04 Mobility Management in NSN SGSN SG7 CN3122EN70GLN00

SGSN Release 7 OM
Mobility Management in NSN SGSN
For public use IPR applies

1
Nokia Siemens Networks
Mobility Management / TAd / 15.10.2008

Academy
Legal notice
Intellectual Property Rights
All copyrights and intellectual property rights for Nokia Siemens Networks training
documentation, product documentation and slide presentation material, all of which are forthwith
known as Nokia Siemens Networks training material, are the exclusive property of Nokia
Siemens Networks. Nokia Siemens Networks owns the rights to copying, modification,
translation, adaptation or derivatives including any improvements or developments. Nokia
Siemens Networks has the sole right to copy, distribute, amend, modify, develop, license,
sublicense, sell, transfer and assign the Nokia Siemens Networks training material. Individuals
can use the Nokia Siemens Networks training material for their own personal self-development
only, those same individuals cannot subsequently pass on that same Intellectual Property to
others without the prior written agreement of Nokia Siemens Networks. The Nokia Siemens
Networks training material cannot be used outside of an agreed Nokia Siemens Networks
training session for development of groups without the prior written agreement of Nokia
Siemens Networks.
Document change history

Date
Version
15.10.08
0.1
Name
Change comment
Tanti Adriyani
Initial Draft
Objectives
After completing this module, the participant can:
Describe the Mobility Management states
Describe signalling procedures related to Mobility
Management
Explain the 2G-3G interworking inside SGSN
Mobility Management messages

The procedures of Mobility Management are:
GPRS Attach/ GPRS Detach
Purge
Security
Authentication
subscriber identity confidentiality
Ciphering (2G only)
Identity check.
Location management
3G-specific procedures:
Radio Access Bearer (RAB) management
SRNS Relocation (3G only)
Service Request (3G only)
Security mode control (3G only)
PS Paging
Normal/periodic routing area update.
Subscriber Management
Interaction with MSC/VLR (2G only)
IMSI attach/detach, combined IMSI/GPRS attach/detach

Combined routing area and location area update
CS paging
Non-GPRS alert
Identification procedure
MM information.
GERAN MM states in NSN SGSN

IDLE
Implicit detach or
cancel location
GPRS Attach
GPRS Detach
OR
Cancel Location
READY
READY timer expiry
OR
Force to standby
OR
Abnormal RLC
condition
STANDBY
6
PDU reception
UTRAN MM states in NSN SGSN

MM states in a UE
MM states in SGSN
PMMDETACHED
PMMDETACHED
Detach
Detach,
RAU reject
GPRS attach
Detach
PMMCONNECTED
Iu connection established
Detach,
RAU reject
Iu connection
release
Iu connection released
PMM- IDLE
GPRS attach
(RAU request)
PMM- IDLE
PMMCONNECTED
Packet rcvddownlink
Serving RNC
relocation
Attach
3G
MSC
Node
B
3G
HLR
RNC
IP
SS
7
SGSN
SGSN
DNS
Gn
BSC
RNC
SGSN
SGSN
BTS
Routing Area Update

3G
HLR
3G
SGSN
1
RA1
Gb/Iu
RA2
SS7
3G
IP
SGSN
2
DNS
GGSN
2G 3G Interworking
10
GPRS DETACH
The MS is detached from GPRS either explicitly or implicitly:
Explicit detach:
detach The network or the MS explicitly requests
detach specifying the cause for it
Implicit detach:
detach The network detaches the MS after the mobile
reachable timer expired or after an irrecoverable radio error
causes disconnection of the logical link
After a successful detach:
MM context and PDP context in PAPU are removed;
P-TMSI - IMSI association is not removed from PAPU;
The Visiting GPRS subscriber data may be deleted from SMMU;
otherwise the data from SMMU is removed when "Detached
subscriber storage time" timer expires. Also the IMSI-P-TMSI
association from PAPU is removed and a "Purge" message is sent to
HLR.
11
MS/UE-initiated detach
3G
SGSN
1
Gb/Iu
12
GGSN
IP
Network-Initiated Detach
SGSN-Initiated Detach procedure: The PAPU starts the detach
procedure every time an error occurred in the network.
Network-Initiated Detach procedures: HLR uses this procedure for
operator-determined purposes to request the removal of a
subscribers MM and PDP contexts at the SGSN.
When the network initiates a GPRS detach procedure for a
subscriber, the following happens:
MM aborts any data transfer for the subscriber
MM asks Session Management to deactivate the subscriber's PDP
contexts
MM informs the MS of a network-requested GPRS detach
MM informs the HLR that the subscriber is detached from the
GPRS network
13
Serving RNS relocation (before)-1

