Académique Documents
Professionnel Documents
Culture Documents
1. Overview
2. Transport Protocols
3. Application Protocols
4. Signaling Procedures
5. Signaling Analysis
V100R001
HUAWEI UMTS Circuit-Switched Core Network
Protocols and Signaling Analysis
BOM 31026440
Huawei Technologies Co., Ltd. provides customers with comprehensive technical support
and service. Please feel free to contact our local office or company headquarters.
Website: http://www.huawei.com
Email: support@huawei.com
Copyright © 2004 Huawei Technologies Co., Ltd.
Trademarks
All other trademarks mentioned in this manual are the property of their respective
holders.
Notice
The information in this manual is subject to change without notice. Every effort has
been made in the preparation of this manual to ensure accuracy of the contents, but
all statements, information, and recommendations in this manual do not constitute
the warranty of any kind, express or implied.
Summary of Updates
This section provides the update history of this manual and introduces the contents of
subsequent updates.
Update History
This manual is updated for a major product version to maintain consistency with system
hardware or software versions and to incorporate customer suggestions.
Updates of Contents
None.
About This Manual
Release Notes
Organization
Intended Audience
Conventions
Convention Description
Arial Normal paragraphs are in Arial.
Arial Narrow Warnings, Cautions, Notes and Tips are in Arial Narrow.
Boldface Headings are in Boldface.
Courier New Terminal Display is in Courier New.
II. Symbols
Eye-catching symbols are also used in the manual to highlight the points worthy of
special attention during the operation. They are defined as follows:
Table of Contents
Part 1 Overview
i
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
ii
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
iii
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
iv
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
v
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
vi
Feature Description
HUAWEI UMTS Circuit-Switched Core Network Table of contents
vii
HUAWEI
Part 1 Overview
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
Table of Contents
i
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
Chapter 1 Overview
1.1 Introduction
This chapter gives a general introduction of the interface types and protocols applying
to variors interface of the circuit switched core network (CSCN), including:
z CSCN Interfaces and Protocols
z Brief Introduction to Interfaces
z CSCN Protocol System
z CSCN Protocol System
As open network entities, the above equipment and external interfaces must adopt
open protocols. Figure 1-1 shows the external interfaces and protocols of various CS
entities.
1-1
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
CAP/L
SCP
HLR
SGSN
Lg
GMLC Gs
E
SMC C/D C
Nc/E SIGTRAN
BSC MSC Server (G)MSC Server SG
A TUP/
Mc Mc ISUP
Nb PSTN
RNC MGW MGW
Iu-CS
CS
BSC: Base Station Controller CAP: CAMEL Application Part HLR: Home Location Register
GMLC: Gateway Mobile Location Cente MGW: Media Gateway RNC: Radio Network Controller
SGSN: Serving GPRS Support Node SIGTRAN: Signaling Transport SMC: Short Massgae Center
SCP: Service Control Point SG: Signaling Gateway PSTN: Public Switched Telephone
Network
Figure 1-1 CNCS interface
Table 1-1 lists the external interfaces and protocols of various CS network entities.
MSC–––BSC A BSSAP
VLR–––HLR D MAP
MSC–––MSC
E MAP
MSC Server–––SMC
VLR–––VLR G MAP
MSC–––PSTN
- ISUP/TUP
MSC–––PLMN
1-2
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
HLR–––SCP
HLR–––SGSN
MGW–––MGW Nb Nb UP
Note:
The interface and the protocol adopted between the physical entities have no one-to-one relationship.
z One protocol may be adopted over several different interfaces.
For instance, the Mobile Application Part (MAP) protocol is adopted on the C, D, E, G, Lg, and L
interfaces.
z Several interfaces may exist between two entities while different protocols are adopted for each
interface.
For instance, both Nc and E interfaces are defined between two MSC Servers, where the Bearer
Independent Call Control (BICC) protocol is adopted for the Nc interface and the MAP protocol for the E
interface.
I. Iu-CS Interface
Iu-CS interface refers to the interface between the CS and the UMTS terrestial radio
access network (UTRAN) in the WCDMA network. It is embodied as the interface
between the MSC and the RNC. It comprises:
z Control panel (CP)
The interface between the MSC Server and the RNC, also called lu CP.
z User panel (UP)
The interface between the MGW and the RNC, also celled lu UP.
Iu-CS interface adopts the Radio Access Network Application Part (RANAP) as the
protocol of the lu CP, which is used to send the following information:
z UTRAN management
z Call handling
z Mobility management
1-3
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
Iu-CS interface adopts the Iu UP protocol to bear and transmit the traffic.
II. A Interface
A interface refers to the interface between the cicuit switched (CS) domain of the
GSM network subsystem (NSS) and the base station subsystem (BSS). It is
embodied as the interface between the MSC and the BSC.
A interface adopts the Base Station Subsystem Application Part (BSSAP) protocol in
the SS7 signaling system. It comprises voice channel and signaling channel. It is
used to pass the following information:
z Mobile station (MS) management
z Base transceiver station (BTS) management
z Mobility management
z Call handling
III. B Interface
B interface refers to the interface between the MSC Server and the VLR. It has no
specific regulation on the signaling mode. It adopts the internal protocols. Through it:
z MSC Server obtains user informaton from VLR.
z When a MS implements the location update, MSC Server notifies VLR to record
the location information.
z When a MS activates a specific supplementary service or modifies related
service data, MSC Server notifies HLR to update the data through VLR.
IV. C Interface
C interface refers to the interface between the MSC Server and HLR. It adopts the
MAP protocol in the SS7 signaling system. Its functions include:
z When a MS is called, HLR sends routing information to MSC Server.
z It is used to pass short messages.
z For CAMEL application, it is used to obtain the rouging information, user status,
and subscriptioin information when a MS is called.
V. D Interface
D interface refers to the interface between the VLR and the HLR. It adopts the MAP
protocol in the SS7 signaling system. It is used to pass the following information.
z Authentication data
z Location update information
z User data in call setup
z Supplementary data
z VLR restoration information
1-4
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
For CAMEL application, it is used to pass CAMEL user data and provide the mobile
station roaming number (MSRN) to the public land mobile network (PLMN) visited.
VI. E Interface
E interface refers to the MAP interface between the MSC Server and the (G) MSC
Server or the interface between the MSC Server and SMC. It adopts the MAP
protocol in the SS7 signaling system. It is used to pass the following information:
z Switchover information
z Short messages
z Call control after inter-MSC switchover
VII. F Interface
F interface refers to the interface between the MSC Server and the equipment identity
register (EIR). It adopts the MAP protocol in the SS7 signaling system.
When the MSC Server needs to check the validity of the international mobile station
equipment identity (IMEI), it must exchange information related to the IMEI with the
EIR through F interface.
VIII. G Interface
G interface refers to the interface between the VLRs. It adopts the MAP protocol in
the SS7 signaling system. It is used to pass the following information:
z Location update data
When a MS roams to a new VLR, it obtains the IMSI from the former VLR.
z Authentication data
The authentication parameter is sent from the former VLR to the current one.
Because the MSC Server and the VLR are integrated, G and E interfaces are
combined as E interface.
IX. Lg Interface
Lg interface refers to the interface between the MSC Server and the GMLC. It is used
to support the location service (LCS). It adopts the MAP protocol in the SS7 signaling
system. Through it:
z GMLC originates a location request of a destination user to the current MSC
Server.
z MSC Server returns a result.
z MSC Server reports the location inforamtion of the destination user to GMLC.
1-5
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
X. L Interface
L interface refers to the MAP interface between the SSP and the SCP. It adopts the
MAP protocol in the SS7 signaling system. It is used to report the invoke notification
of the supplementary service.
Note:
The aboveC, D, E, F, G, Lg, and L interfaces all adopt the MAP prototocl. Sometimes, all these
interfaces are called MAP interfaces.
XI. Gs Interface
Gs interface refers to the interface between the MSC Server and the SGSN. It adopts
the base station system application part+ (BSSAP+) protocol in the SS7 signaling
protocol. Its functions include:
z SGSN sends MS location information to MSC Server.
z SGSN receives paging information from MSC Server.
z MSC Server announces that the MS is implementing the service handled by
MSC Server.
XII. H Interface
H interface refers to the interface between the HLR and the AuC. It has no specific
regulation on the signaling mode. It is used to pass the user authentication and
encryption data.
XIII. Mc Interface
Mc interface refers to the interface between the MSC Server and the MGW. It adopts
the H.248 protocol. Throug it:
z During call handling process, MSC Server controls static and dynamic resources
(including terminal properties, terminal connection relation, and media stream) of
various transmission modes (IP/ATM/TDM).
z MSC Server sends status maintenance and management information to the
MGW.
XIV. Nc Interface
Nc interface refers to the interface between the MSC Servers. It adopts the bearer
independent call controller protocol (BICC). It provides inter-MSC call control ability
1-6
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
XV. Nb Interface
Nb interface refers to the interface between the MGWs. It is used to bearer control
and transmission. The transmission mode of the user data can be RTP/UDP/IP or
AAL2.
CAMEL application part (CAP) interface refers to the interface between the SSP and
the SCP, between the HLR and SCP. It adopts the CAP protocol in the SS7 signaling
system. It is used to realize the signaling exchange between functional entities (SSP,
IP, and SCP) of the intelligent network, thus supporting CAMEL services.
When the MSOFTX3000 functions as the GMSC Server, it provides the interface for
the fixed network switching equipment or other mobile network equipment, and
controls incoming/outgoing calls through the integrated services digital network user
part (ISUP) or the telephone user part (TUP) of the SS7 signaling system.
In the UMTS network, this interface is used to pass the switched circuit network (SCN)
signaling through the IP network. It adopts the SIGTRAN protocol stack.
From the view of different protocol functions, MSOFTX3000 protocol system includes:
z SS7 application protocols
– ISUP
– MAP
– CAP
1-7
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
B OSI
R B layers
I S
A S M C BICC H.248
S S
N S A A 7
Application U A
A A P P
P P
Protocols P P
+
TCAP 6
Transport
Protocols SCCP 5
4
MTP3b 3
MTP3 M3UA
SCTP SSCF-NNI
MTP2 2
IP SSCOP
1
MTP1 MAC ATM
1-8
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
I. Application Protocols
The application protocols are at the top of the protocol stack, implementing the
information interaction function on the interfaces between the communication entities.
The application protocols use the service provided by the transport protocols at the
lower layers.
The transport protocols refer to all the lower-layer protocols below the application
protocols. (The transport protocola mentioned here are “protocol stack”). They
provide message transmission service for the application protocols according to the
application protocols’ requirements.
Iu UP H.248 Nb UP
Q.AAL2
AAL2 SAR STC
M3UA RTP RTCP
SSCS MTP-3b
AAL2 SAAL SCTP UDP
ATM IP
ATM-based IP-based
In CSCN application, HLR9820 protocol system includes the MAP protocol in the SS7
signaling system. It is based on TDM, IP, or ATM, as shown in Figure 1-4.
1-9
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
Application
MAP
parts
TCAP
Message Transfer
SCCP
Part
M3UA MTP3b
MTP3
SCTP SSCF-NNI
MTP2
IP SSCOP
Based on the above analysis, the CS product protocols can be divided into:
z SS7 signaling protocols
Apply to MSOFTX3000 and HLR9820, based on TDM, IP, and ATM.
For instance, the RANAP protocol is used on the Iu-CS interface, and BSSAP used
on the A interface.
1-10
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
The SS7 has a 4-layer structure. In view of its functions, the SS7 is divided into User
Part and Message Transfer Part. See Figure 1-5.
B
R B
I S
A S M C
S S
N S A A
U A
A A P P
P P
P P
+ Application Parts
M3UA MTP3b
MTP3
SCTP SSCF-NNI
MTP2
IP SSCOP
MTP1 MAC ATM
I. MTP Protocol
UP protocol is the functional entity that uses the MTP capability. It is resident at the
top of the SS7 and is used to achieve a variety of services and applications. The SS7
UP protocol is composed of several independent user protocols, including:
1-11
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
z ISUP
z MAP
z CAP
z RANAP
z BSSAP
z BSSAP+
The BICC protocol applies to the Nc interface of the UMTS network for interworking
between the MSC Servers. As one of the application layer control protocols, it is used
to establish, modify, and terminate calls. It can bear comprehensive
PLMN/PSTN/ISDN services.
The BICC protocol evolves from the ISUP protocol and has it developed. It is
characterized by the separation between the call control level and the bearer control
level, thus the Call Service Function is independent of the Bearer Control Function.
BICC
Application Protocol
Transport Protocols
1-12
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
H.248 protocol is the subsequent protocol of the media gateway control protocol
(MGCP), but their concepts are totally different.
The transport layer of the H.248 signaling messages may be IP based Stream
Control Transmission Protocol (SCTP) or ATM based MTP3b. See Figure 1-7.
H.248
Application Protocol
Transport Protocols
SCTP MTP3b
SSCF-NNI
IP
SSCOP
MAC
ATM
I. Protocols over IP
Nb UP
RTP RTCP
UDP UDP
IP IP
1-13
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Overview
z Nb UP
z RTP
z RTCP
z UDP
z IP
Figure 1-9 shows the structure of Nb UP protocol over IP, which is consistent with that
of lu UP.
Q.AAL2
Transmission layer
AAL2 SAR STC
SSCS MTP-3b
AAL2 SAAL
ATM
1-14
HUAWEI
Table of Contents
i
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
ii
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
Narrowband Message Transfer Part (MTP) is the traditional TDM based transmission
system. Its major function is to enable reliable transmission of signaling messages
over signaling network, and to take measures to avoid or minimize message loss,
duplication or mis-sequencing in case of system fault or signaling network fault. The
functions of the MTP are separated into three functional levels: signaling data link
(MTP1), signaling link functions (MTP2) and signaling network functions (MTP3). The
structure of the MTP protocol stack is illustrated in Figure 1-1.
ISUP
MTP3
MTP
MTP2
MTP1
The MTP in the signaling-processing module of MSC and HLR is used to convey SS7
user signaling (ISUP/SCCP). It is designed completely in compliance with the ITU-T
Recommendations Q.701 to Q.710 Series.
1.1 MTP1
Signaling data link is the level 1 function (MTP1) of the MTP. It defines the physical,
electrical and functional characteristics of a signaling data link and the means to
access it. It is equivalent to the physical layer of the OSI reference model and is used
to generate and receive the signals through the physical channels.
A signaling data link is a bidirectional transmission path for signaling, comprising two
data channels operating together in opposite directions at the same data rate. The
standard bit rate on a digital bearer is 64kbit/s. A transmission link at a lower bit rate
(for example, 4.8kbit/s) or at a higher bit rate (for example, 2048kbit/s) may also be
applied.
1.2 MTP2
Signaling link functions are the level 2 functions (MTP2) of the MTP. They are used to
transfer signaling to a data link. The level 2 functions together with a level 1 signaling
1-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
data link provide a signaling link for reliable signaling transfer between two directly
associated signaling points.
The signaling link functions include signal unit delimitation, signal unit alignment, error
detection, error correction, initial alignment, processor outage, level 2 flow control and
signaling link error monitoring.
1.3 MTP3
Signaling network functions are the level 3 functions (MTP3) of the MTP. They
implement the functions of the network layer of the OSI reference model, and are
used to enable management message transmission between the signaling points for
the purpose of ensuring a reliable transfer of the signaling messages over the
signaling network in case that signaling links and signaling transfer points fail.
1.3.1 Functions
The signaling network functions provided by the MTP3 must ensure a reliable transfer
of the signaling messages even in the case of the failure of signaling links and
signaling transfer points. Therefore, they include the appropriate functions and
procedures necessary both to inform the remote parts of the signaling network of the
consequences of a fault, and to appropriately reconfigure the routing of messages
through the signaling network
The signaling network functions are divided into two basic categories, namely
signaling message handling and signaling network management. See Figure 1-2.
1-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
Incoming
Message
routing
Signaling traffic
management
The purpose of the signaling message handling functions is to ensure that the
signaling messages originated by a particular User Part at a signaling point
(originating point) are delivered to the same User Part at the destination point
indicated by the sending User Part.
The signaling message handling functions are divided into:
z the message routing function, used at each signaling point to determine the
outgoing signaling link on which a message has to be sent towards its
destination point;
z the message discrimination function, used at a signaling point to determine
whether or not a received message is destined to the point itself. When the
signaling point has the transfer capability and a message is not destined to it,
that message is transferred to the message routing function;
z the message distribution function, used at each signaling point to deliver the
received messages (destined to the point itself) to the appropriate User Part.
1-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
For the purpose of meeting the requirements of the MTP for transmitting a variety of
signaling messages, three basic types of signal unit are defined: Message Signal Unit
(MSU), Link Status Signal Unit (LSSU), and Fill-In Signal Unit (FISU).
z Message signal units are used to carry messages of the user parts, signaling
network management messages, and signaling network testing and maintenance
messages.
z Link status signal units provide the information about the link status in order to
perform control actions such as connection and restoration on the signaling link.
z Under normal conditions, when no message signal units or link status signal
units are to be transmitted over the signaling links, fill-in signal units are sent
continuously with the feeding objective, for the purpose of maintaining the normal
operation of the signaling links.
The structure of the signal units is illustrated in Figure 1-3.
1-4
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
8 16 8 or 16 2 6 1 7 1 7 8 First bit
transmitted
Format of a link status signal unit (LSSU)
8 16 2 6 1 7 1 7 8 First bit
transmitted
Format of a fill-in signal unit (FISU)
A signal unit is divided into two parts from the structure point of view. One is shared
by the variety of signal units and required by the MTP processing; this part comprises
8 fixed length fields. The other contains the signaling information to be handled by the
user part.
This part includes Flag (F), Forward Sequence Number (FSN), Forward Indicator Bit
(FIB), Backward Sequence Number (BSN), Backward Indicator Bit (BIB), Length
Indicator (LI), Check bits (CK), Status Field (SF), and Service Information Octet (SIO)
(SIO only exists in message signal units).
z Flag (F)
There is a flag at the start and the end of every signal unit. In the transmission of
signal units, the opening flag of a signal unit is normally the closing flag of the
preceding signal unit. Therefore, a signal unit will be delimitated once the opening
and closing flags are successfully found from the information stream.
The bit pattern for the flag is 01111110.
In addition to signal unit delimitation, several flags may be inserted between signal
units, in case that the signaling links are overloaded, in order to cancel controlling and
reduce loading.
z Forward sequence number (FSN)
The forward sequence number is the 7-bit sequence number of the message signal
unit in which it is carried. At the transmitting terminal, all the transmitted message
signal units are allocated with a forward sequence number which is numbered from a
cyclic sequence ranging from 0 to 127. At the receiving terminal, the forward
sequence numbers of the received message signal units are used to detect the order
of the message signal units, as a part of the acknowledgement function. If
retransmission is required, the forward sequence number also serves to identify the
1-5
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
signal unit to be retransmitted. A fill-in signal unit and a link status signal unit share
the forward sequence number of the last transmitted message signal unit instead of
being assigned again.
z Forward indicator bit (FIB)
One bit is occupied. The forward indicator bit is used in the retransmission procedure
of message signal units. It has the same status as the received backward indicator bit
during non-error operation. A change made to the value of the received backward
indicator bit indicates a request for retransmission. The signaling terminal also
changes the value of the forward indicator bit (changing 1 to 0 or 0 to 1) when
retransmitting the message signal unit, in order to keep consistent with the backward
indicator bit value, until the value of the backward indicator bit changes at receiving
another retransmission request.
z Backward sequence number (BSN)
The backward sequence number is the sequence number of a message signal unit
being acknowledged. It is sent by the receiving terminal to indicate to the transmitting
terminal that the message signal unit is acknowledged (accepted successfully).
In the case of a request for a retransmission, the backward sequence number
indicates the sequence number for starting the retransmission.
In the operation of the signaling network, the transmitting terminal and the receiving
terminal of a message independent assign the forward sequence number.
Limited by the forward sequence number and the backward sequence number, not
more than 127 signal units can be transmitted while not be acknowledged.
z Backward indicator bit (BIB)
The backward indicator bit provides a retransmission request for the received error
signal unit. If the received message signal unit is correct its value will be invariable
when a new signal unit is sent; otherwise this bit will be sent with a conversed value
(that is, 0 is changed to 1 or 1 is changed to 0), requesting the terminal peer to
retransmit the error message signal unit.
z Length indicator (LI)
The length indicator is used to indicate the number of octets following the length
indicator octet and preceding the check bits. The length indicator differentiates
between the three types of signal units.
The 6-bit length indicator field is a number in binary code in the range 0~63 (decimal).
The length indicator values of the three types of signal units are as follows:
Length indicator = 0 Fill-in signal unit
Length indicator = 1 or 2 Link status signal unit
Length indicator > 2 Message signal unit
1-6
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
In the national signaling network, the length indicator is invariably set to 63 if the
signaling information field of a message signal unit is more than 62 octets. In the case
that the length indicator equals 63, the maximum length indicated by it cannot be
more than 272 octets.
Note that it is necessary to calculate the number of bits and the number of octets
between two flags in the receiving process of signal units. According to the CCITT,
the number of bits between two signal unit flags must be an integral multiple of 8. The
number of octets may be equal to 0 (if only flags are sent), be equal to 5 (fill-in signal
unit), or be less than or equal to m+7 (m is 272). For a number out of such range, the
signal unit is treated as error.
z Check bits (CK)
The check bits field is used for error detection of a signal unit. It is composed of 16
bits.
The seven fields described above appear in all the three types of signal units. (Eight
such fields are mentioned in the previous section, where the closing flag is included.)
They are mandatory to every signal unit.
z Status field (SF)
The status field is unique to link status signal units and is used to indicate the status
of a signal link.
The length of the status field may be one octet (8 bits) or two octets (16 bits).
If the status field is one octet, the link status is indicated by the lower three bits
currently, as shown in Table 1-1:
Table 1-1 Meanings of the link status indications in the status field
1-7
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
F CK SIF SIO
SSF SI
1-8
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
The signaling information part processed by the user parts is the signaling information
field (SIF) in the message signal unit format. The signaling information field only
exists in a message signal unit. It consists of three parts: the label for message
addressing, the heading code of the user signaling information, and the user signaling
information.
z Label
The label contains the information necessary to deliver the message to its the
destination point. The standard routing label has a length of 32 bits and is placed at
the beginning of the signaling information field. The label includes the destination
point code (DPC), the originating point code (OPC) and the signaling link selection
(SLS) field.
A signaling point code is a numeric address, uniquely identifying one signaling point
in the SS7 network. When the destination point code contained in the message
indicates the receiving signaling point, the message is distributed to the
corresponding user part (such as ISUP or SCCP) identified by the service indicator in
the service information octet.
The signaling link selection is used in the following cases:
1) In ensuring message sequencing. Any two transmitted messages with the same
signaling link selection will normally arrive at the destination in the order in which
they were first transmitted.
2) In performing average load sharing of the stream between all available links. If a
certain user part periodically transmits messages and the signaling link selection
value is assigned in the cyclic manner, all the traffic to the destination has the
same traffic level.
The label structure determines four types of label as shown in Figure 1-5:
Type A MTP management messages
Type B TUP messages
Type C ISUP messages
Type D SCCP messages
As TCAP messages have to be transferred by the SCCP, the TCAP messages are
classified as SCCP messages, that is, type D.
1-9
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
CIC
Signaling message OPC DPC Type B: TUP messages
SLS
z Heading code
The heading code is a field following the label It is composed of the 4-bit heading
code H0 and the 4-bit heading code H1, and identifies the message group and the
message type. For instance, in a TUP message, the heading code H0 coded 0001
and the heading code H1 coded 0001 indicate an Initial Address Message (IAM); the
heading code H0 coded 0001 and the heading code H1 coded 0100 indicate an
Address Complete Message (ACM). Another example is about a signaling network
management message. The H0 coded 0001 and the H1 coded 0001 indicate a
Changeover-order signal (COO); the H0 coded 0001 and the H1 coded 0100 indicate
a Transfer-prohibited signal. As both the H0 and the H1 occupy 4 bits, the maximum
capacity of a class of user messages is 256.
z Signaling information
The signaling information part is also named service information part. This part is
further divided into several sub-fields. These sub-fields may be mandatory or optional
with fixed length or variable length in order to meet the requirements of various
functions and supplements, which makes it possible for message signal units to be
suitable for a variety of user messages and also makes it possible for the variety of
user message to be conveyed through common signaling channels.
For the format and encoding of the service information field, please reference the
user messages.
In a signal unit, the flag, the backward sequence number, the backward indicator bit,
the forward sequence number, the forward indicator bit, the length indicator and the
check bits are mainly used for transmission, receiving sequence, error detection and
correction of the message signal unit. These fields are all analyzed and handled at
the second functional level of the signaling network, that is, the signaling link level.
1-10
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
Fill-in signal units are used for “feeding” purpose on a signaling link and composed of
several fields that mainly involve transmission control. Fill-in signal units are
generated and handled by the level 2 functions.
Link status signal units are used to carry the status indication information of a
signaling link. They are also generated and handled at the functional level 2. The
functional level 2 may base both the related indication from the level 3 and the
judgment of itself to generate a corresponding status signal unit and transmit it out;
the functional level 2 may also accept the status indication of the signaling link from
the peer and process it. If necessary, the information relating to congestion and
processor outage will be reported to the level 3.
Message signal units are divided into three classes according to their role in the
signaling network: the message signal units used for signaling network management
(MSU-SNM), the message signal units used for signaling network testing and
maintenance (MSU-SNT), and the message signal units generated by user parts
(MSU-UP). The first two classes utilize the type A label structure and are transmitted
between the MTPs. They are generated at the functional level 3 of the signaling
network and also processed at the level 3. The third class includes the messages of
type B, C and D label structure. Through the MTP, these messages are delivered to a
particular user part. The level 3 functions of the signaling network are responsible for
analyzing the label contained in the message to determine where the message will be
distributed. The generating and handling of the signaling information part (service
information part) is implemented by the functional level 4, that is, the user parts.
The signaling network management messages are critical to the MTP, and described
in details in the following section.
General format for the signaling network management messages
In the signaling network, the signaling network management messages are
distinguished by the configuration 0000 of the service indicator (SI) contained in the
service information octet in the signal unit.
As a type of message signal unit, the signaling information of a signaling network
management message is carried by the service information field. It structure is
illustrated in Figure 1-6.
8n 4 4 4 4 24/14 24/14
(n 0)
Figure 1-6 General format for the signaling network management messages
z Label
It comprises the destination point code (DPC), the originating point code (OPC) and
the signaling link code (SLC).
1-11
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
The destination point code and the originating point code are described the same as
the preceding section.
The signaling link code indicates the signaling link interconnecting the destination and
originating points. If the message is not related to a signaling link, or another
particular code is not specified, it is coded 0000. Currently 4 bits are used. The spare
4 bits are coded 0000.
z Heading code
The heading codes include the 4-bit heading code H0 and the 4-bit heading code H1.
The heading code H0 identifies the management message group. The heading code
H1 determines the specific message from the message group. As both the H0 and
the H1 occupy 4 bits, the message capacity reaches 256 types. That is, there are 16
message groups and 16 message types in each group are available. Now not all of
them are used. See Table 1-2.
Message H1 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111
Group H0
0000
MIM 0110 LIN LUN LIA LUA LID LFU LLT LRT
1011
1100
1101
1110
1111
The meaning of the signaling network management messages is listed in Table 1-3.
1-12
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
1-13
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
DCBA 0100
Heading Heading First bit
Destination Label
Code H1 Code H0 transmitted
24 4 4 56
D C B A
0 1 0 1 Transfer-allowed signal
I. Message Routing
The message routing function is based on the information contained in the routing
label, namely on the destination point code and on the signaling link selection field.
Each signaling point has the routing information that enables it to determine the
signaling link over which a message is sent on the basis of the destination point code
and the signaling link selection field.
Typically the destination point code is associated with more than one signaling link
that may be used to carry the message; the selection of the particular signaling link is
made by means of the signaling link selection field, thus effecting load sharing.
There are two basic cases of load sharing, namely:
z load sharing between the links belonging to the same link set;
z load sharing between the links not belonging to the same link set.
Messages not related to a signaling link may be assigned any signaling link code
(SLC) to allow load sharing of the messages, or may be assigned a default SLC such
1-14
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
as 0000. They are routed in accordance with the normal routing function, where the
(SLC) is used as SLS for load sharing.
II. Changeover
The purpose of the changeover procedure is to ensure the signaling traffic carried by
the unavailable signaling link is diverted to the alternative signaling link(s) as quickly
as possible while avoiding message loss, duplication or mis-sequencing.
To implement this purpose, in the normal case the changeover procedure includes
buffer updating and retrieval, which are performed before reopening the alternative
signaling link(s) to the diverted traffic. Buffer updating consists of identifying all the
messages in the retransmission buffer of the unavailable signaling link which have not
been received by the far end. Retrieval consists of transferring the concerned
messages to the transmission buffer(s) of the alternative link(s).
In the case of unavailability of a signaling link, changeover is initiated at a signaling
point. The following actions are then made:
z transmission and acceptance of message signal units on the concerned
signaling link is terminated;
z transmission of link status signal units or fill-in signal units takes place;
z the alternative signaling link(s) are determined;
z a procedure to update the content of the retransmission buffer of the unavailable
signaling link is performed;
z signaling traffic is diverted to the alternative signaling link(s).
III. Changeback
1-15
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
z the concerned signaling point will restart diverted traffic over the signaling link
made available when it receives a changeback acknowledgement from the far
signaling point of the link made available.
When a decision is taken to activate an inactive signaling link, initial alignment starts:
z if the initial alignment procedure is successful, the signaling link is active and a
signaling link test is started;
z if the signaling link test is successful, the link becomes ready to convey signaling
traffic;
z in the case when initial alignment is not possible, new initial alignment
procedures are started on the same signaling link after the timer expires;
z if the signaling link test fails, link restoration starts until the signaling link is
activated or a manual intervention is made.
After a signaling link failure is detected, signaling link initial alignment will take place.
z if the initial alignment procedure is successful, a signaling link test is started;
z if the signaling link test is successful, the link becomes restored and thus
available for signaling;
z if the initial alignment is not possible, new initial alignment procedures may be
started on the same signaling link;
z if the signaling link test fails, the restoration procedure is repeated until the link is
restored or a manual intervention made.
1-16
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Narrowband MTP
1-17
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
2.1 Overview
Broadband MTP provides the transfer capability of broadband signaling cross the
ATM network and consists of Message Transfer Part (broadband) (MTP3b) and
Signaling ATM Adaptation Layer (SAAL).
