MSC Innovation Configuration

SN B

LTG

LTG

SSNC

MB D

CPAMPC IOP:MB

Trunks and

SS7 Links

High Speed

SS7 Links

207Mb/s

PCM30/24

NetM

207Mb/s

SSNC: Signaling SystemNetworkControl

LTG: Line TrunkGroup

SN: SwitchingNetwork

MB: MessageBuffer Typ D

IOP: Input/OutputProcessor

AMP: ATM BridgeProcessor

CP: CoordinationProcessor

NetM: Net Manager

MSC structure

SNDLU LTG

LTG

Access

SSNC

SignalingSystem

Network

Control

SYP

Switching

Coordination

MB

CCG

CP

Switching

Exchange

4

Switching

Exchange

5

Switching

Exchange

2

Switching

Exchange

1

Switching

Exchange

3

Some terms of the Circuit Switched Exchange Telephony

Transit

Exchange

Originating

Exchange Terminating

Exchange

Incoming

Traffic

Transit Call and

Outgoing Traffic

Originating

Call

Lines Trunks

Busy

Idle

Calling Party

(A Subscriber)

Called Party

(B Subscriber)Note: The network shown here is only an example.

Routing

Routing in general is the method, how to find a way through a network

for a given Routing Information.

Whithin a Switch, Routing is to find an outgoing trunk, according to the

evaluation results of the Routing Information

Some typical elements of the Routing Information whithin a Switch:

Called Party Number (= dialed number, the most classical element)

Originating Trunk (where the call comes from, see Origin. Depend.

Routing)

Category of the Calling Subscriber (Ordinary, Priority, Operator,..)

Calling Party Number

Transmission Medium Required (Any, Only Digital, Analog,..)

….

During the evaluation of the of the Routing Information, one, some or

all elements can be considered.

Authentication and Ciphering

Authentication and ciphering execution

In the personalization center (PCS), the SIM cards are produced on the one hand and the

database for the subscriber are generated in the authentication center on the other.

The following parameters are necessary on the SIM card along with the IMSI for

authentication and ciphering:

Ki General key

A3 Algorithm 3. Used for generating the authentication code

A8 Algorithm 8. Used for generating the ciphering key

The following parameters are necessary in the database commands along with theIMSI for

authentication and ciphering:

KiA4 General key, however enciphered with algorithm A4 and additional key K4

A3 version Version of the algorithm 3 stored in the AC and to be used.

A8 Version Version of the algorithm 8 stored in the AC and to be used.

The KiA4 is deciphered in the AC with the help of algorithm A4 and key K4 (Ki=A4(K4,KiA4))

and is stored, enciphered again (KiA2=A2(K2,Ki)), in the subscriber database as KiA2 with

A2 and K2.

As soon as the subscriber is set up in the HLR, the AC begins with the generation of the

security parameters. These consist of three values: the rand (a random value), the Sres or

signed response (electronic signature for authentication) and the kc (key for the ciphering on

the radio interface). These three values are designated "triples". A reserve of 6 "triples" are

provisioned.

Authentication and ciphering execution (part2)

Authentication• The Rand is relayed to the mobile station. This generates the Sres with

the help of the parameter Ki stored on the SIM card and A3 (Sres=A3(ki ,rand)). The Sres is sent back to the MSC/VLR and there compared with the Sres of the triple. If both Sres are the same, the authentication is successful. If they are different, the SIM card is rejected, and only emergency calls are possible depending on theproject.

Ciphering• For the ciphering, the Rand is also used in the MS. The key Kc is

generated (Kc=A8(Ki, Rand)) with the help of the parameter Ki stored on the SIM card and A8. The ciphering is thereupon carried out with the algorithm 5 stored in the mobile equipment and the key Kc. The key Kccontained in the triple is meanwhile relayed to the BSS. The algorithm A5 is also available here, so that the ciphering can be carried out here as well.

Location Registration

Since subscribers can change their locations in the PLMN any number of times, it is absolutely necessary to log the current site to a central position for the availability of the subscriber. This central position is the HLR of the respective subscriber. Therefore the routing label of the visited MSC/VLR is entered there.

