1. Overview of WCDMA Circuit Switched Core Network Protocols
Quan Tat
This presentation is based on Mikko Korpela's training materials

2. Presentation contents
Circuit Switched Core Network (CS CN)
Mobility Management (MM)
Registration Management (RM)
Connection Management (CM)
Call Control (CC)
Short Message Service (SMS)
Supplementary Services (SS)
Specifications
Packet Switched Core Network (PS CN) is not described in this presentation
Explain briefly each topic
Questioning at the end

3. OSI Seven Layer Model

4. OSI Seven Layer Model
Standard model used by almost all modern data and telecomm systems
Modern protocols too complex to understand and specify as a whole, so Open System Interconnect (OSI) Reference Model was developed to provide a framework for understanding how information is sent from one device to another.
The OSI model describes seven layers, with each layer intended to provide a well-defined service in order to ensure that data has been successfully transmitted between devices
Each layer provides a service and defined interface to the layer above it
In general, all seven layers at end nodes, three in intermediate nodes
The PDC CS is based on OSI 7 layer model
Example of Telephone transmission system. Terminals & Repeaters
Physical Layer Tx & Rx streams of bits over the transmission medium: Synchronisation, Signal level, Timings
Data Link ensures reliable communications: Error detection, Retransmission, Sequencing etc
Network Layer: routing, Mobility Management, Call Control, Handover etc..
PDC CS now has higher layers: Transport layer for Browser

5. Physical Layer (Layer 1)
Layer 1 ensures transmission of a bit sequence using a communication circuit from one physical device to the next physical device
Examples of activities that are the responsibility of Layer 1 include radio signal transmission, frequency assignment, bit interleaving, bit scrambling, random access control
Device X
Device Y
Communication Medium
Bit Sequence
Explaining of functions
Interleaving (Burst errors)

6. Data Link Layer (Layer 2)
Layer 2 uses the bit transmission function provided by layer 1 to offer a highly reliable and transparent data transfer service
Examples of activities that are the responsibility of Layer 2 include error detection, error correction (by retransmission), flow control, addressing, placing messages in a frame structure, sequence counting, etc
Device X
Device Y
L1 Unreliable Communication Medium
L2 Reliable Communication Medium
Block of Bits

7. Network Layer (Layer 3)
Layer 3 is responsible for setting up and maintaining end to end communication facilities between end node communication devices in the same network
Node
Network
Device X
Device Y
Device P
Device Q
L3 Connection

8. Transport Layer
Transport is responsible for setting up and maintaining end to end communication facilities between end node communication devices in the same or different networks
The Transport Layer addresses the issue of providing mechanisms that will improve the overall quality of the end-to-end service which is in use.
Star Network
Bus Network
Transport Connection

9. Session Layer
All the layers above Transport layer assume that the reliability of the communications path provided by the Transport Layer is as good as it needs.
The only failure is when the Transport Layer connection is lost. This is infrequent but cannot be totally eliminated.
Session layer deals with request a connection, releasing the connection (orderly termination) and aborting the connection (disorderly termination)
Each application in the Application Layer can request a session
Within one device, there can be several sessions running simultaneously.
Session for ftp
Session for Browser
Session for RPC
Transport Layer

10. Presentation Layer
Presentation Layer allows two devices using different internal data presentations to communicate with each other
An example of Abstract Syntax notation is ASN.1
An example of Transfer Syntax is BER - Basic Encoding Rule
Presentation Layer
Local Syntax
Local Syntax
Ohayo Gozaimasu
Gutten Morgen
Good Morning
Good Morning
Morse Code
Abstract Syntax
Abstract Syntax
Transfer Syntax

11. Application Layer
Application layer contains the programs that actually provide services to the user

12. 3GPP Layer Model

13. GSM/3G L2/L3 Structure
NOTE: Packet Switched Core Network is not shown in this diagram CC SS
SMS CM RM MM
GSM/WCDMA Core Network
GSM RAN RR L2 L1
WCDMA RAN
RRC
RLC
MAC L1 L1 L2 L3

14. Circuit Switched Core Network

15. Structure of CS CN Layer 3CC SS
SMS
CS CN CM RM
Layer 3 MM
WCDMA RRC

16. Mobility Management (MM) & Registration Management (RM)CC SS
SMS
CS CN CM RM
Layer 3 MM
WCDMA RRC

17. Terms (MM) LAI = Location Area Identification ( MCC+ MNC + LAC )
PLMN ( MCC + MNC )
Mobile Country Code (MCC) identifies the country in which the UMTS PLMN is located
Mobile Network Code (MNC) is a code identifying the UMTS PLMN in that country
Location Area Code (LAC) which is identifying a location area within a UMTS PLMN
TMSI = Temporary Mobile Subscriber Identity
IMSI = International Mobile Subscriber Identity
IMEI = International Mobile Equipment Identity