The major differences between the broadband SS7 and narrowband SS7 are the
relevant modifications of the MTP layer. To widen the signaling bandwidth, the MTP-1
and the MTP-2 are changed to SAAL (Service Specific Connection Oriented Protocol,
Service Specific Coordination Function) and the MTP-3 is changed to MTP3b. In the
aspect of physical connection, E1 trunk connections are changed to ATM (Permanent
Virtual Channel) connections.
In MSOFTX3000, the broadband MTP provides signaling transfer services for the
SCCP, BICC and H.248 protocols, as shown in Figure 2-1.
SCCP/BICC/H.248
User Part
SSCF AT NNI
LM
SSCOP
SAAL
AAL5
ATM
Currently in UMTS, the broadband MTP is mainly applicable to the Iu-CS interface
and provides signaling transfer services for the RANAP/SCCP. If necessary, the
broadband MTP is also used on the Nc interface and provides services for the BICC
protocol.
2-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
2.2 MTP3b
MTP3b is a protocol specification designed for ATM features on the basis of the
MTP3. The MTP3b is not only responsible for carrying signaling messages, but also
responsible for managing the signaling network and signaling links. The MTP3b uses
the services provided by the SAAL for message exchange.
I. MTP3b Structure
Similar to the MTP3, the functional structure of the MTP3b protocol is composed of
signaling message handling and signaling network management.
1) Signaling message handling
The purpose of the signaling message handling functions is to ensure that the
signaling messages originated by a particular User Part at a signaling point are
delivered to the same User Part at the destination point indicated by the related field
in the message signal unit (there are only SCCP and STC user parts at the Iu
interface). To achieve these functions, signaling message handling is further divided
into message routing, discrimination and distribution functions.
2) Signaling network management
The purpose of the signaling network management functions is to provide
reconfiguration of the signaling network in the case of failures. Activation and
alignment of a new signaling link is also included. With the enlargement of a signaling
network and increasing of the load over signaling links, congestion may appear in the
signaling network. Thus controlling congestion is one of the signaling network
management functions. The signaling network management functions comprise
signaling traffic management, signaling link management and signaling route
management.
The major functions provided by the components in the MTP3b protocol structure are
described as follows:
1) Message discrimination
The purpose of the message discrimination function is to examine the standard field
in the message header to judge whether or not a received message from the lower
layer (SAAL) is valid and, if valid, to determine where the message will be delivered.
If the message is not valid, the message will be discarded.
If the message is valid, there are the following possibilities:
2-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
a) When the received message is destined to the signaling point itself, the message
will be delivered to the message distribution module;
b) When the received message is not destined to the point itself and the signaling
point has no the transfer capability, the message will be discarded; otherwise, the
message will be delivered to the message routing module for further handling.
2) Message distribution
The purpose of the message distribution function is to direct a received message to
the appropriate upper-layer module which is the destination for processing the
message. If the message does not exist in the particular level 4 module indicating to
process it or the field is not valid, the message will be discarded.
3) Message routing
The purpose of the message routing function is to base the header information of a
received message to select an appropriate route for it, base the route to select a link
set, base the link set to select a link, and use the selected link to finally transmit the
message out. The handled message has the following possibilities:
The message is delivered from the upper-layer. The message routing module
has to determine an available route to transmit it. An exception is there is not
such a satisfactory route.
When the message is not destined to the point itself and the signaling point has
the signaling transfer function, its destination signaling point can be found from
the destination signaling point table at this signaling point, so as to direct the
message out.
When the message is not destined to the point itself and the signaling point has
the signaling transfer function but the destination signaling point of the message
cannot be found from the destination signaling point table at this signaling point,
the message will be discarded.
4) Signaling traffic management
The purpose of the signaling traffic management function is to ensure a reliable and
in-sequence transfer of signaling messages. In the case of unreliability or
unavailability of a link, the function is used to divert the messages to one or more
alternative links with the objective of avoiding message loss or mis-sequencing.
5) Signaling route management
The purpose of the signaling route management function is to provide the basis for
message routing and, in the case of unavailability or unreliability of the currently
applied route, provides rerouting function and re-configures the network in order to
provision a reliable route to achieve signaling transfer.
6) Signaling link management
The purpose of the signaling link management function is to perform a proper
handling procedure on a signaling link in the case of unavailability or unreliability, in
2-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
order to stop using the unreliable link and repeatedly restart the link with the objective
of making it available again. The link management function also provides the link
testing function which periodically performs testing on a link so as to confirm the
availability of the link.
The message structure of the MTP3b is basically same as that of the MTP3. Please
reference “Narrowband MTP” for more information. Here in this chapter only their
differences are covered.
The MTP3b extends the length of the user data contained in a signal unit. The
maximum amount of the user data supported by MTP3b signaling links is 4091 octets
(that supported by narrowband MTP is 272 octets).
The following codes of the service indicator are additionally used in the MTP3b:
SI code Meaning
1001 Broadband ISDN User Part
1010 Satellite ISDN User Part
In MSOFTX3000 product, the MTP3b has three users, namely SCCP, BICC and
H.248. The service indicator codes respectively corresponding to them are as follows:
By contrast with the narrowband MTP, the MTP3b changeover procedure applies with
the following exceptions and clarifications:
The signaling link failure indication causes by MTP2 link do not apply, here is In
Service to Out Of Service state causes by SAAL or when a request (automatic or
manual) is obtained from a management or maintenance system.
2-4
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
0000
MIM 0110 LIN LUN LIA LUA LID LFU LLT LRT
1001
1011
1100
1101
1110
1111
2.3 SAAL
2-5
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
signaling. What implements this function is the Signaling ATM Adaptation Layer
(SAAL).
The SAAL protocol used in MSOFTX3000 product is in full compliance with the ITU-T
Recommendations Q.2110, Q.2140 and Q.2144.
The SAAL makes use of the specification of AAL type 5 (AAL5). As shown in Figure
2-2, The SAAL comprises the Convergence Sublayer (CS) and the Segmentation And
Reassembly (SAR). The CS is divided into the Service Specific Convergence
Sublayer (SSCS) and the Common Part Convergence Sublayer (CPCS). Further, the
SSCS includes three parts: the Service Specific Coordination Function (SSCF)
sublayer (ITU-T Q.2140), the Service Specific Connection Oriented Protocol (SSCOP)
sublayer (ITU-T Q.2110), and the Layer Management (LM) (ITU-T Q.2144).
MTP3
B
SSCF-NNI
L
M
SSCO
M P
CPCS -
SAR
SAAL
In MSOFTX3000, the CPCS and the SAR are implemented by the BSG hardware,
thus the SSCOP, the SSCF and the LM constitute the core of the SAAL protocol.
2.3.2 SSCOP
I. SSCOP Functions
2-6
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
What are conveyed between two SSCOP peer layers for the establishment or release
of a connection and for the guarantee of a reliable message transmission are protocol
data units (PDUs) of the SSCOP. Basic PDUs are listed and described as follows:
BGN PDU (Begin): The BGN PDU is used to establish an SSCOP connection
between two peer entities. The BGN PDU requests the clearing of the peer’s
transmitter and receiver buffers, and the initialization of the peer’s transmitter
and receiver state variables and counters.
BGAK PDU (Begin Acknowledge): The BGAK PDU is used to acknowledge the
acceptance of a connection request from the peer.
BGREJ PDU (Begin Reject): The BGREJ PDU is used to reject the connection
request of the peer SSCOP entity.
END PDU (End): The END PDU is used to release an SSCOP connection
between two peer entities.
ENDAK PDU (End Acknowledge): The ENDAK PDU is used to confirm the
release of an SSCOP connection.
RS PDU (Resynchronization): The RS PDU is used for the routine
connection-oriented reset in other connection-oriented protocols. The RS PDU is
used to resynchronize the buffers and the transmitter and receiver state
variables (counters).
RSAK PDU (Resynchronization Acknowledge): The RSAK PDU is used to
acknowledge the acceptance of a resynchronization requested by the peer
SSCOP entity.
2-7
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
ER PDU (Error Recovery): The ER PDU is used to recover from protocol errors
in the operation of a connection.
ERAK PDU (Error Recovery Acknowledge): The ERAK PDU is used to
acknowledge the recovery from protocol error.
SD PDU (Sequenced Data): The SD PDU is used to transfer user service data to
the peer entity after an SSCOP connection is set up.
POLL PDU (Status Request): The POLL PDU is used to request, across an
SSCOP connection, status information about the peer SSCOP entity.
STAT PDU (Solicited Status Response): The STAT PDU is used to respond to a
status request (POLL PDU) received from a peer SSCOP entity. It is used to
notify the peer SSCOP entity of correct receipt of concerned SD PDUs and also
used to acknowledge which SD PDUs are successfully accepted and which fail
to be received. It is also used to update the position of the transmitting window.
In this way, the maximum transmitting sequence number of SD PDUs that can
be sent currently is controlled. The STAT PDU also contains the sequence
number [N(PS)] of the POLL PDU to which it is in response.
USTAT PDU (Unsolicited Status Response): The USTAT PDU is used to
respond to a detection of one or more new missing SD PDUs, based on the
examination of the sequence number of the SD PDU. It contains the data for
updating the transmitting window of the peer, but there is not the N(PS) field.
UD PDU (Unnumbered Data): The UD PDU is used for unassured data transfer
between two SSCOP users, without affecting connection-oriented sequencing in
progress, without changing the entities’ counters or variables, without
re-transmitting lost data.
MD PDU (Management Data): The MD PDU is used for unassured management
data transfer between two SSCOP management entities. Similar to the UD PDU,
the MD PDU does not ensure a reliable receipt by the peer.
The states of an SSCOP protocol entity reflect general conditions of the SSCOP
entity in the sequences of signals and PDU exchanges with its user and peer,
respectively. The basic states are:
State 1 - Idle: Each SSCOP entity is conceptually initiated in the Idle state (State
1) and returns to this state upon the release of a connection.
State 2 - Outgoing Connection Pending: An SSCOP entity requesting a
connection with its peer is in the Outgoing Connection Pending state (State 2)
until it receives acknowledgement from its peer
State 3 - Incoming Connection Pending: An SSCOP entity that has received a
connection request from its peer and is waiting for its user’s response is in the
Incoming Connection Pending state (State 3).
State 4 - Outgoing Disconnection Pending: An SSCOP entity requesting release
of the peer-to-peer connection goes to the Outgoing Disconnection Pending
2-8
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
state (State 4) until it receives confirmation that the peer entity has released and
transitioned to the Idle state (State 1), after which it does the same.
State 5 - Outgoing Resynchronization Pending: An SSCOP entity requesting
resynchronization of the connection with its peer is in the Outgoing
Resynchronization Pending state (State 5).
State 6 - Incoming Resynchronization Pending: An SSCOP entity that has
received a resynchronization request from its peer and is waiting for its user’s
response is in the Incoming Resynchronization Pending state (State 6).
State 7 - Outgoing Recovery Pending: An SSCOP entity requesting recovery
with its peer of an existing connection is in the Outgoing Recovery Pending state
(State 7).
State 8 - Recovery Response Pending: An SSCOP entity which has completed
recovery, notified its user, and is awaiting response is in the Recovery Response
Pending state (State 8).
State 9 - Incoming Recovery Pending: An SSCOP entity that has received a
recovery request from its peer and is waiting for its user’s response is in the
Incoming Recovery Pending state (State 9).
State 10 - Data Transfer Ready: Upon successful completion of the connection
establishment, resynchronization, or error recovery procedures, both peer
SSCOP entities will be in Data Transfer Ready state (State 10) and assured data
transfer can take place.
2-9
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
SSCOP A SSCOP B
AA-ESTABLISH.rsp.
PDU BGAK
AA-ESTABLISH.con.
2-10
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
Action Tx Rx Delivered
1 (0)
2 (0) 1 X
3 (0) 2 X
4 (0) POLL(5.1) X
X
5 (1)
6 (1)
7 (1)
(MR ), {3,5})
STAT (3,1,N X
Free 1, 2 X
7
(MR), {5,7 })
USTAT (3, N
5 (1) 3 X
6 (1) 4 X
T1160080-94/d82
FI G U R E I I .9/Q .2110
E r r or r ecover y via solicited and unsolicited ST A T s
of the last tr ansmitted SD PD U s
SSCOP SSCOP
A B
AA-RELEASE.request
END
AA-RELEASE.indicatio
AA-RELEASE.confirm
ENDAK
2.3.3 SSCF
The SSCF is used to coordinate the interface between the SSCOP and the
upper-layer MTP3b. It maps primitives from the MTP3b to required SSCOP signals,
and vice versa. In nature, the SSCF only transfers the signals between the SSCOP
2-11
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
and the MTP3b to and fro, playing an intermediate role. The SSCF does not transmit
any PDUs to the peer entity in the receiver; instead, by relying on the SSCOP, its
information is carried in SSCOP PDUs.
I. SSCF Functions
Primitive mapping: The SSCF maps primitives received from SAAL user to
signals defined at the SSCOP upper layer boundary and maps signals received
from the SSCOP to primitives implicitly defined at the MTP-3 lower layer
boundary.
Local retrieve: In the case of a changeover procedure performed on a faulty link,
this function makes it possible to obtain back the data not yet transmitted and
divert the data to alternative link(s).
Flow control: The SSCF reports to the user the congestion level (or no
congestion) to avoid unnecessary cell loss. It also diverts its own PDU flow to the
lower layer in order to prevent from congestion happening at the other end.
Link status maintenance: This SSCF function receives primitives from the MTP-3
or signals from the SSCOP and maintains information pertaining to the status of
the link, such as In Service and Out Of Service. Based on the information, it can
provide primitives/signals to the MTP3 and the SSCOP as an aid to maintaining
the link.
Reporting to layer management: This SSCF function transmits MAAL primitives
to the layer management so that the layer management can perform statistics
and measurements. For instance, upon release of a link, the SSCF reports the
release to the layer management, and then the layer management can measure
the In-service duration. With the help of the layer management, the error
monitoring function can be implemented.
Performing link alignment.
These operations require the SSCOP to establish a link between the two exchanges.
After the link is successfully established, the SSCF indicates the layer management
to start the monitoring action. Then the SSCF enters the Proving status for the link.
At this moment, proving PDUs are transported between the exchanges. A links proves
to be good by the means that n (1000 by default) proving PDUs can be successfully
transmitted. In the end, if 1000 proving PDUs are really transmitted successfully and
2-12
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
errors are not found then the link is recognized as passing the alignment and can be
put into service.
The proving algorithm on SAAL link is based on the alignment error rate monitoring
process used for proving a link. Transmission of testing PDUs of N1 amount (1000 by
default) at a specified rate (one PDU per millisecond by default) must be completed
within 30 seconds from the start to the proving success. If one or two (one by default)
of the transmitted N1 PDUs are re-transmitted, the proving fails. If no error occurs, the
link succeeds in being proved and moves to In Service.
2.3.4 LM
The position of the Layer Management (LM) in the SAAL is shown in Figure 2-2. The
SSCS LM is the layer management entity of the Service Specific Convergence
Sublayer. It makes a direct interaction with the sublayers to implement a number of
Operation Administration and Maintenance (OAM) functions. Therefore, the SSCS LM
is described as an entity having interactions with all SAAL layers since CPCS and
SAR (AAL Type 5) are implemented by the hardware and there are no interactions
defined at these two layers. The SSCS LM is responsible for conducting the following
tasks:
Determining whether a link should be out of service or in service. As a
component of these operations, a link has to be monitored against excessive
delays during service transmission. In order to avoid unnecessary alteration, the
layer management allows a certain number of errors occurring at the link.
Periodically conducting a number of measurements. For instance, the layer
management uses counters to count how long each link is in service, how
frequent faults take place, how frequent congestions happen, as well as other
information.
Performing alarm handling.
The layer management has the following states:
Out Of Service
Alignment
Proving
Aligned Ready
In Service
2-13
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
The layer management provides three algorithms for error monitoring. These
algorithms ensure to detect an error burst keeping for more than 400ms.
Algorithm 1 is mainly used for heavy load. If the volume of the transmitted data is
too large, the receiver has not enough time to handle the data. This causes the
fact that the data in the sending buffer cannot be released so long that the sum
of the transmission queue continues to increase to a particular value. At this
moment, the link will be released.
Algorithm 2 is mainly used for intermediate load. This algorithm monitors data
retransmissions. When data retransmissions occur so frequently within a
particular interval that the occurrence sum exceeds a threshold, it indicates a
bad quality on the link. Once the delay is beyond tolerance, the link will be
released.
Algorithm 3 is mainly used for light load. If within a particular interval the
difference between the number of transmitted POLL PDUs and the number of
accepted STAT PDUs (the difference is actually the number of lost STAT PDUs)
exceeds a threshold, it also indicates a bad quality on the link. In this case, the
link will be released.
The states for coordinative operation among the three sub-layers are defined as
follows: (“m” indicates the state number of SSCF; “n” indicates the state number of
SSCOP; “r” indicates the state number of LM; and “m/n/r” indicates the compound
state of the three sub-layers.)
1/1/1 Out Of Service/Idle: In this state, the connection is idle.
1/4/1 Out Of Service/ Outgoing Disconnection Pending: In this state the MTP3b,
or alternatively the Layer Management, has issued an AAL-STOP-request, or an
AA-RELEASE-request or an MAAL_RELEASE-Request, respectively, which
caused the SSCF to issue an AA-RELEASE-request, and the SSCF is waiting for
a confirmation of the SSCOP connection release, AA-RELEASE-confirm.
2/1/2 Alignment/Idle: In this state, the SAAL user requested the SSCF to provide
an AAL connection. This request was passed to SSCOP by means of an
AA-ESTABLISH-request, but the connection establishment or proving was
unsuccessful. SSCF is waiting to reattempt this process. This process will be
repeated until a supervisory function indicates that the establishment of an AAL
connection is to be abandoned.
2/2/2 Alignment/Outgoing Connection Pending: In this state, the user has issued
an AAL-START-request, and the SSCF is waiting for a confirmation of SSCOP
connection.
2/4/2 Alignment/Outgoing Disconnection Pending: In this state the SSCF, or in
the case of unsuccessful proving, the Layer Management, requested the release
2-14
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
2-15
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Broadband MTP
1 1 1/1/1 1 1 1/1/1 1 1
AAL-ST
ART-req RT-req.
. AAL-STA
2 AA-ESTA LIS H-req. 2
BLISH-req AB
. AA-EST
. 2/2/2 BGN BGN 2/2/2
PORT-ind
MAL-RE . 2 2 AA-EST
2 ,-) -c onf 2
(-,ALN TABLISH ABLISH-c MAL-RE
AA-ES 10 10 onf.
(-,ALN,- PORT-ind.
)
BGAK BGAK
d. 2/10/3MAAL-PROVI
OVING-in 2/10/3
MAAL-PR NG-ind.
3 3
T3 expires )
AA-DATA -req.(NM T3 expires
C1 > 0 -req.(NM
) AA-DATA C1 > 0
SD SD
M) AA-DATA
A-ind.(N -ind.(NM)
AA-DAT POLL POLL
T3 expires T3 expires
C1 > 0 STAT C1 > 0
STAT
)
AA-DAT -req.(NM
A-req. (NM) AA-DATA
SD SD
AA-DAT )
ROVIN
G-ind. A-req.(IS A-req.(IS MAAL-S
AA-DAT
TOP_PR
TOP _P ) OVING-i
MAAL-S nd.
2/10/4 SD SD 2/10/4
-ind.(IS) AA-DA TA 4
4 AA-DATA -ind .(IS)
E-ind.
POLL POLL AAL-IN_S
SE RVIC E RVICE-ind
AAL-IN_ .
3/10/5
3 3
-ind. 3/10/5 STAT
STAT MAAL-RE
EPORT (-,INS,-) PORT-ind.
MAAL -R
5 (-, INS,-)
5
T1167200-94/d06
FIGURE II.1/Q.2140
Time flow diagram for connection estabishment Both UPS=Normal, Case 1
2-16
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
Chapter 3 SCTP
3.1 Overview
SCTP is usually view as a transport layer protocol, whose upper layer is SCTP
application, and lower layer is packet-switched network.
3.1.2 Terminology
3-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
RWND: Receiver Window. An SCTP variable that a data sender uses to store the
most recently calculated receiver window of its peer, in number of bytes. This gives
the sender an indication of the space available in the receiver's inbound buffer. During
the association establishment, both data sender and receiver will exchange their
RWND value to each other and the two RWND values will vary with data transmission
and acknowledgement. This is, in effect, restricting the amount of data it can transmit.
If the RWND is equal to 0, the data sender can always have one packet in flight to the
3-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
receiver, which allows the sender to probe for a change in buffer of the data receiver
by means of the acknowledgement message.
The functions of SCTP mainly include association startup and takedown, sequenced
delivery within streams, user data fragmentation, acknowledgement and congestion
avoidance, chunk bundling, packet validation and path management.
z Association startup and takedown
SCTP is an association-oriented transmission protocol. Generally, data only can be
transmitted between two endpoints that have been established an association (SCTP
allows the data to be transmitted in certain steps during the startup of association).
Therefore, the startup and takedown of association are the preconditions for other
services.
z Sequenced delivery within streams
SCTP can transport the datagrams in sequence. The datagrams sent in sequence
must be put in one stream, and the stream is the basis for sequenced transmission.
z User data fragmentation
SCTP fragments and packets the user data on the SCTP layer by means of detecting
the path Maximum Transmission Unit (MTU), thus avoiding multiple times of
fragmentation and reassembly, and reducing the workload of IP layer of router.
z Acknowledgement and congestion avoidance
Acknowledgement and retransmission are the basic methods to ensure the
transmission reliability. In SCTP, acknowledgement is also applied. Moreover,
congestion avoidance succeeds the window mechanism of TCP to perform
appropriate flow control.
z Chunk bundling
If small sized user data carries large SCTP message header, the transmission
efficiency will be lowered much. In this case, the SCTP user can request bundling of
more than one user messages into a single SCTP packet, so as to improve the
utilization ratio of bandwidth.
z Packet validation
Packet validation is the basis for SCTP to provide reliable transmission service. SCTP
uses the ADLER-32 algorithm to figure out a 32 bit checksum for user data, which will
be checked at the receiving end to see whether the checksum is the same, thus
judging whether the user data is broken.
z Path management
3-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
The path management function monitors reachability through heartbeats when other
packet traffic is inadequate to provide this information and advises the SCTP user
when reachability of any far-end transport address changes.
From the above description, we can conclude the differences between SCTP and
TCP.
1) TCP is transmitted on the basis of character stream and its upper layer must
have its own delimitation mechanism. SCTP is transmitted on the basis of
datagram and needs no upper-layer demarcation.
2) SCTP supports the configuration of multiple IP addresses.
3) SCTP defines stream, within which the data is transmitted in sequence.
SCTP
IP
MAC
In CSCN, the lower layer of SCTP is IP network, and its upper layer users include:
z Adaptation module M3UA of SCN signaling in SIGTRAN protocol stack
z BICC application protocol in BICC protocol stack
z H.248 application protocol in H.248 protocol stack
SCTP messges are encapsulated in user data fields of IP packets. Table 3-1 lists the
major SCTP message types:
3-4
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
An endpoint should send this chunk to its peer endpoint to probe the
HEARTBEAT reachability of a particular destination transport address defined in the
present association.
An endpoint should send this chunk to its peer endpoint as a response to
HEARTBEAT ACK
a HEARTBEAT chunk.
I. Startup of Association
The startup of SCTP association is a four-way handshake process, which has four
message interactions: INIT, INIT ACK, COOKIE ECHO and COOKIE ACK, as shown
in Figure 3-2.
3-5
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
Endpoint A Endpoint Z
INIT(Tag_A)
T1-
INIT ACK(Tag_Z, connection information Z)
init
COOKIE ECHO(connection information Z) + DATA
T3-rtx Established
T1-cookie COOKIE ACK+DATA + SACK
Established SACK
1) The initiating end of the association must create a data structure TCB
(Transmission Control Block) to describe the association (including the
fundamental information) to be initiated, and then send INIT message to the peer
end. In this message, the parameter usually carries one or multiple IP addresses
used by local end. If no IP address is carried, the peer end will take the source IP
address of the INIT message as the IP address of the end. In common header,
the Verification Tag field is set to “0”, because the Tag of peer end is unknown.
In the message parameter, the Tag of local end and the expected
inbound/outbound stream numbers should be included. After sending, the timer
“INIT” is started, for waiting the INIT ACK message from peer end. If the timer
timeouts, the INIT message will be resent till the maximum retransmission time is
reached. After such actions, the sender enters COOKIE-WAIT status.
2) Upon receiving the INIT message, the receiver of the association will generate a
Tag, which will act as the initial Tag of the local end and will be put into the
parameter of INIT ACK message. Then a TCB will be generated according to the
basic information of association. However, this TCB is a temporary TCB. After
the TCB is generated, the mandatory information in it (including the time stamp
and life period of COOKIE) and the secret key in local end are calculated into a
32-bit MAC (Message Authentication Code) through the algorithm described in
RFC2401 (this calculation is irreversible). After that, the mandatory information
and the MAC are combined into a parameter called STATE COOKIE, which is
included in the INIT ACK message. The Verification Tag in INIT ACK message is
set to the initial Tag value in INIT message. The INIT ACK message usually
carries the information such as the IP address used by local end,
inbound/outbound streams. When the INIT ACK message is sent to the peer end,
the temporary TCB is deleted (then the receiver does not reserve any resources
for this association).
3) When the initiating end of the association receives the INIT ACK message, the
INIT timer will be stopped. Its own TCB will be updated, and the information
obtained from INIT ACK will be filled in. then COOKIE ECHO message will be
3-6
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
generated to carry back the STATE COOKIE in the INIT ACK message. The
timer COOKIE is started, and the status is changed into COOKIE-ECHOED.
4) After receiving the COOKIE ECHO message, the receiver of the association will
perform COOKIE check. The TCB in the STATE COOKIE and the local secret
key will be calculated into an MAC, according to the MAC algorithm described in
RFC2401. This MAC will be compared with that in the STATE COOKIE message.
If they are different, this message will be discarded. If they are identical, the time
stamp in the TCB will be taken out to compare with the current time. If the time
has exceeds the life time of COOKIE, the message will be discarded, otherwise,
an association to the peer end will be set up according to the information in TCB.
The status will be changed into ESTABLISHED, and COOKIE ACK message will
be sent back.
5) Upon receiving the COOKIE ACK message, the initiating end of the association
will stop the timer COOKIE, and the status will be changed into ESTABLISHED.
So the startup of association is finished.
SCTP association can be terminated in two ways: One is GRACEFUL close, the other
is UNGRACEFUL close. Just as their names imply, the former means that all data in
queue by either endpoint is delivered to the respective peers before the association is
shut down. The latter means that the association is directly aborted and the data is
directly discarded.
z GRACEFUL close
GRACEFUL close of association is implemented through three-way handshake:
1) Firstly, the user at the initiating end of the termination sends a GRACEFUL
request to SCTP for terminating the association. Then SCTP association is
changed from the ESTABLISHED status to the SHUTDOWN-PENDING status,
in which SCTP will no longer accept any requests from upper layer for data
transmission on this association. At the same time, the association will wait for
the validation of all the data sent from local end but has not been validated yet.
2) When all the data has been validated, SHUTDOWN message will be sent to the
peer end. The association will be changed into SHUTDOWN-SENT status, and
the SHUTDOWN timer will be started to wait for the SHUTDOWN-ACK message
from peer end. In this status, the data received from peer end will be validated
immediately (the slowdown validation mechanism of SCTP application will be
introduced in the following part).
3) When the peer end receives the SHUT DOWN message, it will enter the
SHUTDOWN-RECEIVED status, in which SCTP will no longer accept any
requests from upper layer for data transmission on this association. When all the
un-transmitted data and un-validated data sent from local end has been sent and
3-7
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 SCTP
validated, the SHUTDOWN ACK message will be sent. The SHUTDOWN timer
will be started to wait for the SHUTDOWN COMPLETE message.
4) Upon receiving the SHUTDOWN ACK message, the initiating end of the
termination will stop the SHUTDOWN timer, send the SHUTDOWN COMPLETE
message to the peer end, and then delete the TCB of the association.
5) The peer end deletes the TCB of association after it receives the SHUTDOWN
COMPLETE message.
z UNGRACEFUL close
Since this close mode does not care for the security of the data, it is relatively simple.
When the initiating end sends an ABORT message to the peer end, the TCB of
association will be deleted immediately. When the peer end receives the ABORT
message, it will delete the TCB of the association immediately.
3-8
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
Chapter 4 M3UA
4.1 Overview
Signaling System No. 7 MTP3-User Adaptation layer (M3UA) is the user adaptation
protocol of the Signaling Transport (SIGTRAN) protocol stack. M3UA provides primitive
communication service for MTP3 users over IP network and MTP3 (in a signaling
gateway) at the edge of a network, so as to implement interworking between TDM SS7
and IP.
SIGTRAN stack is the protocol stack that supports transmission of Switched Circuit
Network (SCN) signaling through IP network. This protocol stack supports the
inter-layer standard primitive interface defined in SCN signaling protocol hierarchy
model, so as to ensure utilization of the existing SCN signaling application without
modification. It also uses the standard IP transport protocol as the transmission bottom
layer, and satisfies the special transmission requirements of SCN signaling through
adding its own functions.
The SIGTRAN protocol stack is responsible for the communication between the
Signaling Gateway and the Media Gateway Controller. It has two functions: adaptation
and transmission. Accordingly, two layers of protocols are included in the SIGTRAN
protocol stack, that is,, transmission protocols (such as SCTP/IP) and adaptation
protocols (such as M3UA, IUA). Figure 4-1 illustrates the model.
SCTP
IP
MAC
M3UA: MTP3-User Adaptation Layer M2UA: MTP2-User IUA: ISDN User Adaptation Layer
Adaptation Layer
M2PA: MTP2 Peer Adaptation Layer V5UA: V5 User Adaptation SUA: SCCP User Adaptation Layer
Layer
SCTP: Stream Control Transmission IP: Internet Protocol MAC: Media Access Control
Protocol
Figure 4-1 SIGTRAN protocol model
4-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
SCTP is introduced in this model for the purpose of ensuring reliable transmission
since the SIGTRAN stack only achieves adaptation and transmission of SCN signaling
over IP network, leaving user layer signaling messages unchanged.
The SIGTRAN protocol stack used in CSCN consists of the MAC, IP, SCTP and M3UA.
Its protocols under the network layer (MAC, IP) are the standard TCP/IP protocols.
