CALL & MOBILITY MANAGEMENT

Call And Mobility Management

• RF channel overview & Modes of Mobile Station.

• MS Initialization ( Network Attachment )

• Mobility Management and MM Procedures

• Authentication & Location Updating Procedure

• Connection Management (CM)

• Call Processing – MO & MT Calls

 Modes Mobile Station ( MS )
• MS Switched Off - can not receive incoming paging messages.
- can not make outgoing call.
- No dedicated channel is associated with it.
• MS Switched On - can receive incoming paging messages.
And in Idle Mode - can make outgoing call.
- No dedicated channel is associated with it.
• MS in Dedicated Mode -MS is in conversation and a
dedicated traffic channel TCH is
associated with it.
 RF Channels Overview
• Broadcast Control Channels - BCCH
P-MP FCCH
SCH
• Common Control Channels PCH
P-P RACH
AGCH

• Dedicated Control Channels - SDCCH

P-P FACCH
SACCH
3 CC SMS SS 142 3 8.25
T CM Fixed Bits T GP

FCCH Burst

3 CC SMS
57 SS 1 26 1 57 3 8.25
T S Encrypted GP
CM
Encrypted Training S T

Normal Burst
 Possible Channel Combinations On RT in One Cell

Timeslots

0 1 2 3 4 5 6 7

RT 0 BCCH SDCCH CCCH TCH CCCH TCH CCCH TCH

RT 1 TCH TCH TCH TCH TCH TCH TCH TCH

RT 2 SDCCH TCH TCH TCH TCH TCH TCH TCH

CC TCH
RT 3
SMS SS
TCH TCH TCH TCH TCH TCH TCH
CM
 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 . . . 49 50

FS F S I
Down-link C C BCCH CCCH C C BCCH D
CH C H L
H H E

RR R
Up-link A A . . . A
CC C
CCH HSMS SS H
CM

Channel Combination IV :main BCCH ( GSM 05.01)

Technical Terms Used w.r.t. MM (Mobility Management )
• IMSI – International Mobile Subscriber Identity
• IMSISDN – Mobile Subscriber ISDN number
• IMEI – International Mobile Equipment Identity
• TMSI – Temporary Mobile Subscriber Identity

• MSRN – Mobile Subscriber Roaming Number

• LAI – Location Area Identity
• A3 – Authentication Algorithm
• A5 – Ciphering Algorithm
• A8 – Kc Generation Algorithm
 Location Related Identities

1. MSRN – Mobile Subscriber Roaming Number

It is a temporary number used for routing the call to MS.

Format : MSRN = CC + NDC + SN

CC = Country Code

NDC = Network Destination Code

SN = Subscriber Number

For example for Patna MSC in IMPCS network MSRN looks

like 91 98750 00100.
 Location Related Identities

MSRN

MSISDN MSISDN
PSTN GMSC 2
1
HLR
MSRN 6
MSRN
IMSI MSRN
7 3 5

VLR
MSC

IMSI 4 MSRN
 Location Related Identities

2. Location Area Identity (LAI ) -

• Each location area in a GSM PLMN is identified by a Location

Area Identity ( LAI ).
• Location area consist of one or more than one cell which may
be served by one or more BSC s.
• All the cells in a Location area are served by single VLR.
BTS BSC MSC 1
LA 1
BTS
BSC
BTS
VLR 1
LA 2
BTS
SS 7
BSC HLR

MSC 2
BTS

LA 3
BTS

BSC
VLR 2

Location Area
 Location Related Identities
3 digits 2 digits 2 octets max

( 16 bits )
MCC MNC LAC

LAI
LAI = MCC + MNC + LAC
MCC - Mobile Country Code.
MNC - Mobile Network Code.
LAC - Location Area Code .
• Maximum length of LAC is 16 bits.