18. Layer 3 - Registration Management (RM)
RM is not a protocol itself. It is a sublayer which takes care that MS is in contact with the network in idle mode
3GPP documents define the RM as a part of the MM. NMP implements RM as a separate SW entity

19. Layer 3 - Mobility Management (MM)
MM Main functions:
To handle user & terminal mobility related procedures like:
Location Area Update
IMSI Attach
IMSI Detach
To handle security related procedures like:
Authentication
Identification
TMSI reallocation
To provide services for upper layers (CM)
MM Connection establishment
MM information
The above procedures could be combined
Location Area Update Procedure

20. Location Update (MM) - (1)
Upon successful location update, network knows on which Location Area mobile is in idle mode so that network may page a particular mobile on this Location Area e.g. to initiate a speech call originating from the network side
Normal: Normal location update is performed when location area changes e.g. re-selected cell belongs to different location area from the previous cell
Periodic: Periodic location update is performed when timer (T3212) expires, max value of T3212 timer is * 6 min = 24h, and if the value is 0, it means that periodic location update is not used in the network
LOCATION UPDATE
LOCATION UPDATING ACCEPT (SUCCESSFUL)
LOCATION UPDATING REJECT (UNSUCCESSFUL)
LOCATION UPDATING REQUEST OR

21. Location Update & IMSI Attach (MM) - (2)
IMSI: International Mobile Subscriber Identity
IMSI Attach: Phone is switched on in the same location area where it was powered off and IMSI attach is allowed by the network
IMSI attach is performed by using the location updating procedure. The location updating type information element in the LOCATION UPDATING REQUEST message shall in this case indicate IMSI attach.
LOCATION UPDATE
LOCATION UPDATING ACCEPT (SUCCESSFUL)
LOCATION UPDATING REJECT (UNSUCCESSFUL)
LOCATION UPDATING REQUEST OR

22. IMSI DETACH INDICATION
IMSI Detach (MM)
IMSI detach is performed during power off if mobile is registered to the network and if IMSI detach is allowed by the network
Inform the network that IMSI is no longer active
IMSI DETACH INDICATION

23. AUTHENTICATION (Successful)
Authentication (MM)
Is used when network wants to check whether user has rights to use the network
In UMTS, mobiles may also authenticate network to avoid false base stations!
AUTHENTICATION REQUEST
AUTHENTICATION FAILURE
AUTHENTICATION (Successful)
AUTHENTICATION (Network authentication fails)
AUTHENTICATION RESPONSE

24. Identification (MM)
Identification procedure is used by network to request mobile station to provide specific identification parameters e.g. IMSI or IMEI to the network
IMEI: International Mobile Equipment Identity
IDENTITY REQUEST
IDENTITY RESPONSE
IDENTIFICATION

25. TMSI Reallocation (MM)
TMSI: Temporary Mobile Subscriber Identity
Purpose of TMSI reallocation is to provide identity confidentiality, i.e. to protect user against being identified and located by an intruder
TMSI reallocation is performed at least when location area changes
TMSI has significance only within a location area
TMSI REALLOCATION COMMAND
TMSI REALLOCATION COMPLETE
TMSI Reallocation

26. MO MM Connection Establishment (MM)
In mobile originated MM connection establishment, CM layer requests MM to establish MM connection
if no signaling connection exists, MM asks RRC to establish a new one
When signaling connection is established, CM SERVICE REQUEST is sent to network to identify the requested service (like conversational call, SMS)
Service is accepted by CM SERVICE ACCEPT message, or by indication that ciphering has been started by RRC
Service is rejected by CM SERVICE REJECT message, cause value specifies the reason for failure
CM SERVICE ACCEPT (SUCCESSFUL)
CM SERVICE REJECT (UNSUCCESSFUL)
CM SERVICE REQUEST OR
CIPHERING STARTED (INDICATION FROM RRC LAYER!)

