Modes Mobile Station ( MS ) MS Switched Off can not receive incoming paging messages. can not make outgoing call. No dedicated channel is associated with it. MS Switched On And in Idle Mode can receive incoming paging messages. can make outgoing call. No dedicated channel is associated with it. MS in Dedicated Mode MS is in conversation A dedicated traffic channel TCH is associated with it.

Technical Terms Used w.r.t. MM(Mobility Management) IMSI -International Mobile Subscriber Identity MSISDN -Mobile Subscriber ISDN Number TMSI -Temporary Mobile Subscriber Identity MSRN -Mobile Subscriber Roaming Number IMEI - International Mobile Equipment Identity LAI -Local Area Identity A3 -Authentication Algorithm A5 -Ciphering Algorithm A8 -Kc(Ciphering Key) Generation Algorithm

MSISDN (Mobile subscriber ISDN Number) Technical Terms Used in GSM MSISDN MSISDN (Mobile subscriber ISDN Number) A number assigned to the mobile subscriber Registered in Telephone Directory Used by the calling party for dialing MSISDN is used by the caller to set up a connection to this GSM mobile subscriber. by the MSC/GMSC to address the HLR when interrogating the visitor location of the GSM mobile subscriber. By the system to access the database of the GSM mobile subscriber in the HLR. Stored as semi permanent data in HLR

MSISDN format CC – Country Code NDC – National Destination Code CC NDC SN 3 DIGITS 2 DIGITS 10 DIGITS CC – Country Code NDC – National Destination Code - uniquely identifies the PLMN in a country -Max No of digits 15 as per ITU recommendation.

Technical Terms Used in GSM IMSI (International Mobile Subscriber Identity) A unique identity allocated to each MSISDN. Known only to the operator To ensure confidentiality to the subscriber. IMSI is used By VLR to address the HLR while updating the location of the GSM subscriber. To access the database of the GSM subscriber in the HLR, VLR and AuC Stored as permanent data in SIM, Semi permanent data HLR, Transient data in VLR.

IMSI MCC MNC MSIN MCC – Mobile Country Code 3 DIGITS 2 DIGITS <= 10 DIGITS MCC MNC MSIN 15 DIGITS OR LESS MCC – Mobile Country Code To Identify the home country of the PLMN MNC – Mobile Network Code To identify a GSM PLMN in a country MSIN – Mobile Station Identification Number Uniquely identifies a subscriber within a home PLMN. 2 DIGITS 8 DIGITS HLRID SN

Technical Terms Used in GSM TMSI (Temporary Mobile Subscriber Identity) Identity which guarantees the integrity of mobile subscriber on the radio interface. Uses only over the radio path Assigned by VLR to each mobile subscriber entering the VLR area Stored in SIM of MS and in VLR TMSI is used To address the GSM subscriber in the BSS To address the GSM subscriber data in the VLR Consists of Four Octets, coded using a full hexadecimal representation

LMSI (Local Mobile Subscriber Identification) Allocated by VLR and sent to HLR LMSI is the address at which GSM subscriber are stored in VLR database HLR includes it together with IMSI to speed up the search for subscriber data to in VLR. Comprises of 4 Octets.

MSRN (Mobile Subscriber Roaming Number) Required by GMSC to route an incoming call to a MS that is not currently under the gateway’s control It is a temporary number used To set up the voice connection from the originating MSC/GMSC to the VMSC To address the GSM subscriber data in VLR. HLR knows the current MSC/VLR service area for a mobile subscriber HLR requests the current MSC/VLR to allocate a MSRN to the called subscriber and return to it. After receiving MSRN, HLR returns the same to GMSC, which can route the call to current MSC/VLR exchange. Format:--- MSRN=CC+NDC+SN CC=Country code. NDC=Network Destination Code. SN=Subscriber Number.

IMEI (International Mobile Equipment Identity Number) Identifies the mobile equipment TAC FAC SNR 6 CHAR 2 CHAR TAC – Type Approval Code Allows approved types to be distinguished from Non approval types. FAC – Final Assembly Code Identifies the place of manufacture SNR – Serial Number issued by manufacturer.

All the cells in a Location area are served by single VLR. Location area consist of one or more than one cell which may be served by one or more BSC s. All the cells in a Location area are served by single VLR.

