1.1 GSM Security Management
At first, let’s see the first part-GSM security management. As a digital communication system, the security management is very easy to be realized for GSM. In GSM system, the security management consists of four parts, authentication and ciphering, TMSI reallocation and equipment identification.
Let’s see the first one, authentication. Generally, authentication may be executed during call setup, location updating and supplementary services; it ensures only legal subscriber can access to the network.
At the side of the network, the AUC is the entity, which produces the authentication parameters. In AUC, there stores IMSI and KI of the mobile station, besides, security algorithm , A3 and A8 ,still random number generator. This generator produces the different random number, here, for short, RAND. Then, how does AUC produce the authentication parameters? We know，for one MS, the unique identification is IMSI, corresponding to the IMSI, there is a set of KI. In AUC, KI and RAND will be calculated through A3 and A8, the results are called SRES and Kc respectively. RAND, SRES and Kc (authentication parameters), are called triples .For different RAND, the different SRES and Kc will be generated, So, in AUC, for each mobile subscriber, accordingly, there are many sets of triples. In the buffer, there are tables which indicate the relationship between IMSI and triples. In GSM system, we know, AUC only has interface with HLR, so ,AUC will send the triples to HLR, from 8 to 10 sets every time. temporarily, there stores the triples in HLR. At the side of the mobile station, in the SIM card, IMSI and KI are stored,also,A3 and A8.when MS wants to access to the network, for example, call setup, location updating or supplementary services, from the HLR the triples are sent to the VLR which the MS is registered. The VLR will send authentication request to the MS, at the same time, the RAND in the triples are sent to the MS, after the MS received the request, at SIM card, same calculation with AUC will be executed, KI and RAND which are from VLR through A3 and A8, SRES and Kc can be got in SIM card, then SRES is sent to the VLR, the VLR compare the two SRES, if equal, the MS can access to the system.
Then, the authentication and ciphering message sequence. When the MS sends the request of call setup, location updating and supplementary services, if authentication is set to necessary in the VLR, then the VLR check whether there are authentication parameters in it or not, if not, the VLR will send “authentication parameters request” to the HLR, generally, the HLR sends the triples in groups of five through the acknowledgement message. These triples are stored in the VLR. This ensures that the VLR can carry out the authentication and that it will not have to contact the HLR.
Then, the VLR initiates the authentication by sending message : “authenticate” to the MSC. The MSC will repackage this message and send it on to the MS. The message is an “Authentication Request” and contains the random number RAND.
When the mobile receives the message, it responds with the “Authentication Response” message, this contains the signed response (SRES).
If authentication is successful, the VLR will request the MSC to start ciphering procedures using the “Start Ciphering” message. This message contains information indicating whether ciphering is required. If authentication fails the HLR will be notified and an “Authentication Reject” message will be sent to the mobile.
The MSC will start ciphering procedures by sending the “Ciphering Mode Command” This message contains the encryption information required by the BSS. The new mode is applied for reception on the network side after the message has been sent. In the CIPHER MODE COMMAND, the MSC specifies which of the ciphering algorithms may be used by the BSS. Upon receipt of the CIPHERING MODE COMMAND message indicating ciphering, the mobile station shall start transmission and reception in the indicated mode. Whenever the mobile station receives a valid CIPHERING MODE COMMAND message, it shall, if a SIM is present and considered valid by the ME and the ciphering key sequence number stored on the SIM indicates that a ciphering key is available, load the ciphering key stored on the SIM into the ME. The BSS then selects an appropriate algorithm, taking into account the MS ciphering capabilities. The CIPHER MODE COMPLETE message returned to the MSC indicates the chosen ciphering algorithm message to the BSS. Upon receipt of the CIPHERING MODE COMPLETE message the network starts transmission in the new mode. Whether the traffic or signaling information between the mobile and the BTS can be encrypted. Generally, A5 algorithms and KC(ciphering key) are used during the ciphering. For the encryption (MS or BTS) , the information is processed with KC via A5;for the decryption(BTS or MS),the received information is also processed with KC via A5.
