Misplaced Pages

#249750

63-572: The network provides mobility management , session management and transport for IP packet services in GSM and WCDMA networks. The core network also provides support for other functions such as billing and lawful interception . It was also proposed, at one stage, to support packet radio services in the US D-AMPS TDMA system, however, in practice, all of these networks have been converted to GSM so this option has become irrelevant. PRS module

126-410: A GSM system that carries out call out and mobility management functions for mobile phones roaming on the network of base stations . It is owned and deployed by mobile phone operators and allows mobile devices to communicate with each other and telephones in the wider public switched telephone network (PSTN). The architecture contains specific features and functions which are needed because

189-414: A Node B . A group of base stations is named a location area, or a routing area . The location update procedure allows a mobile device to inform the cellular network whenever it moves from one location area to the next. Mobiles are responsible for detecting location area codes (LAC). When a mobile finds that the location area code is different from its last update, it performs another update by sending to

252-471: A Radio Network Controller (RNC) in UMTS. The BSC / RNC is the intelligence behind the base stations; it handles allocation of radio channels, receives measurements from the mobile phones, and controls handovers between base stations. Each location area has an assigned unique identifier, made up of numbers, called a "location area code" (LAC). The LAC is broadcast by each base station at regular intervals. Within

315-462: A TMSI may be set by a VLR, SGSN, or MME. In the least-precise case, TMSI is randomly assigned by the VLR to every mobile in the area, the moment it is switched on, in order to support identity confidentiality. The number is local to a location area, and so it has to be updated each time the mobile moves to a new geographical area. The VLR, SGSN, and MME must be capable of correlating an allocated TMSI with

378-534: A chance to notify the network with an IMSI detach and then switched on right after it has been turned off. Considering the fact that the mobile is still associated with the Mobile Switching Center/ Visitor Location Register (MSC/VLR) of the current location area, there is no need for any kind of IMSI attachment procedures to be done. There are several reasons why a mobile may provide updated location information to

441-502: A common physical connection with other reference points). Some of these names can be seen in the network structure diagram on this page. Mobility management Mobility management is one of the major functions of a GSM or a UMTS network that allows mobile phones to work. The aim of mobility management is to track where the subscribers are, allowing calls, SMS and other mobile phone services to be delivered to them. A GSM or UMTS network, like all cellular networks ,

504-418: A communication terminal or else just by using the subscriber identity in the visited network. Roaming is technically supported by a mobility management, authentication , authorization and billing procedures. A "location area" is a set of base stations that are grouped together to optimize signaling. Typically, tens or even hundreds of base stations share a single Base Station Controller (BSC) in GSM, or

567-548: A location area, each base station is assigned a distinct "cell identifier" (CI) number, see also Cell Global Identity . If the location areas are large and moderately populated, there will likely be a high number of mobiles operating simultaneously, resulting in very high paging traffic. This is due to the fact that every paging request has to be broadcast to every base station in the location area. Ultimately, this wastes bandwidth and power on mobile devices by requiring them to listen for broadcast messages too often. Similarly if on

630-562: A mobile wants to use GPRS, it must first attach and then activate a PDP context . This allocates a PDP context data structure in the SGSN that the subscriber is currently visiting and the GGSN serving the subscriber's access point. The data recorded includes Within the GPRS core network standards, there are a number of interfaces and reference points (logical points of connection that probably share

693-410: A rule, these are stolen or lost devices. Mobile operators rarely use EIR capabilities to block devices on their own. Usually blocking begins when there is a law in the country, which obliges all cellular operators of the country to do so. Therefore, in the delivery of the basic components of the network switching subsystem (core network) is often already present EIR with basic functionality, which includes

SECTION 10

#1732787338250

756-446: A specific service number, sending SMS to a specific service number, and all Internet traffic is redirected to a specific landing page. This is achieved by the fact that EIR can send commands to several MNO systems (HLR, PCRF , SMSC , etc.). The most common suppliers of individual EIR systems (not as part of a complex solution) are the companies BroadForward, Mahindra Comviva, Mavenir, Nokia, Eastwind. Connected more or less directly to

819-470: A specific user, it checks if the user is active. If it is, the GGSN forwards the data to the SGSN serving the mobile user, but if the mobile user is inactive, the data is discarded. In the other direction, mobile-originated packets are routed to the right network by the GGSN. The GGSN is the anchor point that enables the mobility of the user terminal in the GPRS/ UMTS networks. In essence, it carries out