27. MT MM Connection Establishment (MM)
MM layer in network side initiates Mobile terminated MM connection establishment
Paging received by RRC is indicated to MM
After paging indication, MM on mobile side starts to request signaling connection from RRC
When signaling connection exists, MM sends PAGING RESPONSE to network. Then, network may send CM layer messages
CM LAYER MESSAGE (MM ROUTES TO CM)
PAGING HAS BEEN RECEIVED (INDICATION FROM RRC LAYER!)
SIGNALLING CONNECTION SETUP (REQUESTED FROM RRC LAYER!)
PAGING RESPONSE

28. MM Information (MM) MM INFORMATION
In MM INFORMATION message, network may send current time & date and/or network name to MM
Usually happens when MS performs location update
Date & time may be used to auto update time in mobile e.g. after power on
Network name information may be used e.g. by older mobiles in new networks to show correct network names on display
MM INFORMATION

29. MM: Location Update Procedure (1)
Setup Signalling Channel (GSM/UMTS)
RADIO ACCESS
LOCATION UPDATE REQUEST (I have moved!)
IDENTITY REQUEST (Who are you?)
IDENTIFICATION (optional)
IDENTITY RESPONSE (I am so&so)
AUTHENTICATION REQUEST (Prove who you are)
AUTHENTICATION (optional)
AUTHENTICATION RESPONSE (Here is the proof)

30. MM: Location Update Procedure (2)
CIPHERING MODE COMMAND (Let's talk in our secret language)
CIPHERING (optional)
CIPHERING MODE COMPLETE (OK)
LOCATION UPDATE ACCEPT (I know where you are now.
I will call you TMSI#x)
LOCATION UPDATE
TMSI REALLOCATION COMPLETE (OK)
RELEASE CONNECTION
Release Signalling Channel (GSM/UMTS)

31. What is new in release 1999 MM?
Will be based on GSM MM, only few modifications like
Security improvements like longer authentication keys to be used
Network is also authenticated to avoid false, "pirate" base stations
Support for handovers between GSM & UMTS (key handling etc.)
Paging indication is now raised from RR level to MM level

32. Call Control (CC) CC SS
SMS
CS CN CM RM
Layer 3 MM
WCDMA RRC

33. Call Control Procedures (CC)
Mobile Originated Call Establishment
Mobile Terminated Call Establishment
Mobile Originated Call Clearing
Mobile Terminated Call Clearing
CC Procdures are usually combined with MM procedures:
Mobile Originated Call
Mobile Terminated Call

34. Mobile Originated Call Establishment (CC)
User may originate speech calls or data/fax calls (usually from laptop PC)
Transaction identifier is assigned to every new call!
MOBILE ORIGINATED CALL SETUP
SETUP
CALL PROCEEDING
ALERT
CONNECT
CALL IS ACTIVE
CONNECT ACKNOWLEDGE

35. Mobile Terminated Call Establishment (CC)
Network originates call establishment:
first mobile is paged
Then MM setups signaling connection
After that MM routes any CC messages to CC layer by using transaction identifier
MOBILE TERMINATED CALL SETUP
SETUP
CALL CONFIRMED
ALERTING
CONNECT
CONNECT ACKNOWLEDGE
CALL IS ACTIVE

36. Mobile Originated Call Clearing (CC)
In mobile originated call clearing, user or mobile starts call clearing procedure.
In normal case user presses end key (red key)
If mobile loses coverage and loses signaling connection to the network, e.g. by entering to the elevator, call is cleared in mobile internally (by using error procedures between layers)
MT CLEARING
DISCONNECT
RELEASE
RELEASE COMPLETE
CALL IS RELEASED

37. Mobile Terminated Call Clearing (CC)
In mobile terminated call clearing, mobile receives from the network disconnect message
This is symmetric to MO case
MT CLEARING
DISCONNECT
RELEASE
RELEASE COMPLETE
CALL IS RELEASED

38. CC: Mobile Originated Call (1)
RADIO ACCESS PART
Setup Signalling Channel (GSM/UMTS)
CM SERVICE REQUEST
(I want connection service)
AUTHENTICATION REQUEST (Prove who you are)
AUTHENTICATION & ENCRYPTION
AUTHENTICATION RESPONSE (Here is the proof)
CIPHERING MODE COMMAND (Let's talk in our secret language)
CIPHERING MODE COMPLETE (OK)

39. CC: Mobile Originated Call (2)
SETUP (I want to set up a call to this number)
CALL SETUP
CALL PROCEEDING (I am setting it up)
Access Bearer ASSIGNMENT
Setup Communication Channel (GSM/UMTS)
ALERTING (Other party is ringing)
CALL SETUP CONTINUES
CONNECT (Other party's answered)
CALL IS ACTIVE
CONNECT ACK. (OK)

40. CC: Mobile Originated Call (3)
CALL ACTIVE
Call quality report (GSM/UMTS)
DISCONNECT (Other party hanged up)
MT CLEARING
RELEASE (OK)
RELEASE COMPLETE (Call is finished)
Release Signalling and Communication Channels (GSM/UMTS)

