eHRPD MILENAGE Algorithm 7

Parameter Block, the mobile station shall set BLOCK_ID to the received 8

parameter block identifier and RESULT_CODE to ‘00110011’, “Rejected – Secure 9

Mode not active”. 10


the mobile station shall set the RESULT_CODE in the corresponding returned 12



















in the 3GPD Configuration Response Message. All the encrypted Parameter 31

Blocks and FRESH field shall fit into the 3GPD Configuration Response 32

Message. 33




complete data blocks, in the order requested, in the 3GPD Configuration 37

Response Message. . If SECURE_MODE_INDS = ‘1’, the mobile station shall 38

set the FRESH_INCL field to ‘1’, and include the FRESH field and set it to a 39

15-bit value selected according to 3.3.8. The mobile station shall encrypt as 40


in the 3GPD Configuration Response Message. 42

3GPP2 C.S0016-D v2.0

3-27

3.3.1.15 3GPD Download Request Message Processing 1

15. 3GPD Download Request Message : The mobile station shall respond to 2

the message with a 3GPD Download Response Message within 750 ms. 3

• If Secure Mode is not active and the 3GPD Download Request Message contains 4

a SimpleIPSimple IP PAP Parameter Block, SimpleIPSimple IP CHAP SS 5

Parameter Block, MobileIPMobile IP SS Parameter Block, HRPD Access 6

Authentication CHAP SS Paramater Block or eHRPD MILENAGE Algorithm 7

Parameter Block, the mobile station shall set BLOCK_ID to the received 8

parameter block identifier and RESULT_CODE to ‘00110011’, “Rejected – Secure 9

Mode not active”. 10

• If FRESH_INCLr = ‘1’, the mobile station shall set FRESHS = FRESHr. If the 11

SECURE_MODE_INDS = ‘1’, the mobile station shall decrypt as specified in 3.3.8 12

each PARAM_DATA field of all Parameter Blocks received in the 3GPD Download 13

Request Message. 14

• If the 3GPD Download Request Message contains an 3GPD Parameter Block with 15

a BLOCK_ID that is not supported by the mobile station, the mobile station 16

shall set BLOCK_ID to the received parameter block identifier and 17


• If the 3GPD Download Request Message contains an 3GPD Parameter Block 19


station shall set BLOCK_ID to the received parameter block identifier and 21

RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch;” 22

• If the 3GPD Download Request Message contains an 3GPD Parameter Block with 23

a parameter value that is out-of-range, the mobile station shall set BLOCK_ID to 24


“Rejected - Invalid parameter;” 26

• If the 3GPD Download Request Message contains an Operation Mode Parameter 27

Block with a OP_MODE not supported by the mobile station, the mobile station 28


RESULT_CODE to ‘00010010’, “Rejected – Operation Mode mismatch;” 30

• If the 3GPD Download Request Message contains a SimpleIPSimple IP User 31

Profile Parameter Block with a NUM_NAI or any NAI_ENTRY_INDEX greater than 32

that supported by the mobile station, the mobile station shall set BLOCK_ID to 33


“Rejected – SimpleIPSimple IP MAX_NUM_NAI mismatch;” 35

• If the 3GPD Download Request Message contains a SimpleIPSimple IP User 36

Profile Parameter Block with any NAI_LENGTH larger than that supported by 37

the mobile station, the mobile station shall set BLOCK_ID to the received 38

parameter block identifier and RESULT_CODE to ‘00010100’, “Rejected – 39

SimpleIPSimple IP MAX_NAI_LENGTH mismatch;” 40

3GPP2 C.S0016-D v2.0

3-28

• If the 3GPD Download Request Message contains a MobileIPMobile IP User 1

Profile Parameter Block with a NUM_NAI or any NAI_ENTRY_INDEX greater than 2

that supported by the mobile station, the mobile station shall set BLOCK_ID to 3


“Rejected – MobileIPMobile IP MAX_NUM_NAI mismatch;” 5


Profile Parameter Block with any NAI_LENGTH larger than that supported by 7


parameter block identifier and RESULT_CODE to ‘00010110’, “Rejected – 9

MobileIPMobile IP MAX_NAI_LENGTH mismatch;” 10

• If the 3GPD Download Request Message contains a SimpleIPSimple IP PAP SS 11

Parameter Block with a SS_LENGTH larger than that supported by the mobile 12

station, the mobile station shall set BLOCK_ID to the received parameter block 13

identifier and RESULT_CODE to ‘00010111’, “Rejected – SimpleIPSimple IP PAP 14

MAX_SS_LENGTH mismatch;” 15

• If the 3GPD Download Request Message contains a SimpleIPSimple IP CHAP SS 16

Parameter Block with a SS_LENGTH larger than that supported by the mobile 17


identifier and RESULT_CODE to ‘00011000’, “Rejected – SimpleIPSimple IP 19

CHAP MAX_SS_LENGTH mismatch;” 20

• If the 3GPD Download Request Message contains a MobileIPMobile IP SS 21

Parameter Block with a MN-AAA_SS_LENGTH larger than that supported by the 22

mobile station, the mobile station shall set BLOCK_ID to the received parameter 23

block identifier and RESULT_CODE to ‘00011001’, “Rejected – MAX_MN-24

AAA_SS_LENGTH mismatch;” 25


Parameter Block with a MN-HA_SS_LENGTH larger than that supported by the 27


block identifier and RESULT_CODE to ‘00011010’, “Rejected – MAX_MN-29

HA_SS_LENGTH mismatch;” 30


Profile Parameter Block with any MN-AAA_AUTH_ALGORITHM not supported by 32


parameter block identifier and RESULT_CODE to ‘00011011’, “Rejected – MN-34

AAA_AUTH_ALGORITHM mismatch;” 35


Profile Parameter Block with any MN-HA_AUTH_ ALGORITHM not supported by 37


parameter block identifier and RESULT_CODE to ‘00011100’, “Rejected – MN-39

HA_AUTH_ ALGORITHM mismatch;” 40

3GPP2 C.S0016-D v2.0

3-29

• If the 3GPD Download Request Message contains a SimpleIPSimple IP Status 1

Parameter Block with an ACT_NAI_ENTRY_INDEX not supported by the mobile 2



ACT_NAI_ENTRY_INDEX mismatch;” 5

• If the 3GPD Download Request Message contains a MobileIPMobile IP Status 6

Parameter Block with an ACT_NAI_ENTRY_INDEX not supported by the mobile 7


identifier and RESULT_CODE to ‘00011110’, “Rejected – MobileIPMobile IP 9

ACT_NAI_ENTRY_INDEX mismatch;” 10

• If the 3GPD Download Request Message contains a SimpleIPSimple IP PAP SS 11

Parameter Block with an NAI_ENTRY_INDEX not supported by the mobile 12


identifier and RESULT_CODE to ‘00011111’, “Rejected – SimpleIPSimple IP PAP 14

NAI_ENTRY_INDEX mismatch;” 15

• If the 3GPD Download Request Message contains a SimpleIPSimple IP CHAP SS 16




CHAP NAI_ENTRY_INDEX mismatch;” 20




identifier and RESULT_CODE to ‘00100001’, “Rejected – MobileIPMobile IP 24

NAI_ENTRY_INDEX mismatch;” 25

If the 3GPD Download Request Message contains a HRPD Access Authentication 26

User Profile Parameter Block with any NAI_LENGTH larger than that supported 27

by the mobile station, the mobile station shall set BLOCK_ID to the received 28

parameter block identifier and RESULT_CODE to ‘00100100’, “Rejected – HRPD 29

Access Authentication MAX_NAI_LENGTH mismatch;” 30

If the 3GPD Download Request Message contains a HRPD Access Authentication 31

CHAP SS Parameter Block with a SS_LENGTH larger than that supported by the 32


block identifier and RESULT_CODE to ‘00100101’, “Rejected – HRPD Access 34

Authentication CHAP_MAX_SS_LENGTH mismatch;” 35

• If the 3GPD Download Request Message is not accepted for any other reason, the 36


and RESULT_CODE to ‘00000001’, “Rejected – Unknown reason;” 38

3GPP2 C.S0016-D v2.0

3-30

• Otherwise, the mobile station shall store the message data in temporary memory, 1

set BLOCK_ID to the received parameter block identifier and set RESULT_CODE to 2

‘00000000’, “Accepted – Operation successful.” If more than one 3GPD Download 3

Request Message or parameter block is received containing values for the same 4

indicators, the mobile station shall retain only the most recently received values. 5

3.3.1.16 Secure Mode Request Message Processing 6

16. Secure Mode Request Message: The mobile station shall send the Secure 7

Mode Response Message within 750 ms after receiving the message. 8


the mobile station shall indicate the error condition by setting the 10

RESULT_CODE to ‘00001010’, “Rejected - Mobile station locked” in the Secure 11

Mode Response Message. 12


- If the START_STOPr field received in the message is equal to ‘1’, the mobile 14


+ The mobile station shall set SECURE_MODE_INDS = ‘1’. 16

+ The mobile station shall generate SMCKs (see 3.3.8.23.8.2). 17

+ The mobile station shall set the RESULT_CODE to ‘00000000’, “Accepted 18

- Operation successful”, in the Secure Mode Response Message. 19

- If the START_STOPr field received in the message is equal to ‘0’, the mobile 20

station shall set the RESULT_CODE to the ‘00000000’, “Accepted - 21

Operation successful”, in the Secure Mode Response Message. If the Secure 22

Mode is active, the mobile station shall terminate the Secure Mode. The 23

mobile station shall set SECURE_MODE_INDS = ‘0’ and SMCKs to NULLSMCK. 24

3.3.1.17 MMD Configuration Request Message Processing 25

17. MMD Configuration Request Message : The mobile station shall send 26

a MMD Configuration Response Message within 750 ms after receiving the message. 27












3GPP2 C.S0016-D v2.0

3-31










in the MMD Configuration Response Message. All the encrypted Parameter 10

Blocks and FRESH field shall fit into the MMD Configuration Response 11

Message. 12




complete data blocks, in the order requested, in the MMD Configuration 16

Response Message. . If SECURE_MODE_INDS = ‘1’, the mobile station shall 17




in the MMD Configuration Response Message. 21

3.3.1.18 MMD Download Request Message Processing 22

18. MMD Download Request Message: The mobile station shall respond to the 23

message with a MMD Download Response Message within 750 ms. 24



each PARAM_DATA field of all Parameter Blocks received in the MMD Download 27

Request Message. 28

• If the MMD Download Request Message contains an MMD Application Parameter 29

Block with a BLOCK_ID that is not supported by the mobile station, the mobile 30




Block having a size different from that supported by the mobile station, the 34


and RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch;” 36


Block with a parameter value that is out-of-range, the mobile station shall set 38

BLOCK_ID to the received parameter block identifier and RESULT_CODE to 39

‘00000100’, “Rejected - Invalid parameter;” 40

3GPP2 C.S0016-D v2.0

3-32

• If the MMD Download Request Message contains a MMD Application Parameter 1

Block with a NUM_IMPU or any IMPU_ENTRY_IDX greater than that supported 2

by the mobile station, the mobile station shall set BLOCK_ID to the received 3

parameter block identifier and RESULT_CODE to ‘00100110’, “Rejected – MMD 4

MAX_NUM_IMPU mismatch;” 5


Block with any IMPU_LENGTH larger than that supported by the mobile station, 7

the mobile station shall set BLOCK_ID to the received parameter block identifier 8

and RESULT_CODE to ‘00100111’, “Rejected – MMD MAX_IMPU_LENGTH 9

mismatch;” 10


Block with a NUM_P-CSCF or any P-CSCF_ENTRY_IDX greater than that 12

supported by the mobile station, the mobile station shall set BLOCK_ID to the 13

received parameter block identifier and RESULT_CODE to ‘00101000’, “Rejected 14

– MMD MAX_NUM_P-CSCF mismatch;” 15


Block with any P-CSCF_LENGTH larger than that supported by the mobile 17


identifier and RESULT_CODE to ‘00101001’, “Rejected – MMD MAX_P-19

CSCF_LENGTH mismatch;” 20

• If the MMD Download Request Message is not accepted for any other reason, the 21


and RESULT_CODE to ‘00000001’, “Rejected – Unknown reason;” 23



RESULT_CODE to ‘00000000’, “Accepted – Operation successful.” If more 26

than one MMD Download Request Message or parameter block is received 27

containing values for the same indicators, the mobile station shall retain 28

only the most recently received values. 29

3.3.1.19 System Tag Configuration Request Message Processing 30

19. System Tag Configuration Request Message: The mobile station shall send a 31

System Tag Configuration Response Message within 750 ms after receiving the 32

message. 33


the mobile station shall set RESULT_CODE in the System Tag Configuration 35

Response Message to ‘00001010’, “Rejected - Mobile station locked”. The mobile 36

station shall include the requested parameter block with the BLOCK_LEN field 37

set to zero. 38


3GPP2 C.S0016-D v2.0

3-33



parameter block to ‘00000111’, “Rejected - BLOCK_ID value not supported.” 3

The mobile station shall include the parameter block with the BLOCK_LEN 4

field set to zero. 5

- If the REQUEST_OFFSETr received in the message specifies an offset which 6

is invalid for the current system tag list, the mobile station shall set the 7

RESULT_CODE in the corresponding returned parameter block to 8

‘00000010’, “Rejected - Data size mismatch.” 9

The mobile station shall set the BLOCK_ID to the corresponding parameter 10

block identifier, the SEGMENT_OFFSET in the returned Parameter Block to 11

the value of the REQUEST_OFFSETr, the SEGMENT_SIZE to ‘00000000’, 12

and shall include no octets of the system tag list in the returned Parameter 13

Block. 14

- Otherwise, if the REQUEST_OFFSETr received in the message is valid for the 15

current system tag list, the mobile station shall set the RESULT_CODE in 16

the System Tag Configuration Response Message to ‘00000000’, “Accepted - 17

Operation successful” for the Parameter Block included in the message. 18

The mobile station shall include the system tag data starting at the offset 19

corresponding to the REQUEST_OFFSETr and not exceeding a maximum 20

number of octets corresponding to the REQUEST_MAX_SIZEr received in the 21

message. 22

The mobile station shall set the SEGMENT_OFFSET in the returned 23

Parameter Block to the value of the REQUEST_OFFSETr received in the 24

message. 25

The mobile station shall set the SEGMENT_SIZE field to the number of 26

octets of the system tag list included in the returned Parameter Block. If 27

the Parameter Block contains the last segment of the system tag list data, 28

the mobile station shall set the LAST_SEGMENT field to ‘1’; otherwise the 29

mobile station shall set the LAST_SEGMENT field to ‘0’ in the returned 30

Parameter Block. 31

3.3.1.20 System Tag Download Request Message Processing 32

20. System Tag Download Request Message: The mobile station shall respond to 33

the message with a System Tag Download Response Message within 750 ms. 34

• If the System Tag Download Request Message contains a System Tag Parameter 35

Block with a BLOCK_ID that is not supported by the mobile station, the mobile 36

station shall set the RESULT_CODE in the System Tag Download Response 37

Message to ‘00000111’, “Rejected - BLOCK_ID value not supported” and shall 38

set the BLOCK_ID to the received parameter block identifier. The mobile station 39

shall omit the SEGMENT_OFFSET and the SEGMENT_SIZE fields in the System 40

Tag Download Response Message. 41

3GPP2 C.S0016-D v2.0

3-34

• If the System Tag Download Request Message contains a System Tag Parameter 1

Block having a size different from that supported by the mobile station, the 2

mobile station shall set the RESULT_CODE in the System Tag Download 3

Response Message to ‘00000010’, “Rejected - Data size mismatch” and shall set 4

the BLOCK_ID to the received parameter block identifier. 5

If the System Tag Download Request Message does not contain a System tag 6

Parameter Block having a BLOCK_ID of ‘00000001’, ‘00000010’, or ‘00000011’, 7

the mobile station shall omit the SEGMENT_OFFSET and SEGMENT_SIZE 8

fields. 9

• Otherwise, the mobile station shall perform the following: 10

- If the System Tag Download Request Message contains a System tag 11

Parameter Block having a BLOCK_ID of ‘00000001’, ‘00000010’, or 12

‘00000011’, the mobile station shall set SEGMENT_OFFSET to the value of 13



- If SYS_TAG_BLOCK_ID_CURRENTs is not NULLSYS_TAG_BLOCK_ID and the value 16

of the BLOCK_IDr field is not equal to SYS_TAG_BLOCK_ID_CURRENTs, the 17

mobile station shall perform the following: 18

+ Set the RESULT_CODE in the System Tag Download Response Message 19

to ‘00101010’, “Rejected – Unexpected System Tag BLOCK_ID change”. 20

+ In the System Tag Download Response Message, set the BLOCK_ID to the 21

received parameter block identifier and set the SEGMENT_OFFSET and 22

the SEGMENT_SIZE to ‘00000000’. 23

+ Discard all the SEGMENT_DATA octets that have been received in a 24

System Tag Download Request Message with the BLOCK_ID field set to 25

‘00000001’. 26

+ Set the SYS_TAG_BLOCK_ID_CURRENTs to NULLSYS_TAG_BLOCK_ID. 27

- Otherwise, the mobile station shall perform the following: 28

+ Set the SYS_TAG_BLOCK_ID_CURRENTs to the value of the BLOCK_ID 29

field received in the System Tag Download Request Message. 30

+ If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are 31

inconsistent with the system tag list storage capabilities of the mobile 32

station, the mobile station shall set the RESULT_CODE to ‘00101011’, 33

“Rejected – System Tag format mismatch” and shall set the BLOCK_ID to 34

the received parameter block identifier. 35

+ Otherwise, if SEGMENT_OFFSET andin conjunction with 36

SEGMENT_SIZE are consistent with the system tag list storage 37

capabilities of the mobile station, the mobile station shall store the 38

SEGMENT_DATA octets in temporary memory. 39

3GPP2 C.S0016-D v2.0

3-35




o If LAST_SEGMENT is equal to ‘1’ or if BLOCK_ID is equal to 4

‘00000000’ (Home System Tag), the mobile station shall calculate the 5

CRC, as specified in Section 3.5.11.13.5.10.1 for the system tag list 6

stored in temporary memory. If the calculated CRC and received 7

CRC are equalCRC checks, the mobile station shall set the 8

RESULT_CODE to ‘00000000’, “Accepted - Operation successful;” 9

otherwise, the mobile station shall set the RESULT_CODE to 10

‘00001001’, “Rejected - CRC error” and shall discard this segment 11

and all previously assembled segments of the system tag list from the 12

temporary memory. The mobile station shall set the BLOCK_ID to 13

the received parameter block identifier. 14

3.3.1.21 Service Key Generation Request Message Processing 15

21. Service Key Generation Request Message: 16

• The mobile station shall compute the value of the service root key, for each 17

service root key requested, in accordance with 3.3.10. 18

• If the mobile station has not successfully calculated the service key(s) in 19

accordance with 3.3.10, the mobile station shall set RESULT_CODE to 20

‘00000001’, “Rejected - Unknown reason.” The mobile station shall then send a 21

Service Key Generation Response Message within 750 ms after receiving this 22

message. 23

• If the mobile station has successfully calculated the services root key(s) in 24

accordance with 3.3.109, the mobile station shall set RESULT_CODE to 25

‘00000000’, “Accepted - Operation successful.” The mobile station shall then 26

send a Service Key Generation Response Message within 750 ms after receiving 27

this message. 28

3.3.1.22 MMS Configuration Request Message Processing 29

22. MMS Configuration Request Message: The mobile station shall send a MMS 30


If either SP_LOCK_STATE = ,’1’ or NAM_LOCK_STATE = ‘1’, or both are set to ‘1’, 32






3GPP2 C.S0016-D v2.0

3-36















in the MMS Configuration Response Message. All the encrypted Parameter 15

Blocks and FRESH field shall fit into the MMS Configuration Response 16

Message. 17




complete data blocks, in the order requested, in the MMS Configuration 21

Response Message. If SECURE_MODE_INDS = ‘1’, the mobile station shall 22




in the MMS Configuration Response Message. 26

3.3.1.23 MMS Download Request Message Processing 27

23. MMS Download Request Message : The mobile station shall respond to 28

the message with a MMS Download Response Message within 750 ms. 29



each PARAM_DATA field of all Parameter Blocks received in the MMS Download 32

Request Message. 33

• If the MMS Download Request Message contains an MMS URI Parameter Block 34

with a BLOCK_ID that is not supported by the mobile station, the mobile station 35


RESULT_CODE to ‘00000111’, “Rejected - BLOCK_ID value not supported” 37




RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch” 41

3GPP2 C.S0016-D v2.0

3-37


with a parameter value that is out-of-range, the mobile station shall set 2


‘00000100’, “Rejected - Invalid parameter” 4

• If the MMS Download Request Message contains a MMS URI Parameter Block 5

with a NUM_MMS_URI greater than that supported by the mobile station, the 6

mobile station shall set BLOCK_ID to the received parameter block identifier and 7

RESULT_CODE to ‘00101100’, “Rejected – NUM_MMS_URI mismatch” 8


with any MMS_URI _LENGTH larger than that supported by the mobile station, 10


and RESULT_CODE to ‘00101101’, “Rejected – MMS_URI _LENGTH mismatch;” 12


with an invalid MMS_URI, the mobile station shall set BLOCK_ID to the received 14

parameter block identifier and RESULT_CODE to ‘00101110’, “Rejected – Invalid 15

MMS_URI” 16

• If the MMS Download Request Message is not accepted for any other reason, the 17

mobile station shall set BLOCK_ID to the received parameter block identifier and 18

RESULT_CODE to ‘00000001’, “Rejected – Unknown reason;” 19



RESULT_CODE to ‘00000000’, “Accepted – Operation successful.” If more than 22

one MMS Download Request Message or parameter block is received containing 23

values for the same indicators, the mobile station shall retain only the most 24

recently received values. 25

3.3.1.24 MMSS Configuration Request Message Processing 26

MMSS Configuration Request Message: The mobile station shall send an MMSS 27













3GPP2 C.S0016-D v2.0

3-38




Block included in the message. The mobile station shall include data blocks, 4

in the order requested, up to the maximum number of blocks that fit into 5

the message. If SECURE_MODE_INDS = ‘1’, the mobile station shall set the 6

FRESH_INCL field to ‘1’, include the FRESH field and set it to a 15-bit value 7


3.3.8 each PARAM_DATA field of all Parameter Blocks included in the MMSS 9

Configuration Response Message. All the encrypted Parameter Blocks and 10

FRESH field shall fit into the MMSS Configuration Response Message. 11



corresponding confirmation block. The mobile station shall include complete 14

data blocks, in the order requested, in the MMSS Configuration Response 15

Message. . If SECURE_MODE_INDS = ‘1’, the mobile station shall set the 16

FRESH_INCL field to ‘1’, and include the FRESH field and set it to a 15-bit 17



in the MMSS Configuration Response Message. 20

3.3.1.25 MMSS Download Request Message Processing 21

MMSS Download Request Message: The mobile station shall send an MMSS 22

Download Response Message within 750 ms after receiving the message. 23



each PARAM_DATA field of all Parameter Blocks received in the MMSS Download 26

Request Message. 27

• If the MMSS Download Request Message contains an MMSS Parameter Block 28

with a BLOCK_ID that is not supported by the mobile station, the mobile station 29






RESULT_CODE to ‘00000010’, “Rejected - Data size mismatch;” 35


with a parameter value that is out-of-range, the mobile station shall set 37


00000100’, “Rejected - Invalid parameter;” 39


with any NUM_MLPL_RECS larger than that supported by the mobile station, 41


3GPP2 C.S0016-D v2.0

3-39

and RESULT_CODE to ‘00101111’, “Rejected – MMSS NUM_MLPL_REC 1

mismatch;” 2


with any NUM_MSPL_RECS larger than that supported by the mobile station, 4


and RESULT_CODE to ‘00110000’, “Rejected – MMSS NUM_MSPL_RECS 6

mismatch;" 7


with a NUM_WLAN_AIR_INT greater than that supported by the mobile station, 9


and RESULT_CODE to ‘00110001’, “Rejected – MMSS NUM_WLAN_AIR_INT 11

mismatch;” 12

• If the MMSS Download Request Message is not accepted for any other reason, 13


RESULT_CODE to ‘00000001’, “Rejected – Unknown reason;” 15



RESULT_CODE to ‘00000000’, “Accepted – Operation successful.” 18

If the BLOCK_ID field in the MMSS Download Request Message is equal to 19

‘00000001’ or ‘00000010’ (MMSS Location Associated Priority List Parameter 20

Block or MMSS System Priority List Parameter Block, respectively), the mobile 21


- The mobile station shall set SEGMENT_OFFSET to the value of 23



- If SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE are 26

inconsistent with the MLP_LISTs-p (or MSP_LISTs-p) storage capabilities of 27

the mobile station, the mobile station shall set the RESULT_CODE to 28

‘00110100’, “Rejected - MLPL length mismatch” (or to ‘00110101’, “Rejected 29

- MSPL length mismatch”) and shall set the BLOCK_ID to the received 30


- Otherwise, if SEGMENT_OFFSET andin conjunction with SEGMENT_SIZE 32

are consistent with the MLP_LISTs-p and MSP_LISTs-p storage capabilities 33

of the mobile station, the mobile station shall store the SEGMENT_DATA 34

octets in temporary memory. 35




3GPP2 C.S0016-D v2.0

3-40

o If LAST_SEGMENT is equal to ‘1’, the mobile station shall calculate 1

the CRC, as specified in Section 3.5.14.1 for the MMSS Location 2

Associated Priority List if the BLOCK_ID = ‘00000001’ (or MMSS 3

System Priority List if the BLOCK_ID = ‘00000010’) stored in 4

temporary memory. If the CRC checks, the mobile station shall set 5

the RESULT_CODE to ‘00000000’, “Accepted - Operation successful;” 6

otherwise, the mobile station shall set the RESULT_CODE to 7

‘00001001’, “Rejected - CRC error” and shall discard this segment 8

and all previously assembled segments of the MMSS Location 9

Asociated Priority List if the BLOCK_ID = ‘00000001’ (or MMSS 10

System Priority List if the BLOCK_ID = ‘00000010’) from temporary 11

memory. The mobile station shall set the BLOCK_ID to the received 12


14

If more 15

than one MMSS Download Request Message or parameter block is received 16

containing values for the same indicators, the mobile station shall retain 17

only the most recently received values. 18

If the mobile station receives an OTASP Data Message that it does not recognize or which 19

requires a capability that is not supported, the mobile station shall discard the message 20

and shall send a Mobile Station Reject Order with ORDQ set to ‘00000110’ within T56m 21

seconds (see [7]). 22

23

3.3.2 Mobile Station SSD Update and Re-authentication 24

Re-authentication is the process by which the mobile station is instructed to perform 25

authentication and generate the Private Long Code Mask (CDMA only) and Message 26

Encryption parameters while on the CDMA Traffic channel or analog voice channel. The 27

authentication key, A-key, may be generated by the mobile station during the programming 28

session. Shared Secret Data, SSD, is generated prior to performing re-authentication. 29

If the mobile station has not generated an A-key during the present programming session 30

via the Key Generation Request Message, the mobile station shall follow the procedures 31

specified in 6.3.12 of [1] or 2.3.12 of [1] when performing an SSD update. 32

If the mobile station has correctly generated an A-key during the present programming 33

session, the mobile station shall follow the procedures specified in 6.3.12 of [1] or 2.3.12 of 34

[1] when performing an SSD update with the following exceptions: 35

• The mobile station shall use A_KEY_TEMPs as the A-key input. 36

• The mobile station shall store the SSD_A_NEW and SSD_B_NEW outputs in 37

SSD_As and SSD_Bs, respectively, rather than in SSD_As-p and SSD_Bs-p. 38

3GPP2 C.S0016-D v2.0

3-41

Once SSD has been generated from A_KEY_TEMPs, the mobile station shall use SSDs 1

instead of SSDs-p until SSDs is stored into SSDs-p after receiving a Commit Request 2

Message. 3

The authentication algorithms are described in [2]. The interface for the algorithms is 4

described in [2]. Re-authentication should be performed as follows: 5

In the mobile station, 6

• Set the input parameters of the Auth_Signature procedure (see [2]) as follows 7

- If the programming session was initiated by the network as described in 8

3.2.2, the input parameters shall be set as defined in 6.3.12.1.7 of 9

[1]TIA/EIA-95B. 10


the input parameters shall be set as defined in 6.3.12.1.6 of [1]TIA/EIA-95B. 12

• Execute the Auth_Signature procedure; 13

• Set AUTHRs equal to the 18-bit output AUTH_SIGNATURE; 14

• Send AUTHRs, RANDC (eight most significant bits of RANDs), AUTH_DATAs and 15

COUNTs-p to the base station in the Re-Authenticate Response Message. 16

At the base station, 17

• Compare the received values for RANDC, and optionally COUNT, with the 18

internally stored values associated with the mobile station being activated; 19

• Compute AUTHR as described above, except use the internally stored value of 20

SSD_A; 21

• Compare the value for AUTHR computed internally with the value of AUTHR 22

received from the mobile station. 23

If the comparisons executed at the base station are successful, the base station may 24

activate Message Encryption (see 3.3.3) and may also activate Voice Privacy (see 3.3.4). 25

The base station may issue a Parameter Update Order to the mobile station on the Forward 26

Voice Channel or on the Forward Traffic Channel, updating the value of COUNTs-p in the 27

mobile station. 28

If any of the comparisons fail, the base station may deny activation, initiate the Unique 29

Challenge-Response Procedure (see 6.3.12.1.5 of [1] or 2.3.12.1.4 of [1]) or commence the 30

process of updating SSD (see 6.3.12.1.5 of [1] or 2.3.12.1.9 of [1]). 31

3.3.3 Activation of Message Encryption 32

To enhance the security of the programming session and to protect sensitive subscriber 33

information, a method is provided to encrypt certain fields of selected OTASP Traffic 34

Channel and Forward and Reverse Voice Channel messages (see [1) for details]. 35

Message encryption is controlled on a per-call basis. 36

If message encryption was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 2.3.12.2 of [1]) or 37

transition to the Private Long Code Mask was made (see 6.3.12.3 of [1] or 2.3.12.3 of [1]) 38

3GPP2 C.S0016-D v2.0

3-42

before the re-authentication operation, the message encryption parameters active at that 1

time shall remain unchanged for the duration of the call. 2

Otherwise, the message encryption parameters are re-calculated during the re-3

authentication operation. In this case, the data used to initialize the algorithm for 4

calculating the message encryption parameters is computed based on parameters in effect 5

at the time the AUTHR included in Re-Authenticate Response Message was computed. 6

3.3.4 Activation of Voice Privacy 7


information, voice privacy is provided in the CDMA system (see 6.3.12.3 of [1] or 2.3.12.3 of 9

[1]) by means of the Private Long Code Mask used for PN spreading. 10

The generation of the Private Long Code Mask is specified in [1, 1]. 11

If transition to the Private Long Code Mask was made (see 6.3.12.3 of [1] or 2.3.12.3 of [1]), 12

or if signaling message encryption was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 13

2.3.12.2 of [1]) before the re-authentication operation, the Private Long Code Mask active at 14

that time shall remain unchanged for the duration of the call. 15

Otherwise, the Private Long Code Mask shall be recalculated during the re-authentication 16

operation. In this case, the data used to initialize the algorithm for calculating the Private 17

Long Code Mask is computed based on parameters in effect at the time the AUTHR 18

included in the Re-Authenticate Response Message was computed. 19

3.3.5 System Selection for Preferred Roaming 20

The goal of System Selection for Preferred Roaming (SSPR) is for the mobile station to 21

acquire the most preferred system using the information from the preferred roaming list 22

(PR_LISTs-p) stored in the mobile station (see 3.5.5). Annex C contains information on the 23

recommended use of the preferred roaming list. 24

3.3.6 Service Programming Lock 25

Access to the mobile station programming module containing NAM indicators and 26

parameters (see 4.5.2, 4.5.3 and 4.5.4) that can be assigned values using Over-the-Air 27

Service Provisioning is protected by the service programming lock. The service 28

programming lock parameter contains the Service Programming Code (SPC) used for 29

unlocking the mobile station parameters for programming or reprogramming. 30

The service programming lock based on a single SPC protects parameters of all NAMs in 31

the mobile station. 32

The SPC has values defined in the Table 3.3.6-1. 33

3GPP2 C.S0016-D v2.0

3-43

Table 3.3.6-1 Service Programming Code Values 1

Service Programming Code Type SPC Value

Default 0

Active 1 through 999,999

The mobile station should provide the user a means to program the mobile station to 2

accept or deny the SPC change from the default value to a non-default value. The mobile 3

station should be programmed by default to deny the SPC change from the default value to 4

a non-default value. 5

When SPC is set to the default value, all programmable modules in the mobile station are 6

unlocked, unless protected by SPASM (see 3.3.7). When programmable modules are 7

unlocked, access and programming of all NAM indicators and parameters are allowed. 8

When SPC is set to any value other than the default value, the programming module in the 9

mobile station is locked, and access to NAM indicators and parameters can be allowed only 10

if correct value of the SPC is received from the base station within the current OTASP 11

session. 12

3.3.7 Subscriber Parameter Administration Security Mechanism 13

In order to validate SPASM, the mobile station shall set the input parameters of the 14

Auth_Signature procedure (see [2]) as follows: 15

The mobile station shall set the RAND_CHALLENGE input parameter to the 32-bit random 16

value that is sent to the base station in the RAND_OTAPA field of the OTAPA Response 17

Message, the AUTH_DATA input parameter as defined in 6.3.12.1.7 of [1]TIA/EIA-95B, the 18

SSD_AUTH input parameter to the exclusive OR of SSD_As-p and A-keyA_KEY, the ESN 19

input parameter to the mobile station ESN and the SAVE_REGISTERS input parameter to 20

FALSE. If the mobile station only supports MEID, then Pseudo-ESN shall be used as the 21

ESN. 22

The mobile station shall execute the Auth_Signature procedure. The AUTH_OTAPAs is set 23

to the computed 18-bit result AUTH_SIGNATURE. 24

Upon receiving the RAND_OTAPA from the mobile station in the OTAPA Response Message, 25

the base station shall compute AUTH_OTAPA as described above with the exception of 26

using the SSD_AUTH input parameter set to the exclusive OR of the internally stored value 27

of SSD_A and A-keyA_KEY. 28

The AUTH_OTAPA is set to the computed 18-bit result AUTH_SIGNATURE and is sent to 29

the mobile station in the Validate SPASM Parameter Block of the Validation Request 30

Message. 31

The mobile station validates SPASM by comparing the AUTH_OTAPAr received in the 32

message to its locally computed value of the AUTH_OTAPAs. 33

3GPP2 C.S0016-D v2.0

3-44

3.3.8 Secure Mode 1

To enhance security of the programming session and to protect sensitive subscriber 2

information, a method is provided to encrypt PARAM_DATA fields of Parameter Blocks in 3

OTASP messages irrespective of the air interface message encryption described in 3.3.3. 4

This method allows setting up a secure “tunnel” between the mobile station and the 5

network based Over-The-Air Service Provisioning entity. 6

If the mobile station supports Secure Mode, it shall indicate it to the base station in the 7

Protocol Capability Response Message by setting appropriate feature-related fields. 8

When the mobile station is unlocked, i.e. when both SP LOCK_STATES and 9

NAM_LOCK_STATES are equal to ‘0’, the base station can initiate the Secure Mode by 10

sending the Secure Mode Request Message to the mobile station with the START_STOP field 11

set to ‘1’. 12

The mobile station shall use the RAND_SMr received in the message and the SSDs-p to 13

compute the Secure Mode Ciphering Key SMCKs as specified in 3.3.8.1. 14

The mobile station shall use the SMCKs as a key for encryption and decryption, as specified 15

in 3.3.8.2, of all PARAM-DATA of all Parameter Blocks sent and received by the mobile 16

station in the OTASP Data Messages while the Secure mode is active. 17

When encrypting the message, the mobile station shall select a value of FRESH associated 18

with this message and unique for the duration of Secure Mode session. The value of FRESH 19

can be selected at random, or can be set to a monotonically increasing counter. 20

When decrypting the message, the mobile station shall use the value of FRESHr received in 21

the message. 22

The base station can terminate the Secure Mode by sending the Secure Mode Request 23

Message to the mobile station with the START_STOP field set to ‘0’. When Secure Mode 24

session is terminated, the mobile station shall reset the SMCKs to NULL. 25

3.3.8.1 Generation of Secure Mode Ciphering Key 26

The Secure Mode Ciphering Key Generation SMCKs is generated by the algorithmic function 27

specified in Section 2.2.2.6 of [8]. 28

If KEY_IN_USE = ‘0000’, the input parameters to the algorithmic function f3 shall be set as 29

follows: 30

• The K parameter shall be set to SSD-As-p|SSD-Bs-p. 31

• The fi parameter shall be set to 0x45. 32

• The RAND parameter shall be set to RAND_SMr|RAND_SMr. 33

• The Fmk parameter shall be set to 0x41484147. 34


follows: 36

• The K parameter shall be set to the 128-bit Root Key K. 37


3GPP2 C.S0016-D v2.0

3-45

• The RAND parameter shall be set to RAND_SMr|RAND_SMr. 1


The mobile station shall execute the Ciphering Key Generation Procedure as specified in 3

2.2.2.6 of [8]. The mobile station shall set SMCKs to the computed 128-bit output of f3. 4

The mobile station shall set input parameter to the ESP_privacykey Procedure as follows: 5

• The key parameter shall be set to SMCKs. 6

The mobile station shall execute the ESP_privacykey Procedure. 7

3.3.8.2 Encryption and Decryption of messages in Secure Mode 8

Encryption and decryption of PARAM_DATA information is performed by the Enhanced 9

Privacy Algorithm specified in 2.3.2.2 of [8]. 10

The mobile station shall set input parameters to the Enhanced Privacy Algorithm as 11

follows: 12

13

• If the mobile station presents the data for encryption, the mobile station shall set 14

the fresh parameter to FRESH|’ 0’|BLOCK_ID; otherwise, if the mobile station 15

presents the data for decryption, the mobile station shall set the fresh parameter to 16

FRESHr|’ 1’|BLOCK_ID; 17

• The freshsize parameter shall be set to 3; 18

• The buf parameter shall be set to address of the octet containing the first bit of the 19

buffer that contains the data to be encrypted or decrypted. 20

• The bit_offset parameter shall be set to the offset between the bit position of the 21

most significant bit of the data to be encrypted/decrypted and the bit position of the 22

most significant bit of the buffer (e.g., if the bit position of the most significant bit of 23

the data to be encrypted/decrypted and the bit position of the most significant bit of 24

the buffer are equal, bit_offset shall be set to 0). 25

• The bit_count parameter shall be set to the number of bits of the data to be 26

encrypted/decrypted. 27

The mobile station shall execute the ESP_maskbits Procedure. 28

3.3.9 System Tag Indicator 29

The goal of the System Tag capability is to increase the functionality of the Roaming 30

Indicators (ROAM_IND) listed within the Preferred Roaming List. This capability allows the 31

downloading and synchronization of a file of operator-customizable roaming indicators, 32

tailored to the specific capabilities of the mobile station, representing the operator-specific 33

roaming indicators. 34

Once configured with a compatible System Tag file associated with the Preferred Roaming 35

List stored within the mobile station, the mobile station shall determine the roaming 36

indicator (ROAM_IND) listed within the System Record or Extended System Record entry 37

3GPP2 C.S0016-D v2.0

3-46

(see 3.5.5.3.1 and 3.5.5.3.2, respectively) corresponding to the SID of the system in which 1

the mobile station is operating. The mobile station shall then use this ROAM_IND to 2

determine the appropriate user interface actions (graphical and/or textual display) to take 3

as defined by the corresponding ROAM_IND entry within the System Tag file. 4

3.3.10 Generation of Service Keys 5

Generation of service keys consists of generating an intermediate key and using the 6

intermediate key to generate service keys. 7

3.3.10.1 Generation of Intermediate Key 8

The Intermediate value ITM_RAND is generated by the algorithmic function specified in 9

Section 2.2.2.2 of [8]. 10

The input parameters to the algorithmic function f0 shall be set as follows: 11

• The K parameter shall be set to RKP. 12


• The Fmk parameter shall be set to 0x534B474B. 14

The mobile station shall execute f0 twice. ITM_RAND is set to the 128-bit output of f0. 15

3.3.10.2 Generation of Service Keys 16

For each bit in the bitmap as illustrated in Table 4.5.1.22-1 that is turned on, the base 17

station shall generate the service key by invoking the key generation function as specified 18

in Section 2.2.2.6 of [8]. 19


• The K parameter shall be set to ITM_RAND. 21


• The RAND parameter shall be set according to table 4.3.6.2-1, with remaining least 23

significant bits padded with ‘0’, for each service requested. 24


The mobile station shall execute f3 to produce 128-bit service root key. 26

3GPP2 C.S0016-D v2.0

3-47

Table 3.3.10.2-1 Key Identifier Table 1

Service Key Requested RAND Value

IMS ROOT KEY 0x494D53

BCMCS ROOT KEY 0x42434D4353

WLAN ROOT KEY 0x574C414E

3.4 Termination of the Programming Procedure 2

If the mobile station does not support concurrent services, if the mobile station enters any 3

substate or task other than the CDMA Conversation Substate or the analog Conversation 4

Task, the mobile station shall terminate the programming session. 5

Following a CDMA-to-analog handoff, the mobile station may terminate the programming 6

session; however, the mobile station shall not autonomously release the call. 7

If the mobile station receives more than five Validation Request Messages during the same 8

programming session with the SPCr value not equal to the SPCp, the mobile station should 9

terminate the programming session and should not begin another session until after the 10

mobile station power is cycled. 11

If more than five validations of SPASM (see 3.3.7) result in a mismatch during the same 12

programming session, the mobile station should terminate the programming session and 13

should not begin another session until after the mobile station power is cycled. 14

The mobile station shall provide a means for the user to end the programming session. If 15

the user directs the mobile station to end the programming process, the mobile station 16

shall release the call and shall terminate the programming session. 17

If the programming session was initiated by the network as described in 3.2.2, and if the 18

mobile station is directed by the user to initiate a call during the OTAPA session, the 19

mobile station may initiate the call by sending an Enhanced Origination Message if both 20

mobile station and the base station supports concurrent service; otherwise, the mobile 21

station shall terminate the OTAPA session and release the OTAPA call prior to proceeding 22

with the origination procedure. 23

If the mobile station receives the OTAPA Request Message with the START_STOPr equal to 24

‘0’, it shall terminate the OTAPA session. 25

If the programming session is terminated, the mobile station shall discard all the NAM 26

indicator values that are not stored in permanent memory. 27

28

3GPP2 C.S0016-D v2.0

3-48

3.5 Reverse Link Message Formats 1

The reverse link OTASP Data Messages are summarized in Table 3.5-1. 2

Table 3.5-1 Reverse Link Messages 3

Message Name OTASP_MSG_TYPE Reference

Configuration Response Message ‘00000000’ 3.5.1.1

Download Response Message ‘00000001’ 3.5.1.2

MS Key Response Message ‘00000010’ 3.5.1.3

Key Generation Response Message

‘00000011’ 3.5.1.4

Re-Authenticate Response Message

‘00000100’ 3.5.1.5

Commit Response Message ‘00000101’ 3.5.1.6

Protocol Capability Response Message

‘00000110’ 3.5.1.7

SSPR Configuration Response Message

‘00000111’ 3.5.1.8

SSPR Download Response Message

‘00001000’ 3.5.1.9

Validation Response Message ‘00001001’ 3.5.1.10

OTAPA Response Message ‘00001010’ 3.5.1.11

PUZL Configuration Response Message

‘00001011’ 3.5.1.12

PUZL Download Response Message

‘00001100’ 3.5.1.13

3GPD Configuration Response Message

'00001101' 3.5.1.14

3GPD Download Response Message

'00001110' 3.5.1.15

Secure Mode Response Message ‘00001111’ 3.5.1.16

Extended Protocol Capability Response Message

‘00010000’ 3.5.1.17

MMD Configuration Response Message

‘00010001’ 3.5.1.18

MMD Download Response Message

‘00010010’ 3.5.1.19

System Tag Configuration Response Message

‘00010011’ 3.5.1.20

3GPP2 C.S0016-D v2.0

3-49


System Tag Download Response Message

‘00010100’ 3.5.1.21

Service Key Generation Response Message

‘00010101’ 3.5.1.22

MMS Configuration Response Message

‘00010110’ 3.5.1.23

MMS Download Response Message

‘00010111’ 3.5.1.24

MMSS Configuration Response Message

‘00011000’ 3.5.1.25

MMSS Download Response Message

‘00011001’ 3.5.1.26

Reserved for future standardization

‘00011010’ through ’01111111’

Reserved for manufacturer-specific OTASP Data Message definition

‘10000000’ See [4]


‘10000001’ through ’10111111’

Available for manufacturer-specific OTASP Data Message definition

‘11000000’ through ‘11111110’

See [4]

Reserved ‘11111111’

1

3GPP2 C.S0016-D v2.0

3-50

3.5.1 Message Contents 1

3.5.1.1 Configuration Response Message 2

The Configuration Response Message has the following variable-length format: 3

Field Length (bits)

OTASP_MSG_TYPE (‘00000000’) 8

NUM_BLOCKS 8

NUM_BLOCKS occurrences of the following parameter block:

BLOCK_ID 8

BLOCK_LEN 8

PARAM_DATA 8 BLOCK_LEN

NUM_BLOCKS occurrences of the following field

RESULT_CODE 8

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4

OTASP_MSG_TYPE - OTASP Data Message type. 5

The mobile station shall set this field to ‘00000000’. 6

NUM_BLOCKS - Number of parameter blocks. 7

The mobile station shall set this field to the number of 8

parameter blocks contained in the Configuration Response 9

Message. 10

BLOCK_ID - Parameter block identifier. 11

The mobile station shall set this field to the value of the 12

BLOCK_ID field of the corresponding parameter block in the 13

Configuration Request Message that is being confirmed (see 14

Table 3.5.2-1). 15

BLOCK_LEN - Parameter block length. 16

The mobile station shall set this field to the number of octets 17

in the parameter block, not including the BLOCK_ID and 18

BLOCK_LEN fields. 19

PARAM_DATA - Parameter data fields. 20

The mobile station shall include the parameter block (see 21

3.5.2) specified by the BLOCK_ID field. If 22

SECURE_MODE_INDS = ‘1’, PARAM_DATA fields shall be 23

encrypted as specified in 3.3.8. 24

3GPP2 C.S0016-D v2.0

3-51

RESULT_CODE - Configuration result code. 1

The mobile station shall include one instance of this field for 2

each parameter block included in the message, in the same 3

order of appearance. The mobile station shall set this field to 4

indicate acceptance or rejection status of the request for the 5

corresponding parameter block in the Configuration Request 6

Message, using the values defined in Table 3.5.1.2-1. 7

FRESH_INCL - FRESH included indicator. 8

If SECURE_MODE_INDS = ‘1’, the mobile station shall set this 9

field to ’1’; otherwise the mobile station shall set this field to 10

‘0’. 11

FRESH - Cryptographic Synchronizer (crypto-sync) selected for 12

encrypting PARAM_DATA fields of the message. 13

If FRESH_INCL = ‘1’, the mobile station shall include this field 14

and set it to a 15-bit value chosen according to requirements 15

defined in Section 3.3.8 for encrypting the PARAM_DATA 16

fields of all Parameter Data blocks included in the message; 17

otherwise the mobile station shall omit this field. 18

RESERVED - Reserved bits. 19

If FRESH_INCL = ‘1’, the mobile station shall omit this field; 20

otherwise, the mobile station shall set all the bits of this field 21

to ‘0’. 22

3.5.1.2 Download Response Message 23

The Download Response Message has the following variable-length format: 24

Field Length (bits)


NUM_BLOCKS 8

NUM_BLOCKS occurrences of the following confirmation block:

BLOCK_ID 8

RESULT_CODE 8





parameter blocks contained in the Download Request Message 29

that is being confirmed. 30


3GPP2 C.S0016-D v2.0

3-52



Download Request Message that is being confirmed (see Table 3

4.5.2-1). 4

RESULT_CODE - Download result code. 5

The mobile station shall set this field to indicate acceptance 6

or rejection status of the corresponding parameter block in 7

the Download Request Message that is being confirmed, using 8

the values defined in Table 3.5.1.2-1. 9

3GPP2 C.S0016-D v2.0

3-53

Table 3.5.1.2-1 Result Codes 1

RESULT_CODE Message Parameter Description

‘00000000’ Accepted - Operation successful

‘00000001’ Rejected - Unknown reason

‘00000010’ Rejected - Data size mismatch

‘00000011’ Rejected - Protocol version mismatch

‘00000100’ Rejected - Invalid parameter

‘00000101’ Rejected - SID/NID length mismatch

‘00000110’ Rejected - Message not expected in this mode

‘00000111’ Rejected - BLOCK_ID value not supported

‘00001000’ Rejected - Preferred roaming list length mismatch

‘00001001’ Rejected - CRC error

‘00001010’ Rejected - Mobile station locked

‘00001011’ Rejected - Invalid SPC

‘00001100’ Rejected - SPC change denied by the user

‘00001101’ Rejected - Invalid SPASM

‘00001110’ Rejected - BLOCK_ID not expected in this mode

‘00001111’ Rejected – User Zone already in PUZL

‘00010000’ Rejected – User Zone not in PUZL

‘00010001’ Rejected – No entries in PUZL

'00010010' Rejected - Operation Mode mismatch

'00010011' Rejected - SimpleIPSimple IP MAX_NUM_NAI mismatch

'00010100' Rejected - SimpleIPSimple IP MAX_NAI_LENGTH mismatch

'00010101' Rejected - MobileIPMobile IP MAX_NUM_NAI mismatch

'00010110' Rejected - MobileIPMobile IP MAX_NAI_LENGTH mismatch

'00010111' Rejected - SimpleIPSimple IP PAP MAX_SS_LENGTH mismatch

'00011000' Rejected - SmpleIP CHAP MAX_SS_LENGTH mismatch

'00011001' Rejected - MobileIPMobile IP MAX_MN-AAA_SS_LENGTH mismatch

3GPP2 C.S0016-D v2.0

3-54


'00011010' Rejected - MobileIPMobile IP MAX_MN-HA_SS_LENGTH mismatch

'00011011' Rejected - MobileIPMobile IP MN-AAA_AUTH_ALGORITHM mismatch

'00011100' Rejected - MobileIPMobile IP MN-HA_AUTH_ALGORITHM mismatch

'00011101' Rejected - SimpleIPSimple IP ACT_NAI_ENTRY_INDEX mismatch

'00011110' Rejected - MobileIPMobile IP ACT_NAI_ENTRY_INDEX mismatch

'00011111' Rejected - SimpleIPSimple IP PAP NAI_ENTRY_INDEX mismatch

'00100000' Rejected - SimpleIPSimple IP CHAP NAI_ENTRY_INDEX mismatch

'00100001' Rejected - MobileIPMobile IP NAI_ENTRY_INDEX mismatch

'00100010' Rejected – Unexpected PRL_BLOCK_ID change

'00100011' Rejected – PRL format mismatch

'00100100' Rejected – HRPD Access Authentication MAX_NAI_LENGTH mismatch

'00100101' Rejected – HRPD Access Authentication CHAP MAX_SS_LENGTH mismatch

‘00100110’ Rejected – MMD MAX_NUM_IMPU mismatch

‘00100111’ Rejected – MMD MAX_IMPU_LENGTH mismatch

‘00101000’ Rejected – MMD MAX_NUM_P-CSCF mismatch

‘00101001’ Rejected – MMD MAX_P-CSCF_LENGTH mismatch

‘00101010’ Rejected – Unexpected System Tag BLOCK_ID Change

‘00101011’ Rejected – System Tag Format mismatch

‘00101100’ Rejected – NUM_MMS_URI mismatch

‘00101101’ Rejected – MMS_URI _LENGTH mismatch

‘00101110’ Rejected – Invalid MMS_URI

‘00101111’ Rejected – MMSS MODE SETTINGS format mismatch

‘00110000’ Rejected – MLPL format mismatch

3GPP2 C.S0016-D v2.0

3-55


‘00110001’ Rejected – MSPL format mismatch

‘00110010’ Rejected – MMSS WLAN DOWNLOAD PARAM format mismatch

‘00110011’ Rejected – Secure Mode not active

‘00110100’ Rejected – MLPL length mismatch

‘00110101’ Rejected – MSPL length mismatch

'00110110100011' - ‘01111111’


‘10000000’ - ‘11111110’

Available for manufacturer-specific Result Code definitions. See [4].

