1. GSM Mobility Management
Rashmi Nigalye
Mouloud Rahmani
Aruna Vegesana
Garima Mittal
December 5, 2001
EL604: Wireless & Mobile Networking

2. Outline GSM architecture overview Handover management
Network layout
Protocols
Addresses & identifiers
Handover management
Talk and Move
Location management
Move only, without conversation

3. GSM NETWORK LAYOUT MSC region GSM Network (PLMN) Location area BSC BTS
In each GSM network ( also called Public Land Mobile Network (PLMN) ) there is at least one administration area assigned to a Mobile Switching Center (MSC)
In each administration area there is at least one Location Area (LA)
LA consists of several cell groups (BTSs) – should this (BTSs) be removed because one cell group has one BSC controlling many BTSs
Each cell group is assigned to one Base Station Controller (BSC)
Cells of one BSC may belong to different LAs
BTS : Base Transceiver station

4. GSM NETWORK LAYOUT ISC OMC BSC MSC GMSC BSC BTS HLR EIR BTS VLR AUC
PLMN
INTERNATIONAL
ISC
OMC
PSTN
ISDN
BSC
MSC
GMSC E
MSBTS: Um interface (GSM specific)
BTSBSC: Abis interface (GSM specific)
BSCNSS: A, B, C I/f (NSS consists of MSC, OMC, HLR, VLRs, AuC)
NSSPLMN: SS7 protocols (PLMN consists of ISC), provides signaling services
NSS GMSC: SS7 protocol, E interface.
GSM uses SS7 protocols over dedicated facilities that connect network elements
ISC: International switching center
OMC: Operations and maintenance center
GMSC: Gateway mobile switching center
NSS: Network and Switching Subsystem
MSC: Mobile switching center
VLR: Visitor location register
HLR: Home Location register
EIR: Equipment Identification register
AuC: Authentication center
BSC: Base station controller
BTS: Base transceiver station
MS: Mobile subscriber
BSS: Base Station System
(The BSC and BTS together are referred to as BSS. )
Abis
BSC A
B,C
BTS
HLR
EIR
BTS
VLR
AUC Um
BTS

5. Interfaces in GSM MSC or HLR or VLR BSC BTS MSC MS A- interface
Radio interface
SS7 GSM MAP
A-bis

6. GSM Protocol layers (GSM has MAP just like IS41)
To perform network control operations unique to personal communications, GSM adds a Mobile Application Part (MAP) to SS7.
MAP makes use of the Transactions Capabilities Part (TCAP) transport protocol.
MAP functions:
Updating of residence information in VLR
Storage of routing information in HLR
Updating and supplementing of user profiles in HLR
Handoff of connections between MSCs

7. What is a location area (LA)?
A powered-on mobile is informed of an incoming call by a paging message sent over the PAGCH channel of a cell
One extreme is to page every cell in the network for each call, which results in a waste of radio bandwidth
Other extreme is to have a Mobile notify the system via location updating messages of its current location at the individual cell level. This requires paging messages to be sent to exactly one cell, but this is wasteful due to the large number of location updating messages.
Hence, in GSM, we group cells into Location Areas (Neighborhoods).

8. Addresses and Identifiers
International Mobile Station Equipment Identity (IMEI)
- It is similar to a serial number. It is allocated by equipment manufacturer, registered by network, and stored in EIR
International Mobile Subscriber Identity (IMSI)
-CC: Country Code
-MNC: Mobile Network Code
-MSIN: Mobile Subscriber Identification Number (ID in home net.)
When subscribing for service with a network, subscriber receives (IMSI) and stores it in the SIM (Subscriber Identity Module) card. The IMSI has the unique subscriber id that identifies the HLR of the MS. It is never made public
CC MNC MSIN

9. Addresses and Identifiers
Mobile Subscriber ISDN (MSISDN)
-NDC: National Destination Code, SN:Subscriber Number,CC: Country Code
-The “real telephone number”, assigned to the SIM
-The SIM can have several MSISDN numbers for selection of different services like voice, data, fax
Mobile Station Roaming Number (MSRN)
-It is temporary location dependent ISDN number
-It is assigned by local VLR to each MS in its area.
CC NDC SN
SN is the address to the serving MSC/VLR.
Why need Imsi then?
To locate the HLR for that handheld
CC NDC SN