M3UA (MTP3 User Adaptation) protocol supports the transport of any SS7 MTP3-User
signaling (for example,, ISUP and SCCP messages) over IP using the services of the
Stream Control Transmission Protocol. Also, provision is made for protocol elements
that enable a seamless operation of the MTP3-User peers in the SS7 and IP domains.
This protocol would be used between a Signaling Gateway (SG) and a Media Gateway
Controller (MGC) or IP-resident Database, or between two IP-based applications.
SS7 SIGTRAN
SEP SG MGC
ISUP ISUP
PSTN NIF IP
MTP3
M3UA
MTP3 M3UA
MTP2 SCTP
MTP2 SCTP
MTP1 MTP1 IP IP
SEP: Signaling endpoint; SG: Signaling gateway; MGC: Media gateway controller
As illustrated above, in the SIGTRAN protocol stack, M3UA runs on top of SCTP and is
the SCTP user. The upper layer user of M3UA at the MGC side is ISUP (MTP 3 User),
and is NIF at the SG side.
The M3UA layer can also be used for point-to-point signaling between two IP Server
Processes (IPSPs). In this case, the M3UA layer provides the same set of primitives
and services at its upper layer as the MTP3.
4-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
IP
MGC MGC
User
User
M3UA
M3UA
SCTP
SCTP
IP
IP
4.1.3 Terminology
4-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
M3UA Link
M3UA Linkset
M3UA Route
M3UA Entity
These concepts have enhanced the functionality provided by the protocol in the
following manner:
1) The concept of M3UA Route has been introduced to apply in large-scale networks.
Two M3UA entities separated by large geographical distances can access each
other using M3UA Route.
2) It helps in easy understanding of the network, which leads to better network
planning.
3) It also helps users to configure M3UA faster as all these concepts are compatible
with MTP3 concepts.
SGP2
SGP3 ASP1
SP SG1 ASP2
SGP1 ASP3
SGP2 MGC
SGP3
SG2
Figure 4-4 Relationship among M3UA Link, Linkset, Route and Entity
These concepts are valid for both SGP-ASP and IPSP-IPSP model.
The management of M3UA link state is same to that of ASP or SCTP state.
4-4
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
M3UA_LINK_DOWN: When M3UA at ASP/IPSP (client end) has not received ASP UP
ACK message or M3UA at SGP/IPSP (server end) have not received ASP UP message
after SCTP association has been successfully established, M3UA LINK state is
M3UA_LINK_DOWN. When M3UA LINK state in this state, it can send and receive
ASPSM (ASP UP,ASP DOWN,ASP UP ACK,ASP DOWN ACK), but can not send and
receive any ASPTM (ASP ACTIVE, ASP ACTIVE ACK, ASP INACTIVE, ASP
INACTIVE ACK), SSNM (NOTIFY, ERROR) and DATA message.
Asp Up or
SCTP-RI Asp Up Ack Asp Down or SCTP
Asp Down Ack CDI
or SCTP-RI
SCTP-CDI
4-5
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
M3UA LINKSET is made up of all the M3UA links between SG and MGC (SGP-ASP) or
between MGC and MGC (IPSP-IPSP) that serve the same AS. The state of the links in
any Linkset decides the state of the M3UA Linkset.
There are three kinds of M3UA Linkset states at ASP/IPSP (at client end):
While there are four kinds of M3UA Linkset states in SGP/IPSP (at server end):
M3UA_LINKSET_DOWN, M3UA_LINKSET_INACTIVE, M3UA_LINKSET_ACTIVE
and M3UA_LINKSET_PENDING.
This Linkset state can only be valid in SGP/IPSP (act as server). When Linkset state
becomes M3UA_LINKSET_PENDING, it should start a PENDING timer and assign a
PENDING buffer to save the data. At this time, if there are some service data to peer
M3UA, it should send the service data to PENDING buffer. If any link in the given
Linkset becomes ACTIVE again before PENDING timer expires, M3UA Linkset state
changes from M3UA_LINKSET_PENDING to M3UA_LINKSET_ACTIVE, it gets the
service data from PENDING buffer, and sends it to peer M3UA in ordered sequence. If
PENDING timer expires before any M3UA link becomes M3UA_LINK_ACTIVE, the
SGP M3UA stops queuing messages and discards all previously queued messages.
The M3UA LINKSET state will move to the M3UA_LINKSET_INACTIVE state if at least
one M3UA link is in ASP-INACTIVE state, otherwise it will move to
M3UA_LINKSET_DOWN state.
4-6
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
The path from source entity to destination entity is called a M3UA route. One M3UA
route corresponds to one M3UA Linkset at the home terminal. In ASP or IPSP (client)
side, usually there is only one route from a local entity to a special destination entity. But
in SGP or IPSP (server) side, there may be more than one route from a local entity to a
special destination entity. There can be two route states:
In IPSP-IPSP model, M3UA route state entirely depends on M3UA LINKSET state.
In SGP-ASP network model, M3UA ROUTE state maintained in SGP M3UA entirely
depends on M3UA LINKSET state and M3UA ROUTE state maintained in ASP M3UA
depends on both M3UA LINKSET state and the route state from SG to SS7 network
signaling point.
4-7
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
M3UA_ROUTE_
AVAILABLE
M3UA_ROUTE_
UNAVAILABLE
M3UA_ROUTE_
AVAILABLE
M3UA_ROUTE_
UNAVAILABLE
The logical processing unit that accomplishes some special functions, such as AS, SP
or a logic unit that only implements special message transfer function, such as SG can
be classified as M3UA Entity. Each M3UA Entity is identified by a unique signaling point
code.
Incase all AS share the same point code then they are said to be in Inclusive SPC
mode and if all AS have different point codes then they are said to be in Exclusive SPC
mode. In other words, if one AS is servicing all the services related to one signaling one
point code then it is said to be in Exclusive mode, else its is in Inclusive mode.
4-8
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
M3UA Entity further falls under two categories: M3UA Local Entity and M3UA
Destination Entity.
M3UA LOCAL ENTITY: The logical entity to accomplish special function in local side. In
ASP/IPSP M3UA, local entity is related to AS. In SGP M3UA, local entity is related to
SG.
M3UA DESTINATION ENTITY: The logic entity to accomplish special function in peer
side. In IPSP-IPSP model, the destination entity maintained by IPSP M3UA is related to
the peer AS. In SGP-ASP model, the destination entity maintained by SGP M3UA is
also related to peer AS; whereas the destination entity maintained by ASP M3UA can
SG or destination signaling point in SS7 network. There can be two destination entity
states:
M3UA_DEST_ENTITY_
ACCESSIBE
all of the
m3ua route At least one
state to the of m3ua route
given dest tothe given
entity are dest entity
unavailable is available
M3UA_DEST_ENTITY_
INACCESSIBLE
M3UA SPMC: All the M3UA destination entities related to the same local entity consists
of a complete SPMC, if the OPC of local entity is same as DPC in M3UA destination
4-9
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
entity; the local entity is also a part of SPMC. SPMC is maintained only in SGP side.
There are two kinds of M3UA SPMC state:
M3UA_SPMC_
ACCESSIBE
M3UA_SPMC_
INACCESSIBLE
The relationships between M3UA Entity, M3UA Route, M3UA Linkset and M3UA Link
are shown in Figure 4-4. The M3UA destination entity can be reached through one or
more M3UA routes. Each M3UA route at home terminal corresponds to one M3UA link
set. Different routes implements signaling service load sharing according to the
user-defined M3UA routing mask and the SLS in the signaling message. Meanwhile,
different priorities can be set for each M3UA route. Therefore, in routing, the M3UA
route with a higher priority will be selected first. That is to say, the routing is based on
the priority. One M3UA link set is composed of one or more M3UA links. Each M3UA
link corresponds to one SCTP association. Different M3UA links employ two working
modes: active/standby mode or load-sharing mode. With load-sharing mode, different
M3UA links in the same link set can implement signaling service load-sharing
according to the user-defined routing mask and the SLS in the signaling message;
meanwhile, different priorities can be set for each M3UA link, and the M3UA link with a
higher priority in the same link set will be selected first.
4-10
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
Usage of M3UA with CSCN in 3G solutions is shown in Figure 4-11. The M3UA is used
to carry user-signaling information over IP domain.
SMS-C GMLC/SMLC
HLR/EIR
SCP
M3UA MAP
M3UA MAP
M3UA
M3UA M3UA
M3UA GMSC server
CAP MAP
MSC Server MAP
M3UA M3UA M3UA
M3UA
M3UA M3UA ISUP
PSTN / ISDN
BICC
UTRAN RANAP
MAP / IP ISUP / IP
BSSAP
H.248 SG SS7
AAL2 SS7
In CSCN, the local attribute of M3UA link can be SGP, ASP or IPSP. M3UA can support
following two work modes:
Agent Mode
In agent mode SG and all AS have the same signaling point code and each AS has
different combination of CIC, SSN and SI. The destination entity is distinguished by the
combination of CIC, SSN and SI.
Transfer mode
In Transfer mode, AS and SG have the different signaling point code and each AS has
can have either a different signaling point code (AS in exclusive mode) or same
signaling point code (AS in inclusive mode). In this mode, SG have the STP
functionality, each AS can access destination signaling point in SS7 network through
more than one SG.
4-11
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
The general M3UA message format includes a common message header followed by
zero or more variable length parameters.
The protocol messages for MTP3-User Adaptation require a message structure, which
contains a version, message class, message type, message length, and message
contents. This message header is common among all signaling protocol adaptation
layers.
All the parameters contained in a message are defined in a Tag Length-Value format as
shown below.
I. Management Messages
4-12
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
Message
Message description
name
The DATA message contains the SS7 MTP3-User protocol data, which is an
Data
MTP-TRANSFER primitive, including the complete MTP3 Routing Label.
Message
Message description
name
The DUNA message is sent from an SGP in an SG to all concerned ASPs to indicate
DUNA
that the SG has determined that one or more SS7 destinations are unreachable.
The DAVA message is sent from an SGP to all concerned ASPs to indicate that the SG
DAVA has determined that one or more SS7 destinations are now reachable (and not
restricted), or in response to a DAUD message if appropriate.
The DAUD message is sent from the ASP to the SGP to audit the
DAUD availability/congestion state of SS7 routes from the SG to one or more affected
destinations.
The SCON message is sent from an SGP to all concerned ASPs to indicate that an SG
SCON has determined that there is congestion in the SS7 network to one or more
destinations, or to an ASP in response to a DATA or DAUD message as appropriate.
The DUPU message is used by an SGP to inform concerned ASPs that a remote peer
DUPU
MTP3-User Part (for example,, ISUP or SCCP) at an SS7 node is unavailable.
The DRST message is sent from the SGP to all concerned ASPs to indicate that the SG
DRST has determined that one or more SS7 destinations are now restricted from the point of
view of the SG, or in response to a DAUD message if appropriate.
Message
Message description
name
The ASP Up message is used to indicate to a remote M3UA peer that the
ASP Up Adaptation layer is ready to receive any ASPSM/ASPTM messages for all
Routing Keys that the ASP is configured to serve.
4-13
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
Message
Message description
name
The ASP Down message is used to indicate to a remote M3UA peer that the
ASP Down
adaptation layer is NOT ready to receive DATA, SSNM, RKM or ASPTM messages.
The ASP UP Ack message is used to acknowledge an ASP Up message received
ASP Up Ack
from a remote M3UA peer.
ASP Down The ASP Down Ack message is used to acknowledge an ASP Down message
Ack Received from a remote M3UA peer.
ASP Inactive The ASP Inactive Ack message is used to acknowledge an ASP Inactive message
Ack received from a remote M3UA peer.
An example of M3UA messages is DATA that will be described in the following part to
help you to form an idea of the structure of M3UA messages.
The DATA message contains the SS7 MTP3-User protocol data, which is an
MTP-TRANSFER primitive, including the complete MTP3 Routing Label.
Correlation Id Optional
4-14
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
The mandatory Protocol Data field contains the original SS7 MTP3 message, including
Service Information Octet and Routing Label.
SI NI MP SLS
I. Establishment Procedure
The following scenario in Figure 4-14 shows the example M3UA message flows for the
establishment of traffic between an SGP and an ASP or between two IPSPs. It is
assumed that the SCTP association is already set up.
4-15
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
SGP ASP
ASP UP
ASP UP ACK
AS INACTIVE NOTIFY
ASP ACTIVE
AS ACTIVE NOTIFY
Here ASP is the client, which will first send the request to establish the M3UA Link.
Once link is ready, all types of M3UA messages can be transmitted between the peers.
When the M3UA layer on the ASP has a M3UA User message to be sent to the SG, it
will do the following:
1) Determine the correct Destination Entity.
2) If the destination Entity is Accessible, then get the Available route to that
destination entity.
3) Get an Active Linkset belonging to this Route.
4) Determine an Active Link in the given Linkset.
5) Determine whether to complete the optional fields of the DATA message.
6) Map the MTP-TRANSFER request primitive into the Protocol Data field of a DATA
message
7) Send the DATA message to the remote M3UA peer at the SGP, over the chosen
M3UA link.
4-16
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
SGP
ASP
MTP_TRANSFER
DATA message
When the M3UA layer on the SG has a M3UA User message to be sent to the ASP, it
will do the following:
1) Determine the correct Destination Entity.
2) If the destination Entity is Accessible, then get the Available route to that
destination entity.
3) Get an Active Linkset belonging to this Route.
4) Determine an Active Link in the given Linkset.
5) Map the MTP-TRANSFER request primitive into the Protocol Data field of a DATA
message
6) Send the DATA message to the remote M3UA peer at the ASP, over the chosen
M3UA link.
4-17
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
SGP
ASP
MTP_TRANSFER
DATA message
Release procedure of the M3UA service environment is illustrated in Figure 4-17 below:
SGP ASP
ASP INACTIVE
AS PENDING NOTIFY
Pending Timer Expires
AS INACTIVE NOTIFY
ASP DOWN
AS DOWN NOTIFY
4-18
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 M3UA
When the M3UA link needs to be withdrawn, the ASP will start the above procedure. At
the end of this procedure the SCTP association will be shut down.
4-19
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Chapter 5 SCCP
5.1 Overview
The Signaling Connection Control Part (SCCP) is one of the user parts in the
hierarchical architecture of the Signaling System No. 7, and resident at the functional
level 4. The SCCP also provides additional functions to the Message Transfer Part
(MTP) to cater for both connectionless as well as connection-oriented network
services to transfer circuit related and non-circuit related signaling information and
other types of information between exchanges and specialized centers in
telecommunication networks through a SS7 network, thus forming the network layer
of the OSI reference model.
The overall objectives of the SCCP are to provide the data information transfer means
for:
z Logical signaling connections within the common channel signaling network;
z A transfer capability for signaling data units with or without the use of logical
signaling connections.
Functions of the SCCP are also used for the transfer of circuit related and non circuit
related signaling information of the ISDN user part with or without setup of end-to-end
signaling connections.
The services provided by the SCCP can be grouped into four classes:
z 0: Basic connectionless class.
z 1: In-sequence delivery connectionless class.
z 2: Basic connection-oriented class.
z 3: Flow control connection-oriented class.
The classes 0 and 1 are connectionless services; the classes 2 and 3 are
connection-oriented services.
5-1
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Permanent signaling connections are established and controlled by the local (or
remote) operation and maintenance function or by the management function of the
node and they are provided for the user on a semi-permanent basis, thus similar to
leased telephone lines. Connection-oriented described here refers to the temporary
signaling connection.
The SCCP provides the transfer service for multiple application protocols of CSCN,
as shown in Figure 5-1.
SCCP
SCTP SSCF-NNI
MTP2
IP SSCOP
MTP1 MAC ATM
The SCCP exists in CSCN to serve as the intermediate layer for transferring
messages. Its upper-layer users are ISUP, BSSAP, BSSAP+, RANAP and TCAP;
according to the transfer media, its lower-layer protocols are MTP3, M3UA and
MTP3b.
5-2
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
SCCP message is a kind of message signal unit (MSU) of SS7. Its message contents
are contained in the signaling information field (SIF) of the MSU. A SCCP message is
identified by the SI coded 0011 contained in the service information octet (SIO) of the
MSU. See Figure 5-2.
The routing label in Figure 5-2 has been introduced in Section MTP. 8-bit coding is
used for the variety of message types. Each code identifies one SCCP message.
Those parameters that are mandatory and of fixed length for a particular message
type are contained in the “mandatory fixed part”; those mandatory parameters of
variable length are included in the “mandatory variable part”. A particular message
may also consist of an optional part. The optional parameters may be of fixed length
or variable length. For those mandatory variable parameters, pointers are used to
indicate their location. For the optional parameters, the beginning of each parameter
should be indicated, and the code and the length of each parameter should be given.
5-3
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
7 6 1 0 bit
DPC
0 0 0 0 0 0 0 0
OPC
BIB BSN
SLS
F IB F SN
LI Message type
Mandatory parameter A
Sub-service field SI with fixed length
Mandatory parameter B
with fixed length
Mandatory param eter B with fixed length Point to parameter M
Point to parameter P
Parameter M
Length of parameter P
Parameter P
Code of parameter X
ck Length of parameter X
Parameter X
0 1 1 1 1 1 1 0
Code of parameter Z
Length of parameter Z
Parameter Z
0 0 0 0 0 0 0 0
5-4
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Protocol class
DT1, DT2 and ED messages are used to carry the data after the signaling connection
is established. The DT1 serves for the protocol class 2, and the DT2 and the ED
serve for the protocol class 3. In addition, the DT2 and ED must be acknowledged by
a AK and a EA respectively.
RLSD and RLC messages are used to release the signaling connection after data
transmission is completed.
RSR and RSC messages are used to re-initialize the sequence numbers of the data
during the data transfer phase in the protocol class 3.
5-5
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Segmenting/reassembling 00000110
Receive sequence number P(R) 00000111
Sequencing/segmenting 00001000
Credit 00001001
5-6
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Data 00001111
The “destination local reference” and the “source local reference” uniquely determine
a signaling connection.
The “called party address” and the “calling party address” are used to identify the
originating/destination signaling point and (or) the SCCP service access point.
The “protocol class” defines the four classes of protocols used for connectionless
services and connection-oriented services.
If the length of the network service data unit (NSDU) exceeds the maximum length
allowed by the message transferred as data, it is required to segment one network
service data for deliver individually. After reaching the destination, the segments will
be reassembled. The purpose of the “segmenting/reassembling” parameter is to
achieve this. This parameter is only used in DT1 messages.
The “receive sequence number” P(R) parameter indicates the sequence number of
the next expected message. The parameter is used in DT2 and AK messages in the
protocol class 3, for the purpose of acknowledging that the remote node has already
received all the messages before P(R)-1.
The “release cause", the “reset cause” and the “refusal cause” are used to
respectively indicate the reason why the signaling connection was release, reset, or
refused. The “error cause” is used in the ERR message in order to indicate what is
the exact error. The “return cause” is used in the UDTS or XUDTS message of a
5-7
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
connectionless service to indicate the reason why the UDT or XUDT message failed
to be delivered to the destination.
The “data” parameter contains the network service data (NSD) to be delivered to the
destination by the user.
Address: The called/calling party address is a variable length parameter. Its structure
is shown in Figure 5-3.
Address indicator
Address
I. Address Indicator
The “address indicator” indicates the type of address information contained in the
address field. See Table 5-3.
7 6 5 4 3 2 1 0 Bi
t
“0” indicates that the address does not contain a signaling point code.
“0” indicates that the address does not contain a subsystem number.
Bits 5-2 contain the global title indicator, which is encoded as follows:
5-8
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
0011 Global title includes translation type, numbering plan and encoding
scheme.
0100 Global title includes translation type, numbering plan, encoding scheme
and nature of address indicator.
0101
~ Spare international
0111
1000
~ Spare national
1110
Bit 6: “0” indicates that routing is based on the global title contained in the address;
“1” indicates that routing is based on the destination point code contained in the MTP
routing label and the subsystem number contained in the called party address
(DPC+SSN).
III. Address
The various elements, when provided, occur in the order: destination point code,
subsystem number, global title, as shown in Figure 5-4.
DPC
SSN
GT
Bits: 76543210
5-9
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
00000010 reserved
00001001
~ Idle
11111110
Figure 5-5 shows the format of the global title, if the global title indicator equals 0001.
Nature of address
O/E
indicator
Address information
If the global title indicator equals 0001, the bits 6~0 of the octet 1 contain the Nature
of Address Indicator (NAI) and are coded as follows:
Bits 6~0:
0000000 idle
5-10
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
00000101
~ Idle
11111111
If the global title indicator equals 0001, the octets 2 and further contain a number of
address signals as shown in Figure 5-6.
0000 digit 0
0001 digit 1
0010 digit 2
0011 digit 3
0100 digit 4
0101 digit 5
0110 digit 6
0111 digit 7
1000 digit 8
1001 digit 9
1010 spare
1011 code 11
1100 code 12
1101 spare
1110 spare
5-11
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
1111 ST
In case of an odd number of address signals, a filler code 0000 is inserted after the
last address signal.
z Protocol class and return selection
The protocol class is used to define the service class of the SCCP. During the
signaling connection setup phase, the protocol class field is required and is
negotiated between the SCCP peers.
Bits 3210
0000 class 0
0001 class 1
0010 class 2
0011 class 3
When the bits 0-3 are coded to indicate a connection-oriented protocol class (class 2,
class 3), the bits 4-7 are spare.
When the bits 0-3 are coded to indicate a connectionless protocol class (class 0,
class 1), the bits 4-7 are coded as follows:
Bits 7654
0001
to spare
0111
1001
to spare
1111
The format and the parameters used for SCCP messages have been described in the
above sections. Each SCCP message consists of several parameters including the
mandatory part and possibly optional part. The corresponding parameters constituting
each message are shown in Table 5-4.
5-12
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
C C CR RL RL DT DT A E E RS RS ER I UD UD
Parameter
R C EF SD C 1 2 K D A R C R T T TS
Destination local M M M M M M M M M M M M M
reference
Source local M M M M M M M
reference
Called party M o o M M
address
Calling party o M M
address
Protocol class M M M
Segmenting/reass M
embling
Receive sequence M
number
Sequencing/segm M M
enting
Credit M M
Release cause M
Return cause
Reset cause M
Error cause M
User data o o o o M M M
Refusal cause M
End of optional o o o o
parameters
m: mandatory parameter (including fixed length part and variable length part)
o: optional parameter
5-13
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Credit 0 3
Calling party address 0 4 (minimum)
Data 0 3-130
End of optional parameters 0 1
5-14
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Data V 2-X
X: variable.
Data V 2-X
Optional O 6
X: variable.
5-15
T Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SCCP
Optional O 6
X: variable.
5-16
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
Chapter 6 TCAP
6.1 Overview
TC user
Component sub-layer
Transaction sub-layer
SCCP
I. Component Sub-Layer
6-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
The class of the operation is determined by the TC user. The TCAP can identify these
classes. Each operation has at most one reply. The reply may be:
a return result indicating success (RESULT);
a return error indicating operation failure (ERROR);
a reject indicating inability to perform the operation (REJECT);
Expiry of the operation invocation (CANCEL), only having the local meaning.
The component portion implements the handling of the components, including
temporary ones, between two TC-users. According to the particular type of operation
carried by the component, management is performed on the state machine of the
component.
b) Basic end (TC_END): The local dialogue is ended; the pending components are
delivered to the remote end and the remote TC-user is informed of the ending of the
dialogue.
The transaction sub-layer is used for transaction handling control. Components are
transferred in the transaction sub-layer messages between TC-users by means of
6-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
TCAP messages are the SCCP user data and structured by information elements.
Each element has the same structure and consists of three fields as shown in Figure
6-2.
Tag
Length Tag
Contents Length
Contents
I. Tag
The Tag distinguishes one information element from another and governs the
interpretation of the Contents. It is one or more octets in length. The Tag is composed
of “Class”, “Form” and “Tag code”, as shown in Figure 6-3.
7 6 5 4 3 2 1 0
Class Form Tag code
00 Universal
01 Application-wide
10 Context-specific
11 Private use
6-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
resultant Tag consists of bits 0 to 6 of each extension octet, with bit 6 of the first
extension octet being most significant (MSB) and bit 0 of the last extension octet
being least significant (LSB).
II. Length
It is the length of the Contents. The Length uses the short, long or indefinite form. In
the indefinite form, a special primitive (Tag EOC=0; Length=0; Contents is unused
and absent) is used to terminate the Contents. See Figure 6-4.
7 6 5 4 3 2 1 0
0 MSB Length of Contents LSB
a) Short form
7 6 5 4 3 2 1 0
Length of Contents
LSB N
b) Long form
7 6 5 4 3 2 1 0
1 0 0 0 0 0 0 0
Informatio
n element
.....
Informatio
n element
c) Indefinite form
6-4
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
III. Contents
The contents may be a value along with the Tag and the Length constituting a
primitive, or one or more information elements along with the Tag and the Length
constituting a constructor. The contents is interpreted according to the tag value.
Component
Message
Unidirectional Begin Continue End Abort
Parameter
Originating Transaction ID M M
Destination Transaction ID M M M
Abort Cause O
Dialogue Portion O O O O O
6-5
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 TCAP
Message
Unidirectional Begin Continue End Abort
Parameter
Component Portion M O O O
Unstructured dialogue: Object Identifier Tag (M), Protocol Version (M), Application
Context Name (M), User Information (O).
Structured dialogue:
1) Dialogue Request: Protocol Version (O), Application Context Name (M), User
Information (O).
2) Dialogue Response: Protocol Version (O), Application Context Name (M), Result
(M), Result Source Diagnostic (M), User Information (O).
3) Dialogue Abort: Abort Source (M), User Information (O).
Structure of the Component Portion
a) Invoke: Invoke ID (M), Linked ID (O), Operation Code (M), Parameter (O).
b) Return Result (last and non-last): Invoke ID (M), Sequence Tag (O), Operation
Code (O), Parameter (O).
6-6
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 RTP and RTCP
7-1
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 RTP and RTCP
MRPU
Nb UP
RTP RTCP
UDP
IP
ETH
IP
Version 2 The field defines the version of RTP. The version defined here is two.
Padding(P) 1 If the padding bit is set to 1, the packet contains one or more additional
padding octets at the end of the header. The last octet of the padding
contains a count of padding octets. Padding may be needed by some
encryption algorithms or for carrying several RTP packets in a
lower-layer protocol data packet.
Extension (X) 1 If the extension bit is set to 1, the RTP header is followed by exactly one
header extension.
CSRC Count 4 The CSRC count contains the number of CSRC identifiers that follow
(CC) the header.
Mark (M) 1 It is set by specific protocols. In IP calls, it is set to 1 in the first RTP data
packet transferred after mute, and it is set to 0 in other cases.
Payload Type 7 This field identifies the format of the RTP payload.
(PT)
Sequence 16 The sequence number is used by the receiver to detect packet loss and
Number to restore packet sequence. The initial value of the sequence number is
random and increments by one for each RTP data packet sent.
7-2
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 RTP and RTCP
Timestamp 32 The timestamp reflects the sampling instant of the first octet in the RTP
data packet. The sampling instant must accommodate to
synchronization to allow synchronization and jitter calculations. The
initial value of the timestamp is random, and increments with the size of
packet data.
SSRC 32 The SSRC field identifies the RTP packet sender. This identifier is
chosen randomly, with the intent that no two RTP packet senders within
the same gateway will have the same SSRC identifier. Although the
probability of multiple sources choosing the same identifier is low, all
RTP implementations must be prepared to detect and resolve
collisions. If a source changes its source transport address, it must also
choose a new SSRC identifier to avoid being interpreted as a looped
source.
CSRC List 0-480 0 to 15 items, 32 bits each. The CSRC list identifies CSRC in packets.
The number of identifiers is given by the CC field. At most 15 CSRC
identifiers are defined and are inserted by mixers, using the SSRC
identifiers
RTCP defines several types of RCTP packets to carry a variety of control information as
shown in Table 7-2.
SR (sender report) Describe transmission and reception statistics from the gateways that are
active senders
RR (receiver report) Describe reception statistics from the gateways that are receivers
SDES (source description Describe the sources sending RTCP packets, including CNAME.
item)
Each RTCP packet begins with a fixed part similar to that of RTP data packets, followed
by structured elements that may be of variable length according to the packet type but
always end on a 32-bit boundary. The alignment requirement and a length field in the
fixed part make RTCP packets "stackable", that is, multiple RTCP packets form a
compound RTCP packet that is sent in a single packet of the lower layer protocol, for
example UDP. There is no explicit count of individual RTCP packets in the compound
packet since the lower layer protocols are expected to provide an overall length to
determine the end of the compound packet.
7-3
Protocols and Signaling Analysis Transport Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 RTP and RTCP
RTCP transmits RTP control packets based on the periodic transmission, using the
same distribution mechanism as the data packets. RTCP chiefly performs two
functions.
The primary function is to provide feedback on the quality of the data distribution.
The receiver diagnoses faults on transport lines and controls RTP packet transfer
according to the feedback information in RTCP packets. The feedback function is
accomplished through sending and receiving reports by RTCP.
RTCP carries a persistent identifier for a RTP source, which is called the canonical
name (CNAME). Since the RTP header may change if a conflict is discovered or a
program is restarted, receivers require the CNAME to keep track of each
participant.
The interval between RTCP packets transmitted is varied randomly over the range [0.5,
1.5] times the calculated interval to avoid unintended synchronization of all participants.
The first RTCP packet sent after joining a session is also delayed by a random variation
of half the minimum RTCP interval in case the application is started at multiple sites
simultaneously.
7-4
HUAWEI
Table of Contents
i
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
ii
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
iii
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
1.1 Overview
The Iu interface is specified at the boundary between UTRAN and CN. According to the
nature of provided services, the CN is divided into Circuit Switched (CS) domain,
Packet Switched (PS) domain and Broadcast (BC) domain. The CS domain provides
circuit services for users; the PS domain provides packet services; the BC domain
provides broadcast services. The Iu interface respectively towards these logically
independent CN domains is called Iu-CS, Iu-PS, Iu-BC. The Iu interface architecture is
shown in Figure 1-1.
RNC “Iu-CS”
Node B
PS
Domain
Node B “Iu-PS”
RNC
BC
Node B Domain
“Iu-BC”
Iu Interface
The Iu interface between the Radio Network Controller (RNC) and the CN is defined as
follows:
1-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
There shall not be more than one Iu-CS interface between a RNC and the CS
domain resident CN;
There shall not be more than one Iu-PS interface between a RNC and the PS
domain resident CN;
There may be multiple Iu-BC interfaces between a RNC and the BC domain.