‘11111111’ Reserved

1

3.5.1.3 MS Key Response Message 2

The MS Key Response Message has the following fixed-length format: 3

Field Length (bits)


RESULT_CODE 8

4



RESULT_CODE - Key exchange result code. 7


or rejection status, using the values defined in Table 3.5.1.2-9

1. 10

3.5.1.4 Key Generation Response Message 11

The Key Generation Response Message has the following variable-length format: 12

Field Length (bits)


RESULT_CODE 8

MS_RESULT_LEN 8

MS_RESULT 8 MS_RESULT_LEN

13


3GPP2 C.S0016-D v2.0

3-56


RESULT_CODE - Key exchange result code. 2


or rejection status, using the values defined in Table 3.5.1.2-4

1. 5

MS_RESULT_LEN - Length of MS_RESULT field. 6


in the MS_RESULT field. 8

MS_RESULT - Mobile station calculation result. 9

If A_KEY_P_REV received in the MS Key Request Message is 10

equal to ‘00000010’, the mobile station shall set this field 11

equal to the value of MS_RESULT as described in 5.1.2. If 12

A_KEY_P_REV received in the MS Key Request Message is 13

equal to ‘00000011’ or ‘00000100’, the mobile station shall 14

set this field equal to the value of MS_RESULT as described in 15

5.3.2. If A_KEY_P_REV received in the MS Key Request 16

Message is equal to ‘00000101’, the mobile station shall set 17

this field to the value of MS_RESULT as described in 5.5.2. If 18


equal to ‘00000111’, the mobile station shall set this field to 20

the value of MS_RESULT as described in 5.7.2. If 21


equal to ‘00001000’, the mobile station shall set this field to 23

the value of MS_RESULT as described in 5.9.2. 24

25

3.5.1.5 Re-Authenticate Response Message 26

The Re-Authenticate Response Message has the following fixed-length format: 27

Field Length (bits)


AUTHR 18

RANDC 8

COUNT 6

AUTH_DATA 24

28



AUTHR - Authentication signature data. 31

The mobile station shall set this field as specified in 3.3.2. 32

RANDC - Random challenge value. 33


3GPP2 C.S0016-D v2.0

3-57

COUNT - Call history parameter. 1


AUTH_DATA - Authentication Data input parameter. 3


3.5.1.6 Commit Response Message 5

The Commit Response Message has the following fixed-length format: 6

Field Length (bits)


RESULT_CODE 8

7



RESULT_CODE - Data commit result code. 10


or rejection status of the Commit Request Message, using 12

values defined in Table 3.5.1.2-1. 13

3.5.1.7 Protocol Capability Response Message 14

The Protocol Capability Response Message has the following variable-length format: 15

Field Length (bits)


MOB_FIRM_REV 16

MOB_MODEL 8

NUM_FEATURES 8

NUM_FEATURES occurrences of the following features:

FEATURE_ID 8

FEATURE_P_REV 8

ADD_LENGTH 8

Additional fields 8 ADD_LENGTH

16



3GPP2 C.S0016-D v2.0

3-58

MOB_FIRM_REV - Mobile station firmware revision number. 1


MOB_FIRM_REVp permanent mobile station indicator (see 3

F.2.1 of [1, 1]). 4

MOB_MODEL - Mobile station manufacturer’s model number. 5


MOB_MODELp permanent mobile station indicator (see F.2.1 7

of [1, 1]). 8

NUM_FEATURES - Number of Features. 9


features supported by the mobile station using the OTASP 11

protocol with each feature represented by a pair of 12

FEATURE_ID and FEATURE_P_REV fields. 13

A data pair (FEATURE_ID/FEATURE_P_REV) shall not be 14

included if a feature is not supported. If multiple protocol 15

versions are supported, multiple data pairs shall be included, 16

each with the same FEATURE_ID and a different 17

FEATURE_P_REV. The order of the pairs shall have no 18

significance. 19

FEATURE_ID - Feature Identifier. 20

The mobile station shall set this field according to Table 21

3.5.1.7-1 to indicate the feature supported by the mobile 22

station. 23

FEATURE_P_REV - Feature protocol version. 24


3.5.1.7-1 to indicate the protocol version of the feature 26

supported by the mobile station. 27

28

3GPP2 C.S0016-D v2.0

3-59

Table 3.5.1.7-1 Feature Identifier 1

Features FEATURE_ID FEATURE_P_REV FEATURE_P_REV Description

NAM Download (DATA_P_REV)

‘00000000’ ‘00000010’ NAM Download as specified in this

document

‘00000011’ NAM Download with eHRPD IMSI provisioning

as specified in this document

Key Exchange (A_KEY_P_REV)

‘00000001’ ‘00000010’ A-keyA key provisioning as specified in this

document

‘00000011’ A-keyA key and 3G Root Key provisioning as

specified in this document

‘00000100’ 3G Root Key provisioning as specified in this

document

‘00000101’ Enhanced 3G Root Key provisioning as specified

in this document

‘00000110’ Service Key Generation as specified in this

document

‘00000111’ eHRPD Root Key = A_KEY_P_REV

= ’00000111’ provisioning as specified in this

document

‘00001000’ eHRPD Root Key = A_KEY_P_REV =

‘00001000’ provisioning as specified in this

document

3GPP2 C.S0016-D v2.0

3-60


System Selection for Preferred Roaming (SSPR_P_REV)

‘00000010’ ‘00000001’ System Selection for Preferred Roaming using Preferred Roaming List

‘00000010’ Reserved

‘00000011’ System Selection for Preferred Roaming using

Extended Preferred Roaming List associated

with SSPR_P_REV of ‘00000011’

Service Programming Lock (SPL_P_REV)

‘00000011’ ‘00000001’ Service Programming Lock as specified in this

document

Over-The-Air Service Provisioning (OTASP_P_REV)

‘00000100’ ‘00000001’ Over-The-Air Service Provisioning as specified

in this document

Preferred User Zone List (PUZL_P_REV)

‘00000101’ ‘00000010’ Preferred User Zone List as specified in this

document

3G Packet Data (3GPD) '00000110' '00000011' 3G Packet Data as specified in this

document

Secure MODE (SECURE_MODE_P_REV)

‘00000111’ ‘00000001’ Secure Mode as specified in this document when

root key K is not available

‘00000010’ Secure Mode as specified in this document when root key K is available

Multimedia Domain (MMD)

‘00001000’ ‘00000001’ MMD as specified in this document

System Tag Download

(TAG_P_REV)

‘00001001’ ‘00000001’ System Tag Download as specified in this

document

Multimedia Messaging Service (MMS)

‘00001010’ ‘00000001’ MMS as specified in this document

Multimode System Selection (MMSS_P_REV)

‘00001011’ ‘00000001’ MMSS as specified in this document

3GPP2 C.S0016-D v2.0

3-61



‘000001100’ through

‘10111111’

Available for manufacturer-specific features

‘11000000’ through

‘11111110’

See [4]


1

ADD_LENGTH - Number of octets in the additional fields. 2


included in the Additional fields. 4

Additional fields - Additional fields. 5

The mobile station shall include the following field as the first 6

octet of the additional fields. 7

8

Field Length (bits)

BAND_MODE_CAP 8

9

BAND_MODE_CAP - Band/mode Capability Information. 10

The mobile station shall set this field to indicate band and 11

mode capabilities supported by the mobile station. This field 12

consists of the fields as shown in Table 3.5.1.7-2. The mobile 13

station shall set each field to ‘1’ if the corresponding 14

band/mode is supported by the mobile station; otherwise, the 15

mobile station shall set the corresponding field to ‘0’. All bits 16

of the RESERVED field of the BAND_MODE_CAP field shall be 17

set to ‘0’. 18

19

3GPP2 C.S0016-D v2.0

3-62

Table 3.5.1.7-2 Band/mode Capability Information 1

Description Length (bits)

Band Class 0 Analog 1

Band Class 0 CDMA 1

Band Class 1 CDMA 1

Band Class 3 CDMA 1

Band Class 6 CDMA 1

RESERVED 3

2

3.5.1.8 SSPR Configuration Response Message 3

The SSPR Configuration Response Message has the following variable-length format: 4

5

Field Length (bits)


BLOCK_ID 8

RESULT_CODE 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

6



BLOCK_ID - Parameter Block identifier. 9


BLOCK_ID of the parameter block being returned in this 11

message (see Table 3.5.3-1). 12

RESULT_CODE - SSPR Configuration result code. 13


or rejection status of the request for corresponding parameter 15

block in the SSPR Configuration Request Message, using the 16



3GPP2 C.S0016-D v2.0

3-63



BLOCK_LEN fields. 3

PARAM_DATA - Parameter block data. 4

The mobile station shall include the parameter block specified 5

by the BLOCK_ID field. If SECURE_MODE_INDS = ‘1’, 6

PARAM_DATA fields shall be encrypted as specified in 3.3.8. 7




‘0’. 11











to ‘0’. 22

3.5.1.9 SSPR Download Response Message 23

The SSPR Download Response Message has the following variable-length format: 24

25

Field Length (bits)


BLOCK_ID 8

RESULT_CODE 8

If the BLOCK_ID being confirmed is either ‘00000000’ 26

(Preferred Roaming List) or ‘00000001’ (Extended Preferred 27

Roaming List), the mobile station shall also include the 28

following fields: 29

SEGMENT_OFFSET 16

SEGMENT_SIZE 8

30



BLOCK_ID SSPR Parameter block identifier. 33

3GPP2 C.S0016-D v2.0

3-64


BLOCK_ID field of the parameter block in the SSPR Download 2

Request Message that is being confirmed (see Table 4.5.3-1). 3

RESULT_CODE - SSPR Download result code. 4


or rejection status of the parameter block in the SSPR 6

Download Request Message that is being confirmed, using the 7


SEGMENT_OFFSET - Segment offset. 9

If the BLOCK_ID is either ‘00000000’ (Preferred Roaming List) 10

or ‘00000001’ (Extended Preferred Roaming List), the mobile 11

station shall include and set this field to the value of 12

SEGMENT_OFFSET from the SSPR Download Request 13

Message that is being confirmed; otherwise, the mobile 14

station shall omit this field (See SSPR Download Request 15

Message processing in 3.3.1 for more details). 16

SEGMENT_SIZE - Segment size. 17

If the BLOCK_ID is either ‘00000000’ (Preferred Roaming List) 18

or ‘00000001’ (Extended Preferred Roaming List), the mobile 19

station shall include and set this field to the number of octets 20

of the preferred roaming list (PR_LISTs-p) included in 21

SEGMENT_DATA of the SSPR Download Request Message that 22

is being confirmed; otherwise, the mobile station shall omit 23

this field (See SSPR Download Request Message processing in 24

3.3.1 for more details). 25

26

3.5.1.10 Validation Response Message 27

The Validation Response Message shall have the following variable-length format: 28

29

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8

30




3GPP2 C.S0016-D v2.0

3-65


parameter blocks contained in the Validation Request Message 2

that is being confirmed. 3




Validation Request Message that is being confirmed (see Table 7

4.5.4-1). 8

RESULT_CODE - Service programming lock result code. 9



the Validation Request Message that is being confirmed, using 12


14

3.5.1.11 OTAPA Response Message 15

The OTAPA Response Message shall have the following variable-length format: 16

17

Field Length (bits)


RESULT_CODE 8

RESERVED 7

NAM_LOCK_IND 1

RAND_OTAPA 0 or 32

18



RESULT_CODE - OTAPA result code. 21

The mobile station shall set this field using the values defined 22

in Table 3.5.1.2-1. 23

RESERVED - Reserved field. 24

The mobile station shall set this field to ‘0000000’ 25

NAM_LOCK_IND - NAM_LOCK indicator. 26

If the mobile station is sending this message in response to 27

the OTAPA Request Message containing the START_STOP field 28

equal to ‘1’, the mobile station shall set this field to ‘1’ if the 29

indicators and parameters of the active NAM are secured by 30

SPASM (see 3.3.7); otherwise, the mobile station shall set this 31


3GPP2 C.S0016-D v2.0

3-66

If the mobile station is sending this message in response to 1

the OTAPA Request Message containing the START_STOP field 2

equal to ‘0’, the mobile station shall set this field to ‘0’. 3

RAND_OTAPA - SPASM random challenge. 4

If the NAM_LOCK_IND is equal to ‘1’, the mobile station shall 5

set this field as specified in 3.3.7; otherwise, the mobile 6

station shall omit this field. 7

8

3.5.1.12 PUZL Configuration Response Message 9

The PUZL Configuration Response Message shall have the following variable-length format: 10

11

Field Length (bits)


BLOCK_ID 8

RESULT_CODE 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

12






PUZL Configuration Request Message that is being confirmed 18

(see Table 3.5.6-1). 19


The mobile station shall include one instance of this field for 21

each parameter block included in the message, in the same 22

order of appearance. The mobile station shall set this field to 23

indicate acceptance or rejection status of the request for the 24

corresponding parameter block in the PUZL Configuration 25

Request Message, using the values defined in Table 3.5.1.2-1. 26





3GPP2 C.S0016-D v2.0

3-67



by the BLOCK_ID field. If SECURE_MODE_INDS = ‘1’, 3

PARAM_DATA field shall be encrypted as specified in 3.3.8. 4


If the mobile station supports Secure Mode and if 6

SECURE_MODE_INDS = ‘1’, the mobile station shall set this 7


‘0’. 9



If the mobile station supports Secure Mode, 12

SECURE_MODE_INDS = ‘1’, and FRESH_INCL = ‘1’, the 13

mobile station shall include this field and set it to a 15-bit 14

value chosen according to requirements defined in Section 15

3.3.8 for encrypting the PARAM_DATA fields of all Parameter 16

Data blocks included in the message; otherwise the mobile 17

station shall omit this field. 18




to ‘0’. 22

23

3.5.1.13 PUZL Download Response Message 24

The PUZL Download Response Message shall have the following variable-length format: 25

26

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8

IDS_PRESENT 1

UZ_ID 0 or 16

UZ_SID 0 or 15

RESERVED 0 or 7

27



3GPP2 C.S0016-D v2.0

3-68



parameter blocks contained in the PUZL Download Response 3

Message. 4




PUZL Download Request Message that is being confirmed (see 8

Table 4.5.6-1). 9

RESULT_CODE - PUZL Download result code. 10



the PUZL Download Request Message that is being confirmed, 13

using the values defined in Table 3.5.1.2-1. 14

IDS_PRESENT - Identifiers present flag. 15

The mobile station shall set this field to indicate whether or 16

not the UZ_ID and UZ_SID fields are included in the 17

parameter block. If the UZ_ID and UZ_SID fields are included, 18

IDS_PRESENT = ‘1’; otherwise, IDS_PRESENT = ‘0’. 19

UZ_ID - User Zone ID. 20

Identification number for the User Zone. This is used over the 21

air interface to identify the User Zone to the network and the 22

mobile station. The UZ_ID values are defined based on Table 23

3.5.1.13-1. 24

25

Table 3.5.1.13-1 UZ Type According to UZ_ID 26

UZ_ID Bit # Description of UZ Type

Bit 16 ‘1’ indicates a UZ (e.g. HRPD-only) with no 1x SIDinformation included.

‘0’ indicates otherwise.

Bit 15 ‘1’ indicates MS-specific usage.

‘0’ indicates otherwise.

Bit 14 RESERVED

Bit 13 RESERVED

Bits 1 to 12 Identification of UZ.

27

UZ_SID - User Zone System ID. 28

The System Identifier (SID) associated with the User Zone ID. 29

The User Zone ID and User Zone SID values together provide a 30

unique identifier for the user zone. 31

3GPP2 C.S0016-D v2.0

3-69


The mobile station shall add reserved bits as needed in order to 2

make the length of the entire parameter block equal to an 3

integer number of octets. Each reserved bit shall be set to '0'. 4

5

3.5.1.14 3GPD Configuration Response Message 6

The 3GPD Configuration Response Message has the following variable-length format: 7

8

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


RESULT_CODE 8

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

9





parameter blocks contained in the 3GPD Configuration 14


The mobile station shall set NUM_BLOCKS occurrences of the following fields: 16




3GPD Configuration Request Message that is being confirmed 20

(see Table 3.5.8-1). 21


3GPP2 C.S0016-D v2.0

3-70



BLOCK_LEN fields. 3








or rejection status of the request for the corresponding 11

parameter block in the 3GPD Configuration Request Message, 12




field to SECURE_MODE_IND; otherwise the mobile station 16

shall set this field to ‘0’. 17











to ‘0’. 28

29

3.5.1.15 3GPD Download Response Message 30

The 3GPD Download Response Message has the following variable-length format: 31

32

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8


3GPP2 C.S0016-D v2.0

3-71




parameter blocks contained in the 3GPD Download Request 4

Message that is being confirmed. 5





3GPD Download Request Message that is being confirmed (see 10

Table 4.5.7-1). 11




the 3GPD Download Request Message that is being confirmed, 15


3.5.1.16 Secure Mode Response Message 17

The Secure Mode Response Message shall have the following variable-length format: 18

19

Field Length (bits)


RESULT_CODE 8

20



RESULT_CODE - Secure Mode result code. 23


in Table 3.5.1.2-1. 25

The mobile station shall add reserved bits, if necessary, in order to make the length of the 26

entire parameter block equal to an integer number of octets. The mobile station shall set 27

these bits to ‘0000000’. 28

3GPP2 C.S0016-D v2.0

3-72

3.5.1.17 Extended Protocol Capability Response Message 1

The Extended Protocol Capability Response Message has the following variable-length 2

format: 3

4

Field Length (bits)


OTASP_MOB_P_REV 8

MOB_FIRM_REV 16

MOB_MODEL 8

NUM_FEATURES 8

NUM_FEATURES occurrences of the following features:

FEATURE_ID 8

FEATURE_P_REV 8

NUM_CAP_RECORDS 8

NUM_CAP_RECORDS occurrences of the following records:

CAP_RECORD_TYPE 8

CAP_RECORD_LEN 8

Type-specific field 8 RECORD_LEN

5



OTASP_MOB_P_REV - OTASP Mobile Protocol Revision. 8


MOB_FIRM_REV - Mobile station firmware revision number. 10


MOB_FIRM_REVp permanent mobile station indicator (see 12

F.2.1 of [1, 7]). 13

MOB_MODEL - Mobile station manufacturer’s model number. 14


MOB_MODELp permanent mobile station indicator (see F.2.1 16

of [1, 7]). 17

NUM_FEATURES - Number of Features. 18


features supported by the mobile station using the OTASP 20

protocol. 21

3GPP2 C.S0016-D v2.0

3-73

FEATURE_ID - Feature Identifier. 1


3.5.1.7-1 to indicate the feature supported by the mobile 3

station. 4

FEATURE_P_REV - Feature protocol version. 5


3.5.1.7-1 to indicate the protocol version of the feature 7

supported by the mobile station. 8

NUM_CAP_RECORDS - Number of Capability Records. 9


Capability Records contained in the Extended Protocol 11

Capability Response Message. 12

13

The mobile station shall include all the records requested in the corresponding Protocol 14

Capability Request Message. The mobile station shall include the following fields for each 15

capability record to be included: 16

17

CAP_RECORD_TYPE - Capability Record Type. 18

The mobile station shall set this field to the record type value 19

shown in Table 3.5.1.17.1-1 corresponding to the type of this 20

information record. 21

CAP_RECORD_LEN - Capability Record Length. 22


included in the type-specific fields of this information record. 24

If the mobile station does not support a requested 25

CAP_RECORD_TYPE or supports a requested 26

CAP_RECORD_TYPE, but does not have a value, the mobile 27

station shall include the CAP_RECORD_TYPE with the 28

CAP_RECORD_LEN field set to ‘00000000’. 29

Type-specific field - Type-specific field. 30

The mobile station shall set these fields to the information as 31

specified in 3.5.1.17.1 for the specific type of records. 32

33

3GPP2 C.S0016-D v2.0

3-74

3.5.1.17.1 Capability Information Record 1

Table 3.5.1.17.1-1 lists the information record type values that can be used in the 2

Extended Protocol Capability Response Message. The following sections describe the 3

contents of each of the record types in detail. 4

5

Table 3.5.1.17.1-1 Capability Information Record Types 6

Capability Information Record Record Type

(binary)

Operating Mode Information ‘00000000’

CDMA Band Class Information ‘00000001’

MEID ‘00000010’

ICCID ‘00000011’

EXT_UIM_ID ‘00000100’

MEID_ME ‘00000101’

All other values are reserved.

7

3.5.1.17.1.1 Operating Mode Information 8

This capability information record is used to return operating mode information supported 9

by the mobile station. 10

11

Type-Specific Field Length (bits)

OP_MODE_INFO 8 CAP_RECORD_LEN

12

OP_MODE_INFO – Operating mode information. 13

This field indicates which operating modes are supported by 14

the mobile station in the band class for which information is 15

requested. 16

This field currently consists of the following subfields which 17

are included in the information record in the order shown in 18

Table 3.5.1.17.1.1-1. 19

3GPP2 C.S0016-D v2.0

3-75

Table 3.5.1.17.1.1-1. OP_MODE 1

Subfield Length (bits)

Subfield Description Standards

OP_MODE0 1 Analog mode [22]

OP_MODE1 1 CDMA mode [7]

OP_MODE2 1 HRPD mode [9]

RESERVED 5 – –

2

The mobile station shall set each subfield to ‘1’, if the 3

corresponding operating mode is supported by the mobile 4

station; otherwise, the mobile station shall set the subfield to 5

‘0’. 6

RESERVED – Reserved bits. 7

The mobile station shall set each bit in this field to ‘0’. 8

When more operating modes are defined, the reserved bits will 9

be used for the new corresponding subfields. Sufficient octets 10

will also be added to this field to accommodate the 11

corresponding new subfields. All the undefined bits in an 12

additional octet will be reserved bits. 13

If all bits are set to ‘0’ in an octet and all succeeding octets, 14

the mobile station shall omit the octet and the succeeding 15

octets. 16

17

3.5.1.17.1.2 CDMA Band Class Information 18

This capability information record is used to return band class information about the 19

mobile station. 20

21


BAND_CLASS_INFO 8 CAP_RECORD_LEN

22

BAND_CLASS_INFO – Band class information. 23

This field indicates which band classes are supported by the 24

mobile station. 25

3GPP2 C.S0016-D v2.0

3-76

The mobile station shall set the Nth significant bit of this field 1

to ‘1’ if the Nth band class defined in [23] is supported by the 2

mobile station; otherwise, the mobile station shall set the Nth 3

most significant bit of this field to ‘0’. 4

The mobile station shall add reserved bits as needed in order 5

to make the length of the entire information record equal to 6

an integer number of octets. The mobile station shall set 7

these bits to ‘0’. 8

9

3.5.1.17.1.3 MEID 10

This capability information record is used to return the mobile station MEID, or the smart 11

card’s SF_EUIMID based on the SF_EUIMID Usage Indicator as defined in [24] and [32]. 12

13


MEID 56

14

MEID – Mobile Equipment Identifier. 15

If the mobile station is not smart card enabled, then the 16

mobile station shall set this field to its Mobile Equipment 17

Identifier. 18

If the mobile station is smart card enabled, and if there is no 19

card present, the mobile station shall set this field to its 20

Mobile Equipment Identifier. 21

If the mobile station is smart card enabled, and the the smart 22

card is present, the mobile station shall set this field to its 23

Mobile Equipment Identifier or the SF_EUIMID based on the 24

UIM_ID / SF_EUIMID Usage Indicator defined in [24] and 25

[32]. 26

3.5.1.17.1.4 ICCID 27

This capability information record is used to return the ICCID in the smart card. 28

29


ICCID 80

30

ICCID – Integrated Circuit Card Identifier. 31

The mobile station shall set this field to the Integrated Circuit 32

Card Identifier (LF_EUIMID) stored in the smart card. 33

3GPP2 C.S0016-D v2.0

3-77

3.5.1.17.1.5 EXT_UIM_ID 1

This capability information record is used to return the EXT_UIM_ID in the smart card 2

based on the SF_EUIMID-based EUIMID service as defined in [24] and [32]. 3

4


EXT_UIM_ID 8 CAP_RECORD_LEN

5

EXT_UIM_ID – Mobile station Extended User Identity Module identifier. 6


3.5.1.17.1.5-1. 8

Table 3.5.1.17.1.5-1. EXT_UIM_ID Field Setting 9

SF_EUIMID-based EUIMID

EXT_UIM_ID Length (bits)

0 LF_EUIMID 80

1 SF_EUIMID 56

10

3.5.1.17.1.6 MEID_ME 11

This capability information record is used to return the mobile station MEID. 12

13


MEID_ME 56

14

MEID_ME – Mobile Equipment Identifier of ME. 15

The mobile station shall set this field to the LF_EUIMID when the CAP_Record_LEN is set 16

to 10 octets. The mobile station shall set this field to the SF_EUIMID when the 17

CAP_Record_LEN is set to 7 octets. 18

19

3GPP2 C.S0016-D v2.0

3-78

3.5.1.18 MMD Configuration Response Message 1

The MMD Configuration Response Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


RESULT_CODE 8

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter blocks contained in the MMD Configuration 9






MMD Configuration Request Message that is being confirmed 15

(see Table 3.5.9-1). 16










3GPP2 C.S0016-D v2.0

3-79



or rejection status of the request for the corresponding 3

parameter block in the MMD Configuration Request Message, 4




field to SECURE_MODE_IND; otherwise the mobile station 8












to ‘0’. 20

3.5.1.19 MMD Download Response Message 21

The MMD Download Response Message has the following variable-length format: 22

23

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8





parameter blocks contained in the MMD Download Request 28




3GPP2 C.S0016-D v2.0

3-80



MMD Download Request Message that is being confirmed (see 3

Table 4.5.8-1). 4




the MMD Download Request Message that is being confirmed, 8


3.5.1.20 System Tag Configuration Response Message 10

The System Tag Configuration Response Message shall have the following variable-length 11

format: 12

13

Field Length (bits)


BLOCK_ID 8

RESULT_CODE 8

BLOCK_LEN 8




BLOCK_ID - The mobile station shall set this field to the value of the 16


System Tag Configuration Request Message that is being 18

confirmed (see Table 3.5.10-1). 19

RESULT_CODE - System Tag result code. 20


or rejection status of the request for corresponding parameter 22

block in the System Tag Configuration Request Message, using 23








by the BLOCK_ID field. 31

32

3GPP2 C.S0016-D v2.0

3-81

3.5.1.21 System Tag Download Response Message 1

The System Tag Download Response Message shall have the following format: 2

3

Field Length (bits)


BLOCK_ID 8

RESULT_CODE 8

If the BLOCK_ID being confirmed is ‘00000001’ (Group Tag 4

List),’00000010’ (Specific Tag List), or ‘00000011’ (Call Prompt 5

List), the mobile station shall also include the following fields: 6

SEGMENT_OFFSET 16

SEGMENT_SIZE 8

7



BLOCK_ID System Tag Parameter block identifier. 10


BLOCK_ID field of the parameter block in the System Tag 12

Download Request Message that is being confirmed (see Table 13

4.5.9-1). 14

RESULT_CODE - System Tag Download result code. 15


or rejection status of the parameter block in the System Tag 17

Download Request Message that is being confirmed, using the 18





List), the mobile station shall include and set this field to the 23

value of SEGMENT_OFFSET from the System Tag Download 24

Request Message that is being confirmed; otherwise, the 25

mobile station shall omit this field 26




List), the mobile station shall set this field to the number of 30

octets of the group tag list (GROUP_TAG_LISTs-p), specific tag 31

list (SPEC_TAG_LISTs-p), or call prompt list (CALL_PRMPT_ 32

LISTs-p) included in SEGMENT_DATA of the System Tag 33

Download Request Message that is being confirmed; 34

otherwise, the mobile station shall omit this field. 35

3GPP2 C.S0016-D v2.0

3-82

3.5.1.22 Service Key Generation Response Message 1

The Service Key Generation Response Message shall have the following format: 2

3

Field Length (bits)


RESULT_CODE 8

4



RESULT_CODE - Service Key Generation result code. 7


in Table 3.5.1.2-1. 9

10

3.5.1.23 MMS Configuration Response Message 11

The MMS Configuration Response Message has the following variable-length format: 12

13

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


RESULT_CODE 8

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

14





parameter blocks contained in the MMS Configuration 19


3GPP2 C.S0016-D v2.0

3-83



parameter block type being included in the message (see 3

Table 3.5.12-1). 4




BLOCK_LEN fields. 8



by the BLOCK_ID field. If Secure Mode is active, 11





the MMS Configuration Request Message that is being 16

confirmed, using the values defined in Table 3.5.1.2-1. 17


If Secure Mode is active (See 3.3.8), the mobile station shall 19

set this field to ‘1’; otherwise the mobile station shall set this 20





and set it to a 15-bit value chosen as specified in 3.3.8 for 25

encrypting the PARAM_DATA fields of all Parameter Data 26

blocks included in the message; otherwise the mobile station 27

shall omit this field. 28


If FRESH_INCL= ‘1’, the mobile station shall omit this field; 30


to ‘0’. 32

33

3GPP2 C.S0016-D v2.0

3-84

3.5.1.24 MMS Download Response Message 1

The MMS Download Response Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8





parameter blocks contained in the MMS Download Request 8






MMS Download Request Message that is being confirmed (see 14

Table 4.5.10-1). 15




the MMS Download Request Message that is being confirmed, 19


21

3GPP2 C.S0016-D v2.0

3-85

3.5.1.25 MMSS Configuration Response Message 1

The MMSS Configuration Response Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8

PARAM_DATA 8 x BLOCK_LEN

RESULT_CODE 8

4

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

5





parameter blocks contained in the MMSS Configuration 10

Request Message that is being confirmed. 11




MMSS Configuration Request Message that is being confirmed 15

(see Table 3.5.13-1). 16






3GPP2 C.S0016-D v2.0

3-86

If the BLOCK_ID field is set to ‘00000010’ (MMSS Location 1

Associated Priority List) or ‘00000011’ (MMSS System Priority 2

List), then the mobile station shall include the table below. 3

Otherwise, Tthe mobile station shall include the parameter 4

block specified by the BLOCK_ID field as specified in section 5

3.5.13. If SECURE_MODE_INDS = ‘1’, PARAM_DATA fields 6

shall be encrypted as specified in section 3.3.8. 7

8

Field Length (bits)

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8

SEGMENT_DATA 8 SEGMENT_SIZE

9

RESERVED - Reserved bits (in PARAM_DATA). 10


LAST_SEGMENT - Last segment indicator bit (in PARAM_DATA). 12

The mobile station shall set this field to ‘1’ if SEGMENT_DATA 13

contains the last octet of the MMSS Location Associated 14

Priority List (MLP_LISTS-P) or MMSS System Priority List 15

(MSP_LISTS-P); otherwise, the mobile station shall set this field 16

to ‘0’. The MLP_LISTS-P is defined in Sec. 3.5.13.3 MMSS 17

Location Associated Priority List. The MSP_LISTS-P is defined 18

in Sec. 3.5.13.4. 19

SEGMENT_OFFSET - Segment offset (in PARAM_DATA). 20


REQUEST_OFFSET from the corresponding MMSS 22

Configuration Request Message. 23

SEGMENT_SIZE - Segment size (in PARAM_DATA). 24


of MLP_LISTS-P or MSP_LISTS-P included in SEGMENT_DATA. 26

If REQUEST_OFFSET from the corresponding MMSS 27

Configuration Request Message specifies an offset that is 28

invalid for the current MLP_LISTS-P or MSP_LISTS-P, then the 29

mobile station shall include no octets in this field. 30

If REQUEST_OFFSET specifies an offset that is valid for the 31

current MLP_LISTS-P or MSP_LISTS-P, then the mobile station 32

shall include at most REQUEST_MAX_SIZE sequential octets 33

of the MLP_LISTS-P or MSP_LISTS-P in this field. 34

SEGMENT_DATA - Segment data (in PARAM_DATA). 35

3GPP2 C.S0016-D v2.0

3-87

If SEGMENT_SIZE is zero, this field shall be omitted. 1

Otherwise, this field contains SEGMENT_SIZE octets starting 2

at the offset specified by SEGMENT_OFFSET within the 3

MLP_LISTS-P if BLOCK_ID = ‘00000010’ or MSP_LISTS-P if 4

BLOCK_ID = ‘00000011’. 5

6

RESULT_CODE - Service programming lock result code. The mobile station 7

shall set this field to indicate acceptance or rejection status of 8

the corresponding parameter block in the MMSS Configuration 9

Request Message that is being confirmed, using the values 10

defined in Table 3.5.1.2-1. 11




‘0’. 15











to ‘0’. 26

27

28

3GPP2 C.S0016-D v2.0

3-88

3.5.1.26 MMSS Download Response Message 1

The MMSS Download Response Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

RESULT_CODE 8

SEGMENT_OFFSET 0 or 16

SEGMENT_SIZE 0 or 8

4





parameter blocks contained in the MMSS Download Request 9





MMSS Download Request Message that is being confirmed (see 14

Table 4.5.11-1). 15

RESULT_CODE - MMSS Download result code. 16



the MMSS Download Request Message that is being confirmed, 19


21

If the BLOCK_ID field is set to ‘00000001’ (MMSS Location Associated Priority List), the 22

mobile station shall include the following fields in the message: 23

24


3GPP2 C.S0016-D v2.0

3-89

If the BLOCK_ID is ‘00000001’ (MMSS Location Associated 1

Priority List), tThe mobile station shall include and set this 2

field to the value of SEGMENT_OFFSET from the MMSS 3




If the BLOCK_ID is ‘00000001’ (MMSS Location Associated 7

Priority List), tThe mobile station shall include and set this 8

field to the number of octets of the MMSS location associated 9

priority list included in SEGMENT_DATA of the MMSS 10



13

If the BLOCK_ID field is set to ‘00000010’ (MMSS System Priority List), the mobile station 14

shall include the following fields in the message: 15

16


If the BLOCK_ID is ‘00000010’ (MMSS System Priority List), 18

tThe mobile station shall include and set this field to the 19

value of SEGMENT_OFFSET from the MMSS Download 20

Request Message that is being confirmed; otherwise, the 21

mobile station shall omit this field. 22


If the BLOCK_ID is ‘00000010’ (MMSS System Priority List), 24

tThe mobile station shall include and set this field to the 25

number of octets of the MMSS systemlocation associated 26

priority list included in SEGMENT_DATA of the MMSS 27



If the BLOCK_ID is any value other than ‘00000001’ or ‘00000010’, the mobile station shall 30

omit the SEGMENT_OFFSET and SEGMENT_SIZE fields. 31

32

3GPP2 C.S0016-D v2.0

3-90

3.5.2 NAM Parameter Blocks 1

Table 3.5.2-1 lists the types of parameter blocks used in the Configuration Request Message 2

and the Configuration Response Message. 3

4

Table 3.5.2-1 NAM Parameter Block Types 5

Parameter Block Type BLOCK_ID Reference

CDMA/Analog NAM ‘00000000’ 3.5.2.1

Mobile Directory Number ‘00000001’ 3.5.2.2

CDMA NAM ‘00000010’ 3.5.2.3

IMSI_T ‘00000011’ 3.5.2.4

eHRPD IMSI ‘00000100’ 3.5.2.5

Reserved for future standardization ‘00000101’ through

‘01111111’

Available for manufacturer-specific parameter block definitions

‘10000000’ through

‘11111110’

See [4]


6

3GPP2 C.S0016-D v2.0

3-91

3.5.2.1 CDMA/Analog NAM Parameter Block 1

The PARAM_DATA field of this Parameter Block consists of the following fields: 2

3

Field Length (bits)

FIRSTCHP 11

HOME_SID 15

EX 1

SCM 8

MOB_P_REV 8

IMSI_M_CLASS 1

IMSI_M_ADDR_NUM 3

MCC_M 10

IMSI__M_11_12 7

IMSI_M_S 34

ACCOLC 4

LOCAL_CONTROL_ANALOG 1

MOB_TERM_HOME 1

MOB_TERM_FOR_SID 1

MOB_TERM_FOR_NID 1

MAX_SID_NID 8

STORED_SID_NID 8

STORED_SID_NID occurrences of the following SID/NID pair:

SID 15

NID 16

The parameter block ends with the following field:

RESERVED 0 to 7 (as needed)

4

FIRSTCHP - First paging channel used in the home system. 5


FIRSTCHPp NAM indicator (see F.3 of [1, 1]). 7

HOME_SID - Home system identification. 8


HOME_SIDp NAM indicator (see F.3 of [1, 1]). 10

3GPP2 C.S0016-D v2.0

3-92

EX - Extended address indicator. 1

The mobile station shall set this field to the value of the Exp 2

NAM indicator (see F.3 of [1, 1]). 3

SCM - Station class mark. 4

The mobile station shall set this field to the value of the SCMp 5

permanent mobile station indicator (see F.2.1 of [1, 1]). 6

MOB_P_REV - Mobile station protocol revision number. 7


MOB_P_REVp permanent mobile station indicator (see F.2.1 9

of [1, 1]). 10

IMSI_M_CLASS - IMSI_M Class assignment of the mobile station. 11

If the mobile station’s IMSI_M is a class 0 IMSI, the mobile 12

station shall set this field to ‘0’; otherwise, the mobile station 13


IMSI_M_ADDR_NUM - Number of IMSI_M address digits. 15

If the mobile station has been assigned a class 1 IMSI_M (see 16

F.3 and 6.3.1 of [1] or F.3 and 2.3.1 of [1]), the mobile station 17

shall set this field to four less than the number of digits in the 18

NMSI; otherwise, the mobile station shall set this field to 19

‘000’. 20

MCC_M - Mobile country code. 21


MCC_Mp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 23

2.3.1 of [1]). 24

IMSI__M_11_12 - 11th and 12th digits of the IMSI_M. 25


IMSI_M_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 27

and 2.3.1 of [1]). 28

IMSI_M_S - The least significant 10 digits of the IMSI_M. 29


IMSI_M_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 31

2.3.1 of [1]). 32

3GPP2 C.S0016-D v2.0

3-93

ACCOLC - Access overload class. 1


ACCOLCp NAM indicator (see F.3 of [1, 1]). 3

4

The value of ACCOLC may determine the Access Terminal 5

Class (ATC) if ATC is not provisioned in the Access Terminal 6

as described in Section 1.4.6.1.4.1.4 of [34].The mobile 7

station shall set the APersistence[i] (for mobile stations that 8

also support HRPD) as shown in Table 3.5.2.1-1 when 9

ACCOLC is set. 10

11

Table 3.5.2.1-1 ACCOLC – APersistence[i] Equivalence Table 12

ACCOLC APersistence[i]

0 to 9 0

10, 11 1

12, 13 2

14, 15 3

13

LOCAL_CONTROL_ANALOG - Local control status for Analog operation. 14

If the local control status for Analog operation is enabled (see 15

2.6.1.2.2 of [1]), the mobile station shall set this field to ‘1’; 16

otherwise, the mobile station shall set this field to ‘0’. 17

MOB_TERM_HOME - Termination indicator for the home system. 18


MOB_TERM_HOMEp NAM indicator (see F.3 of [1, 1]). 20

MOB_TERM_FOR_SID - Termination indicator for SID roaming. 21


MOB_TERM_FOR_SIDp NAM indicator (see F.3 of [1, 1]). 23

MOB_TERM_FOR_NID - Termination indicator for NID roaming. 24


MOB_TERM_FOR_NIDp NAM indicator (see F.3 of [1, 1]). 26

MAX_SID_NID - Maximum stored SID/NID pairs. 27

The mobile station shall set this field to the maximum 28

number of SID/NID pairs that it can store in the NAM. 29

STORED_SID_NID - Number of stored SID/NID pairs. 30


SID/NID pairs stored in the NAM. All SID/NID pairs stored in 32

the NAM shall be included in the parameter block. 33

SID - System identification. 34

3GPP2 C.S0016-D v2.0

3-94

The mobile station shall include one occurrence of this field 1

for each SID/NID pair stored in the NAM. The mobile station 2

shall set this field to the value of the SIDp NAM indicator (see 3

F.3 of [1, 1]). 4

NID - Network identification. 5



shall set this field to the value of the NIDp NAM indicator (see 8

F.3 of [1, 1]). 9



to make the length of the entire parameter block equal to an 12

integer number of octets. The mobile station shall set these 13

bits to ‘0’. 14

15

3.5.2.2 Mobile Directory Number 16

The PARAM_DATA field of the Mobile Directory Number Parameter Block consists of the 17


Field Length (bits)

N_DIGITS 4

N_DIGITS occurrences of the following field:

DIGITn 4


RESERVED 0 or 4

19

N_DIGITS - Number of digits. 20

The mobile station shall set this field to the number of digits 21

included in the parameter block. 22

DIGITn - Digit. 23

The mobile station shall set these fields to the digits of the 24

mobile station directory number. Each digit shall be encoded 25

according to Table 6.7.1.3.2.4-4 of [1] or Table 2.7.1.3.2.4-4 of 26

[1]. 27





bits to ‘0’. 32

33

3GPP2 C.S0016-D v2.0

3-95

3.5.2.3 CDMA NAM Parameter Block 1

The PARAM_DATA field of this Parameter Block consists of the following fields: 2

3

Field Length (bits)

RESERVED 2

SLOTTED_MODE 1

RESERVED 5

MOB_P_REV 8

IMSI_M_CLASS 1

IMSI_M_ADDR_NUM 3

MCC_M 10

IMSI_M_11_12 7

IMSI_M_S 34

ACCOLC 4

LOCAL CONTROLLOCAL_CONTROL_CDMA

1

MOB_TERM_HOME 1

MOB_TERM_FOR_SID 1

MOB_TERM_FOR_NID 1

MAX_SID_NID 8

STORED_SID_NID 8

STORED_SID_NID occurrences of the following SID/NID pair:

SID 15

NID 16



4



SLOTTED_MODE - Slotted mode. 7

If the mobile station is operating in the slotted mode, the 8

mobile station shall set this field to ‘1’; otherwise, the mobile 9

station shall set this field to ‘0’. 10



3GPP2 C.S0016-D v2.0

3-96

MOB_P_REV - Mobile station protocol revision number. 1


MOB_P_REVp permanent mobile station indicator (see F.2.1 3

of [1, 1]). 4


If the mobile station’s IMSI_M is a class 0 IMSI, the mobile 6



IMSI_ M_ADDR_NUM - Number of IMSI_M address digits. 9


F.3 [1, 1]), the mobile station shall set this field to four less 11

than the number of digits in the NMSI; otherwise, the mobile 12


MCC_M - Mobile country code. 14


MCC_Mp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 16

2.3.1 of [1]). 17

IMSI_M_11_12 - 11th and 12th digits of the IMSI. 18


IMSI_M_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 20

and 2.3.1 of [1]). 21

IMSI_M_S - The least significant 10 digits of the IMSI. 22


IMSI_M_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 24

2.3.1 of [1]). 25



ACCOLCp NAM indicator (see F.3 of [1, 1]). 28

The mobile station shall set APersistence[i] (for mobile 29

stations that also support HRPD) as shown in Table 3.5.2.1-1 30

when ACCOLC is set. 31

LOCAL_ CONTROL_CDMA - Local control status for CDMA operation. 32

If the local control status for CDMA operation is enabled (see 33

6.3.9 of [1] or 2.3.9 of [1]), the mobile station shall set this 34

field to ‘1’; otherwise, the mobile station shall set this field to 35

‘0’. 36



MOB_TERM_HOMEp NAM indicator (see F.3 of [1, 1]). 39



MOB_TERM_FOR_SIDp NAM indicator (see F.3 of [1, 1]). 42

3GPP2 C.S0016-D v2.0

3-97



MOB_TERM_FOR_NIDp NAM indicator (see F.3 of [1, 1]). 3

MAX_SID_NID - Maximum stored SID/NID pairs. 4


number of SID/NID pairs that it can store in the NAM. 6

STORED_SID_NID - Number of stored SID/NID pairs. 7


SID/NID pairs stored in the NAM. All SID/NID pairs stored in 9

the NAM shall be included in the parameter block. 10




shall set this field to the value of the SIDp NAM indicator (see 14

F.3 of [1, 1]). 15




shall set this field to the value of the NIDp NAM indicator (see 19

F.3 of [1, 1]). 20





bits to ‘0’. 25

26

3.5.2.4 IMSI_T Parameter Block 27

The PARAM_DATA field of the IMSI_T Parameter Block consists of the following fields: 28

29

Field Length (bits)

IMSI_T_CLASS 1

IMSI_T_ADDR_NUM 3

MCC_T 10

IMSI_T_11_12 7

IMSI_T_S 34

RESERVED 1

IMSI_T_CLASS - IMSI_T Class assignment of the mobile station. 30

3GPP2 C.S0016-D v2.0

3-98

If the mobile station’s IMSI_T is a class 0 IMSI, the mobile 1



IMSI_T_ADDR_NUM - Number of IMSI_T address digits. 4

If the mobile station has been assigned a class 1 IMSI_T (see 5

6.3.1 of [1] or 2.3.1 of [1]), the mobile station shall set this 6

field to four less than the number of digits in the NMSI; 7

otherwise, the mobile station shall set this field to ‘000’. 8

MCC_T - Mobile country code. 9


MCC_Tp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 11

2.3.1 of [1]). 12

IMSI__T_11_12 - 11th and 12th digits of the IMSI_T. 13


IMSI_T_11_12p NAM indicator (see F.3 and 6.3.1 of [1] or F.3 15

and 2.3.1 of [1]). 16

IMSI_T_S - The least significant 10 digits of the IMSI_T. 17


IMSI_T_Sp NAM indicator (see F.3 and 6.3.1 of [1] or F.3 and 19

2.3.1 of [1]). 20



23

3.5.2.5 eHRPD IMSI Parameter Block 24

The PARAM_DATA field of the eHRPD IMSI Parameter Block consists of the following fields: 25

26

Field Length (bits)

eHRPD_MNC_NUM_DIGITS 1

eHRPD_IMSI_NUM_DIGITS 4

RESERVED 3

eHRPD_IMSI_DIGITS 4 * eHRPD_IMSI_NUM_DIGITS

RESERVED 0 to 4 bits as needed

27

eHRPD_MNC_NUM_DIGITS - Number of Mobile Network Code Digits. 28

If the number of MNC digits in the eHRPD IMSI is 2, the value 29

of this field is set to ‘0’. Otherwise, it is set to ‘1’ to indicate 30

an MNC with 3 digits in the eHRPD IMSI. 31

eHRPD_IMSI_NUM_DIGITS - Number of eHRPD International Mobile Station Identity Digits 32

3GPP2 C.S0016-D v2.0

3-99

The mobile station shall set this field to the number of digits 1

in eHRPD_IMSI. 2



eHRPD_IMSI_DIGITS - eHRPD International Mobile Station Identity Digits 5

The mobile station shall set this field to the eHRPD IMSI 6

using BCD encoding wherein each digit is represented by 4 7

bits. Digits are included in sequence starting with the most 8

significant digit.3 9





14

15

3.5.3 SSPR Parameter Blocks 16

Table 3.5.3-1 lists the types of parameter blocks used in the SSPR Configuration Request 17

Message and the SSPR Configuration Response Message. 18

19

Table 3.5.3-1 SSPR Parameter Block Types 20

SSPR Parameter Block Type BLOCK_ID Reference

Preferred Roaming List Dimensions ‘00000000’ 3.5.3.1

Preferred Roaming List ‘00000001’ 3.5.3.2

Extended Preferred Roaming List Dimensions

‘00000010’ 3.5.3.3

Reserved for future standardization ‘00000011’ -’01111111’


‘10000000’- ‘11111110’

See [4]


21

3 For example, given the eHRPD IMSI ‘001 02 0123456789’, eHRPD_MNC_NUM_DIGITS is ‘0’,

eHRPD_IMSI_NUM_DIGITS is ‘1111’, and eHRPD_IMSI_DIGITS is ‘0000 0000 0001 0000 0010 0000

0001 0010 0011 0100 0101 0110 0111 1000 1001’ where spaces between digits and bits have been

added for clarity.

3GPP2 C.S0016-D v2.0

3-100

3.5.3.1 Preferred Roaming List Dimensions Parameter Block 1

The PARAM_DATA field of the Preferred Roaming List Dimensions Parameter Block consists 2

of the following fields: 3

4

Field Length (bits)

MAX_PR_LIST_SIZE 16

CUR_PR_LIST_SIZE 16

PR_LIST_ID 16

RESERVED 1

NUM_ACQ_RECS 9

NUM_SYS_RECS 14

5

MAX_PR_LIST_SIZE - Maximum preferred roaming list size. 6

The mobile station shall set this field to the maximum size, in 7

octets, that the mobile station can support for the preferred 8

roaming list (PR_LISTs-p). 9

CUR_PR_LIST_SIZE - Current preferred roaming list size. 10

The mobile station shall set this field to the size, in octets, of 11

the current preferred roaming list. 12

PR_LIST_ID Preferred Roaming List Identification. 13


Preferred Roaming List Identification assigned for the 15

preferred roaming list (PR_LISTs-p) by the base station. 16

RESERVED - Reserved bit. 17


NUM_ACQ_RECS - Number of acquisition records. 19


acquisition records contained in the ACQ_TABLE field of the 21

current preferred roaming list. 22

NUM_SYS_RECS - Number of system records. 23

The mobile station shall set this field to the number of system 24

records contained in the SYS_TABLE field of the current 25

preferred roaming list. 26

27

3GPP2 C.S0016-D v2.0

3-101

3.5.3.2 Preferred Roaming List Parameter Block 1

The PARAM_DATA field of the Preferred Roaming List Parameter Block consists of the 2

following fields: 3

Field Length (bits)

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8


4



LAST_SEGMENT - Last segment indicator bit. 7


contains the last octet of the preferred roaming list (PR_LISTs-9

p); otherwise, the mobile station shall set this field to ‘0’. 10


The mobile station shall set this field to the value of 12

REQUEST_OFFSET from the corresponding SSPR 13




of the preferred roaming list (PR_LISTs-p) included in 17

SEGMENT_DATA. 18

If REQUEST_OFFSET from the corresponding SSPR 19


invalid for the current preferred roaming list, the mobile 21

station shall set this field to zero. 22


current preferred roaming list, the mobile station shall set 24

this field to a value less than or equal to 25

REQUEST_MAX_SIZE. 26

SEGMENT_DATA - Segment of the preferred roaming list (PR_LISTs-p) data. 27

If REQUEST_OFFSET from the corresponding SSPR 28


invalid for the current preferred roaming list, the mobile 30

station shall include no octets in this field. 31

3GPP2 C.S0016-D v2.0

3-102


current preferred roaming list, the mobile station shall 2

include at most REQUEST_MAX_SIZE sequential octets of the 3

preferred roaming list in this field. This field contains 4

SEGMENT_SIZEThe octets shall be equal to the octets 5

starting at the offset specified by SEGMENT_OFFSET within 6

the preferred roaming list specified by SEGMENT_OFFSET. 7

8

9

3GPP2 C.S0016-D v2.0

3-103

3.5.3.3 Extended Preferred Roaming List Dimensions Parameter Block 1

The PARAM_DATA field of the Extended Preferred Roaming List Dimensions Parameter 2

Block consists of the following fields: 3

4

Field Length (bits)

MAX_PR_LIST_SIZE 16

CUR_PR_LIST_SIZE 16

PR_LIST_ID 16

CUR_SSPR_P_REV 8

CUR_SSPR_P_REV-specific fields variable

If CUR_SSPR_P_REV is ‘00000001’ the CUR_SSPR_P_REV-specific fields also include the following fields:

RESERVED 1

NUM_ACQ_RECS 9

NUM_SYS_RECS 14

If CUR_SSPR_P_REV is ‘00000011’ the CUR_SSPR_P_REV-specific fields also include the following fields:

NUM_ACQ_RECS 9

NUM_COMMON_SUBNET_RECS 9

NUM_EXT_SYS_RECS 14

5

MAX_PR_LIST_SIZE - Maximum preferred roaming list size. 6



roaming list (PR_LISTs-p). 9

CUR_PR_LIST_SIZE - Current preferred roaming list size. 10


the current preferred roaming list. 12





CUR_SSPR_P_REV - Protocol revision of the mobile station’s current preferred 17

roaming list. 18


SSPR_P_REV associated with its current preferred roaming 20

list. 21

3GPP2 C.S0016-D v2.0

3-104





acquisition records contained in the ACQ_TABLE field of the 5

current preferred roaming list. 6


The mobile station shall set this field to the number of system 8

records contained in the SYS_TABLE field of the current 9

preferred roaming list. 10


- Number of records in the Common Subnet Table. 12

This field is set to the number of records contained in the 13

Common Subnet Table. 14

NUM_EXT_SYS_RECS - Number of extended system records. 15


extended system records contained in the EXT_SYS_TABLE 17

field of the current preferred roaming list. 18

19

3.5.4 Reserved 20

Reserved. 21

22

3.5.5 Preferred Roaming List and Extended Preferred Roaming List 23

The preferred roaming list (PR_LISTs-p) contains information to assist the mobile station 24

system selection and acquisition process, particularly when the mobile station is roaming. 25

The preferred roaming list can be sent to the mobile station using Over-the-Air Service 26

Provisioning (OTASP). The preferred roaming list is retained by the mobile station when 27

power is turned off. Two categories of the preferred roaming list are defined: The Preferred 28

Roaming List and the Extended Preferred Roaming List. 29

The Preferred Roaming List is associated with SSPR_P_REV equal to ‘00000001’ and has 30

the following variable length format: 31

32

3GPP2 C.S0016-D v2.0

3-105

Preferred Roaming List Field Length (bits)

PR_LIST_SIZE 16

PR_LIST_ID 16

PREF_ONLY 1

DEF_ROAM_IND 8

NUM_ACQ_RECS 9

NUM_SYS_RECS 14

ACQ_TABLE variable

SYS_TABLE variable

RESERVED 0 to 7

PR_LIST_CRC 16

1

PR_LIST_SIZE - Preferred roaming list size. 2

This field is set to the total size, in octets, of the preferred 3

roaming list, including the PR_LIST_SIZE and PR_LIST_CRC 4

fields. 5





PREF_ONLY - Preferred only. 10

This field is set to ‘1’ if the mobile station is to operate only on 11

systems that are specified in SYS_TABLE with PREF_NEG set 12

to ‘1’. This field is set to ‘0’ if the mobile station is to operate 13

on systems that are specified in SYS_TABLE with PREF_NEG 14

set to ‘1’ or on systems that are not specified in SYS_TABLE4. 15

DEF_ROAM_IND - Default roaming indication. 16

This field is set to the roaming indication value the mobile 17

station is to use when operating on systems not specified in 18

SYS_TABLE (see [4]). 19


This field is set to the number of acquisition records 21

contained in ACQ_TABLE (see Table 3.5.5.2-1). 22


4 For emergency access (911) the mobile station may ignore restrictions set by the PREF_ONLY and

PREF_NEG fields and access any available system.