From the ciphering sequence, we can see, the ciphering will be processed after the network gets the identification of MS(IMSI).That is, ciphering is point to point. So, IMSI is transferred without encryption in radio path. This is very dangerous. We know, IMSI is the unique identification of the mobile subscriber. In GSM system, to avoid this instance, TMSI reallocation is used. TMSI is the abbreviation of Temporary Mobile Subscriber Identification. It is allocated by VLR. After a location update, the VLR will assign a new TMSI for the mobile. The New TMSI and LAI will be transmitted to mobile through “Location Update Accept” message. The mobile has stored both TMSI and LAI on its SIM card, It will send the “TMSI Reallocate complete” message to the VLR to confirm that the location update has been completed. During call setup, location updating and supplementary service, the mobile only sends TMSI to the network, not IMSI. In this way, IMSI become very safe.
In the security management of the GSM system, on the side of the mobile station, the first three are all based on the SIM card . For the last one, equipment identification is based on the mobile equipment. IMEI, International Mobile Equipment Identification, it is the unique number for the mobile equipment. On the side of the network, EIR(Equipment Identification Register) stores the IMEI of all the mobile equipment. There are three databases in the EIR: white list, black list and grey list. In the white list ,IMEI of legal mobile equipment is stored. In the black list, IMEI of illegal mobile equipment are stored. In the grey list, IMEIs of faulty mobile equipment are stored. Equipment Identification will be initiated by the MSC sending the “equipment ID Request” message to the mobile. This will be carried out less frequently than authentication. The frequency of the checks will be at the discretion of the network operator. Equipment Identification will be carried out during a Location Update or a Call Setup.
The mobile will respond to the message by sending the “ID Response” message. This message contains the equipment’s IMEI number.
After the MSC received the “ID Response” message, the MSC will send the IMEI number on to the EIR Using the “Check IMEI” message. The EIR will be respond with the “Check IMEI Response”. In this message, equipment status is included, that is, indicates which list the IMEI is located. So, the MSC can decide whether continue the call or location updating. Here, please note, checking of the IMEI at the EIR may occur after the TCH has been allocated to the mobile. Ok, hereto, we have finished the GSM security management. GSM security management can be run through during the other sequence, for example, call sequence, location updating and so on. So, it was introduced at first
1.2 GSM Basic Call Sequence
Ok, after the GSM security management, let’s study GSM basic call sequence. The process for the calling MS and called MS is two independent flows. So, at first, we take the sequence from mobile to land as example, in this sequence, we mainly devote to the calling party. Then for the called MS, land to mobile call sequence will be introduced, of course, devote to the called party. At last, we will study call clearing sequence.
Ok, at first, the Mobile to Land Call Sequence.
The mobile subscriber pressing the “send” key initiates a “Channel Request” message from MS to the BSS. This is followed by the assignment of a dedicated control channel by the BSS. In this way, the signaling link between the MS and BSS is established. Here you can find that the assignment of the SDCCH is performed by the BSS, not through the MSC.
After the SDCCH assignment, the message “Request for service” is passed to the MSC which relay it to the VLR. Let’s see A interface at first, “Request for Service” is included in the CR message, connection request, the SCCP message which belongs to connection-oriented service. We know, in A interface connection-oriented service is widely used. After CR and CC, the virtual connection has been established in A interface. Ok, then let’s see B interface between MSC and VLR. We know, in GSM system, the MSC provides the call control function, the subscriber information is stored in the VLR and HLR, so when the MSC received the “Request for service” from the mobile, it will send “Process Access Request” message to the VLR. The VLR will carry out the authentication process if the MS has been previously registered on this VLR. If not, the VLR will have to obtain authentication parameters from the HLR.
Subscriber authentication takes place using authentication message and encryption algorithms. If successful the Call setup can be continued. If ciphering is to be used this is initiated at this time as the setup message contains sensitive information. Of course, subscriber authentication and ciphering can be optional. The operator can make the configuration in the MSC/VLR.
And then the message “Set-up” is sent to the MSC by the MS accompanied by the call information, such as type of call, and called number. The message is forwarded from MSC to the VLR. This message is “SFOC”, Send Information for outgoing call.