HLR
D
TE
C
E
NN
O
-C
MM
GGSN
SGSN1
MSC2
MSC1
RNC2
RNC1
LA2, RA2
LA1, RA1
UE
14
SGSN2
Serving RNS relocation (after)-2
HLR
MM-I
DLE
GGSN
SGSN1
MSC2
MSC1
RNC2
RNC1
LA2, RA2
LA1, RA1
UE
15
SGSN2
Service request
Service request is a term
for different MM and SM
operations, like:
establishment of data
connection
3G
MSC
Node
B
establishment of
signalling connection
paging towards the UE
3G
HLR
RNC
IP
SS
7
SGSN
SGSN
DNS
Gn
Service request can be:

UE-initiated
NW-initiated
16
GGSN
Security mode command

For using Security Mode Command, authentication vectors need to
be obtained from the Authentication Centre (AUC) if there is no
unused vectors in the SGSN.
The security mode command is used to deliver information about

used authentication and ciphering related parameters from the
SGSN to the RNC
3G
SGSN
1
Iu
17
3G
HLR
SS7
Purge function
The Purge function allows an SGSN (SMMU) to inform the HLR that it
has deleted the subscriber information of a detached MS stored in
Visiting GPRS subscriber database.
3G
HLR
SS7
SGSN
SGSN
18
Authentication
MS/UE
RAN
PAPU
SMMU
HLR/AuC
IMSI
1. DX200.Send Authentication Info
IMSI
1 a. MAP.Send Authentication Info

1 b. MAP.Send Authent. Info Ack
RAND, CKSN,
Ciphering Algorithm
1. DX200.Send Authentication Info
2. GMM.Authentication Request
SRES/XRES
2. GMM.Authentication Response
19
Authentication
vectors
Authentication
vectors
Authentication Vector Generation in AUC

Generate SQN
Generate RAND
SQN
RAND
AMF
Aut Mgmt Field
f1
f2
f3
f4
f5
Message
Authentication
Code (MAC)
Expected
Response
(XRES)
Cipher Key
(CK)
Integrity Key
(IK)
Anonimity Key
(AK)
The actual quintet is a concatenation of:

RAND, XRES, CK, IK, and AUTN
Where AUTN=SQN AK || AMF || MAC
20
Authentication Vector Generation and Check in USIM
from VLR/SGSN
AUTN from VLR/SGSN
MAC || AMF || SQN AK

Anonymity Key
(AK)
RAND
F5
K in USIM
SQ
N
=?
F1
f2
f3
f4
Message
Authentication
Code (XMAC)
Expected
Response
(XRES)
Cipher Key
(CK)
Integrity Key
(IK)
comparison
authentication token AUTN=SQN AK || AMF || MAC

21
UMTS Authentication
Enhanced support for GSM-UMTS
roaming
Better security for UMTS
subscribers
Optimized signaling load
Better roaming agreements
Mutual authentication method is used

to authenticate UMTS subscribers
The SGSN can receive quintuplets
from the HLR or from a 3G SGSN
and convert them into triplets when
needed
Authentication failures are reported
to the HPLMN
As specified in 3GPP TS 33.102
Release 99+
HLR/AuC
Quintets
CK, IKKc
CK, IKKc RES SRES
[Kc]
UTRAN
RAND
AUTN
RES
RAND
AUTN
RES
R99+ ME
CK, IK
Kc
[Kc]
Release 98VLR/SGSN
[Kc]
GSM BSS
CK, IK
Kc
RAND
SRES
RAND
SRES
R98- ME
R99+ ME
or
R98- ME
Kc
Kc
CK, IKKc CK, IKKc CK, IKKc CK, IKKc

RES SRES RES SRES
USIM
UMTS security context
22
Triplets
Release 99+ VLR/SGSN
CK
IK
CK, IK Kc
RES SRES
GSM security context
Identity Check
MS/UE
RAN
1. GMM.Identity Request
PAPU
SMMU
EIR
Identity
Type=IMEI
IMEI
IMEI
1. GMM.Identity Response
2. DX200.Check IMEI
IMEI
2. MAP. IMEI Check

Equipment
status
Equipment
status
2. MAP.IMEI Check Ack
2. DX200.IMEI Check
23
Update Location Procedure to HLR

new SMMU
old SMMU
HLR
1. MAP. Update GPRS Location

2. MAP. Cancel Location
2. MAP. Cancel Location Ack
3. MAP. Insert subscriber
3. MAP. Insert subscriber
4. MAP. Update GPRS Location Ack
24
Appendix
Mobility Management Features