3GPP2 C.S0016-D v2.0

3-106

This field is set to the number of system records contained in 1

SYS_TABLE. 2

ACQ_TABLE - Acquisition Table. 3

This field contains the Acquisition Records. The number of 4

acquisition records is specified by NUM_ACQ_RECS. The 5

acquisition record formats are specified in 3.5.5.2.1. 6

SYS_TABLE - System Table. 7

This field contains system records. The number of system 8

records is specified by NUM_SYS_RECS. The system record 9

format is specified in 3.5.5.3.1. 10




integer number of octets. Each reserved bit shall be set to '0' 14

PR_LIST_CRC - CRC for preferred roaming list. 15

This field is set to the 16-bit CRC calculated according to 16

3.5.5.1. 17

18

The Extended Preferred Roaming List is associated with SSPR_P_REV greater than or equal 19

to ‘00000010’ and has the following variable length format: 20

21

Extended Preferred Roaming List Field

Length (bits)

PR_LIST_SIZE 16

PR_LIST_ID 16

CUR_SSPR_P_REV 8

CUR_SSPR_P_REV-specific variable

PR_LIST_SIZE - Extended Preferred Roaming List size. 22

This field is set to the total size, in octets, of the Extended 23

Preferred Roaming List, including the PR_LIST_SIZE and 24

PR_LIST_CRC fields. 25

PR_LIST_ID - Preferred Roaming List Identification. 26


Extended Preferred Roaming List identification assigned for 28

the preferred roaming list (PR_LISTs-p) by the base station. 29

CUR_SSPR_P_REV - Protocol revision for the PRL format. 30

This field is used to specify the format of the rest of the 31

Extended Preferred Roaming List. 32

3GPP2 C.S0016-D v2.0

3-107

The format of the Extended Preferred Roaming List associated with the SSPR_P_REV equal 1

to ‘00000011’ has the following format: 2

3

Extended Preferred Roaming List Field

Length (bits)

PR_LIST_SIZE 16

PR_LIST_ID 16

CUR_SSPR_P_REV 8

PREF_ONLY 1

DEF_ROAM_IND 8

NUM_ACQ_RECS 9


NUM_SYS_RECS 14

RESERVED 7

EXT_ACQ_TABLE variable

COMMON_SUBNET_TABLE variable

EXT_SYS_TABLE variable

RESERVED As needed

PR_LIST_CRC 16

4

PR_LIST_SIZE - Preferred roaming list size. 5

This field is set to the total size, in octets, of the preferred 6

roaming list, including the PR_LIST_SIZE and PR_LIST_CRC 7

fields. 8

PR_LIST_ID - Preferred Roaming List Identification. 9




CUR_SSPR_P_REV - Protocol revision of the mobile station SSPR Download 13

procedure and the PRL format. 14

This field is set to the value of the SSPR_P_REV corresponding 15

this preferred roaming list (PR_LISTs-p) structure. This field 16

determines the parsing rules for the Preferred Roaming List. 17

The mobile station shall set this field to ‘00000011’ for this 18

PRL structure. 19

PREF_ONLY - Preferred only. 20

3GPP2 C.S0016-D v2.0

3-108

This field is set to ‘1’ if the mobile station is to operate only on 1

systems that are specified in SYS_TABLE with PREF_NEG set 2

to ‘1’. This field is set to ‘0’ if the mobile station is to operate 3

on systems that are specified in SYS_TABLE with PREF_NEG 4

set to ‘1’ or on systems that are not specified in SYS_TABLE5. 5

DEF_ROAM_IND - Default roaming indication. 6

This field is set to the roaming indication value the mobile 7

station is to use when operating on systems not specified in 8

SYS_TABLE (see [4]TSB58). 9


This field is set to the number of acquisition records 11

contained in ACQ_TABLE (see Table 3.5.5.2-1). 12


- Number of records in the Common Subnet Table. 14

This field is set to the number of records contained in the 15



This field is set to the number of Extended System Records 18

contained in EXT_SYS_TABLE. 19



EXT_ACQ_TABLE - Extended Acquisition Table. 22

This field contains the Extended Acquisition Records. The 23

number of acquisition records is specified by 24

NUM_ACQ_RECS. The Extended Acquisition Record format is 25

specified in 3.5.5.2.2. 26

COMMON_SUBNET_TABLE - 27


This field contains the Common Subnet Records defined in 29

3.5.5.3.2.1. The number of Common Subnetacquisition 30

records is specified by NUM_COMMON_SUBNET_RECS. 31

EXT_SYS_TABLE - Extended System Table. 32

This field contains Extended System Records. The number of 33

Extended system records is specified by NUM_SYS_RECS. 34

The Extended system record format is specified in 3.5.5.3.2. 35


5 For emergency access (911) the mobile station may ignore restrictions set by the PREF_ONLY and

PREF_NEG fields and access any available system.

3GPP2 C.S0016-D v2.0

3-109

This field is populated with ‘0’ bits as necessary to make the 1

length of the entire preferred roaming list equal to an integer 2

number of octets. This field may be extended for future use. 3

The mobile station shall be able to parse the entire Extended 4

PRL even if this field is more than 7 bits. 5

PR_LIST_CRC - CRC for preferred roaming list. 6


3.5.5.1. 8

9

3.5.5.1 Preferred Roaming List CRC Calculation 10

The 16-bit preferred roaming list CRC field PR_LIST_CRC is calculated on all bits of the 11

Preferred Roaming List/Extended Preferred Roaming List excluding the bits of the 12

PR_LIST_CRC field itself. The generator polynomial for this CRC is 13

g(x) = x16

+ x12

+ x5 + x

0. 14

The 16-bit CRC is calculated according to the following procedure using the logic shown in 15

Figure 2.2.1-2: 16

• Initially, all shift register elements are set to logical one and the switches are set in 17

the position A. 18

• The register is clocked with each preferred roaming list bit as an input, from the 19

most significant bit of the PR_LIST_SIZE field through the least significant bit of the 20

RESERVED field. 21

• The switches are set in the position B, and the register is clocked an additional 16 22

times. The 16 additional output bits constitute the CRC. 23

24

3.5.5.2 Acquisition Records 25

An acquisition record contains parameters that the mobile station can use to acquire a 26

system. Each type of acquisition record is tailored for use in acquiring a particular kind of 27

system. 28

Two categories of acquisition records are defined; Acquisition Records and Extended 29

Acquisition Records. Table 3.5.5.2-1 defines the types of Acquisition Records. The 30

Acquisition Records shall be used only in a Preferred Roaming List associated with the 31

SSPR_P_REV equal to ‘00000001’. 32

33

3GPP2 C.S0016-D v2.0

3-110

Table 3.5.5.2-1 Acquisition Record Type Values 1

Acquisition Record Type Value

Reserved ‘0000’

Cellular Analog ‘0001’

Cellular CDMA (Standard Channels) ‘0010’

Cellular CDMA (Custom Channels) ‘0011’

Cellular CDMA Preferred ‘0100’

PCS CDMA (Using Blocks) ‘0101’

PCS CDMA (Using Channels) ‘0110’

JTACS CDMA (Standard Channels) '0111'

JTACS CDMA (Custom Channels) '1000'

2GHz Band (Using Channels) '1001'

Reserved ‘1010’ - ‘1111’

Table 3.5.5.2-2 defines the types of Extended Acquisition Records. The Extended 2

Acquisition Records shall be used only in an Extended Preferred Roaming List associated 3

with the SSPR_P_REV equal to ‘00000011’. 4

5

3GPP2 C.S0016-D v2.0

3-111

Table 3.5.5.2-2 Extended Acquisition Record Type Values 1



Cellular Analog ‘00000001’

Cellular CDMA (Standard Channels) ‘00000010’

Cellular CDMA (Custom Channels) ‘00000011’

Cellular CDMA Preferred ‘00000100’

PCS CDMA (Using Blocks) ‘00000101’

PCS CDMA (Using Channels) ‘00000110’

JTACS CDMA (Standard Channels) '00000111'

JTACS CDMA (Custom Channels) '00001000'

2GHz Band (Using Channels) '00001001'

Generic Acquisition Record for cdma2000 1x and IS-95

‘00001010’

Generic Acquisition Record for HRPD ‘00001011’

Reserved for Obsolete Identification ‘00001100’- ‘00001110’

Common Acquisition table record for UMB ‘00001111’

Generic acquisition record for UMB ‘00010000’

Reserved All other values

2

If ACQ_TABLE contains more than one acquisition record, these records should be listed in 3

priority order (highest priority first) according to the desired mobile station system selection 4

scanning priorities. 5

6

3.5.5.2.1 Acquisition Record Formats 7

3.5.5.2.1.1 Cellular Analog System Acquisition Record 8

This acquisition record type is for use in acquiring a cellular analog system, and has the 9

following fixed length format: 10

11

Acquisition Record Field Length (bits)

ACQ_TYPE (‘0001’) 4

A_B 2

12

ACQ_TYPE - Acquisition record type. 13

3GPP2 C.S0016-D v2.0

3-112

This field is set to ‘0001’ (see Table 3.5.5.2-1). 1

A_B - System A/B selection type. 2

The values for this field are specified in Table 3.5.5.2.1.1-1. 3

4

Table 3.5.5.2.1.1-1 Cellular System A/B Selection Type Values 5

System A/B Selection Type Value

System A ‘00’

System B ‘01’

Reserved ‘10’

System A or B ‘11’

6

3.5.5.2.1.2 Cellular CDMA and JTACS CDMA System Acquisition (Standard Channels) 7

Record 8

This acquisition record type is for use in acquiring a cellular CDMA and JTACS CDMA 9

system on the primary or secondary CDMA channels, and has the following fixed length 10

format: 11

12


ACQ_TYPE (‘0010’) 4

A_B 2

PRI_SEC 2

13





PRI_SEC - Standard CDMA Channel selection type. 18


20

3GPP2 C.S0016-D v2.0

3-113

Table 3.5.5.2.1.2-1 Cellular CDMA and JTACS CDMA Standard Channel Selection 1

Type Values 2

Standard Channel Selection Type

Value

Reserved ‘00’

Primary CDMA Channel ‘01’

Secondary CDMA Channel ‘10’

Primary or Secondary CDMA Channel

‘11’

3

3.5.5.2.1.3 Cellular CDMA and JTACS CDMA System Acquisition (Custom Channels) 4

Record 5

This acquisition record type is for use in acquiring a cellular CDMA and JTACS CDMA 6

system using a list of CDMA channels, and has the following variable length format: 7

8


ACQ_TYPE (‘0011’) 4

NUM_CHANS 5

NUM_CHANS occurrences of the following field:

CHAN 11

9



NUM_CHANS - Number of CDMA channels. 12

This field is set to the number of cellular CDMA and JTACS 13

CDMA channels included in this record. 14

CHAN - Cellular CDMA and JTACS CDMA channel. 15

This field specifies a cellular CDMA and JTACS CDMA 16

channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields 17

should be listed in priority order (highest priority first) 18

according to the desired mobile station system selection 19


21

3GPP2 C.S0016-D v2.0

3-114

3.5.5.2.1.4 Cellular CDMA Preferred System Acquisition Record 1

This acquisition record type is for use in acquiring a cellular system (CDMA first, then 2

Analog), and has the following fixed length format: 3


ACQ_TYPE (‘0100’) 4

A_B 2

4





9

3.5.5.2.1.5 PCS CDMA System Acquisition (Using Blocks) Record 10

This acquisition record type is for use in acquiring a PCS CDMA system using a list of 11

CDMA frequency blocks, and has the following variable length format: 12

13


ACQ_TYPE (‘0101’) 4

NUM_BLOCKS 3

NUM_BLOCKS occurrences of the following field:

BLOCK 3

14



NUM_BLOCKS - Number of frequency blocks. 17

This field is set to the number of PCS frequency blocks 18

included in this record. 19

BLOCK - PCS frequency block. 20


The BLOCK fields should be listed in priority order (highest 22

priority first) according to the desired mobile station system 23

selection scanning priorities. 24

25

3GPP2 C.S0016-D v2.0

3-115

Table 3.5.5.2.1.5-1 PCS CDMA Frequency Blocks 1

PCS CDMA Frequency Block Value

Block A ‘000’

Block B ‘001’

Block C ‘010’

Block D ‘011’

Block E ‘100’

Block F ‘101’

Reserved ‘110’

Any Block ‘111’

2

3.5.5.2.1.6 PCS CDMA and 2 GHz Band CDMA System Acquisition (Using Channels) 3

Record 4

This acquisition record type is for use in acquiring a PCS CDMA and a 2 GHz Band CDMA 5

system using a list of CDMA channels, and has the following variable length format: 6

7


ACQ_TYPE (‘0110’) 4

NUM_CHANS 5


CHAN 11

8




This field is set to the number of PCS CDMA and 2 GHz band 12

CDMA channels included in this record. 13

CHAN - PCS CDMA channel. 14

This field specifies a PCS CDMA and a 2 GHz Band CDMA 15

channel number (see 6.1.1.1 of [1] or [23]). The CHAN fields 16

should be listed in priority order (highest priority first) 17

according to the desired mobile station system selection 18


3GPP2 C.S0016-D v2.0

3-116

3.5.5.2.1.7 JTACS CDMA System Acquisition (Standard Channels) Record 1

This acquisition record type is for use in acquiring a JTACS CDMA system on the primary 2

or secondary CDMA channels, and has the following fixed length format: 3

4


ACQ_TYPE (‘0111’) 4

A_B 2

PRI_SEC 2

5







12

Table 3.5.5.2.1.7-1 JTACS CDMA Standard Channel Selection Type Values 13

Standard Channel Selection Type Value

Reserved ‘00’

Primary CDMA Channel ‘01’

Secondary CDMA Channel ‘10’

Primary or Secondary CDMA Channel ‘11’

14

3.5.5.2.1.8 JTACS CDMA System Acquisition (Custom Channels) Record 15

This acquisition record type is for use in acquiring a JTACS CDMA system using a list of 16

custom CDMA channels, and has the following variable length format: 17

18


ACQ_TYPE (‘1000’) 4

NUM_CHANS 5


CHAN 11

3GPP2 C.S0016-D v2.0

3-117

1




This field is set to the number of JTACS CDMA channels 5


CHAN - JTACS CDMA channel. 7

This field specifies a JTACS CDMA channel number [23]. The 8

CHAN fields should be listed in priority order (highest priority 9

first) according to the desired mobile station system selection 10


12

3.5.5.2.1.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 13

This acquisition record type is for use in acquiring a 2 GHz Band CDMA system using a list 14

of CDMA channels, and has the following variable length format: 15

16


ACQ_TYPE (‘1001’) 4

NUM_CHANS 5


CHAN 11

17




This field is set to the number of 2 GHz Band CDMA channels 21


CHAN - 2 GHz Band CDMA channel. 23

This field specifies a PCS CDMA channel number (see [23]). 24

The CHAN fields should be listed in priority order (highest 25



3GPP2 C.S0016-D v2.0

3-118

3.5.5.2.2 Extended Acquisition Record Format 1

The format of the Extended Acquisition Record is as follows: 2

3

Type-specific Record Length (bits)

ACQ_TYPE 8

LENGTH 8

Type-specific 8 LENGTH


This field is set to the Extended Acquisition Record type (see 5

Table 3.5.5.2-2) and identifies the type-specific fields. 6

LENGTH - Length of the Type-specific fields. 7

This field is set to the length of the Type-specific record in 8

octets. 9

The contents of the type-specific fields determined by the ACQ_TYPE field and are specified 10

as follows. 11

3.5.5.2.2.1 Cellular Analog System Acquisition Record 12

If the ACQ_TYPE field is set to ‘00000001’, the type-specific record specifies the acquisition 13

record for use in acquiring a cellular analog system. The type-specific record has the 14

following fixed-length format: 15

16


A_B 2

RESERVED 6

17





3GPP2 C.S0016-D v2.0

3-119

1

3.5.5.2.2.2 Cellular CDMA System Acquisition (Standard Channels) Record 2


record for use in acquiring a cellular CDMA system on the primary or secondary CDMA 4

channels. The type-specific record has the following fixed-length format: 5

6


A_B 2

PRI_SEC 2

RESERVED 4

7







14

3.5.5.2.2.3 Cellular CDMA System Acquisition (Custom Channels) Record 15


record for use in acquiring a cellular CDMA system using a list of CDMA channels. The 17

type-specific record has the following variable-length format: 18

19


NUM_CHANS 5


CHAN 11

RESERVED 0 to 7

20


This field is set to the number of cellular CDMA channels 22


CHAN - Cellular CDMA channel. 24

3GPP2 C.S0016-D v2.0

3-120

This field specifies a cellular CDMA channel number (see 1

6.1.1.1 of [1] or [23]). The CHAN fields should be listed in 2

priority order (highest priority first) according to the desired 3

mobile station system selection scanning priorities. 4





9

3.5.5.2.2.4 Cellular CDMA Preferred System Acquisition Record 10


record for use in acquiring a cellular system (CDMA first, then Analog). The type-specific 12

record has the following fixed-length format: 13

14


A_B 2

RESERVED 6

15





20

3.5.5.2.2.5 PCS CDMA System Acquisition (Using Blocks) Record 21


record for use in acquiring a PCS CDMA system using a list of CDMA frequency blocks. 23

The type-specific record has the following variable-length format: 24

25


NUM_BLOCKS 3


BLOCK 3

RESERVED 0 to 7

26

NUM_BLOCKS - Number of frequency blocks. 27

3GPP2 C.S0016-D v2.0

3-121

This field is set to the number of PCS frequency blocks 1


BLOCK - PCS frequency block. 3


The BLOCK fields should be listed in priority order (highest 5







12

3.5.5.2.2.6 PCS CDMA System Acquisition (Using Channels) Record 13


record for use in acquiring a PCS CDMA system using a list of CDMA channels. The type-15

specific record has the following variable-length format: 16

17


NUM_CHANS 5


CHAN 11

RESERVED 0 to 7

18


This field is set to the number of PCS CDMA channels 20


CHAN - PCS CDMA channel. 22

This field specifies a PCS CDMA channel number (see 6.1.1.1 23

of [1] or [23]). The CHAN fields should be listed in priority 24

order (highest priority first) according to the desired mobile 25

station system selection scanning priorities. 26





3GPP2 C.S0016-D v2.0

3-122

3.5.5.2.2.7 JTACS CDMA System Acquisition (Standard Channels) Record 1


record for use in acquiring a JTACS CDMA system on the primary or secondary CDMA 3

channels. The type-specific record has the following fixed-length format: 4

5


A_B 2

PRI_SEC 2

RESERVED 4







12

3.5.5.2.2.8 JTACS CDMA System Acquisition (Custom Channels) Record 13


record for use in acquiring a JTACS CDMA system using a list of custom CDMA channels. 15


17


NUM_CHANS 5


CHAN 11

RESERVED 0 to 7

18


This field is set to the number of JTACS CDMA channels 20


CHAN - JTACS CDMA channel. 22

3GPP2 C.S0016-D v2.0

3-123

This field specifies a JTACS CDMA channel number [23]. The 1

CHAN fields should be listed in priority order (highest priority 2

first) according to the desired mobile station system selection 3






3.5.5.2.2.9 2 GHz Band CDMA System Acquisition (Using Channels) Record 9


record for use in acquiring a 2 GHz Band CDMA system using a list of CDMA channels. 11


This acquisition record type is for use in acquiring, and has the following variable length 13

format: 14

15


NUM_CHANS 5


CHAN 11

RESERVED 0 to 7

16


This field is set to the number of 2 GHz Band CDMA channels 18


CHAN - 2 GHz Band CDMA channel. 20

This field specifies a PCS CDMA channel number (see [23]). 21

The CHAN fields should be listed in priority order (highest 22







3.5.5.2.2.10 Generic Acquisition Record for cdma2000 1x and IS-95 29


record for use in acquiring cdma2000 1x and IS-95 systems using band-class and channel 31

number [23]. The type-specific record has the following variable-length format: 32

3GPP2 C.S0016-D v2.0

3-124


format: 2

3


LENGTH/2 occurrences of the following two fields:

BAND_CLASS 5

CHANNEL_NUMBER 11

BAND_CLASS - This field is set to the Band Class number corresponding to 4

the frequency assignment of the channel specified by this 5

record. 6

CHANNEL_NUMBER - This field is set to the channel number corresponding to the 7

Band Class specified by this record. 8

3.5.5.2.2.11 Generic Acquisition Record for HRPD 9


record for use in acquiring HRPD systems using band-class and channel number. The 11

type-specific record has the following variable-length format: 12


format: 14

15


LENGTH/2 occurrences of the following two fields:

BAND_CLASS 5

CHANNEL_NUMBER 11



record. 18



3.5.5.2.2.12 Reserved for Obsolete Identification Record Types 21

A base station should not set the ACQ_TYPE field to ‘00001100’, ‘00001101’, or 22

‘00001110’. A mobile station that receives an acquisition record with the ACQ_TYPE field 23

set to ‘00001100’, ‘00001101’, or ‘00001110’ should ignore the acquisition record. 24

3.5.5.2.2.13 Common Acquisition Table Record for UMB 25

If the ACQ_TYPE field is set to ‘00001111’, the type-specific record specifies the Common 26

Acquisition Table Record for UMB that is referenced by a Generic Acquisition Record for 27

UMB. Only one Common Acquisition Table Record for UMB, at most, shall be allowed. A 28

Common Acquisition Table Record for UMB shall be required if there is a Generic 29

3GPP2 C.S0016-D v2.0

3-125

Acquisition Record for UMB with a UMB_ACQ_TABLE_PROFILE (see 3.5.5.2.2.13 Generic 1

Acquisition Record for UMB) other than ‘111111’. The type-specific record has the 2

following variable-length format: 3

4


LENGTH/2 occurrences of the following fields:

UMB_ACQ_PROFILE 6

FFT_SIZE 4

CYCLIC_PREFIX_LENGTH 3

NUM_GUARD_SUBCARRIERS 7

RESERVED 0 to 7

5

UMB_ACQ_PROFILE - UMB Acquisition Profile. 6

This field is set to a unique 6-bit number that specifies a set 7

of UMB acquisition fields (one FFT_SIZE field, one 8

CYCLIC_PREFIX_LENGTH field and one 9

NUM_GUARD_SUBCARRIERS field). UMB_ACQ_PROFILE is 10

used by the Generic Acquisition Record for UMB for specifying 11

the set of acquisition parameters. 12

The value ‘111111’ is reserved. 13

The UMB_ACQ_PROFILE entries in the Common Acquisition 14

Table Record for UMB should be listed in order of increasing 15

UMB_ACQ_PROFILE values. 16

FFT_SIZE - Fast Fourier Transform Size. 17

This field shall be set to log2(N_FFT/128), where N_FFT is the 18

FFT size used by the UMB system [27]. 19

The value ‘1111’ denotes any FFT_SIZE (i.e. serves as a 20

wildcard for FFT_SIZE). 21

CYCLIC_PREFIX_LENGTH 22

- This field shall be set to one less than the NCP parameter 23

defined in the UMB Physical Layer [27]. Note that the UMB 24

Physical Layer defines cyclic prefix as NCPNFFTTCHIP/16 25

seconds long. 26

The value ‘111’ denotes any CYCLIC_PREFIX_LENGTH (i.e. 27

serves as a wildcard for CYCLIC_PREFIX_LENGTH). 28

NUM_GUARD_SUBCARRIERS 29

- Number of Guard Subcarriers 30

This field shall be set to the number of guard subcarriers 31

used in the UMB system [27], in units of 16. 32

3GPP2 C.S0016-D v2.0

3-126

The value ‘1111111’ denotes any 1

NUM_GUARD_SUBCARRIERS (i.e. serves as a wildcard for 2

NUM_GUARD_SUBCARRIERS). 3

RESERVED - Reserved bits 4




8

3.5.5.2.2.14 Generic Acquisition Record for UMB 9


record for use in acquiring a UMB system [27]. If the UMB_ACQ_TABLE_PROFILE 11

(described below) is set to a value other than ‘111111’, then the Generic Acquisition Record 12

for UMB shall reference the Common Acquisition Table Record for UMB. The type-specific 13

record has the following variable-length format: 14

15


NUM_UMB_BLOCKS 6

NUM_UMB_BLOCKS occurrences of the following fields:

BAND_CLASS 8

CHANNEL_NUMBER 16

UMB_ACQ_TABLE_PROFILE 6

RESERVED 0 to 7

16

NUM_UMB_BLOCKS - Number of UMB Blocks. 17

- This field is set to the number of UMB blocks included in this 18

record. 19

NUM_UMB_BLOCKS occurrences of the following four fields shall be included. The UMB 20

block fields should be listed in priority order (highest priority first) according to the desired 21

mobile station system selection scanning priorities. 22

23



record. 26



The value 0xFFFF‘0xffff’ denotes any CHANNEL_NUMBER (i.e. 29

serves as a wildcard for CHANNEL_NUMBER). 30

3GPP2 C.S0016-D v2.0

3-127

UMB_ACQ_TABLE_PROFILE 1

- UMB Acquisition Table Profile 2

This field shall be set to the value of the UMB_ACQ_PROFILE 3

in the Common Acquisition Record for the desired set of UMB 4

acquisition fields in the Common Acquisition Table Record for 5

UMB. 6

The value ‘111111’ indicates that the Common Acquisition 7

Table Record for UMB can be ignored. 8





13

3.5.5.3 System Record and Extended System Record Format 14

A system record contains parameters that the mobile station can use for identifying an 15

acquired system, for determining whether an acquired system is the optimal system on 16

which to operate and for determining the mobile station’s roaming status. 17

Two categories of system records are defined: System Records and Extended System 18

Records. A System Record defined in section 3.5.5.3.1 shall be included only in a Preferred 19

Roaming List associated with the SSPR_P_REV equal to ‘00000001’. An Extended System 20

Record defined in section 3.5.5.3.2 shall be included only in an Extended Preferred 21

Roaming List associated with the SSPR_P_REV equal to or greater than ‘00000011’. 22

3.5.5.3.1 System Record Format 23

Each System Record has the following variable length format: 24

25

System Record Field Length (bits)

SID 15

NID_INCL 2

NID 0 or 16

PREF_NEG 1

GEO 1

PRI 0 or 1

ACQ_INDEX 9

ROAM_IND 0 or 8

26


This field is set to the SID of the system associated with this 28

record. 29

3GPP2 C.S0016-D v2.0

3-128

The value ‘000000000000000’ denotes a system with any SID 1

(i.e., serves as a SID wildcard) not specifically included 2

elsewhere in SYS_TABLE, provided that the system is found 3

on a channel or in a block specified in the acquisition record 4

corresponding to ACQ_INDEX. Any other value of this field 5

denotes a system with that specific SID found on any 6

channel. 7

NID_INCL - NID included. 8

This field is set to the value defined in Table 3.5.5.3-1. 9

Table 3.5.5.3-1 NID_INCL Values 10

NID_INCL Value Parameter Description

‘00’ NID not included. Assume NID value ‘1111111111111111’

‘01’ NID included


‘11’ Reserved

11


If the NID_INCL field of this record is equal to ‘01’, this field is 13

included and is set to the NID of the network associated with 14

this record; otherwise, this field is omitted. 15

The value ‘1111111111111111’ denotes any NID (i.e., serves 16

as a NID wildcard). Not including the NID field is equivalent 17

to including it and setting it to ‘1111111111111111’. 18

The value ‘0000000000000000’ denotes a NID of the public 19

system (see 6.6.5.2 of [1] or 2.6.5.2 of [1]) 20

PREF_NEG - Preferred/negative system. 21

This field is set to ‘1’ if the mobile station is allowed to operate 22

on the system associated with this record. This field is set to 23

‘0’ if the mobile station is not allowed to operate on the 24

system associated with this record. 25

GEO - Geographical region indicator. 26

If this is the first system record, this field is set to ‘0’. 27

If this is not the first system record, then this field is set as 28

follows: If the system associated with this record is in the 29

same geographical region as the system associated with the 30

previous system record, this field is set to ‘1’; otherwise, this 31

field is set to ‘0’. 32

PRI - Relative priority indicator. 33

3GPP2 C.S0016-D v2.0

3-129

If the PREF_NEG field of this system record is equal to ‘0’, this 1

field is omitted; otherwise this field is included and is set as 2

follows: 3

If this is the last system record in the specific geographical 4

region, or if the PREF_NEG field in the next system record is 5

equal to’0’, this field is set to ‘0’ and has no meaning. 6

If the system associated with this system record is more 7

desirable than the system associated with the next system 8

record, this field is set to ‘1’. 9

If the system associated with this system record is as 10

desirable as the system associated with the next system 11


ACQ_INDEX - Acquisition record index. 13

This field is set to the index of the acquisition record that 14

specifies the acquisition parameters for the system associated 15

with this record. 16

Note: The index of the nth acquisition record is n-1. For 17

example, the index of the first acquisition record in 18

ACQ_TABLE is 0, and the index for the fourth acquisition 19

record is 3. 20

ROAM_IND - If the PREF_NEG field of this record is equal to ‘1’, this field is 21

included and is set to the roaming indication value (see [4]) 22

for the system associated with this record; otherwise, this 23

field is omitted. 24

3.5.5.3.2 Extended System Record Format 25

Each Extended System Record has the following variable length format: 26

27


SYS_RECORD_LENGTH 5

SYS_RECORD_TYPE 4

SYS_RECORD_TYPE specific fields

variable

28

SYS_RECORD_LENGTH - Extended System Record Length. 29

This field is set to the length of the Extended System Record 30

in octets. 31

SYS_RECORD_TYPE - Extended System Record Type. 32

The value of this field specifies the format of the rest of this 33

record. 34

3GPP2 C.S0016-D v2.0

3-130

The following table specifies the format of the Extended System Record for the values of the 1

SYS_RECORD_TYPE specified in Table 3.5.5.3.2-1. All other values for the 2

SYS_RECORD_TYPE are reserved. 3

4


SYS_RECORD_LENGTH 5

SYS_RECORD_TYPE 4

PREF_NEG 1

GEO 1

PRI 1

ACQ_INDEX 9

Type-specific system ID record variable

ROAM_IND 0 or 8

ASSOCIATION_INC 1

ASSOCIATION_TAG 0 or 8

PN_ASSOCIATION 0 or 1

DATA_ASSOCIATION 0 or 1

RESERVED 0 to 7

5

SYS_RECORD_LENGTH - Extended System Record Length. 6

This field is set to the length of the Extended System Record 7

in octets. 8

SYS_RECORD_TYPE - Extended System Record Type. 9

This field is set to the type of this Extended System Record 10

(see Table 3.5.5.3.2-1). 11

Table 3.5.5.3.2-1 Type-specific system ID record 12

SYS_RECORD_TYPE Parameter Description

‘0000’ cdma2000 1x and IS-95 Systems

‘0001’ HRPD System

‘0010’ Reserved for Obsolete Identification

‘0011’ MCC-MNC based System Record

‘0100’ - ‘1111’ Reserved

A base station should not set the SYS_RECORD_TYPE field to 13

‘0010’. A mobile station that receives a record with the 14

SYS_RECORD_TYPE field set to ‘0010’ should ignore the 15

record. 16

3GPP2 C.S0016-D v2.0

3-131

PREF_NEG - Preferred/negative system. 1


on the system associated with this record. This field is set to 3

‘0’ if the mobile station is not allowed to operate on the 4

system associated with this record. 5

GEO - Geographical region indicator. 6

If this is the first system record, this field is set to ‘0’. 7

If this is not the first system record, then this field is set as 8

follows: If the system associated with this record is in the 9

same geographical region as the system associated with the 10

previous system record, this field is set to ‘1’; otherwise, this 11

field is set to ‘0’. 12

PRI - Relative priority indicator. 13

This field is set as follows: 14

If this is the last system record in the specific geographical 15

region, or if the PREF_NEG field in the next system record is 16

equal to‘0’, this field is set to ‘0’ and has no meaning. 17

If the system associated with this system record is more 18

desirable than the system associated with the next system 19


If the system associated with this system record is as 21

desirable as the system associated with the next system 22


ACQ_INDEX - Acquisition record index. 24

This field is set to the index of the acquisition record that 25

specifies the acquisition parameters for the system associated 26

with this record. 27

Note: The index of the nth acquisition record is n-1. For 28

example, the index of the first acquisition record in 29

ACQ_TABLE is 0, and the index for the fourth acquisition 30

record is 3. 31





36

The type-specific system ID record is set according to the value of the SYS_RECORD_TYPE 37

field as follows: 38

If the SYS_RECORD_TYPE is set to ‘0000’, the type-specific system ID is as specified in 39

Table 3.5.5.3.2-2: 40

3GPP2 C.S0016-D v2.0

3-132

Table 3.5.5.3.2-2 Type-specific system ID record 1

System ID Record Field Length (bits)

RESERVED 1

NID_INCL 2

SID 15

NID 0 or 16


This field shall be set to ‘0’. 3

NID_INCL - NID included. 4

This field is set to the value defined in Table 3.5.5.3.2-3. 5

6

Table 3.5.5.3.2-3 NID_INCL Values 7

NID_INCL Value Parameter Description


‘01’ NID included


‘11’ Reserved

8



record. 11

The value ‘000000000000000’ denotes a system with any SID 12

(i.e., serves as a SID wildcard) not specifically included 13

elsewhere in SYS_TABLE, provided that the system is found 14

on a channel or in a block specified in the acquisition record 15

corresponding to ACQ_INDEX. Any other value of this field 16

denotes a system with that specific SID found on any 17

channel. 18


If the NID_INCL field of this record is equal to ‘01’, this field is 20

included and is set to the NID of the network associated with 21

this record; otherwise, this field is omitted. 22

The value ‘1111111111111111’ denotes any NID (i.e., serves 23

as a NID wildcard). Not including the NID field is equivalent 24

to including it and setting it to ‘1111111111111111’. 25

The value ‘0000000000000000’ denotes a NID of the public 26

system (see 6.6.5.2 of [1]) 27

3GPP2 C.S0016-D v2.0

3-133


Table 3.5.5.3.2-4: 2

Table 3.5.5.3.2-4 Type-specific System ID Record 3


RESERVED 3

SUBNET_COMMON_INCLUDED 1

SUBNET_LSB_LENGTH 7

SUBNET_LSB SUBNET_LSB_LENGTH

SUBNET_COMMON_OFFSET 0 or 12

4



SUBNET_COMMON_INCLUDED 7

- Common part of the HRPD subnet included indicator. 8

This field is set to ‘1’ if the SUBNET_COMMON_OFFSET field 9

is included. Otherwise this field is set to ‘0’. 10

SUBNET_LSB_LENGTH - This field is set to the length of the least significant bits of the 11

HRPD subnet. If SUBNET_COMMON_INCLUDED is set to ‘0’, 12

this field is set to the length of the HRPD subnet associated 13

with this system record. 14

SUBNET_LSB - This field is set to the least significant bits of the HRPD 15

subnet of length specified by SUBNET_LSB_LENGTH. If 16

SUBNET_COMMON_INCLUDED is set to ‘0’, this field is set to 17

the entire HRPD subnet associated with this system record. 18

SUBNET_COMMON_OFFSET 19

- Common part of the HRPD subnet. 20

If included, this field is set to the offset into the Common 21

Subnet Table (see Table 3.5.5.3.2.1-1), in octets, that specifies 22

the most significant bits of the subnet associated with this 23

system record (e.g., a value of zero for this field points to the 24

beginning of the Common Subnet Table). 25

ROAM_IND - If the PREF_NEG field of this record is equal to ‘1’, this field is 26

included and is set to the roaming indication value (see 27

[4]TSB58) for the system associated with this record; 28

otherwise, this field is omitted. 29

ASSOCIATION_INC - Association tag included flag. 30

This field is set to ‘1’ if the next three fields are included. 31

Otherwise, this field is set to ‘0’. 32

3GPP2 C.S0016-D v2.0

3-134

ASSOCIATION_TAG - If included, this field is set to the 8-bit number that specifies 1

the set to which this system record belongs. The value of the 2

ASSOCIATION_TAG field is only unique within a GEO. The 3

set is defined as a set of systems (specified by the system 4

records) for which at least one the following two conditions 5

hold: 6

The members of the set have the same PN offset assignment (i.e., collocated), or 7

The members of the set can reach the same set of PDSNs (i.e., associated). 8

PN_ASSOCIATION - PN association flag. 9

This field is only included if the ASSOCIATION_INC field is set 10

to ‘1’. If included, this field shall be set to ‘1’ if the system 11

identified by this system record has the same PN assignment 12

as other systems in the same GEO that are members of the 13

set identified by ASSOCIATION_TAG and whose 14

PN_ASSOCIATION field is also set to ‘1’. Otherwise, this field 15

shall be set to ‘0’. 16

DATA_ASSOCIATION - Data association flag. 17

This field is only included if the ASSOCIATION_INC field is set 18

to ‘1’. If included, this field shall be set to ‘1’ if the system 19

identified by this system record can reach the same set of 20

PDSNs as other systems in the same GEO that are members 21

of the set identified by ASSOCIATION_TAG and whose 22

DATA_ASSOCIATION field is also set to ‘1’. Otherwise, this 23

field shall be set to ‘0’. 6 24





29

6 The mobile station may use the value of this field to limit the set of systems in the GEO that it

should attempt to acquire. For example, the mobile station may choose to only acquire systems that

can reach the same set of PDSNs (in order to avoid establishing two separate PPP session).

3GPP2 C.S0016-D v2.0

3-135

3.5.5.3.2.1 Common Subnet Table for the HRPD Extended System Record 1

The Common Subnet Table for the HRPD Extended System Record consists of records with 2

the following format: 3

Table 3.5.5.3.2.1-1 Common Subnet Record 4


RESERVED 4

SUBNET_COMMON_LENGTH 4

SUBNET_COMMON 8 SUBNET_COMMON_LENGTH

5




- Length of the common part of the HRPD subnet. 9

This field is set to the length of the most significant bits of the 10

HRPD subnet which is included in this record. 11

SUBNET_COMMON - Common part of the HRPD subnet. 12

This field is set to the most significant bits of the HRPD 13

subnet which is included in this record. 14

3.5.5.3.2.2 Type-specific System ID Record of type ‘0011’ 15


Table 3.5.5.3.2.2-1: 17

Table 3.5.5.3.2.2-1 Type-specific system ID record 18


SYS_RECORD_SUBTYPE 3

Subtype dependent field Variable

SYS_RECORD_SUBTYPE - This field shall determine the format of this record, as shown 19

in the following table. 20

3GPP2 C.S0016-D v2.0

3-136

Table 3.5.5.3.2.2-2 SYS_RECORD_SUBTYPE Values 1

SYS_RECORD_SUBTYPE

Parameter Description

‘000’ MCC, MNC Only

‘001’ MCC, MNC and multiple SIDs

‘010’ MCC, MNC and multiple SIDs, NIDs included

‘011’ MCC, MNC and multiple Subnet IDs

All other values Reserved

2

Subtype dependent record- This field shall be set as per the value of 3

SYS_RECORD_SUBTYPE. 4

5

Subtype dependent record for Subtype ‘000’ 6

Table 3.5.5.3.2.2-3 Subtype Dependent record for Subtype ‘000’ 7

Field Name Length (bits)

MCC 12

MNC 12

MCC - This field shall be set to the Mobile Country Code of the 8

system using BCD encoding. 9

MNC - This field shall be set to the Mobile Network Code of the 10

system using BCD encoding. If the length of the MNC is two 11

digits, the least significant digit is encoded with 0xF‘F’. For 12

example, MNC=23 is set to 0x23F‘23F’ [31]. 13

14




MCC 12

MNC 12

RESERVED 4

NUM_SID 4

NUM_SID occurrences of the following field

RESERVED 1

SID 1516

MCC - Mobile Country Code. 17

3GPP2 C.S0016-D v2.0

3-137

This field shall be set to the Mobile Country Code of the 1


MNC - Mobile Network Code. 3

This field shall be set to the Mobile Network Code of the 4






NUM_SID - Number of SID values. 10

The number of SID values following this field. 11





record. 16

17




MCC 12

MNC 12

RESERVED 4

NUM_SID_NID 4

NUM_SID_NID occurrences of the following two fields

RESERVED 1

SID 1516

NID 16

20










3GPP2 C.S0016-D v2.0

3-138


NUM_SID_NID - Number of SID and NID values 2

The number of SID and NID values following this field. 3





record. 8


This field is set to the NID of the system associated with this 10

record. 11

12




MCC 12

MNC 12

RESERVED 4

NUM_SUBNET_ID 4

NUM_SUBNET_ID occurrences of the following threetwo fields:

SUBNET_LENGTH 8

SUBNET_ID SUBNET_LENGTH

RESERVED 0 to 7

RESERVED 0 or 4

15











3GPP2 C.S0016-D v2.0

3-139

NUM_SUBNET_ID - Number Subnet ID. 1

The number of Subnet ID values following this field. 2

SUBNET_LENGTH - Subnet ID Length. 3

This field specifies the length of the Subnet ID. The 4

maximum SUBNET_LENGTH is 128. The values '10000001' 5

(129) to ‘11111111’ (255) shall be reserved. Note: when the 6

SUBNET_LENGTH is 128, the SUBNET_ID is equivalent to the 7

SECTOR_ID. 8

SUBNET_ID - Subnet ID. 9

This field is set to the SUBNET_ID. 10

SUBNET_COMMON_LENGTH - Length of the common part of the HRPD subnet. 11


HRPD subnet which is included in this record. The maximum 13

SUBNET_COMMON_LENGTH is 128. The values '10000001' 14


SUBNET_COMMON_LENGTH is 128, the SUBNET_ID is 16

equivalent to the SECTOR_ID. 17


This field is set to the most significant bits of the HRPD 19

subnet which is included in this record. 20



to make the combined length of SUBNET_LENGTH to 23

RESERVED in each set of the three fields this subtype 24

dependent record the entire parameter block equal to an 25


3.5.6 PUZL Parameter Blocks 27

Table 3.5.6-1 lists the types of parameter blocks used in the PUZL Configuration Request 28

Message and the PUZL Configuration Response Message. 29

3GPP2 C.S0016-D v2.0

3-140

Table 3.5.6-1. PUZL Parameter Block Types 1

PUZL Parameter Block Type BLOCK_ID Reference

PUZL Dimensions ‘00000000’ 3.5.6.1

PUZL Priorities ‘00000001’ 3.5.6.2

User Zone ‘00000010’ 3.5.6.3

Preferred User Zone List ‘00000011’ 3.5.6.4

Reserved for future standardization ‘00000100’

through

‘01111111


‘10000000’

through

‘11111110’

See [4]


2

3GPP2 C.S0016-D v2.0

3-141

3.5.6.1 PUZL Dimensions Parameter Block 1

The PARAM_DATA field of the PUZL Dimensions Parameter Block consists of the following 2

fields: 3

4

Field Length (bits)

UZ_LIST_ID 16

CUR_PUZL_P_REV 8

MAX_UZ_LIST_SIZE 24

CUR_UZ_LIST_SIZE 24

MAX_NUM_UZ 12

CUR_NUM_UZ 12

UZ_MAX_SIZE 12

UZ_ORIG_ONLY 1

UZ_TEMP_SUBSC 1

MANUAL_UPDATE_ALLOWED 1

MANUAL_ACQ_ALLOWED 1

PUZL_PRL_RELATIVE_PRIORITY 1

PREF_ONLY 1

UZ_DISP_IND 8

UZ_CIRCLE_FLAG 1

UZ_POLYGON_FLAG 1

UZ_LINEAR_FLAG 1

UZ_TYPE1_FLAG 1

UZ_TYPE2_FLAG 1

UZ_TYPE3_FLAG 1

UZ_TYPE4_FLAG 1

UZ_TYPE5_FLAG 1

UZ_TYPE6_FLAG 1

RESERVED 5

5

UZ_LIST_ID - User Zone List Identifier 6


Preferred User Zone List Identification assigned for the 8

preferred user zone list (PUZLs-p) by the base station. 9

3GPP2 C.S0016-D v2.0

3-142

CUR_PUZL_P_REV - Protocol revision of the mobile station’s current prefered user 1

zone list 2


PUZL_P_REV associated with its current preferred user zone 4

list (PUZLs-p). 5

MAX_UZ_LIST_SIZE - Maximum preferred user zone list size. 6



user zone list (PUZLs-p). 9

CUR_UZ_LIST_SIZE - Current preferred user zone list size. 10


the current preferred user zone list. 12

MAX_NUM_UZ - Maximum number of User Zone entries. 13


number of user zone entries that the mobile station can 15

support. 16

CUR_NUM_UZ - Current number of User Zone entries. 17

The mobile station shall set this field to the number of user 18

zone entries currently stored in the preferred user zone list in 19


UZ_MAX_SIZE - Maximum User Zone Size. 21

The mobile station shall set this field to the maximum user 22

zone size, in octets, it can support. 23

UZ_ORIG_ONLY - User Zone Origination Only Flag. 24

The mobile station shall set this field corresponding to its 25

current setting to indicate whether or not the mobile station is 26

permitted to originate calls only when within the serving area of 27

a currently assigned User Zone. If call origination is only 28

allowed within an assigned user zone, UZ_ORIG_ONLY = ‘1’; 29

otherwise, UZ_ORIG_ONLY = ‘0’. 30

UZ_TEMP_SUBSC - User Zone Temporary Subscription Flag. 31


current setting to indicate whether or not it is permitted to 33

access User Zones that offer temporary subscription. If 34

allowed, UZ_TEMP_SUBSC = ‘1’; otherwise, UZ_TEMP_SUBSC 35

= ‘0’. 36

MANUAL_UPDATE_ALLOWED - Manual Update Allowed Flag. 37

When set to ‘1’, this field indicates that manual updates are 38

allowed in this database allowing the user to add records, and 39

modify or delete the records added by the user in the 40

database. 41

When set to ‘0’ this field indicates no manual updates are 42

allowed in this database. 43

3GPP2 C.S0016-D v2.0

3-143

MANUAL_ACQ_ALLOWED - Manual Acquisition Allowed Flag. 1

When set to ‘1’, this field indicates that the user is allowed to 2

manually initiate scan and acquisition of an access point. 3

When set to ‘0’, this field indicates that the user is not allowed 4

to initiate manual scan looking for available systems. 5

PUZL_PRL_RELATIVE_PRIORITY - PUZL PRL Relative Priority flag. 6

When set to ‘1’, this field indicates PUZL takes precedence 7

over PRL. When determining the sequencing of the 8

bands/frequencies to scan applied along with the other 9

techniques, the mobile shall provide a higher priority to the 10

PUZL entries compared to the PRL entries. 11

When set to ‘0’, this field indicates PRL takes precedence over 12

PUZL. When determining the sequencing of the 13



PRL entries compared to the PUZL entries. 16

PREF_ONLY - Preferred only flag. 17

When set to ‘1’ this field indicates that when the mobile 18

station performs scans based on PUZL, the mobile station is 19

restricted to acquire only those valid systems identified in 20

PUZL. 21


station performs scans based on PUZL, it may acquire valid 23

systems identified in PUZL and other systems not identified in 24

PUZL. 25

UZ_DISP_IND - User Zone Display Indicator 26

The mobile station shall set this field to the value of the action 27

for displaying the default UZ indicator on the mobile station’s 28

display if this feature is supported by the MS. The value 29

assignments are defined in [4]. 30

UZ_CIRCLE_FLAG - User Zone Circle Flag. 31


capability to support the Circle User Zone Type. If supported, 33

UZ_CIRCLE_FLAG = ‘1’; otherwise, UZ_CIRCLE_FLAG = ‘0’. 34

UZ_POLYGON_FLAG - User Zone Polygon Flag. 35


capability to support the Polygon User Zone Type. If 37

supported, UZ_POLYGON_FLAG = ‘1’; otherwise, 38

UZ_POLYGON_FLAG = ‘0’. 39

UZ_LINEAR_FLAG - User Zone Segmented Linear Flag. 40


capability to support the Segmented Linear User Zone Type. If 42

supported, UZ_LINEAR_FLAG = ‘1’; otherwise, 43

UZ_LINEAR_FLAG = ‘0’. 44

UZ_TYPE1_FLAG - User Zone Type 1 Flag. 45

3GPP2 C.S0016-D v2.0

3-144


capability to support the User Zone Type 1: Broadcast – RF 2

Coverage Based User Zone Type. If supported, 3

UZ_TYPE1_FLAG = ‘1’; otherwise, UZ_TYPE1_FLAG = ‘0’. 4



capability to support the User Zone Type 2: Broadcast – Geo-7

Based User Zone Type. If supported, UZ_TYPE2_FLAG = ‘1’; 8

otherwise, UZ_TYPE2_FLAG = ‘0’. 9



capability to support the User Zone Type 3: Mobile Specific – 12

RF Coverage Based - Overhead Parameter Determined User 13

Zone Type. If supported, UZ_TYPE3_FLAG = ‘1’; otherwise, 14

UZ_TYPE3_FLAG = ‘0’. 15




Geo-Based User Zone Type. If supported, UZ_TYPE4_FLAG = 19

‘1’; otherwise, UZ_TYPE4_FLAG = ‘0’. 20



capability to support the User Zone Type 5: Mobile Specific - 23

Geo Based - Separate Carrier User Zone Type. If supported, 24





RF Coverage and Geo-Based – User Zone Type. If supported, 29




33

3GPP2 C.S0016-D v2.0

3-145

3.5.6.2 PUZL Priorities Parameter Block 1

The PARAM_DATA field of the PUZL Priorities Parameter Block consists of the following 2

fields: 3

4

Field Length (bits)

LAST_SEGMENT 1

SEGMENT_SEQ 16

NUM_UZ_ENTRIES 8

NUM_UZ_ENTRIES occurrences of the following three parameters:

UZ_ID 16

UZ_SID 15

UZ_PRIORITY 4


RESERVED 0 to 7

5


The mobile station shall set this field to ‘1’ if this parameter 7

block contains the user zone ID, SID and priority information 8

for the last entry of the current preferred user zone list 9

(PUZLs-p); otherwise, the mobile station shall set this field to 10

‘0’. 11

SEGMENT_SEQ - Segment sequence number. 12

The base station shall set this field to the sequence number of 13

each segment starting from ‘0000000000000000’ with the 14

sequence number incremented by 1 for each subsequent 15

segment. 16

NUM_UZ_ENTRIES - Number of User Zone Entries. 17


zone entries included in the parameter block. 19

If UZ_ID and UZ_SID are not present in PUZL, then the 20

mobile station shall set this field to zero. No UZ_ID, UZ_SID 21

and UZ_PRIORITY fields shall be included. 22





3.5.1.13-1. 27


3GPP2 C.S0016-D v2.0

3-146




UZ_PRIORITY - User Zone priority. 4

This field indicates the priority level of a user zone. When 5

more than one UZ is available, the UZ with the highest 6

priority that is not NULLUZ_PRIORITY takes precedence. A lower 7

value indicates a higher priority; that is UZ_PRIORITY='0000' 8

has a higher priority than UZ_PRIORITY='0001'. A priority of 9

NULLUZ_PRIORITY indicates that a User Zone is for manual 10

selection only. 11

12

Note: UZ_PRIORITY is not unique; two or more UZs can have 13

the same priority. 14



priority takes precedence. A priority of null NULLUZ_PRIORITY 17

indicates that a User Zone is for manual selection only. A 18

mobile station will never automatically select a User Zone of 19

priority ‘null’ unless initiated manually by the user. Note: 20

UZ_PRIORITY is not unique; two or more UZs can have the 21

same priority that the value of User Zone Priority is non-22

exclusive. 23

A lower value indicates a higher priority, that is 24

UZ_PRIORITY='0000' has a higher priority than 25

UZ_PRIORITY='0001'. And NULL is indicated by 26

UZ_PRIORITY = '1111'. 27

28


The mobile station shall add reserved bits in order to make 30

the length of the entire parameter block equal to an integer 31

number of octets. The mobile station shall set these bits to 32

‘0’. 33

34

3.5.6.3 User Zone Parameter Block 35

The PARAM_DATA field of the User Zone Parameter Block consists of the following fields: 36

37

3GPP2 C.S0016-D v2.0

3-147

Field Length (bits)

UZ_ID 16

UZ_SID 15

LAST_SEGMENT 1

SEGMENT_SEQ 16

SEGMENT_SIZE 8

SEGMENT_DATA 8 × SEGMENT_SIZE

1





3.5.1.13-1. 6







contains the last octet of the user zone entry; otherwise, the 13

mobile station shall set this field to ‘0’. 14


The mobile station shall set this field to the sequence number 16

of each segment starting from ‘00000000’ with the sequence 17

number incremented by 1 for each subsequent segment. 18



of the user zone entry included in SEGMENT_DATA. 21

SEGMENT_DATA - Segment of the specified user zone entry of the PUZL. 22

Refer to Section 3.5.7. 23

24

3.5.6.4 Preferred User Zone List Parameter Block 25

The PARAM_DATA field of the Preferred User Zone List Parameter Block consists of the 26


28

3GPP2 C.S0016-D v2.0

3-148

Field Length (bits)

NUM_ENTRIES 8

NUM_ENTRIES occurrences of the following:

RESERVED 7

LAST_SEGMENT 1

SEGMENT_SEQ 16

SEGMENT_SIZE 8

SEGMENT_DATA 8 × SEGMENT_SIZE

1

NUM_ENTRIES - Number of User Zone entries. 2


zone entries included in the parameter block. 4









each segment starting from ‘00000000’ with the sequence 13




of the user zone entry included in SEGMENT_DATA. 17

SEGMENT_DATA - Segment of the PUZL data for Preferred User Zone List 18

Parameter Block. 19

Refer to Section 3.5.7 for more details. 20

21

3.5.7 Preferred User Zone List (PUZL) 22

The Preferred User Zone List (PUZLS-P) provides the mobile station with the priority and 23

characteristics of the User Zones to which the mobile station is subscribed. The relative 24

priority between the PUZL and the PRL databases is used to determine the scan sequence 25

Based on the relative priority between the PUZL and PRL databases entries, the mobile may 26

determine the scan sequence along with other techniques in performing system acquisition. 27

Once a mobile station has found its preferred system, the PUZL is used to select the most 28

preferred User Zone on that system. It should be noted that PUZL could have up to 4095 29

User Zone entries. A User Zone entry includes all of the information associated with the 30

3GPP2 C.S0016-D v2.0

3-149

definition of a single user zone that is uniquely identified by the combination of User Zone ID 1

and User Zone SID. 2

The following sections define the parameters that are stored in the PUZL: 3

4

3GPP2 C.S0016-D v2.0

3-150

Field Length (bits)

UZ_LIST_ID 16

CUR_PUZL_P_REV 8

RESERVED 2

UZ_TEMP_SUBSC 1

UZ_ORIG_ONLY 1




PREF_ONLY 1

UZ_DISP_IND 8

NUM_UZ_ENTRIES 12

NUM_UZ_ENTRIES occurrences of the following User Zone entry:

{ (NUM_UZ_ENTRIES)7

UZ_INFO_FLAG 1

UZ_PRIORITY 4

UZ_ID 16

UZ_SID 15 or 0

UZ_NAME_ENCODING 8 or 0

N_OCTETS 5 or 0

UZ_NAME 8 × N_OCTETS

ACTIVE_FLAG 1 or 0

PRIORITY_CONTROL 3

REG_REQ_FLAG 1

NOTIFICATION_FLAG 1 or 0

UZ_REVISION 4

UZ_TYPE 3

NUM_ELEMENTS 4

NUM_ELEMENTS occurrences of the following field:

UZ Type Specific Fields Variable

7 The sequence of fields enclosed between “{ (NUM_xyz) … } (NUM_xyz)” are repeated NUM_xyz

times.

