GSM-Mobile Networks. Procedures and Scenarios. Author: Dipl. Ing. Ingo Schacht

Transcription

1 GSM-Mobile Networks Procedures and Scenarios Author: Dipl. Ing. Ingo Schacht Date:

2 Resources and References GSM-Signalisierung Gunnar Heine Franzis Verlag GmbH Specifications of 3GPP Siemens internal documents and presentations Dipl. Ing. Ingo Schacht Page 2 Siemens, 2003

3 Basic Considerations What are the basic requests? A mobile subscriber wants to initiate calls to other parties. A mobile subscriber wants to receive calls from other parties. Telephony in fixed networks Every subscriber can be reached by its fix connection to the network. - Identity is clear! - Location is clear! Telephony in mobile networks Theoretically each subscriber can try to use services from every network everywhere! - Identity isn t clear! - Location isn t clear! Dipl. Ing. Ingo Schacht Page 3 Siemens, 2003

4 Conclusion A mobile network needs additional mechanisms to realize mobile telephony! Detection of subscriber location Verification of subscriber identity Verification of mobile equipment identity Communication security Support of change of subscriber location during stable call Support of foreign mobile subscriber Mobility Management!! Dipl. Ing. Ingo Schacht Page 4 Siemens, 2003

5 Introduction Introduction Dipl. Ing. Ingo Schacht Page 5 Siemens, 2003

6 Scope of the presentation Core Network Access Network Switching Subsystem Radio Subsystem Operation & Maintenance Subsystem GSM/DCS Dipl. Ing. Ingo Schacht Page 6 Siemens, 2003

7 GSM Network - Overview PLMN PSTN (Public Land Mobile Network) (Public Switched Telecom Network) Access Network Core Network HLR MAP SCP Mobility IN MAP CAMEL BSS VLR ISUP ISUP BSSAP SS7 Switch STP MSC GMSC SS7 transit network PSTN / ISDN Signalling Traffic Dipl. Ing. Ingo Schacht Page 7 Siemens, 2003

8 Mobile Station ME + SIM / USIM = MS SIM SIEMENS Mobile Equipment (HW & SW) Mobile Subscriber Mobile Station Dipl. Ing. Ingo Schacht Page 8 Siemens, 2003

9 SIM Subcriber Identity Module SIM identifies the mobile subscriber (MSub) Consisting of microprocessor and memory for temporary and permanent data Temporary data: - Temporary subscriber identity (TMSI) - Current location information (LAI) - Encryption data SIM SIEMENS Permanent data: - Permanent subscriber identity (IMSI) - Key (Ki) individual subscriber authentication key - Algorithms for authentication (A3) and encryption (A8) Dipl. Ing. Ingo Schacht Page 9 Siemens, 2003

10 Procedures & Scenarios Procedures & Scenarios Dipl. Ing. Ingo Schacht Page 10 Siemens, 2003

11 Overview Authentication Location Update Mobile Originating Call (MOC) Mobile Terminating Call (MTC) Interrogation Paging Handover Dipl. Ing. Ingo Schacht Page 11 Siemens, 2003

12 Authentication(I) Purpose: - Protection of the network against unauthorized access and usage of offered services - Protection of the mobile subscriber against unauthorized usage of its own identity Trigger: - No independent operation! Always in conjunction with an other scenario (LUP, MOC,..)! Affected entities: - MS - MSC/VLR - HLR/AC Dipl. Ing. Ingo Schacht Page 12 Siemens, 2003

13 Authentication(II) MS Access Network Core Network MAP HLR/ AC Mobility VLR BSS BSSAP MSC SIM SIM SIEMENS HLR/AC IMSI Ki A3 A8 Permanent stored data Triples RAND Kc SRES Signed Response (Ki+RAND+A3) Ciphering Key (KI+RAND+A8) Random Number Dipl. Ing. Ingo Schacht Page 13 Siemens, 2003

14 Authentication(III) SIM SIEMENS VLR HLR/AC MS VLR HLR/AC Triple_Request (IMSI) Triple_Response (Triples) Authentication_Request (RAND) Calculation Of SRES with A3 Authentication_Response (SRES) Comparison Of Received SRES With Stored SRES Dipl. Ing. Ingo Schacht Page 14 Siemens, 2003

15 Location Update (I) Purpose: - Update of current location information on the SIM and in VLR Trigger: - MS detects that stored location information on SIM (LAI) is different to the received location information via broadcast channel (not during stable call!) Affected entities: - MS - MSC/VLR - HLR/AC Dipl. Ing. Ingo Schacht Page 15 Siemens, 2003

16 Location Update (II) MS Access Network Core Network MAP HLR Mobility VLR BSS BSSAP MSC MS VLR HLR/AC Location_Update_Request (IMSI) Authentication MSub_Data_Request (LMSI, VLR-Nr.) MSub_Data_Response Location_Update_Response (TMSI) Dipl. Ing. Ingo Schacht Page 16 Siemens, 2003

