CS CORE- CALL FLOWS

PREPARED BY
SAIF UL ISLAM SAJID

MS Authentication
Whenever an MS attaches to the network or its inter-MSS location update is required,
authentication is performed

a) MS attaches to the network or LU is performed

d) MSS sends RAND to MS.
e) MS sends SRES which it generates by using A3
algorithm on RAND & Ki. The two SRES are then
compared in MSS and if they are equal, the user is
authenticated.
MSS also sends TMSI and LAI to MS and updates
its location in VLR.
f) Ciphering is enabled between the MS & BSS
using 3-way handshake. Kc is generated using A8
algorithm on RAND & Ki

b) MSS requests the HLR for

authentication triplets (RAND,
Kc & SRES) which are
held/calculated with AuC

c) HLR
forwards these
triplets to MSS

Voice Call Setup

(step by step)

1. Radio Resource (RR)

and Mobility Management
(MM) parameters are
negotiated between the MS
& BSS
0. A-party dials
the number

2. Cellular Management (CM) request is received by the

BSS, which then forms BSSMAP complete layer3
information msg. The BSS then piggybacks it on the
SCCP connection request msg and sends to MSS

4. MSS initiates ciphering

and sends a BSSMAP
ciphering mode
command to the BSS,
which then ciphers (using
A5 algorithm) the data
being sent on TCH to
prevent eavesdropping

5. BSS sends BSSMAP ciphering mode

complete msg to the MSS. After this point,
the BSS becomes transparent for
communication between MSS & MS (thus
BSS will not be shown in following slides
unless necessary)

3. MSS checks
whether MS is
authentic. Since
authentication has
already been
performed, the
MSS does not reauthenticate.

Voice Call Setup

(step by step-contd.)
6. MS sends Call
Control (CC) call setup
msg which contains the
digits of dest #
MSS-A
7. MSS replies with CC
call proceeding msg
which tells the MS that
it is establishing link
with the B-party

9. MSS sends Initial

Detection Point (IDP)
msg to IN

8. MSS reserves a
circuit on CGR and
informs the BSS, which
then informs the MS to
switch to voice mode.

14. HLR responds

with SRI-Ack
10. IN responds
with Request
Return BCSM
Event (RRBE)
and Apply
Charging (AC)
msg

11. MSS sends

Send Routing
Info (SRI) msg to
HLR

12. HLR sends

Provide Roaming
Number (PRN) to
MSS of party-B

13. MSS of party-B

responds with Mobile
Subscriber Roaming
Number (MSRN).

MSS-B

Voice Call Setup

(step by step-contd.)

15. MSS of party-A sends Initial Address Msg

(IAM) to MSS-B
MSS-A

16. MSS-B responds with Address Complete Msg

(ACM) and establishes communication with
party-B
17. MSS-B then sends Answer Msg (ANM) when
party-B answers the call and communication is
established between the two parties.

MSS-B

Voice Call Termination

18. Assuming that Subs-A drops

the call, CC disconnect msg is
sent to MSS
23. MSS responds with CC
release msg

20. Voice circuits with

BSS are released

MSS-A

24. MS sends CC release

complete msg to MSS to indicate
that the call has been released.

26. RR release is
negotiated and the
reserved radio
resources are freed

27. BSS sends BSSMAP

clear complete msg to MSS to
indicate that all occupied
resources are now free

19. ISUP release msg is

sent to MSS-B
21. MSS-A releases the
circuits and sends
ISUP released msg to
MSS-B
22. MSS-B responds
with ISUP release
complete msg

25. MSS sends

BSSMAP clear
command to BSS

MSS-B

SMS Call Flow

iii) MSS sends MOSMS msg to SMC (aka
SMSC)
i) MS sends the SMS to
MSS

MSS-A

iv) SMC sends MOSMS ack msg to MSS

vi) SMC sends MT

forward short msg
(which contains the
original SMS) to MSS-B
vii) MSS-B
sends MT
forward short
msg ack to
SMC

ii) MSS consults with

IN if the user has
sufficient balance and if
so, it responds to MSS
v) SMC
performs SRI
for SMS with
HLR

MSS-B

Location Update
LU can be done in 3 cases:
IMSI attach (already covered in slide 2)
Periodic LU
Inter LAC LU
Intra-MSS LU
Inter-MSS LU

Periodic LU:
It is done to keep a check on the presence of MS in the network.
There is an IMSI detach timer in the VLR, which if times out, will detach the subscriber, delete
its entry and inform the HLR.
Thus, to keep the user attached a timer, T3212, is implemented in the BSS.
This timer is network dependent and for TP it is 6 hours.
BSS keeps the MS informed about this timer through its BCCH channel and MS keeps track of
time expiry through its own counter.
When the time expires, the MS performs an LU.

