oma000003 gsm communication flow

M900/M1800M900/M1800GSM SystemGSM System

Lecturer: Wang Hui

OMA000003 GSM Communication Flow

Handover Sequence

SMS Sequence

Location Update Sequence

GSM Basic Call Sequence

CONTENTCONTENT

GSM Security Management

GSM Security ManagementGSM Security Management

Authentication and Ciphering Sequence

TMSI Reallocation

Equipment Identification

AuthenticationAuthentication

Authentication may be Authentication may be executed during setup, executed during setup, location updating and location updating and supplementary servicessupplementary services

Authentication SequenceAuthentication Sequence

KI （ M)KI （ N)

IMSI(m)

RANDGENERATOR

A8 A3KI(IMSI)

IMSIBUFFER

RAND

RANDRAND

RAND

KC

12

5

KC KC

KC

SRES

SRESSRES

SRES

TEMPDATA

AUC

HLR/AUC

HLR

AUTH REQ

RAND

KCSRES

RAND

A8 A3

SRES

EQUAL

CKSN

KC BSS

KI(IMSI)

VLR

SIM

RAND 16byte KI 16byte kc 8byte SERS 4byte CKSN low 3bits of 1byte

IMSI(n)

SRESKI I MSI +RAND（） A3

KI (I MSI )+RAND A8 KCM+KC A5 KC(M)

(MS/ BSS)

KC(M)+KC MA5(MS/ BSS)

Authentication and Ciphering SequenceAuthentication and Ciphering Sequence

HLRMS BSS MSC VLR1 Pre-send Triples to VLR

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>


1 Pre-send Triples to VLR

2 AuthenticateAuthentication Request

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>

< SDCCH>

(SRES)




3 Authenticate Response

HLRMS BSS MSC VLR

RAND

RAND< SDCCH>

< SDCCH>

(SRES)




3 Authenticate Response

4 Start Ciphering

HLRMS BSS MSC VLR

5 Cipher Mode Command

Cipher Mode Complete

<SDCCH>

< SDCCH>



RAND

RAND< SDCCH>

3 Authenticate Response < SDCCH>

(SRES)

4 Start Ciphering


TMSI ReallocationTMSI Reallocation

MS VLR

Location Update Req

Location Update Acc

TMSI Reallocation Comp

(TMSI)

Equipment IdentificationEquipment Identification

MS BSS MSC VLR HLR PSTN1 Equipment ID

Request< SDCCH>

EIR


Request< SDCCH>

2 ID Response< SDCCH>

IMEI)

EIR



Request< SDCCH>

2 ID Response< SDCCH>

IMEI)

3 Check IMEI

Check IMEIResponse

EIR


GSM Basic Call SequenceGSM Basic Call Sequence

Mobile to Land Sequence

Land to Mobile Sequence

Mobile Initiated Call Clearing Sequence


The process for calling MS and called MS are two independent flow. The calling party begins with channel request and ends with TCH assignment competition. In general, the calling party includes following several stages: access process, authentication and ciphering process, TCH assignment process. So, we take the sequence from mobile to land as example, in this sequence, we mainly devote to the calling party.

Mobile to Land SequenceMobile to Land Sequence

MS BSS MSC VLR HLR1 CHANNEL REQUEST <RACH>

<AGCH>DCCH ASSIGN

SIGNALING LINK ESTABLISHED

PSTN


<AGCH>DCCH ASSIGN

<SDCCH>


2 REQ. FOR SERVICECR

CC

PSTN



<AGCH>DCCH ASSIGN

<SDCCH>



CC

3 AUTHENTICATION

SET Cipher MODE

PSTN



<AGCH>DCCH ASSIGN

<SDCCH>



CC

3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>

Call Info

PSTN

SFOC



<AGCH>DCCH ASSIGN

<SDCCH>



CC

3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>

Call Info5 EQUIP. ID REQ.