3GPP2 C.S0016-D v2.0

3-151

} (NUM_UZ_ENTRIES)

The User Zone entry ends with the following two fields:

RESERVED 0 to 7

UZ_CRC 16

1






zone list 7



list (PUZLs-p). 10



UZ_TEMP_SUBSC - User Zone Temporary Subscription Flag. 13

This flag indicates whether or not the mobile station is 14

permitted to access User Zones that offer temporary 15

subscription. This field does not apply to a specific User Zone 16

and is per MS. If allowed, UZ_TEMP_SUBSC = ‘1’; otherwise, 17

UZ_TEMP_SUBSC = ‘0’. 18

UZ_ORIG_ONLY - User Zone Origination Only Flag. 19

This flag indicates whether or not the mobile station is permitted 20

to originate calls only when within the serving area of a 21

currently assigned User Zone. If call origination is only allowed 22

within an assigned user zone, UZ_ORIG_ONLY = ‘1’; 23

otherwise, UZ_ORIG_ONLY = ‘0’. 24

MANUAL_UPDATE_ALLOWED - Manual update allowed flag. 25

When set to ‘1’ this field indicates if manual updates are 26



database. 29



MANUAL_ACQ_ALLOWED - Manual acquisition allowed flag. 32

When set to ‘1’ this field indicates if the user is allowed to 33


When set to ‘0’ this field indicates that the user is not allowed 35



3GPP2 C.S0016-D v2.0

3-152

When set to ‘1’ this field indicates PUZL takes precedence 1





When set to ‘0’ this field indicates PRL takes precedence over 6









PUZL. 15




PUZL. 19






NUM_UZ_ENTRIES - Current number of User Zone entries. 25

Number of User Zone entries currently in the mobile’s PUZL. 26

UZ_INFO_FLAG - User Zone Information present flag. 27

If UZ_INFO_FLAG is set to ‘1’, this field indicates that the user 28

zone information is specified for this record. 29

Otherwise, this field indicates that the user zone information 30

is not specified for this record. 31








selection only. 39

40



3GPP2 C.S0016-D v2.0

3-153



priority takes precedence. A priority of null NULLUZ_PRIORITY 3



priority ‘null’ unless initiated manually by the user. Note that 6

the value of User Zone Priority is non-exclusive.Note: 7


same priority. 9









3.5.1.13-1. 18


If UZ_INFO_FLAG is set to '1', this field is set to the System 20

Identifier (SID) associated with the User Zone ID. Otherwise, 21

it is omitted. 22



UZ_NAME_ENCODING - User Zone name encoding. 25

Specified when UZ_INFO_FLAG is set to ‘1’ and omitted 26

otherwise. A field indicating the character set the User Zone 27

Name is encoded in as per ANSI-41 (See [4]TSB-58). 28

N_OCTETS - Number of octets. 29


otherwise. Number of octets in the User Zone name. 31

UZ_NAME - User Zone name. 32


otherwise. Up to 12-character field used in the mobile station 34

to indicate to the mobile station the Name of the User Zone 35

the mobile station is currently subscribed to. Encoded as per 36

the previous field. 37

ACTIVE_FLAG - Active flag. 38


otherwise. With this flag set to ‘1’, the mobile station must 40

register upon entering or exiting this particular User Zone. If 41

allowed, ACTIVE_FLAG = ‘1’; otherwise, ACTIVE_FLAG = ‘0’. 42

3GPP2 C.S0016-D v2.0

3-154

PRIORITY_CONTROL - Priority Control. 1

A 3 bit field that controls the ability of the user to modify 2

PUZL priorities using the user interface of the mobile. The 3

following states are defined at this time: 4

5

State Value Description

No changes permitted

‘000’ The user may not modify or override the PUZL priorities in any way.

Manual ‘001’ Permitted to select manually amongst the User Zones present. Upon exiting the User Zone the Mobile will revert back to the PUZL priorities.

Manual and Temporary

‘010’ The user is also permitted to change the priorities of the PUZL for this User Zone. The change will remain in effect until the next power down.

Reserved ‘011’ through ‘111’

6

REG_REQ_FLAG - Registration Required flag. 7

When this flag is set to ‘1’ and a mobile station moves within 8

the coverage area of a User Zone, this flag can be used to 9

indicate that the mobile is to register when it acquires an 10

associated system in this User Zone. This also indicates that 11

when the mobile is associated with a system associated with 12

this User Zone, it shall register upon switching from PN to 13

another PN independent of whether the target system belongs 14

to the same/different SID/NID compared to the source. 15

NOTIFICATION_FLAG - Notification flag. 16


otherwise. When this flag is set to ‘1’ and a mobile station 18

moves within the coverage area of a User Zone, this flag can 19

be used to indicate to the user that the User Zone is present. 20

This flag would typically be used for User Zones that are set 21

for manual selection only (User Zone Priority = 22

nullNULLUZ_PRIORITY) but that the subscriber wishes to be 23

informed of its presence. 24

3GPP2 C.S0016-D v2.0

3-155

UZ_REVISION - User Zone revision. 1

This indicates the current revision of this entry in the PUZL. 2

For Broadcast User Zones, the mobile station uses this value 3

to determine if the network has more current information 4

about the particular User Zone. 5

UZ_TYPE - User Zone type. 6

This field is used to distinguish between the following types of 7

User Zones: 8

Table 3.5.7-1 User Zone Type Values 9

User Zone Type Value

UZ_TYPE_1: Broadcast – RF Coverage Based ‘000’

UZ_TYPE_2: Broadcast – Geo-Based ‘001’

UZ_TYPE_3: Mobile Specific – RF Coverage Based - Overhead Parameter Determined

‘010’

UZ_TYPE_4: Mobile Specific – Geo-Based ‘011’

UZ_TYPE_5: Mobile Specific - Geo Based - Separate Carrier

‘100’

UZ_TYPE_6: Mobile Specific – RF Coverage and Geo Based

‘101’

Reserved ‘110’ through

‘111’

10

NUM_ELEMENTS - Number of elements. 11

This is the number of User Zone type specific fields that follow 12

according to the following table. 13

14

User Zone Type

NUM_ELEMENTS Type of Elements

000 0 None

001 Variable Geo Types

010 Variable OHP Types

011 Variable Geo Types

100 1 Geo-Based – Separate Carrier

101 1 RF Coverage and Geo Based

15

3GPP2 C.S0016-D v2.0

3-156

UZ Type Specific Fields - User Zone type specific fields. 1

Refer to Section 3.5.7.1. 2





UZ_CRC - User Zone Cyclic Redundancy Check. 7

Set to the computed value of the CRC including all the fields 8

for this user zone entry except for this field. The 16-bit CRC 9

is calculated according to 3.5.5.1. 10

11

12

3.5.7.1 User Zone Type Specific Fields 13

This section describes User Zone Type specific fields associated with a User Zone. 14

15

3.5.7.1.1 User Zone Type 1: Broadcast – RF Coverage Based 16

No data required. 17

18

3.5.7.1.2 User Zone Type 2: Broadcast – Geo-based 19

20

Table 3.5.7.1.2-1 below lists all the supporting Geo Types and corresponding values. 21

22

Table 3.5.7.1.2-1 Geo Type Values 23

Geo Type Value

Circle ‘000’

Segmented Linear ‘001’

Polygon ‘010’


‘100’

24

For Geo Type Specific Fields see 3.5.7.1.2.1 – 3.5.7.1.2.3. 25

26

3GPP2 C.S0016-D v2.0

3-157

3.5.7.1.2.1 Circle 1

The “Circle” Geo Type has the following format: 2

3

Geo Type Field Length (bits)

GEO_TYPE (‘000’) 3

ANCHOR_LATITUDE 23

ANCHOR_LONGITUDE 22

ANCHOR_HEIGHT_MID_PT 16

ANCHOR_HEIGHT_MAG 9

RADIUS 10

HYSTERESIS 4

RESERVED 1

4

GEO_TYPE - Geo Type. 5

This field is set to ‘000’ (see Table 3.5.7.1.2-1). 6

ANCHOR_LATITUDE - Anchor latitude. 7

Latitude of the center of the circle in units of 0.25 second, 8

expressed as a two’s complemented signed number with 9

positive numbers signifying North latitudes. Values over the 10

range of -1296000 to 1296000 inclusive (corresponding to a 11

range of -90° to +90°) are valid. 12

ANCHOR_LONGITUDE - Anchor longitude. 13

Longitude of the center of the circle in units of 0.25 second, 14


positive numbers signifying East longitude. Values over the 16



ANCHOR_HEIGHT_MID_PT - Anchor Height Mid-Point. 19

This field is a two’s complement signed value set to the height 20

above the WGS-84 reference ellipsoid, in units of 1 meter, in 21

the range from -500 m to 15883 m. This field defines the 22

center point of the vertical range defined by 23

ANCHOR_HEIGHT_MAG. 24

ANCHOR_HEIGHT_MAG - Anchor Height Magnitude 25

This field is set to the magnitude of the height range in units 26

of 1 m. The value of ‘0’ indicates no height is specified. 27

3GPP2 C.S0016-D v2.0

3-158

RADIUS - Radius. 1

Radius of the circle in units of 0.25 second. The 10 bits are 2

divided into a 7-bit mantissa and a 3-bit exponent providing a 3

range of 0 to 127 x 27 x 0.25 seconds. 4

HYSTERESIS - Hysteresis. 5

Hysteresis value expressed in units of 0.25 second. The 6

mantissa is defined as '1' and the 4 bits represent the 7

exponent. This provides hysteresis values of 1, 2 , 4, 8 …128 8

x 0.25 sec. The hysteresis value delays the exiting of a user 9

zone by a distance offset determined by the value of the 10

hysteresis. The entry point for a user zone is the radius value 11

(horizontally) or anchor height mid-point and anchor height 12

magnitude value (vertically). 13



16

17

3GPP2 C.S0016-D v2.0

3-159

3.5.7.1.2.2 Segmented Linear 1

The segmented linear user zone is defined by an anchor point and a series of points offset 2

relative to each other. The area is formed by defining a distance (radius) offset from the 3

line. 4

The “Segmented Linear” Geo Type has the following format: 5

6


GEO_TYPE (‘001’) 3

ANCHOR_LATITUDE 23

ANCHOR_LONGITUDE 22


ANCHOR_HEIGHT_MAG 9

RADIUS 10

HYSTERESIS 4

N_POINTS 5

N_POINTS of the following:

LAT_OFFSET 11

LONG_OFFSET 11

RESERVED 0 to 7

7




Latitude of the anchor point for the line in units of 0.25 11

second, expressed as a two’s complemented signed number 12

with positive numbers signifying North latitudes. Values over 13

the range of -1296000 to 1296000 inclusive (corresponding to 14

a range of -90° to +90°) are valid. 15


Longitude of the anchor point for the line in units of 0.25 17


with positive numbers signifying East longitude. Values over 19



3GPP2 C.S0016-D v2.0

3-160







7




RADIUS - Radius. 11

Distance away from the line that the User Zone covers in 12

units of 0.25 second. The 10 bits are divided into a 7-bit 13

mantissa and a 3-bit exponent providing a range of 0 to 127 x 14

27 x 0.25 seconds. 15



mantissa is defined as '1' and the 4 bits represent the 18

exponent. This provides hysteresis values of 1, 2, 4, 8 …128 19

x 0.25 sec. The hysteresis value delays the exiting of a user 20

zone by a distance offset from the radius determined by the 21

value of the hysteresis. The entry point for a user zone is the 22

radius value (horizontally) or anchor height mid-point and 23

anchor height magnitude value (vertically). 24

N_POINTS - Number of points. 25

Number of points of the following two values. 26

LAT_OFFSET - Latitude offset. 27

Latitude offset distance from the previous point in units of 28

0.25 seconds. The 11 bits are divided into an 8 bit mantissa 29

(2's complement representation) and a 3 bit exponent 30

providing a range of ± 0 to 127 x 27 x 0.25 seconds. 31

LONG_OFFSET - Longitude offset. 32

Longitude offset distance from the previous point in units of 33

0.25 seconds. The 11 bits are divided into an 8 bit mantissa 34

(2's complement representation) and a 3 bit exponent 35

providing a range of ± 0 to 127 x 27 x 0.25 seconds. 36





41

42

3GPP2 C.S0016-D v2.0

3-161

3.5.7.1.2.3 Polygon 1

The polygon is defined by an anchor vertex and a series of vertices offset from the anchor. 2

The polygon is formed by lines formed between the vertices in the order they are 3

provisioned starting with the anchor as the first vertex. A line is formed between the last 4

point provisioned and the anchor to close the polygon. 5

The “Polygon” Geo Type has the following format: 6

7


GEO_TYPE (‘010’) 3

ANCHOR_LATITUDE 23

ANCHOR_LONGITUDE 22


ANCHOR_HEIGHT_MAG 9

HYSTERESIS 4

N_POINTS 5

N_POINTS of the following:

LAT_OFFSET 11

LONG_OFFSET 11

RESERVED 0 to 7

8




Latitude of the anchor point for one vertex on the polygon in 12

units of 0.25 second, expressed as a two’s complement signed 13

number with positive numbers signifying North latitudes. 14

Values over the range of -1296000 to 1296000 inclusive 15

(corresponding to a range of -90° to +90°) are valid. 16


Longitude of the anchor point for one vertex on the polygon in 18

units of 0.25 second, expressed as a two’s complement signed 19

number with positive numbers signifying East longitude. 20

Values over the range of -2592000 to 2592000 inclusive 21

(corresponding to a range of -180° to +180°) are valid. 22

3GPP2 C.S0016-D v2.0

3-162







7






mantissa is defined as '1' and the 4 bits represent the exponent. 13

This provides hysteresis values of 1, 2 , 4, 8 …128 x 0.25 sec. 14

The hysteresis value delays the exiting of a user zone by a 15

distance offset from the polygon edge determined by the value of 16

the hysteresis. The entry point for the polygon as defined by the 17

lines joining the points on the polygon (horizontally) or anchor 18

height mid point and anchor height magnitude value 19

(vertically). 20


Number of points of the following two values. 22

LAT_OFFSET - Latitude offset. 23

Latitude offset distance from the anchor point in units of 0.25 24

seconds. The 11 bits are divided into an 8 bit mantissa (2's 25

complement representation) and a 3 bit exponent providing a 26

range of ± 0 to 127 x 27 x 0.25 seconds. 27

LONG_OFFSET - Longitude offset. 28

Longitude offset distance from the anchor point in units of 0.25 29

seconds. The 11 bits are divided into an 8 bit mantissa (2's 30

complement representation) and a 3 bit exponent providing a 31

range of ± 0 to 127 x 27 x 0.25 seconds. 32





37

3GPP2 C.S0016-D v2.0

3-163

3.5.7.1.3 User Zone Type 3: Mobile Specific – RF Coverage Based - Overhead Parameter 1

Determined 2

For this type of user zone, the mobile station matched parameters on the overhead channel 3

with information in the PUZL. 4

Below describes all the supporting Overhead Parameter (OHP) Types and corresponding 5

values: 6

7

Table 3.5.7.1.3-1 Overhead Parameter (OHP) Type Values 8

OHP Type Value

SID Only ‘000’

SID and NID ‘001’

SID and BASE_ID ‘010’

Base station Latitude and Longitude

‘011’

User Zone Center Point and Radius ‘100’


‘111’

9

3.5.7.1.3.1 SID Only 10

The SID comes from the common parameters defining the User Zone. 11

The “SID Only” OHP Type has the following format: 12

13

OHP Type Field Length (bits)

OHP_TYPE (‘000’) 3

HYSTERESIS 4

RESERVED 1

14

OHP_TYPE - Overhead Parameter Type. 15



Expressed in dB. See Section 2.6.9 of [7] for definition of 18

hysteresis relative to CDMA Tiered Services. 19

RESERVED - Reserved bit 20


3GPP2 C.S0016-D v2.0

3-164

1

3.5.7.1.3.2 SID and NID 2


The “SID and NID” OHP Type has the following format: 4

5


OHP_TYPE (‘001’) 3

N_ITEMS 5

N_ITEMS occurrences of the following two fields:

NID 16

HYSTERESIS 4

RESERVED 4 or 0

6



N_ITEMS - Number of items. 9

Number of entries of the following two values. 10

NID - Network ID. 11

See [7]. 12



hysteresis relative to CDMA Tiered Services for RF coverage 15

based user zones. 16





21

22

3GPP2 C.S0016-D v2.0

3-165

3.5.7.1.3.3 SID and BASE_ID 1


The “SID and BASE_ID” OHP Type has the following format: 3

4


OHP_TYPE (‘010’) 3

N_ITEMS 5

N_ITEMS occurrences of the following two fields:

BASE_ID 16

HYSTERESIS 4

RESERVED 4 or 0

5



N_ITEMS - Number of items. 8

Number of entries of the following two values. 9

BASE_ID - Base Station ID. 10

See [7]. 11









20

3GPP2 C.S0016-D v2.0

3-166

3.5.7.1.3.4 Base Station Latitude and Longitude 1

The “Base Station Latitude and Longitude“ OHP Type has the following format: 2

3


OHP_TYPE (‘011’) 3

N_POINTS 5

N_POINTS occurrences of the following three fields:

BASE_LAT 22

BASE_LONG 23

HYSTERESIS 4

RESERVED 0 to 7

4




Number of points of the following three values. 8

BASE_LAT - Base Station latitude. 9

See [7]. 10

BASE_LONG - Base Station longitude. 11

See [7]. 12









21

3.5.7.1.3.5 User Zone Center Point and Radius 22

In this case, a circle is used to define the user zone. Any base station whose BASE_LAT 23

and BASE_LONG fall within the circle are considered to define the user zone. The coverage 24

area of these sites constitute the user zone. 25

The “User Zone Center Point and Radius“ HP Type has the following format: 26

3GPP2 C.S0016-D v2.0

3-167

1


OHP_TYPE (‘100’) 3

CENTER_POINT_LAT 23

CENTER_POINT_LONG 22

RADIUS 10

HYSTERESIS 4

RESERVED 2

2



CENTER_POINT_LAT - Center point latitude. 5

Latitude of the center of the circle in units of 0.25 second, 6


positive numbers signifying North latitudes. Values over the 8



CENTER_POINT_LONG - Center point longitude. 11

Longitude of the center of the circle in units of 0.25 second, 12


positive numbers signifying East longitude. Values over the 14



RADIUS - Radius. 17

Radius of the circle in units of 0.25 second. The 10 bits are 18

divided into a 7-bit mantissa and a 3-bit exponent providing a 19

range of 0 to 127 x 27 x 0.25 seconds. 20







27

3.5.7.1.4 User Zone Type 4: Mobile Specific – Geo-Based 28

See section 3.5.7.1 2. The parameters are identical. 29

3.5.7.1.5 User Zone Type 5: Mobile Specific – Geo-Based – Separate Carrier 30

This user zone type has the following format: 31

3GPP2 C.S0016-D v2.0

3-168

1

Field Length (bits)

SID 15

NID 16

PN_INCLUDED 1

PRI_NGHBR_PN 0 or 9

BAND_CLASS 5

NGHBR_FREQ 5

NUM_ENTRIES 4

NUM_ENTRIES occurrences of the following field:

Geo Type Specific Fields Variable

RESERVED 0 to 7

2

SID - System ID. 3

The SID of the separate RF carrier. 4

NID - Network ID. 5

The NID of the separate RF carrier. 6

PN_INCLUDED - Private neighbor PN included indicator. 7

Set to ‘1’ if the Private Neighbor PN is included. Otherwise the 8

mobile should due a full search of the frequency. 9

PRI_NGHBR_PN - Private neighbor PN offset. 10

The PN offset of the private RF carrier. 11

BAND_CLASS - Private neighbor band class. 12

The Band Class of the private RF carrier. 13

NGHBR_FREQ - Private neighbor frequency. 14

The frequency of the private RF carrier. 15

NUM_ENTRIES - Number of entries. 16

The number of Geo Type specific fields that follow. 17

Geo Type Specific Fields - Geo Type specific fields. 18

One or more Geo Type specific fields (see Section 3.5.7.1.2). 19





24

3GPP2 C.S0016-D v2.0

3-169

3.5.7.1.6 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based 1

This user zone type is applicable to both same carrier and separate carriers. 2

This user zone type has the following format: 3

3GPP2 C.S0016-D v2.0

3-170

Field Length (bits)

REC_LENGTH 16

PREF_NEG 1

SYSTEM_INFO_LENGTH 8

SYS_TYPE 8

SYS_INFO variable

AP_ID_INCLUDED 1

AP_ID_MASK_LENGTH 8 or 0

AP_ID_MSB AP_ID_MASK_LENGTH

AP_ID_TEXT_INCLUDED 1

AP_ID_TEXT_LENGTH 8 or 0

AP_ID_TEXT 8 x AP_ID_TEXT_LENGTH

SERVICE_CAP_INFO_INCLUDED 1

SERVICE_CAP_INFO 32 or 0

LAT_LONG_INCLUDED 1

LATITUDE 23 or 0

LONGITUDE 24 or 0

HEIGHT_INCLUDED 1

HEIGHT 16 or 0

ACQ_TYPE 8

ACQ_INFO variable

ASSOCIATED_HRPD 0 or 31

USE_ASSOCIATED_UZ_RF_GEO_INFO 0 or 1

NUM_UZ_RF_TYPES 4

NUM_UZ_RF_TYPE occurrences of the following two fields:

UZ_RF_TYPE 8

UZ_RF_INFO variable

NUM_GEO_TYPE_SPECIFIC_FIELDS 4

NUM_GEO_TYPE_SPECIFIC_FIELDS occurrences of the following field:

GEO_TYPE_SPECIFIC_FIELDS Variable

RESERVED 0 to 7

1

3GPP2 C.S0016-D v2.0

3-171

REC_LENGTH - Record Length. 1

Set to the total length of this record in octets including this 2

field. 3

PREF_NEG - System Type indicator. 4


on the system associated with this record. 6

This field is set to ‘0’ if the mobile station is not allowed to 7

operate on the system associated with this record.8 8

SYSTEM_INFO_LENGTH - System information length. 9

Set to the length in octets of the system information contained 10

in this record. This covers all the fields starting with and 11

including this field up to and including the 12

USE_ASSOCIATED_UZ_RF_GEO_INFO field. 13

SYS_TYPE - System Type indicator. 14

Set according to the following table. 15

SYS_TYPE Value Description

‘00000000’ cdma2000 1x

‘00000001’ HRPD

‘00000010’ to ‘11111111’ Reserved

16

SYS_INFO - System Information 17

See Section 3.5.7.1.6.1 User Zone Type 6: Mobile Specific – 18

RF Coverage and Geo-Based – System Information. 19

AP_ID_INCLUDED - Access Point Identification Included 20

This field is set to ’1’ if the AP_ID is included. Otherwise, it is 21

set to ’0’. 22

AP_ID_MASK_LENGTH - Access Point Identification Mask Length 23

If AP_ID_INCLUDED is set to ‘1’, then this field specifies the 24

number of consecutive bits (starting from the most significant 25

bit) of AP_ID which can identify a group of access points or a 26

single access point. Note: when the AP_ID_MASK_LENGTH is 27

equivalent to the full length of the AP_ID, the AP_ID_MSBS is 28

equivalent to the AP_ID. The AP_ID_MASK_LENGTH may be 29

broadcasted by a base-station in an overhead signaling 30

message. 31

Otherwise, if AP_ID_INCLUDED is set to ‘0’, then this field is 32

excluded. 33

8 Creation and configuration of the PUZL information entries with PREF_NEG set to '0' is under

control of the system operator and is subject to system operator policy.

3GPP2 C.S0016-D v2.0

3-172

AP_ID_MSB - Access Point Identification Most Significant Bits. 1

Set to most significant bits of AP_ID limited to the length 2

specified by AP_ID_MASK_LENGTH. The AP_ID may be 3


message. 5

AP_ID_TEXT_INCLUDED - Access Point Identification Text Included 6

This field is set to ’1’ if the AP_ID_TEXT is included. 7

Otherwise, it is set to ’0’. 8

AP_ID_TEXT_LENGTH – Access Point Identification Text Length. 9

If AP_ID_TEXT_INCLUDED is set to ‘1’, then this field is set to 10

the number of octets in the AP_ID_TEXT field following the 11

AP_ID_TEXT_LEN field. Otherwise, this field is excluded. 12

AP_ID_TEXT - Access Point text identification. 13

The AP_ID_TEXT field shall include the following fields: 14

15

MSG_ENCODING 5

NUM_FIELDS 8

NUM_FIELDS occurrences of the following field

CHARi Variable

RESERVED 0 to 7

16

MSG_ENCODING - Message encoding. 17

See [4]. 18

Support of an encoding method does not imply that the entire 19

encodable character set needs to be supported. In general, 20

once the supported character set is determined, various 21

subsets of the character set can be supported. If a message is 22

comprised entirely of characters from a supported subset of a 23

character set, it can be displayed. If a message contains an 24

unsupported character of a character set, it can be discarded. 25

NUM_FIELDS - Number of fields. 26

If the MSG_ENCODING field is set to ‘00101’ (Shift-JIS) or 27

‘00110’ (Korean), this field indicates the total length in octets 28

of the CHARi field; otherwise this field shall be set to the 29

number of characters included in this occurrence of the 30

encoding-specific-fields. 31

3GPP2 C.S0016-D v2.0

3-173

CHARi - Character. 1

See [4]. NUM_FIELDS occurrences of this field shall be 2

included. The base station shall set each occurrence of this 3

field to represent the character string that identifies this base 4

station. The character string shall be included in the order of 5

appearance. 6


This field shall contain the number of bits required to make 8

the entire AP_ID_TEXT field an integer number of octets in 9

length. All bits of this field shall be set to zeros. 10

SERVICE_CAP_INFO_INCLUDED – Service Capability Information Included 11

This field is set to ‘1’ if SERVICE_CAP_INFO is included. 12

Otherwise, it is set to ‘0.’ 13

SERVICE_CAP_INFO - Service Capability Information 14

If SERVICE_CAP_INFO_INCLUDED is set to ‘1’, the mobile 15

station shall include this field; otherwise the mobile station 16

shall omit this field. The value assignments of each bit in this 17

field is defined in [4]. 18

LAT_LONG_INCLUDED - Latitude and Longitude Included 19

This field is set to ‘1’ if latitude and longitude information is 20

included. Otherwise, it is set to ‘0.’ 21

LATITUDE - Latitude. 22

If LAT_LONG_INCLUDED is set to ‘1’, the mobile station shall 23

include this field; otherwise the mobile station shall omit this 24

field. Latitude of the center of the circle in units of 0.25 25


with positive numbers signifying North latitudes. Values over 27



Otherwise, this field is omitted. 30

LONGITUDE - Longitude. 31

If LAT_LONG_INCLUDED is set to ‘1’, the mobile station shall 32


field. Longitude of the center of the circle in units of 0.25 34


with positive numbers signifying East longitude. Values over 36




HEIGHT_INCLUDED - Height Included 40

This field is set to ‘1’ if height information is included. 41


3GPP2 C.S0016-D v2.0

3-174

HEIGHT - Height. 1

If HEIGHT_INCLUDED is set to ‘1’, the mobile station shall 2


field. This field is a two’s complement signed value set to the 4

height above the WGS-84 reference ellipsoid, in units of 1 5

meter, in the range from -500 m to 15883 m. 6


8

ACQ_TYPE - Acquisition Type 9


ACQ_TYPE Value Description

‘00000000’ cdma2000 1x or HRPD

‘00000001’ to ‘11111111’ Reserved

11

ACQ_INFO - Acquisition Information 12

See Section 3.5.7.1.6.2 User Zone Type 6: Mobile Specific – 13

RF Coverage and Geo-Based – Acquisition Information. 14

ASSOCIATED_HRPD - Associated HRPD System. 15

When the SYS_TYPE is set to cdma2000 1x and there is an 16

associated HRPD system available it shall be set to the 31 bit 17

field consisting of, in sequence, the UZ_ID and UZ_SID 18

identifying the UZ of the associated HRPD system. 19

When the SYS_TYPE is set to HRPD, this field is not included. 20

USE_ASSOCIATED_UZ_RF_GEO_INFO - Use the UZ information from the Associated 21

System 22

If this flag is set to '1' for an HRPD UZ (a UZ with a SYS_TYPE 23

set to HRPD) with an associated system, the UZ_RF_TYPE and 24

GEO_TYPE_SPECIFIC_FIELDS information of the associated 25

system will be used. And the UZ_RF_TYPE and 26

GEO_TYPE_SPECIFIC_FIELDS information shall not be 27

provisioned in this HRPD UZ. 28

If the flag is set to '0' for an HRPD_UZ, the UZ_RF_TYPE and 29

GEO_TYPE_SPECIFIC_FIELDS information of the associated 30

system are not used. And the UZ_RF_TYPE and 31

GEO_TYPE_SPECIFIC_FIELDS information may be 32

provisioned. 33

For the associated 1x UZ (with a SYS_TYPE set to 1x), the flag 34

is set to '0'. 35

NUM_UZ_RF_TYPES - Number of User Zone RF Types 36

If UZ_INFO_FLAG is set to ‘0’, then this field is set to ‘0’. 37

Otherwise, this field is set to the number of UZ_RF_TYPEs. 38

3GPP2 C.S0016-D v2.0

3-175

UZ_RF_TYPE - User Zone RF Type 1

The UZ RF Type describes the type of UZ RF information 2

which can be used by a Mobile Station to determine when to 3

scan for an AP. 4


UZ_RF_TYPE Value Description

‘00000000’ 1x

‘00000001’ HRPD

‘00000010’ to ‘11111111’ Reserved

6

UZ_RF_INFO - See Section 3.5.7.1.6.3 User Zone Type 6: Mobile Specific – 7

RF Coverage and Geo-Based – UZ RF Information. 8

NUM_GEO_TYPE_SPECIFIC FIELDS – Number of Geo Type Specific Fields 9

This fieldvalue is set to the number of 10

GEO_TYPE_SPECIFIC_FIELDS. 11

GEO_TYPE_SPECIFIC_FIELDS - Geo Type specific fields. 12

The GEO_TYPE_SPECIFIC_FIELDS describes geo-spatial 13

information which can be used by a mobile station to 14

determine if it should scan for an AP. One or more Geo Type 15

specific fields (see 3.5.7.1.2). 16





21

3.5.7.1.6.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – System 22

Information 23

This section defines the Access Point System Information for User Zone Type 6 for the 24

various system types. 25

3GPP2 C.S0016-D v2.0

3-176

3.5.7.1.6.1.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – System 1

Information for 1x 2

This section defines the Access Point System Information for User Zone Type 6 and 3

SYS_TYPE = ‘00000000’. 4

5

Field Length (bits)

MCC_INCLUDED 1

MCC 12 or 0

MNC_INCLUDED 1

MNC 12 or 0

SID_INCLUDED 1

SID 15 or 0

NID_INCLUDED 1

NID_COUNT 6 or 0

NID_COUNT occurrences of the following field:

NID 16

MSC_CELL_ID_INCLUDED 1

MSC_ID 24 or 0

CELL_ID 16 or 0

BASE_ID_INCLUDED 1

BASE_ID_COUNT 8 or 0

BASE_ID_COUNT occurrences of the following field:

BASE_ID 16

REG_ZONE_INCLUDED 1

REG_ZONE 8 or 0

RESERVED 0 to 7

6

MCC_INCLUDED - Mobile Country Code Included 7

This field is set to ‘1’ if MCC information is included. 8


MCC - Mobile Country Code 10

When the system type is a cdma2000 1x system, this field is 11

set, using BCD encoding, to the three digit Mobile Country 12

Code. 13

3GPP2 C.S0016-D v2.0

3-177

MNC_INCLUDED - Mobile Network Code Included 1

This field is set to ‘1’ if MNC information is included. 2


MNC - Mobile Network Code 4

When the system type is a cdma2000 1x system, this field is 5

set, using BCD encoding, to the two or three digit Mobile 6

Network Code. If the length of the MNC is two digits, the least 7

significant digit is encoded with 0xF‘F’. For example, MNC=23 8

is set to 0x23F‘23F’ [31]. 9

SID_INCLUDED - System ID Included 10

This field is set to ‘1’ if SID is included. Otherwise, it is set to 11

‘0.’ 12

SID - System ID. 13

If SID_INCLUDED = ‘1’, this field is included and is set to the 14

SID. Otherwise, this field is omitted. 15

NID_INCLUDED - NID Included 16

This field is set to ‘1’ if NID information is included. 17

Otherwise, it is set to ‘0’. 18

NID_COUNT - NID Count. 19

If NID_INCLUDED is set to ‘1’, then this field is set to the 20

number of NIDs in the SID. Otherwise, this field is excluded. 21

NID - Network Identifier. 22

MSC_CELL_ID_INCLUDED - MSC_ID and CELL_ID Included. 23

If MSC_ID and CELL_ID are included, this field is set to ‘1’ . 24


MSC_ID - MSC ID. 26

Mobile Switching Center(s) (MSC). 27

CELL_ID - Cell ID. 28

The sector(s) (CELL). 29

BASE_ID_INCLUDED - BASE_ID Included. 30

This field is set to ‘1’ if BASE_ID is included. Otherwise, it is 31

set to ‘0’. 32

BASE_ID_COUNT - BASE_ID Count. 33

If BASE_ID_INCLUDED is ‘0’, this field shall not be included. 34

Otherwise, this field is set to the count of BASE_IDs. 35

BASE_ID - BASE_ID. 36

This field is set to the BASE_ID.. 37

REG_ZONE_INCLUDED - Registration Zone Included 38

This field is set to ‘1’ if Registration Zone information is 39

included. Otherwise, it is set to ‘0.’ 40

3GPP2 C.S0016-D v2.0

3-178

REG_ZONE - Registration Zone. 1

This field is set to the Registration Zone number of the base 2

station [7]. 3




integer number of octets. The base station shall set these bits 7

to ‘0’. 8

9

3.5.7.1.6.1.2 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – System 10

Information for HRPD 11

This section defines the system fields for SYS_TYPE=’00000001’ for HRPD. 12

13

Field Length (bits)

SUBNET_ID_COUNT 8

SUBNET_ID_COUNT occurrences of the following threetwo fields:

SUBNET_LENGTH 8

SUBNET_ID SUBNET_LENGTH

RESERVED 0 to 7

RESERVED 0 to 7

14

SUBNET_ID_COUNT - SUBNET_ID Count. 15

This field is set to the count of SUBNET_IDs. 16



maximum Subnet_LENGTH is 128. The values '10000001' 19



SECTOR_ID. 22





to make the combined length of SUBNET_LENGTH, 27

SUBNET_ID and RESERVEDthis SYS_TYPEe entire parameter 28

block equal to an integer number of octets. The base station 29

shall set these bits shall be set to ‘0’. 30

31

3GPP2 C.S0016-D v2.0

3-179

1

3.5.7.1.6.2 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – Acquisition 2

Information 3

This section describes the Access Point acquisition information. 4

3.5.7.1.6.2.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – Acquisition 5

Information for 1x and HRPD 6

This section defines the Access Point acquisition fields for ACQ_TYPE = ‘00000000’ for 1x 7

or HRPD. 8

Field Length (bits)

PN_INCLUDED 1

PN_COUNT 8 or 0

PN_COUNT occurrences of the following field:

NGHBR_PN 9

BAND_CLASS_CHAN_INCLUDED 1

BAND_CLASS_CHAN_NUM_COUNT 8 or 0

BAND_CLASS_CHAN_NUM_COUNT occurrences of the following two fields:

BAND_CLASS 5

CHANNEL_NUM 11

RESERVED 0 to 7

9

PN_INCLUDED - PN Included. 10

If this field is set to ‘1’, then PN information is included. 11

Otherwise, it is excluded. 12

PN_COUNT - PN count. 13

If PN_INCLUDED is ‘1’, this field is set to the number of PN 14

offsets. Otherwise, it is excluded. 15

NGHBR_PN - Neighbor PN offset. 16

This field is set to the PN offset in units of 64 chips [7]. 17

BAND_CLASS_CHAN_INCLUDED - Band Class Channel Included 18

If this field is set to ‘1’, the Band Class and Channel Number 19

information is included. Otherwise, it is set to ‘0’. 20

BAND_CLASS_CHAN_NUM_COUNT - Band Class and Channel Number count. 21

3GPP2 C.S0016-D v2.0

3-180

If BAND_CLASS_CHAN_INCLUDED is ‘1’, this field is set to 1

the count of band classes and Channel Numbers. Otherwise, 2

it is not included. 3

BAND_CLASS - Band class. 4

This field is set to the Band Class as specified in [23]. 5

CHANNEL_NUM - Channel Number. 6

This field is set to the channel number corresponding to the 7






to ‘0’. 13

14

3.5.7.1.6.3 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – UZ RF 15

Information 16

This section describes the UZ information in terms of RF coverage. 17

3GPP2 C.S0016-D v2.0

3-181

3.5.7.1.6.3.1 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – UZ RF 1

Information for 1x 2

This section defines the UZ RF Info for UZ_RF_TYPE = ‘00000000’ for 1x. 3

4

NUM_ENTRIES 4

NUM_ENTRIES occurrences of the following fields:

{ (NUM_ENTRIES)

PN_OFFSET_INCL 1

NUM_PN_OFFSET 3 or 0

NUM_PN_OFFSET occurrences of the following field:

PN_OFFSET 9

NUM_REG_ZONE 2

NUM_REG_ZONE occurrences of the following field:

REG_ZONE 8

NUM_AP_ID 3

NUM_AP_ID occurrences of the following two fields:

AP_ID_MASK_LENGTH 8


UZ_NID_INCLUDED 1

UZ_NID_COUNT 6 or 0

UZ_NID_COUNT occurrences of the following field:

UZ_NID 16

UZ_BASE_ID_INCLUDED 1

UZ_BASE_ID_COUNT 8 or 0

UZ_BASE_ID_COUNT occurrences of the following field:

UZ_BASE_ID 16

RESERVED 0 to 7

} (NUM_ENTRIES)

RESERVED 0 to 7

5

3GPP2 C.S0016-D v2.0

3-182


This field is set to the number of UZ_NID_COUNT, UZ_NID, 2

UZ_BASE_ID_COUNT, UZ_BASE_ID and Geo Type specific 3

fields that follow. 4

PN_OFFSET_INCL - PN Offset Included. 5

This field is set to ‘1’ if the PN_OFFSET is included. 6


NUM_PN_OFFSET - Number of PN Offsets. 8

If PN_OFFSET_INCL is ‘1’, then this field is set to the number 9

of PN Offsets to be included. Otherwise, this field is omitted. 10

PN_OFFSET - PN offset. 11

If PN_OFFSET_INCL is ‘1’, then this field is set the PN offset of 12

a base station or access point. Otherwise, this field is omitted. 13

NUM_REG_ZONE - Number of Registration Zones. 14

This field is set to the number of REG_ZONEs to be included. 15

REG_ZONE - Registration Zone. 16

This field is set to the Registration Zone number of the base 17

station [7]. 18

NUM_AP_ID - Number of Access Point Identifications 19

This field is set to the number of AP_ID to be included. 20


This field specifies the number of consecutive bits (starting 22

from the most significant bit) of AP_ID which can identify a 23

group of access points or a single access point. Note: when 24

the AP_ID_MASK_LENGTH is equivalent to the full length of 25

the AP_ID, the AP_ID_MSBS is equivalent to the AP_ID. The 26

AP_ID_MASK_LENGTH may be broadcasted by a base-station 27

in an overhead signaling message. This field may be set to 28

‘00000000’ if no AP_ID_MSB is specified. 29

AP_ID_MSB - Access Point Identification Most Significant Bits. 30

This field is set to most significant bits of AP ID limited to the 31

length specified by AP_ID_MASK_LENGTH. The AP_ID may be 32


message. 34

UZ_NID_INCLUDED - UZ NID Included. 35

If this field is set to ‘1’, UZ_NID Information is included. 36


UZ_NID_COUNT - User Zone NID Count 38

If UZ_NID_INCLUDED is ‘1’, this field is set to the count of the 39

number of NIDs associated with the User Zone ID. Otherwise, 40

it is not included. 41

3GPP2 C.S0016-D v2.0

3-183

UZ_NID - User Zone Network ID. 1

The set of Network Identifiers (NID) associated with the User 2

Zone ID. 3

UZ_BASE_ID_INCLUDED - UZ BASE ID Included. 4

If this field is set to ‘1’, UZ_BASE_ID Information is included. 5


UZ_BASE_ID_COUNT - User Zone BASE_ID Count. 7

If UZ_BASE_ID_INCLUDED is ‘1’, then this field is set to the 8

count of the number of UZ_BASE_IDs fields associated with 9

the User Zone ID. Otherwise, it is excluded. 10

UZ_BASE_ID - User Zone Base ID. 11

The BASE_ID associated with the User Zone ID. 12





to ‘0’. 17

18

3GPP2 C.S0016-D v2.0

3-184

3.5.7.1.6.3.2 User Zone Type 6: Mobile Specific – RF Coverage and Geo-Based – UZ RF 1

Information for HRPD 2

This section defines the UZ RF Info for UZ_RF_TYPE = ‘00000001’ for HRPD. 3

4

NUM_ENTRIES 4

NUM_ENTRIES occurrences of the following fields:

{ (NUM_ENTRIES)

PN_OFFSET_INCL 1

NUM_PN_OFFSET 3 or 0

NUM_PN_OFFSET occurrences of the following field:

PN_OFFSET 9 or 0

NUM_AP_ID 3

NUM_AP_ID occurrences of the following two fields:

AP_ID_MASK_LENGTH 8


UZ_SUBNET_ID_INCLUDED 1

UZ_ SUBNET_ID_COUNT 8 or 0

UZ_ SUBNET_ID_COUNT occurrences of the following two fields:

UZ_SUBNET_LENGTH 8

UZ_SUBNET_ID SUBNET_LENGTH

RESERVED 0 to 7

} (NUM_ENTRIES)

RESERVED 0 to 7

5


This field is set to the number of UZ_NID_COUNT, UZ_NID, 7

UZ_BASE_ID_COUNT, UZ_BASE_ID and Geo Type specific 8

fields that follow. 9

PN_OFFSET_INCL - PN Offset Included. 10

This field is set to ‘1’ if the PN_OFFSET is included. 11


NUM_PN_OFFSET - Number of PN Offsets. 13

3GPP2 C.S0016-D v2.0

3-185

If PN_OFFSET_INCL is ‘1’, then this field is set to the number 1

of PN Offsets to be included. Otherwise, this field is omitted. 2

PN_OFFSET - PN offset. 3

If PN_OFFSET_INCL is ‘1’, then this field is set the PN offset of 4

a base station or access point. Otherwise, this field is omitted. 5

NUM_AP_ID - Number of AP_IDs 6

This field is set to the number of AP_IDs to be included. 7

AP_ID_LENGTH - Access Point Identification Length 8

This field is set to the length of the access point identification 9

(AP_ID) in units of 16 bits. The AP_ID_LENGTH may be 10


message. 12


This field specifies the number of consecutive bits (starting 14

from the most significant bit) of AP_ID which identifies a 15

group of access points. Note: when the AP_ID_MASK_LENGTH 16

is equivalent to the length of the AP_ID specified by 17

AP_ID_LENGTH (48 bits), the AP_ID_MASK is equivalent to 18

the AP_ID. The AP_ID_MASK_LENGTH may be broadcasted 19

by a base-station in an overhead signaling message. This field 20

may be set to ‘00000000’ if no AP_ID_MSB is specified. 21

AP_ID_MSB - Access Point Identification Most Significant Bits 22

Set to most significant bits of AP ID limited to the length 23

specified by AP_ID_MASK_LENGTH. The AP_ID may be 24


message. 26

UZ_SUBNET_ID_INCLUDED - UZ SUBNET ID Included. 27

If this field is set to ‘1’, UZ_SUBNET_ID information is 28

included. Otherwise, this field is set to ‘0’. 29

UZ_SUBNET_ID_COUNT - User Zone SUBNET_ID Count 30

If UZ_SUBNET_ID_INCLUDED is ‘1’, then this field is set to 31

the count of the number of UZSUBNET_LENGTH and 32

UZ_SUBNET_IDs fields associated with the User Zone ID. 33

Otherwise, it is excluded. 34

UZ_SUBNET_LENGTH - User Zone Subnet ID Length. 35

This field specifies the length of the User Zone Subnet ID. 36

The maximum UZ_SUBNET_LENGTH is 128. The values 37

'10000001' (129) to ‘11111111’ (255) shall be reserved. Note: 38

when the UZ_SUBNET_LENGTH is 128, the UZ_SUBNET_ID 39

is equivalent to the UZ_SECTOR_ID. 40

UZ_SUBNET_ID - User Zone Subnet ID. 41

The set of Subnet ID associated with the User Zone ID. 42


3GPP2 C.S0016-D v2.0

3-186


to make the length of each entry (from PN_OFFSET_INCL to 2

RESERVED inclusive)this UZ RF Infoe entire parameter block 3

equal to an integer number of octets. The base station shall 4

set these bits to ‘0’. 5

3GPP2 C.S0016-D v2.0

3-187

3.5.8 3GPD Parameter Blocks 1

Table 3.5.8-1 lists the types of parameter blocks used in the 3GPD Configuration Request 2

Message and the 3GPD Configuration Response Message. 3

4

Table 3.5.8-1 3GPD Parameter Block Types 5


3GPD Operation Capability Parameters ‘00000000’ 3.5.8.1

3GPD Operation Mode Parameters ‘00000001’ 3.5.8.2

SimpleIPSimple IP Capability Parameters ‘00000010’ 3.5.8.3

MobileIPMobile IP Capability Parameters ‘00000011’ 3.5.8.4

SimpleIPSimple IP User Profile Parameters

‘00000100’ 3.5.8.5

Mobile IP User Profile Parameters ‘00000101’ 3.5.8.6

SimpleIPSimple IP Status Parameters ‘00000110’ 3.5.8.7

MobileIPMobile IP Status Parameters ‘00000111’ 3.5.8.8

SimpleIPSimple IP PAP SS Parameters1 ‘00001000’ 3.5.8.9

SimpleIPSimple IP CHAP SS Parameters1 ‘00001001’ 3.5.8.10

MobileIPMobile IP SS Parameters1 ‘00001010’ 3.5.8.11

HRPD Access Authentication Capability Parameters

‘00001011’ 3.5.8.12

HRPD Access Authentication User Profile Parameters

‘00001100’ 3.5.8.13

HRPD Access Authentication CHAP SS Parameters1

‘00001101’ 3.5.8.14

eHRPD AKA Algorithm Capability Parameters

‘00001110’ 3.5.8.15

eHRPD MILENAGE Algorithm Parameters2

‘00001111’ 3.5.8.16


‘11111111’

1 The shared secret parameters shall not be transmitted over the air unencrypted.

2 The MILENAGE algorithm parameters shall not be transmitted over the air unencrypted.

6

3GPP2 C.S0016-D v2.0

3-188

3.5.8.1 3GPD Operation Capability Parameters 1

The PARAM_DATA field of the 3GPD Operation Capability Parameters Block consists of the 2

following fields: 3

4

Field Length

OP_MODE 8

5

OP_ MODE - Operation Mode Bitmap to indicate which operation modes 6

are supported by the mobile station. 7

The mobile station shall set this field to the value in the form 8

of bitmap as follows: 9

10

Subfield

Length (bits)

Subfield Description

SimpleIPSimple IP 1 SimpleIPSimple IP Supported

MobileIPMobile IP 1 MobileIPMobile IP Supported

MobileIPMobile IP with SimpleIPSimple IP fallback

1 MobileIPMobile IP with SimpleIPSimple IP fallback Supported

Reserved 5 -

11

The Mobile Station shall set each subfield to ‘1’, if the corresponding 12

operating mode is supported by the mobile station; otherwise the mobile 13

station shall set the subfield to ‘0’. 14

15




integer number of octets. 19


3GPP2 C.S0016-D v2.0

3-189

3.5.8.2 3GPD Operation Mode Parameters 1

The PARAM_DATA field of the 3GPD Operation Mode Parameters Block consists of the 2

following fields: 3

4

Field Length

OP_MODE 2

RESERVED 6

5

OP_ MODE - Active operation mode in the mobile station. 6

The mobile station shall set this field to the active operation 7

mode in the mobile station as specified in Table 3.5.8.2-1. 8

9

Table 3.5.8.2-1 Operation Mode 10

Operation Mode Binary Value

SimpleIPSimple IP only 00

MobileIPMobile IP with SimpleIPSimple IP Fallback

01

MobileIPMobile IP only 10

RESERVED 11

11


Additional reserved bits are needed in order to make the 13

length of the entire parameter block equal to an integer 14

number of octets. 15


3GPP2 C.S0016-D v2.0

3-190

3.5.8.3 SimpleIPSimple IP Capability Parameters 1

The PARAM_DATA field of the SimpleIPSimple IP Capability Parameters Block consists of 2

the following fields: 3

4

Field Length (bits)

MAX_NUM_NAI 4

MAX_NAI_LENGTH 8

MAX_SS_LENGTH 5

AUTH_ALGORITHM 8

RESERVED 7

5

MAX_NUM_NAI - Maximum SimpleIPSimple IP NAI Entries. 6


number of SimpleIPSimple IP NAI entries supported by the 8

mobile station. 9

MAX_NAI_LENGTH - Maximum SimpleIPSimple IP NAI length. 10

The mobile station shall set this field to the maximum length, 11

in units of octets, of the SimpleIPSimple IP NAIs supported by 12

the mobile station. The mobile station shall support an NAI 13

length of at least 72 octets. If multiple authentication 14

algorithms support is indicated, the mobile station shall set 15

this field to the maximum of the NAI lengths allocated for the 16

supported algorithms. The MAX_NAI_LENGTH shall be 72 17

octets or greater.9 18

MAX_SS_LENGTH - Maximum Length of the Shared Secret Data. 19


in units of octets, of the shared secret data supported by the 21

mobile station. The mobile station shall support an SS length 22

of at least 16 octets long. If multiple authentication 23


this field to the maximum of the SS lengths allocated for the 25

supported algorithms. The mobile station shall support an SS 26

length of at least 16 octets long. The MAX_SS_LENGTH shall 27

be 16 octets or greater. 28

AUTH_ALGORITHM - SimpleIPSimple IP Authentication Algorithm supported by the 29

mobile station. 30

The mobile station shall set this field to the SimpleIPSimple IP 31

authentication algorithms supported by the mobile station in 32

the form of bitmap. The Authentication Algorithm is encoded 33

as follows: 34

9 Note that [35] states that “The NAI is 72 octets max”.

3GPP2 C.S0016-D v2.0

3-191

1

Table 3.5.8.3-1 AUTH_ALGORITHM Parameter Values 2

Subfield

Length (bits)


PPP CHAP 1 CHAP mode-[11]

PPP_PAP 1 PAP mode- [10]

RESERVED 6

3




integer number of octets. The mobile station shall set all bits 7

of this field to ‘0’. 8

3.5.8.4 MobileIPMobile IP Capability Parameters 9

The PARAM_DATA field of the 3GPD MobileIPMobile IP Capability Parameters Block 10

consists of the following fields: 11

12

Field Length (bits)

MAX_NUM_NAI 4

MAX_NAI_LENGTH 8

MAX_MN-AAA_SS_LENGTH 5

MN-AAA_AUTH_ALGORITHM 8

MAX_MN-HA_SS_LENGTH 5

MN-HA_AUTH_ALGORITHM 8

RESERVED 2

13

MAX_NUM_NAI - Maximum MobileIPMobile IP NAI Entries. 14


number of MobileIPMobile IP NAI entries supported by the 16

mobile station. 17

MAX_NAI_LENGTH - Maximum MobileIPMobile IP NAI length. 18

3GPP2 C.S0016-D v2.0

3-192


in units of octets, of the MobileIPMobile IP NAIs supported by 2

the mobile station. The mobile station shall support an NAI 3

length of at least 72 octets. If multiple authentication 4


this field to the maximum of the NAI lengths allocated for the 6

supported algorithms. The MAX_NAI_LENGTH shall be 72 7

octets or greater.10 8

MAX_MN-AAA_SS_LENGTH - Maximum Length of the Shared Secret Data (MN-AAA). 9


in units of octet, of the shared secret data (MN-AAA) 11

supported by the mobile station. The mobile station shall 12

support shared secret data of at least 16 octets long. If 13

multiple authentication algorithms support is indicated, the 14

mobile station shall set this field to the maximum of the MN-15

AAA SS lengths allocated for the supported algorithms. The 16

MAX_MN-AAA_SS_LENGTH shall be 16 octets or greater. 17

MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) supported by the mobile 18

station. 19

The mobile station shall set this field to the MobileIPMobile IP 20

authentication algorithms (MN-AAA) supported by the mobile 21

station in the form of bitmap. The Authentication Algorithm is 22

encoded as follows: 23

24

Table 3.5.8.4-1 MN-AAA_AUTH_ALGORITHM Parameter Values 25

26

Subfield

Length (bits)


MD5 1 [15]

RESERVED 7

27

MAX_MN-HA_SS_LENGTH - Maximum Length of the Shared Secret Data (MN-HA). 28


in units of octet, of the shared secret data (MN-HA) supported 30

by the mobile station. The mobile station shall set the shared 31

secret data of at least 16 octets long. If multiple 32

authentication algorithms support is indicated, the mobile 33

station shall set this field to the maximum of the MN-HA SS 34

lengths allocated for the supported algorithms. The 35

MAX_MN-HA_SS_LENGTH shall be 16 octets or greater. 36


3GPP2 C.S0016-D v2.0

3-193

MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) supported by the mobile 1

station. 2

The mobile station shall set this field to the MobileIPMobile IP 3

authentication algorithms (MN-HA) supported by the mobile 4

station in the form of bitmap. The Authentication Algorithm is 5

encoded as follows: 6

7

Table 3.5.8.4-2 MN-HA_AUTH_ALGORITHM Parameter Values 8

9

Subfield

Length (bits)