41. CC: Mobile Terminated Call (1)
PAGING REQUEST (Someone is ringing you)
PAGING
RADIO ACCESS PART
Setup Signalling Channel (GSM/UMTS)
AUTHENTICATION REQUEST (Prove who you are)
AUTHENTICATION & CIPHERING
AUTHENTICATION RESPONSE (Here is the proof)

42. CC: Mobile Terminated Call (2)
CIPHERING MODE COMMAND (Let's talk in our secret language)
CIPHERING MODE COMPLETE (OK)
SETUP (This number is ringing you)
CALL SETUP
CALL CONFIRMED (OK)
ALERTING (I am ringing)
Access Bearer ASSIGNMENT
Setup Communication Channel (GSM/UMTS)

43. CC: Mobile Terminated Call (3)
CONNECT (Call is answered)
CONNECT ACK. (OK)
CALL ACTIVE
Call quality report (GSM/UMTS)
MT CLEARING
DISCONNECT (Other party hanged up)
RELEASE (OK)
RELEASE COMPLETE (Call is finished)
Release Signalling and Communication Channels (GSM/UMTS)

44. 10 Minutes Break 1) Self introduction
Tracker CF: Development of the WCDMA RAN stack in Southwood, UK
2) Switch off mobile phones or set to silent, meeting mode
2) Assessment form?

45. Other Procedures (CC)
Emergency call: it's possible to place emergency call by dialing e.g. 112 or 911.
Emergency call is basically similar to MO call establishment, but instead of SETUP, EMERGENCY SETUP message is used
Modify: it's possible during active call to modify data call parameters
Sending DTMFs: possible during active call, tones are generated locally and send to the network as encapsulated digits
Video telephony: similar to data call from CC point of view, only some new values are used for data parameters
Multicall: introduction of a new parameter (Stream Identifier) in some of the CC messages, not too much impact on CC layer

46. Call control properties (CC)
Call control entity can handle several calls at the same time
There could be up to 5 calls in conference call (multiparty)
One call on hold
One call waiting
Call control messages may transfer SS information
Facility information element can be included in call control messages e.g. in SETUP, CALL PROCEEDING, RELEASE COMPLETE and so on

47. What is new in release 1999 CC?
Introduction of circuit switched multimedia (video telephony)
Multicall i.e. possibility to have multiple simultaneous active calls, for example one speech call & several data/fax calls
However, these modifications only add some new parameters to the CC messages, and are not visible on basic CC signaling procedures!

48. Short Message Service (SMS)CC SS
SMS
CS CN CM RM
Layer 3 MM
WCDMA RRC

49. Short Message Service Procedures (SMS)
Main procedures:
Short Message Mobile Originated
Short Message Mobile Terminated
Short Message Cell Broadcasting
3GPP SMS R99 is the same as current GSM SMS (no modifications)
Exception: Packet switched SMS internal interfaces in protocol stack are a bit different since different protocols are used in UMTS!

50. Short Message Mobile Originated (SMS)
Transfer of SM MO is called submission
Text part of short message contains up to 140 octets (160 7-bit characters!)
SMS signaling from protocol point of view is quite simple, since applications (in UI) take care of most things!
CP-DATA contains SM
CP-ACK contains report of the submission
CP-DATA (Submission)
CP-ACK (Report from SMSC)
SHORT MESSAGE SUBMISSION
Short Message Service Centre (SMSC)

51. Short Message Mobile Terminated (SMS)
Transfer of SM MT is called delivery
CP-DATA contains SM
CP-ACK contains report of the delivery
CP-DATA (Delivery)
CP-ACK (Report from mobile)
SHORT MESSAGE DELIVERY
Short Message Service Centre (SMSC)

52. Short Message Cell Broadcasting (SMS)
It is possible for network to broadcast CB SM to multiple mobiles inside one cell, location area or network
Mobiles may filter only relevant messages, e.g. which are sent in a certain language, or belong to certain group
Unidirectional (on broadcast channel) so there is no report back to SMSC!
Not widely used in GSM!
In UMTS, size of CB message increased to over 1000 octets (in GSM 88 octets)
CP-DATA (CB Delivery)
SHORT MESSAGE CB DELIVERY
Short Message Service Centre (SMSC)