Location update is carried out for the following situations:

• When first checking into a network.

– The subscriber checks into a network for the first time.

• Upon change of location.

– The subscriber changes to another MSC area.

• Periodical location update (only in the VLR)

– A time provider in the mobile station runs out and a location update is carried out in the VLR.

• After failure of the HLR

– After a HLR failure, all affected VLRs are informed of the possible data loss. After subsequent originating traffic (mobile originating call), for instance, a location update is carried out in the HLR.

MS BS/MSC/VLR

old LAI & old TMSI

Acknowledgement

ciphered(new TMSI)

Allocate

new TMSI

Location up-date

• While staying in the old MSC area, the identification code of the location area (LAI location area ID) is noted on the SIM card (subscriber identity Module)• If the subscriber now moves to a new MSC area and thus also to a new location area, the mobile subscriber receives a new LAI from the MSC/VLR.• Since the new LAI is different from the old LAI, the mobile subscriber sends both LAIs back to the MSC.• If the new MSC knows the old LAI or the corresponding old MSC/VLR, it requests from there the security parameters not used (triples) and the subscriber identification IMSI (international mobile subscriber identity).• Hereupon the new location area is transmitted to the HLR from the new VLR/MSC.• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deletedin the VLR.

MSold LAI & old TMSI

Acknowledgement

ciphered(new TMSI)

Allocate

new TMSI

old TMSI

unknown

IMSI

ID request

BS/MSC/VLR

Location up-date –TMSI unknown

Location Update with Location Change to anUnknown MSC/VLR

• While staying in the old MSC area, the identification code of the location area

• (LAI location area ID) is noted on the SIM card (subscriber identity Module)

• If the subscriber now moves to a new MSC area and thus also to a new location

• area, the mobile subscriber receives a new LAI from the MSC/VLR.

• Since the new LAI is different from the old LAI, the mobile subscriber sends both

• LAIs back to the MSC.

• Since in this case the old MSC/VLR is unknown in the new MSC/VLR, the MSC/

• VLR requests the subscriber identification number (IMSI international subscriber

• identity) from the mobile subscriber and transmits the new location to the HLR.

• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted

• in the VLR.

Mobile Originated Call (MOC) in D900

Visited

MSC

Transit

switch

Transit

switch

Terminating

exchange

MOC

Outgoing Traffic

Transit Call

Outgoing Traffic

Transit Call

Outgoing Traffic

Terminating Call

Terminating Traffic

A-sideMobile Station

Signalling

e g by ISUP, TUP, MFCR2

BSC

BTS

VLR

A-interfaceBSSAP

based on SCCP

Air interface

B-sideterminal

equipment

Bnumber

Bnumber

Bnumber

Bnumber

•The dialing information is received via BSSAP in the MSC.

•An audit of possible subscriber restrictions takes place in the MSC/VLR.

•The dialing information is converted in the MSC and via the routing a route into

the PSTN is determined.

MOC macro

Message 1 MSC <- BSS CR(Complete L3 info(CM service request))

Message 2 MSC -> BSS CC(Authentication Request)

Message 3 MSC <- BSS DT1(Authentication Response)

Message 4 MSC -> BSS DT1(Cipher Mode Command)

Message 5 MSC <- BSS DT1(Cipher Mode Complete)

Message 6 MSC -> BSS DT1(ID Request (IMEI))

Message 7 MSC <- BSS DT1(Setup)

Message 8 MSC -> BSS DT1(Call Proceeding)

Message 9 MSC -> BSS DT1(Assignment Request)

Message 10 MSC <- BSS DT1(ID Response (IMEI))

Message 11 MSC <- BSS DT1(Assignment Complete)

Message 12 MSC -> BSS DT1(TMSI Reallocation Command)

Message 13 MSC <- BSS DT1(TMSI Reallocation Complete)

Message 14 PSTN <- MSC IAM

Message 15 PSTN -> MSC ACM

Message 16 MSC -> BSS DT1(Alerting)