10. Addresses and Identifiers
Location Area ID(LAI)
- CC: Country Code, MNC:Mobile Network Code, LAC: Location Area Code
-LAI is broadcast regularly by Base Station on BCCH
-Each cell is identified uniquely as belonging to an LA by its LAI
Temporary Mobile Subscriber Identity (TMSI)
-It is an alias of the IMSI and is used in its place for privacy.
-It is used to avoid sending IMSI on the radio path.
It is an temporary identity that is allocated to an MS by the VLR at inter-VLR registration, and can be changed by the VLR
--TMSI is stored in MS SIM card and in VLR.
MSCs and location registers (HLR,VLR) are addressed with ISDN numbers. In addition, they may have a Signaling Point Code (SPC) within a PLMN to address them uniquely in SS#7.
CC MNC LAC
BCCH is Broadcast Control Channel

11. TMSI vs IMSI vs MSRN vs MSISDN
TMSI is used during location update and registration for find, paging and call routing. Instead of using IMSI, the MS sends the TMSI to the BSS, which forwards it to the MSC.
MSRN is the routing number that identifies the current location of the called MS.
MSRN is temporary network identity assigned during the call establishment to a mobile subscriber.
MSRN is the address to the serving MSC/VLR.
MSRN is used during call termination (Incoming call to the MS).
MSISDN is dialed during call termination.
MSISDN points to the subscribers records in the HLR that contains information to locate the MSC where the subscriber is currently located.
MSISDN is the telephone number.
There is an association between IMSI and MSISDN in the HLR.

12. Types of handover (same as “handoff”)
There are four different types of handover in the GSM system. Handover involves transferring a call between:
Channels (time slots) in the same cell
Cells (Base Transceiver Stations) under the control of the same Base Station Controller (BSC),
Cells under the control of different BSCs, but belonging to the same Mobile services Switching Center (MSC), and
Cells under the control of different MSCs.
Internal handovers
Only one Base Station Controller (BSC). (save signaling bandwidth, they are managed by the BSC without involving the Mobile services Switching Center (MSC), except to notify it at the completion of the handover.)
External handovers
Handled by the MSCs involved. (An important aspect of GSM is that the original MSC, the anchor MSC, remains responsible for most call-related functions, with the exception of subsequent inter-BSC handovers under the control of the new MSC, called the relay MSC.)

13. Attributes of radio-link handover
Hard handover
MAHO
Backward
Handover messages
Channel allocation schemes
COS selection scheme: static
Cross-over switch: anchor switch
Does GSM cross-over fit the generic scheme?
GSM is circuit switched and in circuit switches there are no buffers. Hence, we apply the same procedure as the generic scheme for handover but the buffering step is excluded.
Yes
Circuit switching
No buffering

14. Handover (MAHO)
Handovers are initiated by the BSS/MSC (as a means of traffic load balancing).
During its idle time slots, the mobile scans the Broadcast Control Channel of up to 16 neighboring cells, and forms a list of the six best candidates for possible handover, based on the received signal strength.
This information is passed to the BSC and MSC, at least once per second, and is used by the handover algorithm.

15. Integrated/Overlay Handover
ISUP messages used for selecting inter-switch channel

16. Messages Exchanged in Mobile Assisted Handover
Mobile Base Logical
station Station Channel
Conversation Conversation
MEASUREMENT REPORT
Conversation
HANDOVER COMMAND
TCH
TCH
SACCH
TCH
SACCH
TCH
FACCH

17. Cont’d Mobile Station Base Station Logical Channel HANDOVER ACCESS
New TCH
HANDOVER ACCESS
TCH
HANDOVER ACCESS
TCH
HANDOVER ACCESS
TCH
PHYSICAL INFORMATION
FACCH
HANDOVER COMPLETE
FACCH
Conversation
TCH
Conversation
TCH

18. Handover procedures in GSM8
Connection route 9
MSC-A
MSC-B
MSC-C 1 6 8
BSC 4 3
BSC
BTS 1
BSC
BTS 2 2
BTS 3
BTS 3 5 7

19. Inter MSC basic handover
VLR-B
MS/BSS 1
MSC-A
MSC-B
Handover required
Perform Handover
Allocate Handover number
Handover report
Radio chan. Ack
IAM
MS/BSS 2
ACM
HA Indication
HB Indication
HB Confirm
Send End Signal
BSS requests for handover to MSC-A
MSC-A decides handover and sends “perform handover” message to MSC-B.
MSC-B assigns a handover number and allocates a channel for MS via VLR-B.
VLR-B sends a handover report to MSC-B, which then sends a “radio-channel ack” containing the new MSRN, to MSC-A.
An ISDN channel is switched between the two MSCs (ISUP messges: IAM and ACM)
Both MSCs ack the MS(HA and HB indications). HA indication and HB indication are the acknowledgements send from the MSCs to the MS.
MS resumes connection on the new channel (HB confirm). HB confirm is sent from MS to MSC when it resumes the connection to the new channel after a short interruption.
MSC-B sends “send end signal” msg to MSC-A and releases the old radio connection.
MSC-A generates an “end signal” mssg to MSC-B
MSC-B sends “handover report” to its VLR.
VLR is involved because during call origination and call termination routing information must be obtained by the MSC from the serving VLR.
ANS
End of Call
REL
RLC
End Signal
Handover report