Location update
Inter-LAC, Intra-MSS

new

ii) Radio Resources

assignment is negotiated
between MS & BSS

i) MS continuously monitors
the BCCH channel and
upon changing cells during
movement when it notices
that broadcasted LAC has
changed, it will initiate LU

iii) MM location
update request is
sent by MS to BSS.
This msg contains
LAI & TMSI.
viii) Ciphering is
enabled and MM & RR
are released by the BSS
with a 3-way
handshake

iv) BSS sends BSSMAP

complete layer 3 msg to
the MSS which contains
location update request

vi) BSSMAP
clear command is
sent to the BSS

vii) BSSMAP
clear complete is
sent to the MSS

new

v) MSS notes that the LAC is

covered by itself and updates the
VLR with new LAC

Location update
Inter-MSS
i) MS continuously
monitors the BCCH
channel and upon
changing cells during
movement when it
notices that broadcasted
LAC has changed, it will
initiate LU

ii) Radio Resources

assignment is negotiated
between MS & new BSS

iii) MM location update

request is sent by MS to
new BSS. This msg
contains LAI & TMSI.

iv) BSS sends BSSMAP

complete layer 3 msg to
the MSS which contains
location update request
new

viii) MM & RR are

released by the BSS
with a 3-way
handshake

old

vi) New MSS contacts the old one using MAP/G send
parameters msg which contains TMSI and requests the
IMSI of the subs
vii) Old MSS sends MAP/G send parameters result msg to
the new MSS

viii) MSS sends

MAP/D update
location msg to
the HLR

ix) HLR sends

MAP/D insert
subs data which
contains
authentication
triplets

new

v) MSS notes that old LAC was

covered by another MSS, so it
contacts that MSS using TMSI of
the subs and HLR for its Database

Location update
Inter-MSS (contd.)

xi) HLR sends MAP/D cancel

location msg to the old MSS
old

xii) MSS sends MAP/D cancel

location result msg to HLR and
releases TMSI & deletes subs
entry from its VLR

x) MSS replies
with MAP/D
insert subs data
result msg

xiv) MS is authenticated by MSS.

xv) Ciphering mode is enabled on radio channels for
secure communication.
xvi) MSS sends MM location updating accept msg to
MS which contains new TMSI.
xvii) MS sends MM TMSI reallocation complete msg
to MSS
xviii) RR are cleared between MS & BSS upon request
of MSS.

xiii) HLR sends

MAP/D update
location result
after updating its
record

new

Inter-MSS HO During Call

8) MSS allocates a HO
number through which interMSS call will be initiated.

6) BSS allocates a TCH.

5) BSSMAP HO request msg is sent to the new
BSS. It contains target cells and origin cell
new

new
7) BSSMAP HO request ack msg is sent to the
MSS. It contains RR HO command msg which
contains all the parameters which the MS will need
to switch to the best cell.
9) New MSS sends MAP
prepare HO response
msg. It contains RR HO
command and HO
number msg

1) MS sends periodic RR
measurement report of its
current and neighboring
cells to the BSS

anchor

3) BSSMAP HO required msg is sent to MSS. It

contains target cells and origin cell

2) BSS analyses the measurements

received and when the signal
quality of its serving cell falls below
threshold, HO is requested. A list of
target cells is provided to the MSS.

4) Anchor MSS sends

MAP prepare HO msg
to the new MSS. It also
contains target and
origin cells

anchor

Inter-MSS HO During Call

(contd)

15) BSS sends BSSMAP HO detected to the MSS

and then MSS switches to the voice path.
new

new

14) RR HO accept is sent

to the BSS through access
burst and it contains HO
reference

10) IAM msg sent 11) ACM msg sent

to the new MSS
to the anchor MSS
using HO number and call is setup.
13) RR HO command is
sent to MS which
contains HO reference
and TCH

anchor

12) BSSMAP HO command msg is sent to BSS. It

RR HO command.
anchor

Inter-MSS HO During Call

(contd)

19) BSSMAP HO complete msg is sent to MSS. It

RR HO command.
new

new

17) BSS sends RR physical

info to the MS. This msg
contains time & freq
correction
18) Signaling connection is
completed between the MS &
BSS. Then, MS sends RR HO
complete msg to the BSS.

16) MAP access signaling request

is sent to the old MSS to inform
that HO has been detected
20) MAP send end signal is sent
to the old MSS. It contains HO
complete
21) ISUP Ans msg is sent to the
old MSS to establish voice call.

anchor

22) BSSMAP clear command msg is sent to the

old BSS to release the RR connection
anchor
23) BSSMAP clear complete msg is sent to the
MSS to indicate that RR connection have been
released.

Inter-MSS HO During Call

(Call Cleared)

new

25) ISUP RLC msg is sent

by the new MSS.
24) SUBS HAVE HUNG UP:
ISUP Release msg is sent by
the anchor MSS.
26) MAP send end signal
response is sent to indicate that
HO call has ended.

anchor

Thank you