Message 17 PSTN -> MSC ANM

Message 18 MSC -> BSS DT1(Connect)

Message 19 MSC <- BSS DT1(Connect Acknowledge

Mobile Originated Call (MOC) in D900 with MNP (QoD – query on digits)

Visited

MSC

Transit

switch

Transit

switch

Terminating

exchange

MOC

Outgoing Traffic

Transit Call

Outgoing Traffic

Transit Call

Outgoing Traffic

Terminating Call

Terminating Traffic

A-sideMobile Station

Signalling

e g by ISUP, TUP, MFCR2

BSC

BTS

VLR

A-interfaceBSSAP

based on SCCP

Air interface

B-sideterminal

equipment

Bnumber

Bnumber

Bnumber

Bnumber

•The dialing information is received via BSSAP in the MSC.

•An audit of possible subscriber restrictions takes place in the MSC/VLR.

•Based on the dialled digits, MNP query is started; MNP server is triggered

•The information from MNP server is converted in the MSC and via the routing a

route into the PSTN is determined.

MNP server

Mobile Terminating Call e.g. from PSTN

• The dialing information is received by PSTN e.g. via ISUP in the PLMN gateway MSC

• The dialing information is converted in the gateway MSC.• A so-called "interrogation" is started as a response; i.e. a MAP message

is sent to the HLR in order to obtain location-specific routing information. The HLR knows the location routing label i.e. the MSC/VLR by the"location update" and relays the query there.

• The MSC/VLR makes a temporary directory number available and sends it back via the HLR to the gateway MSC.

• The gateway MSC converts this temporary directory number and sets up a circuit connection (ISUP) to the visited MSC. The location area is specified in the MSC/VLR owing to the cross-connection between temporary directory number and mobile subscriber.

• The visited MSC now sends a "paging" to all BSCs situated in the location area.

• The BSC in which the subscriber is currently situated answers with a "paging response".

• The MSC makes the connection to the called subscriber.

Mobile Terminating Call

VLR

Transit

switch

Transit

switchlocal

exchange

Mobile

Terminating

Traffic

Transit Call

Outgoing

Traffic

Outgoing

Traffic

Originating Call

Outgoing Traffic

B-sideMobile Station

Signalling

e g by ISUP (TUP, MFCR2)

BSC

BTS

Visited

MSC

A-interfaceBSSAP

based on SCCP

Air interface

A-sideterminal

equipment

Gateway

MSC

Interrogation

HLR

MSRN MSRNMSISDN

MSISDN

MAP signalling

based on SCCP and TCAP

MSRN MSRN

SendRoutingInfo

ProvideRoamingNr

MSRN

MTC macro

Message 1 PSTN -> MSC IAM

Message 2 MSC -> BSS UDT(paging)

Message 3 MSC <- BSS CR(ComL3Inf (Paging response)

Message 4 MSC -> BSS CC(Authentication Request)

Message 5 MSC <- BSS DT1(Authentication Response)

Message 6 MSC -> BSS DT1(Cipher Mode Command)

Message 7 MSC <- BSS DT1(Cipher Mode Complete)

Message 8 MSC -> BSS DT1(ID Request)

Message 9 MSC -> BSS DT1(Setup)

Message 10 MSC <- BSS DT1(ID Response)

Message 11 MSC -> BSS DT1(TMSI Reallocation Command)

Message 12 MSC <- BSS DT1(Call Confirmed)

Message 13 MSC -> BSS DT1(Assignment Request)

Message 14 MSC <- BSS DT1(Assignment Complete)

Message 15 MSC <- BSS DT1(TMSI Reallocation Complete)

Message 16 MSC <- BSS DT1(Alerting)

Message 17 PSTN <- MSC ACM

Message 18 MSC <- BSS DT1(Connect)

Message 19 MSC -> BSS DT1(Connect Acknowledge)

Message 20 PSTN <- MSC ANM

Mobile Terminating Call with MNP (QoHLR – query on HLR)