MD5 1 [12]

RESERVED 7

10




integer number of octets. The mobile station shall set all bits 14

of this field to ‘0’. 15

16

3.5.8.5 SimpleIPSimple IP User Profile Parameters 17

The PARAM_DATA field of the SimpleIPSimple IP User Profile Parameters Block consists of 18


20

Field Length (bits)

NUM_NAI 4

NUM_NAI occurrences of the following fields:

NAI_ENTRY_INDEX 4

NAI_LENGTH 8

NAI 8 NAI_LENGTH

AUTH_ALGORITHM 4


21

NUM_NAI - Number of SimpleIPSimple IP NAI Entries. 22


SimpleIPSimple IP NAI entries. 24

3GPP2 C.S0016-D v2.0

3-194

The mobile station shall include NUM_NAI occurrences of the following fields: 1

NAI_ENTRY_INDEX - SimpleIPSimple IP NAI entry index. 2

The mobile station shall set this field to the index in the 3

SimpleIPSimple IP NAI Table. 4

NAI_LENGTH - SimpleIPSimple IP NAI length. 5

The mobile station shall set this field to the length of the NAI 6

in units of octet. 7

NAI - Network Access Identifier. 8

The mobile station shall set this field to the Network Access 9

Identifier (NAI), encoded in ASCII string, refer to [14]. The NAI 10

is of the form user@realm. 11

AUTH_ALGORITHM - Authentication Algorithm for SimpleIPSimple IP. 12

The mobile station shall set this field to the authentication 13

algorithm used to calculate the Simple IP Authentication. The 14

Authentication Algorithm is specified in Table 3.5.8.5-1. 15

16

Table 3.5.8.5-1 Authentication Algorithm Parameter Values for SimpleIPSimple IP 17

AUTH_ALGORITHM Binary Value

None ‘0000’

PPP CHAP ‘0001’

PPP PAP ‘0010’

PPP CHAP to PAP fallback ‘0011’

RESERVED ‘0100’ to ‘1111’

18





23

3GPP2 C.S0016-D v2.0

3-195

3.5.8.6 Mobile IP User Profile Parameters 1

The PARAM_DATA field of the Mobile IP User Profile Parameters Block consists of the 2

following fields: 3

4

Field Length (bits)

RETRY_INFO_INCLUDED 1

MAX_NUM_RETRY 0 or 2

FIRST_RETRY_TIMEOUT 0 or 3

REREG_THRESHOLD 0 or 6

NUM_NAI 4


NAI_ENTRY_INDEX 4

NAI_LENGTH 8

NAI 8 NAI_LENGTH

T_BIT 1

HOME_ADDRESS 32

PRIMARY_HOME_AGENT 32

SECONDARY_HOME_AGENT 32


MN-AAA-SPI_INDICATOR 1

MN-AAA_SPI 0 or 32


MN-HA_SPI_INDICATOR 1

MN-HA_SPI 0 or 32


5

RETRY_INFO_INCLUDED - Indicate if the retry information is included or not. 6

If MAX_NUM_RETRY, FIRST_RETRY_TIMEOUT and 7

REREG_THRESHOLD are included in this block, the mobile 8



MAX_NUM_RETRY - Maximum Number of Retry for the MobileIPMobile IP 11

Registration. 12

3GPP2 C.S0016-D v2.0

3-196

If RETRY_INFO_INCLUDED is set to ‘0’, the mobile station 1

shall omit this field; otherwise, the mobile station shall set 2

this field as follows: 3


number of retries for MobileIPMobile IP registration. 5

FIRST_RETRY_TIMEOUT - The amount of time elapsed between the first and second 6

MobileIPMobile IP Registration Requests, while the mobile 7

station did not receive the MobileIPMobile IP Registration 8

Reply. 9

If RETRY_INFO_INCLUDED is set to ‘0’, this field shall be 10

omitted; otherwise, this field shall be set as follows: 11

This field shall be set to one less than the number of amount 12

of time elapsed, in units of 250ms, between the first and 13

second MobileIPMobile IP Registration Requests, while the 14

mobile station did not receive the MobileIPMobile IP 15

Registration Reply. 16

REREG_THRESHOLD -Re-Registration Threshold. 17

If RETRY_INFO_INCLUDED is set to ‘0’, the mobile station 18

shall omit this field; otherwise, the mobile station shall set 19

this field as follows: 20

The mobile station shall set this field to the time, in units of 21

minute, before the expiration of the registration lifetime that 22

the mobile will try to reregister. 23

NUM_NAI - Number of MobileIPMobile IP NAI Entries. 24


MobileIPMobile IP NAI entries. 26


NAI_ENTRY_INDEX - MobileIPMobile IP NAI entry index. 28


MobileIPMobile IP NAI Table. 30

NAI_LENGTH - MobileIPMobile IP NAI length. 31

The mobile station shall set this field to the length of the 32

MobileIPMobile IP NAI, in units of octet. 33





T_BIT - Reverse Tunneling. 38

The mobile station shall set this field to ‘1’ if the reverse 39

tunneling is required or set to ‘0’ if reverse tunneling is not 40

required, see [13]. 41

HOME_ADDRESS - Home Address. 42

The mobile station shall set this field to the IP address of the 43

mobile node in the form of network byte code. 44

3GPP2 C.S0016-D v2.0

3-197

PRIMARY_HOME_AGENT - Primary Home Agent. 1


mobile node's primary home agent in the form of network byte 3

code. 4

SECONDARY_HOME_AGENT - Secondary Home Agent. 5


mobile node's back-up/secondary home agent in the form of 7

network byte code. 8

MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) 9


algorithm used to calculate the Mobile IP MN-AAA 11

Authentication Extension as defined in [15]. The 12

Authentication Algorithm is encoded corresponding to Table 13

3.5.8.6-1. 14

15

Table 3.5.8.6-1 Authentication Algorithm Parameter Values 16

MN-AAA_AUTH_ALGORITHM/

MA-HA_AUTH_AlGORITHM

Binary Value

None ‘0000’

MD5 ‘0001’


17

MN-AAA_SPI_INDICATOR - Indicator of SPI between MN and AAA. 18

The mobile station shall set this field to ‘1’ if the Security 19

Parameter Index is included; otherwise, the mobile station 20


MN-AAA_SPI - SPI between MN and AAA. 22

If the MN-AAA_SPI_INDICATOR field is set to ‘1’, the mobile 23

station shall set this field to the Security Parameter Index 24

(MN-AAA); otherwise, the mobile station shall omit this field. 25

MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) 26


algorithm used to calculate the Mobile IP MN-HA 28


Authentication Algorithm is encoded according to Table 30

3.5.8.6-1. 31

MN-HA_SPI_INDICATOR - Indicator of SPI between MN and HA. 32

The mobile station shall set this field to ‘1’ if Security 33

Parameter Index is included; otherwise, the mobile station 34


MN-HA_SPI - SPI between MN and HA. 36

3GPP2 C.S0016-D v2.0

3-198

If the MN-HA_SPI_INDICATOR field is set to ‘1’, the mobile 1


between MN and HA; otherwise, mobile station shall omit this 3

field. 4




number of octets. The mobile station shall set these bits to ‘0’. 8

3.5.8.7 SimpleIPSimple IP Status Parameters 9

10

Field Length (bits)

ACT_NAI_ENTRY_INDEX 4

RESERVED 4

11

ACT_NAI_ENTRY_INDEX - Active SimpleIPSimple IP NAI entry index. 12

The mobile station shall set this field to the active 13

SimpleIPSimple IP NAI entry index. 14






3.5.8.8 MobileIPMobile IP Status Parameters 20

21

Field Length (bits)


NUM_ADD_ACT_NAI 4

NUM_ADD_ACT_NAI occurrences of the following field:

ADD_ACT_NAI_ENTRY_INDEX 4

RESERVED 0 or 4 (as needed)

22

ACT_NAI_ENTRY_INDEX - Active MobileIPMobile IP NAI entry index. 23


MobileIPMobile IP NAI entry index. 25

NUM_ADD_ACT_NAI - Number of additional Active MobileIPMobile IP NAI entries. 26

3GPP2 C.S0016-D v2.0

3-199


additional active MobileIPMobile IP NAI entries. 2

ADD_ACT_NAI_ENTRY_INDEX - Additonal Active MobileIPMobile IP NAI entry index. 3






number of octets. 9


11

3.5.8.9 SimpleIPSimple IP PAP SS Parameters 12

13

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

SS_LENGTH 5

SS 8 SS_LENGTH


14








SS_LENGTH - Shared Secret Data Length. 22

The mobile station shall set this field to the length, in units of 23

octet, of the shared secret data. The mobile station shall 24

support the shared secret data of at least 16 octets long. 25

SS - Shared Secret Data. 26

3GPP2 C.S0016-D v2.0

3-200

The mobile station shall set this field to the Shared Secret 1

Data. 2





7

3.5.8.10 SimpleIPSimple IP CHAP SS Parameters 8

9

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

SS_LENGTH 5

SS 8 SS_LENGTH


10












SS - Shared Secret Data 22


Data. 24





29

3GPP2 C.S0016-D v2.0

3-201

3.5.8.11 MobileIPMobile IP SS Parameters 1

2

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

MN-AAA_SS_LENGTH 5

MN-AAA_SS 8 MN-AAA_SS_LENGTH

MN-HA_SS_LENGTH 5

MN-HA_SS 8 MN-FA_SS_LENGTH


3








MN-AAA_SS_LENGTH - Shared Secret Data Length between MN and AAA. 11


octet, of the shared secret data between MN and AAA. The 13

mobile station shall support the shared secret data of at least 14

16 octets long. 15

MN-AAA_SS - Shared Secret Data between MN and AAA. 16


Data between MN and AAA. 18

MN-HA_SS_LENGTH - Shared Secret Data Length between MN and HA. 19




MN-HA_SS - Shared Secret Data between MN and HA. 23


Data between MN and HA. 25


3GPP2 C.S0016-D v2.0

3-202



number of octets. The mobile station shall set these bits to 3

‘0’. 4

3.5.8.12 HRPD Access Authentication Capability Parameters 5

The PARAM_DATA field of the HRPD [9] Access Authentication Capability Parameters Block 6


8

Field Length (bits)

MAX_NAI_LENGTH 8

MAX_SS_LENGTH 5

RESERVED 3

AUTH_ALGORITHM 8

9

MAX_NAI_LENGTH - Maximum Access Authentication NAI length. 10


in units of octets, of the NAIs supported by the mobile station. 12

The mobile station shall support an NAI length of at least 72 13

octets. If multiple authentication algorithms support is 14

indicated, the mobile station shall set this field to the 15

maximum of the NAI length allocated for the supported 16

algorithms. The MAX_NAI_LENGTH shall be 72 octets or 17

greater.11 18

MAX_SS_LENGTH - Maximum Length of the Shared Secret Data. 19


in units of octets, of the shared secret data supported by the 21

mobile station. The mobile station shall support an SS length 22

of at least 16 octets long. If multiple authentication 23


this field to the maximum of the SS length allocated for the 25

supported algorithms. The MAX_SS_LENGTH shall be 16 26

octets or greater. 27






AUTH_ALGORITHM - HRPD Access Authentication Algorithm supported by the 33

mobile station. 34


3GPP2 C.S0016-D v2.0

3-203

The mobile station shall set this field to the HRPD access 1

authentication algorithms supported by the mobile station in 2

the form of bitmap. The Authentication Algorithm is encoded 3

as follows: 4

5

Table 3.5.8.12-1 AUTH_ALGORITHM Parameter Values 6

Subfield

Length (bits)


PPP CHAP 1 CHAP mode-[11]

RESERVED 7

The mobile station shall set each subfield to ‘1’, if the corresponding 7

authentication algorithm is supported by the mobile station; otherwise, the 8

mobile station shall set the subfield to ‘0’. 9

10

3.5.8.13 HRPD Access Authentication User Profile Parameters 11

The PARAM_DATA field of the HRPD Access Authentication User Profile Parameters Block 12


14

Field Length (bits)

NAI_LENGTH 8

NAI 8 NAI_LENGTH

AUTH_ALGORITHM 4

RESERVED 4

15

NAI_LENGTH - NAI length. 16







AUTH_ALGORITHM - Authentication Algorithm for HRPD Access Authentication. 23


algorithm used to calculate the HRPD Access Authentication. 25

The Authentication Algorithm is specified in Table 3.5.8.13-1. 26

3GPP2 C.S0016-D v2.0

3-204

Table 3.5.8.13-1 Authentication Algorithm Parameter Values 1

AUTH_ALGORITHM Binary Value

None ‘0000’

PPP CHAP ‘0001’


2



5

3.5.8.14 HRPD Access Authentication CHAP SS Parameters 6

7

Field Length (bits)

SS_LENGTH 5

SS 8 SS_LENGTH

RESERVED 3







Data. 14





19

3GPP2 C.S0016-D v2.0

3-205

3.5.8.15 eHRPD AKA Algorithm Capability Parameters 1

The PARAM_DATA field of the eHRPD AKA Algorithm Capability Parameters Block consists 2

of the following fields: 3

4

Field Length (bits)

AKA_ALGORITHM 8

5

AKA_ALGORITHM - eHRPD AKA authentication algorithms bitmap to indicate 6

which AKA authentication algorithms are supported by the 7

mobile station. 8

The mobile station shall set this field to the value in the form 9

of bitmap as follows: 10

11

Subfield

Length (bits)


MILENAGE 1 MILENAGE supported as specified in [29]

RESERVED 7 -

12

The Mobile Station shall set each subfield to ‘1’, if the corresponding 13

operating mode is supported by the mobile station; otherwise the mobile 14

station shall set the subfield to ‘0’. 15

16






22

3.5.8.16 eHRPD MILENAGE Algorithm Parameters 23

24

Field Length (bits)

OP_PARAM_VALUE 128

OP_PARAM_TYPE 1

RESERVED 7

25

3GPP2 C.S0016-D v2.0

3-206

OP_PARAM_VALUE - 128-bit MILENAGE Operator Variant Algorithm Configuration 1

Field (see to [29]). 2

OP_PARAM_TYPE - If this bit is ‘0’, the mobile station shall treat 3

OP_PARAM_VALUE as the OP parameter defined in [29]; 4

otherwise, the mobile sation shall treat OP_PARAM_VALUE as 5

the OPc parameter defined in [29]. 6





The mobile station shall set these bits to ‘0000000’. 11

12

3.5.9 MMD Parameter Block 13

Table 3.5.9-1 lists the types of parameter blocks used in the MMD Configuration Request 14

Message and the MMD Configuration Response Message. 15

16

Table 3.5.9-1 MMD Parameter Block Types 17


MMD Application Parameters ‘00000000’ 3.5.9.1


‘11111111’

3GPP2 C.S0016-D v2.0

3-207

1

3.5.9.1 MMD Application Parameters 2

The PARAM_DATA field of the MMD Application Parameters Block consists of the following 3

fields: 4

5

Field Length (bits)

IMPI_LENGTH 8

IMPI 8 IMPI_LENGTH

NUM_IMPU 4

NUM_IMPU occurrences of the following fields:

IMPU_ENTRY_IDX 4

IMPU_LENGTH 8

IMPU 8 IMPU_LENGTH

SIP_URI_LENGTH 8

SIP_DOMAIN_URI 8 SIP_URI_LENGTH

NUM_P-CSCF 4

NUM_P-CSCF occurrences of the following fields:

P-CSCF_ENTRY_IDX 4

P-CSCF_LENGTH 8

P-CSCF_ADDRESS 8 P-CSCF_LENGTH

RESERVED 0 to 7

IMPI_LENGTH - IMS Private Identity length 6

The mobile station shall set this field to the length of the IMPI 7

in units of octets 8

IMPI - IMS Private Identity. 9

The mobile station shall set this field to the IMS Private 10

Identity, encoded in ASCII string, refer to [17]. 11

NUM_IMPU - Number of IMS Public Identity entries. 12

The mobile station shall set this field to the number of IMS 13

Public Identity entries. 14

The mobile station shall include NUM_IMPU occurrences of the following fields: 15

IMPU_ENTRY_IDX - IMPU entry index. 16

3GPP2 C.S0016-D v2.0

3-208

The mobile station shall set this field to the index in the IMPU 1

Table. 2

IMPU_LENGTH - IMS Public Identity length. 3


IMPU in units of octet. 5

IMPU - IMS Public Identity. 6

The mobile station shall set this field to the IMS Public 7

Identity (IMPU), encoded in ASCII string, refer to [17]. 8

SIP_URI_LENGTH - SIP Domain URI length. 9

The mobile station shall set this field to the length of the SIP 10

Domain URI. 11

SIP_DOMAIN_URI - SIP Domain URI. 12

The mobile station shall set this field to the SIP Domain URI, 13

encoded in ASCII string, refer to [17]. 14

NUM_P-CSCF - Number of P-CSCF entries 15

The mobile station shall set this field to the number of P-16

CSCF entries. 17

The mobile station shall include NUM_P-CSCF occurrences of the following fields: 18

P-CSCF_ENTRY_IDX - P-CSCF entry index. 19

The mobile station shall set this field to the index in the P-20

CSCF Table. 21

P-CSCF_LENGTH - P-CSCF length. 22

The mobile station shall set this field to the length of the P-23

CSCF in units of octet. 24

P-CSCF_ADDRESS - P-CSCF address. 25

The mobile station shall set this field to the P-CSCF address, 26

encoded in ASCII string, refer to [17] 27





32

3GPP2 C.S0016-D v2.0

3-209

3.5.10 System Tag Parameter Blocks 1

Table 3.5.10-1 lists the types of parameter blocks used in the System Tag Configuration 2

Request Message and the System Tag Configuration Response Message. 3

4

Table 3.5.10-1 System Tag Parameter Block Types 5

System Tag Parameter Block Type BLOCK_ID Reference

Home System Tag ‘00000000’ 3.5.10.1

Group Tag List Dimensions ‘00000001’ 3.5.10.2

Group Tag List ‘00000010’ 3.5.10.3

Specific Tag List Dimensions ‘00000011’ 3.5.10.4

Specific Tag List ‘00000100’ 3.5.10.5

Call Prompt List Dimensions ‘00000101’ 3.5.10.6

Call Prompt List ‘00000110’ 3.5.10.7


‘11111111’

6

3.5.10.1 Home System Tag 7

The PARAM_DATA field of the Home System Tag Block consists of the following fields: 8

9

Field Length (bits)

CALL_PRMPT_INCL 1

CALL_PRMPT 0 or 5

RESERVED 0 or 5

TAG_ENCODING 5

TAG_LEN 5

TAG TAG_LEN 8

10

CALL_PRMPT_INCL - Call Prompt Included Flag. 11

The mobile station shall set this field to ‘1’ if the CALL_PRMPT 12

field is included in this parameter block. Otherwise, the 13

mobile station shall set this field to ‘0’ 14

CALL_PRMPT - Call prompt identifier. 15

3GPP2 C.S0016-D v2.0

3-210

If a Call Prompt is associated with the Home System Tag, the 1

mobile station shall set this field to the associated Call 2

Prompt Identifier (see 3.5.10.4). Otherwise, this field shall be 3

omitted. 4


If CALL_PRMPT_INCL is set to ‘0’, the mobile station shall set 6

this field to ‘00000’. Otherwise, this field shall be omitted. 7

TAG_ENCODING - Home system tag encoding. 8

See [4]. This field shall be set to indicate the character set 9

used in the TAG field included in this parameter block. 10

TAG_LEN - Length of home system tag. 11

The mobile system shall set this field to the length of the 12

home system tag in octets. 13

TAG - Home system tag. 14

The mobile station shall set this field to characters based on 15

the encoding method defined in TAG_ENCODING. 16

3.5.10.2 Group Tag List Dimensions 17

The PARAM_DATA field of the Group Tag List Dimensions Block consists of the following 18

fields: 19

20

Field Length (bits)

MAX_GROUP_TAG_LIST_SIZE 16

CUR_GROUP_TAG_LIST_SIZE 16

GROUP_TAG_LIST_ID 16

CUR_TAG_P_REV 8

NUM_GROUP_TAG_RECS 8

21

MAX_GROUP_TAG_LIST_SIZE - Maximum group system tag list size. 22


octets, that the mobile station can support for the group 24

system tag list (GROUP_TAG_LISTs-p). 25

CUR_GROUP_TAG_LIST_SIZE - Current group system tag list size. 26


the current group system tag list. 28

GROUP_TAG_LIST_ID Group System Tag List Identification. 29


Group System Tag List Identification assigned for the group 31

system tag indicator list (GROUP_TAG_LISTs-p) by the base 32

station. 33

3GPP2 C.S0016-D v2.0

3-211

CUR_TAG_P_REV - Protocol revision of the mobile station’s current group tag list. 1


TAG_P_REV associated with its current group tag list. 3

NUM_GROUP_TAG_RECS - Number of Group System Tag Records. 4

The mobile station shall set this field to the number of group 5

system tag records contained within the GROUP_TAG_TABLE 6

field of the current group tag list. 7

3.5.10.3 Group Tag List Parameter Block 8

The PARAM_DATA field of the Group Tag List Block consists of the following fields: 9

10

Field Length (bits)

CUR_TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8

SEGMENT_DATA SEGMENT_SIZE 8

11

CUR_TAG_P_REV - Protocol revision for the system tag. 12


System Tag. The mobile station shall set this field to the value 14

of the TAG_P_REV associated with its current group tag list. 15





contains the last octet of the group tag list; otherwise, the 20




REQUEST_OFFSET from the corresponding System Tag 24




of the group tag list included in SEGMENT_DATA. 28

3GPP2 C.S0016-D v2.0

3-212

If REQUEST_OFFSET from the corresponding System Tag 1


invalid for the current group tag list, the mobile station shall 3

set this field to '0000 0000' and shall include no octets in the 4

SEGMENT_DATA field. 5


current group tag list, the mobile station shall include at most 7

REQUEST_MAX_SIZE sequential octets of the group tag list in 8

the SEGMENT_DATA field. 9

SEGMENT_DATA - Segment of the group tag list data. 10




include no octets in this field. 14




this field. This field contains SEGMENT_SIZEThe octets shall 18

be equal to the octets starting at the offset specified by 19

SEGMENT_OFFSET within the group tag list specified by 20

SEGMENT_OFFSET. 21

3.5.10.4 Specific Tag List Dimensions 22

The PARAM_DATA field of the Specific Tag List Dimensions Block consists of the following 23

fields: 24

25

Field Length (bits)

MAX_SPEC_TAG_LIST_SIZE 16

CUR_SPEC_TAG_LIST_SIZE 16

SPEC_TAG_LIST_ID 16

CUR_TAG_P_REV 8

NUM_SPEC_TAG_RECS 14

RESERVED 2

26

MAX_SPEC_TAG_LIST_SIZE - Maximum specific system tag list size. 27


octets, that the mobile station can support for the specific 29

system tag list (SPEC_TAG_LISTs-p). 30

CUR_SPEC_TAG_LIST_SIZE - Current specific system tag list size. 31


the current specific system tag list. 33

SPEC_TAG_LIST_ID Specific System Tag List Identification. 34

3GPP2 C.S0016-D v2.0

3-213


Specific System Tag List Identification assigned for the 2

specific system tag indicator list (SPEC_TAG_LISTs-p) by the 3

base station. 4

CUR_TAG_P_REV - Protocol revision of the mobile station’s current group tag list. 5


TAG_P_REV associated with its current specific tag list. 7

NUM_SPEC_TAG_RECS - Number of Specific System Tag Records. 8

The mobile station shall set this field to the number of specific 9

system tag records contained within its SPEC_TAG_TABLE 10

field of the current specific tag list 11



3.5.10.5 Specific Tag List Parameter Block 14

The PARAM_DATA field of the Specific Tag List Block consists of the following fields: 15

16

Field Length (bits)

CUR_TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8


17




of the TAG_P_REV associated with its current specific tag list. 21





contains the last octet of the specific tag list; otherwise, the 26







3GPP2 C.S0016-D v2.0

3-214


of the specific tag list included in SEGMENT_DATA. 2



invalid for the current specific tag list, the mobile station shall 5

set this field to '0000 0000' and shall include no octets in the 6

SEGMENT_DATA field. 7


current specific tag list, the mobile station shall include at 9

most REQUEST_MAX_SIZE sequential octets of the specific 10

tag list in the SEGMENT_DATA field. 11

SEGMENT_DATA - Segment of the specific tag list data. 12



invalid for the current specific tag list, the mobile station shall 15



current specific tag list, the mobile station shall include at 18

most REQUEST_MAX_SIZE sequential octets of the specific 19

tag list in this field.This field contains SEGMENT_SIZE The 20

octets shall be equal to the octets starting at the offset 21

specified by SEGMENT_OFFSET within the specific tag list 22

specified by SEGMENT_OFFSET. 23

24

3.5.10.6 Call Prompt List Dimensions 25

The PARAM_DATA field of the Call Prompt List Dimensions Block consists of the following 26

fields: 27

28

Field Length (bits)

MAX_CALL_PRMPT_LIST_SIZE 16

CUR_CALL_PRMPT_LIST_SIZE 16

CALL_PRMPT_LIST_ID 16

CUR_TAG_P_REV 8

NUM_CALL_PRMPT_RECS 8

29

MAX_CALL_PRMPT_LIST_SIZE - Maximum call prompt list size. 30


octets, that the mobile station can support for the call prompt 32

list (CALL_PRMPT_LISTs-p). 33

CUR_CALL_PRMPT_LIST_SIZE - Current call prompt list size. 34

3GPP2 C.S0016-D v2.0

3-215


the current call prompt list. 2

CALL_PRMPT_LIST_ID Call Prompt List Identification. 3

The mobile station shall set this field to the value of the Call 4

Prompt List Identification assigned for the call prompt list 5

(CALL_PRMPT_LISTs-p) by the base station. 6



TAG_P_REV associated with its current call prompt list. 9

NUM_CALL_PRMPT_RECS - Number of Call Prompt Records. 10

The mobile station shall set this field to the number of call 11

prompt records contained within its CALL_PRMPT_TABLE 12

field of the call prompt list 13

3.5.10.7 Call Prompt Tag List Parameter Block 14

The PARAM_DATA field of the Call Prompt List Block consists of the following fields: 15

16

Field Length (bits)

TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8


17




of the TAG_P_REV associated with its current specific tag list. 21





contains the last octet of the call prompt list; otherwise, the 26







3GPP2 C.S0016-D v2.0

3-216


of the call prompt list included in SEGMENT_DATA. 2



invalid for the current call prompt list, the mobile station 5

shall set this field to '0000 0000' and shall include no octets 6

in the SEGMENT_DATA field. 7


current call prompt list, the mobile station shall include at 9

most REQUEST_MAX_SIZE sequential octets of the call 10

prompt list in the SEGMENT_DATA field. 11

SEGMENT_DATA - Segment of the group tag list data. 12



invalid for the current call prompt list, the mobile station 15

shall include no octets in this field. 16


current call prompt list, the mobile station shall include at 18

most REQUEST_MAX_SIZE sequential octets of the call 19

prompt list in this field. This field contains 20

SEGMENT_SIZEThe octets shall be equal to the octets 21

starting at the offset specified by SEGMENT_OFFSET within 22

the call prompt list specified by SEGMENT_OFFSET. 23

3.5.11 Group Tag List, Specific Tag List and Call Prompt List 24

The group tag list (GROUP_TAG_LISTs-p) and the specific tag list (SPEC_TAG_LISTs-p) 25

contain information to be displayed on the mobile station when the mobile station is 26

obtaining a service in the roaming network. These information can be associated with 27

some parameters in the system record in the preferred roaming list. 28

The Group Tag List is associated with TAG_P_REV equal to ‘00000001’ and has the 29

following variable length format: 30

31

Group Tag List Field Length (bits)

GROUP_TAG_LIST_SIZE 16

GROUP_TAG_LIST_ID 16

TAG_P_REV 8

DEF_TAG_ENCODING 8

NUM_GROUP_TAG_RECS 8

GROUP_TAG_TABLE variable

GROUP_TAG_CRC 16

32

GROUP_TAG_LIST_SIZE - Group tag list size. 33

3GPP2 C.S0016-D v2.0

3-217

This field is set to the total size, in octets, of the group tag list, 1

including the GROUP_TAG_LIST_SIZE and 2

GROUP_TAG_LIST_CRC fields. 3

GROUP_TAG_LIST_ID Group Tag List Identification. 4


Group Tag List Identification assigned for the group tag list 6

(GROUP_TAG_LISTs-p) by the base station. 7

TAG_P_REV - Protocol revision of the Group Tag format. 8

This field is set to the value of the TAG_P_REV corresponding 9

this group tag list (GROUP_TAG_LISTs-p) structure. This field 10

determines the parsing rules for the Group Tag List. The base 11

station shall set this field to ‘00000001’ for this Group Tag 12

List structure. 13

DEF_TAG_ENCODING - Default tag encoding. 14

This field is set to the tag encoding method the mobile station 15

is to use when operating on group tags not specified in 16

GROUP_TAG_TABLE. 17

NUM_GROUP_TAG_RECS - Number of group tag records. 18

This field is set to the number of group tag records contained 19

in GROUP_TAG_TABLE (see Table 3.5.10.2-1). 20

GROUP_TAG_TABLE - Group Tag Table. 21

This field contains the Group Tag Records. The number of 22

group tag records is specified by NUM_GROUP_TAG_RECS. 23

The group tag record formats are specified in 3.5.10.2.1. 24

GROUP_TAG_LIST_CRC - CRC for group tag list. 25


3.5.11.13.5.10.1. 27

The Specific Tag List is associated with TAG_P_REV equal to ‘00000001’ and has the 28


30

Specific Tag List Field Length (bits)

SPEC_TAG_LIST_SIZE 16

SPEC_TAG_LIST_ID 16

TAG_P_REV 8

DEF_TAG_ENCODING 8

NUM_SPEC_TAG_RECS 14

RESERVED 2

SPEC_TAG_TABLE variable

SPEC_TAG_CRC 16

31

3GPP2 C.S0016-D v2.0

3-218

SPEC_TAG_LIST_SIZE - Specific tag list size. 1

This field is set to the total size, in octets, of the specific tag 2

list, including the SPEC_TAG_LIST_SIZE and 3

SPEC_TAG_LIST_CRC fields. 4

SPEC_TAG_LIST_ID Specific Tag List Identification. 5


Specific Tag List Identification assigned for the specific tag list 7

(SPEC_TAG_LISTs-p) by the base station. 8

TAG_P_REV - Protocol revision of the Specific Tag format. 9


this specific tag list (SPEC_TAG_LISTs-p) structure. This field 11

determines the parsing rules for the Specific Tag List. The 12

base station shall set this field to ‘00000001’ for this Specific 13

Tag List structure. 14



is to use when operating on specific tags not specified in 17

SPEC_TAG_TABLE. 18

NUM_SPEC_TAG_RECS - Number of specific tag records. 19

This field is set to the number of specific tag records 20

contained in SPEC_TAG_TABLE (see Table 3.5.10.3-1). 21



SPEC_TAG_TABLE - Specific Tag Table. 24

This field contains the Specific Tag Records. The number of 25

specific tag records is specified by NUM_SPEC_TAG_RECS. 26

The specific tag record formats are specified in 3.5.10.3.1. 27

SPEC_TAG_LIST_CRC - CRC for group tag list. 28


3.5.11.13.5.10.1. 30

The Call Prompt List is associated with TAG_P_REV equal to ‘00000001’ and has the 31


33

3GPP2 C.S0016-D v2.0

3-219

Call Prompt List Field Length (bits)

CALL_PRMPT_LIST_SIZE 16

CALL_PRMPT_LIST_ID 16

TAG_P_REV 8

DEF_TAG_ENCODING 8

NUM_CALL_PRMPT_RECS 14

RESERVED 2

CALL_PRMPT_TABLE variable

CALL_PRMPT_CRC 16

1

CALL_PRMPT_LIST_SIZE - Call prompt list size. 2

This field is set to the total size, in octets, of the specific tag 3

list, including the CALL_PRMPT_LIST_SIZE and 4

CALL_PRMPT_LIST_CRC fields. 5

CALL_PRMPT_LIST_ID Call Prompt List Identification. 6

The mobile station shall set this field to the value of the Call 7

Prompt List Identification assigned for the call prompt list 8

(CALL_PRMPT_LISTs-p) by the base station. 9

TAG_P_REV - Protocol revision of the Call Prompt format. 10


this call prompt list (CALL_PRMPT_LISTs-p) structure. This 12

field determines the parsing rules for the Call Prompt List. 13

The base station shall set this field to ‘00000001’ for this Call 14

Prompt List structure. 15



is to use when operating on call prompts not specified in 18

CALL_PRMPT_TABLE. 19

NUM_CALL_PRMPT_RECS - Number of call prompt records. 20

This field is set to the number of call prompt records 21

contained in CALL_PRMPT_TABLE (see Table 3.5.10.3-1). 22



CALL_PRMPT_TABLE - Call Prompt Table. 25

This field contains the Call Prompt Records. The number of 26

call prompt records is specified by NUM_CALL_PRMPT_RECS. 27

The call prompt record formats are specified in 3.5.10.3.1. 28

CALL_PRMPT_LIST_CRC - CRC for call prompt list. 29

3GPP2 C.S0016-D v2.0

3-220


3.5.11.13.5.10.1. 2

3.5.11.1 Group Tag List, Specific Tag List, and Call Prompt List CRC Calculation 3

The 16-bit group tag list, specific tag list, and call prompt list CRC fields 4

(GROUP_TAG_LIST_CRC, SPEC_TAG_LIST_CRC, CALL_PRMPT_LIST_CRC, respectively) are 5

calculated on all bits of the Group Tag List, Specific Tag List, or Call Prompt List (as 6

appropriate) excluding the bits of the GROUP_TAG_LIST_CRC, SPEC_TAG_LIST_CRC, and 7

CALL_PRMPT_LIST_CRC fields. The generator polynomial for this CRC is 8

g(x) = x16

+ x12

+ x5 + x

0. 9


Figure 2.2.1-2: 11

• Initially, all shift register elements are set to logical one and the switches are set in 12

the position A. 13

• The register is clocked with each preferred roaming list bit as an input, from the 14

most significant bit of the 15

GROUP_TAG_LIST_SIZE/SPEC_TAG_LIST_SIZE/CALL_PRMPT_LIST_SIZE field 16

through the least significant bit of the 17

GROUP_TAG_TABLE/SPEC_TAG_TABLE/CALL_PRMPT_TABLE field. 18

• The switches are set in the position B, and the register is clocked an additional 16 19


3.5.11.2 Group Tag Records 21

A group tag record contains parameters that the mobile station can use to display a system 22

tag. Each type of group tag record is tailored for use in determining a particular system 23

tag. 24

25

Table 3.5.11.2-1 Group Tag Record Type Values 26


Group Tag Record – Single Entry ‘000’

Group Tag Record – Range ‘001’

Reserved ‘010’ - ‘111’

27

3.5.11.2.1 Group Tag Record Format 28

3.5.11.2.1.1 Group Tag Record – Single Entry 29

This group tag record type is for use in displaying a system tag in associated with a 30

roaming indicator in the system record of the preferred roaming list, and has the following 31

variable length format: 32

3GPP2 C.S0016-D v2.0

3-221

1

Group Tag Record Field Length (bits)

GROUP_TAG_TYPE (‘000’) 3

ROAM_DISP_IND 4

ENCODING_INCL 1

TAG_ENCODING 0 or 5

ROAM_IND 8

CALL_PRMPT_INCL 1

CALL_PRMPT 0 or 5

TAG_LEN 5

TAG TAG_LEN 8

RESERVED 0, 2 or 5

2

GROUP_TAG_TYPE - Group tag record type. 3


ROAM_DISP_IND - Roaming display indicator. 5


for displaying the default roaming indicator on the mobile 7

station’s display. The values are: 8

9

ROAM_DISP_IND Action

‘0000’ Default Roaming Indicator off.

‘0001’ Default Roaming indicator on.

‘0010’ Default Roaming Indicator flashing.

‘0011’ – ‘1111’ Reserved

10

ENCODING_INCL - Tag encoding field included flag. 11

The mobile station shall set this field to ‘1’ if the 12

TAG_ENCODING field is included. Otherwise, the mobile 13


TAG_ENCODING - Group tag encoding format. 15



ROAM_IND - Roaming indicator 18

The mobile station shall set this field to the roaming indicator 19

value (see [4]) for which this Group Tag Record is associated. 20

3GPP2 C.S0016-D v2.0

3-222

CALL_PRMPT_INCL - Call Prompt Included Flag 1




CALL_PRMPT - Call prompt identifier 5




omitted. 9

TAG_LEN - Group tag length indicator. 10


in the TAG field. 12

TAG - Group tag. 13




The mobile station shall set this field to ‘00’ if 17

ENCODING_INCL = ‘0’ and CALL_PRMPT_INCL = ‘0’. The 18

mobile station shall set this field to ‘00000’ if either 19

ENCODING_INCL = ‘1’ or CALL_PRMPT_INCL = ‘1’. If 20

ENCODING_INCL = ‘1’ and CALL_PRMPT = ‘1’, this field shall 21

be omitted. 22

3.5.11.2.1.2 Group Tag Record – Range 23

This group tag record type is for use in displaying a system tag in associated with roaming 24

indicators in the system records of the preferred roaming list, and has the following 25

variable length format: 26

27

3GPP2 C.S0016-D v2.0

3-223

Group Tag Record Field Length (bits)

GROUP_TAG_TYPE (‘000’) 3

ROAM_DISP_IND 4

ENCODING_INCL 1

TAG_ENCODING 0 or 5

CALL_PRMPT_INCL 1

CALL_PRMPT 0 or 5

LOW_ROAM_IND 8

HIGH_ROAM_IND 8

ROAM_INC 3

TAG_LEN 5

TAG TAG_LEN 8

RESERVED 2, 5 or 7

1

GROUP_TAG_TYPE - Group tag record type. 2






8





‘0011’ – ‘1111’ Reserved

9

ENCODING_INCL - Tag encoding field included flag. 10




TAG_ENCODING - Group tag encoding format. 14




3GPP2 C.S0016-D v2.0

3-224








omitted. 8

LOW_ROAM_IND - Low roaming indicator 9


(ROAM_IND, see [4]) having the lowest value over the range of 11

ROAM_IND values for which this Group Tag Record is 12

associated. 13

HIGH_ROAM_IND - High roaming indicator 14


(ROAM_IND, see [4]) having the highest value over the range 16

of ROAM_IND values for which this Group Tag Record is 17

associated. 18

ROAM_INC - Roaming indicator increment 19

The mobile station shall set this field to the increment used to 20

construct the set of ROAM_INDs associated with this record. 21

ROAM_INDs associated with this record are multiples of this 22

value between LOW_ROAM_IND and HIGH_ROAM_IND 23

inclusive. This field shall be set to a value in the range 1 to 7 24

inclusive. 25

TAG_LEN - Group tag length indicator. 26



TAG - Group tag. 29




The mobile station shall set this field to ‘00’ if either 33

ENCODING_INCL = ‘1’ or CALL_PRMPT_INCL = ‘1’. If 34

ENCODING_INCL = ‘1’ and CALL_PRMPT_INCL = ‘1’, the 35

mobile station shall set this field to ‘00000’. If 36

ENCODING_INCL = ‘0’ and CALL_PRMPT_INCL = ‘0’, the 37


39

3.5.11.3 Specific Tag Records 40

A specific tag record contains parameters that the mobile station can use to display a 41

system tag. Each type of group tag record is tailored for use in determining a particular 42

system tag. 43

3GPP2 C.S0016-D v2.0

3-225

1

Table 3.5.11.3-1 Specific Tag Record Type Values 2


Specific Tag Record – Single Entry ‘000’

Specific Tag Record – Range ‘001’

Reserved ‘010’ - ‘111’

3

3.5.11.3.1 Specific Tag Record Format 4

3.5.11.3.1.1 Specific Tag Record – Single Entry 5

This specific tag record type is for use in displaying a system tag in associated with a SID 6

in the system record of the preferred roaming list, and has the following variable length 7

format: 8

9

Specific Tag Record Field Length (bits)

SPEC_TAG_TYPE (‘000’) 3

ROAM_DISP_IND 4

ENCODING_INCL 1

TAG_ENCODING 0 or 5

CALL_PRMPT_INCL 1

CALL_PRMPT 0 or 5

SID 15

TAG_LEN 5

TAG TAG_LEN 8

RESERVED 1, 3 or 6

10

SPEC_TAG_TYPE - Specific tag record type. 11






17



3GPP2 C.S0016-D v2.0

3-226



‘0011’ – ‘1111’ Reserved

1

ENCODING_INCL - Tag encoding indicator flag. 2




TAG_ENCODING - Tag encoding format. 6











omitted. 17

SID - System Identification 18

The mobile station shall set this field to the System 19

Identification (SID) corresponding to this Specific Tag Record. 20

(See [7]). 21

TAG_LEN - Tag length 22



TAG - Specific Tag. 25






mobile station shall set this field to ‘000’ if ENCODING_INCL 31

= ‘0’ and CALL_PRMPT_INCL = ‘0’. Otherwise, the mobile 32


3.5.11.3.1.2 Specific Tag Record – Range 34

This specific tag record type is for use in displaying a system tag in associated with SIDs in 35

the system records of the preferred roaming list, and has the following variable length 36

format: 37

3GPP2 C.S0016-D v2.0

3-227

1

Specific Tag Record Field Length (bits)

SPEC_TAG_TYPE (‘000’) 3

ROAM_DISP_IND 4

ENCODING_INCL 1

TAG_ENCODING 0 or 5

CALL_PRMPT_INCL 1

CALL_PRMPT 0 or 5

LOW_SID 15

HIGH_SID 15

SID_INC 3

TAG_LEN 5

TAG TAG_LEN 8

RESERVED 1, 4 or 7

2

SPEC_TAG_TYPE - Specific tag record type. 3






9





‘0011’ – ‘1111’ Reserved

10

ENCODING_INCL - Tag encoding indicator flag. 11




TAG_ENCODING - Tag encoding format. 15




3GPP2 C.S0016-D v2.0

3-228








omitted. 8

LOW_SID - Lowest applicable System Identification 9


Identification (SID) having the lowest value over the range of 11

SID values for which this Specific Tag Record is associated. 12

(See [7]). 13

HIGH_SID - Highest applicable System Identification 14


Identification (SID) having the highest value over the range of 16

SID values for which this Specific Tag Record is associated. 17

(See [7]). 18

SID_INC - System identifier increment 19

The mobile station shall set this field to the increment to be 20

used to construct SIDs of the systems associated with this 21

record. SIDs of the systems associated with this record are 22

multiples of this value between LOW_SID and HIGH_SID 23

inclusive. This field shall be set to a value in the range 1 to 7 24

inclusive. 25

TAG_LEN - Tag length 26



TAG - Specific Tag. 29






mobile station shall set this field to ‘0000’ if either 35

ENCODING_INCL = ‘1’ or CALL_PRMPT_INCL = ‘1’. The 36

mobile station shall set this field to ‘0000000’ if 37

ENCODING_INCL = ‘1’ and CALL_PRMPT_INCL = ‘1’. 38

39

3.5.11.4 Call Prompt Record Format 40

Each Call Prompt Record has the following format: 41

42

3GPP2 C.S0016-D v2.0

3-229

Call Prompt Record Field Length (bits)

CALL_PRMPT 5

CALL_PRMPT_TEXT_STATE 2

ENCODING_INCL 1

PRMPT_ENCODING 0 or 5

PRMPT_LEN 5

PRMPT PRMPT_LEN 8

RESERVED 3 or 6

1

CALL_PRMPT - Call prompt identifier. 2

The mobile station shall set this field to the call prompt 3

identifier for the given record entry. 4

CALL_PRMPT_TEXT_STATE - Call Prompt Text State 5

The mobile station shall set this field to the text state for the 6

text to be displayed by the mobile station according to the 7

following table: 8

9

CALL_PROMPT_TEXT_STATE Action

‘00’ Call Prompt text on.

‘01’ Call Prompt text flashing.

‘10’ – ‘11’ Reserved

10

ENCODING_INCL - Call prompt character encoding included flag. 11


PRMPT_ENCODING field is included. Otherwise, the mobile 13


PRMPT_ENCODING - Character Encoding. 15


used in the PRMPT field included in this parameter block. 17

PRMPT_LEN - Call prompt length indicator 18

The mobile station shall set this field to indicate the number 19

of octets of the PRMPT field. 20

PRMPT - Call prompt. 21

The mobile station shall set this field to the characters based 22

on the encoding method defined in PRMPT_ENCODING. 23


3GPP2 C.S0016-D v2.0

3-230


ENCODING_INCL = ‘0’. Otherwise, the mobile station shall 2


3.5.12 MMS Parameter Block 4

Table 3.5.12-1 lists the types of parameter blocks used in the MMS Configuration Request 5

Message and the MMS Configuration Response Message. 6

7

Table 3.5.12-1 MMS Parameter Block Types 8


MMS URI Parameters ‘00000000’ 3.5.12.1

MMS URI Capability Parameters ‘00000001’ 3.5.12.2


‘11111111’

3.5.12.1 MMS URI Parameters 9

The PARAM_DATA field of the MMS URI Parameters Block consists of the following fields: 10

11

Field Length (bits)

NUM_MMS_URI 4

NUM_MMS_URI occurrences of the following fields:

MMS_URI_ENTRY_IDX 4

MMS_URI_LENGTH 8

MMS URI 8 x MMS_URI_LENGTH

RESERVED 0 to 7

NUM_MMS_URI - Number of MMS URIs 12

The mobile station shall set this field to the number of MMS 13

URIs stored on the mobile, encoded in ASCII string, refer to 14

[16], [17] and [18]. 15

The mobile station shall include NUM_MMS_URI occurrences of the following fields: 16

MMS_URI_ENTRY_IDX - MMS URI entry index. 17

The mobile station shall set this field to the index in the MMS 18

URI Table, refer to [16], [17] and [18]. 19

MMS_URI_LENGTH - MMS URI length. 20

The mobile station shall set this field to the length of the URI 21

associated with the MMS Relay/Server in units of octet 22

3GPP2 C.S0016-D v2.0

3-231

MMS_URI - MMS_URI 1

The mobile station shall set this field to the URI of the MMS 2

Relay/Server, encoded in ASCII string, refer to [16], [17] and 3

[18]. 4





3.5.12.2 MMS URI Capability Parameters 9

The PARAM_DATA field of the MMS URI Capability Parameters Block consists of the 10


12

Field Length (bits)

MAX_NUM_MMS_URI 4

MAX_MMS_URI_LENGTH 8

RESERVED 7

13

MAX_NUM_MMS_URI - Maximum MMS URI Entries. 14


number of MMS URI entries supported by the mobile station. 16

MAX_MMS_URI_LENGTH - Maximum MMS URI length. 17


in units of octets, of the MMS URI supported by the mobile 19

station. 20





3GPP2 C.S0016-D v2.0

3-232

3.5.13 MMSS Configuration Parameter Blocks 1

Table 3.5.13-1 lists the types of parameter blocks used in the MMSS Configuration Request 2

Message and the MMSS Configuration Response Message. 3

4

Table 3.5.13-1 MMSS Configuration Parameter Block Types 5


AIR_INT_TYPE Supported ‘00000000’ 3.5.13.1

MMSS MODE SETTINGS ‘00000001’ 3.5.13.2

MMSS Location Associated Priority List (MLPL)

‘00000010’ 3.5.13.3

MMSS System Priority List (MSPL) ‘00000011’ 3.5.13.4

MMSS WLAN Configuration Parameter ‘00000100’ 3.5.13.5

Reserved for future access technologies ‘00000101’ through ‘01111111’


‘10000000’ through ‘11111110’

See [4]


6

3.5.13.1 AIR_INT_TYPE SUPPORTED Parameter Block 7

PARAM_DATA consists of the following: 8

9


WiMAX SUPPORTED 1

WLAN SUPPORTED 1

GSM_SUPPORTED 1

UMTS_SUPPORTED 1

LTE_SUPPORTED 1

1x_SUPPORTED 1

HRPD_SUPPORTED 1

Reserved for future types of access technologies

57

10

3GPP2 C.S0016-D v2.0

3-233

WiMAX_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 1

station is capable of supporting WiMAX; otherwise this field 2


WLAN SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 4

station is capable of supporting WLAN; otherwise this field 5


GSM_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 7

station is capable of supporting GSM; otherwise this field 8


UMTS_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 10

station is capable of supporting UMTS; otherwise this field 11


LTE_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 13

station is capable of supporting LTE; otherwise this field shall 14

be set to ‘0’. 15

1x_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 16

station is capable of supporting 1x; otherwise this field shall 17

be set to ‘0’. 18

HRPD_SUPPORTED - The mobile shall set this field to ‘1’ to indicate that the mobile 19

station is capable of supporting HRPD; otherwise this field 20


22

3.5.13.2 MMSS MODE SETTINGS Parameter Block 23

The MMSS Mode Settings is applicable to cdma2000 and non-cdma2000 cellular systems. 24

The MMSS Mode Settings is associated with MMSS System Priority List. The PARAM_DATA 25

field of the MMSS Mode Settings consists of the following fields: 26

27

Field Length (bits)

MMSS_MODE 8

28

MMSS_MODE - MMSS Mode. 29

The mobile station shall set this field to the current MMSS 30

mode of the mobile station where: 31

Manual mode – systems are selected manually by the user. 32

Power-up Auto mode - the mobile station automatically 33

acquires the appropriate system during power-up. After 34

power-up, selections are preformed manually. 35

Automatic mode – the appropriate system is selected 36

automatically. 37

The values for each mode are given in the following table. 38

39

3GPP2 C.S0016-D v2.0

3-234

Bit MMSS Allowed Modes

Bit 0 Manual Allowed ‘XXXXXXX1’

Manual not Allowed ‘XXXXXXX0’

Bit 1 Power-up Auto Mode Allowed ‘XXXXXX1X’

Power-up Auto Mode not Allowed ‘XXXXXX0X’

Bit 2 Automatic Allowed ‘XXXXX1XX’

Automatic not Allowed ‘XXXXX0XX’

Bits 3 – 7 RESERVED

1



4

3.5.13.3 MMSS Location Associated Priority List (MLPL) Parameter Block 5

The MLPL is a list of groupings based on location specific information. MLPL allows the 6

base station to specify the MMSS System Priority List to be used in a location grouping. 7

Different types of location groupings are specified in Table 3.5.13.3-1. Each entry in the 8

MLPL points to an MSPL (see section 3.5.13.4). 9

The MLP_LISTS-P, which stores the MLPL, consists of the following fields: 10

11

Field Length (bits)

MLPL_SIZE 16

CUR_MMSS_P_REV 8

MLPL_VER_ID 16

MLPL_ID 8

NUM_MLPL_RECS 8

NUM_MLPL_RECS occurrences of the following three fields: 12

LOC_PARAM_TYPE 8

LOC_PARAM_VAL Variable

MSPL_INDEX 8

RESERVED 0 to 7

MLPL_CRC 16

13

3GPP2 C.S0016-D v2.0

3-235

MLPL_SIZE - MMSS Location associated priority list size. 1

This field is set to the total size, in octets, of the MLPL, 2

including the MLPL_SIZE and MLPL_CRC fields. 3

CUR_MMSS_P_REV - Protocol Revision of the mobile station’s current 4

MMSS_P_REV 5


MMSS_P_REV associated with this MLPL. 7

MLPL_VER_ID - MLPL Version Identification 8

The mobile station shall set this field to the value of the MLPL 9

Version Identification assigned for the MLPL (MLP_LISTs-p) by 10

the base station. 11

MLPL_ID - MMSS Location Priority List identification. 12

Unique identification for the MLPL assigned by the base 13

station. 14

NUM_MLPL_RECS - Number of MMSS Location Associated priority records. 15

This field is set to the number of entries in the MLPL. 16

LOC_PARAM_TYPE - Location Parameter Type 17

This field identifies the parameter used for Location grouping. 18

Possible parameters are described in Table 3.5.13.3-1. The 19

location parameter type can be specified as any combinations 20

of MCC, MNC and NUM_SYS_LOC_TAG. The 21

NUM_SYS_LOC_TAG bit specifies the location grouping to 22

which this MLPL record belongs. When bits 0, 1, and 2 are all 23

set to ‘0’ the ‘Default’ type shall be used. The ‘Default’ type 24

represents the case when no location information is available 25

to the device. 26

27

3GPP2 C.S0016-D v2.0

3-236

Table 3.5.13.3-1 LOC_PARAM_TYPE 1

Bit LOC_PARAM_TYPE Description

Bit 7 Reserved

Bit 6 Reserved

Bit 5 Reserved

Bit 4 Reserved

Bit 3 Reserved

Bit 2 NUM_SYS_LOC_TAG specified ‘XXXXX1XX’

NUM_SYS_LOC_TAG not specified ‘XXXXX0XX’

Bit 1 MNC specified ‘XXXXXX1X’

MNC not specified ‘XXXXXX0X’

Bit 0 MCC specified ‘XXXXXXX1’

MCC not specified ‘XXXXXXX0’