20. Subsequent handover from MSC-B to MSC-A
MS/BSS 1
MSC-A
MSC-B
MS/BSS 2
HA Required
Perform subsequent
Handover
Subseq. Handover
Acknowledge
HB Indication
HB Confirm
HA Indication
Mobile returns to MSC-A (hand back)
MSC-A does not assign a handover number, searches directly for a new radio channel for the MS.
Both MSC A and MSC B start handover procedure at the air I/F (HA/HB indication), and complete the handover.
MSC A terminates the connection to MSC B
“End signal” terminates connection at MSC B
Handover report is sent to the VLR of MSC B
ISUP messg “release” releases the ISDN connection.
End Signal
VLR-B
Handover report
End of Call
REL
RLC

21. Subsequent handover from MSC-B to MSC-C
MSC-A
MSC-B MS
HA Request
Perform subsequent
Handover
MSC-C
VLR-C
Perform Handover
Allocate Handover
Number
Send Handover report
Handover to MSC-C:
Subsequent handover from MSC-B to MSC-A
Basic handover from MSC-A to MSC-C
MSC-B sends the messg “perform subsequent handover” to MSC-A and initiates basic handover to MSC-C.
MSC-C sends ISUP messg ACM to MSC-A. Now, MSC-A informs MSC-B about the start of handover and frees handover procedure at the radio I/F from MSC-B.
MSC-B sends “send end signal” to MSC-A
MSC-A sends “end signal” to MSC-B to terminate the MAP procedure and cancels the ISDN connection.
Here the ISUP messages, IAM and ACM, are used because MSC-A frees the handover procedure at radio interface for MSC-B, only after it receives these ISUP messages from MSC-C about the start of handover at MSC-C.
Radio chan. Ack.
IAM
ACM
HB Indication
(Contd…)

22. (…contd) Subsequent handover from MSC-B to MSC-C
MSC-A
MSC-B MS
Perform subsequent
Acknowledge
HA Indication
MSC-C
HB Confirm
Send End Signal
ANS
MSC-B
VLR-B
REL and RLC are release messages.
End Signal
Handoff Report
REL
RLC

23. Location management Set of procedures to:
track a mobile user
find the mobile user to deliver it calls
Current location of MS maintained by 2-level hierarchical strategy with HLRs and VLRs.

24. Location registrationMS
BSS/MSC
VLR
HLR
AUC
Location registration
IMSI Ki
Loc.Upd.Req
Upd Loc.Area
Aut.Par.Req
(IMSI,LAI)
(IMSI,LAI)
(IMSI)
Aut. Info.
Authenticate
(IMSI,Kc,
RAND,SRES)
Authentic. Req
(RAND)
(RAND)
Auth.Info.Req
(IMSI) Ki
RAND
Auth.Info
SRES
A3 & A8
After subscriber has requested registration at its current location by sending its IMSI and LAI, the MSC instructs the VLR to register the MS with its current LAI.
In order for this registration to be valid, identity of subscriber is first checked using IMSI.
The AuC gives the authentication information based on the IMSI.
(IMSI,Kc,
RAND,SRES)
SRES Kc
Auth.Resp.
Auth.Resp =
(SRES)
(SRES)
Update Location
(IMSI,MSRN)
Generate
TMSI
Contd...

25. (…contd) Location registration.
VLR MS
BSS/MSC
HLR
AUC
Generate
TMSI
Start Ciph.
Ins.Subsc.Data
(Kc)
(IMSI)
Forw. New TMSI
Subs.Dat.Ins.Ack
(TMSI)
Ciph.Mod.Com.
Loc.Upd.Accept Kc
Loc.Upd.Accept
Message M
(IMSI) A5
Ciph.Mod.
Kc(M)
After successful authentication, MS is assigned new MSRN which is stored with LAI in HLR, and new TMSI is received by MS (TMSI Reallocation) in ciphering mode.
While in location Updating, VLR is receiving user data.
Kc(M)
Kc(M) Kc A5 M
TMSI Realloc.Cmd.
Loc.Upd.Accept
TMSI Realloc.Ack
TMSI.Ack

