oma gsm communication flow

M900/M1800M900/M1800GSM SystemGSM System

Lecturer: Wang Hui

OMA000003 GSM Communication Flow

Handover Sequence

SMS Sequence

Location Update Sequence

GSM Basic Call Sequence

CONTENTCONTENT

GSM Security Management

GSM Security ManagementGSM Security Management

Authentication and Ciphering Sequence

TMSI Reallocation

Equipment Identification

AuthenticationAuthentication

Authentication may be Authentication may be executed during setup, executed during setup, location updating and location updating and supplementary servicessupplementary services

Authentication SequenceAuthentication Sequence

KI （ M)KI （ N)

IMSI(m)

RANDGENERATOR

A8 A3KI(IMSI)

IMSIBUFFER

RAND

RANDRANDRAND

KC

12

5

KC KC

KC

SRES

SRESSRES

SRES

TEMPDATA

AUC

HLR/AUC

HLR

AUTH REQ

RAND

KCSRES

RAND A8

A3SRES

EQUAL

CKSN

KC BSS

KI(IMSI)

VLR

SIM

RAND 16byte KI 16byte kc 8byte SERS 4byte CKSN low 3bits of 1byte

IMSI(n)

SRESKI I MSI +RAND（） A3KI ( I MSI )+RAND A8 KCM+KC A5 KC(M)(MS/ BSS)KC(M)+KC MA5

(MS/ BSS)

Authentication and Ciphering SequenceAuthentication and Ciphering Sequence

HLRMS BSS MSC VLR1 Pre-send Triples to VLR

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>


1 Pre-send Triples to VLR

2 AuthenticateAuthentication Request

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>

< SDCCH>(SRES)




3 Authenticate Response

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>

< SDCCH>(SRES)




3 Authenticate Response

4 Start Ciphering

HLRMS BSS MSC VLR

5 Cipher Mode Command Cipher Mode Complete

<SDCCH>

< SDCCH>



RAND

RAND< SDCCH>

3 Authenticate Response < SDCCH>(SRES)

4 Start Ciphering


TMSI ReallocationTMSI Reallocation

MS VLR

Location Update Req

Location Update Acc

TMSI Reallocation Comp

(TMSI)

Equipment IdentificationEquipment Identification

MS BSS MSC VLR HLR PSTN1 Equipment ID

Request< SDCCH>

EIR


Request< SDCCH>

2 ID Response< SDCCH>

IMEI)

EIR



Request< SDCCH>

2 ID Response< SDCCH>

IMEI)

3 Check IMEI

Check IMEIResponse

EIR


GSM Basic Call SequenceGSM Basic Call Sequence

Mobile to Land Sequence

Land to Mobile Sequence

Mobile Initiated Call Clearing Sequence


The process for calling MS and called MS are two independent flow. The calling party begins with channel request and ends with TCH assignment competition. In general, the calling party includes following several stages: access process, authentication and ciphering process, TCH assignment process. So, we take the sequence from mobile to land as example, in this sequence, we mainly devote to the calling party.

Mobile to Land SequenceMobile to Land SequenceMS BSS MSC VLR HLR

1 CHANNEL REQUEST <RACH>

<AGCH>DCCH ASSIGNSIGNALING LINK ESTABLISHED

PSTN

MS BSS MSC VLR HLR1 CHANNEL REQUEST <RACH>

<AGCH>DCCH ASSIGN

<SDCCH>

SIGNALING LINK ESTABLISHED

2 REQ. FOR SERVICECRCC

PSTN

Mobile to Land SequenceMobile to Land Sequence


<AGCH>DCCH ASSIGN

<SDCCH>



3 AUTHENTICATION

SET Cipher MODE

PSTN



<AGCH>DCCH ASSIGN

<SDCCH>



3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>

Call Info

PSTN

SFOC



<AGCH>DCCH ASSIGN

<SDCCH>



3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>

Call Info5 EQUIP. ID REQ.