• Thus there can be maximum of 65,536 Location Areas defined

in one GSM PLMN.
 MS Initialization / Network Attachment

1. MS Powered on.
2. Frequency Synchronization

- MS scans entire 124 carriers and monitors RF levels.

- several readings are taken to get accurate estimate
the channel power.
- MS then searches for Frequency Correction burst (FCCH) on
the channel with strongest RF level.

- FCCH present in time slot T0 & has a fixed pattern of 142 0’s.

- After tuning to FCCH MS synchronizes in time with SCH .

 MS Initialization / Network Attachment
3. Synchronization in Time
- SCH occurs in next frame in same time slot as FCCH.

- The occurrence of SCH is eight burst period ( BP’s ) later than

FCCH.

- SCH contains precise timing information and current frame

number to which MS is synchronized.

- After successful synchronization the MS will read the TDMA

frame number and Base Station Identity Code BSIC .

- BSIC consists of - PLMN colour code ( 3 bits )

- BS colour code ( 3 bits ).
 MS Initialization / Network Attachment

• MS location is determined by cell identification of strongest

BCCH signal received by MS.

• MS regularly measures the received signal strength of BCCH at

least once every 6 sec ( Superframe Duration).

• MS stores at least six strongest BCCH and their cell

identification in SIM.

• MS decodes information on BCCH and gets Location Area

Identity ( LAI ).

• If the information stored on SIM does not match with the

information MS thinks that it has moved to new location and
sends LA update request to BSS.
 Network Attachment Process

MS Switch -on

Measure strongest
BCCH channels

PLMN Selection

Limited Service Mode

. Cell should be of selected PLMN.
Cell Selection
. Cell should not be “ barred “.
. Radio path loss between BTS and
the MS must be below a threshold set
by the operator. Location Update
( Register its presence
to the network. )

Idle-Mode
 MS BTS BSC MSC
DTAP
RIL3 - CM CM
M
RIL3 - MM DTAP
MM
A I
P
S
RIL 3-
RIL3 - RR RR BSSMAP BSSMAP TCAP U
RR BTSM BTSM SCCP SCCP P
SCCP

LAPD m LAPD m LAPD LAPD MTP MTP

Layer 1 Layer 1 Layer 1 Layer 1

Um A bis A link BCDEFG

GSM Signaling Protocols Overview
 What is Mobility Management ( MM ) ?

Subscriber Data management at MSC/VLR

• Subscriber data from HLR are retrieved by MM at the time of
first location up-dating of a subscriber.
• Dynamic data changes by subscriber are also managed by MM
at MSC/VLR.
• Operator initiated data changes for a subscriber are also
managed by MM.

Services Provided to Upper Layers

• MM sub-layer provides basic services to upper layer CM sub-
layer.
• MM handover procedures provide smooth transition from one
radio link to other.
 What is Mobility Management ( MM ) ?

Subscriber Authentication and Confidentiality

management
• MM procedures ensure authenticity of a subscriber.

• MM procedures ensure data confidentiality at radio interface.

 MM Procedures
MM Common Procedures :
• TMSI Reallocation Procedure.
• Authentication Procedure.
• Identification Procedure.
• IMSI Detach Procedure.
• Ciphering Procedure.
• Abort Procedure.
MM Specific Procedures :
• Location Updating Procedure.
• IMSI Attach Procedure.
 MM Procedures

• A MM specific procedure can only be started if no

other MM specific procedure is running.
• During the lifetime of a MM specific procedure if a MM
connection establishment is requested by a CM entity,
the request will either be rejected or delayed until the
running of MM specific procedure is terminated.
• Any MM common procedure Procedure ( except
IMSI detach) may be initiated during MM specific
procedure.
• The MS side should wait for release of RR connection
used for a MM specific procedure before a new MM
specific procedure or MM connection establishment is
started.
 Authentication

• Authentication is used to check the validity of a

mobile subscriber.