PSTN

SFOC



<AGCH>DCCH ASSIGN

<SDCCH>



CC

3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>


6 COMPLETE CALL

CALL PROCEEDING <SDCCH>

PSTN

SFOC



7 ASSIG. COMMAND <SDCCH>

ASSIG. COMPLETEcircuit< FACCH>

MS BSS MSC VLR HLR PSTN

7 ASSIG. COMMAND<SDCCH>

ASSIG. COMPLETE

Address Complete(ACM)

Alerting

circuit< FACCH>

Initial and Final Address 8 Message (IFAM)

MS hears ring tone from land phone

<FACCH>




ASSIG. COMPLETE


Alerting

<FACCH>

9 Answer (ANS)Connect

circuit< FACCH>



<FACCH>

Ring tone stops




ASSIG. COMPLETE


Alerting

<FACCH>

9 Answer (ANS)Connect

10 Connect Acknowledge<FACCH>

circuit< FACCH>

<TCH>



<FACCH>

Ring tone stops

HELLO!


BILLING STARTS


QuestionQuestion

What happens when the

calling MS activates the

SS of BAOC?

AnswerAnswerMS BSS MSC VLR HLR

1 CHANNEL REQUEST <RACH>

<AGCH>DCCH ASSIGN

<SDCCH>



CC

3 AUTHENTICATION

SET Cipher MODE

4 SET-UP <SDCCH>


6 COMPLETE CALL

CALL PROCEEDING <SDCCH>

PSTN

SFOC

Call Barred


For the called party, the flow for the called party

begins when MSC sends paging command to the

called party, ends when two party start talk. In

general, this call flow includes several stages:

access process, authentication and ciphering

process, TCH assignment process, talk process,

release process.

Land to Mobile SequenceLand to Mobile Sequence

MS BSS MSC VLR HLR GMSC

( MSISDN)

Initial and Final 1 Address Message

PSTN


( MSISDN)

( MSISDN) (IMSI)


PSTN

2 Send Routing Info



( MSISDN)

( MSISDN) (IMSI)

(MSRN)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack

Initial and Final Address Message



( MSISDN)

( MSISDN) (IMSI)

(MSRN)

(MSRN)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack


4 Send Info For I/C Call Setup



( MSISDN)

( MSISDN) (IMSI)

(MSRN)

(MSRN)

( LAI & TMSI)(TMSI)(TMSI)


PSTN

(MSRN) (MSRN)

2 Send Routing Info

3 Routing Info Ack


4 Send Info For I/C Call Setup

5 PagePaging Request

<PCH>


6 Channel Request

DCCH Assign

Signaling Link Established

Page Response

*Authentication

<RACH>

<AGCH>

<SDCCH>

<SDCCH>

(TMSI)(TMSI & Status)

(Status)

CR


MS BSS MSC VLR HLR GMSC PSTN

6 Channel Request

DCCH Assign


Page Response

*Authentication

7 Complete CallSetup

<RACH>

<AGCH>

<SDCCH>

<SDCCH>


(Status)

<TMSI>

<SDCCH>

CR



6 Channel Request

DCCH Assign


Page Response

*Authentication

7 Complete CallSetup

8 Call Confirmation

<RACH>

<AGCH>

<SDCCH>

<SDCCH>


(Status)

<TMSI>

<SDCCH>

<SDCCH>

CR


Ring Tone at the land phone


( channel) (circuit)

<FACCH>

9 Assignment Command

Assignment Complete

Alert<TCH>

Address Complete




<FACCH>

( channel) (circuit)

<FACCH>

9 Assignment Command

Assignment Complete

Alert<TCH>

<FACCH>10 Connect

Connect ACK ANS

<TCH>

Hello...

Address Complete


Billing starts


Ringing stops at land phoneSubscriber

picks up


QuestionsQuestions

Please give the sequence:1.The called MS is powered off.2.The called MS activates the CFU to a PSTN No.3.The called MS has been barred all incoming call.4.The Called MS are not known at HLR

1. The called MS is powered off


( MSISDN)

( MSISDN) ( IMSI)


2 Send Routing Info

3 Routing Info Ack

PSTN

Subscriber Absent

The Land hears the announcement of mobile is powered off

AnswersAnswers

2. The called MS activates the CFU to a PSTN No.

(MSISDN)

(MSISDN)

CFN

4 IFAM

AnswersAnswers



2 Send Routing Info

3 Routing Info Ack

AnswersAnswers3. The called MS has been barred all incoming call.