2

Reserved - Reserved bit. 3

The mobile station shall set each reserved bit to ‘0’. 4

LOC_PARAM_VAL - Location Parameter Value 5

LOC_PARAM_VAL is the value of the Location Parameter 6

used. The length of this field is variable in length and depends 7

on the LOC_PARAM_TYPE used for location grouping. 8

If bit 0 of LOC_PARAM_TYPE is set to ‘1’, LOC_PARAM_VAL 9

begins with an MCC field. 10


contains a MNC field. 12


will contain a field called NUM_SYS_LOC_TAG. This field 14

specifies the number of additional records that are present in 15

LOC_PARAM_VAL. The fields in LOC_PARAM_VAL for each 16

LOC_PARAM_TYPE is described in Table 3.5.13.3-2. 17

18

3GPP2 C.S0016-D v2.0

3-237

Table 3.5.13.3-2 LOC_PARAM_VAL 1

LOC_PARAM_VAL Length in bits

MCC 0 or 12

MNC 0 or 12

NUM_SYS_LOC_TAG 0 or 8

If LOC_PARAM_TYPE has the value ‘XXXXX1XX’, the LOC_PARAM_VAL has 2

NUM_SYS_LOC_TAG occurrences of the following fields: 3

SYS_TYPE 8

SYS_LOC_TAG_SIZE 8

SYS_LOC_TAG Variable

RESERVED 0 to 7

4


If Bit 0 of LOC_PARAM_TYPE is set to ‘1’, this field shall be 6

included and shall be set to the Mobile Country Code using 7

BCD encoding; otherwise this field shall be omitted. 8


If Bit 1 of LOC_PARAM_TYPE is set to ‘1’, this field shall be 10

included and shall be set to the Mobile Network Code using 11

BCD encoding. If the length of the MNC is two digits, the 12

least significant digit is encoded with 0xF‘F’. For example, 13

MNC=23 is set to 0x23F‘23F’ [31]. 14

Otherwise this field shall be omitted. 15

NUM_SYS_LOC_TAG - Number of System Location Tags 16

If Bit 2 of LOC_PARAM_TYPE is set to ‘1’, this field shall be set 17

to the number of system location information applicable to 18

this LOC_PARAM_VAL; otherwise this field shall be omitted. 19

SYS_TYPE - System Type. 20

This field shall be set to the system type specified in Table 21

3.5.13.4-1. 22

SYS_LOC_TAG_SIZE - System Location Tag Size 23

Size of SYS_LOC_TAG in bits. 24

SYS_LOC_TAG - System Location Tag. 25

This field shall be set according to the system record 26

associated with the system type specified in SYS_TYPE 27

If SYS_TYPE is set to ‘00000000’ (cdma2000_AI) or 28

‘00000011’ (cdma2000 1x) the SYS_LOC_TAG shall consist of 29


31

3GPP2 C.S0016-D v2.0

3-238

System Location Tag Length in bits

RESERVED 1

SID 15

NID_START 16

NID_RANGE 8

1



SID - System ID. 4

A number uniquely identifying a cdma2000 system. 5

NID_START - Network ID Start 6

NID_START specifies the first NID value from the cdma2000 7

PRL to be included in the System Location Tag. If NID_START 8

is set to ’1111111111111111’ (NID wildcard), any system with 9

a SID equal to the value in the SID field is a match to the 10

SYS_LOC_TAG. 11

NID_RANGE - Network ID Range. 12

NID_RANGE specifies the number of consecutive NIDs 13

following NID_START within the cdma2000 PRL. Therefore, 14

the last NID value specified by NID_RANGE shall be equal to 15

NID_START + NID_RANGE. If only one NID value is specified 16

(i.e., NID_START), the NID_RANGE shall be set to ‘00000000’. 17

18

If SYS_TYPE is set to ‘00000001’ (3GPP_AI), ‘00000101’ 19

(GERAN (GSM)), ‘00000110’ (UTRAN (UMTS)), or ‘00000111’ 20

(EUTRAN (LTE)), the SYS_LOC_TAG shall consist of the 21


23


PLMN_START 24

PLMN_RANGE 8

PLMN_START - PLMN Start 24

PLMN_START specifies the first PLMN [26] value from the 25

PLMN Selector List to be included in the System Location Tag. 26

PLMN_RANGE - PLMN Range. 27

PLMN_RANGE specifies the number of consecutive PLMNs 28

following PLMN_START within the PLMN Selector List. If only 29

one PLMN value is specified (i.e., PLMN_START), the 30

PLMN_RANGEOFFSET shall be set to ‘00000000’. 31

32

3GPP2 C.S0016-D v2.0

3-239

If SYS_TYPE is set to ‘00000100’ (cdma2000 HRPD), the 1

SYS_LOC_TAG shall consist of the following three fields: 2



SUBNET_IDCOMMON SUBNET_COMMON_LENGTH

RESERVED 0 to 7

3



maximum Subnet_LENGTH is 128. The values ‘'10000001’' 6



SECTOR_ID. 9





to make the length of this SYS_LOC_TAG equal to an integer 14

number of octets. Each reserved bit shall be set to ‘'0’. 15

SUBNET_COMMON_LENGTH - Length of the common part of the HRPD subnet. 16


HRPD subnet which is included in this record. The maximum 18

SUBNET_COMMON_LENGTH is 128. The values '10000001' 19


SUBNET_COMMON_LENGTH is 128, the SUBNET_ID is 21

equivalent to the SECTOR_ID. 22


This field is set to the HRPD subnet. 24




integer number of octets. Each reserved bit shall be set to '0 28

MSPL_INDEX - MMSS System Priority List Index 29

This field is set to the MSPL_ID of the MMSS System Priority 30

List corresponding to an MLPL entry. 31




integer number of octets. Each reserved bit shall be set to '0’. 35

MLPL_CRC - CRC for MLPL 36

3GPP2 C.S0016-D v2.0

3-240


3.5.14.1. 2

3

4

3.5.13.4 MMSS System Priority List (MSPL) 5

The MSPL is a prioritized list of cdma2000 and non-cdma2000 cellular systems. The 6

MSPL assists a multimode mobile station in selecting a system. Once a system is 7

selected, the mobile station follows the standard network selection procedures for the 8

selected system to acquire a network. There can be one or more MSPLs in the MS. The 9

MSPL can be sent to the mobile station over-the-Air. The MSPL is retained by the mobile 10

station when power is turned off. There shall be only one MSPL associated with a 11

location grouping in the MLPL. 12

The MSP_LISTS-P, which stores the MSPL, consists of the following fields: 13

14

Field Length (bits)

MSPL_SIZE 16

CUR_MMSS_P_REV 8

MSPL_VER_ID 16

NUM_MSPL_ID 8

NUM_MSPL_ID occurrences of the following fields:

{ (NUM_MSPL_ID}

MSPL_ID 8

NUM_MSPL_RECS 8

NUM_MSPL_RECS occurrences of the following six fields: 15

{ (NUM_MSPL_RECS} 16

SYS_TYPE 8

PRI_CLASS 4

SYS_PRI 1

HIGHER_PRI_SRCH_TIME 3

NETWORK_CAP_IND 1

NETWORK_CAP 6 or 0

} (NUM_MSPL_RECS)

} (NUM_MSPL_ID}

RESERVED 0 to 7

3GPP2 C.S0016-D v2.0

3-241

MSPL_CRC 16

1

MSPL_SIZE - MMSS system priority list size. 2

This field is set to the total size, in octets, of the MMSS 3

System Priority List, including the MSPL_SIZE and 4

MSPL_CRC fields. 5

CUR_MMSS_P_REV - Protocol Revision of the mobile station’s current 6

MMSS_P_REV 7


MMSS_P_REV associated with this MSPL. 9

MSPL_VER_ID - MSPL Version Identification 10

The mobile station shall set this field to the value of the MSPL 11

Version Identification assigned for the MSPL (MSP_LISTs-p) by 12

the base station. 13

NUM_MSPL_ID - Number of MSPL IDs 14

This field is set to the number of MSPL_IDs in this set of 15

MSPL_IDs. 16

MSPL_ID - MMSS system priority list identification. 17

MSPL_ID is the unique identifier of an MSPL table assigned 18

by the base station. 19

NUM_MSPL_RECS - Number of MMSS system priority records. 20

This field is set to the number of MMSS system priority 21

records contained in the MSPL block. 22

SYS_TYPE - System Type identification. 23

The system type shall be set according to Table 3.5.13.4-1. 24

25

3GPP2 C.S0016-D v2.0

3-242

Table 3.5.13.4-1 System Type 1

System Type Value

cdma2000_AI 00000000

3GPP_AI 00000001

WiMAX 00000010

cdma2000 1x 00000011

cdma2000 HRPD 00000100

GERAN (GSM) 00000101

UTRAN (UMTS) 00000110

EUTRAN (LTE) 00000111


‘00001000’ – ‘11111111’

2

PRI_CLASS - Priority Class. 3

Priority Class defines the selection priority to be used in a 4

system as allowed in that system. PRI_CLASS shall be one of 5

the following. 6

‘0000’- Home only. 7

The mobile station can only use the home network in 8

the system for system selection. This priority class 9

includes networks defined to be equivalent to the 10

home network. In some cases more than one network 11

may be defined in the home priority class; for example, 12

networks having equal priority in the network priority 13

list for the system. 14

‘0001’- Home + Preferred. 15

This priority class includes both home and preferred 16

networks. The mobile station can use home priority 17

networks and preferred networks in the system for 18

system selection. A preferred network of a system is 19

defined as a network with the second highest priority 20

in the priority list. 21

‘0010’ to ‘1110’ – Reserved. 22

‘1111’- Any. 23

This priority class includes home, preferred and any 24

networks for the system, including ones that are not 25

listed or considered a preferred network in the priority 26

list of a system. The mobile station can use any 27

network in the system for system selection. 28

SYS_PRI - System Priority. 29

3GPP2 C.S0016-D v2.0

3-243

This field indicates the relative priority of systems in the 1

MMSS system priority table. The relative priority can be ‘more’ 2

(1) or ‘same’ (0). The last entry in the system priority table 3

has the system priority set to ‘0’. For each entry a ‘1’ indicates 4

that the current system type is of higher priority than the next 5

system type in the table. For each entry a ‘0’ indicates that 6

the current system type is of same priority as the next system 7

type in the table. 8

HIGHER_PRI_SRCH_TIME - Higher Priority Search Time. 9

Set to the time between searches of higher priority systems of 10

other radio access technologies that the mobile station may 11

use when this entry is the current system. This field shall be 12

set to the value from Table 3.5.13.4-2 corresponding to the 13

desired search time. 14

Table 3.5.13.4-2 Higher Priority Search Time 15

HIGHER_PRI_SRCH_TIME Description

‘000’ 1 minute

‘001’ 2 minutes

‘010’ 4 minutes

‘011’ 8 minutes

‘100’ 16 minutes




16

NETWORK_CAP_IND - Network Capability Indicator. 17

If a NETWORK_CAP is to be included in this MSPL record this 18

field shall be set to ‘1’. Otherwise this field shall be set to ‘0’. 19

NETWORK_CAP - Network Capability. 20

If the NETWORK_CAP_IND is set to ‘1’, this field shall be set 21

to a value from Table 3.5.13.4-3. Otherwise, it is omitted. 22

This field is used to indicate the general capability of a system 23

included in an MSPL record. For example, the presence of a 24

Voice and Data NETWORK_CAP can be used to differentiate a 25

GSM and GPRS voice and data system from a GSM voice only 26

system in an MSPL record to assist system selection by the 27

mobile station. In this case, a record with SYS_TYPE of 28

'00000101' including a Voice and Data NETWORK_CAP is 29

used to indicate both voice and data, and a record with 30

SYS_TYPE of '00000101' without NETWORK_CAP is used to 31

indicate Voice only. An MSPL that does not include 32

NETWORK_CAP does not differentiate between ‘Voice and 33

Data’ and ‘Voice only’ capability of SYS_TYPE '00000101'. 34

3GPP2 C.S0016-D v2.0

3-244

1

Table 3.5.13.4-3 Network Capability 2

NETWORK_CAP Value

Voice and Data ‘000000’

Reserved ‘000001’ – ‘111111’

3





MSPL_CRC - CRC for MSPL 8


3.5.14.1. 10

11

3.5.14 MMSS Location Associated Priority List and MMSS System Priority List 12

13

3.5.14.1 MLPL and MSPL CRC Calculation 14

The 16-bit CRC field MLPL_CRC (or MSPL_CRC) is calculated on all bits of MMSS Location 15

Associated Priority List (or MMSS System Priority List) excluding the bits of the MLPL_CRC 16

(or MSPL_CRC) field itself. The generator polynomial for this CRC is 17

g(x) = x16

+ x12

+ x5 + x

0. 18


Figure 2.2.1-2: 20

Initially, all shift register elements are set to logical one and the switches are set in the 21

position A. 22

The register is clocked with each MMSS Location Associated Priority List bit (or MMSS 23

System Priority List bit) as an input, from the most significant bit of the MLPL_SIZE 24

field (or MSPL_SIZE) through the least significant bit of the RESERVED field. 25

The switches are set in the position B, and the register is clocked an additional 16 26


28

3GPP2 C.S0016-D v2.0

3-245

3.5.13.5 MMSS WLAN Configuration Parameters 1

2


WLAN_AIR_INT_ALLOWED 1

NUM_WLAN_SERV_CAT 7

NUM_WLAN_SERV_CAT occurrences of the following fields:

WLAN_SERV_CAT_TYPE 8

AUTO_ACQ_ALLOWED 1


SIMULTANEOUS_ALLOWED 1

WLAN_SCAN_MODE 1

WLAN_SCAN_LIMIT 3

EMG_CALL_ALLOWED 1

VOIP_SERVICES_ALLOWED 1

POS_DET_ALLOWED 1

NUM_WLAN_AIR_INT 8 3

NUM_WLAN_AIR_INT occurrences of the following field: 4

WLAN_AIR_INT_TYPE 8

5

RESERVED 0 to 7

6

WLAN_AIR_INT_ALLOWED - The network shall set this field to ‘1’ if WLAN is allowed. 7

Otherwise, this field shall be set to ‘0’. 8

NUM_WLAN_SERV_CAT - If WLAN_AIR_INT_ALLOWED is set to ‘1’, set 9

NUM_WLAN_SERV_CAT to the number of WLAN service 10

categories supported. Otherwise this field shall be set to ‘0’. 11

WLAN_SERV_CAT_TYPE - This field is set according to Table 4.5.11.4-1 for the type of 12

service category for this record. 13

AUTO_ACQ_ALLOWED - This field shall be set to ‘1’ if WLAN can be acquired 14

automatically. Otherwise this field shall be set to ‘0’. 15

MANUAL_ACQ_ALLOWED - This field shall be set to ‘1’ if the mobile station is allowed to 16

enable WLAN manually. Otherwise this field shall be set to 17

‘0’. 18

3GPP2 C.S0016-D v2.0

3-246

SIMULTANEOUS_ALLOWED - This field shall be set to ‘1’ if the mobile station is allowed to 1

operate both WLAN radio when accessing or connected to 2

WLAN_SERV_CAT_TYPE of User Defined and cellular systems 3

at the same time. Otherwise this field shall be set to ‘0’. 4

WLAN_SCAN_MODE - If active scan is allowed, set this field to ‘1’. Otherwise, set 5

this field to ‘0’. 6

WLAN_SCAN_LIMIT - WLAN scanning duration is set by defining scan values given 7

in Table 4.5.11.4-1. The WLAN_SCAN_LIMIT is used by a 8

timer to allow the carrier to specify the maximum duration in 9

minutes that the mobile station is permitted to search for 10

WLAN based on time while the mobile station is in the idle 11

mode. If the mobile station has not acquired and selected a 12

WLAN system prior to the expiration of the timer, the mobile 13

station shall stop performing time-based searches for WLAN 14

systems. If another parameter causes the mobile station to 15

search for WLAN prior to the expiration of the timer, the timer 16

shall not be reset. If the duration of this parameter is reached, 17

the timer shall be reset when another parameter causes the 18

mobile station to search for WLAN. The specified parameter 19

does not require a continuous search for WLAN. This is a 20

time-based parameter for WLAN searches. Other parameters 21

(e.g. manual override, launch of an application, change in 22

location) that are not time-based can override this time-based 23

parameter. 24

EMG_CALL_ALLOWED - If emergency call is allowed, set this field to ‘1’. Otherwise, set 25


VOIP_SERVICES_ALLOWED - If VoIP services is allowed, set this field to ‘1’. Otherwise, set 27


POS_DET_ALLOWED - If position determination is allowed, set this field to ‘1’. 29

Otherwise, set this field to ‘0’. 30

NUM_WLAN_AIR_INT - This field shall be set to the number of WLAN air interfaces 31

supported for this record. Otherwise this field shall be set to 32

‘0’. 33

WLAN_AIR_INT_TYPE - WLAN_Air Interface Types. 34


3.5.13.5-1 to indicate the supported types of WLAN Air 36

Interface Radio. 37

Table 3.5.13.5-1 WLAN Air Interface Types 38

AIR_INT_TYPE Description

‘00000000’ Any IEEE 802.11 Air Interface

‘00000001’ Any WLAN Air Interface

‘00000010’-‘11111111’ Reserved

39

3GPP2 C.S0016-D v2.0

3-247


The base station shall add reserved bits as needed in order to 2



to ‘0’. 5

6

3GPP2 C.S0016-D v2.0

3-248

1

2

3

4

5

6

7

8

9

This page left intentionally blank. 10

3GPP2 C.S0016-D v2.0

4-1

4 BASE STATION PROCEDURES 1

4.1 Reserved 2

4.2 Initiation of the Programming Procedures 3

4.2.1 User-Initiated Procedure 4

If the base station sends a message to the mobile station on the CDMA Paging Channel or 5

Forward Common Control Channel, and if the active NAM of this mobile station has not 6

been provisioned, the base station should address the message using the ESN or MEID of 7


After receiving an activation origination, the base station should assign the mobile station 9

to a CDMA Traffic Channel or analog voice channel and perform appropriate procedures as 10

specified in 6.6.4 of [1] or 2.6.4 of [1]. 11

The base station should not process an activation origination as an implicit registration 12

(see 6.6.5.1 of [1] or 2.6.5.1 of [1]). The base station should not send the Mobile Station 13

Registered Message (see 7.7.3.3.2.15 of [1] or 3.7.3.3.2.15 of [1]) during the programming 14

session. 15

If the mobile station includes authentication information when sending an activation 16

origination, the base station should process the authentication data as required in 7.3.1 of 17

[1] or 3.3.1 of [1]. During the programming session, the base station should invoke 18

signaling message encryption and voice privacy (CDMA only) whenever available. 19

If the base station sets the AUTH field of the Access Parameters Message to ‘01’ or sets 20

SENDING RAND field of the MC-RR Parameters Message to ‘1’, and if the mobile station 21

does not include authentication information when sending an activation origination, the 22

base station shall not activate voice privacy or message encryption. 23

If the base station sets the AUTH field of the Access Parameters Message to ‘01’ or sets 24

SENDING RAND field of the MC-RR Parameters Message to ‘1’, and if the mobile station 25

includes authentication information when sending an activation origination, but 26

authentication fails, the base station may perform the following to provide signaling 27

message encryption and voice privacy prior to performing full mobile station activation: 28

• The base station should complete the exchange of the A-key information and, 29

optionally, set a non-default mobile station identifier. The base station should store 30

the information in its database so that authentication and key calculation can be 31

performed. 32

• Following the exchange of A-key information, the base station should perform SSD 33

update (see 3.3.2) procedures of 6.3.12.1.9 of [1] or 2.3.12.1.5 of [1]. The base 34

station may confirm the SSD update by performing the Unique Challenge-Response 35

Procedure defined in 6.3.12.1.5 of [1] or 2.3.12.1.4 of [1]. 36

• When the SSD update has been completed, the base station may send the Re-37

Authenticate Message (see 4.3.2). 38

3GPP2 C.S0016-D v2.0

4-2

• The base station may activate message encryption (see 4.3.3) and voice privacy (see 1

4.3.4). 2

4.2.2 Network-Initiated Procedure. 3

If the network initiates OTAPA for the mobile station that is already in a CDMA 4

Conversation Substate or the analog Conversation Task (i.e. the base station is 5

communicating with the mobile station on the CDMA Traffic Channel or on the Analog 6

Voice Channel), the base station shall send the OTAPA Request Message with the 7

START_STOP field set to ‘1’ to the mobile station in order to start the OTAPA session in the 8

mobile station. 9

If the network initiates OTAPA for the mobile station that is in the CDMA Mobile Station Idle 10

State, the base station shall do the following: 11

• The base station shall page the mobile station and establish a Traffic Channel using 12

the procedures defined in 7.6 of [1] or 3.6 of [1]. The base station shall request 13

Service Option 18 or 19, and perform service negotiation. 14

• If the base station establishes a service configuration, as specified in a Service 15

Connect Message, that includes a service option connection using Service Option 18 16

or 19, then the service option connection shall become part of the current service 17

configuration at the action time associated with the Service Connect Message. 18

Service Option 18 or 19 is considered connected when the current service 19

configuration includes a service option connection for it. 20

• When the Service Option 18 or 19 is connected, the Service Option shall discard all 21

primary traffic data bits received from the multiplex sublayer, and the base station 22

should transmit null traffic channel data. 23

• The base station shall send the OTAPA Request Message with the START_STOP field 24

set to ‘1’ to the mobile station in order to start the OTAPA session in the mobile 25

station. 26

4.3 Programming Data Download 27

4.3.1 OTA Data Message Processing 28

While in the CDMA Conversation Substate or the analog Conversation Task, the base 29

station may send the messages prescribed below. If the base station sends a message 30

requiring a response, the base station should wait for receipt of the appropriate response 31

before sending further Over-the-Air Service Provisioning messages. If the base station does 32

not receive a response to the message, it may retransmit the message. 33

If the base station receives any OTASP Data Message containing the RESULT_CODE = 34

‘00001010’, “Rejected - Mobile station locked”, or ‘00001011’, “Rejected - Invalid SPC” or 35

‘00001101’, “Rejected - Invalid SPASM”, indicating that the mobile station parameters are 36

locked (see 3.3.6 and 3.3.7), the base station may attempt to unlock the mobile station 37

before continuing the programming procedure. 38

3GPP2 C.S0016-D v2.0

4-3

If the base station receives any message containing a RESULT_CODE indicating any other 1

error condition, the base station may terminate the programming session, or select 2

appropriate action to correct the error condition. 3

4.3.1.1 Configuration Request Message Processing 4

1. Configuration Request Message: The base station should wait for a Configuration 5

Response Message. 6

4.3.1.2 Download Request Message Processing 7

2. Download Request Message: The base station should wait for a Download Response 8

Message. 9

4.3.1.3 Commit Request Message Processing 10

3. Commit Request Message: The base station should wait for a Commit Response 11

Message. Upon receipt of the Commit Response Message with the RESULT_CODE set to 12

‘00000000’, “Accepted - Operation successful,” the base station should update its 13

stored database to include the activation information. 14

4.3.1.4 Re-Authenticate Request Message Processing 15

4. Re-Authenticate Request Message: The base station should wait for a Re-Authenticate 16


4.3.1.5 MS Key Request Message Processing 18

5. MS Key Request Message: The base station should wait for an MS Key Response 19

Message. 20

4.3.1.6 Key Generation Request Message Processing 21

6. Key Generation Request Message: The base station should receive an MS Key 22

Response Message with RESULT_CODE equal to ‘00000000’, “Accepted - Operation 23

successful,” prior to sending this message. The base station should wait for a Key 24

Generation Response Message. 25

4.3.1.7 Protocol Capability Request Message Processing 26

7. Protocol Capability Request Message: The base station should wait for a Protocol 27

Capability Response Message or an Extended Protocol Capability Response Message. The 28

base station mayshall not send the Protocol Capability Request Message with additional 29

fields to the mobile stations which do not support the additional any or all fields defined 30

in Section 4.5.1.7 to any mobile station.12 31

12 A mobile station that does not support the additional fields ignores those fields and responds with

a Protocol Capability Response Message.The base station may use the first 8 bits of the received value

in the ESN field to determine if the value in the ESN field is a true ESN/UIMID (with a prefix other

than 0x80) or a pseudo-ESN/pseudo-UIMID (with a prefix of 0x80). The first 8 bits only indicates the

3GPP2 C.S0016-D v2.0

4-4

4.3.1.8 SSPR Configuration Request Message Processing 1

8. SSPR Configuration Request Message: The base station should wait for an 2

SSPR Configuration Response Message. 3

4.3.1.9 SSPR Download Request Message Processing 4

9. SSPR Download Request Message: The base station should wait for an SSPR 5

Download Response Message. 6

4.3.1.10 Validation Request Message Processing 7

10. Validation Request Message: The base station should wait for a Validation Response 8

Message. The following procedures may be used: 9

• In order to unlock the mobile station, the base station may send the Verify SPC 10

Parameter Block with the SPC field set to the value of the Service Programming 11

Code assigned to the mobile station. 12

• If the base station elects to change the value of the SPC assigned to the mobile 13

station, the base station may send the Change SPC Parameter Block with the 14

SPC field set to the value of the new Service Programming Code assigned to the 15

mobile station. If the base station elects to permanently unlock the mobile 16

station, the base station shall set the SPC field to the default value (see Table 17

3.3.6-1). 18

• In order to unlock the active mobile station NAM secured by SPASM, the base 19

station may send the Validate SPASM Parameter Block. 20


the base station should not send this Parameter Block. 22

- If the base station received the RAND_OTAPA value from the mobile station 23

in the OTAPA Response Message, the base station should set the 24

AUTH_OTAPA_INCL field to ‘1’ and the AUTH_OTAPA field to the value 25

computed by the base station as specified in 3.3.7. 26

- If the base station did not receive the RAND_OTAPA value from the mobile 27

station in the OTAPA Response Message, the base station may not send this 28

Parameter Block. If the base station sends this Parameter Block, the base 29

station should set the AUTH_OTAPA_INCL field to ‘0’ and omit the 30

AUTH_OTAPA field. 31

MEID capability of the mobile station if it is known by the base station that the mobile station is non-

RUIM capable.

3GPP2 C.S0016-D v2.0

4-5

- The base station should set the NAM_LOCK field to ‘1’ to activate SPASM 1

protection of programmable parameters and indicators of the active NAM for 2

subsequent OTAPA session, otherwise the base station should set this field 3

to ‘0’. SPASM protection specified by the value of the NAM_LOCK field will 4

take effect for the subsequent OTAPA session if it is committed into the 5

permanent mobile station memory during the current OTAPA session. 6

4.3.1.11 OTAPA Request Message Processing 7

11. OTAPA Request Message: The base station should wait for an OTAPA 8

Response Message. The following procedures may be used: 9

• If the programming session was initiated by the user as described in 3.2.1, the 10

base station should not send this message. 11

• In order to invoke the OTAPA session in the mobile station, the base station 12

shall set the START_STOP field to ‘1’ in the message. 13

• In order to terminate the OTAPA session in the mobile station, the base station 14


4.3.1.12 PUZL Configuration Request Message Processing 16

12. PUZL Configuration Request Message: The base station should wait for a PUZL 17


4.3.1.13 PUZL Download Request Message Processing 19

13. PUZL Download Request Message : The base station should wait for a 20

PUZL Download Response Message. 21

4.3.1.14 3GPD Configuration Request Message Processing 22

14. 3GPD Configuration Request Message: The base station should wait for a 3GPD 23


4.3.1.15 3GPD Download Request Message Processing 25

15. 3GPD Download Request Message: The base station should wait for a 3GPD 26


4.3.1.16 Secure Mode Request Message Processing 28

16. Secure Mode Request Message: The base station should wait for a 29

Secure Mode Response Message. The following procedures may be used: 30

• The base station shall generate the Secure Mode Ciphering Key (SMCK) as 31

specified in 4.3.5. If SMCK generation is unsuccessful, the base station shall not 32

send the message. 33

3GPP2 C.S0016-D v2.0

4-6

• In order to invoke the Secure Mode in the mobile station, the base station shall 1

set the START_STOP field to ‘1’ and the RAND_SM field to a randomly selected 2

64-bit value used for generating the Secure Mode Ciphering Key SMCK (see 3

4.3.5). Upon receipt of the Secure Mode Response Message with the 4

RESULT_CODE set to ‘00000000’, “Accepted - Operation successful,” the base 5

station should activate the Secure Mode as specified in 4.3.5. 6

• In order to terminate the Secure Mode in the mobile station, the base station 7


4.3.1.17 MMD Configuration Request Message Processing 9

17. MMD Configuration Request Message: The base station should wait for a MMD 10


4.3.1.18 MMD Download Request Message Processing 12

18. MMD Download Request Message: The base station should wait for a MMD 13


4.3.1.19 System Tag Configuration Request Message Processing 15

19. System Tag Configuration Request Message: The base station should wait for 16

a System Tag Configuration Response Message. 17

4.3.1.20 System Tag Download Request Message Processing 18

20. System Tag Download Request Message: The base station should 19

wait for a System Tag Download Response Message. 20

4.3.1.21 Service Key Generation Request Message Processing 21

21. Service Key Generation Request Message: The base station should wait for a 22

Service Key Generation Response Message. 23

4.3.1.22 MMS Configuration Request Message Processing 24

22. MMS Configuration Request Message: The base station should wait for a MMS 25


4.3.1.23 MMS Download Request Message Processing 27

23. MMS Download Request Message: The base station should wait for a MMS 28


4.3.1.24 MMSS Configuration Request Message Processing 30

24. MMSS Configuration Request Message: The base station should wait for an MMSS 31


3GPP2 C.S0016-D v2.0

4-7

4.3.1.25 MMSS Download Request Message Processing 1

25. MMSS Download Request Message: The base station should wait for an MMSS 2


4

4.3.2 SSD Update and re-authentication 5

Re-authentication is the process by which the base station instructs the mobile station to 6

perform authentication and generate the Private Long Code Mask and Message Encryption 7

parameters while on the CDMA Traffic channel or analog voice channel. The 8

authentication key, A-key, should be generated in the mobile station during the present 9

programming session. 10

The base station shall disable voice privacy and message encryption prior to performing re-11

authentication. 12

The Shared Secret Data, SSD, shall be generated prior to performing re-authentication. 13

The procedure for setting the interface values and for generating the authentication 14

signature, voice privacy and message encryption parameters, is described in 3.3.2. 15

4.3.3 Activation of Message Encryption 16


information, the base station should enable message encryption (see 7.3.2 of [1] or 3.3.2 of 18

[1]). 19

If message encryption was enabled or transition to the Private Long Code Mask was made 20

(see 7.3.3 of [1] or 3.3.3 of [1]) before the re-authentication operation, message encryption 21

parameters active at that time shall remain unchanged for the duration of the call. 22

Otherwise, message encryption parameters are re-calculated during the re-authentication 23

operation. In this case, the data used to initialize the algorithm for calculating message 24

encryption parameters is computed based on parameters in effect at the time the Re-25

Authenticate Request Message was sent. 26

Messages shall not be encrypted following an unsuccessful re-authentication. 27

4.3.4 Activation of Voice Privacy Mode 28


information, the base station should enable voice privacy (see 7.3.3 of [1] or 3.3.3 of [1]). 30

If a transition to the Private Long Code Mask was made or signaling message encryption 31

was activated (see 2.3.12.2.1 and 6.3.12.2 of [1] or 2.3.12.2 of [1]) before the re-32

authentication operation, the Private Long Code Mask active at that time shall remain 33

unchanged for the duration of the call. 34

Otherwise, the Private Long Code Mask is recalculated during the re-authentication 35

operation. In this case, the data used to initialize the algorithm for calculating the Private 36

3GPP2 C.S0016-D v2.0

4-8

Long Code Mask is computed based on parameters in effect at the time the Re-Authenticate 1

Request Message was sent. 2

Voice privacy shall not be enabled following an unsuccessful re-authentication. 3

4.3.5 Secure Mode 4

To enhance security of the programming session and to protect sensitive subscriber 5

information, a method is provided to encrypt PARAM_DATA fields of Parameter Blocks in 6

OTASP messages irrespective of the air interface message encryption described in 4.3.3. 7

This method allows setting up a secure “tunnel” between the network based Over-The-Air 8

Service Provisioning entity and the mobile station. 9

If the mobile station indicates its support for Secure Mode by setting appropriate feature-10

related fields in the Protocol Capability Response Message, the base station may activate the 11

Secure Mode by sending the Secure Mode Request Message to the mobile station with the 12

START_STOP field set to ‘1’. 13

Prior to initiating the Secure Mode, the base station should generate the Secure Mode 14

Ciphering Key SMCK as specified in 4.3.5.1. The base station should not initiate the Secure 15

Mode if generation of the SMCK is unsuccessful. 16

The base station shall use the SMCK as a key for encryption and decryption, as specified in 17

4.3.5.2, of all PARAM_DATA of all Parameter Blocks sent and received by the base station 18

in the OTASP Data Messages while the Secure mode is active. 19

When encrypting the message, the base station should select a value of FRESH associated 20

with this message and unique for the duration of Secure Mode session. The value of FRESH 21

can be selected at random, or can be set to a monotonically increasing counter. 22

When decrypting the message, the base station should use the value of FRESH received in 23

the message. 24

The base station can terminate the Secure Mode by sending the Secure Mode Request 25

Message to the mobile station with the START_STOP field set to ‘0’. When Secure Mode 26

session is terminated, the base station should reset the SMCK to NULLSMCK. 27

4.3.5.1 Generation of Secure Mode Ciphering Key 28

The Secure Mode Ciphering Key Generation SMCK is generated by the algorithmic function 29

specified in Section 2.2.2.6 of [8]. 30


follows: 32

• The K parameter shall be set to SSD-A|SSD-B. 33


• The RAND parameter shall be set to RAND_SM|RAND_SM. 35


If KEY_IN_USE = ‘0001’,the input parameters to the algorithmic function f3 shall be set as 37

follows: 38

3GPP2 C.S0016-D v2.0

4-9

• The K parameter shall be set to the 128-bit Root Key K. 1


• The RAND parameter shall be set to RAND_SM|RAND_SM. 3


The base station shall execute the Ciphering Key Generation Procedure as specified in 5

2.2.2.6 of [8]. The base station shall set SMCK to the computed 128-bit output of f3. 6

The base station shall set input parameter to the ESP_privacykey Procedure as follows: 7

• The key parameter shall be set to SMCK. 8

The base station shall execute the ESP_privacykey Procedure. 9

4.3.5.2 Encryption and Decryption of Messages in Secure Mode 10

Encryption and decryption of PARAM_DATA information is performed by the Enhanced 11

Privacy Algorithm specified in 2.3.2.2 of [8]. 12

The base station shall set input parameters to the Enhanced Privacy Algorithm as follows: 13

• If the base station presents the data for encryption, the base station shall set the 14

fresh parameter to FRESH|’ 1’|BLOCK_ID; otherwise, if the base station presents 15

the data for decryption, the base station shall set the fresh parameter to FRESHr|’ 16

0’|BLOCK_ID; 17

• The freshsize parameter shall be set to 3; 18

• The buf parameter shall be set to the address of the octet containing the first bit of 19

the buffer that contains the data to be encrypted or decrypted. 20

• The bit_offset parameter shall be set to the offset between the bit position of the 21

most significant bit of the data to be encrypted/decrypted and the bit position of the 22

most significant bit of the buffer (e.g., if the bit position of the most significant bit of 23

the data to be encrypted/decrypted and the bit position of the most significant bit of 24

the buffer are equal, bit_offset shall be set to 0). 25

• The bit_count parameter shall be set to the number of bits of the data to be 26

encrypted/decrypted. 27

The base station shall execute the ESP_maskbits Procedure. 28

4.3.6 Generation of Service Keys 29

Generation of service keys consists of generating an intermediate key and using the 30

intermediate key to generate service keys. 31

4.3.6.1 Generation of Intermediate Key 32

The Intermediate value ITM_RAND is generated by the algorithmic function specified in 33

Section 2.2.2.2 of [8]. 34


3GPP2 C.S0016-D v2.0

4-10

• The K parameter shall be set to RKP. 1



The base station shall execute f0 twice. ITM_RAND is set to the 128-bit output of f0. 4

4.3.6.2 Generation of Service Keys 5

For each bit in the bitmap as illustrated in Table 4.5.1.22-1 that is turned on, the base 6

station shall generate the service key by invoking key generation function as specified in 7

Section 2.2.2.6 of [8]. 8


• The K parameter shall be set to ITM_RAND. 10


• The RAND parameter shall be set according to table 4.3.6.2-1, with remaining least 12

significant bits padded with ‘0’, for each service requested. 13


The base station shall execute f3 to produce 128-bit service root key. 15


Service Key Requested

RAND Value

IMS ROOT KEY 0x494D53

BCMCS ROOT KEY

0x42434D4353

WLAN ROOT KEY 0x574C414E

17

4.4 Termination of the Programming Procedure 18

The programming session ends when the OTAPA service option is disconnected. 19

If the programming session was initiated by the network as described in 3.2.2, and if the 20

base station processes the incoming call directed to the mobile station during the OTAPA 21

process, the base station shall perform the following: 22

1. If either the mobile station or the base station does not support concurrent services 23

the base station shall disconnect the OTAPA session and may release the traffic 24

channel prior to connecting the incoming call. 25

2. If both the mobile station and base station supports concurrent service then the 26

base station may disconnect the OTAPA session and may release the traffic channel 27

prior to connecting the incoming call. 28

3GPP2 C.S0016-D v2.0

4-11

If the programming session was initiated by the network as described in 3.2.2, the base 1

station may terminate the OTAPA session by sending the OTAPA Request Message to the 2

mobile station with the START_STOP field set to ‘0’. 3

4.5 Forward Link Message Formats 4

The forward link OTASP Data Messages are summarized in Table4.5-1. 5

6

3GPP2 C.S0016-D v2.0

4-12

Table 4.5-1 Forward Link Messages 1


Configuration Request Message

‘00000000’ 4.5.1.1

Download Request Message ‘00000001’ 4.5.1.2

MS Key Request Message ‘00000010’ 4.5.1.3

Key Generation Request Message

‘00000011’ 4.5.1.4

Re-Authenticate Request Message

‘00000100’ 4.5.1.5

Commit Request Message ‘00000101’ 4.5.1.6

Protocol Capability Request Message

‘00000110’ 4.5.1.7

SSPR Configuration Request Message

‘00000111’ 4.5.1.8

SSPR Download Request Message

‘00001000’ 4.5.1.9

Validation Request Message ‘00001001’ 4.5.1.10

OTAPA Request Message ‘00001010’ 4.5.1.11

PUZL Configuration Request Message

‘00001011’ 4.5.1.12

PUZL Download Request Message

‘00001100’ 4.5.1.13

3GPD Configuration Request Message

'00001101' 4.5.1.14

3GPD Downloaded Request Message

'00001110' 4.5.1.15

Secure Mode Request Message ‘00001111’ 4.5.1.16


MMD Configuration Request Message

‘00010001’ 4.5.1.18

MMD Download Request Message

‘00010010’ 4.5.1.19

System Tag Configuration Request Message

‘00010011’ 4.5.1.20

System Tag Download Request Message

‘00010100’ 4.5.1.21

3GPP2 C.S0016-D v2.0

4-13


Service Key Generation Request Message

‘00010101’ 4.5.1.22

MMS Configuration Request Message

‘00010110’ 4.5.1.23

MMS Download Request Message

‘00010111’ 4.5.1.24

MMSS Configuration Request Message

‘00011000’ 4.5.1.25

MMSS Download Request Message

‘00011001’ 4.5.1.26


‘00011010’ through ’01111111’

Reserved for manufacturer-specific OTASP Data Message definition

‘10000000’ See [4]


‘10000001’ through ’10111111’

Available for manufacturer-specific OTASP Data Message definition

‘11000000’ through ‘11111110’

See [4]


1

2

4.5.1 Message Contents 3

4.5.1.1 Configuration Request Message 4

The Configuration Request Message has the following variable-length format: 5

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

6


The base station shall set this field to ‘00000000’. 8

3GPP2 C.S0016-D v2.0

4-14

NUM_BLOCKS - Number of parameter blocks requested. 1

The base station shall set this field to the number of 2

parameter blocks requested. 3


The base station shall include NUM_BLOCKS occurrences of 5

this field. The base station shall set each field to the value of 6

the parameter block type requested (see Table 3.5.2-1). 7

4.5.1.2 Download Request Message 8

The Download Request Message has the following variable-length format: 9

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

10





parameter blocks contained in the Download Request 15

Message. 16


The base station shall include NUM_BLOCKS occurrences of 18

this field. The base station shall set each field to the value of 19

the parameter block type requested (see Table 4.5.2-1). 20


The base station shall set this field to the number of octets in 22

the parameter block, not including the BLOCK_ID and 23



3GPP2 C.S0016-D v2.0

4-15

The base station shall include the parameter block (see 4.5.2) 1

specified by the BLOCK_ID field. If Secure Mode is active (see 2

4.3.5), PARAM_DATA fields shall be encrypted as specified in 3

4.3.5. 4


If Secure Mode is active (See 4.3.5), the base station shall 6

include this field and set it to ‘1’; otherwise the base station 7




If FRESH_INCL = ‘1’, the base station shall include this field 11



blocks included in the message; otherwise the base station 14



If FRESH_INCL = ‘1’, the base station shall omit this field; 17

otherwise, the base station shall set all the bits of this field to 18

‘0’. 19

4.5.1.3 MS Key Request Message 20

The MS Key Request Message has the following variable-length format: 21

Field Length (bits)


A_KEY_P_REV 8

PARAM_P_LEN 0 or 8

PARAM_P 0 or 8 PARAM_P_LEN

PARAM_G_LEN 0 or 8

PARAM_G 0 or 8 PARAM_G_LEN

22



A_KEY_P_REV - Key exchange protocol version. 25

The base station shall set this field to ‘00000010’ for 2G A-key 26

generation, ‘00000011’ for combination 2G A-key and 3G 27

Root Key generation, ‘00000100’ for 3G Root Key generation, 28

or ‘00000101’ for Enhanced 3G Root Key generation, 29

‘00000111’ for eHRPD Root Key A_KEY_P_REV = ‘00000111’ 30

generation, or ‘00001000’ for eHRPD Root Key A_KEY_P_REV 31

= ‘00001000’ generation. 32

PARAM_P_LEN - Length of PARAM_P field. 33

3GPP2 C.S0016-D v2.0

4-16

If A_KEY_P_REV = ‘00000010’, the base station shall set this 1

field to the number of octets in the PARAM_P field, and the 2

base station shall set this field to ‘01000000’. If 3

A_KEY_P_REV > ‘00000010’, the base station shall omit this 4

field. 5

PARAM_P - Key exchange parameter P. 6


field as described in 5.2.1. If A_KEY_P_REV > ‘00000010’, the 8

base station shall omit this field. 9

PARAM_G_LEN - Length of PARAM_G field. 10


field to the number of octets in the PARAM_G field, and the 12

base station shall set this field to ‘00010100’. If 13

A_KEY_P_REV > ‘00000010’, the base station shall omit this 14

field. 15

PARAM_G - Key exchange parameter G. 16


field as described in 5.2.1. If A_KEY_P_REV > ‘00000010’, the 18

base station shall omit this field. 19

20

4.5.1.4 Key Generation Request Message 21

The Key Generation Request Message has the following variable-length format: 22

Field Length (bits)


BS_RESULT_LEN 8

BS_RESULT 8 BS_RESULT_LEN

23



BS_RESULT_LEN - Length of BS_RESULT field. 26


the BS_RESULT field. 28

BS_RESULT - Base station calculation result. 29

3GPP2 C.S0016-D v2.0

4-17


field equal to the value of BS_RESULT as described in 5.2.2. 2

If A_KEY_P_REV = ‘00000011’ or ‘00000100’, the base station 3

shall set this field equal to the value of BS_RESULT as 4

described in 5.4.2. If A_KEY_P_REV = ‘00000101’, the base 5

station shall set this field equal to the value of BS_RESULT as 6





described in 5.10.2. 11

12

13

4.5.1.5 Re-Authenticate Request Message 14

The Re-Authenticate Request Message has the following fixed-length format: 15

Field Length (bits)


RAND 32

16



RAND - Random Challenge value. 19

The base station shall set this field to the value used as an 20

input to the Auth_Signature procedure for performing re-21

authentication. See 3.3.2. 22

4.5.1.6 Commit Request Message 23

The Commit Request Message has the following fixed-length format: 24

Field Length (bits)


25



28

3GPP2 C.S0016-D v2.0

4-18

4.5.1.7 Protocol Capability Request Message 1

The Protocol Capability Request Message has the following variable-length format: 2

Field Length (bits)


OTASP_P_REV 0 or 8

NUM_CAP_RECORD 0 or 8

NUM_CAP_RECORDOne or more occurrences of the following record:

CAP_RECORD_TYPE 0 or 8

3



OTASP_P_REV - OTASP protocol revision. 6

If the base station does not request new capability 7

information records as defined in Table 3.5.1.17.1-1, the base 8

station shall omit this field; otherwise, the base station shall 9


NUM_CAP_RECORDS - Number of Capability Records. 11

If OTASP_P_REV field is not included, the base station shall 12

omit this field; otherwise, the base station shall set this field 13

to the number of Capability Records requested. 14

CAP_RECORD_TYPE - Capability Record Type. 15

If OTASP_P_REV field is not included, the base station shall 16


to the record type value shown in Table 3.5.1.17.1-1 18

corresponding to the information record requested. 19

20

3GPP2 C.S0016-D v2.0

4-19

4.5.1.8 SSPR Configuration Request Message 1

The SSPR Configuration Request Message has the following variable-length format: 2

3

Field Length (bits)


BLOCK_ID 8

If BLOCK_ID = ‘00000001’ (Preferred Roaming List Parameter Block), the message also includes the following fields:

REQUEST_OFFSET 16

REQUEST_MAX_SIZE 8

4



BLOCK_ID Parameter block identifier. 7

The base station shall set this field to the value of the 8

BLOCK_ID of the parameter block being requested in this 9


If the BLOCK_ID field is set to ‘00000001’ (Preferred Roaming List Parameter Block), the 11

base station shall include the following fields in the message: 12

REQUEST_OFFSET - Segment offset. 13

The base station shall set this field to the starting offset 14

within the preferred roaming list (PR_LISTs-p) of the octets 15

being requested. 16

REQUEST_MAX_SIZE - Maximum segment size. 17

The base station shall set this field to the maximum number 18

of preferred roaming list octets that the mobile station is to 19

return. 20

21

3GPP2 C.S0016-D v2.0

4-20

4.5.1.9 SSPR Download Request Message 1

The SSPR Download Request Message has the following variable-length format: 2

3

Field Length (bits)


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter block type being downloaded (see Table 4.5.3-1). 9





PARAM_DATA - Parameter data. 14

The base station shall include the parameter block specified 15

by the BLOCK_ID field. If Secure Mode is active (see 4.3.5), 16

PARAM_DATA field shall be encrypted as specified in 4.3.5. 17


If Secure Mode is active (See 4.3.5), the base station shall set 19

this field to ‘1’; otherwise the base station shall set this field 20

to ‘0’. 21


encrypting PARAM_DATA field of the message. 23



encrypting the PARAM_DATA field of the Parameter Data 26

block included in the message; otherwise the base station 27





‘0’. 32

3GPP2 C.S0016-D v2.0

4-21

1

4.5.1.10 Validation Request Message 2

The Validation Request Message has the following variable-length format: 3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


4





parameter blocks contained in the Validation Request 9

Message. 10




Table 4.5.4-1). 14








22

3GPP2 C.S0016-D v2.0

4-22

4.5.1.11 OTAPA Request Message 1

The OTAPA Request Message has the following fixed-length format: 2

Field Length (bits)


START_STOP 1

RESERVED 7

3



START_STOP - OTAPA session start-stop indicator. 6

The base station shall set this field to ‘1’ to invoke the OTAPA 7

session in the mobile station. The base station shall set this 8

field to ‘0’ to terminate the OTAPA session in the mobile 9

station. 10



4.5.1.12 PUZL Configuration Request Message 13

The PUZL Configuration Request Message has the following variable-length format: 14

15

Field Length (bits)


BLOCK_ID 8

If BLOCK_ID = ‘00000001’ (PUZL Priorities Parameter Block) or if BLOCK_ID = ‘00000010’ (User Zone Parameter Block), the message also includes the following fields:

UZ_COUNT 12

UZ_COUNT occurrences of the following two fields:

UZ_ID 16

UZ_SID 15

RESERVED 0 to 7

16




3GPP2 C.S0016-D v2.0

4-23



message [see Table 3.5.6-1]. 3

If the BLOCK_ID field is set to ‘00000001’ (PUZL Priorities 4

Parameter Block) or set to ‘00000010’ (User Zone Parameter 5

Block), the base station shall include the following fields in 6

the message: 7

UZ_COUNT - User Zone Count. 8

The base station shall set this field to the number of UZ_ID 9

and UZ_SID pairs contained in the PUZL Configuratoin 10

Request Message. 11





3.5.1.13-1. 16









to ‘0’. 25

26

3GPP2 C.S0016-D v2.0

4-24

4.5.1.13 PUZL Download Request Message 1

The PUZL Download Request Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter blocks contained in the PUZL Download Request 9

Message. 10




Table 4.5.6-1). 14












to ‘0’. 26



3GPP2 C.S0016-D v2.0

4-25

If FRESH_INCL = ‘1, the base station shall include this field 1






If FRESH_INCL= ‘1’, the base station shall omit this field; 7


‘0’. 9

10

4.5.1.14 3GPD Configuration Request Message 11

The 3GPD Configuration Request Message has the following format: 12

13

Field Length (bits)


NUM_BLOCKS 8

NUM_BLOCKS occurrences of the following fields:

BLOCK_ID 8

14






The base station shall include NUM_BLOCKS occurrences of the following field: 20





25

3GPP2 C.S0016-D v2.0

4-26

4.5.1.15 3GPD Download Request Message 1

The 3GPD Download Request Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter blocks contained in the 3GPD Download Request 9

Message. 10

The base station shall include NUM_BLOCKS occurrences of the following fields: 11




Table 4.5.7-1). 15










If Secure Mode is active (See 4.3.5), the base station shall 25

include this field and set it to ‘1’; otherwise the base station 26


3GPP2 C.S0016-D v2.0

4-27











‘0’. 11

4.5.1.16 Secure Mode Request Message 12

The Secure Mode Request Message has the following fixed-length format: 13

Field Length (bits)


START_STOP 1

KEY_IN_USE 4

RESERVED 3

RAND_SM 0 or 64

14



START_STOP - Secure Mode start-stop indicator. 17

The base station shall set this field to ‘1’ to invoke the Secure 18

Mode in the mobile station. The base station shall set this 19

field to ‘0’ to terminate the Secure Mode in the mobile station. 20

KEY_IN_USE - Key in use indicator. 21

If the START_STOP is set to ‘1’, the base station shall set this 22

field to ‘0000’ to indicate SMCK generation using SSD_A and 23

SSD_B, or ‘0001’ to indicate SMCK generation using 3G Root 24

Key, otherwise, this field shall be set to ‘0000’. 25



RAND_SM - Random Number used for SMCK generation. 28

If the START_STOP is set to ‘1’, the base station shall set this 29

field to a randomly selected 64-bit value used for generation 30

of the SMCK. If the START_STOP is set to ‘0’, the base station 31


3GPP2 C.S0016-D v2.0

4-28

4.5.1.17 Reserved 1

This section was reserved for an Extended Protocol Capability Request Message. However, 2

the Protocol Capability Request Message is used instead. 3

4

4.5.1.18 MMD Configuration Request Message 5

The MMD Configuration Request Message has the following format: 6

7

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

8











19

3GPP2 C.S0016-D v2.0

4-29

4.5.1.19 MMD Download Request Message 1

The MMD Download Request Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter blocks contained in the MMD Download Request 9

Message. 10




Table 4.5.8-1). 14












to ‘0’. 26



3GPP2 C.S0016-D v2.0

4-30

If FRESH_INCL = ‘1, the base station shall include this field 1








‘0’. 9

10

4.5.1.20 System Tag Configuration Request Message 11

The System Tag Configuration Request Message shall have the following variable-length 12

format: 13

14

Field Length (bits)


BLOCK_ID 8

If BLOCK_ID = ‘00000001’ (System Tag List Parameter Block), the message also includes the following fields:

REQUEST_OFFSET 16

REQUEST_MAX_SIZE 8

15







If the BLOCK_ID field is set to ‘00000001’ (System Tag List Parameter Block), the base 22

station shall include the following fields in the message: 23



within the group tag list (GROUP_TAG_ LISTs-p), specific tag 26

list (SPEC_TAG_ LISTs-p), or call prompt list (CALL_PRMPT_ 27

LISTs-p) of the octets being requested. 28



of system tag list octets that the mobile station is to return. 31

3GPP2 C.S0016-D v2.0

4-31

4.5.1.21 System Tag Download Request Message 1

The System Tag Download Request Message shall have the following format 2

Field Length (bits)


BLOCK_ID 8

BLOCK_LEN 8






parameter block type being downloaded (see Table 4.5.9-1). 7





PARAM_DATA - Parameter data. 12



15

4.5.1.22 Service Key Generation Request Message 16

The Service Key Generation Request Message has the following fixed-length format: 17

Field Length (bits)


KEY_ID 12

RESERVED 4

18



KEY_ID - Key exchange identifier. 21

The base station shall set this field corresponding to the key 22

requested as shown in Table 4.5.1.22-1 in the form of a 23

bitmap; otherwise, the base station shall omit this field. 24

3GPP2 C.S0016-D v2.0

4-32


Subfield Length

(bits)

IMS Root Key 1

BCMCS Root Key 1

WLAN Root Key 1

RESERVED 9



4

4.5.1.23 MMS Configuration Request Message 5

The MMS Configuration Request Message has the following format: 6

7

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

8











3GPP2 C.S0016-D v2.0

4-33

4.5.1.24 MMS Download Request Message 1

The MMS Download Request Message has the following variable-length format: 2

3

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8


FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

4





parameter blocks contained in the MMS Download Request 9

Message. 10




Table 4.5.10-1). 14












to ‘0’. 26



3GPP2 C.S0016-D v2.0

4-34









‘0’. 9

10

4.5.1.25 MMSS Configuration Request Message 11

The MMSS Configuration Request Message has the following variable-length format: 12