26. Location registration
MS has to register with the PLMN to get communication services
Registration is required for a change of PLMN
MS has to report to current PLMN with its IMSI and receive new TMSI by executing Location Registration process.
The TMSI is stored in SIM, so that even after power on or off, there is only normal Location Update.
If the MS recognizes by reading the LAI broadcast on BCCH that it is in new LA, it performs Location Update to update the HLR records.
Location update procedure could also be performed periodically, independent of the MS movement.
The difference in Location Registration and Location Update is that in location update the MS has already been assigned a TMSI.

27. Insert Subscriber. dataMS
BSS/MSC
VLR
HLR
AUC
Location update
IMSI, TMSI
Ki, Kc, LAI
Loc.Upd.Req
Update Loc.Area
(TMSI,LAI)
(TMSI,LAI)
Authentication
Update Location
(IMSI,MSRN)
Generate
TMSI
Start ciphering
Insert Subscriber. data
(Kc)
IMSI
Start ciphering.
Subs. Data Insert Ack
(contd..)

28. (..contd) Location update.
VLR MS
BSS/MSC
HLR
AUC
Start ciphering.
Forward new TMSI
(TMSI)
Loc. Upd. Acept
(IMSI)
Loc. Upd. Acept
TMSI Realloc. Cmd.
Auth. Para. Req
If location change involves both LA and VLR, the new VLR has to request the Identification and security data for the MS from the old VLR and store them locally.
In case of Inter-VLR, if (in an emergency situation) the old VLR cannot be determined by the LAI or the old TMSI is not known in the new VLR, IMSI is requested by new VLR from the MS.
(IMSI)
Loc. Upd. Acept
Auth. Info.
Auth.Info.Req
(IMSI,Kc, RAND,SRES)
TMSI Reallocation
Complete
TMSI Ack
(IMSI)
Auth.Info
(IMSI,Kc, RAND,SRES)

29. Ways to obtain MSRN
Obtaining at location update– MSRN for the MS is assigned at the time of each location update which is stored in the HLR. This way the HLR is in a position to supply immediately the routing info (MSRN) needed to switch a call through to the local MSC.
Obtaining on a per call basis– This case requires that the HLR has at least an identification for the currently responsible VLR. When routing info is requested from the HLR, it first has to obtain the MSRN from the VLR. This MSRN is assigned on a per call basis, i.e. each call involves a new MSRN assignment

30. Call routing to a Mobile Station1
MSISDN
GMSC
ISDN
LA 1 1 4
MSRN 2
MSISDN 3
MSRN
BSC
MSC
MSC
HLR
BTS 7
TMSI
1) ISDN switch forward the call to a mobile switch based on the MSISDN.
2) 3) GMSC request routing address (MSRN) from HLR.
4) Using MSRN, call is forward to local MSC.
5) 6) MSC determines TMSI of MS from the VLR.
7) MSC initiates paging in relevant LA.
8) After MS responds to paging, connection is switched through.
HLR has MSISDN to MSRN mapping and VLR has MSRN to TMSI mapping.
In the current slide, we presume that the HLR already has the updated MSRN. (refer to slide 29).
In case, the HLR only knows about the VLR, it would have to request the current VLR of the MS to provide the routable address (MSRN).
The VLR would return the MSRN to the GMSC through the HLR.
Then, the GMSC would use the MSRN to route the call to the MS through the visited MSC. 5
MSRN 7
TMSI
LA 2
BSC
EIR
BTS
VLR 8
TMSI 7
TMSI
AUC 6
TMSI
BTS MS

31. Call Origination VLR u1 PSTN MSC PSTN VLR MSC MS2 u1 3
PSTN
MSC 1 4
CALL ORIGINATION follow the following 4 steps:
The MSu1 sends the call origination request to the MSC.
The MSC forwards the request to the VLR by sending MAP_SEND_INFO_FOR_OUTGOING_CALL.
The VLR checks the u1’s profile and sends MAP_SEND_INFO_FOR_OUTGOING_CALL_ack to the MSC to grant call request
The MSC sets up the trunk according to the standard PSTN call setup procedure.
PSTN
VLR
MSC MS
1.call origination request
2. MAP_SEND_INFO_FOR_OUTGOING_CALL
3. MAP_SEND_INFO_FOR_OUTGOING_CALL_ack
4. IAM