PSTN

SFOC



<AGCH>DCCH ASSIGN

<SDCCH>



3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>


6 COMPLETE CALL

CALL PROCEEDING <SDCCH>

PSTN

SFOC



7 ASSIG. COMMAND <SDCCH>

ASSIG. COMPLETEcircuit< FACCH>

MS BSS MSC VLR HLR PSTN

7 ASSIG. COMMAND<SDCCH>

ASSIG. COMPLETE

Address Complete(ACM)

Alerting

circuit< FACCH>

Initial and Final Address 8 Message (IFAM)

MS hears ring tone from land phone

<FACCH>




ASSIG. COMPLETE


Alerting

<FACCH>9 Answer (ANS)Connect

circuit< FACCH>



<FACCH>

Ring tone stops




ASSIG. COMPLETE


Alerting

<FACCH>9 Answer (ANS)Connect

10 Connect Acknowledge<FACCH>

circuit< FACCH>

<TCH>



<FACCH>

Ring tone stops

HELLO!


BILLING STARTS


QuestionQuestion

What happens when the calling MS activates the SS of BAOC?

AnswerAnswerMS BSS MSC VLR HLR


<AGCH>DCCH ASSIGN

<SDCCH>



3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>


6 COMPLETE CALL

CALL PROCEEDING <SDCCH>

PSTN

SFOC

Call Barred


For the called party, the flow for the called party begins when MSC sends paging command to the called party, ends when two party start talk. In general, this call flow includes several stages: access process, authentication and ciphering process, TCH assignment process, talk process, release process.

Land to Mobile SequenceLand to Mobile SequenceMS BSS MSC VLR HLR GMSC

( MSISDN)

Initial and Final 1 Address Message

PSTN

MS BSS MSC VLR HLR GMSC

( MSISDN)

( MSISDN) (IMSI)


PSTN

2 Send Routing Info

Land to Mobile SequenceLand to Mobile Sequence


( MSISDN)

( MSISDN) (IMSI)

(MSRN)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack

Initial and Final Address Message



( MSISDN)

( MSISDN) (IMSI)

(MSRN)

(MSRN)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack


4 Send Info For I/C Call Setup



( MSISDN)

( MSISDN) (IMSI)

(MSRN)

(MSRN)

( LAI & TMSI)(TMSI)(TMSI)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack


4 Send Info For I/C Call Setup

5 PagePaging Request

<PCH>


6 Channel Request

DCCH Assign

Signaling Link Established

Page Response

*Authentication

<RACH>

<AGCH>

<SDCCH>

<SDCCH>

(TMSI)(TMSI & Status)

(Status)

CR

Land to Mobile SequenceLand to Mobile SequenceMS BSS MSC VLR HLR GMSC PSTN

6 Channel Request

DCCH Assign


Page Response

*Authentication

7 Complete CallSetup

<RACH>

<AGCH>

<SDCCH>

<SDCCH>


(Status)

<TMSI><SDCCH>

CR

MS BSS MSC VLR HLR GMSC PSTN


6 Channel Request

DCCH Assign


Page Response

*Authentication

7 Complete CallSetup

8 Call Confirmation

<RACH>

<AGCH>

<SDCCH>

<SDCCH>


(Status)

<TMSI><SDCCH>

<SDCCH>

CR


Ring Tone at the land phone


(channel) (circuit)<FACCH>

9 Assignment Command

Assignment Complete

Alert<TCH>

Address Complete

Land to Mobile SequenceLand to Mobile SequenceMS BSS MSC VLR HLR GMSC PSTN


<FACCH>

(channel) (circuit)<FACCH>

9 Assignment Command

Assignment Complete

Alert<TCH>

<FACCH>10 Connect

Connect ACK ANS

<TCH>

Hello...

Address Complete


Billing starts


Ringing stops at land phoneSubscriber

picks up


QuestionsQuestions

Please give the sequence:1.The called MS is powered off.2.The called MS activates the CFU to a PSTN No.3.The called MS has been barred all incoming call.4.The Called MS are not known at HLR

1. The called MS is powered off


( MSISDN)

( MSISDN) ( IMSI)


2 Send Routing Info

3 Routing Info Ack

PSTN

Subscriber Absent

The Land hears the announcement of mobile is powered off

AnswersAnswers

2. The called MS activates the CFU to a PSTN No.

(MSISDN)

(MSISDN)

CFN4 IFAM

AnswersAnswers



2 Send Routing Info

3 Routing Info Ack

AnswersAnswers3. The called MS has been barred all incoming call.