Main functions implemented by the Iu interface are described as follows:
Radio Access Bearer (RAB) management functions
Radio resource management functions
Rate adaptation functions
Iu link management functions
Iu user-plane management functions
Mobility management functions
Security management functions
Service and network access functions
Iu co-ordination functions (paging co-ordination and relocation co-ordination)
Figure 1-2 shows the protocol structure for Iu-CS interface described by the 3GPP
25.410.
SCCP Q.2150.1
MTP3b MTP3b
SSCF-NNI SSCF-NNI
SSCOP SSCOP
ATM
Physical Layer
According to the vertical plane structure, the Iu-CS interface protocol includes:
1-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
Control plane: includes control plane signaling RANAP (TS25.413) and signaling
bearer (TS25.412).
User plane: includes user plane protocol Iu UP (TS25.415) and data bearer
(TS25.414).
Transport network control plane: includes data bearer control signaling ALCAP
(ITU-T Q.2630.1 and ITU-T Q.2630.2) and signaling bearer (TS25.414).
MSOFTX3000 functions as a MSC Server in UMTS and is the control plane equipment
of the CN. So the Iu-CS interface in MSOFTX3000 is only embodied by the control
plane protocol, RANAP. The user plane protocol (Iu UP) is embodied on the interface
between the MGW (UMG8900) and the RNC. See Figure 1-3.
MSOFTX3000
RANAP
RNC Iu-CS
Mc
RANAP
Iu UP
UTRAN UMG8900
The structure of the RANAP protocol stack is shown in Figure 1-4. MSOFTX3000
supports two signaling bearer modes: ATM based broadband SS7 (SAAL-NNI, MTP3b,
SCCP) and IP based signaling transport systems (IP, SCTP, M3UA).
1-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
SCCP SCCP
SCCP SCCP
MTP3B MTP3B
M3UA M3UA
STC STC
AAL5 AAL5
IP IP
ATM ATM
MAC MAC
PL PL
From the point of view of layers, the RANAP protocol stack can be divided into two parts:
radio access network application protocol at the radio network layer, using RANAP
protocol (TS25.413), and signaling bearer, resident at the transport network layer.
RANAP is responsible for signaling interaction of the Iu-CS interface between the CN
and the RNC. It provides a variety of functions above mentioned by combination of one
or more Elementary Procedures (EPs).
The following section describes EPs classified respectively by response type and
message transport mode.
According to different response types, RANAP EPs are divided into Classes 1, 2 and 3.
Class 1: Elementary Procedures with response (success and/or failure). For Class
1 EPs, “Successful” means a signaling message explicitly indicates that the
elementary procedure successfully completed with the receipt of the response.
“Unsuccessful” means a signaling message explicitly indicates that the EP failed
or on time supervision expiry (that is, absence of expected response). A third
result is “successful and unsuccessful”. “Successful and unsuccessful” means one
signaling message reports both successful and unsuccessful outcome for the
different included requests. The response message used is the one defined for
successful outcome.
Class 2: Elementary Procedures without response. Class 2 EPs are considered
always successful.
Class 3: Elementary Procedures with possibility of multiple responses. Class 3
EPs have one or several response messages reporting both successful,
1-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
unsuccessful outcome of the requests and temporary status information about the
requests.
Messages relating to the three classes of RANAP EPs are shown in Table 1-1 to Table
1-3.
Relocation RELOCATION
RELOCATION
Resource REQUEST RELOCATION FAILURE
REQUEST
Allocation ACKNOWLEDGE
RELOCATION
Relocation RELOCATION
CANCEL
Cancel CANCEL
ACKNOWLEDGE
SRNS Context SRNS CONTEXT SRNS CONTEXT
Transfer REQUEST RESPONSE
Security Mode SECURITY MODE SECURITY MODE
SECURITY MODE REJECT
Control COMMAND COMPLETE
Data Volume DATA VOLUME DATA VOLUME
Report REPORT REQUEST REPORT
RESET
Reset RESET
ACKNOWLEDGE
Reset RESET RESOURCE
RESET RESOURCE
Resource ACKNOWLEDGE
1-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
According to different message transport modes, RANAP EPs are classified into:
connection-oriented and connectionless. The former is supported by a UE specific
signaling connection for transport; the latter is supported by a common signaling
connection for transport.
All other procedures use connection-oriented service to transport except that Reset,
Reset Resource, Overload Control, and Paging use SCCP connectionless service and
Error Indication bases the actual conditions to make a determination between the
connectionless service and the connection-oriented service.
Connection-oriented messages are ones between a specific UE and the network, such
as UE location update procedure and call procedure. Connectionless messages are
ones pertaining to system maintenance and administration and affect part or all of UE
users.
1-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
I. RAB Assignment
RAB assignment is initiated by the CN. But the CN only determines a RAB ID value and
concerned RAB parameters. The RNC executes the request, allocates user plane
resources, and reports to the CN the outcome of the procedure in one or more
responses. The message flow is shown in Figure 1-5.
RNC CN
**
Note:
Q.2630.1 message only appears on the Iu-CS interface. It does not appear on the Iu-PS interface.
There may be multiple responses.
1-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
2) If there are not RABs in the queue, the CN terminates TRABAssgt on reception of
the first RAB assignment response, and ends the RAB assignment procedure; if
there is a queue, the RNC starts the TQEUING timer, and returns the execution
results about RAB queuing to the CN with a RAB assignment response. (RAB
results may be returned one by one or several are returned at a time.)
3) If the RNC completes the execution of queued RABs before TQEUING expiry, it
stops timing of TQEUING, returns a RAB assignment response, and ends the
RAB assignment procedure; if the RNC does not complete the execution of RAB
assignment requests in the queue before TQEUING expiry, the RNC stops queue
execution, returns a RAB assignment response, and ends the RAB assignment
procedure.
4) If the CN receives execution results about all queued RABs before TRABAssgt
expiry, it stops timing of TRABAssgt, and ends the RAB assignment procedure; if
the CN does not receive execution results about all queued RABs before
TRABAssgt expiry, it ends the RAB assignment procedure, and regards RABs
without results returned as unsuccessful execution.
The RNC uses this procedure to request the CN to release concerned RAB resources.
The elementary procedure without response is connection-oriented. The message flow
is shown in Figure 1-6.
When a failure occurring to the corresponding user plane resource of RAB ID is found
at the RNC, the RNC initiates a RAB release request message to the CN in normal
cases.
RNC CN
RAB
RELEASE REQUEST
This procedure is used by the RNC to request the CN to release the Iu connection for a
particular UE. It is due to some UTRAN generated reason, for example, “O&M
Intervention”, “User Inactivity”, “Radio Connection With UE Lost", etc. The Iu Release
Request procedure without response is connection-oriented. The message flow is
shown in Figure 1-7.
1-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
IU RELEASE REQUEST
IV. Iu Release
RNC CN
IU RELEASE COMMAND
IU RELEASE COMPLETE
V. Relocation of SRNS
This procedure is used to relocate the Serving RNS (SRNS) from one RNS to another.
This procedure can be divided into several stages: Relocation Preparation, Relocation
Resource Allocation, Relocation Detect and Relocation Complete. In addition,
Relocation Cancel is also included.
1) Relocation Preparation
The relocation message flow is shown in Figure 1-9 and Figure 1-10.
1-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
Source RNC CN
RELOCATION REQUIRED
RELOCATION COMMAND
Source RNC CN
RELOCATION REQUIRED
RELOCATION PREPARATION
FAILURE
1-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
This procedure is used to allocate resources from the target RNS for a relocation of
SRNS and co-ordinate Iu connection resources existing for the particular UE. The
procedure with response is connection-oriented. The message flow is shown in Figure
1-11 and Figure 1-12.
Target RNC CN
RELOCATION REQUEST
RELOCATION REQUEST
ACKNOWLEDGE
Target RNC CN
RELOCATION REQUEST
RELOCATION FAILURE
1-11
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
3) Relocation Detect
This procedure is used by the target RNC to indicate to the CN the detection of
relocation execution. The procedure without response is connection-oriented. The
message flow is shown in Figure 1-13.
Target RNC CN
RELOCATION DETECT
When relocation execution trigger is received, the target RNC sends a RELOCATION
DETECT message to the CN and starts the role of SRNC. Upon reception of the
RELOCATION DETECT message, the CN switches the user plane from the source
RNC to the target RNC.
4) Relocation Complete
This procedure is used by the target RNC to indicate to the CN the completion of
relocation of SRNS. The procedure without response is connection-oriented. The
message flow is shown in Figure 1-14.
Target RNC CN
RELOCATION COMPLETE
When the new SRNC-ID and Serving RNC Radio Network Temporary Identity (S-RNTI)
are successfully exchanged with the UE by the radio protocols, the target RNC sends a
relocation complete message to the CN, and terminates the whole Relocation
procedure. Upon reception of the relocation complete message, the CN begins to
release the connection associated with the SRNC.
5) Relocation Cancel
The purpose of this procedure is to enable the source RNC to cancel an ongoing
relocation of SRNS. The procedure takes place after the Relocation Preparation
procedure. The procedure with response is connection-oriented.
1-12
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
Source RNC CN
RELOCATION CANCEL
RELOCATION CANCEL
ACKNOWLEDGE
VI. Paging
When the UE is idle, paging is performed through a common paging channel; when the
UE has already had a Radio Resource Control (RRC) connection, paging is performed
through its dedicated RRC connection.
RNC CN
PAGING
VII. Common ID
This procedure is used, after a RRC connection is established for the UE, to create a
reference between a common identity of the UE (for example, IMSI) and the RRC
connection and store it in the RNC, so that subsequent paging messages can be
1-13
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
COMMON ID
After a connection has been established between the RNC and the CN, the CN shall
send the common ID of the UE to the RNC as soon as possible. When a call is already
set up between the UE and a domain of the CN (for example, PS domain) and another
domain (for example, CS domain) wants to page the UE, the RNC can use the
Common ID of the UE to look for the corresponding RRC connection of the PS domain.
(PS and CS domains always share one RRC connection to the same UE.) Then the
PAGING message is sent to the UE through the dedicated RRC connection channel.
If the RNC does not support this function, the RNC will send the PAGING message
through a common paging channel in the preceding conditions. In this way, the
PAGING message will not be found by the UE, and thus the paging operation will fail.
This procedure is used to inform the RNC to trace the actions of a particular UE and
report the record to a specified Operation and Maintenance Center (OMC). The
procedure without response is connection-oriented. The message flow is shown in
Figure 1-18.
RNC CN
CN INVOKE TRACE
This procedure is used by the CN to pass cipher and integrity mode information to the
UTRAN. The UTRAN uses these algorithms during the subsequent RAB connection
1-14
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
SECURITY MODE
COMMAND
SECURITY MODE
COMPLETE
RNC CN
SECURITY MODE
COMMAND
SECURITY MODE
REJECT
This procedure is used by the CN to request the RNC to provide information on the
location of a given UE. The control parameter may be of direct report type, change
report type or stop report type. The procedure without response is connection-oriented.
The message flow is shown in Figure 1-21.
RNC CN
LOCATION REPORTING
CONTROL
1-15
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
This procedure is used by the RNC to report the UE's location information to the CN.
The report is controlled by the LOCATION REPORT CONTROL message. The
procedure without response is connection-oriented. The message flow is shown in
Figure 1-22.
RNC CN
LOCATION REPORT
This procedure is used by the RNC to transparently transfer to the CN the radio
interface initial message (NAS-PDU) of the third layer from the UE when a Iu signaling
connection is established by the RNC. The procedure without response is
connection-oriented. The message flow is shown in Figure 1-23.
RNC CN
INITIAL UE MESSAGE
The RNC does not analyze the contents of the initial message. What it does is to add
some information on it to generate an INITIAL UE message and then transfer it to the
CN.
1-16
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
DIRECT TRANSFER
RNC CN
DIRECT TRANSFER
This procedure is initiated by either the RNC or the CN in case that signaling overload
happens at its side. The other party performs overload control according to a certain
algorithm, such as restricting UE accessing or restricting to send paging or switching
request, etc. messages. The purpose to do so is to appropriately reduce the traffic
processed by the RNC or the CN, so as to ensure the normal operation of the system.
The RNC and the CN are equivalent in the aspect of the role during this control
procedure. That is, either can initiate this procedure.
This procedure has two operations: overload control at the CN side and overload
control at the UTRAN side. The procedure without response is connectionless. The
message flow is shown in Figure 1-26 and Figure 1-27.
RNC CN
OVERLOAD
1-17
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
OVERLOAD
For flow control, at the CN “Processor Overload” is catered for, and at the UTRAN
“Processor Overload” and “Overload in the Capability to Send Signaling Messages to
the UE” are catered for.
XV. Reset
Reset is designed for all transactions on the Iu interface at the RNC or the CN. After
reset, all call connections (already established or being established) will be released.
Call messages from the UE will not be accepted during the reset protection time. The
message flow is shown in Figure 1-28 and Figure 1-29.
RNC CN
RESET
RESET ACKNOWLEDGE
1-18
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
RESET
RESET ACKNOWLEDGE
The source end sends a RESET message and starts timer T(RafC) or T(RafR). Upon
reception of the RESET message, the opposite end releases affected RABs and then
returns a reset acknowledgement message.
Reset Resource is designed for partial Iu connections at the RNC (or the CN). When
connection status abnormality is found by the RNC or the CN, the RNC or the CN
initiates the Reset Resource procedure. The message flow is shown in Figure 1-30 and
Figure 1-31.
RNC CN
RESET RESOURCE
RESET RESOURCE
ACKNOWLEDGE
1-19
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
RESET RESOURCE
RESET RESOURCE
ACKNOWLEDGE
The Error Indication procedure is initiated by a node to report detected errors in one
incoming message, provided they cannot be reported by an appropriate failure
message.
If the error situation arises due to reception of a message utilizing dedicated signaling,
then the Error Indication procedure without response uses connection-oriented
signaling. Otherwise the procedure without response uses connectionless signaling.
The message flow is shown in Figure 1-32 and Figure 1-33.
RNC CN
ERROR INDICATION
RNC CN
ERROR INDICATION
This procedure is used to inform the RNC to trace the actions of a particular UE and
report the record to a specified Operation and Maintenance Center (OMC). The
1-20
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
This procedure is used to inform the RNC to stop tracing the actions of a particular UE.
The procedure without response is connection-oriented. The message flow is shown in
Figure 1-34.
RNC CN
CN DEACTIVATE
TRACE
On the basis of RANAP Elementary Procedures, this section describes the signaling of
several typical procedures on the Iu interface so that you can have an idea of
applications of the RANAP EPs.
The typical procedures to be described below are CS domain location update, mobile
calling, mobile called, relocation, relocation failure, etc.
Figure 1-35 illustrates a typical location update procedure. The location update
procedure is connection-oriented.
1-21
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
SCCP : CR
( Initial UE Message (location update request))
Iu Release Command
Iu Release Complete
SCCP : RLC
1-22
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
1-23
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
9) If the call is terminated by the calling UE, the calling UE sends a DISCONNECT
message to the CN. If the called party hooks on first, the CN sends a
DISCONNECT message to the calling UE.
RNC CN
Pagings
SCCP : CR
(Initial UE Message (paging response))
SCCP : CC
Common ID
Authentication Encryption procedure
Direct Transfer ( setup )
Direct Transfer( call confirmed )
RAB Assignment procedure
Direct Transfer( alerting)
Direct Transfer( connect )
Direct Transfer( connect ack )
In conversation
Direct Transfer ( disconnect: released by the called party)
1-24
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
6) After the called party hears ringing tone, the UE sends an ALERTING message to
the CN.
7) The called party hooks off, the UE sends a CONNECT message to the CN.
8) The CN returns a CONNECT ACK message. The call is connected.
9) The message flow about on-hook is the same as that of the mobile calling
procedure.
Figure 1-38 illustrates the switching procedure between two RNCs in the same CN.
SRNC CN TRNC
Connection Established
Relocation Required
Relocation Request
SCCP CC
Relocation Failure
Relocation Prep. Failure
Relocatin Req. Ack
Relocation Command
Relocation Detect
Relocation Cancel
Relocation Cancel Ack. Relocation Complete
Iu Release/ SCCP Release
As shown in Figure 1-38, solid lines represent normal switching procedures and dotted
lines represent abnormal procedures.
After a successful switch, the CN shall initiate the Iu Release procedure to the source
side. If the CN fails to initiate the Iu Release procedure to the RNC before the timer
expires, the source RNC shall actively initiate the Iu Release Request.
Note:
For the switching procedure between CNs, the message flow on the Iu interface is basically same. The
difference is E interface message flow between CNs (RANAP messages carried by the MAP protocol in
effect).
1-25
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
Figure 1-39 illustrates the resource allocation failure procedure about relocating the
target RNC.
RNC1 CN RNC2
Connection Established
Relocation Required
Relocation Request
SCCP CC
Figure 1-40 illustrates the relocation cancel procedure by the source side actively
1-26
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC1 CN RNC2
Connection Established
Relocation Required
Relocation Request
SCCP CC
Relocatin Req. Ack
Relocation Command
Relocation Cancel
1.3.1 Functions
When RAB needs to transport user data through the lu UP protocol, lu UP protocol
instances must be available at each lu interface access point. The lu UP protocol
instances must be set up, relocated and released together with RABs concerned. The
RAB functions completed by the peer protocol entities defined by the lu UP protocol
vary with lu UP protocol operational modes.
1-27
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
Iu UP Iu UP
Access Stratum
UE Uu UTRAN Iu CN
Iu UP operational mode is decided by RAB, other than the CN or service types, which
ensures the QoS required by RAB. Lu UP protocol data packet type is determined by lu
UP protocol operational mode, that is, different operational modes correspond to
different data packet structures.
Iu UP defines two operational modes, which are activated based on RAB, rather than
CN domain or services (telecommunication). lu UP protocol operational mode specifies
whether to provide features or what features are provided to satisfy RAB QoS
requirements.
1-28
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
and relocation for each RAB. It is signaled to the Iu UP protocol layer at user plane
establishment.
Note:
In most cases, for the circuit domain-oriented lu interface user plane, support mode is adopted and lu user
plane protocol is used to implement some certain processing. Thus the lu user plane protocol (the lu UP
protocol) is usually regarded as an lu user protocol in the circuit domain.
The transparent mode is intended for those RABs that do not require any particular
feature from the Iu UP protocol other than transfer of user data. The operation of the lu
UP protocol in transparent mode is illustrated in Figure 1-42.
UTRAN Iu Interface CN
Non Access
RNL-SAP
Stratum
Access Stratum
Radio Iu UP Iu UP
Interface Layer in Layer in transparent
Protocols transparent Mode Mode
TNL-SAP TNL-SAP
1-29
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
and transport network layer, none access stratum (NAS) data are transmitted through
service access points (SAP).
In transparent mode, the lu UP protocol layer connects transport network layer and
upper layers. The lu UP protocol layer is an empty layer, through which NAS data
stream PUDs are transmitted between upper layers and transport layer.
In transparent mode, the lu UP protocol layer needs to make use of the services
provided by the lu UP protocol transport layer to transmit user data.
1.3.4 Support Mode (SMpSDU: Support Mode for predefined SDU size)
This mode is intended for those RABs that do require particular features from the Iu UP
protocol in addition to transfer of user data. In this mode, lu UP protocol frames are
transmitted by the peer lu UP protocol instances; while in transparent mode, no lu UP
protocol frames are generated. The functional model of the lu UP protocol layer in
support mode is shown in Figure 1-43.
UTRAN Iu Interface CN
Non Access
RNL-SAP
Iu UP Stratum
Frame
Access Stratum
Iu UP
Radio support Iu UP
support Layer in
Interface Mode Layer in support
Mode support
Protocols Function Mode
Function Mode
TNL-SAP TNL-SAP
In predefined support mode, the corresponding RAB constrains the Iu UP protocol and
even the radio interface protocols in some particular way. For instance, certain RABs
can have variable predefined rates.
1-30
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
UTRAN Iu Interface CN
Iu UP layer in Iu UP layer in
support mode support mode
NAS Data Proce- NAS Data Proce-
Radio Interface
TNL-SAP TNL-SAP
Figure 1-44 The functional model of the lu UP protocol layer in support mode
1-31
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
The procedures handled at the lu UP protocol layer are controlled by this set of
functions. The procedures include:
Rate control: This procedure controls over the lu UP the rate set that is allowed to
be sent. The function controlling this procedure interacts with the functions outside
the lu UP protocol layer.
Initialization: This procedure controls the exchange of initialization information
which is needed for operation in support mode. The initialization information can
contain RFCI collection to be used until termination of the connection or until a
new round of initialization.
Time alignment: This procedure controls the timing of the downlink data to the
RNC over lu. The function controlling this procedure interacts with the functions
outside of the lu UP protocol layer.
Error events handling: This procedure controls information exchanged over the lu
concerning fault monitor. The function controlling this procedure interacts with the
functions outside of the lu UP protocol layer.
The special functions of NAS data streams are responsible for "limited manipulation" of
the payload and the consistency check of the frame. If some frames are found lost
during frames receiving, the event will be reported to the procedure control function;
meanwhile for the CRC check and calculation of the Iu UP frame payload part. These
functions are also responsible for the frame quality classification handling.
The special functions of NAS data streams interact with the upper layers to exchange lu
data stream blocks of lu UP protocol frame payload. When necessary, these functions
also handle the padding and depadding of the Iu UP frame payloads.
The special functions of NAS data streams interact with the procedure control function
and provide access to the upper layers for the procedure control function.
Frame qualification classification function
1-32
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
In the lu UP protocol support mode, frame quality classifier is used to classify frame
qualification, which is based on two aspects: radio frame classification and the setting
of RAB attributes “error SDU transmission”. The RAB attribute “error SDU
transmission” tells if erroneous frames shall be sent or not.
FQC information handling
In SRNC on the sending side, the support mode function takes as input the radio frame
quality information and the frame. Based on this the FQC is set for the frame. If
necessary, a CRC is added and the frame is sent to CN. The configuration of FQC
domain is shown in Table 1-4:
INPUT ACTION
Delivery of erroneous SDU Radio Frame Classification Action taken in SRNC on the sending
side
In the support mode, if CRC exits, the receiving side of CN will perform CRC check of
the frame payload, and then passes frames and frame qualify classification information
through RNL-SAP. The configuration of CRC is shown in Table 1-5:
INPUT ACTION
Delivery of erroneous Payload CRC Check Actions taken at CN on the receiving side
SDU result
Not Applicable Any result Frame forwarded with FQC as set by UTRAN
On the CN sending side, the support mode function adds CRC for frame payloads (if
needed), which then are transmitted together with FQC (in the case of transcoding,
FQC is normally set as “good”).
1-33
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
If CRC is available, in SRNC the support mode function will perform a CRC check.
Based on the FQC and the CRC check result, a decision is made whether to deliver the
frame or not. The actions corresponding to FQC setting and CRC check results are
shown in Table 1-6.
Table 1-6 Actions corresponding to FQC setting and CRC check results
INPUT ACTION
Delivery of FQC CRC check (if Actions taken at SRNC on the receiving
erroneous SDUs payload CRC side
present)
N/A Any value Any result Pass the frame to radio interface protocols
The case where SRNC receives a frame with the FQC set to "bad radio frame"
corresponds to a TrFO case. The frame is then trashed by the receiving RNC since
there is currently no means to pass the frame quality indicator down to the UE.
Note:
The basic procedures described in this section are all in support mode of the lu UP protocol.
1-34
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
The purpose of this procedure is to transfer lu user plane frames between the two lu
user plane protocol layers at the two ends of the lu interface. At present the user data
transferred by the lu UP protocol are mainly AMR speech service data.
As one lu user plane instance can only associate with one RAB, the user data being
transferred only relate to the associated RAB.
The message flow in transfer user data procedure is shown in Figure 1-45 and Figure
1-46.
RNC/ CN/
CN Transfer of User Data RNC
(RFCI, payload)
RNC/ CN/
CN Transfer of User Data RNC
(RFCI, payload)
1)
2)
The procedure is invoked by the Iu UP upper layers upon reception of the upper layer
PDU and associated control information: RFCI.
If necessary, NAS data stream function performs CRC check of the upper-layer PDU,
and then sends CRC check results together with RFCI information to the frame
handling function. The frame handling function then retrieves the frame number from its
internal memory, formats the frame header and the payload into the appropriate PDU
type and then transmits lu user frame PDU of to the lower layer of the lu interface.
1-35
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
When receiving a user data frame, the lu user-plane protocol layer will check the
consistency of the lu user-plane frame as below:
The frame handling function is responsible for checking the consistency of the
frame header. If correct, this function stores the frame number and passes the lu
user-plane payload and related CRC information (if CRC check is present) to the
NAS data stream function. And the RFCI received is transmitted to the procedure
control function.
The NAS data stream functions check the payload CRC (if CRC is available). If the
procedure control function indicates RFCI is correct and matches the lu user-plane
frame payload, the NAS data stream functions will send the RFCI and the payload
to the upper layers.
Initialization procedure means that during data transfer, the lu user planes of RNC and
CN must establish the corresponding relationship between RFCI and RAB sub-flow
size, including user rate types the bearer path should support, intervals of speech data
frames sending, the protocol version used by RNC and CN, etc. This procedure is
mandatory for RABs using the support mode for predefined SDU size.
The message flow in the initialization procedure is shown in Figure 1-47. For R4, both
RNC side and CN side can originate this procedure.
RNC/ CN/
CN RNC
INITIALISATION
2)
* ((RFCI, SDU sizes[, IPTIs ])m)
INITIALISATION ACK
1-36
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
The lu rate control procedure is to control the rate of user data sending from CN to RNC,
that is, the working rate of AMR encoder. The purpose of this procedure is to notify the
peer lu UP protocol entity of the rate range allowed by the local lu UP protocol entity.
The message flow in this procedure is shown in Figure 1-48.
RNC/ CN/
CN RNC
RATE CONTROL
(RFCI indicators)
RNC/CN sends a rate control frame firstly. When receiving the frame, CN/RNC will
adjust the encoder working mode according to the rate information in the frame.
In normal cases when other signals are transmitted through the user data path, the
speech rate needs to be lowered. And when signals transmission is completed, the
speech rate needs to be increased. During this process, lu rate control procedure takes
effect.
Another typical case which lu rate control procedure is applied to is the handover
process. RNC may initiate immediate lu rate control procedure so that the RNCs at two
sides in the TrFO service can exchange information with each other as soon as
possible and services after handover can be correctly processed.
Time alignment procedure is to adjust the phase of user data frames sent from CN to
RNC. The message flow is shown in Figure 1-49.
1-37
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
RNC CN
TIME ALIGNMENT
ACK
RNC is responsible for this procedure. When RNC finds that the user data frames from
CN can not satisfy the system time requirements, it will send a time alignment frame to
request CN to adjust the time along with user data frames. If the time can be adjusted,
CN will return to RNC a reply frame indicating correct time alignment; otherwise, a reply
frame indicating error time alignment will be returned.
RNC/ CN/
CN RNC
Error event
(Cause value,
Error distance)
When the protocols at the RNC side or CN side discover abnormal conditions, RNC or
CN will send error reports composed of error event frames to notify CN or RNC.
1-38
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 RANAP and Iu UP
This procedure, collaborated with the user data transfer procedure, is to exchange
frame qualify information at lu user-plane interfaces. The message flow is shown in
Figure 1-51.
RNC/ CN/
CN Transfer of User Data RNC
(FQC, RFCI, payload)
1-39
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
Chapter 2 BSSAP
2.1 Overview
Base Station Subsystem Application Part (BSSAP) is the application protocol used on
the A interface to the GSM network.
The BSSAP protocol used on the A interface describes two classes of messages,
namely BSSMAP messages and DTAP messages. BSSMAP messages are
responsible for service process control and are handled by the corresponding A
interface internal functional module. For DTAP messages, the A interface only
functions as a transport channel. At BSS side, DTAP messages are directly conveyed
to a radio channel; at NSS side, DTAP messages are carried to the corresponding
functional processing unit. The BSSAP protocol is 3GPP TS 08.08 compliant.
2-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
MSOFTX3000
BSSAP
BSC
A Internal
内部接口
interface
BSS UMG8900
MSC/VLR
A
BSC MSC Server
SCCP SCCP
MTP3 MTP3
MTP2 MTP2
MTP1 MTP1
BSSAP user protocols include Direct Transfer Application Part (DTAP) and Base
Station Subsystem Management Application Part (BSSMAP). Both parts are borne
over the SCCP protocol. The underlying signaling transport protocol is TDM based
MTP.
2-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
According to different message functions and handling modes, BSSAP messages are
classified into DTAP messages and BSSMAP messages.
I. DTAP Messages
DTAP messages are divided into Mobility Management (MM) messages and Call
Control (CC) messages. DTAP messages are not interpreted by the BSSAP protocol.
Instead, DTAP messages are conveyed transparently.
2-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
BSSAP messages are encapsulated in the user data part of SCCP messages. The
message structure is shown in Figure 2-3.
I. Assignment
The purpose of the Assignment procedure is to ensure that the correct dedicated
radio resource can be allocated or reallocated to a MS that requires it. However, the
initial random access by the MS and “Immediate Assignment” to a DCCH is handled
by the BSS without reference to the MSC.
The Assignment procedure depends upon the MSC choosing the terrestrial resource
to be used. The MSC therefore needs to be informed of any terrestrial circuits that are
out of service at the BSS. This is performed by using a simple blocking/unblocking
procedure.
The purpose of the Resource Indication procedure is to inform the MSC of the
following information:
—— the amount of radio resource that is spare at the BSS and available for traffic
carrying purposes;
2-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
——the total amount of the accessible radio resource (that is, available for service or
currently assigned).
This cannot easily be derived from the traffic that the MSC is carrying. The MSC may
take these pieces of information into account for the external handover decision.
IV. Reset
The purpose of the Reset procedure is to initialize the BSS or MSC in the event of a
failure. For example, in the event of a failure at the BSS which has resulted in the loss
of transaction reference information, a RESET message is sent to the MSC. This
message is used by the MSC to release affected calls and erase all affected
references, and to put all circuits to the idle state.
In case of a failure at a part of the MSC or BSS, the Clearing procedure can be used
to erase the affected parts.
V. Handover Required
Due to the following reasons, the BSS will send a HANDOVER REQUIRED message
to the MSC to implement handover for a MS with the assigned dedicated resource:
——The MSC has initiates a Handover Candidate Enquiry procedure, and this MS is
currently awaiting the handover.
——A cell change is required at call setup due to congestion, for example, directed
retry.
——All communication is lost with the MS, and the transaction is abandoned, or
The Handover Resource Allocation procedure enables the MSC to request resources
from a BSS according to the handover requirements. The target BSS will reserve the
resource and awaits access of a MS on the reserved channel.