Call Barred


(MSISDN)

(MSISDN)


2 Send Routing Info

3 Routing Info Ack

PSTN

AnswersAnswers

4. The Called MS are not known at HLR

Unknown Subscriber


(MSISDN)

(MSISDN)


2 Send Routing Info

3 Routing Info Ack

PSTN

MS BSS MSC VLR HLR

<FACCH>

< FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

Mobile Initiated Call Clearing SequenceMobile Initiated Call Clearing Sequence

MS BSS MSC VLR HLR

< FACCH>

<FACCH>

< FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

2 PSTN Release

CompleteMobile Release Complete

MS-MSC Signalling Released


MS BSS MSC VLR HLR

< FACCH>

< FACCH>

<FACCH>

< FACCH>

1 Disconnect

PSTN

PSTN Release

Mobile Release

2 PSTN Release

CompleteMobile Release Complete

MS-MSC Signalling Released

3 Clear Command

Channel Release



<FACCH>

<FACCH>4 DISC

UA

Clear Complete



<FACCH>

<FACCH>4 DISC

UA

Clear Complete

5 RLSD

Release Complete


Brief Introduction to Location Update

Location Update SequenceLocation Update Sequence

Several Typical Location Update Sequences

The types of Location Update :

Brief Introdution to Location UpdateBrief Introdution to Location Update

Periodic Location UpdatePeriodic Location Update

IMSI Attach/DetachIMSI Attach/Detach

Normal Location UpdateNormal Location Update

Several Typical Location Update SequencesSeveral Typical Location Update Sequences

Intra-VLR Location Update Sequence

Inter-VLR Location Update Sequence

Intra-VLR Location Update SequenceIntra-VLR Location Update Sequence

MS BSS MSC VLR<RACH> 1 Channel Request<AGCH>

DCCH Assign

HLR

Only sent to HLR if this is the first time the MS has Location Updated in this VLR



DCCH Assign

2 Location Update Request<SDCCH>

HLR




DCCH Assign


LAI & TMSI 3 Authentication & Ciphering

HLR




DCCH Assign



4 Forward New TMSI

Location Update Accept

<TMSI>

<SDCCH>

<TMSI>

HLR




DCCH Assign



4 Forward New TMSI


<TMSI>

<SDCCH>

<TMSI>

5 TMSI Reallocate Complete

TMSI ACK

<SDCCH>

HLR




DCCH Assign



4 Forward New TMSI


<TMSI>

<SDCCH>

<TMSI>

5 TMSI Reallocate Complete

TMSI ACK

<SDCCH>

6 Clear Command

Clear Complete

<SDCCH>

<SDCCH>

HLR


Location Update via IMSI

Location Update via TMSI

Inter-VLR Location Update SequenceInter-VLR Location Update Sequence

<RACH>

1 Channel Request <AGCH>DCCH Assign

MS BSS MSC VLRn HLR VLRo

Inter-VLR Location Update Via IMSIInter-VLR Location Update Via IMSI

<RACH>


2 Location Update Request

<SDCCH>



LAI & IMSI

<RACH>



<SDCCH>

LAI & IMSI

Authentication & Ciphering

MS BSS MSC VLRn HLR

3 Authentication Para. Req

VLRo

.


<RACH>



<SDCCH>

LAI & IMSI


MS BSS MSC VLRn HLR



Insert Subscriber Data

Insert Subscriber Data Ack

Location Update accept

VLRo


<RACH>



<SDCCH>

LAI & IMSI


MS BSS MSC VLRn HLR






VLRo

5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI


TMSI Reallocate Complete

TMSI ACK



6 Forward New TMSI



TMSI ACK

7 Clear Command

Clear Complete



<RACH>



Inter-VLR Location Update Via TMSIInter-VLR Location Update Via TMSI

<RACH>



<SDCCH>



LAI & TMSI

<RACH>



<SDCCH>

LAI & TMSI


.



3 Provide Identification

provide Identification Ack

TMSI&LAIO

TMSI,IMSI,KC,R,S)

<RACH>



<SDCCH>

LAI & TMSI




3 Provide Identification

provide Identification Ack

TMSI&LAIO

TMSI,IMSI,KC,R,S)







5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI



TMSI ACK


5 Cancellocation

Cancellocation Ack.