Location Area SS 7 HLR BSC LA 1 BSC VLR 1 LA 2 BSC LA 3 BSC BTS BTS MSC1 LA 1 BTS BSC BTS VLR 1 LA 2 SS 7 BTS HLR BSC MSC2 BTS LA 3 BTS BSC VLR 2 Location Area

Location Area Each location area in a GSM PLMN is identified by a Location Area Identity ( LAI ). LAI = MCC + MNC + LAC MCC - Mobile Country Code. MNC - Mobile Network Code. LAC - Location Area Code . MCC MNC LAC 3 digits 2 digits 2 octets max LAI ( 16 bits ) Maximum length of LAC is 16 bits. Thus there can be maximum of 65,536 Location Areas defined in one GSM PLMN. Stored as semi permanent data in VLR Stored in SIM of MS

Subscriber Data at MSC/HLR Data related to identification and numbering ( IMSI, MSISDN). Data related to MS Subscription type. Authentication and Ciphering Data. MS VLR number

Subscriber Data at MSC/VLR Data related to identification and numbering ( IMSI, MSISDN,MSRN and TMSI ). Data related to MS subscription type. Authentication and Ciphering Data. MS status data, Location Area Hand-over data,

Authentication is used to check the validity of a mobile subscriber. At MS At N/W Ki Ki RAND( 128 bits ) A3 A3 SRES SRES ( 32 bits ) =? AUTHENTICATION

Ki ( 128 bits) : Identification Key - Purpose : Ki is used to calculate SRES and Kc. - Ki is stored in SIM and HLR. - Ki is never transmitted over signaling network. RAND ( 128 bits ):Random Number - Purpose : RAND is used to calculate SRES and Kc. Kc ( 64 bits ) : Ciphering Key - Purpose : Kc is used to encrypt data over radio interface. SRES ( 32 bits) :Signed Response

A5 A5 S1 S2 S1 S2 114 bits BTS MS Kc. FRAME NO. Kc 64bits FRAME NO. CIPHERING DECIPHERING DECIPHERING CIPHERING BTS MS

Ciphering is used to encrypt data on radio interface. RAND Ki Kc generation is done at the time of Authentication. A8 Frame No. (22 bits ) Kc ( 64 bits) A5 Ciphering Stream Ciphered Bits XOR Information Bits ( 114 bits ) CIPHERING

LOCATION UPDATE SCENARIO - I Request For Service Old MSC/ VLR New MSC/ VLR HLR /AUC MS BSS Channel Request 1 RACH SDCCH Assignment 2 AGCH Location Update Request ( TMSI , LAI 0 ) 3 SDCCH Request IMSI ( TMSI ) 4 Send IMSI

LOCATION UPDATE SCENARIO - II Authentication and Ciphering New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS 5 Get Authentication Parameters ( IMSI ) Authentication Parameters Authenticate MS ( RAND ) ( RAND,Kc,SRES ) SDCCH 6 Authentication Response ( SRES ) SDCCH Cipher Radio Channel 7 ( Kc ) Cipher Up Link Channel SDCCH

LOCATION UPDATE SCENARIO - III Authentication and Ciphering New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Up Link Ciphered 8 SDCCH BSS Ciphers Down link Channel . 9 Ciphering Complete

LOCATION UPDATE SCENARIO - IV Update HLR/VLR & TMSI Reallocation New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Update Location 10 De Register Mobile 11 Mobile De-registered 12 Location Updated Location Updated Accept TMSI 13 SDCCH

LOCATION UPDATE SCENARIO - V Update HLR/VLR & TMSI Reallocation New MSC/ VLR Old MSC/ VLR HLR/ AUC MS BSS Location Updated Complete 14 SDCCH 15 Clear Signaling Connection Clear Complete 16 Release Radio Signaling Channel SDCCH

SETUP PHASE - CALL SETUP - CALL RELEASE Mobile To Land Call Set-up Scenario SETUP PHASE - REQUEST FOR SERVICE ( CHANNEL ) BY MS - AUTHENTICATION - CIPHERING - EQUIPMENT VALIDATION ( EIR CHECK ) - VALIDATION AT VLR - CALL SETUP - HAND OVERs - CALL RELEASE

Service Request (TMSI,LAI) MOBILE TO LAND CALL - I Request For Service MSC/VLR BSS MS Channel Request 1 RACH SDCCH Assignment 2 AGCH Service Request (TMSI,LAI) 3 SDCCH Authentication Ciphering Equipment validation