2-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
If a resource release is required because of a BSS generated reason, the BSS shall
generate a CLEAR REQUEST message to inform the MSC to initiate the Release
procedure, so as to release the terrestrial and radio resources associated with MSC
and BSS.
IX. Paging
PAGING messages for all MSs are sent through the BSSMAP as a connectionless
message. When the BSS receives a radio interface PAGING RESPONSE message,
a SCCP connection is set up towards the MSC. The PAGING RESPONSE message
is taken in a COMPLETE LAYER 3 message of BSSMAP and is carried to the MSC
through the signaling connection.
X. Flow Control
The flow control is adopted to prevent entities from entering unstable status due to
overload. The flow control on the A interface is implemented by controlling traffic at
the traffic source. 15-level flow control is provided. Flow control can be executed
according to user levels.
The purpose of the Classmark Updating procedure is to inform the receiving entity
about classmark information received from the MS. In normal conditions, the BSS
receives the classmark information from the MS and then informs the MSC. Another
possibility is that the MSC sends to the new BSS the corresponding MS classmark
information through the A interface after the handover is completed.
2-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 BSSAP
The Cipher Mode Control procedure allows the MSC to pass cipher mode control
information to the BSS to select and load the user device and signaling encryption
device with the appropriate key.
The purpose of the Queuing Indication procedure is to inform the MSC about a delay
in the allocation of the necessary dedicated radio resources by the BSS. The
procedure is only relevant if the system is using a queuing procedure for traffic
channels in the BSS and for handover of traffic channels.
The purpose of the Load Indication procedure is to inform all adjacent BSSs about
the traffic of a cell so that a global control can be imposed on traffic handover in a
MSC. During some effective time segment, the traffic of the close cell shall be taken
into account for handover between adjacent BSSs.
2-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
Chapter 3 MAP
3.1 Overview
Mobile Application Part (MAP) defines how information is exchanged between mobile
system communication network entities for the purpose of achieving Mobile Station
(MS) roaming function. Concerned network entities include Mobile Service Switching
Center Server (MSC Server), Visitor Location Register (VLR), Serving GPRS Support
Node (SGSN), Home Location Register (HLR), Short Message Center (SMC) and
Gateway Mobile Location Center (GMLC). In the UMTS network, C, D, E, G, Lg or L
interface can be used to convey MAP messages, thus all of them are called MAP
interface.
I. C Interface
The C interface is the interface between a MSC Server and a HLR. On this interface,
the MSC Server uses the MAP protocol of SS7 to carry signaling. The MSC Server
implements the following functions:
In a Mobile Terminated Call (MTC), the MSC/GMSC Server gets the routing
information from the HLR through the C interface. The HLR provisions through
the C interface to the MSC/GMSC Server the routing information and subscriber
management information (including subscriber status, subscriber location, and
subscription information.).
Short message service (mobile terminated short message getting routing
information process).
For CAMEL applications, this interface is used to get routing information,
subscriber status, and subscription information when a mobile subscriber
terminates the call.
Note:
MSOFTX3000 and HLR9820 support MAP Phase1, MAP Phase2 and MAP Phase3, and allows network
carriers to select specifications for different phases according to the functional requirements.
3-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
II. D Interface
The D interface is the interface between a VLR and a HLR. This interface is used to
exchange mobile station location information and subscriber management information
between the HLR and the VLR. On this interface, the VLR uses the MAP protocol of
SS7 to carry signaling, and supports the following functions:
Getting authentication information
Location updating
Provisioning mobile terminated roaming number
Supplementary services
VLR restoration
Subscriber data management function
For the purpose of ensuring that a mobile subscriber can establish and accept calls in
the whole serving area, data exchange between the VLR and the HLR is required.
For instance, the VLR has to notify the HLR of information about the current location
of the subscriber; the HLR has to send to the VLR all service data pertaining to the
subscriber. If the subscriber resident VLR area is already changed, the HLR also has
to delete the location information and service data pertaining to the mobile subscriber
in the previous roaming VLR. In addition, modification requests (for example,
supplementary service operations) concerning used services by the subscriber and
modifications in subscriber data by the carrier shall be exchanged through the D
interface.
III. E Interface
The MAP interface between two MSC Servers and the MAP interface between a MSC
Server and a SMC are defined as the E interfaces. Signaling interworking is achieved
by the MAP protocol of SS7. The MAP protocol mainly implements the following
functions:
Handover
Short message service
MAP controls handover between two MSC Servers in adjacent areas. When a mobile
station in a call is moving from an area controlled by a MSC Server to the area
controlled by another MSC Server, the handover operation must be started and
implemented between the MSC Servers for the purpose of not breaking the
communication.
IV. G Interface
3-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
When a mobile subscriber roams to a new VLR controlled area, the current VLR gets
IMSI and authentication set information from the previous VLR (if the authentication
set is still in use).
V. Lg Interface
The Lg interface is located between a MSC Server and a GMLC. The interface is
used to support Location Services (LCS) functions. Signaling interworking is achieved
by the MAP protocol of SS7. The functions realized through this interface include:
The GMLC initiates a location request message of the target subscriber to the
MSC Server currently in service.
The MSC Server returns to the GMLC the outcome of the location request.
The MSC Server reports to the GMLC the location information of the target
subscriber.
Note:
Both MSC Server and VLR are integrated in MSOFTX3000 entity. Accordingly, the B interface becomes
an internal interface, the C and D interfaces can use the same physical connection, and the E and G
interfaces can use the same physical connection.
VI. L Interface
The L interface is the MAP interface between a SSP and a SCP. The interface is used
for supplementary service invocation reports.
In CSCN, the MAP message handling module is strictly 3GPP TS 29.002 V3.9.0
(2001-06) specification compliant. The module provisions all basic functions defined
in 3GPP TS 29.002, including:
Version negotiation function;
Mobility management, supporting the management on the mobility of both 2G
and 3G subscribers, and supporting to notify the Service Control Point (SCP)
function of mobility events;
Subscription data management, including management on ordinary service
subscription data, LCS and CAMEL subscription data;
Error recovery, including data restoration and HLR restart announcement;
Security management, including authentication, encryption and consistency
check, and TMSI reallocation;
3-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
Call handling, including access of calling & called subscribers, obtaining routing
information and providing roaming number;
Handover control, including intra-office handover inside the UMTS system, and
intra-office handover between UMTS and GSM systems;
Supplementary services, including call related and call independent
supplementary services, and notifying the SCP function of supplementary
service events;
Short message, including mobile originated and mobile terminated short
messages, and short message intelligent trigger function;
Location service, including mobile originated and mobile terminated location,
emergency call location and operation and maintenance location.
HLR
MAP
C/D
L
SCP
E/G
MSC Server/VLR Lg
MSC Server
(MSOFTX3000)
GMLC
SMC
MSOFTX3000 and HLR9820 provide two ways to transfer the MAP protocol: TDM
based and IP based. The TDM based way is to make use of the services provided by
the MTP for information transfer; the IP based way is to make use of the services
provided by the SIGTRAN protocol for transmission. The protocol stack is shown in
Figure 3-2
C, D, E, G, Lg, and L MAP interfaces all follow this protocol stack structure.
3-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
C/D/E/ C/D/E/
G/Lg/L G/Lg/L
TCAP TCAP
TCAP TCAP
SCCP SCCP
SCCP SCCP
M3UA M3UA
MTP3 MTP3
SCTP SCTP
MTP2 MTP2
IP IP
In the Signaling System No.7, MAP messages are transported as TCAP message
component part. Codes of MAP messages use the ASN.1 format. The position in a
link message is shown in Figure 3-3.
There is a one-to-one relationship between the types of MAP messages and the
operation codes in TCAP component. In the message transfer process, allocation of
an Invoke ID is required by each initiated operation. The Invoke ID is uniquely used to
identify an operation in the MAP dialog process. By distinguishing the operation code,
a component can be "translated" to a corresponding MAP message. Message
translation between MAP and TCAP is made by MAP PM.
3-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
Operati
on Operation name Purpose
code
Used by VLR to initiate the location update procedure to
0x02 UpdateLocation HLR in case of inter-VLR location update or subscriber data
unconfirmed by HLR.
Used by HLR to delete the subscriber data of the previous
VLR in location update, or independent location deletion
0x03 CancelLocation
caused by subscriber data modification, or deletion of
subscriber location information by operator.
Used by HLR to get the roaming number from VMSC
0x04 ProvideRoamingNumber Server, so that GMSC Server can address the call to the
present location of the called subscriber to set up the call.
Used by HLR to insert in VLR the subscription data during
0x07 insertSubscriberData location update, and independently insert subscriber data
during subscriber data modifications.
Used by HLR to independently delete the subscription data
0x08 deleteSubscriberData
in VLR when the operator deletes subscriber data.
Phase1 operation used to get the identity & authentication
set of the subscriber from the previous VLR, to get
0x09 sendParameters
authentication set from HLR and for Phase1 data restoration
request & inserting subscriber data.
3-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
Operati
on Operation name Purpose
code
Used by GMSC Server to get the subscriber location
0x16 sendRoutingInformation information from HLR, including roaming number and
forwarded-to number, when the subscriber is called.
0x1C performHandover Used for the Phase1 handover request.
0x1D sendEndSignal Used for handover termination.
PerformSubsequentHand
0x1E Used for the Phase1 subsequent handover request.
ov-er
3-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
Operati
on Operation name Purpose
code
Used by HLR to get the subscriber location information and
0x46 provideSubscriberInfo
status information data from VLR.
Used to report to SCP the supplementary service
0x48 SsInvocationNotification invocation event when CD, ECT, MPTY
supplementary services are invoked.
Used for mobile terminating location request.
ProvideSubscriberLocatio GMLC initiates the location request to MSC
0x53
n Server, and MSC Server responds to GMLC with
the location outcome.
Used to request HLR for routing information
0x55 sendRoutingInfoForLCS when GMLC initiates the mobile terminating
location request.
Used for emergency call or mobile originating
0x56 SubscriberLocationReport location request, and MSC Server reports to
GMLC the location outcome information.
Used to report the event to SCP when normal
location update, IMSI attach, IMSI detach, and
0x59 NoteMMEvent
combined location update are done at the
subscriber.
The location updating procedure and the routing information procedure are the most
basic procedures supported by MAP for inter-network roaming of mobile subscribers.
Other procedures include supplementary service handling, short message, handover
handling, authentication, and so on. In the following section, MAP signaling
procedures are illustrated by two typical examples.
Upon reception of the location updating request message, the VLR judges the
location area. If the updating is not in the same VLR location area, a location updating
request is sent to the HLR. When the HLR returns an acknowledgement message to
the VLR, the HLR number is attached. The location updating procedure may involve
the procedures of getting subscriber identity from the Previous VLR (PVLR), getting
authentication information from HLR, location deletion procedure, and inserting
subscriber data procedure.
1) If the MSC Server/VLR receives a location updating request initiated by the
subscriber using TMSI, and the previous location area information contained in
the location updating request message indicates a location area of an adjacent
3-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
VLR, then the VLR initiates the procedures of getting subscriber IMSI and
authentication information from the PVLR.
2) The MSC Server/VLR receives the location updating request from the subscriber.
If authentication made on data configurations is required but there is not an
available authentication set, the MSC Server/VLR will initiate the request for
getting authentication information to the HLR.
3) After the HLR receives the location updating request from the MSC Server/VLR,
the HLR finds that the subscriber roaming-to MSC/VLR number is changed. In
this case, the HLR will initiate the location deletion procedure to the PVLR to
remove the subscriber information in the PVLR.
4) The HLR sends subscriber data to the VLR.
The procedures of getting subscriber identity and authentication information from
PVLR, getting authentication information from HLR, location deletion in PVLR,
inserting subscriber data and D-interface location updating are all relatively
independent. They co-ordinate each other to complete the location updating
procedure of the subscriber to HLR. D-interface location updating and inserting
subscriber data procedures are necessary, while the other three procedures are
triggered only when conditions are met.
MSC Server
UE UTRAN HLR
/VLR
PVLR
A_LU_REQUEST
MAP_SEND_IDENTIFICATION
MAP_SEND_IDENTIFICATION
ack
MAP_UPDATE_LOCATION
MAP_CANCEL_LOCATION
MAP_CANCEL_LOCATION
ack
MAP_INSERT_SUBSCRIBER_DATA
MAP_INSERT_SUBSCRIBER_DATA ack
MAP_UPDATE_LOCATION ack
A_LU_CONFIRM
3-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 MAP
The SRI procedure requires the co-ordination of the roaming number assignment.
When the HLR receives the request for SRI from the GMSC Server, the forwarded-to
number or absent subscriber message is returned if the subscriber is in the inactive
status; otherwise the request for roaming number is initiated to the subscriber
roaming-to VLR, and a corresponding response is sent to the GMSC Server
according to the returned outcome from the VLR.
IAM
MAP_SEND_ROUTING_
INFORMATION
MAP_PROVIDE_SUBSCRIBER_
INFORMATION
MAP_PROVIDE_SUBSCRIBER_
INFORMATION ack
MAP_SEND_ROUTING_
INFORMATION ack
MAP_SEND_ROUTING_
INFORMATION
MAP_PROVIDE_ROAMING_
NUMBER
MAP_PROVIDE_ROAMING_
NUMBER ack
MAP_SEND_ROUTING_
INFORMATION ack
3-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Chapter 4 H.248/MEGACO
4.1 Overview
H.248/MEGACO has been jointly developed within the ITU-T and the IETF. It is named
H.248 by the ITU-T and MEGACO by the IETF. Hereinafter, both are called H.248 in
this manual.
The Mc interface is the standard interface between the MSC Server (GMSC Server)
and the MGW. It is H.248 protocol compliant. Aiming at special requirements of 3GPP,
H.248 extended Transaction and Package are defined. The Mc interface is an
additional interface for 3GPP R4. The physical interface mode may be ATM or IP.
The Mc interface provides the capabilities of the static and dynamic resources for the
MSC Server (GMSC Server) controlling the various transmission modes (IP/ATM/TDM)
in the MGW in the call processing procedure, such as terminal property, terminal
connection switching relationship, MGW borne media streams. The Mc interface also
provides the call independent MGW status maintenance and management capability.
The H.248 protocol is utilized on the interface between MSOFTX3000 and UMG8900,
namely Mc interface defined in UMTS. See Figure 4-1.
4-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Nc
H.248 H.248
Mc Mc
MWG MWG
(UMG8900) (UMG8900)
As shown in Figure 4-2, the H.248 protocol is applied to the Mc interface. Protocol
transmission may be based on IP (figure a) or based on ATM (figure b). IP based
transmission is typically used due to the current networking architecture.
Mc Mc
(G)MSC Server MGW (G)MSC Server MGW
H.248 H.248
H.248 H.248
MTP3B MTP3B
SCTP SCTP STC STC
IP IP SAAL SAAL
AAL5 AAL5
MAC MAC
ATM ATM
L1 L1 PL PL
4-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
4.2.1 Overview
I. Basic Concepts
Media Gateway (MG): The media gateway converts media provided in one type of
network to the format required in another type of network. For example, a MG
could terminate bearer channels from a switched circuit network (for example,,
PCM) and media streams from a packet network (for example,, media streams in
an IP network). This gateway may be capable of processing audio, video and data
alone, and will be capable of full duplex media translations. The MG may also play
some audio/video signals and perform a number of interactive voice response
(IVR) functions, or may perform media conferencing.
Media Gateway Controller (MGC): Controls the parts of the call state that pertain
to connection control for media channels in a MG.
Multipoint Control Unit: An entity that controls the setup and coordination of a
multi-user conference that typically includes processing of audio, video and data.
Stream: Bidirectional media or control flow received/sent by a media gateway as
part of a call or conference.
The connection model for the protocol describes the logical entities, or objects, within
the Media Gateway that can be controlled by the Media Gateway Controller. The main
abstractions used in the connection model are Terminations and Contexts. Figure 4-3
illustrates the connection model:
Media Gateway
Context
Context Termination
SCN Bearer Channel
Termination
RTP Stream
* Termination
SCN Bearer Channel
Context
Termination Termination
RTP Stream
* SCN Bearer Channel
4-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
In the connection model defined by the H.248/MEGACO, two entities, namely Context
and Termination, are included. A Context shall contain one or more Terminations;
otherwise, the Context will be deleted. A Termination shall exist in only one Context at a
single time point.
1) Context
A Context is an association between a number of Terminations. The Context describes
the topology and the media mixing/switching parameters if more than two Terminations
are involved in the association.
There is a special Context called the null Context. It contains Terminations that
Terminations that are not associated to any other Termination. Terminations in the null
Context can have their parameters examined or modified, and may have events
detected on them.
Topology: The topology of a Context describes the flow of media between the
Terminations within a Context. In contrast, the mode of a Termination describes
the flow of the media at the ingress/egress of the media gateway.
Priority: The priority is used for a Context in order to provide the MG with
information about a certain precedence handling for a Context. The value range is
0~15. The less the value is, the higher the priority is.
Emergency indicator: An indicator for an emergency call is also provided to allow a
preference handling in the MG.
2) Termination
A Termination is a logical entity on a MG that sources and/or sinks media and/or control
streams. A Termination is described by a number of characterizing properties, which
are grouped in a set of descriptors that are included in commands. Terminations have
unique identifies (TerminationIDs), assigned by the MG at the time of their creation.
4-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Usually Terminations are grouped into two classes: semi-permanent Terminations and
ephemeral Terminations. Terminations representing physical entities have a
semi-permanent existence. For example, a Termination representing a TDM channel
might exist for as long as it is provisioned in the gateway. Only if the configuration
information is deleted, the corresponding Termination disappears. Ephemeral
Terminations represent ephemeral information flows, such as RTP flows, would usually
exist only for the duration of their use. Ephemeral Terminations are created by means
of an Add command. They are destroyed by means of a Subtract command. In contrast,
when a physical Termination is added to or subtracted from a Context, it is taken from or
to the null Context, respectively.
Termination dynamics: The protocol can be used to create new Terminations and
to modify the property values of existing Terminations.
TerminationIDs: Terminations are referenced by a TerminationID, which is an
arbitrary schema by the MG. A wildcarding mechanism using two types of
wildcards can be used with TerminationsIDs. The two wildcards are ALL and
CHOOSE.
Packages: Different types of gateways may implement Terminations that have
widely differing characteristics. In order to achieve MG/MGC interoperability,
optional properties of the Termination are grouped into Packages, and a
Termination realizes a set of such Packages.
Termination properties and descriptors: Terminations have properties. The
properties have unique PropertyID.
ROOT Termination: The ROOT Termination is typically used to refer to the entire
gateway. Packages may be defined on ROOT. Root thus may have properties,
events, signals, statistics and parameters. The ROOT Termination may appear in
a Modify, Notify, AuditValue, AuditCapability and ServiceChange commands. Any
other use of the ROOT TerminationID is an error.
Commands: The protocol provides commands for manipulating the logical entities
of the connection model, Contexts and Terminations. Most commands are for the
specific use of the Media Gateway Controller as command initiator in controlling
Media Gateways as command responders. The exceptions are the Notify and
ServiceChange commands: Notify is sent from Media Gateway to Media Gateway
Controller, and ServiceChange may be sent by either entity. For the meanings of
the commands, please reference the following section about command
explanation.
Descriptors: The parameters to a command are termed Descriptors. A Descriptor
consists of a name and a list of items. Descriptors may be returned in the response
as output from a command. In any such return of descriptor contents, an empty
descriptor is represented by its name unaccompanied by any list.
4-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Megaco/H.248 message
Ctx ....
Ctx Hdr Command Command
Properties
A message contains multiple transactions that have nothing to do with each other and
can be handled separately; a transaction is composed of several actions and actions
correspond to Contexts; an action constitutes a series of commands restricted by a
Context. In this way, H.248 message mechanism is shown in Figure 4-5.
4-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
H.248 message
Transaction1
ContextID1
Command1
Des-1 Des-n
Commandn
ContextIDn
TransactionIDn
I. Message
Information units transmitted or accepted by the H.248 protocol are called messages. A
message begins with the Header followed by several transactions.
The message Header contains the Message Identifier (MID) and the Version Number:
The MID identifies the message sender, and may be set to a provisioned name
(for example, domain address/domain name/device name). Domain name is a
suggested default.
The Version Number identifies the version of the protocol the message conforms
to. Versions consist of one or two digits, beginning with version 1 for the present
version of the protocol.
The transactions in a message are treated independently. There is no order implied.
II. Transaction
Commands between the Media Gateway Controller and the Media Gateway are
grouped into Transactions, each of which is identified by a TransactionID. Transactions
consist of one or more Actions. An Action consists of a series of Commands that are
limited to operating within a single Context.
TransHdr is followed by the Actions of the Transaction. The Actions must be executed
in order. At the first failing command in an Action, processing of the remaining
commands in that Transaction stops except Optional Command. Transactions
4-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Transactions include requests and responses, and responses are divided into two
types: TransactionReply and TransactionPending.
TransactionRequest
Each TransactionRequest requests to activate one Transaction. One Transaction
contains one or more Actions and each Action includes one or more commands related
to one single Context.
TransactionRequest(TransactionId {
ContextID {Command ... Command},
...
ContextID {Command ... Command } })
TransactionReply
TransactionReply is a response of the Transaction receiver to the TransactionRequest,
indicating that the receiver completes the executing of the TransactionRequest
command. Every transaction should have its Reply. The following cases indicate the
completion of the executing of a TransactionRequest:
1) All the commands in the TransactionRequest are successfully executed;
2) A non-optional command in the TransactionRequest fails to be executed.
The structure of TransactionReply is as follows:
TransactionReply(TransactionID {
ContextID { Response ...Response },
...
ContextID { Response ...Response } })
TransactionPending
The receiver invokes the TransactionPending. A TransactionPending indicates that the
Transaction is actively being processed, but has not been completed. It is used to
prevent the sender from assuming the TransactionRequest was lost where the
transaction will take some time to complete.
4-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
TransactionPending (TransactionID { } )
Transaction Description
4-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Transaction Description
Isolate Bearer To isolate one Termination from its media flow relation with other
Termination Terminations, so that it has no media flow relation with any Termination.
Join Bearer Termination To add a Termination in an existing CONTEXT.
To establish bearer between MGWs. This operation includes applying for a
Establish Bearer
Termination resource and establishing the bearer to the destination MGW.
To apply for Termination resource from MGW. This is an operation prior to
Prepare Bearer
bearer. It may result in the generation of a new CONTEXT.
Activate Interworking
To activate the IWF on an MGW.
Function
To release bearer between MGWs. This operation does not release the
Release Bearer
Termination resource.
Release Termination To release Termination resource.
Bearer release completion event reported by MGW. This event is
Bearer Released
requested by the MGC.
Bearer establishment completion event reported by MGW. This event is
Bearer Established
requested by the MGC.
Send-tone operation. During a call, the MGC can request the Termination
Send Tone to send a certain tone to a certain direction, such as ring-back tone, busy
tone, and so on.
Play Announcement To play announcement in intelligent or supplementary services, and so on.
Send DTMF To send DTMF tone.
Detect DTMF To request MGW to detect DTMF tones.
Report DTMF MGW reports to the MGC about the completion of DTMF tone detection.
Announcement
Announcement playing completion message reported by MGW.
Completed
Activate Voice
To activate the voice processing function, including EC, Reserve Circuit.
Processing Function
MGW reports IPBCP frame to MGC, and the MGC sends it to the peer
Tunnel Information Up
MGW by means of tunnel.
Tunnel Information
MGC sends the IPBCP message from another MGC to MGW.
Down
4-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Transaction Description
III. Action
Actions are related to Contexts. An action consists of a series of commands that are
limited to operate within one Context. Actions are identified by a ContextID. In an action,
commands should be processed in order.
An action begins with the Context header (CtxHdr) in which ContextID is contained for
identifying the Context this action corresponds to. ContextID is assigned by the MG and
is unique within the scope of the MG. The MGC shall use the ContextID in all
subsequent transactions relating that Context.
CtxHdr is followed by several commands, and these commands are related to the
Context identified by the ContextID.
Commands are the major contents in an H.248 message. They control the Context and
Termination attributes including to specify the event reported by the Termination what
signals and actions can be imposed on the Termination, as well as specifying the
topology structure of the Context. A command is composed of the command header
(CMDHdr) and command parameters. In H.248 protocol, command parameters are
grouped into “Descriptors”.
H.248 protocol defines eight commands, all of which are sent to MG by MGC
except the command “Notify”, which is sent to MGC by MG. The command
4-11
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Sending
Command Meaning
direction
V. Descriptor
DescriptorName=<someID>
{ parm = value, parm = value ...... }
4-12
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Localcontrol Contains properties that are of interest between the MGC and the MG.
Events A list of events that the MG is requested to detect and report.
A list of events, with their parameters if any, that the MG is requested to detect
EventBuffer
and buffer when EventBufferControl equals LockStep.
Describes signals and/or actions to be applied (for example, ringback tone) to
Signals
the Terminations.
Audit Specifies what information is to be audited.
ServiceChange In ServiceChange, what, why service change occurred, and so on.
A dialing plan resident in the MG used for detecting and reporting digit events
DigitMap
received on a Termination.
Statistics In Subtract and Audit, Report of Statistics kept on a Termination.
Packages A AuditValue, returns a list of packages realized by Termination.
ObservedEvents In Notify or AuditValue, report of events observed.
Specifies flow directions between Terminations in a Context, and applies to a
Topology
Context instead of a Termination.
The following part uses an example to illustrate a typical implementation of the H.248
protocol. The diagrams of the call procedure abstractly display the interaction between
a media gateway and the media gateway controller instead of taking issues like time
graduation into account.
The example is about a call set up between two residential gateways. User A and User
B are respectively connected to two residential gateways RGW1 and RGW2, and the
4-13
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
gateways are under the control of the same media gateway controller. The example
only describes a successful call, and it is assumed that the gateways have registered
on the media gateway controller.
The procedure is divided into two processes, namely call setup process and call
backout process.
4-14
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
Nodify Resp
Modify SG:dialtone
ED:al/on,dd/ce{Dmap1}
DM:Dmap1 = 2XXX
Dial Tone
Modify Resp
UserA dials
digits
Notify digits
Nodify Resp
UserB Phone
Ringing
Add Resp TermB
Add Resp EphB Local SDP
(Specified)
UserB Goes
Offhook
Notify offhook
Nodify Resp
Modify TermA SendRecv
Modify EphA Remote(Specified) SendRecv
Modify Resp
Modify TermB SendRecv
Modify EphB SendRecv
Modify Resp
RTP MEDIA
4-15
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
1) MGC sends a Modify message to both gateways to detect the offhook event on the
terminations.
2) It is assumed that User A hooks off first. After RGW1 detects the event, it sends to
MGC a Notify message in which the corresponding event information and
detected timestamp are contained. MGC returns a response message.
3) MGC sends a Modify command to RGW1, indicating to RGW1 to send dial tone to
User A. RGW sends dial tone to the user and meanwhile returns a response
message.
4) User A hears the dial tone and begins to dial.
5) MGC receives the Notify message from RGW1 and begins to analyze the digits. It
is assumed that the called party is connected to RGW2 which is managed by the
same MGC. MGC creates a new context for RGW1 and adds a physical
termination TermA in it. If User B is idle, ringback tone is sent to User A. At the
same time, an ephemeral termination is created and then added in the preceding
context. The connection domain IP address and the media domain port number of
the ephemeral termination are not specified. RGW1 creates a context whose ID is
1. The physical termination TermA is added in the context. Meanwhile, an
ephemeral termination EphA is created and its IP address and port number are
assigned. Then, RGW1 returns a corresponding response in which the IP address
and the port number used are indicated.
6) MGC sends a similar transaction to RGW2. RGW2 creates a context whose ID is 2,
then it adds the physical termination TermB in the context; meanwhile, RGW2
creates an ephemeral termination EphB and returns a response message.
7) User B hooks off. RGW2 uses a Notify command requesting to report this event to
MGC. MGC also returns a Notify response.
8) MGC sends to RGW1 a message to stop sending ringback tone to User A, and
sets the remote SDP information of EphA. The mode of both terminations is
modified to SendRecv (previously both created as RecvOnly mode). RGW1
returns a response message indicating the success of the operation.
9) MGC sends a transaction to RGW2, indicating to stop ringing tone on TermB. After
the completion of the processing, RGW2 returns a response.
10) The users can have a conversation. Once the call is terminated by either party, the
other party will hear busy tone.
4-16
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
UserA Goes
OnHook
Notify OnHook
Nodify Resp
Modify TermB SD:BusyTone
BusyTone To
UserB
Modify Resp
Subtract TermA
Subtract EphA
UserB Goes
Onhook
Notify OnHook
Nodify Resp
Subtract TermB
Subtract EphB
1) It is assumed that the calling party User A will terminate the call. RGW1 sends a
Notify message to MGC to report this event. MGC returns a response message of
the Notify command.
2) MGC generates a Modify command, indicating to RGW2 to play busy tone to User
B. The mode of both terminations is set to RecvOnly. RGW2 returns a response
indicating the success of the operation.
3) MGC directs RGW1 to remove both terminations from the context 1 and return the
statistics information of the ephemeral termination as the response.
4) User B hears busy tone and then hooks on. RGW2 reports a Notify message to
MGC. MGC returns a corresponding response message.
4-17
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 H.248/MEGACO
5) The gateway sends a Subtract command to delete TermB and EphB from the
context 2. RGW2 also deletes the terminations from the context 2 and then returns
a response in which the statistics information of the ephemeral termination is
contained. Here, a call procedure ends. The terminations return to the initial status
and await a new call.
4-18
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Chapter 5 BICC
5.1 Overview
The Bearer Independent Call Control (BICC) protocol is one of the application layer
control protocols. It is used to establish, modify and terminate calls and can bear
comprehensive PLMN/PSTN/ISDN services.
BICC evolves from the ISUP protocol and has it developed. It is characterized by the
separation between the call control level and the bearer control level, thus the Call
Service Function (CSF) is independent of the Bearer Control Function (BCF).
In UMTS, BICC is applied to the call control interface between two MSC Servers.
The Nc interface provides the UMTS CS domain service with the inter-office call control
capability which is independent of user-level bearer technology and control-level
signaling transport technology used, thus achieving the interworking between
networks.
When MSOFTX3000 acts as a MSC Server (or GMSC Server), the BICC protocol is
used for interworking between MSOFTX3000 and other MSC Server, as shown in
Figure 5-1.