25
Appendix
Interaction to MSC/VLR

26
Interaction to MSC/VLR
The interaction between SGSN and MSC/VLR is
realised by supporting a standard "Gs interface" in
MSC/VLR.
3G
MSC
A
BSC
RNC
VLR
SS
7
Gs
BTS
Gb
SGSN
SGSN
GPRS MS
Class A,B
27
SGSN - VLR Association

The basis for the interworking between a VLR and an SGSN is the
existence of an association between those entities per MS.
An association consists of SGSN storing the number of the VLR
serving the MS for circuit switched services and the VLR storing
the number of the SGSN serving the MS for packet switched
services.
MSC/VLR 1
Ms 1: SGSN 1
RA1
MS 1
SGSN 1
Ms 1: VLR 1
Ms 2: VLR 2
MS 2
28
MSC/VLR 2
RA2
Ms 2: SGSN 1
BSSAP+ procedures
29
Paging for non-GPRS services

Location update
Non-GPRS alert procedure
MS information procedure
IMSI detach from GPRS services
IMSI detach from non-GPRS services
Paging for non-GPRS service

MS
BSS
PAPU
IMSI, DRX parameter,

TLLI, VLR TMSI, Area,
Channel Needed, QoS
SMMU
1. BSSAP+.Paging Request
2. DX200.Paging Request
VLR TMSI or IMSI

Channel needed
MSC/VLR
IMSI, VLR number, TMSI,

Location area identifier,
Channel Needed, Priority
2. BSSGP.Paging CS
3. Paging CS
4. SABM (Paging Response)
5. SCCP Connection Request (Paging Response)
30
NSN SGSN Multipoint A (1/2)

SGSN can support the usage of multiple MSCs / MSSs within a
pool area, which enlarges the served area compared to the
service area of one MSC/MSS.
Reduces inter-MSC/MSS location updates and handovers,
handovers and
also reduces the HLR update traffic.
If a CS paging is received through the Gs interface from the
MSC with mobile identity type IMSI, the SGSN includes the
MSC/VLR identifier in the paging request message sent to the
BSC (CN ID).
31
NSN SGSN Multipoint A (2/2)

MSC selection in combined GPRS/IMSI attach
In the case of a combined GPRS/IMSI attach,
attach the SGSN sends a
location update request message to the MSC/VLR stored in
subscriber information.
This selection mechanism enables the MSs to avoid the random
change of the MSC/VLR by using combined procedures when a
SGSN changes
This way, the new SGSN selects the same MSC/VLR which was
selected by the old SGSN
In case it is not possible to determine a MSC/VLR based on
subscriber information, then SGSN selects a MSC/VLR based on a
IMSI hash function from the available MSC/VLRs which serve the
current location area of the Mobile Station (MS).
32
Appendix
Equivalent PLMN

33
Equivalent PLMN (1/2)

The HPLMN is treated in a special way by the MS during
PLMN selection. The HPLMN has highest priority and if the MS
is in a VPLMN of its home country, the MS will search
periodically for the HPLMN code
Equivalent PLMN enables MS to treat selected PLMNs with
different PLMN codes as equivalent to each other at PLMN
selection, cell (re)selection and handover
List of equivalent PLMNs sent to the MS during every attach
and RAU procedure
34
Equivalent PLMN (2/2)

There are several scenarios where equivalent PLMN is needed:
The same operator may have both GSM and UMTS radio
networks but for regulatory reasons, the two radio systems may
have to broadcast different PLMN codes
The same operator may have UMTS and/or GSM networks in

several countries -> MSs should treat all of them as belonging
to home network
With the high spectrum and/or infrastructure costs for UMTS,

operators may want to share the costly radio access
infrastructure for UMTS
35
Appendix
HLR-based 2G/3G access control

36
HLR-based 2G/3G access control (1/2)

Allows operator to specify 2G and 3G access independently for
each subscriber
Allow 3G access for subscribers that do not have a USIM
Information is passed in new parameter within the
InsertSubscriberData Response MAP message from the HLR
during location update
Similar functionality has been possible with controlled roaming,
but the granularity was based on IMSI prefixes instead of
individual subscribers
3GPP Release 6 functionality
Requires a licence
2G Allowed
BTS
BS
37
GSM
Access
HLR
SGSN
SS7
Network
WCDMA
Access
3G Allowed
HLR-based 2G/3G access control (2/2)