Call Barred


(MSISDN)

(MSISDN)


2 Send Routing Info

3 Routing Info Ack

PSTN

AnswersAnswers4. The Called MS are not known at HLR

Unknown Subscriber


(MSISDN)

(MSISDN)


2 Send Routing Info

3 Routing Info Ack

PSTN

MS BSS MSC VLR HLR

<FACCH>

<FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

Mobile Initiated Call Clearing SequenceMobile Initiated Call Clearing Sequence

MS BSS MSC VLR HLR

<FACCH>

<FACCH>

<FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

2 PSTN Release CompleteMobile Release Complete

MS-MSC Signalling Released


MS BSS MSC VLR HLR

<FACCH>

<FACCH>

<FACCH>

<FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

2 PSTN Release CompleteMobile Release Complete

MS-MSC Signalling Released

3 Clear Command

Channel Release



<FACCH>

<FACCH>4 DISC

UA

Clear Complete



<FACCH>

<FACCH>4 DISC

UA

Clear Complete

5 RLSD

Release Complete


Brief Introduction to Location Update

Location Update SequenceLocation Update Sequence

Several Typical Location Update Sequences

The types of Location Update :

Brief Introdution to Location UpdateBrief Introdution to Location Update

Periodic Location UpdatePeriodic Location UpdateIMSI Attach/DetachIMSI Attach/DetachNormal Location UpdateNormal Location Update

Several Typical Location Update SequencesSeveral Typical Location Update Sequences

Intra-VLR Location Update Sequence

Inter-VLR Location Update Sequence

Intra-VLR Location Update SequenceIntra-VLR Location Update SequenceMS BSS MSC VLR

<RACH> 1 Channel Request<AGCH>DCCH Assign

HLR

Only sent to HLR if this is the first time the MS has Location Updated in this VLR



2 Location Update Request <SDCCH>

HLR





LAI & TMSI 3 Authentication & Ciphering

HLR






4 Forward New TMSILocation Update Accept

<TMSI>

<SDCCH><TMSI>

HLR







<TMSI>

<SDCCH><TMSI>

5 TMSI Reallocate CompleteTMSI ACK

<SDCCH>

HLR







<TMSI>

<SDCCH><TMSI>

5 TMSI Reallocate CompleteTMSI ACK

<SDCCH>

6 Clear Command

Clear Complete

<SDCCH>

<SDCCH>

HLR


Location Update via IMSI

Location Update via TMSI

Inter-VLR Location Update SequenceInter-VLR Location Update Sequence

<RACH>1 Channel Request <AGCH>

DCCH Assign

MS BSS MSC VLRn HLR VLRo

Inter-VLR Location Update Via IMSIInter-VLR Location Update Via IMSI


DCCH Assign

2 Location Update Request<SDCCH>



LAI & IMSI


DCCH Assign


LAI & IMSI

Authentication & Ciphering

MS BSS MSC VLRn HLR

3 Authentication Para. Req

VLRo

.



DCCH Assign


LAI & IMSI


MS BSS MSC VLRn HLR


4 Location Update Request

Insert Subscriber DataInsert Subscriber Data Ack

Location Update accept

VLRo



DCCH Assign


LAI & IMSI


MS BSS MSC VLRn HLR





VLRo

5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI

Location Update Accept

TMSI Reallocate Complete

TMSI ACK

Inter-VLR Location Update Via IMSIInter-VLR Location Update Via IMSIMS BSS MSC VLRn HLR VLRo

6 Forward New TMSI



TMSI ACK

7 Clear Command

Clear Complete

Inter-VLR Location Update Via IMSIInter-VLR Location Update Via IMSIMS BSS MSC VLRn HLR VLRo


DCCH Assign


Inter-VLR Location Update Via TMSIInter-VLR Location Update Via TMSI


DCCH Assign




LAI & TMSI


DCCH Assign


LAI & TMSI


.