882-537: A time. The HLRs store details of every SIM card issued by the mobile phone operator. Each SIM has a unique identifier called an IMSI which is the primary key to each HLR record. Another important item of data associated with the SIM are the MSISDNs, which are the telephone numbers used by mobile phones to make and receive calls. The primary MSISDN is the number used for making and receiving voice calls and SMS, but it

945-614: A ‘whitelisted’ response to all CheckIMEI and the ability to fill IMEI blacklist, which will be given a ‘blacklisted’ response. When the legislative framework for blocking registration of devices in cellular networks appears in the country, the telecommunications regulator usually has a Central EIR ( CEIR ) system, which is integrated with the EIR of all operators and transmits to them the actual lists of identifiers that must be used when processing CheckIMEI requests. In doing so, there may be many new requirements for EIR systems that are not present in

1008-534: Is a database of the MSs ( Mobile stations ) that have roamed into the jurisdiction of the Mobile Switching Center (MSC) which it serves. Each main base transceiver station in the network is served by exactly one VLR (one BTS may be served by many MSCs in case of MSC in pool), hence a subscriber cannot be present in more than one VLR at a time. The data stored in the VLR has either been received from

1071-517: Is allowed to attach and proceed with GSM services. After successful authentication, the MSC sends the encryption key K c to the base station controller (BSC) so that all communications can be encrypted and decrypted. Of course, the mobile phone can generate the K c itself by feeding the same RAND supplied during authentication and the K i into the A8 algorithm. The AuC is usually collocated with

1134-406: Is also required of a stationary mobile that reselects coverage from a cell in a different location area, because of signal fade. Thus, a subscriber has reliable access to the network and may be reached with a call, while enjoying the freedom of mobility within the whole coverage area. When a subscriber is paged in an attempt to deliver a call or SMS and the subscriber does not reply to that page then

1197-468: Is an additional form of identification check performed on the serial number of the mobile phone described in the EIR section below, but this is not relevant to the AuC processing. Proper implementation of security in and around the AuC is a key part of an operator's strategy to avoid SIM cloning . The AuC does not engage directly in the authentication process, but instead generates data known as triplets for

1260-528: Is an open standards driven system. The standardization body is the 3GPP . GPRS Tunnelling Protocol is the defining IP -based protocol of the GPRS core network. Primarily it is the protocol which allows end users of a GSM or WCDMA network to move from place to place while continuing to connect to the Internet as if from one location at the Gateway GPRS support node (GGSN) . It does this by carrying

1323-412: Is available in 3GPP TS 23.205. The term Circuit switching (CS) used here originates from traditional telecommunications systems. However, modern MSS and MGW devices mostly use generic Internet technologies and form next-generation telecommunication networks . MSS software may run on generic computers or virtual machines in cloud environment. The MSC connects to the following elements: Tasks of

SECTION 20

#1732787338250

1386-437: Is available. Roaming is one of the fundamental mobility management procedures of all cellular networks . Roaming is defined as the ability for a cellular customer to automatically make and receive voice calls, send and receive data, or access other services, including home data services, when travelling outside the geographical coverage area of the home network , by means of using a visited network. This can be done by using

1449-407: Is basically a radio network of individual cells, known as base stations. Each base station covers a small geographical area which is part of a uniquely identified location area . By integrating the coverage of each of these base stations, a cellular network provides a radio coverage over a much wider area. For GSM, a base station is called a base transceiver station (BTS), and for UMTS it is called

1512-457: Is normally a subdivision of a "location area". Routing areas are used by mobiles which are GPRS -attached. GPRS is optimized for "bursty" data communication services, such as wireless internet/intranet, and multimedia services. It is also known as GSM-IP (" Internet Protocol ") because it will connect users directly to Internet Service Providers The bursty nature of packet traffic means that more paging messages are expected per mobile, and so it

1575-530: Is one of two components of the GPRS PS domain. The GGSN together with the SGSN handle packet transmissions between the GPRS network and external packet-switched networks , such as the Internet or an X.25 network. From an external network's point of view, the GGSN is a router to a "sub-network", because the GGSN ‘hides’ the GPRS infrastructure from the external network. When the GGSN receives data addressed to

1638-471: Is possible for a SIM to have other secondary MSISDNs associated with it for fax and data calls. Each MSISDN is also a unique key to the HLR record. The HLR data is stored for as long as a subscriber remains with the mobile phone operator. Examples of other data stored in the HLR against an IMSI record is: The HLR is a system which directly receives and processes MAP transactions and messages from elements in