5-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Nc
Mc Mc
Nb
MWG MWG
The BICC protocol is defined to use any transport networks for signaling transport,
such as IP, ATM, TDM networks. According to implementation requirements,
MSOFTX3000 can use four transport modes: TDM based MTP3, IP based M3UA or
SCTP, and ATM based MTP3b. See Figure 5-2.
Nc Nc
(G)MSC Server MSC Server (G)MSC Server MSC Server
M3UA M3UA
MTP3 MTP3
SCTP SCTP
MTP2 MTP2 IP IP
MAC MAC
MTP1 MTP1
L1 L1
Nc Nc
(G)MSC Server MSC Server (G)MSC Server MSC Server
BICC BICC
BICC BICC
MTP3B MTP3B
SCTP SCTP STC STC
IP IP SAAL SAAL
AAL5 AAL5
MAC MAC
ATM ATM
L1 L1 PL PL
5-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
BICC signaling develops on the basis of ISUP signaling, and is basically similar to the
ISUP protocol in the aspect of supporting basic call procedures and supplementary
service features. The additional Application Transport Mechanism (APM) in BICC
makes it possible to exchange bearer related information between the call control
nodes at the ends of the Nc interface. Such information includes bearer address,
connection reference, bearer characteristics, bearer setup mode and supported Codec
list, and so on. BICC can also provide an optional tunnel transport function on the Nc
interface for the bearer control signaling between MGWs.
The BICC protocol utilizes the idea of separation between call signaling function and
bearer signaling function, defines a new call control signaling protocol used in a
backbone network, thus can control a variety of networks including SS7, ATM and IP
networks. The call control protocol is based on N-ISUP signaling. It continues to use
related message in ISUP and utilizes APM to convey BICC specific bearer control
information. Therefore, it can bear comprehensive PSTN/ISDN services. The
separation between call and bearer makes the interworking between services provided
by networks of different bearer types simple. What is required is to implement
interworking on bearer level. It is unnecessary to make any modifications on services.
I. Terminology
The BICC protocol defines some new terminologies. A brief introduction is shown in
Table 5-1.
Abbrevi
Full name Description
ation
Represents the edge to edge transport connection
within the backbone network, consisting of one or more
BNC Backbone Network Connection Backbone Network Connection Links (BNCL). The
Backbone Network Connection represents a segment
of the end to end Network Bearer Connection (NBC).
Represents the transport facility between two adjacent
Backbone Network Connection
BNCL backbone network entities containing a bearer control
Link
function.
5-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Abbrevi
Full name Description
ation
5-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Abbrevi
Full name Description
ation
5-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Abbrevi
Full name Description
ation
5-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
BICC is characterized by separation of call control and bearer control layers. The
separation enables the BICC specification to concentrate on handling of Call Service
Functions instead of taking specific bearer control into account, as shown in Figure 5-3.
Such layered and independent architecture is fully consistent with strcuturization and
componentization design idea of a packet network.
Main scope
of the BICC
specification
Bearer
As shown in Figure 5-4, the three-layer architecture of BICC is very clear: BICC
signaling is used between CSFs; bearer control signaling (for example, Q.AAL2) is
used between BCFs; transport of media streams (bearer streams) has nothing to do
with BICC.
BICC
BAT APM signaling APM BAT BAT APM
ASE ASE BICC BICC ASE ASE ASE ASE BICC
ASE ASE ASE
ISUP CC CC
Bearer
control
signaling
BCF BCF BCF
Bearer
streams
Bear Bear Bear
Figure 5-5 shows the generic protocol model defined by the BICC protocol.
5-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
BICC procedures
Signaling
Transport Mapping
Converter Function
Signaling
Transport Bearer
Layers Control
call control
bearer control
protocol
protocol
The protocol model of BICC regards process of the BICC protocol itself as a “black box”.
It has two interface to the BICC core network:
Signaling transport interface: This interface is used to package BICC messages in
signaling transport layer messages for interaction between BICC entities.
Bearer control interface: This interface is used for control and query of bearers.
BICC protocol model implies this idea: In order to make BICC thoroughly independent
of any other parts of its interfaces (signaling transport or bearer), BICC uses a
converter for interface unification at the signaling transport interface point and the
bearer control interface point.
From the point of view of BICC process, it provides only one set of abstracted operation
primitives externally. Then, by a “converting/mapping” component, primitive conversion
with the specific part (signaling transport or bearer) is achieved:
At the signaling transport interface point, Signaling Transport Converter (STC) is
used to convert signaling transport primitives of BICC with specific Signaling
Transport Layers (STLs), such as with MTP3, MTP3B, SCTP, M3UA.
At the bearer control interface point, the Bearer Mapping Layer is used to convert
abstracted bearer control primitives of BICC with specific bearer control primitives,
such as with AAL1, AAL2, B-ISUP, IP, SS7-Bearer.
BICC protocol defines a call control signaling protocol used in a backbone network,
including SS7, ATM and IP networks. It can bear comprehensive PSTN/ISDN services.
Basic call signaling capability sets supported by BICC are shown in Table 5-2. Generic
signaling procedures, supplementary services and additional functions/services
supported by BICC are shown in Figure 5-4.
5-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Continuity indication √ √
Forward transfer - √
Simple segmentation √ √
Dual seizure √ √
Reset √ √
5-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Unequipped CIC √ -
Overlength messages √ √
Hard-to-Reach √ √
Note:
“√" indicates supported by ITU-T; “-” indicates not supported by ITU-T.
Multi rate connection types include 2X64, 384, 1536, and 1920kbit/s.
If BICC uses MTP3B to transport signaling, these functions are provided by STC. Reference Q.2150.1.
If BICC uses MTP3B to transport signaling, these processes are provided by STC. Reference
Q.2150.1.
Table 5-3 Generic signaling procedures, supplementary services and additional functions/services of
BICC
5-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Service activation √ √
Redirection √ -
Pivot routeing √ √
Bearer redirection √ √
Supplementary services
Direct-Dialling-In (DDI) √ √
Sub-addressing (SUB) √ √
5-11
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Additional functions/services
Support of VPN applications with PSS1
√ √
Information Flows
Note:
“√" indicates supported by ITU-T; “-” indicates not supported by ITU-T.
Only information about transit MLPP is supported.
Message format for BICC is basically same as that for ISUP except that the routing
label is absent and Call Identification Code is replaced by Call Instance Code.
5-12
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
Transmission sequence
Octet
8 7 6 5 4 3 2 1 Transmission sequence
Pointer to parameter M
Pointer to parameter P
Parameter P
Parameter name = X
Parameter X
Optional part
Parameter name = Z
Parameter Z
Call Instance Code (CIC) is a logic number associated with the inter-office calling
relation. It is used to identify which call instance this message corresponds to. From the
point of view of function, it is similar to Circuit Identification Code used in ISUP
messages except that it does not identify circuits and it is extended. The Call Instance
Code is extended to 32 bits (Circuit Identification Code has 12 bits), and thus the
number of inter-office call instances is up to 4,294,967,296 (232) theoretically.
5-13
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
The BICC message type code consists of a one-octet field and is mandatory for all
messages. The message type code uniquely defines the function and format of each
BICC message, as shown in Table 5-4. Code points marked as “ISUP only” in this table
are reserved in BICC.
5-14
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
5-15
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
0011 1001
Reserved to used in B-ISUP
0011 1101
BICC message parameter parts include mandatory fixed part, mandatory variable part
and optional part. Each message type has unique parameters.
Call procedures of the BICC protocol mainly include successful call setup procedures,
additional call setup procedures, mid-call procedures, normal release procedures, and
so on.
Bearer setup types lead to different call setup procedures. The main procedure types
are:
Normal modes of each call corresponding to one bearer setup procedure: BNC
forward establishment, without notification; BNC forward establishment,
notification; BNC backward establishment.
Tunnelling modes of each call corresponding to one bearer setup procedure:
per-call bearer setup using tunnelling – fast forward; per-call bearer setup using
tunnelling – delayed forward; per-call bearer setup using tunnelling – backward.
Modes of re-using idle bearer: use of idle BNC, established in the forward direction;
use of idle BNC, established in the backward direction.
In the case of using IP bearer, the current procedure for tunnelling forward setup mode
is shown in Figure 5-7:
5-16
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
IAM
IAM (Action = Connect Forward) , (BNC characteristics)
IAM (COT on previous), (Action = Connect Forward) ,
(BNC characteristics)
“AAA”
APM (Action = Connect Forward, plus notification)
APM (Action = Connect Forward plus notification)
COT
“BBB”
ACM
ACM
ACM ANM
ACM
ANM
ANM
ANM
5-17
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
IAM
IAM (Action = Connect Forward) , (BNC
characteristics), ( Codec list)
IAM (COT on previous), (Action = Connect Forward) ,
(BNC characteristics), (Codec list)
“AAA”
APM (Action = Connect Forward plus notification
APM (Action = Connect Forward, plus notification codec), (BNC-ID= z1), (BIWF Addr= z),
+ Selected
codec), (BNC-ID=y1), (BIWF Addr=y)
+ Selected (Selectedcodec), (Available codec list)
(Selectedcodec), (Availablecodec list)
Bearer Set-up req. (BNC-ID= z1), (BIWF- Addr= z)
Bearer Set-up req. (BNC-ID=y1), (BIWF- Addr=y)
Bearer-Set-up req
Bearer-Set-up req Bearer-Set-up req
Bearer-Set-up req
Bearer-Setup-Connect
Bearer-Setup-Connect
Bearer-Setup-Connect
Bearer-Setup-Connect Bearer-Setup-Connect
Bearer-Setup-Connect
APM (Action = Connected)
ACM
ACM
ACM ANM
ACM ANM
ANM
ANM
5-18
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
APM (Action = Modify to selected codec information), (Selected codec and/or Codec list)
Bearer Modify
Bearer Modify Bearer Modify
Bearer Modify Ack Optionally sent to modify
Bearer Modify Ack codec profile and/or allocate
additional bandwidth.
Bearer Modify Ack
APM (Action = Modify to selected codec information), (Selected codec and/or Codec list)
Bearer Modify
Bearer Modify
Bearer Modify
Optionally sent to modify
Bearer Modify Ack codec profile and/or allocate
Bearer Modify Ack additional bandwidth.
Bearer Modify Ack
According to different bearer setup types, there are the following release procedures:
forward call and bearer release, forward bearer setup; forward call and bearer release,
backward bearer setup; forward call release, bearers not released. See Figure 5-10.
5-19
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 BICC
REL
REL
REL
RLC
REL
RLC
RLC
RLC
Bearer release req.
Bearer release Ack. Bearer release req.
Bearer release req.
Bearer release req.
Bearer release Ack. Bearer release Ack. Bearer release req.
Bearer release Ack.
Bearer release req.
Bearer release Ack.
Bearer release Ack.
Figure 5-10 Forward call and bearer release, forward bearer setup mode
5-20
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
Chapter 6 BSSAP+
6.1 Overview
The Gs interface is the interface between a SGSN and a MSC Server/VLR, where a
number of signaling procedures defined by the BSSAP+ protocol implement message
interaction functions between them.
6-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
BSSAP+
Gs
SGSN MSOFTX3000
The Gs interface is based on MTP link or IP link physically, as shown in Figure 6-2.
The SGSN as a signaling point interconnects with the MSC/VLR across the SS7
network. BSSAP+ uses basic connectionless services (Class 0) of SCCP. According
to service requirements in the aspect of BSSAP+, SCCP and MTP functions have
been appropriately tailored (reference 3GPP TS 29.016 for more information).
M3UA M3UA
MTP3 MTP3
SCTP SCTP
MTP2 MTP2
IP IP
6-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
BSSAP+ signaling format is simple. All follow the “message type + message unit”
format. The message unit uses a simple Tag Length Value (TLV) format. BSSAP+
messages are relatively short and they are not more than 100 bytes.
The non-GPRS location update procedure causes location update at the MSC/VLR
side, and results in creation of the association between the SGSN and the MSC/VLR.
In addition, the TMSI reallocation function is also equipped. According to MAP data
configurations, the MSC/VLR determines whether or not to allocate a new TMSI to
the user. A combined location update takes advantage of saving radio interface
resources.
If IMSI detach from GPRS service happens at the SGSN side, the MS in the non
Gs-NULL state shall inform the MSC/VLR that the association should be cancelled.
The MS in the non Gs-NULL state initiates an explicit IMSI detach from GPRS service
in the following conditions:
1) The MS initiates IMSI detach from GPRS service.
2) A failure of routing area update at the SGSN side results in deletion of user data
done by the SGSN.
3) The HLR initiates to delete the user data.
4) The user data is deleted manually at the SGSN.
The IMSI detach from GPRS service type in the condition 1) is “MS initiated IMSI
detach from GPRS service”.
The IMSI detach from GPRS service type in the conditions 2) and 3) is “GPRS
services not allowed”.
6-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
The IMSI detach from GPRS service type in the condition 4) is “SGSN initiated IMSI
detach from GPRS service”.
The MS in the non Gs-NULL state initiates an explicit IMSI detach from non-GPRS
service in the following conditions:
1) The MS initiates IMSI detach.
2) The MS initiates GPRS/IMSI detach.
The IMSI detach type in the condition 1) is “explicit MS initiated IMSI detach from
non-GPRS service”.
The IMSI detach type in the condition 2) is “combined explicit MS initiated IMSI
detach from GPRS and non-GPRS services”.
For the conditions 1) and 2), the MSC/VLR cancels the user’s location. However at
the SGSN side, only the association is cancelled for the condition 1) and the location
is cancelled for the condition 2).
If the MS Reachable timer at the SGSN side expires, the MS in the non Gs-NULL
state shall inform the MSC/VLR to initiate an implicit IMSI detach. The MSC/VLR
detaches the user's IMSI service. The concerned IMSI detach type is “implicit IMSI
detach from GPRS and non-GPRS services”.
A MS in the non Gs-NULL state, or in the Gs-NULL state but with the "confirmed by
radio contact” flag set to FALSE, acts as the called party at the MSC/VLR side. The
circuit paging messages are sent to the SGSN through the Gs interface, and then the
messages are delivered to the MS through the Gb/Iu interface. The SGSN may be in
one of the following conditions:
1) The user is acknowledged, and the SGSN-Reset flag is FALSE:
The user is in the non Gs-NULL state, and the SGSN delivers paging messages
through the Gb/Iu interface;
The user is in the Gs-NULL state, and the SGSN sends a paging reject message
to the MSC/VLR with the cause as association cancellation;
The user’s PPF flag is FALSE, and the SGSN returns a paging unreachable
message to the MSC/VLR.
6-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
If the MSC/VLR has detected that the MS lost radio interface communication and
then regards the MS unreachable, the MSC/VLR shall initiate the non-GPRS service
alerting procedure to the SGSN. Upon reception of the non-GPRS service alerting
message, the SGSN sets the user’s NGAF flag. Later, if the SGSN finds the MS
becomes reachable, the SGSN shall send a message to the MSC/VLR to inform the
MSC/VLR about that.
If a MS is in the non Gs-NULL state, the MSC/VLR can initiate the MS information
request procedure to the associated SGSN, requesting the SGSN to provide the
user’s identity information and location information. If the SGSN fails to provision the
identity information, the SGSN shall initiate the identification request to the MS.
Upon reception of the request for provisioning location information from the MSC/VLR,
the SGSN does differently in case of a 2G user and 3G user:
1) In case of a 2G user, the SGSN returns the MS resident Cell Global Identification
(CGI) and the time record that the network has radio contact with the user lately.
2) In case of a 3G user, the SGSN returns the MS resident Serving Area
Identification (SAI) and the time record that the network has radio contact with
the user lately. If the user has Iu interface connection, the MS location
information saved in the SGSN may be incorrect (for example, handover may
take place at the user but the user’s location information in the SGSN may not
be updated immediately), the SGSN shall initiate the location reporting request
to the MS.
6-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 BSSAP+
If a MS is in the non Gs-NULL state, the MSC/VLR can initiate the MM information
request procedure to the associated SGSN. The SGSN sends the MM information
through the Gb/Iu interface and the GPRS broadcast channel. And when the user is
enjoying GPRS service, the message can be sent through the service channel. If the
user is unknown at the SGSN, the message is discarded by the SGSN.
After the OMC initiates the SGSN reset procedure at the background, the SGSN
notifies all associated MSC/VLRs that the confirmed by radio contact flag of the MS
saved in the VLR should be set to FALSE, and the association should be cancelled.
In addition, the SGSN-Reset flag should be set to TRUE. The SGSN-Reset flag
should be monitored by a timer, and the timer’s duration should be greater than the
duration of the MS Reachable timer. After the SGSN-Reset flag monitoring timer
expires, the SGSN-Reset flag is set to FALSE. SGSN reset will affect CS paging.
X. VLR Reset
After the VLR is reset, the VLR informs the SGSN to set the VLR-Reliable flag of all
users associated with the VLR to FALSE and to cancel the association. If the
VLR-Reliable flag of a MS is FALSE, the SGSN receives from the user the combined
Ra/La update (no matter La is changed) or the periodic Ra update. The SGSN shall
initiate the location update request to the MSC/VLR.
After the HLR reset, the “location information confirmed in HLR” flag of the MS at the
VLR side is FALSE. The location information of the MS in the HLR should be restored.
The SGSN performs the NGAF flag set.
6-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
Chapter 7 CAP
7.1 Overview
CAMEL Application Part (CAP) has evolved from the Intelligent Network Application
Protocol (INAP) of the wired Intelligent Network (IN). CAP enables signaling
interworking between GSM Service Switching Function (gsmSSF), GSM Specialized
Resource Function (gsmSRF) and GSM Service Control Function (gsmSCF) of radio
IN functional entities, for the purpose of supporting CAMEL services.
CAP protocol is one of the parts of the Signaling System No. 7. CAP is the user part
of the Transaction Capabilities Application Part (TCAP) in the SS7. CAP uses
structured/unstructured dialog capabilities provided by the TCAP protocol, and
realizes signaling interaction between functional entities.
gsmSCF CAP
CAP
MAP
CAP
gsmSSF VLR gsmSSF
MSC Server MSC Server
gsmSRF
7-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
CAP
CAP
MSC Server/SSP
SCP
(MSOFTX3000)
MSOFTX3000 provides two ways to transfer the CAP protocol: TDM based and IP
based. The TDM based way is to make use of the services provided by the MTP for
information transfer; the IP based way is to make use of the services provided by the
SIGTRAN protocol for transmission. The protocol stack is shown in Figure 7-3
CAP CAP
(G)MSC Server/SSP (G)MSC Server/SSP
SCP SCP
(MSOFTX3000) (MSOFTX3000)
TCAP TCAP
TCAP TCAP
SCCP SCCP
SCCP SCCP
M3UA M3UA
MTP3 MTP3
SCTP SCTP
MTP2 MTP2
IP IP
In SS7, CAP messages are conveyed as the component part of TCAP messages.
CAP messages are coded in the Abstract Syntax Notation One (ASN.1) format. There
7-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
is a one-to-one relationship between CAP message types and operation codes in the
TCAP component. When a message is transferred, an Invoke ID shall be allocated to
each initiated operation. The Invoke ID is mainly used to identify a particular operation
in a certain direction of the CAP dialog. By distinguishing the operation code, a
component can be “translated” to the corresponding CAP message. Message
translation between CAP and TCAP is implemented by the Functional Entity Access
Manager (FEAM).
Interaction between functional entities across the mobile intelligent network depends
on a variety of operations defined by the CAP protocol. The CAP protocol defines
different operation sets in specific phases. MSOFTX3000 supports CAMEL Phase 3.
In this phase, the CAP protocol defines 32 CAP operations. 24 operations are call
related and others are Short Message Service (SMS) related. The functions of each
operation are briefly described as follows.
I. Initial DP
This operation is sent by the gsmSSF to the gsmSCF. After detection of a Detection
Point (DP) in the Basic Call State Module (BCSM), triggering of an intelligent call
procedure is required. The gsmSSF initiates the “Initial DP”. The "Initial DP" operation
contains various information needed by the gsmSCF, such as the calling number,
called number, calling subscriber location information, called subscriber location
information, subscriber status, etc.
II. RequestReportBCSMEvent
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF can use the “RequestReportBCSMEvent” to request the
gsmSSF for a call related BCSM event. Upon reception of this operation, the gsmSSF
records the necessary call related BCSM event to be reported. When the BCSM
event is detected, a notification is sent to the gsmSCF by an "EventReportBCSM”.
III. EventReportBCSM
This operation is sent by the gsmSSF to the gsmSCF. The gsmSSF has recorded the
reported event required in the RequestReportBCSMEvent message sent by the
gsmSCF. If the event is detected, a notification is sent to the gsmSCF by using an
“EventReportBCSM”. The gsmSCF will perform further handling according to the
event type.
7-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
IV. CallInformationRequest
This operation is sent by the gsmSCF to the gsmSSF. After collection of call related
information is required in service operations and management, the gsmSCF can send
to the gsmSSF a “CallInformationRequest” message to collect the following call
related information:
Call Attempt Elapsed Time
Call Stop Time
Call Connected Elapsed Time
Release Cause
The information will be reported by the gsmSSF to the gsmSCF in the
“CallInformationReport” format when the call is released or the collection is
completed.
V. CallInformationReport
This operation is sent by the gsmSSF to the gsmSCF. When the gsmSSF receives
the “CallInformationRequest” from the gsmSCF, the gsmSSF sends the required
information in the “CallInformationReport” format to the gsmSCF at call release or
collection completion, so that the gsmSCF can collect the call related information.
VI. ApplyCharging
This operation is sent by the gsmSCF to the gsmSSF, and is used to control the
duration of the call. The “ApplyCharging” operation contains the maximum call
duration, the charging tariff change duration and other control parameter used in the
call. The actual call duration will be sent in an “ApplyChargingReport” by the gsmSSF
to indicate to the gsmSCF when the call reaches the maximum duration or the call is
released by either subscriber.
VII. ApplyChargingReport
This operation is sent by the gsmSSF to the gsmSCF. When the actual call duration
reaches the maximum duration specified in the corresponding “ApplyCharging”
operation or the call is released by either subscriber, the gsmSSF sends this
operation to inform the gsmSCF about the actual duration and other related
information of the call.
7-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
VIII. SendChargingInformation
This operation is sent by the gsmSCF to the gsmSSF. This operation is used to send
e-parameters from the gsmSCF to the gsmSSF. “SendChargingInformation” contains
the Charge Advice Information (CAI) of the Advice of Charge (AoC). This CAI can be
used to replace the MSC generated CAI and inhibit any further generation of CAI.
IX. FurnishChargingInformation
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF sends to the gsmSSF a “FurnishChargingInformation”
message to control output of the charging information at the gsmSSF.
X. Continue
This operation is sent by the gsmSCF to the gsmSSF. The gsmSCF makes use of the
“Continue” operation to instruct the gsmSSF to proceed with the suspended call
processing.
XI. Connect
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF makes use of the “Connect” operation to modify some
parameters of the call, such as the called address, calling line identification
presentation, etc., so that the call can go on as per the service requirements.
XII. ReleaseCall
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF initiates, at any time of the call, the “ReleaseCall”
operation to request the gsmSSF to release the corresponding call.
XIII. ConnectToResource
This operation is sent by the gsmSCF to the gsmSSF. When subscriber interaction is
required, the gsmSCF originates the “ConnectToResource” operation to instruct the
gsmSSF to connection the current call to the gsmSRF, preparing for the subsequent
subscriber interaction process.
XIV. PlayAnnouncement
7-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
The gsmSSF plays a role of signaling trunk during this process. Upon reception of the
operation, the gsmSSF will deliver it to the concerned gsmSRF.
XV. PromptAndCollectInformation
XVI. DisconnectForwardConnection
This operation is sent by the gsmSCF to the gsmSSF/gsmSRF. After user interaction
process is completed, the gsmSCF uses this operation to request the
gsmSSF/gsmSRF to clear the connection of the specialized resources for the call.
XVII. SpecializeResourceReport
This operation is sent by the gsmSRF to the gsmSCF. The gsmSRF uses this
operation to indicate to the gsmSCF that the corresponding “PlayAnnouncement”
operation has been completed.
XVIII. EstablishTemporaryConnection
This operation is sent by the gsmSCF to the initiating gsmSSF. Due to the
requirement by the service or management, the gsmSCF expects to utilize an assist
procedure in user interaction. In this case, the gsmSCF actively sends the
“EstablishTemporaryConnection” operation to the initiating gsmSSF, requesting the
initiating gsmSSF to create a temporary connection with the assisting
gsmSSF/gsmSRF. Upon receipt of the operation, the initiating gsmSSF will initiate an
assist request to the corresponding network entity according to the address of the
assisting gsmSSF/gsmSRF contained in the operation, so as to enable the
appropriate assist procedure.
XIX. AssistRequestInstruction
7-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
XX. CallGap
This operation is sent by the gsmSCF to the gsmSSF. A gsmSSF may provision to the
gsmSCF a large volume of message traffic in a relatively short time. If the growing of
the traffic exceeds the allowable range, congestion may happen at the gsmSCF. This
will prolong the message responding time and increase the call failure rate. Therefore,
the gsmSCF can activate a “CallGap” operation at detecting the congestion,
requesting the gsmSSF to slow down the sending of service requests to it.
XXI. ResetTimer
This operation is sent by the gsmSCF to the gsmSSF. This operation is used by the
gsmSCF to refresh the status timer of the gsmSSF during the service proceeding, in
order to avoid status timeout at the gsmSSF.
XXII. Cancel
This operation is sent by the gsmSCF to the gsmSSF/gsmSRF, for the purpose of
canceling a previously sent “PlayAnnouncement” operation or
“PromptAndCollectInformation” operation. The gsmSSF/gsmSRF uses an error
indication “Canceled” to notify the gsmSCF of the successful cancellation of the
corresponding operation.
XXIII. ActivityTest
This operation is originated by the gsmSCF to test the normality of the control
relationship of the gsmSCF on the gsmSSF/gsmSRF. Upon reception of the
“ActivityTest” operation indication, the gsmSSF/gsmSRF will return the “ActivityTest"
outcome if the control relationship is normal; otherwise, the gsmSSF/gsmSRF will not
perform any handling on it. If an “ActivityTest” response is not received at the
gsmSCF, it indicates that the control relationship between the gsmSCF and the
gsmSSF/gsmSRF has failed in some way. Appropriate actions can be taken as per
the service requirements.
XXIV. ContinueWithArgument
This operation is sent by the gsmSCF to the gsmSSF. The gsmSCF uses the
“ContinueWithArgument” operation to instruct the gsmSSF to proceed with the
suspended call handling. Moreover, this operation also provides additional services
for the user (calling or called party).
7-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
I. InitialDPSMS
This operation is sent by the gsmSSF to the gsmSCF. When the gsmSSF determines
that triggering of a mobile initial SMS procedure is required, the gsmSSF originates
the corresponding procedure by sending the “InitialDPSMS” operation and requests
the gsmSCF to complete the mobile initial SMS procedure.
II. RequestReportSMSEvent
This operation is sent by the gsmSCF to the gsmSSF. The gsmSCF sends the
“RequestReportSMSEvent” operation to the gsmSSF, requesting the gsmSSF to
monitor the SMS related event (a success or failure in submitting the short message
to the SMSC). At detecting the SMS event, the gsmSSF notifies the gsmSCF of that
via an “EventReportSMS” operation.
III. EventReportSMS
This operation is sent by the gsmSSF to the gsmSCF. The gsmSSF has recorded the
reported event required in the “RequestReportSMSEvent” operation sent by the
gsmSCF. If the event is detected, a notification is sent to the gsmSCF by using an
“EventReportSMS”. The gsmSSF will perform further handling according to the event
type.
IV. ContinueSMS
This operation is sent by the gsmSCF to the gsmSSF. The gsmSCF uses the
“ContinueSMS” operation to instruct the gsmSSF to proceed with the suspended
short message handling.
V. FurnishChargingInformationSMS
This operation is sent by the gsmSCF to the gsmSSF, for the purpose of controlling
the output of charging information at the gsmSSF. The gsmSCF sends charge related
information to a logical short message record. The first
“FurnishChargingInformationSMS” operation leads to the generation of a logical short
message record. Receipt of subsequent “FurnishChargingInformationSMS”
operations shall overwrite or add the contents of the logical short message record.
VI. ReleaseSMS
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF uses the “ReleaseSMS” operation to request the gsmSSF
7-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
to release the mobile initial SMS. This operation can be sent only when the controlling
relationship exists between the gsmSCF and the gsmSSF.
VII. ResetTimerSMS
This operation is sent by the gsmSCF to the gsmSSF. This operation is used by the
gsmSCF to refresh the status timer of the gsmSSF during the short message
proceeding, in order to avoid status timeout at the gsmSSF.
VIII. ConnectSMS
This operation is sent by the gsmSCF to the gsmSSF. According to the service
requirements, the gsmSCF can make use of the “ConnectSMS” operation to request
the gsmSSF to execute certain SMS handling: routing the short message to a
specified target address or affecting other SMS establishment information, etc.
I. Procedure 1
Figure 7-5 depicts the call flow for a mobile prepaid subscriber in the MSCa/VLR/SSP
covering scope making a call to a PSTN subscriber, where the O-CSI triggers the
intelligent service.
7-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
O-CSI trigger
IDP
Charging the
calling party
RRBE
AC
Continue
IAI
ACM
ANC
.
.
.
ACR
ERB
RC
CAP messages
TUP messages
Figure 7-5 Flow of prepaid subscriber calling PSTN subscriber (O-CSI trigger)
II. Procedure 2
Figure 7-6 depicts the call flow for a mobile prepaid subscriber out of the
MSCa/VLR/SSP covering scope making a call to a PSTN subscriber, where the
calling party resident MSC/VLR accesses the MSCa/VLR/SSP in OVERLAY mode
7-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 CAP
and the MSCa/VLR/SSP analyzes the calling number and triggers the intelligent
service based on the number segment.
IAI
Number segment
trigger
IDP
Charging the
calling party
RRBE
AC
Continue
IAI
ACM
ANC
.
.
.
ACR
ERB
RC
CAP messages
TUP messages
Figure 7-6 Flow of prepaid subscriber calling PSTN subscriber (number segment trigger)
1) Upon receipt of the forwarded call, the MSCa/VLR/SSP analyzes the calling
number. If the calling party is a prepaid subscriber, the prefix at the front of the
called number is converted into the toll area code representing the actual
location of the calling party, and is put in the Location Number parameter of the
IDP message. The MSCa/VLR/SSP looks up the corresponding SCP address
based on the calling number segment, and then sends the IDP message to the
SCPa.