Transit

switchTransit

switchlocal

exchange Transit Call

Outgoing

Traffic

Outgoing

Traffic

Originating Call

Outgoing Traffic

Signalling

e g by ISUP (TUP, MFCR2)

A-sideterminal

equipment

Gateway

MSC

Interrogation

HLR

MSISDNMSISDN

MAP signalling

based on SCCP and TCAP

Unknown subscriber

SendRoutingInfo

Transit

switch

Call Forwarding Unconditional

Transit

switch

Transit

switchlocal

exchange Transit Call

Outgoing

Traffic

Transit Call

Outgoing Traffic

Originating Call

Outgoing Traffic

Signalling

e g by ISUP (TUP, MFCR2)

terminating

exchange

A-sideterminal

equipment

Gateway

MSC

Transit Call

Interrogation

HLR

FTNO FTNOMSISDN

MSISDN

MAP signalling

based on SCCP and TCAP

FTNOSendRoutingInfo

C-sideterminal

equipment

Terminating Call

Terminating Traffic

B side (mobile) to

C side

Mobile to Mobile Call (Mobile Subscribers indifferent MSC/VLRs)

• The dialing information is received via BSSAP in the MSC

• An audit of possible subscriber restrictions takes place in the MSC/VLR

• The dialing information is converted in the visited MSC of the calling subscriber.

• A so-called "interrogation" is started as a response; i.e. a message is sent to the HLR in order to obtain location-specific routing information. The HLR knows the location routing label i.e. the MSC/VLR by the"location update" and relays the query there.

• The MSC/VLR makes a temporary directory number available and sends it back via the HLR to the MSC of the calling subscriber.

• The MSC of the calling subscriber converts this temporary directory number and sets up a circuit connection (ISUP) to the visited MSC. The location area is specified in the MSC/VLR owing to the cross-connection between temporary directory number and mobile subscriber.

• The visited MSC now sends a "paging" to all BSCs situated in the location area. The BSC in which the subscriber is currently situated answers with a "paging response".

• The MSC makes the connection to the called subscriber.

MIC LOOP: (Mobile Internal Call Loop)

CP

CP

BSSAP - LTG

BSSAP - LTG

MS

MS

LOOP - LTG

MOC

MTC

MIC-Code would be

neccesary

The ORIG1 Story

When we need to perform different actions in differnet callsetup-states with the

same digits, then we use the ORIG1 parameter in command CR CPT

The ORIG1 can be imagined as an additional digit suffix. It is copied into the CPB

and is together with the digits an additional input for the digittranslator.

There are two kinds, how an ORIG1 can be assigned to a call (and copied to the

CPB):

a) assignment via incoming trunk group

b) assignment within specific callsetup

An incoming trunkgroup can be forced to assign an ORIG1 by the ORIG1

parameter in CR TGRP. (see Origination Dependent Routing in the EWSD).

This method is used in D900 MIC/PBX-loop treatment to distinguish between

BSSAP, Trunk or PBX call origination

In specific cases during call setup, the assignement occurs with a procedural

access to preadministered ORIG1 values for MSRN, CF, IN Loop, NP,...

(see MML command ENTRMPRDDAT)

Quiz• Q1: Does the HLR know the respective location of the subscriber?

• Q2: Does the AC generate the mobile station roaming number?

• Q3: Does the MSC serve to through connect the call from the BSC to other MSCs?

• Q4: Which number serves to identify the subscriber and is stored onthe SIM card?

• Q5: With which number can the subscriber be internationally dialed?

• Q6: Which number is transmitted to the equipment identification register for auditing?

• Q7: Which number is used instead of the IMSI in order to avoid unnecessary interchange of the IMSI via the radio interface?

• Q8: Which three components does a so-called triple comprise?

• Q9: Which parameter of the triple compares the MSC/VLR for the authentication test?

• Q10: Did you find this course interesting/usefull?

Answers

• A1: Yes

• A2: No

• A3: Yes

• A4: IMSI

• A5: MSISDN

• A6: IMEI

• A7: TMSI

• A8: Sres, rand, kc

• A9: Sres

• A10: Of course