3 Provide Identification

provide Identification Ack

TMSI&LAIO

TMSI,IMSI,KC,R,S)


DCCH Assign


LAI & TMSI




3 Provide Identification

provide Identification Ack

TMSI&LAIO

TMSI,IMSI,KC,R,S)




Inter-VLR Location Update Via TMSIInter-VLR Location Update Via TMSIMS BSS MSC VLRn HLR VLRo

5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI



TMSI ACK


5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI



TMSI ACK

7 Clear Command

Clear Complete


5 Cancellocation

Cancellocation Ack.

The mobile originated short message transfer procedure is separated from mobile terminated. The basic short message sequence consists of two parts: MO SMS Transfer and MT SMS Transfer.

Short Message SequenceShort Message Sequence

MS BSS MSC VLR InterworkingMSC


<AGCH>DCCH ASSIGN

SIGNALING LINKESTABLISHED

SC

MO SMS TransferMO SMS Transfer



<AGCH>DCCH ASSIGN

<SDCCH>


2 REQ. FOR SERVICE CR

CC

SC




<AGCH>DCCH ASSIGN

<SDCCH>


2 REQ. FOR SERVICE CR

CC

3 AUTHENTICATION

SET Cipher MODE

SC




<AGCH>DCCH ASSIGN

<SDCCH>


2 REQ. FOR SERVICECR

CC

3 AUTHENTICATIONSET Cipher MODE

SC

4 RP_MO_DATA

SIF_MO_SMSSIF_MO_SMS-Ack


5 MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

(SC_No.)

MO SMS TransferMO SMS TransferMS BSS MSC VLR Interworking

MSCSC

5 MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

6 RP_ACK

(SC_No.)

MO SMS TransferMO SMS TransferMS BSS MSC VLR Interworking

MSCSC

"Send Successfully" is displayed on the mobile

MT SMS TransferMT SMS Transfer

For Forwarding a Short Message

For Forwarding Several Short Message

MS ServicingMSC VLR HLR Gateway

MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

MT SMS Transfer (A Message)MT SMS Transfer (A Message)


MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMSPagePage



MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMSPagePage

3 Paging Response

Authentication and Ciphering



MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMSPage

Page Request3 Paging Response


4 Short_Message

Short_Message_Ack

MT_Forward_SM_AckShort_Message_Ack



MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

MT SMS Transfer (Several Messages)MT SMS Transfer (Several Messages)

MT_Forward_SM(The More message To

Send Flag is True)


MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM



Send Flag is True)

2 SIF_MT_SMS PagePaging Request


MSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM



Send Flag is True)

2 SIF_MT_SMS PagePaging Request

3 Paging Response



MSC SC4 Short_Message

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack



MSC SC4 Short_Message

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack


5 Short_Message

MT_Forward_SM


Send Flag is False)

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack

Short_Message

What is the What is the sequence when sequence when the originating the originating subscriber sets subscriber sets the wrong SC the wrong SC No. in the No. in the mobile station.mobile station.

QuestionQuestion

MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

RP_ACK

(SC_No.)


SC

"Send Not Successfully" is displayed on the mobile

AnswerAnswer

Illegal Subscriber

Illegal Subscriber

Handover SequenceHandover Sequence

Inter - BSS handover sequenceInter - MSC handover sequence

MS oBSS nBSS MSC

1 Periodic Measurement 1 Periodic Measurement reportsreports

<SACCH>

Inter - BSS Handover Sequence Inter - BSS Handover Sequence

MS oBSS nBSS MSC

1 Periodic Measurement reports

<SACCH>

2 Handover required2 Handover required


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request3 Handover Request TMSI cct. code


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

4 Handover REQ ACK4 Handover REQ ACK

TMSI cct. code

HO Ref. No.