13

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

REQUEST_OFFSET 0 or 16

REQUEST_MAX_SIZE 0 or 8

14





parameter blocks contained in the MMSS Configuration 19

Request Message that is being confirmed in Table 3.5.13-1. 20




MMSS Configuration Response Message that is being 24

confirmed (see Table 3.5.13-1). 25

If BLOCK_ID = ‘00000010’ (MMSS Location Associated Priority List), the message shallalso 26

includes the following fields: 27


3GPP2 C.S0016-D v2.0

4-35


within the MMSS Location Associated Priority list 2

(MLP_LISTs-p) of the octets being requested. 3



of MMSS Location Associated Priority list octets that the 6

mobile station is to return. 7

8

If the BLOCK_ID field is set to ‘00000011’ (MMSS System Priority List), the base station 9




within the MMSS System Priority list (MSP_LISTs-p) of the 13

octets being requested. 14



of MMSS System Priority list octets that the mobile station is 17

to return. 18

19

4.5.1.26 MMSS Download Request Message 20

The MMSS Download Request Message has the following variable-length format: 21

22

Field Length (bits)


NUM_BLOCKS 8


BLOCK_ID 8

BLOCK_LEN 8

PARAM_DATA 8 x BLOCK_LEN

SEGMENT_OFFSET 16

SEGMENT_DATA 8 x BLOCK_LEN

23

FRESH_INCL 1

FRESH 0 or 15

RESERVED 0 or 7

3GPP2 C.S0016-D v2.0

4-36

1





parameter blocks contained in the MMSS Download Request 6





MMSS Download Request Message that is being confirmed (see 11

Table 4.5.11-1). 12





If the BLOCK_ID field is set to ‘00000001’ (MMSS Location Associated Priority List), the 17

base station shall include the following fields in the message: 18

19


The base station shall set this field to the starting offset, 21

within the MMSS Location Assiocated Priority List (MLPL) at 22

which the mobile station is to store the octets included in 23

SEGMENT_DATA. 24

SEGMENT_DATA - Segment data. 25

The base station shall set this field to sequential octets of the 26

MLPL. The octets shall be those starting at the offset within 27

the MLPL specified by SEGMENT_OFFSET. 28

29

If the BLOCK_ID field is set to ‘00000010’ (MMSS System Priority List), the base station 30


32



within the MMSS System Priority List (MSPL) at which the 35

mobile station is to store the octets included in 36

SEGMENT_DATA. 37


The base station shall set this field to sequential octets of the 39

MSPL. The octets shall be those starting at the offset within 40

the MSPL specified by SEGMENT_OFFSET. 41

42

3GPP2 C.S0016-D v2.0

4-37



Associated Priority List) or ‘00000010’ (MMSS System Priority 3

List), then the base station shall include the fields defined in 4

the table below. Otherwise, Tthe base station shall include 5

the parameter block specified by the BLOCK_ID field as 6

specified in 4.5.11. If SECURE_MODE_INDS = ‘1’, 7

PARAM_DATA fields shall be encrypted as specified in section 8

4.3.53.3.8. 9

10

Field Length (bits)

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8


11

RESERVED - Reserved bits (in PARAM_DATA). 12


LAST_SEGMENT - Last segment indicator bit (in PARAM_DATA). 14

The base station shall set this field to ‘1’ if SEGMENT_DATA 15

contains the last octet of the MMSS Location Assiocated 16

Priority List (MLP_LISTS-P) or MMSS System Priority List 17

(MSP_LISTS-P) sent to the mobile station; otherwise, the base 18

station shall set this field to ‘0’. The MLP_LISTS-P and 19

MSP_LISTS-P is defined in Sec. 4.5.11.2 (MMSS Location 20

Associated Priority List) and 4.5.11.3 (MMSS System Priority 21

List). 22

SEGMENT_OFFSET - Segment offset (in PARAM_DATA). 23


within the MLP_LISTS-P or MSP_LISTS-P at which the mobile 25

station is to store the octets included in SEGMENT_DATA. 26

SEGMENT_SIZE - Segment size (in PARAM_DATA). 27

The base station shall set this field to the number of octets of 28

MLP_LISTS-P or MSP_LISTS-P included in SEGMENT_DATA. 29

SEGMENT_DATA - Segment data (in PARAM_DATA). 30


Associated Priority List), then the base station shall set this 32

field to sequential octets of the MLP_LISTS-P. The octets shall 33

be those starting at the offset within the MLP_LISTS-P 34


3GPP2 C.S0016-D v2.0

4-38

If the BLOCK_ID field is set to ‘00000010’ (MMSS System 1

Priority List), then the base station shall set this field to 2

sequential octets of the MSP_LISTS-P. The octets shall be 3

those starting at the offset within the MSP_LISTS-P specified 4

by SEGMENT_OFFSET. 5

6


If SECURE_MODE_INDS = ‘1’, the base station shall set this 8

field to ’1’; otherwise the base station shall set this field to ‘0’. 9







otherwise the base station shall omit this field. 16




to ‘0’. 20

21

4.5.2 NAM Parameter Blocks 22

Table 4.5.2-1 lists the types of parameter blocks used in the Download Request Message 23

and the Download Response Message. 24

Table 4.5.2-1 NAM Parameter Block Types 25


CDMA/Analog NAM Download ‘00000000’ 4.5.2.1

Mobile Directory Number ‘00000001’ 4.5.2.2

CDMA NAM Download ‘00000010’ 4.5.2.3

IMSI_T ‘00000011’ 4.5.2.4

eHRPD IMSI Download ‘00000100’ 4.5.2.5

Reserved for future standardization ‘00000101’ through ‘01111111’


‘10000000’ through ‘11111110’

See [4]


26

3GPP2 C.S0016-D v2.0

4-39

4.5.2.1 CDMA/Analog NAM Download 1

The PARAM_DATA field of the CDMA/Analog NAM Download Parameter Block consists of 2


Field Length (bits)

FIRSTCHP 11

HOME_SID 15

EX 1

IMSI_M_CLASS 1

IMSI_M_ADDR_NUM 3

MCC_M 10

IMSI_M_11_12 7

IMSI_M_S 34

ACCOLC 4

LOCAL_CONTROL_ANALOG 1

MOB_TERM_HOME 1

MOB_TERM_FOR_SID 1

MOB_TERM_FOR_NID 1

N_SID_NID 8

N_SID_NID occurrences of the following SID/NID pair:

SID 15

NID 16



4

FIRSTCHP - First paging channel used in the home system. 5

The base station shall set this field to the value for the 6

FIRSTCHPp mobile station NAM indicator (see F.3 of [1, 1]). 7

HOME_SID - Home system identification. 8


HOME_SIDp mobile station NAM indicator (see F.3 of [1, 1]). 10

EX - Extended address indicator. 11

The base station shall set this field to the value for the EXp 12

mobile station NAM indicator (see F.3 of [1, 1]). 13


3GPP2 C.S0016-D v2.0

4-40

If the base station is assigning a class 0 IMSI_M to the mobile 1

station, the base station shall set this field to ‘0’; otherwise 2

the base station shall set this field to ‘1’. 3



6.3.1 of [1] or 2.3.1 of [1]), the base station shall set this field 6

to four less than the number of digits in the NMSI; otherwise, 7


MCC_M - Mobile country code of the IMSI_M. 9


MCC_Mp mobile station NAM indicator (see F.3 and 6.3.1 of 11

[1] or F.3 and 2.3.1 of [1]). 12

IMSI_M_11_12 - 11th and 12th digits of the IMSI_M. 13


IMSI_M_11_12p mobile station NAM indicator (see F.3 and 15

6.3.1 of [1] or F.3 and 2.3.1 of [1]. 16



IMSI_M_Sp mobile station NAM indicator (see F.3 and 6.3.1 of 19

[1] or F.3 and 2.3.1 of [1]). 20



ACCOLCp mobile station NAM indicator (see F.3 of [1, 1]). 23

The base station shall set APersistence[i] (for mobile stations 24

that also support HRPD) as shown in Table 3.5.2.1-1 when 25

ACCOLC is set. 26

LOCAL_CONTROL_ANALOG - Local control status for Analog operation. 27

The base station shall set this field to ‘1’ to enable local 28

control status for Analog operation in the mobile station, or to 29

‘0’ to disable local control status (see 2.6.1.2.2 of [1]). 30



MOB_TERM_HOMEp mobile station NAM indicator (see F.3 33

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 34



MOB_TERM_FOR_SIDp mobile station NAM indicator (see F.3 37

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 38



MOB_TERM_FOR_NIDp mobile station NAM indicator (see F.3 41

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 42

43

3GPP2 C.S0016-D v2.0

4-41

N_SID_NID - Number of SID/NID pairs. 1

The base station shall set this field to the number of SID/NID 2

pairs included in the parameter block. The base station shall 3

include at least one SID/NID pair. 4


The base station shall set this field to the value of the SID 6

component of the SID/NID pair (see F.3 of [1, 1]). 7


The base station shall set this field to the value of the NID 9






to ‘0’. 15

16

4.5.2.2 Mobile Directory Number 17

The PARAM_DATA field of the Mobile Directory Number Parameter Block consists of the 18


Field Length (bits)

N_DIGITS 4

N_DIGITS occurrences of the following field:

DIGITn 4


RESERVED 0 or 4

N_DIGITS - Number of digits. 20

The base station shall set this field to the number of digits 21

included in the parameter block. 22

DIGITn - Digit. 23

The base station shall set these fields to the digits of the 24

mobile station directory number. Each digit shall be encoded 25

according to Table 6.7.1.3.2.4-4 of [1] or Table 2.7.1.3.2.4-4 of 26

[1]. 27





to ‘0’. 32

33

3GPP2 C.S0016-D v2.0

4-42

4.5.2.3 CDMA NAM Download 1

The PARAM_DATA field of the CDMA NAM Download Parameter Block consists of the 2

following fields: 3

Field Length (bits)

IMSI_M_CLASS 1

IMSI_M_ADDR_NUM 3

MCC_M 10

IMSI_M_11_12 7

IMSI_M_S 34

ACCOLC 4

LOCAL_ CONTROL_CDMA 1

MOB_TERM_HOME 1

MOB_TERM_FOR_SID 1

MOB_TERM_FOR_NID 1

N_SID_NID 8

N_SID_NID occurrences of the following SID/NID pair:

SID 15

NID 16



4


If the base station is assigning a class 0 IMSI_M to the mobile 6








MCC_M - Mobile country code of the IMSI_M. 14


MCC_Mp mobile station NAM indicator (see F.3 and 6.3.1 of 16

[1] or F.3 and 2.3.1 of [1]). 17

IMSI_M_11_12 - 11th and 12th digits of the IMSI_M. 18

3GPP2 C.S0016-D v2.0

4-43


IMSI_M_11_12p mobile station NAM indicator (see F.3 and 2

6.3.1 of [1] or F.3 and 2.3.1 of [1]). 3



IMSI_M_Sp mobile station NAM indicator (see F.3 and 6.3.1 of 6

[1] or F.3 and 2.3.1 of [1]). 7



ACCOLCp mobile station NAM indicator (see F.3 and 6.3.1 of 10

[1] or F.3 and 2.3.1 of [1]). 11

The base station shall set APersistence[i] (for mobile stations 12

that also support HRPD) as shown in Table 3.5.2.1-1 when 13

ACCOLC is set. 14

LOCAL_ CONTROL_CDMA - Local control status for CDMA operation. 15

The base station shall set this field to ‘1’ to enable local 16

control status for CDMA operation in the mobile station, or to 17

‘0’ to disable local control status (see 6.3.9 of [1] or 2.3.9 of 18

[1]). 19



MOB_TERM_HOMEp mobile station NAM indicator (see F.3 22

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 23



MOB_TERM_FOR_SIDp mobile station NAM indicator (see F.3 26

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 27



MOB_TERM_FOR_NIDp mobile station NAM indicator (see F.3 30

and 6.6.5.3 of [1] or F.3 and 2.6.5.3 of [1]). 31

N_SID_NID - Number of SID/NID pairs. 32

The base station shall set this field to the number of SID/NID 33

pairs included in the parameter block. The base station shall 34

include at least one SID/NID pair. 35


The base station shall set this field to the value of the SID 37



The base station shall set this field to the value of the NID 40



3GPP2 C.S0016-D v2.0

4-44




to ‘0’. 4

4.5.2.4 IMSI_T Parameter Block 5

The PARAM_DATA field of the IMSI_T Parameter Block consists of the following fields: 6

7

Field Length (bits)

IMSI_T_CLASS 1

IMSI_T_ADDR_NUM 3

MCC_T 10

IMSI_T_11_12 7

IMSI_T_S 34

RESERVED 1

IMSI_T_CLASS - IMSI_T Class assignment of the mobile station. 8

If the base station is assigning a class 0 IMSI_T to the mobile 9



IMSI_T_ADDR_NUM - Number of IMSI_T address digits. 12

If the mobile station has been assigned a class 1 IMSI_T (see 13




MCC_T - Mobile country code of the IMSI_T. 17


MCC_Tp mobile station NAM indicator (see F.3 and 6.3.1 of 19

[1] or F.3 and 2.3.1 of [1]). 20

IMSI_T_11_12 - 11th and 12th digits of the IMSI_T. 21


IMSI_T_11_12p mobile station NAM indicator (see F.3 and 23

6.3.1 of [1] or F.3 and 2.3.1 of [1])). 24

IMSI_T_S - The least significant 10 digits of the IMSI_T. 25


IMSI_T_Sp mobile station NAM indicator (see F.3 and 6.3.1 of 27

[1] or F.3 and 2.3.1 of [1]). 28



3GPP2 C.S0016-D v2.0

4-45

4.5.2.5 eHRPD IMSI Download 1

The PARAM_DATA field of the eHRPD IMSI Download Parameter Block consists of the 2

following fields: 3

Field Length (bits)

eHRPD_MNC_NUM_DIGITS 1

eHRPD_IMSI_NUM_DIGITS 4

RESERVED 3

eHRPD_IMSI_DIGITS 4 * eHRPD_IMSI_NUM_DIGITS

RESERVED 0 to 4 bits as needed

4

eHRPD_MNC_NUM_DIGITS - Number of Mobile Network Code Digits. 5

If the number of MNC digits in the eHRPD IMSI is 2, the value 6

of this field is set to ‘0’. Otherwise, it is set to ‘1’ to indicate 7

an MNC with 3 digits in the eHRPD IMSI. 8



eHRPD_IMSI_NUM_DIGITS - Number of eHRPD International Mobile Station Identity Digits 11

The base station shall set this field to the number of digits in 12

eHRPD_IMSI. 13

eHRPD_IMSI_DIGITS - eHRPD International Mobile Station Identity Digits 14

The base station shall set this field to the eHRPD IMSI using 15

BCD encoding wherein each digit is represented by 4 bits. 16

Digits are included in sequence starting with the most 17

significant digit.13 18





to ‘0’. 23

24

25

26

13 For example, given the eHRPD IMSI ‘001 02 0123456789’, eHRPD_MNC_NUM_DIGITS is ‘0’,

eHRPD_IMSI_NUM_DIGITS is ‘1111’, and eHRPD_IMSI_DIGITS is ‘0000 0000 0001 0000 0010 0000

0001 0010 0011 0100 0101 0110 0111 1000 1001’ where spaces between digits and bits have been

added for clarity.

3GPP2 C.S0016-D v2.0

4-46

4.5.3 SSPR Parameter Blocks 1

Table 4.5.3-1 lists the type of the parameter blocks used in the SSPR Download Request 2

Message and the SSPR Download Response Message. 3

Table 4.5.3-1 SSPR Parameter Block Types 4


Preferred Roaming List ‘00000000’ 4.5.3.1

Extended Preferred Roaming List with SSPR_P_REV greater than ‘00000001’

‘00000001’ 4.5.3.1

Reserved for future standardization ‘00000010’ through ‘01111110’ ‘01111111’

NULLPRL_BLOCK_ID ‘01111111’ 1.2.3


‘10000000’ through ‘11111110’

See [4]


5

4.5.3.1 Preferred Roaming List Parameter Block 6

The PARAM_DATA field of the Preferred Roaming List and Extended Preferred Roaming List 7

Parameter Block consists of the following fields: 8

9

Field Length (bits)

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8


10





contains the last octet of the preferred roaming list 15

(PR_LISTs-p) sent to the mobile station; otherwise, the base 16



3GPP2 C.S0016-D v2.0

4-47


within the preferred roaming list at which the mobile station 2

is to store the octets included in SEGMENT_DATA. 3



the preferred roaming list included in SEGMENT_DATA. 6


This field contains SEGMENT_SIZE octets starting at the 8

offset specified by SEGMENT_OFFSET within the preferred 9

roaming list.The base station shall set this field to sequential 10

octets of the preferred roaming list. The octets shall be those 11

starting at the offset within the preferred roaming list 12


14

4.5.4 Validation Parameter Blocks 15

Table 4.5.4-1 lists the types of parameter blocks used in the Validation Request Message 16

and the Validation Response Message. 17

18

Table 4.5.4-1 Validation Parameter Block Types 19


Verify SPC ‘00000000’ 4.5.4.1

Change SPC ‘00000001’ 4.5.4.2

Validate SPASM ‘00000010’ 4.5.4.3

Reserved for future standardization ‘00000011’ through

‘01111111’


‘10000000’ through

‘11111110’

See [4]


20

4.5.4.1 Verify SPC 21

The PARAM_DATA field of the Verify SPC Parameter Block consists of the following field: 22

23

Field Length (bits)

SPC 24

24

3GPP2 C.S0016-D v2.0

4-48

SPC - Service programming code. 1

The base station shall set this field to the BCD coded value of 2

Service Programming Code assigned for the mobile station 3

(see Table 3.3.6-1). Each digit shall be encoded according to 4

the Table 4.5.4.1-1. 5

6

Table 4.5.4.1-1. BCD Mapping 7

Decimal Digit Binary Number

0 0000

1 0001

2 0010

3 0011

4 0100

5 0101

6 0110

7 0111

8 1000

9 1001

8

4.5.4.2 Change SPC 9

The PARAM_DATA field of the Change SPC Parameter Block consists of the following field: 10

11

Field Length (bits)

SPC 24

12

SPC - Service programming code 13

The base station shall set this field to the BCD coded value of 14

newly assigned Service Programming Code for the mobile 15

station (see Table 3.3.6-1). Each digit shall be encoded 16

according to the Table 4.5.4.1-1. 17

3GPP2 C.S0016-D v2.0

4-49

4.5.4.3 Validate SPASM 1

The PARAM_DATA field of the Validate SMASM SPASM Parameter Block consists of the 2

following fields: 3

4

Field Length (bits)

AUTH_OTAPA_INCL 1

AUTH_OTAPA 0 or 18

NAM_LOCK 1

RESERVED 4 or 6

5

AUTH_OTAPA_INCL - OTAPA SPASM validation signature included indicator. 6

The base station shall set this field to ‘1’ to indicate that the 7

OTAPA SPASM validation signature, AUTH_OTAPA, is 8

included in the message; otherwise, the base station shall set 9


AUTH_OTAPA - OTAPA SPASM validation signature. 11

If the AUTH_OTAPA_INCL is set to ‘1’, the base station shall 12

set this field as described in 3.3.7; otherwise, the base station 13


NAM_LOCK - SPASM protection indicator for the active NAM. 15

The base station shall set this field to ‘1’ to activate SPASM 16

protection of programmable parameters and indicators of the 17

active NAM after completion of the current OTAPA session, 18

otherwise the base station shall set this field to ‘0’. 19





to ‘0’. 24

25

4.5.5 Reserved 26

Reserved. 27

28

4.5.6 PUZL Parameter Blocks 29

Table 4.5.6-1 lists the types of parameter blocks used in the PUZL Download Request 30

Message and the PUZL Download Response Message. 31

3GPP2 C.S0016-D v2.0

4-50

Table 4.5.6-1 PUZL Parameter Block Types 1


User Zone Insert ‘00000000’ 4.5.6.1

User Zone Update ‘00000001’ 4.5.6.1

User Zone Delete ‘00000010’ 4.5.6.2

User Zone Priority Change ‘00000011’ 4.5.6.3

PUZL Flags ‘00000100’ 4.5.6.4

Reserved for future standardization ‘00000101’

through

‘01111111’


‘10000000’

through

‘11111110’

See [4]


2

4.5.6.1 User Zone Insert and User Zone Update 3

The PARAM_DATA field of the User Zone Insert and User Zone Update Parameter Blocks 4


6

Field Length (bits)

UZ_ID 16

UZ_SID 15

LAST_SEGMENT 1

SEGMENT_SEQ 8

SEGMENT_SIZE 8


7





3.5.1.13-1. 12





3GPP2 C.S0016-D v2.0

4-51




base station shall set this field to ‘0’. 4



each segment starting from ‘00000000’ with the sequence 7




the user zone included in SEGMENT_DATA. 11


Segment of the user zone data. 13

14

4.5.6.2 User Zone Delete 15

The PARAM_DATA field of the User Zone Delete Parameter Block consists of the following 16

fields: 17

18

Field Length (bits)

UZ_ID 16

UZ_SID 15

RESERVED 1

19





3.5.1.13-1. 24







31

4.5.6.3 User Zone Priority Change 32

The PARAM_DATA field of the User Zone Priority Change Parameter Block consists of the 33


3GPP2 C.S0016-D v2.0

4-52

1

Field Length (bits)

UZ_ID 16

UZ_SID 15

UZ_PRIORITY 4

RESERVED 5

2





3.5.1.13-1. 7












selection only. 19

20





priority takes precedence. A priority of nullNULLUZ_PRIORITY 25



priority ‘null’ unless initiated manually by the user. Note that 28

the value of User Zone Priority is non-exclusive. Note: 29


same priority. 31





. 36



3GPP2 C.S0016-D v2.0

4-53

1

4.5.6.4 PUZL Flags 2

The PARAM_DATA field of the PUZL Flags Parameter Block consists of the following fields: 3

4

Field Length (bits)

UZ_LIST_ID 16

CUR_PUZL_P_REV 8

RESERVED 2

UZ_TEMP_SUBSC 1

UZ_ORIG_ONLY 1




PREF_ONLY 1

UZ_DISP_IND 8

5






zone list 11



list (PUZLs-p). 14



UZ_TEMP_SUBSC - User Zone Temporary Subscription flag. 17

The base station shall set this field accordingly to indicate 18

whether or not the mobile station is permitted to access User 19

Zones that offer temporary subscription. If allowed, 20

UZ_TEMP_SUBSC = ‘1’; otherwise, UZ_TEMP_SUBSC = ‘0’. 21

UZ_ORIG_ONLY - User Zone Origination Only flag. 22

3GPP2 C.S0016-D v2.0

4-54

The base station shall set this field accordingly to indicate 1

whether or not the mobile station is permitted to originate calls 2

only when within the serving area of a currently assigned User 3

Zone. If call origination is only allowed within an assigned 4

user zone, UZ_ORIG_ONLY = ‘1’; otherwise, UZ_ORIG_ONLY = 5

‘0’. 6

MANUAL_UPDATE_ALLOWED - Manual update allowed flag. 7

When set to ‘1’ this field indicates if manual updates are 8



database. 11



MANUAL_ACQ_ALLOWED - Manual acquisition allowed flag. 14

When set to ‘1’ this field indicates that the user is allowed to 15


When set to ‘0’ this field indicates that the user is not allowed 17



When set to ‘1’ this field indicates PUZL takes precedence 20





When set to ‘0’ this field indicates PRL takes precedence over 25









PUZL. 34




PUZL. 38


The base station shall set this field to the value of the action 40




44

3GPP2 C.S0016-D v2.0

4-55

4.5.7 3GPD Parameter Blocks 1

Table 4.5.7-1 lists the types of parameter blocks used in the 3GPD Download Request 2

Message and the 3GPD Download Response Message. 3

4

Table 4.5.7-1 3GPD Parameter Block Types 5


3GPD Operation Mode Parameters ‘00000000’ 4.5.7.1

SimpleIPSimple IP User Profile Parameters

‘00000001’ 4.5.7.2

Mobile IP User Profile Parameters ‘00000010’ 4.5.7.3

SimpleIPSimple IP Status Parameters ‘00000110’ 4.5.7.4

MobileIPMobile IP Status Parameters ‘00000111’ 4.5.7.5

SimpleIPSimple IP PAP SS Parameters1 ‘00001000’ 4.5.7.6

SimpleIPSimple IP CHAP SS Parameters1 ‘00001001’ 4.5.7.7

MobileIPMobile IP SS Parameters1 ‘00001010’ 4.5.7.8

HRPD Access Authentication User Profile Parameters

‘00001011’ 4.5.7.9

HRPD Access Authentication CHAP SS Parameters1

‘00001100’ 4.5.7.10

eHRPD MILENAGE Algorithm Parameters2

00001101 4.5.7.11


‘11111111’

1 The shared secret parameters shall not be transmitted over the air unencrypted.

2 The MILENAGE algorithm parameters shall not be transmitted over the air unencrypted.

6

3GPP2 C.S0016-D v2.0

4-56

4.5.7.1 3GPD Operation Mode Parameters 1

The PARAM_DATA field of the 3GPD Operation Mode Parameters Block consists of the 2

following fields: 3

4

Field Length

OP_MODE 2

RESERVED 6

5

OP_ MODE - The operation mode to be used by the mobile station. 6

The base station shall set this field to the operation mode to 7

be used by the mobile station as specified in Table 3.5.8.2-1. 8






4.5.7.2 SimpleIPSimple IP User Profile Parameters 14

The PARAM_DATA field of the SimpleIPSimple IP User Profile Parameters Block consists of 15


17

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

NAI_LENGTH 8

NAI 8 NAI_LENGTH

AUTH_ALGORITHM 4


18




The base station shall include NUM_NAI occurrences of the following fields: 22


3GPP2 C.S0016-D v2.0

4-57

The base station shall set this field to the index in the 1


NAI_LENGTH - SimpleIPSimple IP NAI length. 3

The base station shall set this field to the length of the NAI in 4

units of octet. 5


The base station shall set this field to the Network Access 7



AUTH_ALGORITHM - Authentication Algorithm for SimpleIPSimple IP. 10

The base station shall set this field to the authentication 11

algorithm used to calculate the Simple IP Authentication. The 12






to ‘0’. 18

19

3GPP2 C.S0016-D v2.0

4-58

4.5.7.3 Mobile IP User Profile Parameters 1

The PARAM_DATA field of the Mobile IP User Profile Parameters Block consists of the 2

following fields: 3

4

Field Length (bits)

RETRY_INFO_INCLUDED 1

MAX_NUM_RETRY 0 or 2

FIRST_RETRY_TIMEOUT 0 or 3

REREG_THRESHOLD 0 or 6

NUM_NAI 4


NAI_ENTRY_INDEX 4

NAI_LENGTH 8

NAI 8 NAI_LENGTH

T_BIT 1

HOME_ADDRESS 32

PRIMARY_HOME_AGENT 32

SECONDARY_HOME_AGENT 32


MN-AAA-SPI_INDICATOR 1

MN-AAA_SPI 0 or 32


MN-HA_SPI_INDICATOR 1

MN-HA_SPI 0 or 32


5

RETRY_INFO_INCLUDED - Indicate if the retry information is included or not. 6

If MAX_NUM_RETRY, FIRST_RETRY_TIMEOUT and 7

REREG_THRESHOLD are included in this block, the base 8

station shall set this field to ‘1’; otherwise, the base station 9


MAX_NUM_RETRY - Maximum Number of Retry for the MobileIPMobile IP 11

Registration. 12

If RETRY_INFO_INCLUDED is set to ‘0’, the base station shall 13


as follows: 15

3GPP2 C.S0016-D v2.0

4-59


of retries for MobileIPMobile IP registration. 2

FIRST_RETRY_TIMEOUT - The amount of time elapsed between the first and second 3

MobileIPMobile IP Registration Requests, while the mobile 4

station did not receive the MobileIPMobile IP Registration 5

Reply. 6



as follows: 9

The base station shall set this field to one less than the 10

number of amount of time elapsed, in units of 250ms, 11

between the first and second MobileIPMobile IP Registration 12

Requests, while the mobile station did not receive the 13

MobileIPMobile IP Registration Reply. 14

REREG_THRESHOLD - Re-Registration Threshold. 15



as follows: 18

The base station shall set this field to the time, in units of 19

minute, before the expiration of the registration lifetime that 20

the mobile will try to reregister. 21








NAI_LENGTH - MobileIPMobile IP NAI length. 29

The base station shall set this field to the length of the 30

MobileIPMobile IP NAI, in units of octet. 31


The base station shall set this field to the Network Access 33



T_BIT - Reverse Tunneling. 36

The base station shall set this field to ‘1’ to request reverse 37

tunneling or set this field to ‘0’ if reverse tunneling is not 38

required, see [13]. 39

HOME_ADDRESS - Home Address. 40

The base station shall set this field to the IP address of the 41

mobile node in the form of network byte code. 42

PRIMARY_HOME_AGENT - Primary Home Agent. 43

3GPP2 C.S0016-D v2.0

4-60


mobile node's primary home agent in the form of network byte 2

code. 3

SECONDARY_HOME_AGENT - Secondary Home Agent. 4


mobile node's back-up/secondary home agent in the form of 6

network byte code. 7

MN-AAA_AUTH_ALGORITHM - Authentication Algorithm (MN-AAA) 8


algorithm used to calculate the Mobile IP MN-AAA 10



MN-AAA_SPI_INDICATOR - Indicator of SPI between MN and AAA. 13

The base station shall set this field to ‘1’ if the Security 14

Parameter Index is included; otherwise, the base station shall 15


MN-AAA_SPI - SPI between MN and AAA. 17

If the MN-AAA_ SPI_INDICATOR field is set to ‘1’, the 18

base station shall set this field to the Security Parameter 19

Index (MN-AAA); otherwise, the base station shall omit this 20

field. 21

MN-HA_AUTH_ALGORITHM - Authentication Algorithm (MN-HA) 22


algorithm used to calculate the Mobile IP MN-HA 24


Authentication Algorithm is encoded according to Table 26

3.5.8.6-1. 27

MN-HA_SPI_INDICATOR - Indicator of SPI between MN and HA. 28

The base station shall set this field to ‘1’ if Security Parameter 29

Index is included; otherwise, the base station shall set this 30


MN-HA_SPI - SPI between MN and HA. 32

If the MN-HA_SPI_INDICATOR field is set to ‘1’, the base 33


between MN and HA; otherwise, The base station shall omit 35

this field. 36





to ‘0’. 41

42

43

3GPP2 C.S0016-D v2.0

4-61

4.5.7.4 SimpleIPSimple IP Status Parameters 1

2

Field Length (bits)


RESERVED 4

3

ACT_NAI_ENTRY_INDEX - The SimpleIPSimple IP NAI entry index to be used by the 4

mobile station. 5

The base station shall set this field to the SimpleIPSimple IP 6

NAI entry index to be used by the mobile station. 7






4.5.7.5 MobileIPMobile IP Status Parameters 13

14

Field Length (bits)


NUM_ADD_ACT_NAI 4

NUM_ADD_ACT_NAI occurrences of the following field:

ADD_ACT_NAI_ENTRY_INDEX 4

RESERVED 0 or 4 (as needed)

15

ACT_NAI_ENTRY_INDEX - The MobileIPMobile IP NAI entry index to be used by the 16

mobile station. 17

The base station shall set this field to the MobileIPMobile IP 18

NAI entry index to be used by the mobile station in the 3GPD 19

Download Request Message. 20

NUM_ADD_ACT_NAI - Number of additional Active MobileIPMobile IP NAI entries. 21


additional active MobileIPMobile IP NAI entries. 23

ADD_ACT_NAI_ENTRY_INDEX - Additonal Active MobileIPMobile IP NAI entry 24

index. 25

3GPP2 C.S0016-D v2.0

4-62

The base station shall set this field to the active 1






to ‘0’. 7

8

4.5.7.6 SimpleIPSimple IP PAP SS Parameters 9

10

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

SS_LENGTH 5

SS 8 SS_LENGTH


11









The base station shall set this field to the length, in units of 20

octet, of the shared secret data. 21

SS - Shared Secret Data. 22

The base station shall set this field to the Shared Secret Data. 23





to ‘0’. 28

3GPP2 C.S0016-D v2.0

4-63

4.5.7.7 SimpleIPSimple IP CHAP SS Parameters 1

2

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

SS_LENGTH 5

SS 8 SS_LENGTH


3












The base station shall set this field to the Shared Secret Data. 15





to ‘0’. 20

21

3GPP2 C.S0016-D v2.0

4-64

4.5.7.8 MobileIPMobile IP SS Parameters 1

2

Field Length (bits)

NUM_NAI 4


NAI_ENTRY_INDEX 4

MN-AAA_SS_LENGTH 5

MN-AAA_SS 8 MN-AAA_SS_LENGTH

MN-HA_SS_LENGTH 5

MN-HA_SS 8 MN-FA_SS_LENGTH


3








MN-AAA_SS_LENGTH - Shared Secret Data Length between MN and AAA. 11


octet, of the shared secret data between MN and AAA. 13

MN-AAA_SS - Shared Secret Data between MN and AAA. 14

The base station shall set this field to the Shared Secret Data 15

between MN and AAA. 16

MN-HA_SS_LENGTH - Shared Secret Data Length between MN and HA. 17



MN-HA_SS - Shared Secret Data between MN and HA. 20

The base station shall set this field to the Shared Secret Data 21

between MN and HA. 22





to ‘0’. 27

28

3GPP2 C.S0016-D v2.0

4-65

4.5.7.9 HRPD Access Authentication User Profile Parameters 1

The PARAM_DATA field of the HRPD Access Authentication User Profile Parameters Block 2


4

Field Length (bits)

NAI_LENGTH 8

NAI 8 NAI_LENGTH

AUTH_ALGORITHM 4

RESERVED 4

5

NAI_LENGTH - NAI length. 6







AUTH_ALGORITHM - Authentication Algorithm for HRPD Access Authentication. 13


algorithm used to calculate the HRPD Access Authentication. 15

The Authentication Algorithm is specified in Table 3.5.8.13-1. 16



19

4.5.7.10 HRPD Access Authentication CHAP SS Parameters 20

21

Field Length (bits)

SS_LENGTH 5

SS 8 SS_LENGTH

RESERVED 3

22






3GPP2 C.S0016-D v2.0

4-66


Data. 2




number of octets. The base station shall set these bits to 6

‘000’. 7

8

4.5.7.11 eHRPD MILENAGE Algorithm Parameters 9

The PARAM_DATA field of the eHRPD MILENAGE Algorithm Parameters Block consists of 10


12

Field Length (bits)

OP_PARAM_VALUE 128

OP_PARAM_TYPE 1

RESERVED 7

13

14

OP_PARAM_VALUE - 128-bit MILENAGE Operator Variant Algorithm Configuration 15

Field (refer to [TS 35.205]). 16

OP_PARAM_TYPE - The base station shall set this bit to ‘0’, if the 17

OP_PARAM_VALUE is to be interpreted by the mobile station 18

as the OP parameter defined in [29]; otherwise, the base 19

sation shall set this bit to ‘1’ to indicate to the mobile station 20

that the OP_PARAM_VALUE is to be interpreted as the OPc 21

parameter defined in [29]. 22




number of octets. The base station shall set these bits to 26

‘0000000’. 27

28

29

3GPP2 C.S0016-D v2.0

4-67

4.5.8 MMD Parameter Block 1

Table 4.5.8-1 lists the types of parameter blocks used in the MMD Download Request 2

Message and the MMD Download Response Message. 3

Table 4.5.8-1 MMD Parameter Block Types 4


MMD Application Parameters ‘00000000’ 4.5.8.1


‘11111111’

4.5.8.1 MMD Application Parameters 5

The PARAM_DATA field of the MMD Application Parameters Block consists of the following 6

fields: 7

Field Length (bits)

IMPI_LENGTH 8

IMPI 8 IMPI_LENGTH

NUM_IMPU 4

NUM_IMPU occurrences of the following fields:

IMPU_ENTRY_IDX 4

IMPU_LENGTH 8

IMPU 8 IMPU_LENGTH

SIP_URI_LENGTH 8

SIP_DOMAIN_URI 8 SIP_URI_LENGTH

NUM_P-CSCF 4

NUM_P-CSCF occurrences of the following fields:

P-CSCF_ENTRY_IDX 4

P-CSCF_LENGTH 8

P-CSCF_ADDRESS 8 P-CSCF_LENGTH

RESERVED 0 to 7

IMPI_LENGTH - IMS Private Identity length 8

The mobile station shall set this field to the length of the IMPI 9

in units of octets 10

IMPI - IMS Private Identity. 11

3GPP2 C.S0016-D v2.0

4-68

The mobile station shall set this field to the IMS Private 1

Identity, encoded in ASCII string, refer to [17]. 2

NUM_IMPU - Number of IMS Public Identity entries. 3

The mobile station shall set this field to the number of IMS 4

Public Identity entries. 5

The mobile station shall include NUM_IMPU occurrences of the following fields: 6

IMPU_ENTRY_IDX - IMPU entry index. 7

The mobile station shall set this field to the index in the IMPU 8

Table. 9

IMPU_LENGTH - IMS Public Identity length. 10


IMPU in units of octet. 12

IMPU - IMS Public Identity. 13

The mobile station shall set this field to the IMS Public 14

Identity (IMPU), encoded in ASCII string, refer to [17]. 15

SIP_URI_LENGTH - SIP Domain URI length. 16

The mobile station shall set this field to the length of the SIP 17

Domain URI. 18

SIP_DOMAIN_URI - SIP Domain URI. 19

The mobile station shall set this field to the SIP Domain URI, 20

encoded in ASCII string, refer to [17]. 21

NUM_P-CSCF - Number of P-CSCF entries 22

The mobile station shall set this field to the number of P-23

CSCF entries. 24

The mobile station shall include NUM_P-CSCF occurrences of the following fields: 25

P-CSCF_ENTRY_IDX - P-CSCF entry index. 26

The mobile station shall set this field to the index in the P-27

CSCF Table. 28

P-CSCF_LENGTH - P-CSCF length. 29

The mobile station shall set this field to the length of the P-30

CSCF in units of octet. 31

P-CSCF_ADDRESS - P-CSCF address. 32

The mobile station shall set this field to the P-CSCF address, 33

encoded in ASCII string, refer to [17] 34





to ‘0’. 39

40

3GPP2 C.S0016-D v2.0

4-69

4.5.9 System Tag Parameter Blocks 1

Table 4.5.9-1 lists the types of parameter blocks used in the System Tag Download Request 2

Message and the System Tag Download Response Message. 3

4

Table 4.5.9-1 System Tag Parameter Block Types 5

System Tag Parameter Block Type BLOCK_ID Reference

Home System Tag ‘00000000’ 4.5.9.1

Group Tag List ‘00000001’ 4.5.9.2

Specific Tag List ‘00000010’ 4.5.9.3

Call Prompt List ‘00000011’ 4.5.9.4

Reserved for future standardization ‘00000100’ -–‘01111110’’01111111’

4.5.9.4

NULLSYS_TAG_BLOCK_ID ‘01111111’ 1.2.3


‘10000000’- ‘11111110’

See [4]


6

4.5.9.1 Home System Tag Parameter Block 7

The PARAM_DATA field of the Home System Tag Parameter Block consists of the following 8

fields: 9

Field Length (bits)

RESERVED 6

TAG_ENCODING 5

TAG_LEN 5

TAG TAG_LEN 8



TAG_ENCODING - Tag encoding. 12



TAG_LEN Tag length. 15



TAG - Tag characters. 18

3GPP2 C.S0016-D v2.0

4-70



3

3GPP2 C.S0016-D v2.0

4-71

4.5.9.2 Group Tag List Parameter Block 1

The PARAM_DATA field of the Group Tag List Parameter Block consists of the following 2

fields: 3

Field Length (bits)

CUR_TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8




System Tag. 6



LAST SEGMENT Last segment indicator bit. 9

The basemobile station shall set this field to ‘1’ if 10

SEGMENT_DATA contains the last octet of the group tag list 11

(GROUP_TAG_LISTs-p); otherwise, the basemobile station 12




within the group tag list (GROUP_TAG_LISTS-P) at which the 16


SEGMENT_DATA.The mobile station shall set this field to the 18

value of REQUEST_OFFSET from the corresponding System 19

Tag Configuration Request Message. 20


The basemobile station shall set this field to the number of 22

octets of the group tag list (GROUP_TAG_LISTs-p) included in 23

SEGMENT_DATA. 24

SEGMENT_DATA - Segment of the group tag list (GROUP_TAG_LISTs-p) data. 25





3GPP2 C.S0016-D v2.0

4-72




this field.This field contains SEGMENT_SIZE The octets shall 4

be equal to the octets starting at the offset specified by 5

SEGMENT_OFFSET within the group tag list 6

(GROUP_TAG_LISTS-P) specified by SEGMENT_OFFSET. 7

8

3GPP2 C.S0016-D v2.0

4-73

4.5.9.3 Specific Tag List Parameter Block 1

The PARAM_DATA field of the Specific Tag List Parameter Block consists of the following 2

fields: 3

Field Length (bits)

CUR_TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8




System Tag. 6





SEGMENT_DATA contains the last octet of the specific tag list 11

(SPEC_TAG_LISTs-p); otherwise, the basemobile station shall 12




within the specific tag list (SPEC_TAG_LISTS-P) at which the 16







octets of the specific tag list (SPEC_TAG_LISTs-p) included in 23

SEGMENT_DATA. 24

SEGMENT_DATA - Segment of the specific tag list (SPEC_TAG_LISTs-p) data. 25


offset specified by SEGMENT_OFFSET within the specific tag 27

list (SPEC_TAG_LISTS-P).If REQUEST_OFFSET from the 28

corresponding System Tag Configuration Request Message 29

specifies an offset that is invalid for the current specific tag 30

list, the mobile station shall include no octets in this field. 31

3GPP2 C.S0016-D v2.0

4-74

If REQUEST_OFFSET specifies an offset that is valid for the current specific tag list, the 1

mobile station shall include at most REQUEST_MAX_SIZE 2

sequential octets of the specific tag list in this field. The 3

octets shall be equal to the octets starting at the offset within 4

the specific tag list specified by SEGMENT_OFFSET. 5

6

4.5.9.4 Call Prompt List Parameter Block 7

The PARAM_DATA field of the Call Prompt List Parameter Block consists of the following 8

fields: 9

Field Length (bits)

CUR_TAG_P_REV 8

RESERVED 7

LAST_SEGMENT 1

SEGMENT_OFFSET 16

SEGMENT_SIZE 8




System Tag. 12





SEGMENT_DATA contains the last octet of the call prompt list 17

(CALL_PRMPT_LISTs-p); otherwise, the basemobile station 18




within the call prompt list (CALL_PRMPT_LISTS-P) at which the 22







octets of the call prompt list (CALL_PRMPT_LISTs-p) included 29

in SEGMENT_DATA. 30

SEGMENT_DATA - Segment of the call prompt list (CALL_PRMPT_LISTs-p) data. 31

3GPP2 C.S0016-D v2.0

4-75


offset specified by SEGMENT_OFFSET within the call prompt 2

list (CALL_PRMPT_LISTS-P).If REQUEST_OFFSET from the 3

corresponding System Tag Configuration Request Message 4

specifies an offset that is invalid for the current call prompt 5

list, the mobile station shall include no octets in this field. 6

If REQUEST_OFFSET specifies an offset that is valid for the current call prompt list, the 7

mobile station shall include at most REQUEST_MAX_SIZE 8

sequential octets of the call prompt list in this field. The 9

octets shall be equal to the octets starting at the offset within 10

the call prompt list specified by SEGMENT_OFFSET. 11

12

4.5.10 MMS Parameter Block 13

Table 4.5.10-1 lists the types of parameter blocks used in the MMS Download Request 14

Message and the MMS Download Response Message. 15

16

Table 4.5.10-1 MMS Parameter Block Types 17


MMS URI Parameters ‘00000000’ 4.5.10.1


‘11111111’

4.5.10.1 MMS URI Parameters 18

The PARAM_DATA field of the MMS Application URI Block consists of the following fields: 19

20

Field Length (bits)

NUM_MMS_URI 4

NUM_MMS_URI occurrences of the following fields:

MMS_URI_ENTRY_IDX 4

MMS_URI_LENGTH 8

MMS URI 8 x MMS_URI_LENGTH

RESERVED 0 to 7

NUM_MMS_URI - Number of MMS URIs 21

The base station shall set this field to the number of MMS 22

URIs stored on the mobile, encoded in ASCII string, refer to 23

[16], [17] and [18]. 24

The mobile station shall include NUM_MMS_URI occurrences of the following fields: 25

3GPP2 C.S0016-D v2.0

4-76

MMS_URI_ENTRY_IDX - MMS URI entry index. 1

The base station shall set this field to the index in the MMS 2

URI Table, refer to [16], [17]and [18]. 3

MMS_URI_LENGTH - MMS URI length. 4

The base station shall set this field to the length of the URI 5

associated with the MMS Relay/Server in units of octet 6

MMS_URI - MMS_URI 7

The base station shall set this field to the URI of the MMS 8

Relay/Server, encoded in ASCII string, refer to [16], [17] and 9

[18]. 10





to ‘0’. 15

16

4.5.11 MMSS Parameter Blocks 17

Table 4.5.11-1 lists the types of parameter blocks used in the MMSS Download Request 18

Message and the MMSS Download Response Message. 19

20

Table 4.5.11-1 MMSS Download Parameter Block Types 21


MMSS MODE SETTINGS ‘00000000’ 4.5.11.1

MMSS Location Associated Priority List (MLPL)

‘00000001’ 4.5.11.2

MMSS System Priority List (MSPL) ‘00000010’ 4.5.11.3

MMSS WLAN DOWNLOAD PARAM ‘00000011’ 4.5.11.4

Reserved for future access technologies ‘00000100’ through ‘01111111’


‘10000000’ through ‘11111110’

See [4]


22

3GPP2 C.S0016-D v2.0

4-77

4.5.11.1 MMSS Mode Settings Parameter Block 1

The MMSS Mode Settings is applicable to cdma2000 and non-cdma2000 cellular systems. 2

The MMSS Mode Settings is associated with MMSS System Priority List. The PARAM_DATA 3

field of the MMSS Mode Settings consists of the following fields: 4

5

Field Length (bits)

MMSS_MODE 8

6

MMSS_MODE - MMSS Mode. 7

The base station assigns the value for each mode as defined 8

in the Table in Sec. 3.5.13.2. 9

10

4.5.11.2 MMSS Location Associated Priority List (MLPL) Parameter Block 11

The MLPL and its stored version MLP_LISTS-P is a list of groupings based on location 12

specific information. MLPL allows the base station to specify the MSPL to be used in a 13

location area. Various ways of defining location is specified by the Location Type. Each 14

entry in the list points to an MSPL (see section 4.5.11.3). 15

16

Field Length (bits)

MLPL_SIZE 16

CUR_MMSS_P_REV 8

MLPL_VER_ID 16

MLPL_ID 8

NUM_MLPL_RECS 8

NUM_MLPL_RECS occurrences of the following: 17

LOC_PARAM_TYPE 8

LOC_PARAM_VAL Variable

MSPL_INDEX 8

RESERVED 0 to 7

MLPL_CRC 16

18

MLPL_SIZE - Location associated priority list size. 19

This field is set to the total size, in octets, of the MLPL, 20

including the MLPL_SIZE and MLPL_CRC fields. 21

3GPP2 C.S0016-D v2.0

4-78

CUR_MMSS_P_REV - Protocol Revision of the current MMSS_P_REV 1


MMSS_P_REV associated with this MLPL. 3

MLPL_VER_ID - MLPL Version Identification 4

The base station assigns the value of the MLPL Version 5

Identification assigned for the MLPL (MLP_LISTs-p). 6

MLPL_ID - MMSS Location Priority List identification. 7

Unique identification for the MLPL assigned by the base 8

station. 9

NUM_MLPL_RECS - Number of MMSS system priority records. 10

This field is set to the number of entries in the MLPL. 11

LOC_PARAM_TYPE - Location Parameter Type 12

This field identifies the parameter used for Location grouping. 13

Possible parameters are described in Table 3.5.13.3-1. The 14

location parameter type can be specified as any combinations 15

of MCC, MNC and NUM_SYS_LOC_TAG. The 16

NUM_SYS_LOC_TAG bit specifies the location grouping to 17

which this MLPL record belongs. When bits 0, 1, and 2 are all 18

set to ‘0’ the ‘Default’ type shall be used. The ‘Default’ type 19

represents the case when no location information is available 20

to the device. 21

LOC_PARAM_VAL - Location Parameter Value 22

LOC_PARAM_VAL is the value of the Location Parameter 23

used. This field is variable in length, depending on the 24

LOC_PARAM_TYPE used for location grouping. The length of 25

LOC_PARAM_VAL for each LOC_PARAM_TYPE is described in 26

Table 3.5.13.3-2. 27

MSPL_INDEX - MMSS System Priority List Index 28

This field is set to the MSPL_ID of the MMSS System Priority 29

List corresponding to an MLPL entry. 30




integer number of octets. Each reserved bit shall be set to ‘0’. 34

MLPL_CRC - CRC for MLPL 35


3.5.14.1. 37

38

4.5.11.3 MMSS System Priority List (MSPL) Parameter Block 39

The MSPL is a prioritized list of cdma2000 and non-cdma2000 cellular systems. The MSPL 40

assists a multimode mobile station in selecting a system. Once a system is selected, the 41

mobile station follows standard network selection procedures for the selected system to 42

3GPP2 C.S0016-D v2.0

4-79

acquire a network. The MMSS System Priority list can be sent to the mobile station using 1

Over-the-Air Service Provisioning (OTASP). The MMSS System Priority list is retained by 2

the mobile station when power is turned off. There shall be only one MSPL associated with 3

a location grouping in the MLPL. The MMSS System Priority List consists of the following 4

fields: 5

The MSP_LISTS-P, which stores the MSPL, consists of the following fields: 6

7

8

Field Length (bits)

MSPL_SIZE 16

CUR_MMSS_P_REV 8

MSPL_VER_ID 16

NUM_MSPL_ID 8

NUM_MSPL_ID occurrences of the following fields:

{ (NUM_MSPL_ID)

MSPL_ID 8

NUM_MSPL_RECS 8

NUM_MSPL_RECS occurrences of the following six fields: 9

{ (NUM_MSPL_RECS) 10

SYS_TYPE 8

PRI_CLASS 4

SYS_PRI 1

HIGHER_PRI_SRCH_TIME 3

NETWORK_CAP_IND 1

NETWORK_CAP 6 or 0

} (NUM_MSPL_RECS)

} (NUM_MSPL_ID)

RESERVED 0 to 7

MSPL_CRC 16

11

MSPL_SIZE - MMSS System Priority List size. 12

This field is set to the total size, in octets, of the MMSS 13

system priority list, including the MSPL_SIZE and MSPL_CRC 14

fields. 15

3GPP2 C.S0016-D v2.0

4-80

CUR_MMSS_P_REV - Protocol Revision of the current MMSS_P_REV 1


MMSS_P_REV associated with this MSPL. 3

MSPL_VER_ID - MSPL Version Identification 4

The base station assigns the value of the MSPL Version 5

Identification assigned for the MSPL (MSP_LISTs-p). 6

NUM_MSPL_ID - Number of MSPL IDs 7

This field is set to the number of MSPL_IDs in this set of 8

MSPL_IDs. 9

MSPL_ID - MMSS system priority list identification. 10

The base station shall set this field to the value of the MMSS 11

System Priority List Identification assigned for the MMSS 12

System Priority List. 13

NUM_MSPL_RECS - Number of MMSS system priority records. 14

This field is set to the number of MMSS system priority 15

records contained in the MSPL block. 16

SYS_TYPE - System Type identification. 17

The system type shall be set according to Table 3.5.13.4-1. 18

PRI_CLASS - Priority Class. Priority Class defines the selection priority to 19

be used in a system as allowed in that system. PRI_CLASS 20

shall be one of the following. 21

‘0000’ - Home only 22

The MS can select only home operator network in the 23

system. 24

‘0001’ - Home + Preferred. 25

The MS can select home operator network and 26

preferred operator network in the system. 27

‘0010’ to ‘1110’ – Reserved. 28

‘1111’ - Any. 29

The MS can select any operator network in the 30

system. 31

SYS_PRI - System Priority. 32

This field indicates the relative priority of systems in the 33

MMSS system priority table. The relative priority can be ‘more’ 34

(1) or ‘same’ (0). The last entry in the MMSS system priority 35

table has the system priority set to ‘0’. For each entry a ‘1’ 36

indicates that the current system type is of higher priority 37

than the next system type in the table. For each entry a ‘0’ 38

indicates that the current system type is of same priority as 39

the next system type in the table. 40

HIGHER_PRI_SRCH_TIME - Higher Priority Search Time. 41

3GPP2 C.S0016-D v2.0

4-81

Set to the time between searches of higher priority systems of 1

other radio access technologies that the mobile station may 2

use when this entry is the current system. This field shall be 3

set to the value from Table 3.5.13.4-2 corresponding to the 4

desired search time. 5

NETWORK_CAP_IND - If a NETWORK_CAP is to be included in this MSPL record this 6

field shall be set to ‘1’. Otherwise this field shall be set to ‘0’. 7

NETWORK_CAP - If the NETWORK_CAP_IND is set to ‘1’, this field shall be set 8

to a value from Table 3.5.13.4-3. Otherwise, it is omitted. 9





MSPL_CRC - CRC for MSPL 14


3.5.14.1. 16

17

4.5.11.4 MMSS WLAN Download PARAM 18

19


WLAN_AIR_INT_ALLOWED 1

NUM_WLAN_SERV_CAT 7

NUM_WLAN_SERV_CAT occurrences of the following fields:

WLAN_SERV_CAT_TYPE 8

AUTO_ACQ_ALLOWED 1


SIMULTANEOUS_ALLOWED 1

WLAN_SCAN_MODE 1

WLAN_SCAN_LIMIT 3

EMG_CALL_ALLOWED 1

VOIP_SERVICES_ALLOWED 1

POS_DET_ALLOWED 1

NUM_WLAN_AIR_INT 8

NUM_WLAN_AIR_INT occurrences of the following field: 20

WLAN_AIR_INT_TYPE 8

21

3GPP2 C.S0016-D v2.0

4-82

RESERVED 0 to 7

1

WLAN_AIR_INT_ALLOWED - The network shall set this field to ‘1’ if WLAN is allowed. 2