The MSC may initiates the MS IMEI check, Is the MS stolen? and so on. Here note that this check may occur later in the message sequence.
In response to the message “Set-up” which sent at step 4,The VLR sends the message “Complete call” to the MSC, which notifies the MS with “Call Proceeding”.
Ok, after the message “Call Proceeding”, the MSC then assigns a traffic channel to the BSS through the message “Assignment Command”, and in turn assigns an air-interface traffic channel. The MS responds to the BSS with “Assignment Complete” which responds in turn to the MSC.
Oh, after so much preparation, an “Initial Address Message” is sent to the PSTN. Ring tone is applied at the MS in response to “Alerting” .The MSC sends it to the MS when the PSTN responds with an “Address Complete Message (ACM)”.
When “Answer (ANS)” from the PSTN, the message “Connect” is forwarded to the MS by the MSC, stopping the MS ringing tone. The MSC then connects the GSM traffic channel to the PSTN circuit, completing the end-end traffic connection.
In response to “Connect”, the MS sends the message “Connect Acknowledge”. Conversation takes place for the duration of the call. Ok, that is the call establishment sequence for Mobile to Land, for the call clearing sequence, we’ll study it later.
Ok, after this sequence, let’s answer a question. What happens when the calling MS activates the SS of BAOC?
Ok, let’s see the answer to this question. We know, Subscriber information is stored in the VLR and HLR. When the MSC receives the “Request for service” from the MS, the message “Set-up” is sent to the MSC by the MS. The call information is included in this message. The MSC sends the message “SFOC” to the VLR, and then the VLR will check the subscriber information in it, at this time, VLR finds that the calling party has activated the supplementary service “ BAOC”, and then in response to the “SFOC”, “call barred” is sent to MSC. The MSC won’t assign the traffic channel for the call.” Call barred” will be displayed on the MS.
Ok, we have studied Mobile to Land sequence ,in this sequence, we mainly devote to the calling party sequence. Then I introduce the called MS sequence, I will take Land to Mobile sequence as example.
At first, a C7 message “Initial Address Message (IAM)” arrives at a gateway MSC(GMSC).The MS to be called is identified by its MSISDN.
Then the GMSC requests the routing information from HLR, using the message “Send Routing Info”, still tagged by the MS’s MSISDN. There stores subscriber location information in the HLR, so the HLR forwards the message using “Provide Roaming Number” to the VLR which the MS is currently located in. This is tagged with the MS’s IMSI to the VLR. The requested information will enable the GMSC to identify the MSC to which the “IAM” must be directed.
The VLR responds with the message “Provide Roaming No. Ack.”, now tagged with an MSRN which is either newly drawn from its pool of MSRNs or already associated with the MS being called. The HLR forwards the message with “Routing Information Ack.”. The GMSC now sends “IAM” to the MSC serving the mobile’s location, tagged with the MSRN.
The visitor MSC then requests call set-up information from the VLR using “SFIC (Send Info for Incoming Call Setup”.
The VLR response is the “page” message back to the MSC, containing the required information, LAI and TMSI or IMSI. The MSC then sends “Paging Request” to the MS via the appropriate BSS.
The MS responds and requests a dedicated control channel from the BSS with “Channel Request”. The BSS then sends assign DCCH ,and MS responds with “Assign complete”. The air interface signaling link is established. Once established, the dedicated control channel carries “Paging Response” to the BSS which relays it to the VLR through the MSC. The MS is authenticated and cipher mode is set. Of course, they are optional.
The “Complete Call” message is then sent to the MSC from the VLR. This is relayed to the MS via the BSS as the message “Setup”.
The MS sends the message “Call Confirmation” to the MSC. This indicates that the MS is capable of receiving a call. And then MSC sends an “Address Complete Message(ACM)” to the GMSC which relays it to the PSTN. The land subscriber will now hear ring tone.
The MSC then assigns a traffic channel to the BSS through “Assignment Command”, in turn assigns an air-interface traffic channel. The MS responds to the BSS with “Assignment Complete”. The BSS responds in turn to the MSC. The MS now rings, sending the message “Alert” to the MSC as a confirmation.