1701-434: Is used to authenticate the customer and generate a key for encrypting voice and data traffic, as defined in 3GPP TS 43.020 (03.20 before Rel-4). Development of A3 and A8 algorithms is considered a matter for individual GSM network operators, although example implementations are available. To encrypt Global System for Mobile Communications (GSM) cellular communications A5 algorithm is used. The Visitor Location Register (VLR)

1764-400: Is worth knowing the location of the mobile more accurately than it would be with traditional circuit-switched traffic. A change from routing area to routing area (called a "Routing Area Update") is done in an almost identical way to a change from location area to location area. The main differences are that the "Serving GPRS Support Node" ( SGSN ) is the element involved. The tracking area is

1827-593: The Home Location Register (HLR) , or collected from the MS. In practice, for performance reasons, most vendors integrate the VLR directly to the V-MSC and, where this is not done, the VLR is very tightly linked with the MSC via a proprietary interface. Whenever an MSC detects a new MS in its network, in addition to creating a new record in the VLR, it also updates the HLR of the mobile subscriber, apprising it of

1890-430: The Internet . The mobile switching center (MSC) is the primary service delivery node for GSM/CDMA, responsible for routing voice calls and SMS as well as other services (such as conference calls, FAX, and circuit-switched data). The MSC sets up and releases the end-to-end connection , handles mobility and hand-over requirements during the call and takes care of charging and real-time prepaid account monitoring. In

1953-632: The LTE counterpart of the location area and routing area. A tracking area is a set of cells. Tracking areas can be grouped into lists of tracking areas (TA lists), which can be configured on the User Equipment (UE). Tracking area updates are performed periodically or when the UE moves to a tracking area that is not included in its TA list. Operators can allocate different TA lists to different UEs. This can avoid signaling peaks in some conditions: for instance,

GPRS core network - Misplaced Pages Continue

2016-588: The UTRAN through the Iu interface. A SGSN is responsible for the delivery of data packets from and to the mobile stations within its geographical service area. Its tasks include packet routing and transfer, mobility management (attach/detach and location management), logical link management, and authentication and charging functions. The location register of the SGSN stores location information (e.g., current cell, current VLR ) and user profiles (e.g., IMSI , address(es) used in

2079-492: The gsm core network (typically when the phone is powered on). Once the authentication is successful, the HLR is allowed to manage the SIM and services described above. An encryption key is also generated that is subsequently used to encrypt all wireless communications (voice, SMS, etc.) between the mobile phone and the GSM core network. If the authentication fails, then no services are possible from that particular combination of SIM card and mobile phone operator attempted. There

2142-456: The EIR response to determine whether or not to allow the device to register or re-register on the network. Since the response of switching equipment to ‘greylisted’ and ‘unknown equipment’ responses is not clearly described in the standard, they are most often not used. Most often, EIR uses the IMEI blacklist feature, which contains the IMEI of the devices that need to be banned from the network. As

2205-619: The GGSN functionality moves to SAE gateway (with SGSN functionality working in MME ). The Serving GPRS Support Node (SGSN) is the node that is serving the MS / UE . The SGSN supports GPRS and/or UMTS . The SGSN keeps track of the location of an individual MS / UE and performs security functions and access control. The SGSN is connected to the GERAN base station system through the Gb or Iu interface and/or to

2268-544: The GSM address of the destination user. The readdressed packets are sent to the responsible SGSN. For this purpose, the GGSN stores the current SGSN address of the user and his or her profile in its location register. The GGSN is responsible for IP address assignment and is the default router for the connected user equipment (UE). The GGSN also performs authentication and charging functions. Other functions include subscriber screening, IP pool management and address mapping , QoS and PDP context enforcement. With LTE scenario

2331-772: The GSM core network are many other functions. The billing center is responsible for processing the toll tickets generated by the VLRs and HLRs and generating a bill for each subscriber. It is also responsible for generating billing data of roaming subscriber. The multimedia messaging service center supports the sending of multimedia messages (e.g., images, audio , video and their combinations) to (or from) MMS-bluetooth. The voicemail system records and stores voicemail. According to U.S. law, which has also been copied into many other countries, especially in Europe, all telecommunications equipment must provide facilities for monitoring

2394-537: The GSM mobile phone system, in contrast with earlier analogue services, fax and data information is sent digitally encoded directly to the MSC. Only at the MSC is this re-coded into an "analogue" signal (although actually this will almost certainly mean sound is encoded digitally as a pulse-code modulation (PCM) signal in a 64-kbit/s timeslot, known as a DS0 in America). There are various different names for MSCs in different contexts which reflects their complex role in