At MS At N/W

Ki Ki
RAND( 128 bits )

A3 A3

SRES SRES
=? ( 32 bits )

AUTHENTICATION
• Ki ( 128 bits) : Identification Key
- Purpose : Ki is used to calculate SRES and Kc.
- Ki is stored in SIM and HLR.
- Ki is never transmitted over signaling network.

• RAND ( 128 bits ):Random Number

- Purpose : RAND is used to calculate SRES and Kc.

• Kc ( 64 bits ) : Ciphering Key

- Purpose : Kc is used to encrypt data over radio interface.

• SRES ( 32 bits) :Signed Response

 Ciphering

• Ciphering is used to encrypt data on radio interface.

RAND Ki
Kc generation is done at the
time of Authentication.
A8
Frame
No. (22
bits ) Kc ( 64 bits)

A5

Ciphering Stream
Ciphered Bits
XOR
Information Bits ( 114 bits )

CIPHERING
 Authentication Procedure
• Authentication procedure is always initiated and
controlled by the n/w.
The purpose of authentication procedure is two fold :
1. To check identity provided by the MS.
2. To supply n/w parameters to MS to calculate Kc.

Authentication Request
TIME

Authentication Response

Authentication Reject

MS AUTHENTICATION PROCEDURE N/W

 Authentication Procedure
Authentication Triplets :

- At n/w side, authentication procedure requires authentication

triplets.
- Authentication triplets contains
-RAND ( 128 bits ).
- SRES ( 32 bits ).
- Kc ( 64 bits ).
- The network can have more than one triplets.
- The operator can allow reuse of triplets.
- The index of currently used triplet is called CKSN
( Ciphering Key Sequence Number ).
 Location Updating Procedure

This is a general procedure which is used for

following purposes -
• Normal Location Updating -
MS moves to new LA.

• Periodic Location Updating -

To notify periodic availability of MS to the network.
• IMSI Attach -
MS switched on for first time in new LA or MS switched
off and on.
 Location Update Scenario
Each time MS moves to new LA corresponding VLR
is informed.
Case - I Old LA and new LA in same VLR area
• MS given new TMSI .
• Location updated in VLR memory.
Case - II Old LA and new LA in different VLR area
• HLR updates.
• old VLR erases data.
• new VLR records relevant parameters.
• MS is given new TMSI.
 Location Update Scenario

Phases of Location Update Scenario

• Request for service.

• Authentication
• Ciphering
• HLR/ VLR updation
• TMSI reallocation.
 LOCATION UPDATE SCENARIO - I
Request For Service
New Old
MS BSS MSC/ HLR
MSC/
VLR /AUC
VLR

Channel Request
1
RACH
SDCCH Assignment
2
AGCH
Location Update Request ( TMSI , LAI 0 )
3
SDCCH
Request IMSI

( TMSI )
4
Send IMSI
 LOCATION UPDATE SCENARIO - II
Authentication and Ciphering
New Old
MS BSS MSC/ HLR/
MSC/
VLR AUC
VLR
5 Get Authentication Parameters

( IMSI )
Authentication Parameters
Authenticate MS ( RAND ) ( RAND,Kc,SRES )

6
SDCCH
Authentication Response ( SRES )
SDCCH
Cipher Radio Channel
7
( Kc )
Cipher Up Link Channel
SDCCH
 LOCATION UPDATE SCENARIO - III
Authentication and Ciphering
New Old
MS BSS MSC/ HLR/
MSC/
VLR AUC
VLR

Up Link Ciphered
8
SDCCH
BSS Ciphers Down link Channel .