17 Mobile Originating Call (MOC) to PSTN MS Access Network Core Network HLR Mobility MAP VLR ISUP ISUP SS7 Switch STP BSSAP BSS SS7 MSC GMSC transit network PSTN / ISDN 1. Location Update MSub-A is known in VLR! 2. MSub-A dials MSISDN of B-Subscriber MOC Request! 3. Traffic Channel Request 4. Authentication by VLR 5. Subscription check (Authorisation for services) 6. Traffic Channel Assignment and Routing to B-Subscriber by MSC 7. Connection will be established when B-Subscriber answers. Dipl. Ing. Ingo Schacht Page 17 Siemens, 2003

18 Mobile Terminating Call (MTC) MS Access Network Core Network HLR Mobility MAP VLR ISUP ISUP SS7 Switch STP BSSAP BSS SS7 MSC GMSC transit network PSTN / ISDN 1. PSTN Subscriber dials MSISDN from MS. 2. Digit analysis in PSTN results routing into PLMN. 3. Network access to a PLMN always via GMSC (Gateway-MSC). 4. GMSC needs routing information to VMSC of MS! Interrogation 5. GMSC establishes a connection to MSC and sends forward the MSRN. 6. MSC requests by means of MSRN the TMSI and the LAI of MS from the VLR stored during last LUP of MS. Paging Dipl. Ing. Ingo Schacht Page 18 Siemens, 2003

19 Interrogation(I) Purpose: - Provisioning of routing information from GMSC to VMSC for incoming calls (MTC) Trigger: - Always in GMSC - Digit processing of MSISDN (MSub-B) detects interrogation necessary Affected entities: - GMSC - HLR - MSC/VLR Dipl. Ing. Ingo Schacht Page 19 Siemens, 2003

20 Interrogation(II) VMSC VLR HLR/AC GMSC VLR HLR/AC GMSC Detection of HLR-ID from MSISDN of MSub-B sendroutinginfo (MSISDN) IMSI and VLR-Nr. of MSub-B from last LUP? provideroamingnumber(imsi) Create and store MSRN provideroamingnumberresult(msrn) sendroutinginforesult (MSRN) Dipl. Ing. Ingo Schacht Page 20 Siemens, 2003 MTC

21 Paging (I) Purpose: - Determination of current subscriber location Trigger: - Incomming call (MTC) Affected entities: - MS - MSC/VLR Dipl. Ing. Ingo Schacht Page 21 Siemens, 2003

22 Paging (II) BSC VLR MSC BTS BTS BTS I m here!! BTS BTS BTS 1. MSC requests all BSCs that support the location area stored during last LUP to sent a search message to the MS. PAGING BTS 2. MS answeres with the current cell info. BSC 3. After new authentication and allocation of new TMSI by VLR connection will be established! Dipl. Ing. Ingo Schacht Page 22 Siemens, 2003

23 Handover What is Handover? If a mobile subscriber changes the cell during stable call the BTS of the new cell takes over the connection without interruption. Handover (HO) General 4 kinds of Handover Controlled by Access Network Controlled by Core Network BSC controlled HO BSC controlled HO MSC controlled HO MSC controlled HO Intra-Cell HO Intra-MSC HO Inter-Cell HO Inter-MSC HO Dipl. Ing. Ingo Schacht Page 23 Siemens, 2003

24 Kinds of Handover BSC controlled HO Intra-Cell HO - Changing the physical channel inside a cell Inter-Cell HO - Changing the cell MSC controlled HO Intra-MSC HO - Changing the serving BSC Inter-MSC HO - Changing the visited MSC Dipl. Ing. Ingo Schacht Page 24 Siemens, 2003

25 Common Phases of every HO Basically there are 4 phases: Phase 1: BSC decides if HO is necessary! Phase 2: Parallel to existing connection a second connection will be established! Phase 3: MS switches over to new connection! Phase 4: Originally connection will be released! Dipl. Ing. Ingo Schacht Page 25 Siemens, 2003

26 Example Inter-MSC HO Phase 4: MS switches Phase over 2: to new radio channel of new cell. MSC1 requests HON from MSC2 BSC and informs MCS2 about the new cell of MS. After succesful switch over the originally connection will be released by MS. BTS BSC of new cell provides corresponding radio ressources. HON and radio ressource data are sent back Phase 3: to MSC1. MSC1 establishes connection to BTS MS BTS BTS MSC2 by using HON. MSC2 establishes connection to new BSC and to new cell. BTS BTS MSC1 informs MS about the new radio ressource data and requests switch over. VLR MSC 1 VLR MSC 2 Phase 1: BTS During stable connection MS measured permanent signal level of own and surrounding cells. Results are transmitted to BSC. BSC decides MSC-controlled HO necessary and informs MSC1. BSC Dipl. Ing. Ingo Schacht Page 26 Siemens, 2003