Equipment Validation A process by which a specific ME can be identified to prevent the use of stolen, unauthorized or malfunctioning equipment in the network. Each equipment is uniquely identified by an International Mobile Equipment Identity (IMEI) code. IMEI is incorporated into ME by the manufacturer IMEI Consists of three components Type approval code (TAC) Final Assembly Code (FAC) Serial Number (SNR) IMEI is stored in EIR

Equipment Validation EIR MSC/VLR BSS EIR MS IMEI Request 1 SDCCH IMEI Response (IMEI) 2 SDCCH Check IMEI 3 IMEI Check results 4

MOBILE TO LAND CALL - II Call Setup MSC/VLR BSS MS Call Setup Request 5 SDCCH Call Proceeding 6 SDCCH Assign Trunk and radio Assign TCH 7 SDCCH Radio Assignment Complete SDCCH Trunk and Radio Assignment Complete

MOBILE TO LAND CALL - III Call Setup MSC/VLR GMSC BSS HLR PSTN MS Network Setup ( Dialed Digits ) 8 Network Alerting Alerting 9 FACCH Connect Start Billing 10 Connect FACCH Connect Acknowledge 11 FACCH

MOBILE TO LAND CALL - IV Call Release MSC/VLR GMSC BSS HLR PSTN MS Disconnect 12 Network Release Release 13 FACCH Release Complete 14 FACCH Clear Command 15 Channel Release FACCH Release Complete

Land To Mobile Call Set-up Scenario Phases of Land To Mobile Call ( Mobile Terminating - MT Call ) Routing Analysis Paging Authentication Ciphering Call-Setup Call Release

Fixed to Mobile Call Routing VLR PSTN MSC HLR BSS MSRN MSISDN IMSI/TMSI IMSI/TMSI MSISDN MSISDN MSRN IMSI/TMSI

Fixed to Mobile Call Routing VLR PSTN MSC HLR BSS (VISITED) (HOME) MSRN MSISDN MSISDN MSRN MSRN IMSI/TMSI MSISDN IMSI/TMSI MSRN IMSI/TMSI

Routing Analysis LAND TO MOBILE CALL - I HLR MSC/VLR GMSC PSTN Incoming Call 1 ( MSISDN ) Get Route 2 Get Route ( MSISDN ) 3 ( IMSI ) Routing Information 4 ( MSRN ) Routing Information ( MSRN ) Incoming Call 5 ( MSRN )

Paging LAND TO MOBILE CALL - II BSS MS MSC (TMSI) PCH ( RACH ) Perform Page Page (TMSI) 6 PCH Channel Request 7 ( RACH ) 8 Access Granted ( AGCH ) Paging Response ( TMSI, LAI ) 9 SDCCH Page Response

LAND TO MOBILE CALL - III Call Set-up BSS MSC MS Call Set Up 10 SDCCH Call Set Up Confirm 11 SDCCH Assign Trunk & Radio Channel Assign Radio Channel 12 SDCCH Radio Channel Assigned Trunk and Radio Channel Assignment Complete SDCCH

LAND TO MOBILE CALL - IV Call Setup MSC/VLR GMSC BSS HLR PSTN MS Mobile Alerting 13 FACCH Network Alerting Connect ( off-hook ) 14 FACCH Connect Connect Acknowledge 15

LAND TO MOBILE CALL - V Call Release MSC/VLR GMSC BSS HLR PSTN MS Network Release Disconnect 16 FACCH Release 17 Release Complete FACCH Release Complete 18 FACCH Clear Command 19 Clear Channel Clear Complete FACCH

Mobile To Mobile Call Set-up Scenario Phases of Mobile To Mobile Call Request for service. Authentication Mobile Originating Ciphering Call-Setup Call Release Routing Analysis Paging Mobile Terminating Authentication Ciphering Call-Setup Call-Release

CHANNELS USED IN GSM PHYSICAL CHANNELS LOGICAL CHANNELS Traffic channels Control channels

CONTROL CHANNELS BROADCAST CONTROL CHANNEL COMMON CONTROL CHANNEL DEDICATED CONTROL CHANNEL

BROADCAST CONTROL CHL BCCH---BroadCast CHannel FCCH---Frequency Correction CHannel SCH------Synchronisation CHannel

COMMON CONTROL CHL PCH-----Paging CHannel RACH---Random Access CHannel AGCH---Access Grant CHannel

DEDICATED CONTROL CHL SDCCH---Standalone Dedicated Control CH SACCH---Slow Associated Control CH FACCH---Fast Associated Control CH