2457-408: The GSM network, for example, the location update messages received as mobile phones roam around. The HLR connects to the following elements: The main function of the HLR is to manage the fact that SIMs and phones move around a lot. The following procedures are implemented to deal with this: The authentication center (AuC) is a function to authenticate each SIM card that attempts to connect to

2520-499: The HLR, although this is not necessary. Whilst the procedure is secure for most everyday use, it is by no means hack proof. Therefore, a new set of security methods was designed for 3G phones. In practice, A3 and A8 algorithms are generally implemented together (known as A3/A8, see COMP128 ). An A3/A8 algorithm is implemented in Subscriber Identity Module (SIM) cards and in GSM network Authentication Centers. It

2583-712: The IMSI of the MS to which it is allocated. An MS may be allocated three TMSIs; one for services provided through the MSC (the TMSI), one for services provided through the SGSN (the packet-TMSI or P-TMSI), and one for the services provided the MME (the MME-TMSI or M-TMSI; a part of the GUTI). The network can also change the TMSI of the mobile at any time. And it normally does so, in order to avoid

GPRS core network - Misplaced Pages Continue

2646-447: The IP address of the GGSN which should serve the access point. At this point a PDP context can be activated. The packet data protocol (PDP; e.g., IP, X.25, FrameRelay) context is a data structure present on both the serving GPRS support node (SGSN) and the gateway GPRS support node (GGSN) which contains the subscriber's session information when the subscriber has an active session. When

2709-427: The MSC include: The home location register (HLR) is a central database that contains details of each mobile phone subscriber that is authorized to use the GSM core network. There can be several logical, and physical, HLRs per public land mobile network (PLMN), though one international mobile subscriber identity (IMSI)/MSISDN pair can be associated with only one logical HLR (which can span several physical nodes) at

2772-461: The MSC to use during the procedure. The security of the process depends upon a shared secret between the AuC and the SIM called the K i . The K i is securely burned into the SIM during manufacture and is also securely replicated onto the AuC. This K i is never transmitted between the AuC and SIM, but is combined with the IMSI to produce a challenge/response for identification purposes and an encryption key called K c for use in over

2835-601: The MSC. When a particular IMSI requests access to the GSM core network, the MSC sends the RAND part of the triplet to the SIM. The SIM then feeds this number and the K i (which is burned onto the SIM) into the A3 algorithm as appropriate and an SRES is calculated and sent back to the MSC. If this SRES matches with the SRES in the triplet (which it should if it is a valid SIM), then the mobile

2898-460: The TMSI is in paging a mobile. "Paging" is the one-to-one communication between the mobile and the base station. The most important use of broadcast information is to set up channels for "paging". Every cellular system has a broadcast mechanism to distribute such information to a plurality of mobiles. Size of TMSI is 4 octet with full hex digits but can't be all FF because the SIM uses 4 octets with all bits equal to 1 to indicate that no valid TMSI

2961-530: The UEs of passengers of a train may not perform tracking area updates simultaneously. On the network side, the involved element is the Mobility Management Entity (MME). MME configures TA lists using NAS messages like Attach Accept, TAU Accept or GUTI Reallocation Command. Visitor Location Register Network switching subsystem ( NSS ) (or GSM core network ) is the component of

3024-405: The air communications. The AuC connects to the following elements: The AuC stores the following data for each IMSI: When the MSC asks the AuC for a new set of triplets for a particular IMSI, the AuC first generates a random number known as RAND . This RAND is then combined with the K i to produce two numbers as follows: The numbers ( RAND , SRES, K c ) form the triplet sent back to

3087-413: The gateway function and the visited MSC function. However, some manufacturers design dedicated high capacity MSCs which do not have any base station subsystems (BSS) connected to them. These MSCs will then be the gateway MSC for many of the calls they handle. The visited MSC (V-MSC) is the MSC where a customer is currently located. The visitor location register (VLR) associated with this MSC will have

3150-419: The legacy EIR: Other functions may be required in individual cases. For example, Kazakhstan has introduced mandatory registration of devices and their binding to subscribers. But when a subscriber appears in the network with a new device, the network operation is not blocked completely, and the subscriber is allowed to register the device. To do this, there are blocked all services, except the following: calls to

3213-531: The mobile switching center, which provides circuit-switched calling mobility management, and GSM services to the mobile phones roaming within the area that it serves. The functionality enables split control between (signaling ) and user plane (bearer in network element called as media gateway/MG), which guarantees better placement of network elements within the network. MSS and media gateway (MGW) makes it possible to cross-connect circuit-switched calls switched by using IP, ATM AAL2 as well as TDM . More information