6 Forward New TMSI



TMSI ACK

7 Clear Command

Clear Complete


5 Cancellocation

Cancellocation Ack.

The mobile originated short message transfer procedure is separated from mobile terminated. The basic short message sequence consists of two parts: MO SMS Transfer and MT SMS Transfer.

Short Message SequenceShort Message Sequence

MS BSS MSC VLR InterworkingMSC


<AGCH>DCCH ASSIGN

SIGNALING LINK

ESTABLISHED

SC

MO SMS TransferMO SMS Transfer



<AGCH>DCCH ASSIGN

<SDCCH>

SIGNALING LINK

ESTABLISHED

2 REQ. FOR SERVICE CR

CC

SC




<AGCH>DCCH ASSIGN

<SDCCH>

SIGNALING LINK

ESTABLISHED

2 REQ. FOR SERVICE CR

CC

3 AUTHENTICATION

SET Cipher MODE

SC




<AGCH>DCCH ASSIGN

<SDCCH>

SIGNALING LINK

ESTABLISHED


CC

3 AUTHENTICATION

SET Cipher MODE

SC

4 RP_MO_DATA

SIF_MO_SMS

SIF_MO_SMS-Ack


5 MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

(SC_No.)



SC

5 MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

6 RP_ACK

(SC_No.)



SC

"Send Successfully" is displayed on the mobile

MT SMS TransferMT SMS Transfer

For Forwarding a Short Message

For Forwarding Several Short Message

MSServicing

MSC VLR HLR GatewayMSC SC

1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

MT SMS Transfer (A Message)MT SMS Transfer (A Message)

MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMS

PagePage


MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMS

PagePage

3 Paging Response

Authentication and Ciphering


MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

2 SIF_MT_SMS

Page

Page Request

3 Paging Response


4 Short_Message

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack


MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM

MT SMS Transfer (Several Messages)MT SMS Transfer (Several Messages)

MT_Forward_SM(The More message To

Send Flag is True)

MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM



Send Flag is True)

2 SIF_MT_SMS PagePaging Request

MSServicing


1 Short Message

SRI_For_SM

SRI_For_SM_Ack

MT_Forward_SM



Send Flag is True)

2 SIF_MT_SMS PagePaging Request

3 Paging Response


MSServicing


4 Short_Message

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack


MSServicing


4 Short_Message

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack


5 Short_Message

MT_Forward_SM


Send Flag is False)

Short_Message_Ack

MT_Forward_SM_Ack

Short_Message_Ack

Short_Message

What is the What is the sequence when sequence when the originating the originating subscriber sets subscriber sets the wrong SC the wrong SC No. in the No. in the mobile station.mobile station.

QuestionQuestion

MO_Forward_SM

Short_Message

MO_Forward_SM_Ack

Short_Message_Ack

RP_ACK

(SC_No.)


SC

"Send Not Successfully" is displayed on the mobile

AnswerAnswer

Illegal Subscriber

Illegal Subscriber

Handover SequenceHandover Sequence

Inter - BSS handover sequence

Inter - MSC handover sequence

MS oBSS nBSS MSC

1 Periodic Measurement 1 Periodic Measurement reportsreports

<SACCH>

Inter - BSS Handover Sequence Inter - BSS Handover Sequence

MS oBSS nBSS MSC

1 Periodic Measurement reports

<SACCH>

2 Handover required2 Handover required


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request3 Handover Request TMSI cct. code


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

4 Handover REQ ACK4 Handover REQ ACK

TMSI cct. code

HO Ref. No.


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command 5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>

6 Information Interchange 6 Information Interchange <FACCH>


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>

6 Information Interchange <FACCH>

7 Handover Complete 7 Handover Complete


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


7 Handover Complete

8 Clear Command 8 Clear Command


MS oBSS nBSS MSC


<SACCH>

2 Handover required

3 Handover Request

5 Handover Command

4 Handover REQ ACK

TMSI cct. code

HO Ref. No.