Otherwise, this field shall be set to ‘0’. 3

NUM_WLAN_SERV_CAT - If WLAN_AIR_INT_ALLOWED is set to ‘1’, set 4

NUM_WLAN_SERV_CAT to the number of WLAN service 5

categories supported. Otherwise this field shall be set to ‘0’. 6

WLAN_SERV_CAT_TYPE - This field is set according to Table 4.5.11.4-1 for the type of 7

service category for this record. 8

Table 4.5.11.4-1 WLAN Service Category Types 9

WLAN_SERV_CAT_TYPE Value

Operator Designated ‘00000000’

Aggregator ‘00000001’

Enterprise ‘00000010’

User Defined ‘00000011’

ANY ‘00000100’

Reserved ‘00000101’ – ‘11111111’

10

11

AUTO_ACQ_ALLOWED - This field shall be set to ‘1’ if WLAN can be acquired 12

automatically. Otherwise this field shall be set to ‘0’. 13

MANUAL_ACQ_ALLOWED - This field shall be set to ‘1’ if the mobile station is allowed to 14

enable WLAN manually. Otherwise this field shall be set to 15

‘0’. 16

SIMULTANEOUS_ALLOWED - This field shall be set to ‘1’ if the mobile station is allowed to 17

operate both WLAN radio when accessing or connected to 18

WLAN_SERV_CAT_TYPE of User Defined and cellular systems 19

at the same time. Otherwise this field shall be set to ‘0’. 20

WLAN_SCAN_MODE - If active scan is allowed, set this field to ‘1’. Otherwise, set 21


3GPP2 C.S0016-D v2.0

4-83

WLAN_SCAN_LIMIT - WLAN scanning duration is set by defining scan values given 1

in Table 4.5.11.4-1. The WLAN_SCAN_LIMIT is used by a 2

timer to allow the carrier to specify the maximum duration in 3

minutes that the mobile station is permitted to search for 4

WLAN based on time while the mobile station is in the idle 5

mode. If the mobile station has not acquired and selected a 6

WLAN system prior to the expiration of the timer, the mobile 7

station shall stop performing time-based searches for WLAN 8

systems. If another parameter causes the mobile station to 9

search for WLAN prior to the expiration of the timer, the timer 10

shall not be reset. If the duration of this parameter is reached, 11

the timer shall be reset when another parameter causes the 12

mobile station to search for WLAN. The specified parameter 13

does not require a continuous search for WLAN. This is a 14

time-based parameter for WLAN searches. Other parameters 15

(e.g. manual override, launch of an application, change in 16

location) that are not time-based can override this time-based 17

parameter. 18

Table 4.5.11.4-1 WLAN Scan Limit 19

WLAN_SCAN_LIMIT Description

‘000’ No Defined Limit

‘001’ Maximum 2 minutes






‘111’ Reserved

20

EMG_CALL_ALLOWED - If emergency call is allowed, set this field to ‘1’. Otherwise, set 21


VOIP_SERVICES_ALLOWED - If VoIP services is allowed, set this field to ‘1’. Otherwise, set 23


POS_DET_ALLOWED - If position determination is allowed, set this field to ‘1’. 25

Otherwise, set this field to ‘0’. 26

NUM_WLAN_AIR_INT - This field shall be set to the number of WLAN air interfaces 27

supported for this record. Otherwise this field shall be set to 28

‘0’. 29

WLAN_AIR_INT_TYPE - WLAN_Air Interface Types. 30

The base station shall set this field according to Table 31

3.5.13.5-1 to indicate the supported types of WLAN Air 32

Interface Radio. 33


3GPP2 C.S0016-D v2.0

4-84




to ‘0’. 4

5

6

3GPP2 C.S0016-D v2.0

5-85

5 KEY EXCHANGE PROCEDURES 1

5.1 Mobile Station Requirements for A_KEY_P_REV < ‘00000011’ 2

5.1.1 Random Number Generation 3

The mobile station shall generate a random number X for use in calculating the mobile 4

station result, MS_RESULT. The number X shall have the following properties: 5

• The number generated shall be 160-bits in length. 6

• The number generated shall not be less than 4. 7

• The number generated shall have an uniform statistical distribution over its range. 8

• The numbers used in formulating different Key Generation Response Messages sent 9

by the same mobile station shall be statistically uncorrelated. 10

• The number used in formulating each Key Generation Response Message shall not be 11

derivable from the previously used numbers or mobile station indicator values. 12

• The numbers used in formulating Key Generation Response Messages sent by 13

different mobile stations shall be statistically uncorrelated. 14

15

5.1.2 Mobile Station Result 16

The mobile station shall calculate MS_RESULT = PARAM_GsX modulo PARAM_Ps. 17

18

5.1.3 A-key Computation 19

The mobile station shall compute the common key K = BS_RESULTsX modulo PARAM_Ps. 20

The mobile station shall store the least significant 64 bits of the result K as A_KEY_TEMPs. 21

5.2 Base Station Requirements for A_KEY_P_REV < ‘00000011’ 22

5.2.1 Generation of the Key Exchange Parameters 23

The base station shall select and store a 512-bit prime number P based on the following 24

criteria: 25

• P should be chosen randomly. 26

• (P - 1) should have a large prime factor. 27

• The most significant bit of P should be equal to ‘1’. 28

The base station shall set PARAM_P of the MS Key Request Message to P. 29

The base station shall select a 160-bit number G such that it is greater than 1 and less 30

than (P-1). The base station shall set PARAM_G of the MS Key Request Message to G. 31

3GPP2 C.S0016-D v2.0

5-86

The base station shall generate a random number Y for use in calculating the base station 1

result, BS_RESULT. The number Y shall have the following properties: 2




• The numbers used in formulating different Key Generation Request Messages sent by 6

the same base station shall be statistically uncorrelated. 7

• The numbers used in formulating Key Generation Request Message sent by different 8

base stations shall be statistically uncorrelated. 9

10

5.2.2 Base Station Result 11

The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_P. 12

13

5.2.3 A-key Computation 14

The base station shall compute the common key K = MS_RESULTY modulo PARAM_P. The 15

base station shall use the least significant 64 bits of the result K as the A-keyA_KEY. 16

5.3 Mobile Station Requirements for A_KEY_P_REV = ‘00000011’ or ‘00000100’ 17

5.3.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure 18

The mobile station shall set PARAM_Ps for use in calculating the mobile station result, 19

MS_RESULT, to the following 1024-bit prime number (Most Significant Bit first): 20

0xFFFFFFFF 0xFFFFFFFF 0xC90FDAA2 0x2168C234 0xC4C6628B 0x80DC1CD1 21

0x29024E08 0x8A67CC74 0x020BBEA6 0x3B139B22 0x514A0879 0x8E3404DD 22

0xEF9519B3 0xCD3A431B 0x302B0A6D 0xF25F1437 0x4FE1356D 0x6D51C245 23

0xE485B576 0x625E7EC6 0xF44C42E9 0xA637ED6B 0x0BFF5CB6 0xF406B7ED 24

0xEE386BFB 0x5A899FA5 0xAE9F2411 0x7C4B1FE6 0x49286651 0xECE65381 25

0xFFFFFFFF 0xFFFFFFFF 26

The mobile station shall set PARAM_Gs for use in calculating MS_RESULT to ‘00000010’. 27

The mobile station shall generate a random number X for use in calculating MS_RESULT. 28

The number X shall have the following properties: 29





3GPP2 C.S0016-D v2.0

5-87






6



9

5.3.3 A Key A-key and Root Key Computation for A_KEY_P_REV = ‘00000011’ 10

The mobile station shall compute one of the input to f0, Random Secret Seed, 11

RAND_SEED_TEMP = BS_RESULTsX modulo PARAM_Ps. The mobile station shall store 12

the least significant 128 bits of the result RAND_SEED_TEMP as RAND_SEED. 13

The A-keyA_KEY and 3G Root Key RK are generated by invoking the algorithmic function 14

f0 as specified in Section 2.2.2.2 of [8]. Since each invocation of f0 produces 64 bits, three 15

invocation of f0 is need for a total of 192 bits. 16


• The K parameter shall be set to RAND_SEED. 18



The mobile station shall invoke f0. 21

The mobile station shall store the most significant bits of the result of invocation of f0 as 22

the A_KEY_TEMPs. 23

The mobile station shall store the remaining 128 bits of the invocation of f0 as RK_TEMPs. 24

25

5.3.4 Root Key Computation for A_KEY_P_REV = ‘00000100’ 26

The mobile station shall compute the Root Key RK = BS_RESULTsX modulo PARAM_Ps. 27

The mobile station shall store the least significant 128 bits of the result RK as RK_TEMPs. 28

5.4 Base Station Requirements for A_KEY_P_REV = ‘00000011’ or ‘00000100’ 29

5.4.1 Generation of the Key Exchange Parameters Root Key 30

The base station shall set PARAM_Ps for use in calculating the base station result, 31

BS_RESULT, to the following 1024-bit prime number (Most Significant Bit first): 32

0xFFFFFFFF 0xFFFFFFFF 0xC90FDAA2 0x2168C234 0xC4C6628B 0x80DC1CD1 33

3GPP2 C.S0016-D v2.0

5-88

0x29024E08 0x8A67CC74 0x020BBEA6 0x3B139B22 0x514A0879 0x8E3404DD 1

0xEF9519B3 0xCD3A431B 0x302B0A6D 0xF25F1437 0x4FE1356D 0x6D51C245 2

0xE485B576 0x625E7EC6 0xF44C42E9 0xA637ED6B 0x0BFF5CB6 0xF406B7ED 3

0xEE386BFB 0x5A899FA5 0xAE9F2411 0x7C4B1FE6 0x49286651 0xECE65381 4

0xFFFFFFFF 0xFFFFFFFF 5

The base station shall set PARAM_Gs for use in calculating BS_RESULT to ‘00000010’. 6

The base station shall generate a random number Y for use in calculating BS_RESULT. 7

The number Y shall have the following properties: 8








16


The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_P. 18

19

5.4.3 A KeyA-key and Root Key Computation for A_KEY_P_REV = ‘00000011’ 20

The base station shall compute the input to f0, Random Secret Seed, RAND_SEED_TEMP = 21

MS_RESULTY modulo PARAM_P. The base station shall store the least significant 128 bits 22

of the result RAND_SEED_TEMP as RAND_SEED. 23

The A-keyA_KEY and 3G Root Key RK are generated by invoking the algorithmic function 24

f0 as specified in Section 2.2.2.2 of [8]. Since each invocation of f0 produces 64 bits, three 25

invocation of f0 is need for a total of 192 bits. 26


• The K parameter shall be set to RAND_SEED. 28



The base station shall invoke f0. 31

The base station shall store the most significant bits of the result of invocation of f0 as the 32

A-keyA_KEY. 33

3GPP2 C.S0016-D v2.0

5-89

The base station shall store the remaining 128 bits of the invocation of f0 as the Root Key 1

K. 2

5.4.4 Root Key K Computation for A_KEY_P_REV = ‘00000100’ 3

The base station shall compute the Root Key RK = MS_RESULTY modulo PARAM_P. The 4

base station shall use the least significant 128 bits of the result RK as the Root Key K. 5

6

5.5 Mobile Station Requirements for A_KEY_P_REV = ‘00000101’ 7

5.5.1 Random Number Generation and Key Generation Parameters 8


MS_RESULT, to the 1024-bit prime number as specified in 5.3.1. 10



The number X shall have the following properties: 13










23


The mobile station shall calculate MS_PW_HASH as the follows: 25

MS_PW_HASH = SHA-114 (0x00000001,0x00000001, MS_PW) modulo 2128 | 26

SHA-1 (0x00000001,0x00000002, MS_PW) modulo 2128 | 27




14 SHA-1 refers to the FIPS-180 hash function as specified in [9].

3GPP2 C.S0016-D v2.0

5-90




SHA-1 (0x00000001,0x00000009, MS_PW) modulo 2128. 4

The mobile station shall calculate MS_RESULT = (MS_PW_HASH15 * PARAM_GsX) modulo 5

PARAM_Ps. 6

7

5.5.3 Root Key Computation for A_KEY_P_REV = ‘00000101’ 8

The mobile station shall compute the Root Key RK = SHA-1 (0x00000003 | 0x00000C8016 9

|MS_PARAM |MS_PARAM), 10

where MS_PARAM =MS_PW| 11

PARAM_GsX modulo PARAM_Ps| 12

(BS_RESULTs/BS_PW_HASH) modulo PARAM_Ps| 13

((BS_RESULTs/BS_PW_HASH)X) modulo PARAM_PsP. 14

The mobile station shall store the least significant 128 bits of the result RK as RK_TEMPs. 15

16

5.6 Base Station Requirements for A_KEY_P_REV = ‘00000101’ 17



BS_RESULT, to the following 1024-bit prime number (Most Significant Bit first) as specified 20

in 5.4.1. 21



The number Y shall have the following properties: 24





15 MS_PW_HASH may be reduced modulo PARAM_PS prior to multiplication to simplify

implementation.

16 This value is set to the length of MS_PARAM in bits.

3GPP2 C.S0016-D v2.0

5-91




4


The base station shall calculate BS_PW_HASH where 6

BS_PW_HASH = SHA-1 (0x00000002,0x00000001, BS_PW) modulo 2128 | 7

SHA-1 (0x00000002,0x00000002, BS_PW) modulo 2128 | 8







SHA-1 (0x00000002,0x00000009, BS_PW) modulo 2128. 15

16

The base station shall calculate BS_RESULT = (BS_PW_HASH17 * PARAM_GY) modulo 17

PARAM_P. 18

19

5.6.3 3G Root Key K Computation 20

The base station shall compute the Root Key RK = SHA-1 (0x00000003 | 0x00000C8018 | 21

BS_PARAM | BS_PARAM), 22

where BS_PARAM =BS_PW| 23

(MS_RESULT/MS_PW_HASH) modulo PARAM_P | 24

PARAM_GY modulo PARAM_P | 25

((MS_RESULT/MS_PW_HASH)Y) modulo PARAM_P. 26

The base station shall use the least significant 128 bits of the result RK as the Root Key K. 27

28

17 BS_PW_HASH may be reduced modulo P prior to multiplication to simplify implementation.

18 This value is set to the length of BS_PARAM in bits.

3GPP2 C.S0016-D v2.0

5-92


5.7.1 Random Number Generation for Diffie-Hellman Key Exchange Procedure 2


MS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.3.1. 4



The number X shall have the properties listed in 5.5.1. 7

8



11

5.7.3 eHRPD Root Key Computation for A_KEY_P_REV = ‘00000111’ 12

The mobile station shall compute the eHRPD Root Key eRK = BS_RESULTsX modulo 13

PARAM_Ps. The mobile station shall store the least significant 128 bits of the result eRK as 14

eHRPD_K_TEMPs. 15

16


5.8.1 Generation of the Key Exchange Parameters Root Key 18


BS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.4.1. 20



The number Y shall have the properties listed in 5.6.1. 23


The base station shall calculate BS_RESULT = PARAM_GY modulo PARAM_Ps. 25

5.8.3 eHRPD Root Key eHRPD_K Computation for A_KEY_P_REV = ‘00000111’ 26

The base station shall compute the eHRPD Root Key eRK = MS_RESULTY modulo 27

PARAM_Ps. The base station shall use the least significant 128 bits of the result eRK as 28

the eHRPD Root Key eHRPD_K. 29

3GPP2 C.S0016-D v2.0

5-93

1




MS_RESULT, to the 1024-bit prime number as specified in 5.3.1. 5



The number X shall have the properties listed in 5.5.1. 8

9


The mobile station shall calculate MS_PW_HASH as the follows: 11

MS_PW_HASH = SHA-25619 (0x00000001,0x00000001, MS_PW) modulo 2256 | 12




SHA-256 (0x00000001,0x00000005, MS_PW) modulo 2128. 16

The mobile station shall calculate MS_RESULT = (MS_PW_HASH20 * PARAM_GsX) modulo 17

PARAM_Ps. 18

19

5.9.3 eHRPD Root Key Computation for A_KEY_P_REV = ‘00001000’ 20

The mobile station shall compute the eHRPD Root Key eRK = SHA-256 (0x00000003 | 21

0x00000C8021 |MS_PARAM |MS_PARAM), 22

where MS_PARAM =MS_PW| 23

PARAM_GsX modulo PARAM_Ps | 24

(BS_RESULTs/BS_PW_HASH) modulo PARAM_Ps | 25

((BS_RESULTs/BS_PW_HASH)X) modulo PARAM_Ps. 26

19 SHA-256 refers to the FIPS-180-2 hash function as specified in [cc].

20 MS_PW_HASH may be reduced modulo PARAM_PS prior to multiplication to simplify

implementation.

21 This value is set to the length of MS_PARAM in bits.

3GPP2 C.S0016-D v2.0

5-94

The mobile station shall store the least significant 128 bits of the result eRK as 1

eHRPD_K_TEMPs. 2

3




BS_RESULT, to the 1024-bit prime number (Most Significant Bit first) specified in 5.4.1. 7



The number Y shall have the properties listed in 5.6.1. 10

11


The base station shall calculate BS_PW_HASH where 13

BS_PW_HASH = SHA-256 (0x00000002,0x00000001, BS_PW) modulo 2256 | 14




SHA-256 (0x00000002,0x00000005, BS_PW) modulo 2128. 18

19

The base station shall calculate BS_RESULT = (BS_PW_HASH22 * PARAM_GY) modulo 20

PARAM_Ps. 21

22

5.10.3 eHRPD Root Key eHRPD_K Computation 23

The base station shall compute the eHRPD Root Key eRK = SHA-256 (0x00000003 | 24

0x00000C8023 | BS_PARAM | BS_PARAM), 25

where BS_PARAM =BS_PW| 26

(MS_RESULT/MS_PW_HASH) modulo PARAM_Ps | 27

PARAM_GY modulo PARAM_Ps | 28

22 BS_PW_HASH may be reduced modulo PARAM_Ps prior to multiplication to simplify

implementation.

23 This value is set to the length of BS_PARAM in bits.

3GPP2 C.S0016-D v2.0

5-95

((MS_RESULT/MS_PW_HASH)Y) modulo PARAM_Ps. 1

The base station shall use the least significant 128 bits of the result eRK as the eHRPD 2

Root Key eHRPD_K. 3

4

5

3GPP2 C.S0016-D v2.0

5-96

1

2

3

4

5

6

7

8

9

This page left intentionally blank.No text 10

3GPP2 C.S0016-D v2.0

A-1

ANNEX A VOIDRESERVED 1

2

3GPP2 C.S0016-D v2.0

A-2

1

2

3

4

5

6

7

8

9

This page left intentionally blank.No text.10

3GPP2 C.S0016-D v2.0

B-1

ANNEX B VOID(INFORMATIVE) BIBLIOGRAPHY 1

The documents listed in this annex are for information only and are not essential for the 2

completion of the requirements of this standard. 3

1. TIA/EIA/IS-91, Mobile Station - Base Station Compatibility Standard for 800 MHz 4

Analog Cellular, October 1994. 5

6

7

3GPP2 C.S0016-D v2.0

B-2

1

2

3

4

5

6

7

8

9

This page left intentionally blank. 10

3GPP2 C.S0016-D v2.0

C-1

ANNEX C (INFORMATIVE) SYSTEM SELECTION AND ACQUISITION 1

C.1 Introduction 2

This is an informative annex that describes recommended use of the preferred roaming list. 3

The preferred roaming list indicates which systems the mobile station should use (preferred 4

systems). It also indicates which systems should not be used by the mobile station 5

(negative systems). In addition to indicating which systems are preferred or negative, the 6

preferred roaming list has information that can reduce the acquisition time, however, for 7

optimum performance of the SSPR feature appropriate structuring of the roaming list is 8

required. 9

The preferred roaming list consists of two tables: the system table and the acquisition 10

table. The system table contains records. Each record identifies a system by its SID and 11

NID. For each record, there is an indicator of whether the system is preferred or negative, 12

the roaming status that should be indicated by the mobile station, the relative priority of 13

the system and its geographic region. Each record also contains an acquisition index that 14

indicates a record in the acquisition table to be used. The acquisition record provides the 15

band and frequencies that the mobile station is to use when attempting to acquire the 16

system. 17

Table C.1-1 illustrates the basic structure of the preferred roaming list. 18

Table C.1-1 Preferred Roaming List 19

PREF_ONLY DEF_ROAM_IND NUM_ACQ_RECS NUM_SYS_RECS

No On (steady) 5 12

20

Table C.1-2 illustrates the acquisition table. The records in the acquisition table are in 21

order of priority (highest priority first) according to desired mobile station system selection 22

scan order. 23

Table C.1-2 Acquisition Table 24

ACQ_INDEX ACQ_TYPE Description Acquisition Parameters

0 ‘0110’ PCS CDMA - Using Channels PCS Channels 100, 125, 150, 175, 200

1 ‘0101’ PCS CDMA - Using Blocks PCS Block C

2 ‘0011’ Cellular CDMA - Custom Channels

Channel Number 1

3 ‘0010’ Cellular CDMA - Standard Channels

System A, Primary and Secondary CDMA Channel

4 ‘0001’ Cellular Analog System B

25

3GPP2 C.S0016-D v2.0

C-2

Table C.1-3 illustrates the system table. In this table, region changes are denoted by a 1

change in shading. 2

Table C.1-3 System Table 3

SID NID_INCL PREF_NEG GEO PRI ACQ_INDEX (ACQ_TYPE)

ROAM_IND

111 0 1 0 1 2 [Cellular CDMA -Standard Channels]

Off

77 0 1 1 0 0 [PCS CDMA -Using Channels]

Off


Flashing

34 0 0 1 N/A 4 [Cellular Analog] N/A


Off

4 0 1 1 1 0 [PCS CDMA -Using Channels]

On

12 0 1 1 1 3 [Cellular CDMA -Custom Channels]

On

0 0 1 1 0 4 (Cellular Analog) On



Off

56 0 1 1 0 1 [PCS CDMA -Using Blocks]

Flashing


4

C.2 Accelerated System Selection 5

C.2.1 Using Positive and Negative Systems 6

An entry in SYS_TABLE having a PREF_NEG bit set to ‘1’ is a preferred system. An entry in 7

SYS_TABLE having a PREF_NEG bit set to ‘0’ is a negative system. 8

Once the SID of the preferred system is determined it can be used to index into the 9

Geographic Region of the SYS_TABLE and select a system in the same Geographic Region 10

that is preferable. The mobile station can then use the acquisition table entry to 11

3GPP2 C.S0016-D v2.0

C-3

determine the frequencies that should be used when attempting to acquire the preferred 1

system. 2

Similarly, once the SID of a negative system is determined, it can be used to index into the 3

Geographic Region of the SYS_TABLE and select a system in the same Geographic Region 4

that is preferable. The mobile station can then use the acquisition table entry to 5

determine the frequencies that should be used when attempting to acquire the preferred 6

system. 7

For example, if the mobile station acquires the analog cellular system with SID equal to 34, 8

the mobile station should attempt to acquire the cellular CDMA system with SID equal to 9

111 (see Table C.1-3). If the mobile station fails to acquire this system, the mobile station 10

should attempt to acquire the PCS CDMA system with SID equal to 77. 11

The relative priority of two preferred systems in the same Geographic Region cannot be 12

expressed when there are one or more negative systems listed between these preferred 13

systems in the SYS_TABLE. For this reason, it is recommended to list negative systems 14

after all preferred systems in their respective Geographic Regions. 15

C.2.2 PCS Block Mode System Selection 16

There are two acquisition types that can be used when acquiring a PCS CDMA system: 17

PCS CDMA System Acquisition (Using Blocks) and PCS CDMA System Acquisition (Using 18

Channels). These correspond to ACQ_TYPE equal to ‘0101’ and ACQ_TYPE equal to ‘0110’, 19

respectively. 20

When using the block mode, the mobile station may need to search all of the preferred 21

frequency assignments (see 6.1.1.1 of [1] or [23]) within the frequency block to determine 22

whether it can acquire the system. For the A, B and C blocks, there are 11 preferred 23

frequency assignments. Since the acquisition time may be proportional to the number of 24

preferred frequency assignments, specifying the entire frequency block should be avoided 25

when a smaller set of frequencies is sufficient, thus, it is usually preferable to use the PCS 26

CDMA System Acquisition (Using Channels) acquisition type. 27

28

C.2.3 Special Cases and Considerations 29

It is possible for the mobile station to acquire a channel, decode the SID/NID and find a 30

matching SID/NID system record where the acquired channel and the acquisition type of 31

the matching record are different. In these cases, service is allowed. For example, if the 32

mobile station is presently scanning one of PCS channels corresponding to ACQ_TYPE = 33

‘0110’ (first entry in the Table C.1-2), discovers the system with SID 61, and finds it in the 34

system table (see Table C.1-3), service is allowed, even though the acquisition index for the 35

record (ACQ_INDEX = 2) does not match acquired system. This situation can occur based 36

upon service providers changing or adding channels in a market, changing broadcast SID, 37

or purchasing another service provider’s market. 38

Wildcard SIDs (SID = 0) can be used to universally allow or deny service in a particular 39

band or mode(s) of operation. In this example, assume that cellular analog system SID 504 40

and cellular CDMA system SID 4101 can be acquired by the mobile station and are not 41

3GPP2 C.S0016-D v2.0

C-4

specifically included in the system table. Assume further that the PREF_ONLY for the 1

preferred roaming list is set to ‘1’ (‘True’). The mobile station scans channels according to 2

all acquisition table entries attempting to acquire a system with SID that matches records 3

in the system table. After finding no matching SIDs, the mobile station allows service on 4

the system with SID 504 acquired at the cellular analog System B. The mobile station does 5

not allow service on system with SID 4101, since that system does not match the 6

acquisition record associated with the system record containing the wildcard SID. 7

C.3 Preferred Roaming List Maintenance 8

All or any part of the preferred roaming list can be replaced using Over-the-Air Service 9

Provisioning. Segmentation of the preferred roaming list provides access to any specific 10

area requiring modification. An area is identified by the position offset of the first modified 11

octet in the list and includes the number of new octets to be transmitted in one or more 12

segments (see 3.3.1). 13

The end of transmission is denoted by the LAST_SEGMENT field set to ‘1’. When the end of 14

transmission is detected, the length and CRC of the preferred roaming list must be verified 15

to ensure the data integrity. For manageability, when replacing areas of differing sizes, it is 16

recommended that the remaining data of the list be retransmitted and replaced as well. 17

When the preferred roaming list data is modified, the service provider may assign a new 18

PR_LIST_ID to the list. 19

20

3GPP2 C.S0016-D v2.0

D-1

ANNEX D (INFORMATIVE) SYSTEM SELECTION AND THE PREFERRED USER ZONE 1

LIST 2

The Preferred User Zone List provides the mobile station that supports the optional User 3

Zone feature with the specification of the User Zones to which the mobile station is 4

subscribed. The PUZL is used after the mobile station has completed system acquisition 5

using the preferred roaming list or other techniques. If PRL has a higher priority than 6

PUZL (PUZL_PRL_RELATIVE_PRIORITY=’0’), then, once a mobile station has found its 7

preferred system via the PRL, the PUZL is used to select the most preferred User Zone on 8

that system. Otherwise, PUZL is first used to select a system. The PUZL contains a list of 9

all User Zones that are subscribed to and any parameters needed to locate and access 10

these User Zones. 11

In the case where the network is broadcasting a Private Neighbor List Message indicating 12

the presence of the preferred User Zone on a separate RF carrier or possibly the same RF 13

carrier, the mobile station will then switch to that RF carrier to obtain the services of the 14

User Zone. For the purposes of the PRL, the private system in this case can be considered 15

to be part of the original system on which the Private Neighbor List Message was detected. 16

The UZ_RF_INFO describes information which may be used by a Mobile Station to 17

determine when to scan for an access point. GEO_TYPE_SPECIFIC_FIELDS describe geo-18

spatial information which may be used by a Mobile Station to determine where to scan for 19

an AP 20

It is noted that: 21

Each entry in the PUZL is uniquely identified by User Zone ID and User Zone SID. 22

Each User Zone entry within the PUZL is stored contiguously in the mobile station 23

memory. 24

The PUZL may be stored in a non-contiguous fashion in the mobile station memory. 25

The PUZL may have up to 4095 User Zone entries. 26

27

28

3GPP2 C.S0016-D v2.0

D-2

1

2

3

4

5

6

7

8

9

This page left intentionally blank.10

3GPP2 C.S0016-D v2.0

E-1

ANNEX E (INFORMATIVE) MULTIMODE SYSTEM SELECTION 1

E.1 Introduction 2

This is an informative annex that describes the recommended use of the MMSS Location 3

Associated Priority List (MLPL) and the MMSS System Priority List (MSPL) for Multimode 4

System Selection (MMSS). The MLPL and the MSPL are used together for the purposes of 5

selecting a supported cellular system based on the two priority lists. 6

The MLPL is a list of records based on location specific information. The MLPL allows the 7

operators to specify the MMSS System Priority List to be used for a particular location 8

record. Typically, the MLPL consists of many location records. For each location record 9

(or, equivalently, MLPL record), one to three location parameter values (i.e., Mobile Country 10

Code (MCC), Mobile Network Code (MNC) and SYS_LOC_TAG) may be specified along with a 11

MSPL_INDEX which specifies the associated MSPL. 12

The MSPL is a list of records for prioritizing cdma2000 and non-cdma2000 cellular 13

systems. The MSPL assists a multimode mobile station in selecting a system. Once a 14

system is selected, the mobile station follows the network selection procedures according to 15

the requirements of that system. After acquiring a system, the multimode mobile station 16

searches for systems having a higher priority in the MSPL after a time that may be 17

specified by HIGHER_PRI_SRCH_TIMER. There can be only one MSPL record associated 18

with a location grouping specified in an MLPL record; however, any number of MLPL 19

records may have the same MSPL_INDEX. The next two sections describe the MLPL and 20

MSPL in more detail. 21

E.1.1 MMSS Location Associated Priority List (MLPL) 22

An MLPL record may consist of one to three location parameter values: MCC, MNC and 23

SYS_LOC_TAG. SYS_LOC_TAG is a location TAG associated with specific networks within a 24

system. Typically, an operator will define an MLPL record for each country where there is a 25

roaming agreement. If the priority for system selection is to be the same within any given 26

country, then only the MCC parameter can be used to define the location parameter value. 27

For example, if the home operator has roaming agreements with 5 countries, the MLPL may 28

consist of the following 5 records: 29

Table E.1.1-1 MLPL 30

MLPL record

MCC MNC SYS_LOC_TAG MSPL_INDEX

1 1 MSPL 1

2 2 MSPL 2

3 3 MSPL 3

4 4 MSPL 4

5 5 MSPL 4

3GPP2 C.S0016-D v2.0

E-2

1

Note that MNC and SYS_LOC_TAG are not needed since each country has only one system 2

selection priority list indicated by MSPL_INDEX. Note the 4th and the 5th records are both 3

associated with the same MSPL_INDEX (i.e., the two countries have the same order of 4

priorities for system selection). 5

The MNC and SYS_LOC_TAG location parameter values are only used when multiple MSPL 6

records are needed within a country. An MNC is unique in a given country and is issued to 7

a specific operator. If the roaming agreements differ from one region of the country to 8

another (e.g., due to availability of services) it may be necessary for the home operator to 9

create two MLPL records pointing to two MSPL records. 10

For example, the home operator may have roaming agreements with operator A (GSM with 11

MNC = 1) and operator B (cdma2000 1x), but less favorable roaming agreements with 12

operator C (GSM with MNC =2) and operator D (cdma2000 1x). It is further assumed that 13

operators A and D serve one region (region 1) of the country whereas operators B and C 14

serve another region of the same country (region 2). For region 1, the preference is for 15

mobile stations to roam onto operator A’s GSM system followed by operator D’s cdma2000 16

1x system. For region 2, the preference is for operator B’s cdma2000 1x system followed by 17

operator C’s GSM system. 18

19

20

21

22

23

24

Using one MSPL to set priorities between cdma2000_AI and 3GPP_AI is clearly insufficient 25

due to the difference in operator’s requirement for system selection. The two MLPL records 26

may be constructed as follows: 27

Table E.1.1-2 MLPL using MNC 28

MLPL Record

MCC MNC SYS_LOC_TAG MSPL_INDEX

1 1 1 MSPL 1

2 1 2 MSPL 2

Note that the first MLPL record is associated with MNC = 1 (operator A) and points to MSPL 29

1 (with 3GPP_AI preferred over cdma2000_AI). The second MLPL record is associated with 30

MNC = 2 (operator C) and points to MSPL 2 (with cdma2000_AI preferred over 3GPP_AI). 31

Mobile stations operating in region 1 would use the first MLPL record while mobile stations 32

operating in region 2 would use the second MLPL record. 33

Operator B (cdma2000 1x) >

Operator C (GSM)

Operator A (GSM) >

Operator D (cdma2000 1x)

Region 1 Region 2

3GPP2 C.S0016-D v2.0

E-3

In some cases it may be desirable for the operator to add SYS_LOC_TAG information to the 1

MLPL records. The SYS_LOC_TAG information for the cdma2000 network is defined by the 2

SID/NID info associated with particular cdma2000 networks. However, in general, there 3

can be more than one SYS_LOC_TAG information belonging to different systems (i.e., 4

SYS_LOC_TAG could be associated with 3GPP_AI and WiMAX) in the same MLPL record. 5

Using the same example as above for Operators A, B, C and D, it is further assumed that 6

Operator B’s cdma2000 1x system uses SID = 5 and NID = 40 while Operator D’s 7

cdma2000 1x system uses SID = 2 and NID = 25. 8

Table E.1.1-3 MLPL with SYS_LOC TAG 9

MLPL record

MCC MNC SYS_TYPE 1 SYS_LOC

_TAG 1

SYS_LOC

_TAG 2

SYS_LOC

_TAG 3

MSPL_INDEX

1 1 1 1

2 1 2 2

3 1 0 (cdma2000_AI)

2 (SID) 25 (NID_START)

0 (NID_RANGE)

1

4 1 0 (cdma2000_AI)


0 (NID_RANGE)

2

10

11

12

With the SYS_LOC_TAG information, if the mobile station were to discover the GSM 13

network with MNC = 1 the first MLPL should be used. If the mobile station were to discover 14

the GSM network with MNC = 2 the second MLPL should be used. If the mobile were to 15

discover the cdma2000 1x network with SID = 2, NID = 25 the third MLPL record should be 16

used. Lastly, if the mobile station were to discover the cdma2000 1x network with SID = 5, 17

NID = 40, the fourth MLPL record should be used. Typically, not all location parameter 18

values are applicable to every system. In this example, the GSM system uses only the MCC 19

and MNC location parameter values while the cdma2000 systems use only the MCC and 20

the SYS_LOC_TAG location parameter values. 21

Since the 1st and 3rd MLPL records in Table E.1.1-3 have the same MCC value and they 22

both map to the same MSPL_INDEX, the two MLPL records can be combined into one MLPL 23

record to reduce storage space (refer to Table E.1.1-4). Similarly, the 2nd and 4th MLPL 24

records can be combined to form one MLPL record. In this case the first MLPL record is 25

used if the mobile station discovers either MNC = 1 while operating on the GSM system or 26

SID=2/NID=25 while operating on the cdma2000 system. The second MLPL record is used 27

if the mobile station discovers either MNC = 2 while operating on the GSM system or 28

SID=5/NID=40 while operating on the cdma2000 system. 29

In some cases, the mobile station may have more than one MLPL record to choose from 30

based on the location parameter values. In these cases, the MLPL record with the finest 31

SYS_LOC_TAG

3GPP2 C.S0016-D v2.0

E-4

granularity is chosen first (i.e., MLPL record containing SYS_LOC_TAG information), 1

followed by the MLPL record with lesser granularity (i.e., MLPL record containing MNC 2

information). Finally, the MLPL record with the least level of granularity is chosen last (i.e., 3

MLPL record containing MCC only). As an example, if the mobile station acquired a 4

cdma2000 network with SID = 5, NID = 40 in MCC 1, it uses the third MLPL record in 5

Table E.1.1-5 since the third MLPL record has better granularity. On the other hand, if the 6

mobile station acquired a network in MCC 1 but the network parameters do not match any 7

of the MNC or SYS_LOC_TAG in the MLPL, then the MLPL record with only the MCC value 8

is used. 9

Table E.1.1-5 MLPL with different levels of granularity 10

MLPL record


_TAG 1

SYS_LOC

_TAG 2

SYS_LOC

_TAG 3

MSPL_INDEX

1 1 1

2 1 1 2

3 1 2 0 (cdma2000_AI)


0 (NID_RANGE)

3

11

E.1.2 MMSS System Priority List (MSPL) 12

In addition to the system selection based on system types (i.e., SYS_TYPE), the MSPL has a 13

number of additional parameters to assist the multimode mobile station in deciding which 14

system to select. These additional parameters include PRI_CLASS, SYS_PRI and 15

HIGHER_PRI_SRCH_TIME. All three fields are applicable to any of the system types listed 16

in Table 3.5.13.4-1. In particular, the PRI_CLASS may be used to define system priority 17

based on different classes of networks within a system. The HIGHER_PRI_SRCH_TIME 18

parameter can define the time between searches of higher priority systems of other radio 19

access technologies. 20

The PRI_CLASS parameter can take on one of three values (‘0000’ =HOME, ‘0001’=HOME + 21

PREFERRED and ‘1111’=ANY), see section 3.5.13.4. Since each system has its own 22

method and format for creating a priority list or roaming list, the mapping of the 23

PRI_CLASS to networks in the priority list or roaming list may appear different from one 24

system to another. 25

A description of the HOME priority class is given below: 26

If the SYS_TYPE = cdma2000_AI, the HOME priority class is the set of most 27

preferred systems in each GEO. Note, if the PRL lists a series of HRPD 28

entries at the top of a GEO, and, at least one of the HRPD system records in 29

the series has the Priority bit set to MORE, even the most preferred 1x 30

system in the GEO will not be part of the HOME priority class. 31

3GPP2 C.S0016-D v2.0

E-5

If the SYS_TYPE = 3GPP_AI, the HOME priority class specifies the set of 1

PLMNs present in the HPLMN and EHPLMN (with or without Access 2

Technologies AcT). 3

If the SYS_TYPE = cdma2000 1x, the HOME priority class specifies the set of 4

most preferred 1x systems in each GEO. 5

If the SYS_TYPE = cdma2000 HRPD, the HOME priority class specifies the 6

set of most preferred cdma2000 HRPD systems in each GEO. 7

If the SYS_TYPE = GERAN, the HOME priority class specifies the GSM 8

PLMNs in the HPLMN or EHPLMN. Note, that if the GSM bit is not set and 9

any other technology bit is set in the Access Technology ID (AcT) bitmap of 10

each PLMN in all the HPLMN and EHPLMN entries, then no GSM system will 11

be part of the HOME priority class. 12

If the SYS_TYPE = UTRAN, the HOME priority class specifies the UMTS 13

PLMNs in the HPLMN or EHPLMN. Note, that if the UMTS bit is not set and 14


each PLMN in all the HPLMN and EHPLMN entries, then no UMTS system 16

will be part of the HOME priority class. 17

If the SYS_TYPE = EUTRAN, the HOME priority class specifies the LTE 18

PLMNs in the HPLMN or EHPLMN. Note, that if the LTE bit is not set and 19


each PLMN in all the HPLMN and EHPLMN entries, then no LTE system will 21

be part of the HOME priority class. 22

A description of the HOME + PREFERRED priority class is given below: 23

If the SYS_TYPE = cdma2000_AI, the Home + Preferred priority class is the 24

set of second most preferred systems plus the most preferred systems in 25

each GEO. 26

If the SYS_TYPE = 3GPP_AI, the Home + Preferred priority class may include 27

the highest priority PLMN present in the OPLMN plus the PLMNs in the 28

HPLMN and EHPLMN. Alternatively, the Home + Preferred priority class may 29

include all of the PLMNs in the OPLMN plus the PLMNs in the HPLMN and 30

EHPLMN. 31

If the SYS_TYPE = cdma2000 1x, the Home + Preferred priority class 32

includes the set of second most preferred 1x systems plus the most 33

preferred systems in each GEO.. 34

If the SYS_TYPE = cdma2000 HRPD, the Home + Preferred priority class 35

includes the set of second most preferred plus the most preferred cdma2000 36

HRPD systems in each GEO. 37

If the SYS_TYPE = GERAN, the Home + Preferred priority class includes the 38

GSM PLMNs in the OPLMN plus the GSM PLMNs in the HPLMN and 39

EHPLMN. 40

If the SYS_TYPE = UTRAN, the Home + Preferred priority class includes the 41

UMTS PLMNs in the OPLMN plus the UMTS PLMNs in the HPLMN and 42

EHPLMN. 43

3GPP2 C.S0016-D v2.0

E-6

If the SYS_TYPE = EUTRAN, the Home + Preferred priority class includes the 1

LTE PLMNs in the OPLMN plus the LTE PLMNs in the HPLMN and EHPLMN. 2

It is recommended that the ANY priority class be applied to any remaining entries not 3

included in other priority classes. 4

5

Examples are given below for PRI_CLASS mappings for cdma2000_AI and 3GPP_AI 6

systems. Note, these examples are informative and other interpretations and 7

implementations are possible. For cdma2000, assume the Preferred Roaming List (PRL) for 8

one GEO consists of the following networks. Note, this GEO is associated with a specific 9

MLPL entry which in turn identifies an MSPL_INDEX. 10

11

Table E.1.2-1 Simplified cdma2000 PRL example for one GEO 12

INDEX SID NID NEG/PREF PRI GEO

0 1 1 PREF MORE NEW

1 3 40 PREF SAME SAME


3 3 15 PREF MORE SAME



13

Based on Table E.1.2-1, the following mappings of PRI_CLASS are recommended: 14

PRI_CLASS = ‘HOME’ maps to INDEX = 0 since the first entry is the highest priority 15

network in the GEO. 16

PRI_CLASS = ‘PREFERRED’ maps to INDEX = 0, 1, 2 and 3 since the next three entries for 17

SID = 3 have equal priorities based on ‘PRI’. The ‘HOME’ network represented by INDEX = 18

0 is also included in ‘PREFERRED’ by definition. 19

PRI_CLASS = ‘ANY’ maps to any cdma2000 networks regardless of whether it is listed in 20

the PRL or not. 21

When 3GPP_AI is used, the PRI_CLASS defined in the MSPL map to entries in the PLMN 22

selector list. The PLMN selector may contain the Home PLMN (HPLMN) or Equivalent 23

HPLMN (EHPLMN), Operator-controlled PLMN (OPLMN) and the Forbidden PLMN. For 24

example, assume an MLPL entry defined by MCC1 points to an MSPL_INDEX matching an 25

entry containing PRI_CLASS entries for HOME, PREFERRED, and ANY associated with 26

3GPP_AI. If the EHPLMN and the OPLMN consist of the following networks in MCC1. 27

3GPP2 C.S0016-D v2.0

E-7

1

Table E.1.2-2 PLMN selector example 2

Entry Type PLMN Entry

EHPLMN PLMN 1

EHPLMN PLMN 2

OPLMN PLMN 3

OPLMN PLMN 4

OPLMN PLMN 5

3

PRI_CLASS = ‘HOME’, maps to PLMN 1 and PLMN 2 since PLMN 1 and PLMN 2 belong to 4

the EHPLMN list. 5

PRI_CLASS = ‘PREFERRED’ maps to PLMNs 1, 2 and 3 since PLMN 3 belongs to the 6

OPLMN. The ‘HOME’ networks represented by PLMNs 1 and 2 are also included in 7

‘PREFERRED’ by definition. These entries are associated with the current region. 8

PRI_CLASS = ‘ANY’ maps to any 3GPP_AI networks regardless of whether it is listed in the 9

PLMN selector or not. In this example, PLMNs 4 and 5 map to PRI_CLASS = ‘ANY’. 10

11

A description of how a mobile station should determine the timing of a search for a higher 12

priority system based on HIGHER_PRI_SRCH_TIME is provided: 13

After an initial system selection or a previous search for a higher priority system a mobile 14

station should search for a higher priority system after a time specified by 15

HIGHER_PRI_SRCH_TIME. 16

If the SYS_TYPE (Table 3.5.13.4-1) used in the MMSS System Priority List 17

(MSPL) describes a family of radio access technologies, i.e. cdma2000_AI or 18

3GPP_AI, the mobile station should search for higher priority systems across 19

different families of radio access technologies after the time period specified 20

by HIGHER_PRI_SRCH_TIME. 21

If the SYS_TYPE (Table 3.5.13.4-1) used in the MSPL is cdma2000 1x, 22

HRPD, WiMAX, GERAN (GSM), UTRAN (UMTS), or EUTRAN (LTE), the 23

following rules apply: 24

1) If the mobile station is on a lower priority 3GPP2 system, i.e. either 25

HRPD or cdma2000 1x, the mobile station should search for higher 26

priority 3GPP, i.e. GERAN, UTRAN and EUTRAN, and WiMAX 27

systems after the time period specified by HIGHER_PRI_SRCH_TIME. 28

A mobile station on a lower priority 3GPP2 system follows 3GPP2 29

specifications when searching for 3GPP2 radio access technologies. 30

3GPP2 C.S0016-D v2.0

E-8

2) If the mobile station is on a lower priority 3GPP system, i.e. GERAN, 1

UTRAN, or EUTRAN, the mobile station should search for higher 2

priority 3GPP2, i.e. cdma2000 1x, cdma2000 HRPD, and WiMAX 3


A mobile station on a lower priority 3GPP system follows 3GPP 5

specifications when searching for 3GPP radio access technologies. 6

3) If the mobile station is on a lower priority WiMAX system, the mobile 7

station should search for higher priority 3GPP, i.e. GERAN, UTRAN, 8

and EUTRAN, and 3GPP2, i.e. cdma2000 1x and cdma2000 HRPD, 9


11

E.1.2.1 MMSS System Priority List (MSPL) Example 12

This section provides an example using generic SYS_TYPES for an MSPL entry that is 13

associated by an MLPL entry that maps to MCC1. In this region, the desired priorities are 14

defined as 15

LTE (MNC1) > HRPD (Subnet 1) > UMTS (MNC2) > HRPD or 1x > GSM 16

17

The MSPL can be constructed in the following fashion: 18

SYS_TYPE PRI_CLASS

PRI

3GPP_AI Home More

cdma2000_AI Home More

3GPP_AI Preferred More

cdma2000AI Any More

3GPP_AI Any More

19

The associated PLMN selector can be constructed as follows 20

Entry Type PLMN Entry Access Technology

EHPLMN MCC1 MNC1 LTE

OPLMN MCC1 MNC2 UMTS

OPLMN MCC1 MNC2 GSM

21

The simplified PRL can be constructed as follows 22

3GPP2 C.S0016-D v2.0

E-9

INDEX SID NID Subnet ID NEG/PREF PRI GEO

0 1 PREF MORE NEW

1 2 PREF MORE SAME


1

E.1.2.2 MMSS System Priority List (MSPL) with Specific System_Types 2

This section describes examples of the MSPL with System Types using specific air-interface 3

technologies. 4

5

Example E.1.2.2-1. For a system prioritization based on the following using air-interface 6

technologies 7

8

LTE > HRPD > UMTS > 1x > GSM, 9

10

the MSPL can be designed as in Table E.1.2.2-1. It is important to note that this list must 11

be designed to be consistent with the corresponding 3GPP and 3GPP2 system priorities. 12

13

Table E.1.2.2-1 MSPL Example E.1.2.2-1 14

SYS_TYPE PRI_CLASS SYS_PRI

0000 0111 (LTE) 0010 (Any) 1 (More)

0000 0100 (HRPD) 0010 (Any) 1 (More)

0000 0110 (UMTS) 0010 (Any) 1 (More)

0000 0011 (1x) 0010 (Any) 1 (More)

0000 0101 (GSM) 0010 (Any) 0 (End)

15

Example E.1.2.2-2. Consider the following multimode system priority list 16

LTE(MCC_1 MNC 1) 17

> HRPD(Subnet_1) 18

> LTE(MCC1, MNC_2 to MNC_3) 19

> HRPD(Subnet_2) 20

> UMTS(MCC_1, MNC_2 to MNC_3) 21

> 1x(SID_1, NID_1) 22

3GPP2 C.S0016-D v2.0

E-10

> GSM(MCC_1, MNC_2 to MNC_3) 1

> cdma2000_AI (Any) 2

> 3GPP_AI(Any). 3

4

This can be realized by designing the MSPL using Table E.1.2.2-2 based on the PRL in 5

Table E.1.2.2-3, the PLMN Selector List in Table E.1.2.2-4 and MLPL Record 1 of the MLPL 6

in Table E.1.2.2-5. MCC 1 is assumed to map to SID 1. 7

8

Table E.1.2.2-2 MSPL Index 1 for Example E.1.2.2-2 9

SYS_TYPE PRI_CLASS SYS_PRI

0000 0111 (LTE) 0000 (Home) 1 (More)

0000 0100 (HRPD) 0000 (Home) 1 (More)

0000 0111 (LTE) 0001 (Home+Preferred) 1 (More)

0000 0100 (HRPD) 0001 (Home+Preferred) 1 (More)

0000 0101 (UMTS) 0001 (Home+Preferred) 1 (More)

0000 0011 (1x) 0001 (Home) 1 (More)

0000 0101 (GSM) 0001 (Home+Preferred) 1 (More)

0000 0000 (cdma2000_AI) 0010 (Any) 1 (More)

0000 0001 (3GPP_AI) 0010 (Any) 0 (End)

10

Table E.1.2.2-3 Simplified cdma2000 PRL for Example E.1.2.2-2 11

INDEX SID NID Subnet ID

NEG/PREF PRI GEO

0 1 PREF MORE NEW

1 2 PREF MORE SAME



12

Table E.1.2.2-4 Simplified PLMN Selector List for Example E.1.2.2-2 13

EHPLMN OPLMN MCC_1, MNC_1 MCC_1, MNC_2 MCC_1, MNC_3

3GPP2 C.S0016-D v2.0

E-11

1

Table E.1.2.2-5 MLPL for Example E.1.2.2-2 2

MLPL Record Index


_TAG 1

SYS_LOC

_TAG 2

SYS_LOC

_TAG 3

MSPL_INDEX

1 1 1

2 1 1 0 (cdma2000)


0 (NID_RANGE)

1

3 0 (cdma2000)


0 (NID_RANGE)

1

3

E.1.2.3 MMSS System Priority List (MSPL) Examples of Higher Priority Search Time 4

This section describes examples of the use of HIGHER_PRI_SRCH_TIME in the MSPL with 5

various values of SYS_TYPE. 6

7

Example E.1.2.3-1. For a system prioritization based on 3GPP_AI i.e. GSM/UMTS/LTE 8

grouped as a single system type, having a higher priority than cdma2000_AI i.e. HRPD/1x 9

grouped as a single system type, the MSPL can be grouped as shown in Table E.1.2.3-1. 10

11

Table E.1.2.3-1 MSPL Example 1 for Higher Priority Search Time 12

SYS_TYPE SYS_PRI HIGHER_PRI_SRCH_TIME

0000 0001 (3GPP_AI) 1 (More) ’111’ (value is ignored)

0000 0000 (cdma2000_AI) 0 (End) ‘100’ (4 minutes)

In this case, if the mobile station is on either an HRPD or a cdma2000 1x system i.e. 13

cdma2000_AI, then the mobile station searches for a 3GPP_AI i.e. GSM, UMTS, or LTE, 14

system every four minutes based on the HIGHER_PRI_SRCH_TIME value in the table. If 15

the mobile station is on a 3GPP_AI system, it is already on the highest priority system, so 16

the value of HIGHER_PRI_SRCH_TIME is not used. 17

18

Example E.1.2.3-2. For a system prioritization based on LTE having a higher priority than 19

HRPD or cdma2000 1x, but with HRPD and cdma2000 1x having the same priority, the 20

MSPL can be grouped as shown in Table E.1.2.3-2. 21

22

3GPP2 C.S0016-D v2.0

E-12



0000 0111 (LTE) 1 (More) ’111’ (value is ignored)

0000 0100 (HRPD) 0 (Same) ‘011’ (8 minutes)

0000 0011 (cdma2000 1x) 0 (End) ‘100’ (4 minutes)

In this case, if the mobile station is on a cdma2000 1x system, then the mobile station 2

searches for an LTE system every four minutes based on the HIGHER_PRI_SRCH_TIME 3

value in the table. If the mobile station is on an HRPD system, then the mobile station 4

searches for an LTE system every eight minutes based on the HIGHER_PRI_SRCH_TIME 5

value in the table. If the mobile station is on a LTE system, it is already on the highest 6

priority system, so the value of HIGHER_PRI_SRCH_TIME is not used. 7

8

Example E.1.2.3-3. For a system prioritization based on the following using air-interface 9

technologies 10

LTE > HRPD > UMTS > 1x > GSM, 11

the MSPL can be designed as in Table E.1.2.3-3. 12

13



0000 0111 (LTE) 1 (More) ’111’ (value is ignored)

0000 0100 (HRPD) 1 (More) ‘100’ (16 minutes)

0000 0110 (UMTS) 1 (More) ‘011’ (8 minutes)

0000 0011 (1x) 1 (More) ‘010’ (4 minutes)

0000 0101 (GSM) 0 (End) ‘001’ (2 minutes)

15

In this case, if the mobile station is on a cdma2000 1x system, then the mobile station 16

searches for an LTE or UMTS system every four minutes based on the 17

HIGHER_PRI_SRCH_TIME value in the table. If the mobile station is on an HRPD system, 18

then the mobile station searches for an LTE system every 16 minutes based on the 19

HIGHER_PRI_SRCH_TIME value in the table. 20

If the mobile station is on a LTE system, it is already on the highest priority system, so the 21

value of HIGHER_PRI_SRCH_TIME is not used. If the mobile station is on a GSM system, 22

then the mobile station searches for a cdma2000 1x or HRPD system every two minutes. If 23

the mobile station is on a UMTS system, then the mobile station searches for a HRPD 24

system every eight minutes. If the mobile station is on a LTE system, it is already on the 25

highest priority system, so the value of HIGHER_PRI_SRCH_TIME is not used. 26

Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Standards

Documents

Transcript of Over-the-Air Service Provisioning of Mobile Stations in Spread Spectrum Standards