32. Call Termination GMSC PSTN HLR VLR Target MSC Originating Switch VLR5 1
GMSC 4
PSTN 2
HLR 3
VLR 6
Target
MSC
Target MSC
Originating Switch
VLR
NOTE: Generally, call termination means end of a conversation. However, in GSM, call termination means delivering an incoming call to the MS.
CALL TERMINATION:
The call originating from a PSTN network to a MS is routed to the gateway MSC (GMSC) through a SS7 ISUP IAM message.
The GMSC then sends MAP_SEND_ROUTING_INFO to the HLR. This message consists of the MSISDN of the MS and other information.
The HLR sends the MAP_PROVIDE_ROAMING message to the VLR to get the MSRN. Message contains IMSI, MSC no. and other information.
4 & 5. The VLR creates the MSRN using the MSC no. stored in the VLR record of that MS. This MSRN is send to GMSC through the HLR.
6. The MSRN provides the address of the target MSC which has the MS. A voice trunk is setup by an SS7 ISUP IAM
Message between the GMSC and the target MSC.
HLR
GMSC
1. ISUP IAM
2. MAP_SEND_ROUTING_INFO
3. MAP_PROVIDE_ROAMING_NUMBER
4. MAP_PROVIDE_ROAMING_NUMBER_ack
5. MAP_SEND_ROUTING_INFO_ack
6. ISUP IAM

33. Find Operation Inter-LA Inter-MSC Inter-VLR
Both LA’s belong to same MSC, call/packets will be routed directly
Inter-MSC
Inter-VLR

34. Find operation in GSM
ISDN switch recognizes from the MSISDN that the call subscriber is a mobile subscriber. Therefore, forward the call to the GMSC of the home PLMN (Public Land Mobile Network)
GMSC requests the current routing address (MSRN) from the HLR using MAP
By way of MSRN the call is forwarded to the local MSC
Local MSC determines the TMSI of the MS (by querying VLR) and initiates the paging procedure in the relevant LA
After MS responds to the page the connection can be switched through.

35. Location update for inter LA, inter VLRMS
BSS/MSC
VLR new
HLR
VLR old
IMSI, TMSI
Ki, Kc, LAI
Loc.Upd.Req
Update Loc.Area
(TMSI,LAI)
Send para. From VLR new
(TMSI, LAI)
(TMSI,LAI)
IMSI response
(IMSI,RAND,SRES,Kc
Authentication
Update Location
(IMSI,MSRN)
Cancel Location
(IMSI)
In inter LA and inter VLR:
The MS requests location update message to BSS/MSC.
The BSS/MSC sends Update Loc. Area message with TMSI and LAI to the new VLR.
The new VLR in turn sends the TMSI and LAI to the old VLR to find out the IMSI of the mobile.
Upon receiving the IMSI of the MS, the new VLR then sends a location update message consisting of the IMSI and MSRN to the HLR of the MS.
The HLR then cancels its location at the old VLR and associates with the new VLR.
The new VLR forwards the new TMSI to the BSS/MSC and HLR accepts the location update at the new VLR.
The remaining procedure is similar to slide 26.
Generate
TMSI
Cancel location ack
(IMSI)
Start ciphering
Insert Subscriber. data
(Kc)
IMSI
Forward new TMSI
(TMSI)
Subs. Data Insert Ack
Location update accept

36. VLR Overflow Too many mobile users move into the LA in a short period
If VLR is full when mobile arrives:
User fails to “register” in the database
It cannot receive cellular services
VLR Overflow Resolutions
Algorithm
O-I: Registration
O-II: Cancellation
O-III: Call Origination
O-IV: Call Termination
In the overflow control scheme, an extra field (1 bit) is required in the HLR records.
The VLR stores the new user information by replacing one of the existing user based on
Random selection
Oldest record selection
Inactive Record selection

37. Abbreviations ISC: International switching center
OMC: Operations and maintenance center
GMSC: Gateway switching center
MSC: Mobile switching center
VLR: Visitor location register
HLR: Home Location register
EIR: Equipment Identification register
AUC: Authentication center
BSC: Base station controller
BTS: Base transceiver station
MS: Mobile subscriber
TMSI: Temporary Mobile Subscriber Identity
IMSI: International Mobile Subscriber Identity

38. Reference Material
Wireless and Mobile Network Architectures by Yi-Bing Lin & Imrich Chlamtac
The GSM Sytem for Mobile communications by Mouly & Pautet
Wireless Personal Communications Systems by Dr. Goodman
GSM Switching, Services and Protocols by Jorg Eberspacher and Hans-Jorg Vogel