27 Network Migration from GSM to UMTS Overview about Network Migration from GSM Over GPRS To UMTS Dipl. Ing. Ingo Schacht Page 27 Siemens, 2003

28 Classic GSM 2G Access Network HLR Mobility Core Network BSC A TDM transit network Switch STP SS7 PSTN / ISDN TDM VMSC GMSC TDM Dipl. Ing. Ingo Schacht Page 28 Siemens, 2003

29 GPRS 2G Access Network HLR Mobility Core Network BSC A TDM transit network Switch STP SS7 PSTN / ISDN TDM VMSC GMSC TDM FR G b Core Network SGSN IP GGSN IP Global IP Network Dipl. Ing. Ingo Schacht Page 29 Siemens, 2003

30 UMTS 3G UMTS Access Network HLR Mobility Core Network BSC A TDM transit network Switch STP SS7 PSTN / ISDN TDM VMSC GMSC TDM FR Access Network G b ATM Iu CS Core Network RNC UTRAN Iu PS IP ATM SGSN IP GGSN Global IP Network Dipl. Ing. Ingo Schacht Page 30 Siemens, 2003

31 Back Up Back Up Dipl. Ing. Ingo Schacht Page 31 Siemens, 2003

32 Abbreviations (I) A3 Encryption algorithm for authentication (SRES) A8 Encryption algorithm for ciphering (Kc) AC Authentication Centre ATM Asynchronous Transfer Mode BSC Base Station Controller BSS Base Station Subsystem BSSAP BSS Application Part BTS Base transceiver station CAMEL Customized Applications Mobile network Enhanced Logic CAP CAMEL Application Part CN Core Network CS Circuit Switched DCS Digital Cellular System EIR Euipment Identity Register FR Frame Relay GGSN Gateway GPRS Support Node GMSC Gateway MSC GPRS General Paket Radio System GSM Global System for Mobile Communication HLR Home Location Register HON HandOver Number IMSI International Mobile Subscriber Identity IN Intelligent Network IP Internet Protocol ISDN Integrated Services Digital Network ISUP ISDN User Part Kc Cipher Key Ki Individual Subscriber Authentication Key LAI Local Area Indentity LMSI Local Mobile Subscriber Identity LUP Location Update MAP Mobile Application Part Dipl. Ing. Ingo Schacht Page 32 Siemens, 2003

33 Abbreviations (II) ME Mobile Equipment MGW Media Gateway MOC Mobile Origination Call MS Mobile Station MSC Mobile Switching Centre MSISDN Mobile Subscriber ISDN MSRN Mobile Subscriber Roaming Number MSub Mobile Subscriber MTC Mobile Terminating Call OMS Operation & Maintenance Subsystem PLMN Public Land Mobile Network PO Paket Oriented PSTN Public Switched Telephone Network RAND Random Number RNC Radio Network Controller RNS Radio Network System RSS Radio Subsystem SCP Service Control Point SGSN Serving GPRS Support Node SIM Subscriber Identity Module SRES Signed Response SS7 Signalling System No.7 SSS Switching Subsystem STP Signalling Tranfer Point TDM Time Division Multiplexing TMSI Temporary Mobile Subscriber Identity UMTS Universal Mobile Telecommunications System USIM UMTS SIM VLR Visitor Location Register VLR-Nr VLR-Number VMSC Visited MSC Dipl. Ing. Ingo Schacht Page 33 Siemens, 2003

34 Network structure defined by 3GPP VLR MSC server Mc B CS-MGW PSTN PSTN Nb G E Nc BSS Um PSTN CS- MGW BTS Nb CS-MGW Mc VLR B MSC server Mc A BSC Abis PSTN GMSC server Nc Gb BTS D C HLR EIR Gs Mh H Gc F Gf AuC Gr IuCS Gi GGSN IuPS RNC Iub RNS Node B Node B cell Uu Gn SGSN Gp Iur CN RNC PSTN: Public Switched Telecommunication Network CN: Core Network CS: Circuit Switched MGW: Media Gateway MSC: Mobile Switching Centre GMSC. Gateway-MSC PO: Packet Oriented GSN: GPRS Support Node SGSN: Serving-GSN GGSN: Gateway-GSN VLR: Visitor Location Register HLR: Home Location Register EIR: Equipment Identity Register BSS: Base Station System BSC: Base Station Controller BTS: Base Transceiver Station RNC: Radio Network Controller RNS: Radio Network System SIM ME SIM-ME i/f or Cu USIM ME: Mobile Equipment SIM: Subscriber Identity Module USIM: UMTS-SIM MS: Mobils Station MS Dipl. Ing. Ingo Schacht Page 34 Siemens, 2003