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command 5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>

6 Information Interchange 6 Information Interchange <FACCH>


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>

6 Information Interchange <FACCH>

7 Handover Complete 7 Handover Complete


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


7 Handover Complete

8 Clear Command 8 Clear Command


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


7 Handover Complete

8 Clear Command

9 Periodic Meas. reports9 Periodic Meas. reports <SACCH>


Inter - MSC Handover Sequence Inter - MSC Handover Sequence

Basic Inter-MSC handover

Subsequent Inter - MSC handover

MSCA MSCB VLRB

1 PrepareHandover1 PrepareHandover

2 Allocate HandoverNo.

4 PrepareHandover_Ack

5 Send HO Report_Ack

6 InitialAddress Message

3 Send Handover Report

Address Completed

Answer

Basic Inter-MSC handoverBasic Inter-MSC handover

MSCA MSCB VLRB

1 PrepareHandover

2 Allocate HandoverNo. 2 Allocate HandoverNo.



6 Initial Address Message


Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover





3 Send Handover Report3 Send Handover Report

Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover


4 PrepareHandover_Ack4 PrepareHandover_Ack


6 InitialAddress Message


Address Completed

Answer


MSCA MSCB VLRB1 PrepareHandover



5 Send HO Report_Ack5 Send HO Report_Ack



Address Completed

Answer


MSCA MSCB VLRB1 PrepareHandover




6 Initial 6 Initial Address MessageAddress Message


Address CompletedAddress Completed

AnswerAnswer


MSC/VLRA MSC/VLRB

7 Process Access Signal7 Process Access Signal

Send End SignalSend End Signal

Forward Access SignalForward Access Signal

Process Access SignalProcess Access Signal

8 Clear Forward

Release Guard

Send End Signal_Ack


MSC/VLRA MSC/VLRB

7 Process Access Signal

Send End Signal

Forward Access Signal

Process Access Signal

8 Release8 Release

Release CompleteRelease Complete

Send End Signal_AckSend End Signal_Ack


MSC/VLRA MSC/VLRB HLRA

9 SendAuth. Info9 SendAuth. Info

Auth InfoAuth InfoUpdate LocationUpdate Location

InsertSubs.DataInsertSubs.Data

InsertSubs.Data_AckInsertSubs.Data_Ack

UpdateLocation_AckUpdateLocation_Ack

Cancellocation

Cancellocation_Ack



1 PrepareSubsequentHOV1 PrepareSubsequentHOVPrepareHandoverPrepareHandover

PrepareHandoverPrepareHandover

PrepareSubsequentHOVPrepareSubsequentHOV2 Initial and FinalAddress MessageAddress Complete

Answer

3 RLSRLC

Subsequent Inter-MSC Subsequent Inter-MSC handoverhandover


1 PrepareSubsequentHOVPrepareHandover

PrepareHandoverPrepareSubsequentHOV

2 Initial and Final2 Initial and FinalAddress MessageAddress MessageAddress CompleteAddress Complete

AnswerAnswer

3 RLSRLC



1 PrepareSubsequentHOVPrepareHandover

PrepareHandover

PrepareSubsequentHOV2 Initial and FinalAddress Message

Address Complete

Answer

3 RLS3 RLSRLCRLC


MSC/VLRA MSC/VLRB MSC/VLRC


ForwardAccessSignalForwardAccessSignal

4 ProcessAccessSignal4 ProcessAccessSignal

7 Location Update

SendEndSignal_Ack

6 SendEndSignal

5 RLS

RLC


Subsequent Inter-MSC handover

5 RLS5 RLS

RLCRLC

7 Location Update

SendEndSignal_Ack

6 SendEndSignal

4 ForwardAccessSignal

ProcessAccessSignal


7 Location Update

SendEndSignal_AckSendEndSignal_Ack6 SendEndSignal6 SendEndSignal



ProcessAccessSignal

5 RLS

RLC



ProcessAccessSignal

5 RLS

RLC

7 Location Update7 Location Update

SendEndSignal_Ack

6 SendEndSignal


SummarySummary

1. GSM Security Mangement

2. GSM Basic Call Sequence

3. Location UpdateSequence

4. SMS Sequence

5. HandoverSequence

oma gsm communication flow

Documents