Functionalities:
HLR Access Restriction Data parameter
SGSN local PLMN specific access restriction
GSM/EDGE Radio Access Network (GERAN) / UMTS Terrestrial
Radio Access Network (UTRAN) subscriber count
SGSN can be configured to send different cause codes in case of
service denial
Code
MML
parameter
11
PLMN
12
LA
13
ROAM
Roaming not allowed in this LA
14
GPRS
GPRS services not allowed in this PLMN
15
CELL
No suitable cells in LA
NO
38
Cause
PLMN not allowed
Location Area not allowed
Not used
Appendix
Controlled Roaming

39
Controlled Roaming - Example of Application

Operator A has network coverage in city and in countryside
Operator B has network coverage in city
Operator A can restrict B's subscribers roaming in city A's coverage
but allow them roaming in countryside
Subscriber from
operator B
Allowed
Not
Allowed
Operator A (City)
40
Operator A
(Countryside)
Appendix
MultiSIM

41
MultiSIM
This feature allows one subscriber to have several mobile
stations simultaneously, each with its own SIM card, under the
same Mobile Subscriber International ISDN Number (MSISDN)
The MultiSIM service may involve a maximum of 5 mobile

stations (5 SIMs).
Several applications are possible with this feature

This feature has no effect on charging. As common charging is
not implemented, the subscriber receives a bill for every mobile
station in the ringing group (15).
42
Appendix
SMS over GPRS

43
SGSN SMS feature

SMS Feature in SGSN provides a mechanism for sending and
receiving a short message from and to the MS.
SMS feature in SGSN handles the following procedures:
Mobile Originated SMS (MO SMS): MS submits a short message;
Mobile Terminated SMS (MT SMS): SMSC delivers a short message
to an MS;
Alert SC: SMSCs involved are informed via HLR that an MS is ready
to receive short messages in the following two cases:
The MS has indicated activity after being unreachable,or
The MS indicates that it again has memory available for receiving short
messages after it has rejected a short message because of lack of
memory.
The operator can also disable all SMSs over GPRS with MML
command
44
Successful MO-SMS Transfer

MS
RAN
PAPU
SMMU
HLR
IW-MSC
SMSC
1. Message transfer
2 Authentication
3. IMEI checking
4 .DX200. Forward short message
4 .MT Forward short message
5. Message Transfer
5. Delivery Report
6 .Forward short message result
6 . DX200.Forward short message result
7. Delivery Report
45
Successful MT-SMS Transfer

MS
RAN
PAPU
SMMU
HLR
G-MSC
SMSC
1. Message Transfer
2. Send routing info for SM
2. Send routing info for SM Result
3 .MT Forward short message
3 .Forward short message
4 Authentication
5. IMEI checking
6. Message transfer
8. Delivery Report
46
SMS Routing Analysis

Operator can control SMS traffic more effectively
SMSIWMSC 1 SMSC for normal short messages
Analysis for:
Result = normal MO-SMS
PID
(Protocol
Identifier)
Short Message
SMSIWMSC 2
Prefix
SMSC for ringing tones
Result = Ringing Tone
SGSN
SMSIWMSC 3
Result = Fax
47
SMSC for fax
SMS barring
A-number prevention
barring is based on the
MSISDN of the subscriber.
When using number
portability,
portability it may not be
possible to bar all
subscribers from a certain
country or PLMN. This can
also lead to a situation
where also unwanted
subscribers are barred
when barring is based on
the CC or NDC prefix.
48
Barring
MO SMS
A-number
prevention
SMSC denial
analysis
MT SMS
SMSC denial
analysis
Appendix
Multi Operator Core Network (MOCN)

49
Network selection by a supporting UE in a MOCN
50
Successful Attach
51
Attach Redirecting/ Reject
52
CS/PS Coordination
53

04 Mobility Management in NSN SGSN SG7 CN3122EN70GLN00

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

04 Mobility Management in NSN SGSN SG7 CN3122EN70GLN00

Caricato da

Copyright:

Formati disponibili

SGSN Release 7 OM

Mobility Management in NSN SGSN

For public use IPR applies

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Document change history

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Mobility Management messages

GPRS Attach/ GPRS Detach

Interaction with MSC/VLR (2G only)

IMSI attach/detach, combined IMSI/GPRS attach/detach

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

GERAN MM states in NSN SGSN

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

UTRAN MM states in NSN SGSN

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Routing Area Update

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Serving RNS relocation (before)-1

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Serving RNS relocation (after)-2

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Service request can be:

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Security mode command

The security mode command is used to deliver information about

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

1. DX200.Send Authentication Info

1 a. MAP.Send Authentication Info

1. DX200.Send Authentication Info

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Authentication Vector Generation in AUC

The actual quintet is a concatenation of:

Nokia Siemens Networks

Mobility Management / TAd / 15.10.2008

Authentication Vector Generation and Check in USIM

AUTN from VLR/SGSN