When the GSM subscriber answers, the MS sends the message “Connect” to the MSC. The MSC acknowledges this with “Conncet Ack” and sends “Answer (ANS)” to the GMSC and PSTN. The land subscriber’s ring tone stops, the GMSC and MSC connect the GSM traffic channel and the PSTN circuit together. Conversation takes place for the duration of the call. So much for the Land to Mobile call sequence.
Ok, let’s answer several questions for this sequence. Please give the sequence: 1.The called MS is powered off. 2.The called MS activates the CFU to a PSTN No. 3.The called MS has been barred all incoming call. 4.The Called MS is unknown in the HLR
Let’s answer the questions one by one. The first one :the sequence when the called MS is power off. The HLR doesn’t know whether the MS is powered on or off. The MS’ IMSI status is stored in the VLR where the mobile is located. If the MS is powered off, IMSI status in the VLR is detach, if on, it’s attach. So, when the VLR receives the “Provide Roaming Number” from the HLR, the VLR will send “Provide Roaming Number Ack.” with the cause of “subscriber absent”. The calling subscriber then listens to the announcement “the subscriber you dialed is powered off”.
The second question: the sequence when the called MS activates the CFU to a PSTN number. We know, in the HLR, there is service information, when the MS activates the CFU, the HLR knows it. So when the HLR receives the “Routing Information Request” from the GMSC, the HLR knows the MS has activated the CFU to an other number, then responds “Routing Information Ack.” with the CFN directly, and not request to the VLR. The GMSC then sends the message “IAM” to the corresponding office direction.
Then let’s see the third question: the sequence when the called MS has been barred all incoming call. It’s very similar to the previous question, the HLR knows the service information, so when the HLR receives the request for routing information, the HLR sends routing info acknowledgement with the cause of “Call Barred” without notification to the VLR.
Then the last question: the sequence when the called MS is unknown in the HLR. This question is very simple for you. As the response to the routing information request, the HLR sends acknowledgement with the cause of unknown subscriber. The calling party may hear the announcement.
In the two sequence, no introduction to the call clearing sequence, here let’s study it. We take mobile initiated call clearing sequence as the example. The mobile initiates the clearing of the call by sending the “Disconnect” message to the MSC. The MSC will then send a “Release” message to the PSTN which will then start to release the fixed network circuits associated with the call. The MSC will also send a “Release” message to the mobile to indicate that it may clear down the call.
When the mobile receives the message it will release the call and respond with the “Release Complete” message. The PSTN will also respond with a “Release Complete” message.
The MSC now initiates the freeing up of the air interface radio resources and the A Interface terrestrial resources related to the call. The MSC will send the “Clear Command” to the BSS. The BSS in turn will send a “Channel Release” on to the mobile, this starts the release of the radio resources used for that call. The BSS will then respond to the MSC with the “Clear Complete” message indicating that it has released the radio and terrestrial resources.
The BSS will complete the release of the radio resources by sending the “DISC” message to the mobile. The mobile will respond with an unnumbered acknowledgement message.
The MSC will now initiate the release of the signaling connection related to the call. The MSC will send the “Released” message, the BSS will respond with the “Release Complete” message. The call is now cleared and all resources are available for another subscriber. Ok, that’s all for the second part. I only give you explanation about basic call sequence. For the more information about call sequence, please refer to the corresponding specifications.
Now, we’ll study the third part, location update sequence. In this part, at first I give you brief introduction to the location update, and then I’ll introduce several typical location updating sequences.
At first ,I’ll introduce the location update briefly. There are three types of location update in GSM system. The first one is periodic location update, it is requested by the system, that is, on the one hand, the BSC defines the interval of periodic location update, notify the mobile through system message, the MS then sends the periodic location update message to the network every the defined interval; on the other hand, the MSC/VLR defines another interval, if the MSC/VLR doesn’t receive the periodic location update message from the mobile after the defined interval, the IMSI status of the mobile will be set to detach. please note the two interval defined by the BSC and MSC is relative. the interval defined by MSC/VLR shouldn’t less than that defined by the BSC. When the MS is out of service area, the network can’t receive its periodic location update message, the IMSI status will be set to detach, and then when the mobile is called, the MSC/VLR won’t send “page” message, the PCH should be saved. But periodic location update message occupies the SDCCH resource, so, the operator should balance them. Ok, that’s the first type of location update. IMSI attach/detach is the second type of location update. The last one is normal location update. It happens when the MS enters a new location area. It is initiated from MS. In the following, the normal location update sequence will be explained.