9
Ciphering Complete
 LOCATION UPDATE SCENARIO - IV
Update HLR/VLR & TMSI Reallocation
New Old
MS BSS MSC/ HLR/
MSC/
VLR AUC
VLR

Update Location
10
De Register Mobile

11 Mobile De-registered

12
Location Updated

Location Updated Accept TMSI

13
SDCCH
 LOCATION UPDATE SCENARIO - V
Update HLR/VLR & TMSI Reallocation

New Old
MS BSS MSC/ HLR/
MSC/
VLR AUC
VLR

Location Updated Complete

14
SDCCH

15 Clear Signaling Connection

Clear Complete

16
Release Radio
Signaling Channel
SDCCH
 LOCATION UPDATION
ND Mobile moves to CA and Powers on MS • Listens
BCCH/FCCH
Update
Location HLR
GMSC
TAX Location Update
MSC ND
CA CA ( TMSI, LAI )
LU Accept MS
LU Accept
VLR
Update ( New TMSI) 9810098111
New VLR records
CA Location VPLMN
subscriber data.
LU Accept HLR HPLMN
ND
LU Accept ( Update Location/
GMSC
TAX MSC/VLR Authentication )
ND ND LU Accept
Update
Location (Subs data)
ACK from
VLR De register old
Mobile to MSC/VLR
Old VLR
 Mobile To Land Call Set-up Scenario

Phases of Mobile To Land Call

( Mobile Originated Call- MO Call )

• SETUP PHASE

• RINGING PHASE

• CONVERSATION PHASE

• RELEASE PHASE
 Mobile To Land Call Set-up Scenario

• SETUP PHASE
- REQUEST FOR SERVICE ( CHANNEL ) BY MS

- CM SERVICE REQUEST
- AUTHENTICATION

- CIPHERING

- EQUIPMENT VALIDATION ( EIR CHECK )

- SETUP MESSAGE

- VALIDATION AT VLR

- ASSIGNMENT
 MOBILE TO LAND CALL - I
Request For Service

MSC/
MS BSS VLR

Channel Request
1
RACH

2 SDCCH Assignment

AGCH
CM Service Request
3
SDCCH

CM Service Accept
4
 Mobile To Land Call Set-up Scenario

• CM SERVICE REQUEST

- The Call Control (CC) entity of MS initiates the establishment of

CC connection by requesting MM sub-layer of the mobile to
establish MM sub-layer connection.

- Upon establishment of MM connection CM SERVICE ACCEPT

message is received from n/w.

• SETUP MESSAGE

- CC entity sends a setup message to its peer entity.

 MOBILE TO LAND CALL - II
Call Setup
MSC/
MS BSS VLR

Call Setup Request

5
SDCCH
Call Proceeding
6
SDCCH
Assign Trunk and radio

Assign TCH
7
SDCCH

Radio Assignment Complete

SDCCH
Trunk and Radio Assignment Complete
 Mobile To Land Call Set-up Scenario
Call Setup message

MSC/VLR

Release Complete
message to MS No Is the requested basic service
provisioned for the subscriber ?

Yes
Release Complete
message to MS Yes Preliminary Digit Analysis
Is the number of digits less than the
minimum expected?

No 1. Check of ODB( BAOC/BOIC/ BOIC Ex HC )

2. Subscriber call barring checks ( BAOC/BOIC e

ASSIGNM ENT
 Mobile To Land Call Set-up Scenario

• ASSIGNMENT

- A BSSMAP message ‘Assignment Command ’ is sent by MSC to

BSS.

- The message contains a free CIC on A-Interface for terrestrial

channel allocated by MSC.

- A free TCH is allocated by the BSS and MS is informed to attach

to this TCH.

- On receiving a response from BSS MSC switches the speech

path towards the calling MS.