53. Supplementary Services (SS)CC SS
SMS
CS CN CM RM
Layer 3 MM
WCDMA RRC

54. Terms (SS)
Bearer Service (BS): from user's point of view not end-to-end service as such. One example of BS is data call which is classified as bearer service, since on laptop it's possible to have other protocols too
Teleservice (TS): from user's point of view end-to-end service like speech call
Call independent SS: SS that can registered before it is 'used' like call forwarding
Call related SS: SS that supplements a certain call, like multiparty call
Phases: GSM Phase 1 (1992), GSM Phase 2 (1996), GSM Phase 2+ (yearly releases after 1996)

55. Supplementary Service Functions (SS)
Main functions:
To supplement speech calls & data calls with additional features like call forwarding etc.
Basic rule in 3GPP: do not touch existing GSM SSs
Above rule has been obeyed very well
Some changes are still expected to specs:
to give support for circuit switched multimedia calls which use a new bearer service and
to make SS to be more suitable for Multicall

56. SUPPLEMENTARY SERVICE REGISTER
Register (SS)
Supplementary service can be activated per basic service basis
Basic service = bearer service (like data call), or teleservice (like speech call)
Register may be used for the following operations
Activation
Deactivation
Interrogation
Registration
Erasure
REGISTER
RELEASE COMPLETE
SUPPLEMENTARY SERVICE REGISTER

57. SS: CONTROL OPERATIONS
ACTIVATION *SC*SI#
DEACTIVATION #SC*SI#
INTERROGATION *#SC*SI#
REGISTRATION *SC*SI# and **SC*SI#
ERASURE ##SC*SI#
SC: Service Code
SI: Service Info
EXAMPLES OF CONTROL OPERATIONS
**67* # <=> registration of CFB
*#43# <=> interrogation of WAIT
*33*password*11# <=> activation of BAOC
#002# <=> deactivation of all CF
##21# <=> erasure of CFU
Overview of GSM features, including SS, can be found in this excellent document:

58. SS: PHASE 1 CALL FORWARDING CALL BARRING
Incoming calls are diverted to another phone if condition specific to involved forwarding service is fullfilled.
CALL BARRING
Barring of incoming or outgoing calls

59. SS: PHASE 2 LINE IDENTIFICATION SERVICES CALL WAITING AND CALL HOLD
MULTIPARTY (MPTY)
CLOSED USER GROUP (CUG)
enables users of the network to form groups to and from which access is restricted.
ADVICE OF CHARGE (AOC)
UNSTRUCTURED SUPPLEMENTARY SERVICE DATA (USSD)
generic method to send user commands to network and to receive information from network. Can be used to control future SS-operations with current mobiles

60. SS: PHASE 2+ EXPLICIT CALL TRANSFER (ECT)
Explicit Call Transfer (ECT) enables the subscriber, who has two calls, to connect those calls and releases the subscriber’s own connection
COMPLETION OF CALLS TO BUSY SUBSCRIBER (CCBS)
Completion of Calls to Busy Subscriber (CCBS) enables the subscriber A, when called number B is busy, to be notified when B is idle and to have the network initiate the call to B, if A desired
CALLING NAME PRESENTATION (CNAP)
Calling NAme Presentation (CNAP) provides for the ability to indicate the name presentation of the calling party to the called party at call set-up time for all incoming calls
USER-TO-USER SIGNALLING (UUS)
User-to-User Signalling (UUS) allows the transfer of User-to-User Information (UUI) to a remote subscriber over the signalling channel
CALL DEFLECTION (CD)
Call Deflection (CD) enables the subscriber to respond to an incoming call by requesting redirection of this call to another number
MULTIPLE SUBSCRIBER PROFILE (MSP)
Multiple Subscriber Profile (MSP) is an optional network feature to enable subscribers to have several profiles

61. Specifications In intranet Starting from Cellular Standardisation Web
WCDMA BSS Business Program home page
In internet:
ftp://ftp.3gpp.org/Specs/

62. Relevant 3GPP Specifications
22.101: Service principles
23.040: Technical realization of the Short Message Service (SMS) Point-to-Point
23.041: Technical realization of the Cell Broadcast Service (CBS)
23.122: NAS Functions related to Mobile Station (MS) in idle mode
24.007: Mobile radio interface signalling layer 3; General aspects
24.008: Core Network Protocols - Stage 3
24.010: General on Supplementary Services
24.011: Point-to-Point (PP) Short Message Service (SMS) support on mobile radio interface
24.012: Short Message Service Cell Broadcast (SMSCB) support on mobile radio interface
24.080: Supplementary Services formats and coding

63. Questions & Hopefully Answers
1) Self introduction
Tracker CF: Development of the WCDMA RAN stack in Southwood, UK
2) Switch off mobile phones or set to silent, meeting mode
2) Assessment form?