2) After the SCPa receives the IDP message, the SCPa analyzes the calling party’s
account before anything else is done. If the account is a valid one, the tariff rate
is determined according to the actual location (Location Number) of the calling
party and the called toll area code. The balance in the account is converted into
the conversation duration. RRBE, AC and Continue messages are sent to the
MSCa/VLR/SSP.
3) The MSCa/VLR/SSP performs the connection according to the called number in
the TUP message.
4) At the end of the conversation, either party hooks on. The MSCa/VLR/SSP
reports the charging report and the onhook event.
7-11
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
Chapter 8 ISUP
8.1 Overview
The Integrated Services Digital Network User Part (ISDN User Part, that is, ISUP) is
one of the User Parts of the Common Channel Signaling System No. 7, which defines
the signaling messages, functions and procedures required to control voice and
non-voice services (for example, circuit switched data communication). The ISUP can
not only implement the functions of the Telephone User Part (TUP) and the Data User
Part (DUP), but also achieve the ISDN services on a wide basis, thus having a
spacious application scope.
The ISUP protocol supports basic bearer services, that is, establishing, monitoring and
releasing 64kbit/s circuits between user terminals, and providing lower-layer
information transfer capability for the users.
In addition to basic bearer services, the ISUP also supports the following
supplementary services:
Calling line identification presentation and identification restriction (CLIP and
CLIR)
Connected line identification presentation and identification restriction (COLP and
COLR)
Call diversion services (call forwarding unconditional, call forwarding busy, call
forwarding no reply, call forwarding on mobile subscriber not reachable)
Call hold (HOLD)
Call waiting (CW)
User-to-user signaling (UUS)
Three-party service (3PTY)
The ISUP also supports the function of multi destination signaling point.
The Signaling Connection Control Part (SCCP) provides the support for ISUP
end-to-end signaling services.
8-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
H.248 H.248
PLMN
MGW MGW
When MSOFTX3000 functions as the GMSC Server, there are two approaches to
interwork with the PSTN/PLMN:
MSOFTX3000 has a built-in Signaling Gateway (SG) function, thus providing the
TDM interface for interworking with PSTN/PLMN signaling equipments (exchange,
STP, and so on) where ISUP is used as the inter-office signaling and MTP is used
to carry the signaling.
MSOFTX3000 provides the IP interface, being transferred by an independent SG,
to interworking with PSTN/PLMN signaling equipments where ISUP is used as the
inter-office signaling and SIGTRAN is used to carry the signaling.
MSOFTX3000 provides two ways to transfer the ISUP protocol: TDM based and IP
based. The TDM based way is to make use of the services provided by the MTP for
information transfer; the IP based way is to make use of the services provided by the
SIGTRAN protocol for transmission. The protocol stack is shown in Figure 8-2
8-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
M3UA M3UA
MTP3 MTP3
SCTP SCTP
MTP2 MTP2
IP IP
Primitives are used for communication of ISUP messages with the lower transport layer.
The primitives used between MTP (or M3UA) and ISUP include the transfer primitive,
the resume primitive, the pause primitive and the status primitive.
The MTP-TRANSFER primitive is used to carry the signaling messages of the
ISDN User Part. ISDN User Part signaling messages are capsulated in the
MTP-TRANSFER primitive for transmission and reception.
The MTP-PAUSE primitive is sent by the Message Transfer Part to indicate its
inability to transfer messages to the destination specified as a parameter.
The MTP-RESUME primitive is sent by the Message Transfer Part to indicate its
ability to resume unrestricted transfer of messages to the destination specified as
a parameter.
The MTP-STATUS primitive is sent by the Message Transfer Part to indicate that
the signaling route to a specific destination is congested or the ISDN User Part at
the destination is unavailable. Unavailability causes can be unequipped,
inaccessible, or unknown.
ISDN User Part messages are conveyed on a signal link by means of message signal
unit (MSU) where the messages are capsulated in the service information field (SIF).
An ISUP message consists of six parts, namely routing label, circuit identification code,
message type code, the mandatory fixed part, the mandatory variable part, and the
optional part, as shown in Figure 8-3.
Please reference Chapter MTP in Transport Protocols part of this manual for the
description of routing label and circuit identification code. Others are covered in this
chapter.
8-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
Message type
Mandatory parameter A with fixed length
~
~ ~
~ Mandatory parameter with fixed length
Mandatory parameter F with fixed length
Point to parameter M
~
~ ~
~
Point to parameter P
Point to start bit of optional parameter
Mandatory parameter with variable length
Length of parameter M
Parameter M
~
~ ~
~
Length of parameter P
Parameter P
Code of parameter X
Length of parameter X
Parameter X
~
~ ~
~
Optional parameter
Code of parameter Z
Length of parameter Z
Parameter Z
End tag of variable parameter
The message type code consists of a one-octet field and is mandatory for all messages.
The message type code uniquely defines the function and format of each ISDN user
part message (see Table 8-1).
Abbreviati
Code Meaning
on
Initial address message: A message sent in the forward direction to
00000001 IAM initiate seizure of an outgoing circuit and to transmit number and other
information relating to the routing and handling of a call.
Subsequent address message: A message that may be sent in
00000010 SAM the forward direction following an initial address message, to convey
additional called party number information.
Information request message: A message sent by an exchange to
00000011 INR
request information in association with a call.
8-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
Abbreviati
Code Meaning
on
Information message: A message sent to convey information in
00000100 INF association with a call, which may have been requested in an
information request message.
Continuity message: A message sent indicating whether or not
there is continuity on the preceding circuit(s) as well as of the selected
00000101 COT circuit to the following exchange, including verification of the
communication path across the exchange with the specified degree of
reliability.
Address complete message: A message indicating that all the address
00000110 ACM signals required for routing the call to the called party have been
received.
Connect message: A message indicating that all the address signals
00000111 CON required for routing the call to the called party have been received and
that the call has been answered.
8-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
Abbreviati
Code Meaning
on
8-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
Abbreviati
Code Meaning
on
00011101
00011100
Reserved
00011110
00100111
Each kind of message is composed of message type code and several parameters.
Each parameter has a name that is coded by a single octet. The length of a parameter
may be fixed or variable, and each parameter can have a one-octet length indicator.
Those parameters that are mandatory and of fixed length for a particular message type
are contained in the mandatory fixed part. The position, length and order of the
8-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
parameters is uniquely defined by the message type; thus, the names of the
parameters and the length indicators are not included in the message.
Mandatory parameters of variable length are included in the mandatory variable part.
Pointers are used to indicate the beginning of each parameter. Each pointer is encoded
as a single octet. The name of each parameter and the order in which the pointers are
sent is implicit in the message type. The number of parameters and the number of
pointers is uniquely defined by the message type.
A pointer is also included to indicate the beginning of the optional part. If the message
type indicates that no optional part is allowed, then this pointer will not be present. If the
message type indicates that an optional part is possible but there is no optional part
included in this particular message, then a pointer field containing all zeros is used.
All the pointers are sent consecutively at the beginning of the mandatory variable part.
Each parameter contains the parameter length indicator and the contents of the
parameters.
The optional part consists of parameters that may or may not occur in any particular
message type. Both fixed length and variable length parameters may be included.
Optional parameters may be transmitted in any order. Each optional parameter will
include the parameter name (one octet) and the length indicator (one octet) followed by
the parameter contents.
End of optional parameters octet: If optional parameters are present and after all
optional parameters have been sent, an "end of optional parameters" octet containing
all zeros will be transmitted.
A mobile subscriber makes a call to an idle PSTN subscriber. The call is implemented
successfully. The inter-office ISUP signaling procedure between the GMSC Server
(functioned by MSOFTX3000) and the PSTN end office LS is made as shown in Figure
8-4.
8-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
GMSC Server LS
IAM
ACM
ANM
Conversation
REL
Calling party
hangs up first
RLC
REL
Called party
hangs up first
RLC
If the called party hangs up first, the LS sends a REL message in the backward
direction. After receiving the REL message, the GMSC Server sends back a RLC
message to release the trunk.
A mobile subscriber makes a call to an idle PSTN subscriber. The call is not successful
as the called party is busy. The inter-office ISUP signaling procedure between the
GMSC Server (functioned by MSOFTX3000) and the PSTN end office LS is made as
shown in Figure 8-5.
8-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 8 ISUP
GMSC Server LS
IAM
REL
Called party is busy
RLC
1) The GMSC Server sends an IAM message to the PSTN end office LS to set up the
call.
2) The LS finds that the called party is busy and then directly sends a REL message
to release the call where the release cause is carried.
3) The GMSC Server sends back a RLC message to complete the release.
8-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
9.1 Overview
9.1.1 Brief Introduction to the Nb Interface
As the interface between MGW devices in the CS domain of the UMTS network, the Nb
interface provides service connection channels between different MGWs, such as
between the end office MGW and the gateway office MGW.
The Nb interface provides the transmission and bearer function for voice service traffic,
and IPBCP is used for the control of voice service traffic transmission in the CN. IPBCP
accomplishes negotiation about the Nb interface bearer features of different MGWs,
and the negotiation interaction messages are transmitted through the tunnel provided
by the Mc interface and Nc interface.
In the architecture where call control is independent from bearer, the Nb interface is
divided into two parts as user plane and control plane based on the difference between
service traffic and control traffic. The user plane transfers service traffic based on Nb
UP; whereas the control plane accomplishes bearer feature negotiation based on Nb
CP. Different bearer modes require different protocols. In the case of IP bearer, the
control plane selects IPBCP for bearer control; and the user plane uses UDP/IP to fulfill
the function of speech service traffic bearer.
As a newly defined interface, the Nb interface is used to connect the service bearer
devices in the CN. The Nb interface has the following functions:
Providing the service traffic bearer function for the CN
Accomplishing being independent from the lower-layer transmission mode based
on Nb UP, and accomplishing bearers of IP/ATM mode.
Providing transparent transmission channels for TDM bearer signaling.
The adaptation protocol used in the Nb interface user plane is to transfer data between
MGWs. Nb UP is originated by an MGW and acknowledged by the neighbor MGW. The
Nb UP frame is the same as the lu UP frame, that is, one PDU type is effective for the
both.
The Nb interface position and the data adaptation protocols are shown in Figure 9-1.
9-1
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
Nb Nb
Iu UP Iu UP
UP UP
Radio
Transport
Protocols
Layer
SRNC MGW MGW
Iu Nb
Figure 9-1 The Nb interface position and the adaptation protocols structure
The definition and operation of Nb UP are the same as that of IuUP, and they both
support the two operational modes: pre-defined support mode and transparent
transmission mode. The only difference between the two protocols is that they are
applied to different interfaces. The most distinctive point of Nb UP is to shield
differences of lower layers, so as to bear the service traffic based on different modes.
The lower layer over the Nb interface has two transmission modes, which are based on
IP and ATM respectively. Different transmission modes call for different user-plane
protocols and control-plane adaptation protocols. Next will introduce the protocol stack
structures related to specific transmission modes.
I. IP Bearer Mode
9-2
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
DATA
Nb UP
RTP/RTCP
(RFC1889/RFC1990)
UDP
(RFC768)
IPv4(RFC791) or IPv6
(RFC2460)
Figure 9-2 The protocol stack structure of the IP bearer user plane
One MGW device can have several IP addresses, and “IP address + UDP port number”
is used to identify a bearer resource. In the structure figure above, RTP is optional.
UDP shall assign two successive port numbers to RTP and RTCP. And RTP shall use
the port with an even port number, and RTCP shall use the port identified by that even
number+1.
In the case of IP transmission, the control plane uses IPBCP (IP Bear Control Protocol).
The bearer feature negotiation is accomplished through the tunnel provided by the Mc
interface and the Nc interface. For details, please see related introduction to IPBCP.
The structure of the user-plane protocol stack based on ATM transmission is illustrated
in Figure 9-3.
DATA
Nb UP
AAL2 SAR
SSCS(I.366.1)
AAL2(I.363.2)
ATM
Figure 9-3 The structure of the user-plane protocol stack based on ATM bearer
As the above figure shown, the protocol stack structure here is the same as that of the
lu interface user plane based on ATM bearer.
The ATM AAL2 link requires virtual circuit transmission. The types of virtual circuits can
be PVC and SPVC and SVC. The Nb interface in ATM transmission mode must support
9-3
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
PVC, whereas SPVC and SVC are optional. The virtual circuit is released by the
initiator.
Note:
At present, the UMG8900 device only supports PVC, other than SPVC and SVC.
AAL-2 SAR SSCS is able to provide elementary data packets for segmentation and
assembly, and it also supports transmission error check, reliable and sequenced
packets transfer and flow control.
The AAL2 sub-layer can transmit such applications as being low-speed, sensitive to
delay and with variable packet length.
The protocol stack structure of the control plane in ATM transmission mode is
illustrated in Figure 9-4.
Q.AAL2(Q.2630.1/
Q.2630.2)
STC(Q.2150.1)
MTP-3b
SAAL
AAL5
ATM
Figure 9-4 The protocol stack structure of the control plane in ATM transmission mode
The figure shows that in ATM transmission mode, the protocol stack structure of the Nb
interface control plane is the same as that of the lu interface control plane at the
transport layer. For details, please refer to related protocol introduction in the appendix
and the lu interface protocol structure introduction in this manual.
9-4
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
Within the UMG8900 device, if the Nb interface selects ATM bearer mode, the MASU
will be responsible for Nb UP processing and protocol supporting function. If the Nb
interface selects IP bearer mode, the MRPU and MTCA/MTCB will be responsible for
Nb UP processing and protocol stack supporting function.
9.2.1 Functions
Like the lu UP protocol, Nb UP also has two operational modes: support mode for
predefined SDU size (SMpSDU) and transparent mode (TrM).
InTrM, Nb UP transmits the frames of the upper layer and the lower layer transparently,
rather than exchange any information with the opposite-end Nb UP. The function of this
mode is confined to user data transmission, and any in-band negotiation process
related to bearer set up is not allowed.
This mode is applied to the condition that the Nb UP layer needs to process data
frames through this layer. PDUs frames used for transmitting AMR speech adopt this
mode. In support mode, Nb UP has the following functions:
Transfer of user data
Initialization
Rate control
Time alignment
Handling of error events
Frame quality classification
As Nb UP has the same functions as the lu UP protocol, for its functions, please see the
previous part of the lu UP protocol introduction.
9-5
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
Nc IPBCP: Q.1970
MSC-Server MSC-Server
Tunnel: Q.1990
Mc Mc BICC: Q.765.5
MGW MGW
TS 29.232
Nb
9-6
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
9.3.1 Functions
IPBCP is mainly engaged in information exchange and negotiation during BICC call
establishment, concerning media stream characteristics, port number, IP address, and
so on. IPBCP uses the codec type defined by SDP to encode this information. IPBCP
assumes a reliable, sequenced, point-to-point signalling transport service between two
nodes.
Note:
The partial and sub domains listed above are added as SDP requires, but independent of application
environment. The above domains must be present and be used as RFC 2327 defines.
9-7
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
Other SDP domains may also exist in an IPBCP message, but they are not useful for IPBCP application.
So they are discarded as not being accepted.
IPBCP basic procedures involve IP bearer set up, IP bearer changing, IP bearer
release, compatibility process and exceptional events process.
I. IP Bearer Setup
1) Successful process
The interworking in IP bearer set-up process is shown in Figure 9-6.
I-BIWF R-BIWF
T1 Request
Accepted
Check the
info Received
9-8
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
The IP bearer set up fails if R-BIWF can not correctly identify the request message from
I-BWF or the accept message returned by R-IWF is wrong.
In terms of I-BIWF at the sending side, the following abnormal cases may appear.
REJECTED message is received.
ACCEPTED message has errors.
If so, I-BIWF will stop T1, release the resources assigned for IP bearer and notify to set
up bearer control entities.
In terms of R-BIW at the receiving side, the following abnormal cases may appear.
The contents of REQUES received are wrong.
The designated media announcement is not supported.
R-BIWF should return the REJECTED message.
After IP bearer is set up, it can be changed by the control entities of I-BIWF and R-BIWF.
However, only fmt list in the media announcement parameter and the media attributes
used by IP bearer can be changed.
1) Successful process
The successful IP bearer changing process is shown in Figure 9-7.
I-BIWF R-BIWF
T2 Request
Accepted
Check the
info Received
Both I-BIWF and R-BIWF can originate IP bearer changing. The process will be
described later with I-BIWF being the initiating side as example. The IP bearer
changing process originated by R-BIWF is the same as that by I-BIWF, except that
messages involved are in the reverse flow.
I-BIWF sends a REQUEST message to request to modify IP bearer. Such parameters
are included in the message as media announcement and media attribute. After the
REQUEST message is sent, I-BIWF starts a timer (T2).
Upon receiving the REQUEST message, R-BIWF will check the message. If no
abnormality is found, the ACCEPTED message will be returned containing such
parameters as media announcement and media attribute. Except the port number, the
9-9
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
This process is to negotiate the IP BCP version of the two interwroking sides. The
process is shown in Figure 9-8.
9-10
Protocols and Signaling Analysis Application Protocols
HUAWEI UMTS Circuit-Switched Core Network Chapter 9 Nb UP and IPBCP
I-BIWF R-BIWF
Request[I-Version ......]
Confused[T-Version ......]
Request[T-Version ......]
The REQUEST message includes the version number parameter I-Version. When the
receiving side receives the REQUEST message, it will check the version number. If t
I-Version is supported, the receiving side will use this version number in all the
messages sent to the remote side later. If it is not supported, the receiving side will
return the CONFUSE message which contains the version number T-Version it
supports.
When receiving the CONFUSED message, the initiating side will check the version
number T-version contained in the message. If T-version is supported, the initiating side
will resend REQUEST, using T-Version. If it is not supported, the initiating side will
report to the control entity.
9-11
HUAWEI
Table of Contents
i
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
ii
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 MGW Registration Procedures
ServiceChange
ServiceChange_Reply
1) When an MGW is in service for the first time or restarted, it sends the
ServiceChange message to the MSC Server to which it belongs to request
registration. This message contains such descriptors as Method (“Restart", for
example), ServiceChangeAddress (address message) and Reason. This
message corresponds to the ROOT terminal (that is, the whole MGW).
2) The MSC Server authenticates the MGW and returns the ServiceChange_Reply
message (containing ServiceChangeAddress) to accept registration. If the MSC
Server rejects the registration due to inconsistent version or MGW out of control,
it sends the message ServiceChange_Reply (containing Reason) to the MGW.
1-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 MGW Registration Procedures
1-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
2.1 Overview
The Mobility Management (MM) aims to locate the MS/UE and keep the connection
between MS/UE and the network in the desirable status.
The action that MS/UE changes its connection with the current cell/network is known
as roaming.
It is very important to locate an MS/UE when it is in the idle status. Since knowing the
current location of the MS/UE is the precondition that the network can set up the
connection with it quickly when it is called.
To realize location management, network will keep tracing MS/UE's current location
and store the location information. The location information is stored in HLR, VLR and
MS/UE (in SIM/USIM card). The location management procedure is used to ensure
the consistency of the location information in these three entities.
Among the three entities, HLR serves to store the MS/UE subscription data and
location information (that is, the MSC/VLR No.). VLR serves to store the subscriber
related information, including the MS/UE subscription data, location information and
subscriber status information downloaded from HLR. MSC processes the MS/UE
location registration procedure and exchanges data with VLR. The MS/UE stores the
information of the Location Area (LA) where it stays.
The location management protocol is observed between HLR and MSC/VLR, and
between MSC/VLR and MS/UE. The Mobile Application Part (MAP) of SS7 is adopted
between HLR and MSC/VLR, while Radio Interface Layer 3 protocol of MM (RIL3-MM)
is adopted between MSC/VLR and the MS/UE.
2-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
The following section describes the location update procedures of the Global System for Mobile
communications (GSM), which are similar to that of the Universal Mobile Telecommunication System
(UMTS).
I. Authentication
On receipt of the location update request from MS, if authentication is needed but
there is no available authentication set, MSC/VLR will request for the authentication
set from HLR, and initiate the authentication procedure.
2-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
MSC/ D
MS VLR HLR
SEND AUTHENTICATE
Authentication procedure
Note:
For detailed description of the authentication procedure, see Section 3.1 Authentication in this manual.
If the subscriber requests location update with Temporary Mobile Subscriber Identifier
(TMSI), the MSC/VLR finds that the TMSI is unknown, and the MS has never
registered in current VLR, the VLR will get the PVLR address according to the old
TMSI and Location Area Identity (LAI), and initiates the procedure to acquire IMSI
and authentication set from PVLR.
G
VLR PVLR
SEND IDENTIFICATION
On receipt of the location update request from MSC/VLR, if the HLR finds that the
subscriber has moved to an area controlled by a different MSC/VLR, it will initiate
location cancellation procedure to remove the subscriber information from PVLR.
2-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
D
HLR PVLR
CANCEL LOCATION
After receiving the location update request from MSC/VLR, if the HLR finds that the
subscriber roamed-to MSC/VLR number is changed, it will initiate the location
cancellation procedure to delete the subscriber information in PVLR. Afterwards, HLR
provides the needed subscriber information to the new VLR.
Figure 2-4 shows the procedure of inserting the subscriber data to VLR by HLR.
D
HLR VLR
V. Purging MS
The procedure is initiated by VLR to delete the subscriber data from the database.
This procedure is induced when the MS stays inactive within a long time (can be set,
usually 24 hours), or when the system administrator deletes the subscriber record.
D
VLR HLR
MAP_PURGE_MS
MAP_PURGE_MS_ack
2-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Once the implicit IMSI detach timer times out, VLR will set the subscriber status
automatically to "detached". The implicit IMSI detach timer records the period within
which the MS is not active (no location update or calling). When the recorded time
reaches the preset "detach" value, VLR will set the subscriber status to "detached".
Whether VLR will initiate the implicit IMSI detach is also related to the periodic
location update time, which is set in Base Station Controller/Radio Network Controller
(BSC/RNC). If the implicit detach time is set longer than the periodic location update
time, and the subscriber has initiated the periodic location update within the set time,
the implicit detach will not be triggered. In this case, the IMSI detach will be triggered
only when the subscriber moves into a no-signal area and does not make the periodic
location update within the implicit detach time.
The MS will initiate the IMSI detach procedure when it is being powered off. VLR will
then mark the IMSI as detached to indicate that the MS is inactive.
Um A
MS B VLR
BSS MSC
1.IMSI·detach L3 message
2.·Detack IMSI
3. Purging command (to
release resources)
4. Purging completed
The major procedure of location management is the location update. There are
different kinds of location updates, including normal location update, periodic location
update, IMSI attach and combined Routing Area/Location Area (RA/LA) update.
2-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
According to whether or not the new LAI shares the same MSC/VLR with the old LAI
and whether or not IMSI is involved, the location update is classified into the following
three kinds:
The location update within the same MSC/VLR area (only VLR is involved)
A B
MS BSS MSC VLR
LOCATION_UPDATING_REQUEST
MAP_UPDATE_LOCATION_AREA
MAP_AUTHENTICATE
MAP_AUTHENTICATE ack
MAP_SET_CIPHERING_MODE
MAP_UPDATE_LOCATION_AREA
LOCATION_UPDATING_ACCEPT ack
MAP_FORW._NEW_TMSI ack
Figure 2-7 Location update within the same MSC/VLR area (only VLR is involved)
1) MS sends to MSC the "Location updating request" message, which includes the
TMSI/IMSI and LAI of the MS and indicates that it is a normal location update.
2) MSC sends the "Update location area" message to VLR.
3) VLR initiates the authentication and encryption procedures. These procedures
are optional.
4) VLR updates the LA information of the MS, stores the new LAI and sends to
MSC the "Update location area ack" message.
5) MSC sends to the MS the "Location updating accept" message, which contains
the TMSI.
6) MSC releases the channel resources and the location update is completed.
Note:
The italicized operations are optional.
The inter MSC/VLR location update (the subscriber data cannot be obtained
from PVLR)
2-6
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
The MS moves from LAI-1 in MSC-A to LAI-2 in MSC-B. The MS will use the IMSI to
initiate the location update if it enters a new VLR, registers for the first time, or the
related network data are lost.
A B D
MS BSS MSC-B VLR-B HLR
G D
PVLR
LOCATION_UPDATING MAP_UPDATE_
_REQUEST
LOCATION_AREA
MAP_UPDATE_LOCATION
MAP_CANCEL_
LOCATION
MAP_CANCEL_
LOCATION ack
MAP_INSERT_SUBSCRIBER_DATA
MAP_INSERT_SUBSCR._DATA ackc
MAP_UPDATE_LOCATION ack
MAP_UPDATE_
LOCATION_UPDATING LOCATION_AREA ack
_ACCEPT
2-7
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
A B D
MS BSS MSC VLR HLR
G D
PVLR
LOCATION_UPDATING
MAP_UPDATE_
_REQUEST MAP_SEND_IDENTIFICATION
LOCATION_AREA
MAP_SEND_IDENTIFICATION ack
MAP_UPDATE_LOCATION
MAP_CANCEL_
LOCATION
MAP_CANCEL_
LOCATION ack
MAP_INSERT_SUBSCRIBER_DATA
MAP_INSERT_SUBSCR._DATA ack
MAP_UPDATE_LOCATION ack
MAP_UPDATE_
LOCATION_UPDATING
LOCATION_AREA ack
_ACCEPT
1) When the MS enters a new LA (VLR-B), it conducts location update with the
TMSI assigned by the PVLR. In this case, VLR-B must get the IMSI of the MS
from the PVLR in order to get the HLR address of this MS. Therefore, VLR-B,
PVLR and HLR will be involved in this location update.
2) VLR-B must get the IMSI from the PVLR. Except from that, this procedure is the
same as the one described above.
When the MS suddenly enters a no-signal area, or is suddenly powered down, the
MS will detach from the network before it can send the "RIL3-MM IMSI detach"
message. In this case, it is impossible for VLR to mark the IMSI as detached. If this
MS is called, the circuit resources and radio resources will be wasted.
2-8
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
The solution to this problem is the periodic location update. The MS is required to
update its location periodically (for example, once every 30 minutes) regardless of
whether or not it has entered a new LA. The VLR will set the IMSI as detached if the
MS does not update its location when the time is due. The period can be manually set
from 6 minutes to 24 hours, or as infinite (no periodic location update).
In MSOFTX3000, the IMSI detach time is set in VLR. When the detach time is due,
the MS will be regarded as having been shut down, and VLR will mark it as detached.
The time for the periodic location update is set in BSC/RNC. The IMSI detach time set
in VLR and the periodic location update time set in BSC/RNC are determined based
on the network planning.
The setting of the period for periodic location update should also take into
consideration the elements such as network quality, signaling link occupancy, and so
on. If the period is too short, much of the signaling link resources and radio resources
will be occupied by periodic location update. The overall connected ratio will therefore
be affected. If the period is too long, the radio resources and circuits may also be
wasted. Therefore, the period of the periodic location update is the balanced result of
Quality of Service (QoS) and network resource.
Through the periodic location update, the waste of circuit/radio resources due to the
data inconsistency after the active/standby switchover of the HLR/VLR database can
also be avoided.
The procedure of periodic location update is the same as that of the normal location
update.
The Mobile Terminated Call (MTC) will be impossible when the MS is powered down.
However, the circuit between the calling party and the destination MSC will still be set
up and the called MS will be paged if the MS is not marked as detached. The
circuit/radio resources are wasted without making any profit for the operator.
The IMSI attach/detach procedure is designed to solve the problem. In VLR, there is
an attach/detach flag for IMSI. When the MS is available, the flag is set as "IMSI
attached". Otherwise, it is set as "IMSI detached".
When the MS is powered down normally, the MS will send the "RIL3-MM IMSI
detach" message to MSC, which will mark the MS as "IMSI detached".
When the MS enters the active status again, and if it is in a new LA, the normal
location update procedure will be performed. If it is still in the old LA, the IMSI attach
procedure as shown in Figure 2-10 will be initiated (this procedure is only applicable
to the situation that the MS was marked as "IMSI detached").
2-9
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
RANAP MAP
Uu Iu B
UE RNS MSC VLR
1.Location update request L3ÐÅÏ¢
(IMSI attach) 2. Access IMSI LAIn-LAlo (w hich means no
location update.
(attach IMSI) Otherw is e, update location message
4. Location update 3.IMSI access confir m w ill be sent.
accept (access
5. Purging command (to
acknow ledgment)
release resources)
6. Purging completed
1) MS/UE sends the "Location updating request" message, which indicates that the
location update type is the IMSI attach.
2) The following procedures are the same as the location update within the same
MSC/VLR area
1) Related concepts
LA: An area in which the MS/UE may roam without updating the location registers in
GSM/WCDMA network. A LA consists of one or more cells. RA: In GPRS network,
every LA is divided into several RAs. Each RA consists of several cells.
GPRS attach: A procedure that GPRS subscribers attach to the GPRS network and
the subscriber information is stored in Serving GPRS Support Node (SGSN).
Combined RA/LA location update with IMSI attach: The GPRS subscribers transmit
the subscriber information through the Gs interface (between SGSN and MSC) to
MSC/VLR through the GPRS network equipment during the combined RA/LA location
update, so as to realize the attach to the GSM network.
The combined RA/LA update procedure will be performed in the following cases:
The MS enters a new RA;
The GRPS attached MS initiates the IMSI attach;
The MS initiates GPRS attach and IMSI attach concurrently.
The SGSN-VLR connection will be set up. Each will keep the Integrated Services
Digital Network (ISDN) number of the other. In SGSN, a mapping table between
2-10
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Routing Area Identity (RAI) and VLR should be created, so that SGSN can find the
corresponding VLR when correlation is needed. The combined RA/LA update fulfills
the RA and LA updates by using only one radio interface. It saves much radio
interface resource.
The normal procedure in combined RA/LA update is shown in Figure 2-11. The dotted
lines represent optional procedures.
1) The MS sends the RA update request to SGSN to initiate the combined RA/LA
update.
2) SGSN gets the location update type from the received message. If the location
update type is the "Combined RA/LA location update with IMSI attach", or the
"LA update followed by RA update", SGSN will get the VLR No. from the
RAI-VLR mapping table and send the location update request to VLR. SGSN
performs the RA update procedure at the same time.
3) VLR determines whether or not to send the location update request to HLR
based on the location update type (contained in the message it receives) and the
MS information stored in itself. If yes, VLR sends the location update request to
HLR. VLR stores or updates the SGSN No. at the same time.
4) Procedures 3, 4, 5 and 6 are the same as those in the none-GPRS location
update. See the inter MSC/VLR location update procedure.
5) VLR returns the "Location update accept" message to SGSN after the location
update is completed. If the TMSI needs to be re-allocated, VLR will send the
allocated TMSI to SGSN in the "Location update accept" message.