HO Ref. No.<FACCH>


7 Handover Complete

8 Clear Command

9 Periodic Meas. reports9 Periodic Meas. reports <SACCH>


Inter - MSC Handover Sequence Inter - MSC Handover Sequence

Basic Inter-MSC handover

Subsequent Inter - MSC handover

MSCA MSCB VLRB

1 PrepareHandover1 PrepareHandover

2 Allocate HandoverNo.

4 PrepareHandover_Ack

5 Send HO Report_Ack

6 Initial

Address Message

3 Send Handover Report

Address Completed

Answer

Basic Inter-MSC handoverBasic Inter-MSC handover

MSCA MSCB VLRB

1 PrepareHandover

2 Allocate HandoverNo. 2 Allocate HandoverNo.



6 Initial

Address Message


Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover




6 Initial

Address Message

3 Send Handover Report3 Send Handover Report

Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover


4 PrepareHandover_Ack4 PrepareHandover_Ack


6 Initial

Address Message


Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover



5 Send HO Report_Ack5 Send HO Report_Ack

6 Initial Address Message


Address Completed

Answer


MSCA MSCB VLRB

1 PrepareHandover




6 Initial 6 Initial Address MessageAddress Message


Address CompletedAddress Completed

AnswerAnswer


MSC/VLRA MSC/VLRB

7 Process Access Signal7 Process Access Signal

Send End SignalSend End Signal

Forward Access SignalForward Access Signal

Process Access SignalProcess Access Signal

8 Clear Forward

Release Guard

Send End Signal_Ack


MSC/VLRA MSC/VLRB

7 Process Access Signal

Send End Signal

Forward Access Signal

Process Access Signal

8 Release8 Release

Release CompleteRelease Complete

Send End Signal_AckSend End Signal_Ack


MSC/VLRA MSC/VLRB HLRA

9 SendAuth. Info9 SendAuth. Info

Auth InfoAuth Info

Update LocationUpdate Location

InsertSubs.DataInsertSubs.Data

InsertSubs.Data_AckInsertSubs.Data_Ack

UpdateLocation_AckUpdateLocation_Ack

Cancellocation

Cancellocation_Ack



1 PrepareSubsequentHOV1 PrepareSubsequentHOV

PrepareHandoverPrepareHandover

PrepareHandoverPrepareHandover

PrepareSubsequentHOVPrepareSubsequentHOV

2 Initial and FinalAddress Message

Address Complete

Answer

3 RLS

RLC

Subsequent Inter-MSC Subsequent Inter-MSC handoverhandover


1 PrepareSubsequentHOV

PrepareHandover

PrepareHandover

PrepareSubsequentHOV

2 Initial and Final2 Initial and FinalAddress MessageAddress Message

Address CompleteAddress Complete

AnswerAnswer

3 RLS

RLC



1 PrepareSubsequentHOV

PrepareHandover

PrepareHandover

PrepareSubsequentHOV

2 Initial and FinalAddress Message

Address Complete

Answer

3 RLS3 RLS

RLCRLC


MSC/VLRA MSC/VLRB MSC/VLRC


ForwardAccessSignalForwardAccessSignal

4 ProcessAccessSignal4 ProcessAccessSignal

7 Location Update

SendEndSignal_Ack

6 SendEndSignal

5 RLS

RLC


Subsequent Inter-MSC handover

5 RLS5 RLS

RLCRLC

7 Location Update

SendEndSignal_Ack

6 SendEndSignal

4 ForwardAccessSignal

ProcessAccessSignal


7 Location Update

SendEndSignal_AckSendEndSignal_Ack6 SendEndSignal6 SendEndSignal



ProcessAccessSignal

5 RLS

RLC



ProcessAccessSignal

5 RLS

RLC

7 Location Update7 Location Update

SendEndSignal_Ack

6 SendEndSignal


SummarySummary

1. GSM Security Mangement

2. GSM Basic Call Sequence

3. Location UpdateSequence

4. SMS Sequence

5. HandoverSequence

oma000003 gsm communication flow

Documents

kc a5 mms bss

withchannel request

thecalling ms

ciphering process

final address8 message

kc a5 kcm ms bsskcm

id req

command assig