1.3 Location Update Sequences
In the second, several normal location update sequences are introduced. It consists of two kinds of sequence: intra-VLR location update and inter-VLR location update.
Ok, at first, intra-VLR location update sequence. A location update is initiated by the mobile when it detects that it has entered a new location area. The location area is transmitted on the BCCH as the LAI. The mobile will be assigned an SDCCH by the BSS, the location updating procedure will be carried out using this channel.
Once the SDCCH has been assigned the mobile transmits a “Location Update Request” message. This message is received by the MSC which then sends the new LAI and current mobile TMSI number to the VLR. The information will also be sent to the HLR if the mobile has not previously been updated on the network. If the mobile has been registered in this VLR, this information won’t be sent to the HLR, that is, this is intra-VLR location update.
Authentication and ciphering may now take place if required.
The VLR will now assign a new TMSI for the mobile, this number will be sent to the MSC using the “Forward New TMSI” message. The VLR will now initiate the “Location Update Accept” message which will transmit the new TMSI and LAI to the mobile.
Once the mobile has stored both the TMSI and the LAI on its SIM card it will send the “TMSI Reallocate Complete” message to the MSC. The MSC will then send the “TMSI ACK” message to the VLR to confirm that the location update has been completed.
The SDCCH will then be released by the mobile. Ok, that is the intra-VLR location update sequence.
Then let’s see the inter-VLR location update sequence. Here introduce the sequence under the two situations. The first is location update though IMSI, the other one is through TMSI.
As the intra-VLR location update, the inter-VLR location update is initiated by the mobile when it detects that it has entered a new location area. The location area is transmitted on the BCCH as the LAI. The mobile will be assigned an SDCCH by the BSS, the location updating procedure will be carried out using this channel.
Once the SDCCH has been assigned the mobile transmits a “Location Update Request” message. This message is received by the MSC, then MSC sends the new LAI and mobile IMSI number to the VLR.
Because the mobile hasn’t previously been registered on this VLR, the information will then be sent to the HLR. If the authentication is required in the MSC/VLR, at first authentication parameter request will be sent to the HLR and the HLR gives response. And then authentication and ciphering may now take place if required.
After the authentication and ciphering, the information of “Location Update Request” will be sent to the HLR, and in response the HLR transmits the subscriber information using the message “Insert Subscriber Data”. Once the VLR has stored the information it will send the Acknowledge message. The HLR will then send the “Location Update Ack.” message to the VLR.
Since the VLRn has stored the mobile information, the HLR then sends “Cancellocation” message to the VLRo, after the response from the VLRo, the HLR will then update VLR number in the HLR for this subscriber.
TMSI reallocation procedure is same with the previous sequence. Of course, if the system doesn’t use TMSI, then no this procedure.
At last the SDCCH will then be released by the mobile.
Ok, After this procedure, let’s see the next one, the sequence for inter-VLR location update via TMSI. At the beginning, the location update is initiated by the mobile, the mobile will be assigned an SDCCH by the BSS, the location updating procedure will be carried out using this channel.
Once the SDCCH has been assigned the mobile transmits a “Location Update Request” message. This message is received by the MSC, the MSC then sends the current TMSI and the LAI which consists of the previous and new one.
We know, the TMSI is allocated by the previous VLR, and unknown in the new VLR (VLRn).So, the VLRn calculates the VLRo number through the old LAI (LAIo),and then sends the message “Send Identification” to the VLRo to get the mobile IMSI and authentication parameters. In response, the VLRo returns the IMSI and authentication parameters in the acknowledgement message. Then authentication and ciphering may now take place if required.