Note : Mobile has not connected user

connection as yet.
 MOBILE TO LAND CALL - III
Call Setup

MSC/ GMSC
MS BSS HLR PSTN
VLR

Network Setup ( Dialed Digits )

8
Network Alerting

Alerting
9
FACCH Connect

Start Billing
10 Connect

FACCH
Connect Acknowledge
11
FACCH
 MOBILE TO LAND CALL - IV
Call Release

MSC/ GMSC
MS BSS HLR PSTN
VLR

Disconnect
12
Network Release

Release
13
FACCH
Release Complete
14
FACCH
Clear Command
15 Channel Release

FACCH Release Complete

 Land To Mobile Call Set-up Scenario

Phases of Land To Mobile Call

( Mobile Terminating - MT Call )

• Routing Analysis

• Paging

• Authentication

• Ciphering

• Call-Setup

• Call Release
 Architecture For Mobile Terminated Call

VISITING PLMN

A- Interface
MSC-B
IAM ( ISUP )
GMSC- B BSS-B

Air Interface
VLR-B

MS

HLR-B
 LAND TO MOBILE CALL - I
Routing Analysis

MSC/VLR HLR GMSC PSTN

1 Incoming Call

Get Route ( MSISDN )

2
Get Route ( MSISDN )
3
( IMSI )

4 Routing Information
( MSRN )
Routing Information

( MSRN )
Incoming Call
5

( MSRN )
 LAND TO MOBILE CALL - II

Paging

MS BSS MSC

Perform Page

Page (TMSI)
6 PCH
Channel Request
7
( RACH )

8 Access Granted
( AGCH )

Paging Response
9 ( TMSI, LAI )
SDCCH Page Response
 LAND TO MOBILE CALL - III
Call Set-up
MS BSS MSC

Call Set Up
10
SDCCH

Call Set Up Confirm

11
SDCCH

Assign Trunk &

Radio Channel
Assign Radio Channel
12
SDCCH

Radio Channel Assigned

SDCCH Trunk and Radio Channel
Assignment Complete
 LAND TO MOBILE CALL - IV
Call Setup

MSC/ GMSC
MS BSS HLR PSTN
VLR

Mobile Alerting
13
FACCH Network Alerting

Connect ( off-hook )
14
FACCH
Start Billing Connect

Connect Acknowledge
15
 LAND TO MOBILE CALL - V
Call Release

MSC/ GMSC
MS BSS HLR PSTN
VLR

Network Release

Disconnect
16 Stop Billing
FACCH
Release
17
Release Complete
FACCH

Release Complete
18
FACCH
Clear Command
19 Clear Channel

FACCH Clear Complete

1. ND PSTN Subscriber Dials ND Mobile Subscriber in ND.

Page(TMSI)
ND
HLR MS

GMSC SRI 9810098100

ND TAX
MSC/VLR MSRN
ND
ND
MSISDN
PRN to
MSISDN ACK from
MSC/VLR
MSC/VLR
MSISDN TANDEM
LE ND
ND
(MSRN)
2. ND PSTN Subscriber Dials CA Mobile Subscriber in CA.
TANDEM
HLR
MSISDN MSISDN
GMSC
TAX MSC/VLR
LE ND
ND

ND MSISDN

CA
HLR

MSISDN SRI
GMSC
TAX
MSC/VLR MSRN
CA
CA

CA Page(TMSI) PRN to ACK from

MS MSC/VLR MSC/VLR
CA
9881098300 CA
(MSRN)
3. ND PSTN Subscriber Dials ND Mobile Subscriber in CA.
HLR
GMSC ND
TAX
MSC/VLR
CA MSRN MS
CA
CA 9810098200
Page(TMSI)
MSRN
HLR

MSRN SRI
GMSC
ND TAX
MSC/VLR MSRN
ND
ND

MSISDN PRN to ACK from

MSISDN
MSC/VLR MSC/VLR
MSISDN TANDEM CA
LE CA
(MSRN)
4. CA PSTN Subscriber Dials ND Mobile Subscriber in CA.
TANDEM
HLR
MSISDN MSISDN
GMSC
TAX MSC/VLR
LE CA 9810098400
CA
MSRN
ND
CA Page(TMSI)
MSISDN MS

ND MSRN
HLR

MSRN GMSC SRI

TAX
MSC/VLR MSRN
ND
ND
MSISDN
PRN to ACK from
MSC/VLR MSC/VLR
CA
CA
(MSRN)
THANKS !