SECTION 50

#1732787338250

3276-403: The network, a location update request, together with its previous location, and its Temporary Mobile Subscriber Identity (TMSI). The mobile also stores the current LAC in the SIM card, concatenating it to a list of recently used LACs. This is done to avoid unnecessary IMSI attachment procedures in case the mobile has been forced to switch off (by removing the battery, for example) without having

3339-504: The network, all of these terms though could refer to the same MSC, but doing different things at different times. The gateway MSC (G-MSC) is the MSC that determines which "visited MSC" (V-MSC) the subscriber who is being called is currently located at. It also interfaces with the PSTN. All mobile to mobile calls and PSTN to mobile calls are routed through a G-MSC. The term is only valid in the context of one call, since any MSC may provide both

3402-407: The network. Whenever a mobile is switched on or off, the network may require it to perform an IMSI attach or IMSI detach location update procedure. Also, each mobile is required to regularly report its location at a set time interval using a periodic location update procedure. Whenever a mobile moves from one location area to the next while not on a call, a random location update is required. This

3465-480: The new location of that MS. If VLR data is corrupted it can lead to serious issues with text messaging and call services. Data stored include: The primary functions of the VLR are: EIR is a system that handles real-time requests to check the IMEI (checkIMEI) of mobile devices that come from the switching equipment (MSC, SGSN , MME ). The answer contains the result of the check: The switching equipment must use

3528-424: The other hand, there are too many small location areas, the mobile device must contact the network very often for changes of location, which will also drain the device’s battery. Therefore, it is important to strike a balance between the size of the location area and the number of mobile device users in the location area . The routing area is the packet-switched domain equivalent of the location area. A "routing area"

3591-448: The packet data network) of all GPRS users registered with it. Enhanced Data Rates for GSM Evolution (EDGE) specific SGSN functions and characteristics are: An access point is: When a GPRS mobile phone sets up a PDP context, the access point is selected. At this point an Access Point Name (APN) is determined This access point is then used in a DNS query to a private DNS network. This process (called APN resolution) finally gives

3654-459: The phones are not fixed in one location. The NSS originally consisted of the circuit-switched core network , used for traditional GSM services such as voice calls, SMS , and circuit switched data calls. It was extended with an overlay architecture to provide packet-switched data services known as the GPRS core network . This allows mobile phones to have access to services such as WAP , MMS and

3717-528: The role in GPRS equivalent to the home agent in Mobile IP . It maintains routing necessary to tunnel the protocol data units (PDUs) to the SGSN that services a particular mobile station (MS). The GGSN converts the GPRS packets coming from the SGSN into the appropriate packet data protocol (PDP) format (e.g., IP or X.25) and sends them out on the corresponding packet data network. In the other direction, PDP addresses of incoming data packets are converted to

3780-477: The subscriber from being identified, and tracked by eavesdroppers on the radio interface. This makes it difficult to trace which mobile is which, except briefly, when the mobile is just switched on, or when the data in the mobile becomes invalid for one reason or another. At that point, the global "international mobile subscriber identity" ( IMSI ) must be sent to the network. The IMSI is sent as rarely as possible, to avoid it being identified and tracked. A key use of

3843-547: The subscriber is marked as absent in both the MSC/VLR and the Home Location Register (HLR) (Mobile not reachable flag MNRF is set). The next time the mobile performs a location update, the HLR is updated and the mobile not reachable flag is cleared. The Temporary Mobile Subscriber Identity (TMSI) is the identity that is most commonly sent between the mobile and the network. Depending on the necessary precision,

SECTION 60

#1732787338250

3906-550: The subscriber's data from the subscriber's current serving GPRS support node (SGSN) to the GGSN which is handling the subscriber's session. Three forms of GTP are used by the GPRS core network. A GSN is a network node that supports the use of GPRS in the GSM core network. All GSNs should have a Gn interface and support the GPRS tunneling protocol. There are two key variants of the GSN, namely gateway GPRS support node and serving GPRS support node. The gateway GPRS support node (GGSN)

3969-408: The subscriber's data in it. The anchor MSC is the MSC from which a handover has been initiated. The target MSC is the MSC toward which a handover should take place. A mobile switching center server is a part of the redesigned MSC concept starting from 3GPP Release 4 . The mobile switching center server is a soft-switch variant (therefore it may be referred to as mobile soft switch, MSS) of

#249750