And the VLRn will now send the message “Location Update Request” to the HLR, the HLR will then transmit the subscriber information to the VLRn. Once the VLRn responds, the HLR sends the message “Location Update Acknowledgement” to the VLRn.
Then the HLR sends “Cancellocation” message to the previous VLR, once the VLRo responds the HLR will then store the VLRn number for the mobile.
The VLR will now assign a new TMSI for the mobile, this number will be sent to the MSC using the “Forward New TMSI” message. The VLRn will now initiate the “Location Update Accept” message which will transmit the new TMSI and LAI to the mobile. Once the mobile has stored both the TMSI and the LAI on its SIM card it will send the “TMSI Reallocate Complete” message to the MSC. The MSC will then send the “TMSI ACK” message to the VLR to confirm that the location update has been completed.
The SDCCH will then be released by the mobile. Ok, that’s all for the location update sequence.
1.4 SMS Sequence
Now we will study the fourth part, short message sequence. The mobile originated short message transfer procedure is separated from mobile terminated. The basic short message sequence consists of two parts: MO SMS Transfer and MT SMS Transfer. It’s very similar to the call sequence.
At first let’s see MO SMS transfer sequence. Like the call sequence, the subscriber pressing the “send” key initiates a “Channel Request” message from the MS to the BSS. This is followed by the assignment of dedicated control channel by the BSS and the establishment of the signaling link between the MS and BSS.
The message “Request for Service” is passed to the MSC which relays it to the VLR.
The VLR will carry out the authentication process if the MS has been previously registered on this VLR, if not, the VLR will have to obtain authentication parameters from the HLR.
The message “RP_MO_DATA” is sent by the mobile to the MSC accompanied by the SM information, such as type of SM, the SMC number. This message is forwarded from the MSC to the VLR, that is, the MSC should query to the VLR whether the mobile subscriber has authority of sending short message via “SIF_MO_SMS” message, and then VLR returns the results for query.
If the mobile has the authority to send short message, the MSC will then transfer the short message to the interworking-MSC via the message ”MO_Forward_SM” tagged with SMC number. The SMC number is set on the mobile station. It’s the home SMC of the mobile. The interworking-MSC will then forward the short message to the corresponding SMC. Once responds from SMC, the interworking-MSC responds in turn to the MSC.
And the MSC will then send the message ”RP_ACK” to MS in response to the message ”RP_MO_DATA”. At this time “Send Successfully" is displayed on the mobile. It’s terminated the MO sequence.
Ok, now let’s see the MT SMS transfer sequence. It consists of two cases: for one short message and several messages.
At first I’ll introduce the MT SMS transfer sequence for one message. A message “short message” arrives at a gateway-MSC. The MS to be called is identified by its MSISDN. The GMSC will then request routing information from HLR using the message “SRI_for_SM”, still tagged by the MS’s MSISDN. The HLR then responds with the message “SRI_for_SM_ACK” which includes the VLR number. This information will enable the GMSC to identify the MSC to which the “Forward_SM” must be directed.
Then the “visitor” MSC requests call Set-up information from the VLR using the message “SIF_MT_SMS”. The VLR response is the “page” message back to the MSC, containing the required information. The MSC then sends “Paging Request ”to the MS via the appropriate BSS.
If the mobile is powered on, and in the service area, the MS responds and requests a dedicated control channel from the BSS. Once the air interface signaling link is established, the dedicated control channel carries the “Paging Response” to the BSS which relays it to the VLR via the MSC. Then the MS is authenticated and cipher mode is set. Of course it’s optional by the operator.
The servicing MSC will then transfer the short message to the MS. The MS acknowledges this and sends “Short_Message_Ack” to the MSC. The servicing MSC then responds to the gateway MSC using the message “MT_Forward_SM_Ack” and in turn the gateway MSC sends acknowledgement to the SMC in response to the message “Short_Message”. Hereto, the sequence is ended.
Ok, let’s see the sequence for MT transfer several messages. At first it’s same to the sequence for one message, a message “short message” arrives at a gateway-MSC. The MS to be called is identified by its MSISDN. The GMSC will then request routing information from the HLR using the message “SRI_for_SM”, still tagged by the MS’s MSISDN. The HLR then responds with the message “SRI_for_SM_ACK” which includes the VLR number. This information will enable the GMSC to identify the MSC to which the “Forward_SM” must be directed. Actually, in the message “MT_Forward_SMS”, there is a flag for more message, in this case, this flag is true. If only one message will be transferred, the flag is false.
The “visitor” MSC then requests call set-up information from the VLR, the VLR responds with “page” message. The MSC then sends “Paging Request” to the MS via the BSS.
The MS responds and requests a dedicated control channel from the BSS. Once the air interface signaling link is established, the dedicated control channel carries “Paging Response” to the BSS which relays it to the VLR via the MSC. The MS is then authenticated and cipher mode is set. Of course, it can be optional by the operator.
Then the MSC transfers the short message to the MS through the BSS. Once the MS sends the acknowledgement to the servicing MSC, the MSC will then respond to the message “MT_Forward_SM” to the gateway MSC which in turn sends response to the SMC. Now one message has been transferred to the MS.
Then the SMC sends the second message to the gateway MSC. The gateway MSC will transfer the message via “MT_Forward_SM” to the servicing MSC without request routing information to the HLR. The “visitor” MSC then sends the message to the MS. Once the MS responds, the MSC sends acknowledgement to the gateway MSC using the message “MT_Forward_SM_Ack”. In turn the gateway MSC responds to the SMC. If the flag in the message “MT_Forward_SM” is false, after the message is received by the MS, the sequence for several messages is closed.
Ok, after the basic SMS sequence, let’s answer a question. What is the sequence when the originating subscriber sets the wrong SC No. in the mobile station.
From the MO SMS sequence, we know, after the establishment of the air interface signaling link and authentication, the MS sends “RP_MO_Data” to the MSC. The MSC will then transfer the short message to the interworking MSC, tagged with SMC number. The SMC number is set on the mobile, and sent from the mobile to the network. This SMC is the home SMC of the mobile. If the mobile set the wrong number, and if the number is other SMC number, then the gateway MSC sends short message to the other SMC. In this SMC, the mobile does not exist, so the SMC returns the acknowledgement with the cause of illegal subscriber, and then “Send Not Successfully" is displayed on the mobile. Ok, that’s all for the fourth part.
1.5 Handover Sequence
Ok, now let’s study the last section, handover sequence. In this section, the content consists of two parts, inter-BSS handover sequence and inter-MSC handover sequence.
At first, I will explain the inter-BSS handover sequence. The MS is in the conversation state and is continuously compiling measurements both current transmission and broadcast control channels of up to sixteen surrounding cells. The measurements from the six best cells are reported back to the BSS, every 480ms.
When a handover is required, due to low Receive Signal Strength Indication (RSS) or poor signal quality the existing “originating” BSS(oBSS) notifies the MSC using message “Handover Required”.
The target or the new BSS (nBSS) is alerted with the message “Handover Request” tagged with the TMSI or IMSI.
Then the new BSS allocates a Handover Reference Number which is used to determine whether the correct mobile gains access to the air-interface channel which it allocates, and acknowledges the MSC’s request with “Handover Request Ack.” This is tagged with the HO Reference number. The nBSS assigns a traffic channel.
The MSC, via the oBSS orders the MS to change to the new channel with the message “Handover Command” on FACCH.
There is an information interchange between nBSS and MS. This uses the FACCH channel but an access burst is used. The messages and information carried depend upon the type of handover being performed.
Once all necessary information has been transferred the message “Handover Complete” is sent to the MSC.
The MSC now sends a “Clear Command” to the oBSS, this frees the radio resources for another MS. The channel is not cleared until this point incase nBSS can not accommodate the MS being handed over.
The MS, still in the conversation mode, then continues to prepare periodic measurement reports and sends them to the nBSS.
Ok, after the inter-BSS handover sequence, we’ll study inter-MSC handover sequence. There are two types of inter-MSC handover sequence, basic inter-MSC sequence and subsequent inter-MSC sequence.
In the inter-MSC handover , here devoted to introduce the sequence between different MSC/VLR. When the MSCA receives the “Handover required” from the oBSS, the MSCA finds that the new cell belongs to the MSCB, then sends the “Prepare Handover” message to the MSCB. This request may optionally contain an indication that a handover number allocation is not required, target Cell Id, for compatibility reasons, and all information required by MSCB to allocate the necessary radio resources.
Then the MSCB sends “Allocate HandoverNo.” Message to the VLRB.
The VLRB responds with the message “Send Handover Report” which handover number is included in.
Then the MSCB transfers the handover number to the MSCA with the message “Prepare Handover Ack”.
The MSCB sends the acknowledgement to the VLRB. The handover number will be reserved until a “Send Handover Report” confirmation is received from MSC-B.
The MSCA then sends the message “Initial Address Message” tagged with handover number allocated by VLRB. The MSCB sends the “Address Complete Message” and “Answer” to the MSCA. The connection between the MSCA and MSCB has been established.
Optionally MSC-A can receive, after a “Prepare Handover” confirmation, a “Process Access Signaling” indication containing BSSAP information. When the connection has been established between the MS and MSCB, MSCA will be informed by a “Send End Signal” indication. If required, the MSCA requests the “Forward Access Signaling” request containing the information to be transferred to the A-interface of MSCB (e.g. call control information). The “Forward Access Signaling” is a non-confirmed service. The “Forward Access Signaling” is composed in such a way that the information can be passed transparently to the A-interface for call control and mobility management information. Any response received in MSC-B from the A-interface that should be brought to MSC-A will require a new independent request from the MSCB to the MSCA by invoking a Process Access Signaling request.
When the conversation is ended, the MSCA sends the “Release” message to the MSCB and MSCB responds with the message “Release Complete”. When MSCA wants to clear the connection with BSSB, and then sends the “Send End Signal” response to MSCB to close the sequence.
After the release of the resources for the call and handover, the inter-VLR location update sequence is followed.
Ok, let’s see the subsequent inter-MSC handover sequence. The procedure is used when the MSCB has decided that a call is to be handed over to another MSC (either back to the controlling MSC (MSCA) or to a third MSC (MSCC)). When MSCA receives a “Prepare Subsequent Handover” request, it will start the procedure of handing the call over to a third MSC (MSCC), or back to the controlling MSC (MSCA). In this example, handover to the MSCC. The controlling MSC(MSCA) sends the “Prepare Handover” to the MSC/VLRC, and MSC/VLRC responds with the handover number in the acknowledgement message. Then the MSCA responds to the MSCB using the message “Prepare Subsequent Handover_Ack”.
The MSCA then sends the message “Initial Address Message” tagged with handover number allocated by the VLRC. The MSCC sends the “Address Complete Message” and “Answer” to the MSCA. The connection between the MSCA and MSCC has been established.
And then the MSCA will release the connection with the MSCB. The MSCA sends “Release” message to the MSCB, and MSCB responds with “Release Complete” message.
If required , MSCC invokes the “Process Access Signaling” request containing the information received on the A-interface that should be transferred to MSCA (e.g. call control information). “Process Access Signaling” is a non-confirmed service and any response from MSC-A will require a “Forward Access Signaling” request.
When the conversation is ended, the MSCA sends the “Release” message to MSCC and MSCC responds with the message “Release Complete”.
Actually, after the establishment of the connection between the MSCC and MSCA, the MSCC sends the message “Send End Signal” to the MSCA. If the new handover procedure towards MSCC (or MSCA) is successful, the MSCA will request the release of the MSC-B by sending the “Send End Signal” confirmation.
At last, a location update sequence is followed.
Ok, hereto, we have finished the study of the communication flow in the GSM system. Finally, let’s make a summary. In this course, the GSM security management was introduced at first, it consists of the authentication, ciphering, TMSI reallocation and equipment identification. It is usually used in the other sequence. Then the explanation for the GSM basic call sequence, it is the most important sequence in the GSM system. In the third section, the location update sequence was introduced. And then an introduction to the basic SM sequence. At last a brief introduction to the handover sequence. Actually, for each kind of sequence, there are many abnormal communication flows. If you want to know more information, please refer to the relative specifications.
Thank you