2-11
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
2.3 Handover
2.3.1 Overview
During the service access or an ongoing session, the MS/UE may move from one cell
to another. In such case, the change of the serving cell becomes a very important
function of mobile communication system. The handover function is therefore
provided, which determines directly the spectrum utilization and QoS.
The basic parameters in the handover operation include the handover decision (when
to perform handover) and Service Area Identity (SAI) selection. To ensure that the
current conversation will not be interrupted, the handover is conducted when the
MS/UE moves out of the current cell. To ensure reliable service quality, the handover
is conducted when the MS/UE changes serving cell to avoid strong interference in the
current cell, or when the "preferred cell" is congested.
Different handover decision methods are adopted for different handover purposes. A
handover for the purpose of no conversation interruption is determined on the basis
of uplink/downlink transmission quality (such as transmission Bit Error Rate,
attenuation and edge transmission delay). To get such values, MS/UE and the Base
Transceiver Station (BTS)/NodeB will regularly measure the uplink/downlink
transmission quality and receiving level. The MS/UE will send the recorded result to
the BTS/NodeB twice a second. In the handover due to cell congestion, the decision
is made on the basis of the current load of each BTS, which is available at only MSC
and RNC. In this kind of handover, a certain number of MS/UEs (unspecified) will be
handed over to the neighbor cell with relatively less traffic. Therefore, such handover
is determined also based on other decision methods and corresponding
measurement results.
2.3.2 Classification
There are many handover causes. According to the mobile communication system
that the MS/UE accesses after the handover, the handover has the following kinds:
1) Intra-system handover: Intra-UMTS handover, that is, the handover between
Radio Network Systems (RNS) within an UMTS. Intra-GSM handover is referred
to as the handover between Base Station Subsystems (BSS) within a GSM.
2-12
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
2-13
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
The handover point may differ in different handover types. In intra-RNS handover, the
handover point is a RNC. In intra-MSC handover, the handover point is MSC. In
inter-MSC handover, there are two handover points: MSC-A and MSC-B.
As mentioned above, the intra-UMTS handover is the handover between RNSs within
the UMTS (from one 3G service area to another 3G service area).
According to the position of the target 3G SAI, the intra-UMTS handover is divided
into intra-MSC handover and inter-MSC handover. The later can be sub-divided into
basic handover, subsequent handover back to MSC-A and subsequent handover to
third-party MSC.
I. Intra-MSC Handover
In most cases, the UMTS UE moves from one 3G service area to another during a
session. If the Serving RNC (SRNC) of this UE finds that more reliable service is
available in the new service area, it will decide to initiate the handover and change
the SRNC of this UE.
2-14
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
UE UE
RNS-A 3G_MSC-A RNS-B
Iu-Relocation-Required
Iu-Relocation-Request
Iu-Relocation-Request-Ack
Iu-Relocation-Command
RRC-HO-Command Detection of UE in
targetRNS
Iu-Relocation-Detect
RRC-HO-Complete
Iu-Relocation-Complete
Iu- Release-Command
Iu- Release-Complete
1) The access network RNS-A of the UE makes the decision to initiate the
handover procedure. It sends to MSC (MSC-A) the handover request
(Iu-Relocation-Required). Included in the handover request is the address
information of the expected access network RNS-B, termed as Target RNS
(TRNS).
2) On receipt of the request, MSC-A checks in the corresponding table. If the TRNS
is found to be its subordinate RNS, MSC-A will generate the corresponding
handover request message (Iu-Relocation-Request) and send it to RNS-B.
3) On receipt of the message from MSC, RNS-B assigns the necessary resource
for the UE to access according to the corresponding requirement (included in the
cells of the message), and performs QoS configuration. The related resources
will be assigned at the same time at the MSC-A.
4) After assigning the related resources, RNS-B sends to MSC-A the
"Iu-Relocation-Request-Ack" message, indicating that the resources assignment
is completed and the RNS is ready for the UE to access.
5) On receipt of the acknowledgement from RNS-B, MSC-A sends the
"Iu-Relocation-Command" message to RNS-A. RNS-A in turn sends it in the
message "RRC-HO-Command" to the UE, asking it to access the new service
area.
6) RNS-B sends to MSC-A the message "Iu-Relocation-Detect" when it detects that
the UE is accessing. After the UE access, RNS-B sends to MSC-A the message
"Iu-Relocation-Complete", indicating that it is able to provide service for the UE.
7) After receiving the handover complete message from RNS-B, MSC-A sends the
message "Iu-Release-Command" to RNS-A, asking it to release the related
resources. After releasing the resource, RNS-A returns the message
"Iu-Release-Complete" to MSC-A, ending the handover procedure.
2-15
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
The RNS-B after the handover becomes the SRNS of that UE. If handover occurs again, the RNS-B will
play the role of RNS-A then.
Basic handover
When an UE in an ongoing session moves to another 3G service area of a different
MSC, the handover will involve two MSCs. The new cell provides radio resources for
the UE, just as what happens in the intra-MSC handover. However, in the inter-MSC
handover, an inter-MSC circuit must be set up between the two MSCs for the call.
RNS-A RNS-B
3G_MSC-A 3G_MSC-B VLR-B
IU-RELOC-REQUIRED
MAP-Prep-Handover req.MAP-Allocate-Handover-Number req.
IU-RELOC-REQUEST
IU-RELOC-REQUEST-ACK
MAP-Prep-Handover resp. MAP-Send-Handover-Report req.
ANSWER
RELEASE
End of call
MAP-Send-End-Signal resp.
1) The access network RNS-A of the UE makes the decision to initiate the
handover procedure. It sends to its MSC (MSC-A) the handover request
(Iu-Relocation-Required). Included in the handover request is the address
information of the expected access network RNS-B, termed as Target RNS
(TRNS).
2) On receipt of the request, MSC-A checks in the corresponding table. If the TRNS
is found to be connected to another MSC (MSC-B), MSC-A will pack the
handover request into a certain cell, put the cell into the corresponding MAP
message (MAP-Prepare-Handover req), and send it to MSC-B through MAP
signaling.
3) On receipt of the MAP-Prepare-Handover Req, MSC-B generates the
corresponding message "Iu-Relocation-Request" and sends it to the TRNS.
2-16
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
4) Upon the reception of the handover request, RNS-B assigns the corresponding
resources for the UE. MSC-B also assigns the related resources at the same
time. After assigning the resources, RNS-B sends to MSC-B the message
"Iu-Relocation-Request-Ack". During or after assigning the resources, MSC-B
will also send to its VLR (VLR-B) the message "MAP-Allocate-Handover-Number
req.", asking for the handover number. VLR-B will send the assigned handover
number to MSC-B in the message "MAP-Send-Handover-Report req.".
5) After receiving the acknowledgement from RNS-B and the handover number,
MSC-B sends to MSC-A the message "MAP-Prep-Handover-resp", indicating
that it is ready for the handover. Included in this message is the handover
number, with which MSC-A can find the route to MSC-B.
6) MSC-A then sends to MSC-B the "Initial Address Message (IAM)" to request for
the corresponding trunk circuit. After occupying the trunk circuit, MSC-B returns
to MSC-A the "Address Complete Message (ACM)". The occupation of the trunk
circuit is then completed.
7) After the setup of the circuit, MSC-A generates the message
"Iu-Reloc-Command" according to the information extracted from the message
"MAP-Prep-Handover-resp", and sends it to RNS-A, asking the UE to start the
handover.
8) The UE then starts to access RNS-B. Upon the detection of UE access, RNS-B
sends to MSC-B the message "Iu-Reloc-Detect". MSC-B packs the message into
the MAP signaling "MAP-Process-Access-Sig req" and sends to MSC-A. MSC-B
then starts waiting for the handover complete message. On receipt of the
corresponding MAP signaling, MSC-A also starts waiting for the handover
complete message.
9) After the UE accesses RNS-B, RNS-B sends the handover complete message to
MSC-B, which will pack the message into the MAP signaling
"MAP-Send-End-Signal req" and send it to MSC-A. The MSC-B then starts some
post-handover operations, such as sending the message "Answer" to the
inter-MSC circuit.
10) After receiving the message from MSC-B, MSC-A concludes that the handover is
completed. It starts releasing the resources occupied by that UE at RNS-A by
sending to the RNS-A the message "IU-REL-CMD". RNS-A returns the message
"IU-REL-COMP" to MSC-A after the releasing. The inter-MSC circuit will be
maintained until the session is over. Then, MSC-A will release the circuit, use the
MAP signaling "MAP-Send-End-Signal resp" to notify MSC-B of the release, and
stop the exchange of MAP signaling with MSC-B.
2-17
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
Anytime after receiving the IAM message from MSC-A, MSC-B can use the MAP signaling
"MAP-Send-Handover-Report resp" to notify VLR-B to release the handover number, so that it can be
reused next time.
The RNS-B after the handover becomes the SRNS of that UE. If handover occurs again, the RNS-B will
play the role of RNS-A then.
Subsequent handover
In this handover, the UE is handed over to another cell (in a different MSC) after the
basic handover. The other MSC could be either of the following:
1) The MSC-A in the basic handover.
2) A new neighbor MSC other than the MSC-A. It is termed here as MSC-BP or
MSC-B'.
The first kind of handover is known as the subsequent handover back to MSC-A. The
later is known as the subsequent handover to third-party MSC.
Subsequent handover back to MSC-A
As mentioned above, in this handover, the UE is handed over from MSC-B to MSC-A
after the basic handover.
Figure 2-15 shows the procedure of the subsequent handover back to MSC-A.
RNS-B RNS-A
3G_MSC-A 3G_MSC-B VLR-B
Iu-RELOCATION-
MAP-Prep-Sub-Handover req.
REQUIRED
Iu-RELOCATION-
REQUEST
Iu-RELOCATION-
MAP-Prep-Sub-Handover resp. Iu-RELOCATION-
REQUEST-ACK
Iu-RELOCATION- COMMAND
DETECT
Iu-RELOCATION-
MAP-Send-End-Signal resp.
COMPLETE Iu-RELEASE-
CMD/COM
Release
Note:
RNS-A refers the SRNS of the UE, while RNS-B is the target RNS of the handover.
2-18
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
1) After the basic handover, the SRNS of the UE (RNS-A) makes the decision to
initiate the handover again. It sends to MSC-B the handover request
"Iu-Relocation-Required". Included in the request is the address information of
the expected access network RNS-B (TRNS).
2) On receipt of the request, MSC-B checks in the corresponding table. If the TRNS
is found to be connected to another MSC, MSC-B will generate the
corresponding MAP message "MAP-Prepare-Handover req", and send it to
MSC-A through MAP signaling.
3) On receipt of the handover request, the MSC-A finds that the TRNS is under its
own control. MSC-A then generates and sends the handover request
"Iu-Relocation-Request" to RNS-B.
4) On receipt of the message from MSC, RNS-B assigns the necessary resources
for the UE to access according to the requirement (included in the cells of the
message), and performs QoS configuration. The related resources will be
assigned at the same time at the MSC-A. After assigning the resources, RNS-B
sends to MSC-A the message "Iu-Relocation-Request-Ack".
5) The MSC-A then generates and sends the MAP message
"MAP-Prep-Sub-Handover resp" to MSC-B through the MAP signaling, indicating
that it is ready for the subsequent handover.
6) MSC-B then sends to RNS-A the handover command "Iu-Relocation-Command",
asking the UE to start handover.
7) The UE then starts to access RNS-B. Upon the detection of the access, RNS-B
sends to MSC-A the message "Iu-Relocation-Detect". After the access is
completed, RNS-B sends to MSC-A the message "Iu-Relocation-Complete",
indicating that the access is complete.
8) MSC-A sends to MSC-B the message "MAP-Send-End-Signal resp", indicating
that the subsequent handover is completed. The MAP signaling exchange
between the two is then stopped. Afterward, MSC-A will release the trunk circuit
set up with MSC-B during the basic handover.
9) After receiving the "MAP-Send-End-Signal resp", MSC-B concludes that the
handover is completed. It asks RNS-A to release the resources occupied by that
UE.
Note:
The RNS-B after the handover becomes the SRNS of that UE. If handover occurs again, the RNS-B will
play the role of RNS-A then.
2-19
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Figure 2-16 shows the procedure of the subsequent handover to third-party MSC.
RNS-B RNS-B'
3G_MSC-B' VLR-B'
Iu-RELOCATION-
REQUIRED
MAP-Prep-Sub-Handover req.
MAP-Prepare-Handover req. MAP-Allocate-Handover-Number req.
Iu-RELOCATION-
REQUEST
Iu-RELOCATION-
REQUEST-ACK MAP-Send-Handover-Report req.
MAP-Prepare-Handover resp.
IAM
MAP-Send-Handover-Rep. resp. (1)
ACM
MAP-Prep-Sub-Ho resp.
Iu-RELOCATION-CMD
Iu-RELOCATION-
DETECT
MAP-Process-Access-Signalling req.
Iu-RELOCATION-
COMPLETE
MAP-Send-End-Signal req.
Answer
Release
MAP-Send-End-Signal resp.
Iu-RELEASE-CMD/COM
(end of call)
Release
MAP-Send-End-Signal resp.
1) After the basic handover, the SRNS of the UE (RNS-A) makes the decision to
initiate the handover again. It sends to MSC-B the handover request
"Iu-Relocation-Required". Included in the request is the address information of
the expected access network RNS-B' (TRNS).
2) On receipt of the request, MSC-B checks in the corresponding table. If the TRNS
is found to be connected to another MSC, MSC-B will generate the
corresponding MAP message "MAP-Prep-Sub-Handover req.", and send it to
MSC-A through MAP signaling.
3) On receipt of the handover request, the MSC-A finds that the TRNS is in another
MSC (MSC-B'). MSC-A then generates the message "MAP-Prep-Handover req"
and sends it to MSC-B' through the MAP signaling.
2-20
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
2-21
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
The MSC-B' after the handover plays the role of MSC-B during the basic inter-MSC handover. If
handover occurs again, the target MSC will play the role of MSC-B' then.
The inter-system handover is the handover of MS/UE from UMTS to GSM, or from
GSM to UMTS. To support the inter-system handover, the GSM system should be
able to recognize the RNC ID of UMTS, and UMTS should be able to recognize the
cell ID of GSM. At the same time, the systems should support the conversion of
service quality parameters (2G channel type and 3G QoS) between them.
In terms of the system, the inter-system handover is divided into two types: The
handover from UMTS to GSM and the handover from GSM to UMTS.
However, there will be many more types if the handover modes are considered:
Intra-MSC handover from UMTS to GSM
Intra-MSC handover from GSM to UMTS
Inter-MSC handover from UMTS to GSM
Inter-MSC handover from GSM to UMTS
Subsequent handover back to MSC-A UMTS cell after UMTS-GSM handover
Subsequent handover back to MSC-A GSM cell after GSM-UMTS handover
Subsequent handover to MSC-B' UMTS cell after UMTS-GSM handover
Subsequent handover to MSC-B' GSM cell after GSM-UMTS handover
There are two key factors in inter-system handover:
First, The RNS of UMTS should be able to recognize the GSM cells, and the BSS of
GSM should be able to recognize the UMTS cells. In addition, the MSC should
support both UMTS and GSM cells, and be capable of generating messages that
meet UMTS and GSM protocols respectively.
Second, The MSC should support the conversion of UMTS and GSM service quality
parameters. To be more specific, the MSC should be able to convert and map
between the GSM Channel Type and the UMTS QoS, so that subscribers can obtain
services of the same quality after the handover.
The inter-system handover involves primarily the MSC adaptation for UMTS and
GSM access networks. Therefore, four basic inter-system handover procedures are
described below. Other procedures are the combination and extension of these four
basic procedures.
2-22
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Figure 2-17 shows the procedure of intra-MSC handover from UMTS to GSM.
UE MS
RNS-A 3G_MSC-A BSS-B
Iu-Relocation-Required
A-Handover-Request
A-Handover-Request-Ack
Iu-Relocation-Command
RRC-HO-Command
RI-HO-Access
A-Handover-Detect
RI-HO-Complete
A-Handover-Complete
Iu-Release-Command
Iu-Release-Complete
1) The access network RNS-A of the MS/UE makes the decision to initiate the
handover procedure. It sends to its MSC (MSC-A) the handover request
(Iu-Relocation-Required). Included in the handover request is the address
information of the expected access network BSS-B, usually the Cell Global ID
(CGI) of the target cell.
2) On receipt of the request, MSC-A checks in the corresponding table. If the target
cell is found to be in the BSS under its own control, MSC-A will generate the
corresponding GSM handover request message "A-Handover-Request" and
send it to BSS-B. While structuring this message, MSC performs the protocol
interworking between UMTS and GSM systems.
3) On receipt of the message from MSC, BSS-B assigns the necessary resources
for the MS/UE to access according to the corresponding requirement (included in
the cells of the message), and performs channel selection to ensure the service
quality.
4) After assigning the related resources, BSS-B sends to MSC-A the
"A-Handover-Request-Ack" message, indicating that the resources assignment
is completed and the BSS is ready for the MS/UE to access.
5) On receipt of the acknowledgement, MSC-A generates the UMTS handover
command "Iu-Relocation-Command" and sends the message to RNS-A. RNS-A
in turn sends it in the message "RRC-HO-Command" to the MS/UE, asking it to
access the new service area. In this process, some information (recognizable to
RNS-A) used to instruct the MS/UE to conduct radio access will be carried in the
GSM message "A-Handover-Request-Ack". Such information is transparent to
MSC. MSC just needs to put the information into UMTS handover message and
sends it to RNS-A.
2-23
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
The BSS-B after the handover becomes the Serving BSS (SBSS) of that MS. If handover occurs again,
the BSS-B will play the role of BSS-A then.
Figure 2-18 shows the procedure of intra-MSC handover from GSM to UMTS.
MS UE
BSS-A 3G_MSC-A RNS-B
A-Handover-Required
Iu-Relocation-Request
Iu-Relocation-Request-Ack
A-Handover-Command
RI-HO-Command
Iu-Relocation-Detect
RRC-HO-Complete
Iu-Relocation-Complete
A-Clear-Command
A-Clear-Complete
1) The access network BSS-A of the MS/UE makes the decision to initiate the
handover procedure. It sends to its MSC (MSC-A) the handover request
(A-Handover-Required). Included in the handover request is the address
information of the expected access network RNS-B, usually the ID of the target
RNC.
2) On receipt of the request, MSC-A checks in the corresponding table. If the target
cell is found to be in the RNS under its own control, MSC-A will generate the
corresponding UMTS handover request message "Iu-Relocation-Request" and
send it to RNS-B. While structuring this message, MSC performs the protocol
interworking between UMTS and GSM systems.
2-24
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
3) On receipt of the message from MSC, RNS-B assigns the necessary resources
for the MS/UE to access according to the requirement (included in the cells of
the message), and performs QoS configuration.
4) After assigning the related resources, RNS-B sends to MSC-A the
"Iu-Relocation-Request-Ack" message, indicating that the resources assignment
is completed and the RNS is ready for the MS/UE to access.
5) On receipt of the UMTS acknowledgement, MSC-A generates the GSM
handover command "A-Handover-Command" and sends the message to BSS-A.
BSS-A in turn sends it in the message "RI-HO-Command" to the MS/UE, asking
it to access the new service area. In this process, some information
(recognizable to BSS-A) used to instruct the MS/UE to conduct radio access will
be carried in the UMTS message "Iu-Relocation-Request-Ack". Such information
is transparent to MSC. MSC just needs to put the information into GSM
handover message and sends it to BSS-A.
6) RNS-B sends to MSC-A the message "Iu-Relocation-Detect" when it detects that
the MS/UE is accessing. After the access, RNS-B sends to MSC-A the message
"Iu-Relocation-Complete", indicating that it is able to provide service for the
MS/UE.
7) After receiving the handover complete message from RNS-B, MSC-A sends the
message "A-Clear-Command" to BSS-A, asking it to release the related
resources. After releasing the resources, BSS-A returns the message
"A-Clear-Command" to MSC-A, ending the handover procedure.
Note:
The RNS-B after the handover becomes the SRNS of that MS/UE. If handover occurs again, it will play
the role of RNS-A then.
Figure 2-19 shows the procedure of inter-MSC handover from UMTS to GSM.
2-25
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
UE/MS/RNS-A BSS-B/MS/UE
IAM
MAP-Send-Handover-Report resp. (1)
Iu-RELOCATION-
ACM
COMMAND
MAP-Process-Access-Sig req. A-HO-DETECT
RELEASE
End of call
MAP-Send-End-Signal resp.
1) The access network RNS-A of the MS/UE makes the decision to initiate the
handover procedure. It sends to its MSC (MSC-A) the handover request
"Iu-Relocation-Required". Included in the handover request is the address
information of the expected access network BSS-B, usually the CGI of the target
cell.
2) On receipt of the request, MSC-A checks in the corresponding table. If the target
BSS is found to be connected to another MSC (MSC-B), MSC-A will pack the
handover request into a cell, put the cell into the corresponding MAP message
"MAP-Prepare-Handover req", and send it to MSC-B through the MAP signaling.
In this procedure, MSC-A will map the UMTS message into GSM message while
packing the handover request, so as to make the message become recognizable
to GSM system.
3) On receipt of the message, MSC-B generates the message
"A-Handover-Request" and sends it to the target BSS.
4) BSS then assigns the corresponding resources for the MS/UE. MSC-B also
assigns the related resources at the same time. After assigning the resources,
BSS sends to MSC-B the message "A-Handover-Request-Ack". During or after
assigning the resources, MSC-B will also send to its VLR (VLR-B) the message
"MAP-Allocate-Handover-Number req", asking for the handover number. VLR-B
will then send the assigned handover number to MSC-B in the message
"MAP-Send-Handover-Report req".
5) After receiving the acknowledgement (from RNS-B) and the handover number,
MSC-B sends to MSC-A the message "MAP-Prep-Handover-resp", indicating
that it is ready for the handover. Included in this message is the handover
number, with which MSC-A can find the route to MSC-B. Besides, the message
2-26
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
Note:
1) Anytime after receiving the IAM message from MSC-A, MSC-B can use the MAP signaling
"MAP-Send-Handover-Report resp" to notify VLR-B to release the handover number, so that it can be
reused next time.
2) The BSS after the handover becomes the SBSS of that MS/UE. If handover occurs again, the BSS
will play the role of BSS-A.
Figure 2-20 shows the procedure of inter-MSC handover from GSM to UMTS.
2-27
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
UE/MS/BSS-A RNS-B/UE/MS
Iu-RELOCATION-REQUEST
Iu-RELOCATION-REQUEST-ACK
IAM
MAP-Send-Handover-Report resp. (1)
A-HO-COMMAND ACM
ANSWER
RELEASE
End of call
MAP-Send-End-Signal resp.
1) The access network BSS-A of the MS/UE makes the decision to initiate the
handover procedure. It sends to its MSC (MSC-A) the handover request
(A-Handover-Required). Included in the handover request is the address
information of the expected access network RNS-B, usually the ID of the target
RNC.
2) On receipt of the request, MSC-A checks in the corresponding table. If the TRNS
(RNS-B) is found to be connected to another MSC (MSC-B), MSC-A will pack
the handover request into a certain cell, put the cell into the corresponding MAP
message "MAP-Prepare-Handover req", and send it to MSC-B through the MAP
signaling.
3) On receipt of the message, MSC-B extracts the GSM message
"A-Handover-Request". Based on this message, MSC generates the
corresponding UMTS handover request "Iu-Relocation-Request" and sends it to
the RNS-B. In this procedure, MSC-B will map the GSM message into the UMTS
message.
4) Upon the reception of the handover request, RNS-B assigns the corresponding
resources for the MS/UE. MSC-B also assigns the related resources at the same
time. After assigning the resources, RNS-B sends to MSC-B the message
"Iu-Relocation-Request-Ack". During or after assigning the resources, MSC-B
will also send to its VLR (VLR-B) the message "MAP-Allocate-Handover-Number
req", asking for the handover number. VLR-B will then send the assigned
handover number to MSC-B in the message "MAP-Send-Handover-Report req".
5) After receiving the acknowledgement (from RNS-B) and the handover number,
MSC-B sends to MSC-A the message "MAP-Prep-Handover-resp", indicating
2-28
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
that it is ready for the handover. Included in this message is the handover
number, with which MSC-A can find the route to MSC-B. Besides, MSC-B will
put the message "A-Handover-Request-Ack" (packed in the PDU format) into
this message.
6) MSC-A then sends to MSC-B the IAM to request for the corresponding trunk
circuit. After occupying the trunk circuit, MSC-B returns to MSC-A the ACM. The
occupation of the trunk circuit is then completed.
7) After the setup of inter-MSC circuit, MSC-A generates the message
"A-Handover-Command" according to the GSM message
"A-Handover-Request-Ack" extracted from the message
"MAP-Prep-Handover-resp". MSC-A sends the message to BSS-A, asking the
MS/UE to start the handover.
8) The MS/UE then starts to access RNS-B. Upon the detection of the access,
RNS-B sends to MSC-B the message "Iu-Relocation-Detect". MSC-B converts
the message into the corresponding GSM message "A-Handover-Detect", packs
the message into the MAP signaling "MAP-Process-Access-Sig req" and sends it
to MSC-A. MSC-B then waits for the handover complete message. On receipt of
the corresponding MAP signaling, MSC-A will also waits for the handover
complete message.
9) After the MS/UE accesses RNS-B, RNS-B sends the handover complete
message to MSC-B. MSC-B converts the message into the corresponding GSM
message "A-Handover_Complete", packs the message into the MAP signaling
"MAP-Send-End-Signal req" and sends it to MSC-A. The MSC-B then starts
some post-handover operations, such as sending the message "Answer" to the
inter-MSC circuit.
10) After receiving the message from MSC-B, MSC-A concludes that the handover is
completed. It starts releasing the resources occupied by that MS/UE at BSS-A
by sending to the BSS-A the message "A-CLR-CMD". BSS-A returns the
message "A-CLR-COMP" to MSC-A after the releasing. The inter-MSC circuit
will be maintained until the session is over. Then, MSC-A will release the circuit,
use the MAP signaling "MAP-Send-End-Signal resp" to notify MSC-B of the
release, and stop the exchange of MAP signaling with MSC-B.
Note:
1). Anytime after receiving the IAM message from MSC-A, MSC-B can use the MAP signaling
"MAP-Send-Handover-Report resp" to notify VLR-B to release the handover number, so that it can be
reused next time.
2). The RNS-B after the handover becomes the SRNS of that MS/UE. If handover occurs again, the
RNS-B will play the role of RNS-A then.
2-29
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Mobility Management
2-30
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
3.1 Overview
The security management of MSOFTX3000 at MSC side includes authentication,
encryption, integrity protection, and TMSI reallocation.
3.2 Authentication
MSOFTX3000 authentication function includes GSM authentication and UMTS
authentication.
I. Definition
The GSM authentication function is to define whether a user has rights to access
Public Land Mobile Network (PLMN). It is done by comparing authentication response
of MS and the set of three Authentication Vectors (AV) provided by Authentication
Center (AuC). Through authentication, the network operator can prevent illegal
subscriber (using duplicated International Mobile Subscriber Identity (IMSI) and
Individual Subscriber Authentication Key (Ki)) from using any form of service.
3-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
III. Principle
The basic function of AuC is to generate the AV trio: RAND, Signed Response to
RAND (SRES), and Kc. Among which
RAND is generated by RAND generator.
SRES is resulted from RAND and Ki in A3 algorithm.
Kc is resulted from RAND and Ki in A8 algorithm.
After generated, the AV trio is stored in HLR. When authentication is required,
MSC/VLR of the MS service region will load at least one AV trio from HLR.
Refer to Figure 3-1 for the principle of authentication.
HLR/AUC
AUC HLR
VLR SIM
IMS (n) KI (N)
KI (IMSI)
RAND
A8 A3
generator Authentication
request
RAND KC SRES
KI (IMSI)
A3
KI (IMSI) + RAND SRES RAND 16byte
A8 KI 16byte
KI (IMSI) + RAND KC
kc 8byte
A5 SERS 4byte
M + KC KC (M)
(MS/BSS) CKSN The last three bits of 1 byte
A5 M
KC (M) + KC
(MS/BSS)
3-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
1) MS indicates the stored CKSN in the first COMPLETE LAYER3 INFO (call
establishment/location update/supplementary service (SMS)).
2) When MSC receives COMPLETE LAYER3 INFO message, it decides whether
authentication is needed based on data configuration. If authentication is not
needed, the procedure is skipped. Otherwise, check if CKSN is consistent with
the value stored in MS in the access process. If not consistent, MSC sends
PROCESS ACCESS REQUEST to VLR to initiate an authentication procedure;
otherwise, the procedure is skipped
3) VLR check if there is an AV trio, (or reuse of the AV trio is permitted). If no AV is
found, VLR will retrieve one from HLR. HLR receives the AV retrieval request, it
requests AuC (usually integrated in HLR) to generate five AVs. Then, HLR
returns the five AVs to VLR in AUTHENTICATION RESPONSE message. If there
is still any AV trio in VLR, HLR will not participate in the procedure, and VLR will
initiate AUTHENTICATION REQUEST to MS directly.
4) VLR sends AUTHENTICATION REQUEST message to invoke authentication
procedure. The request includes a RAND and a CKSN.
5) Upon receiving the request message, MS generates an SRES resulting from Ki
and the RAND in A3 authentication algorithm, and a Kc resulting from Ki and the
RAND in A8 ciphering algorithm. MS sends SRES and Kc back to VLR in
AUTHENTICATION RESPONSE message.
6) When generating authentication vector set at network side, the same algorithm is
adopted. An SRES is generated resulting from Ki and RAND in A3 algorithm.
Then VLR compares the value of two SRESs. If they are the same, authentication
3-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
I. Definition
3-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
AMF
Authentication and key Management Field (AMF) is indicates and generates the
algorithm and ciphering key for a certain AV. It indicates the maximum differential
value between SQNMS and SQN. If SQN-SQNMS<AMF, and SQN>SQNMS, SQN is
valid. USIM restricts CK with a validity period. The period can be adjusted in AMF.
AK
AK encrypts SQN in AUTN. It is obtained from RAND and K (CK constantly shared
between AuC and HE). Alternatively, set AK=0.
MAC
Message Authentication Code (MAC) is obtained from the calculation of SQN, RAND,
AMF and K. The received end shall re-calculate MAC to compare with the received
one, judging if MAC failed.
II. Principle
When user accesses the network, if authentication is required, VLR/SGSN will select
an unused AV quintet, and initiate authentication request to UE. The request message
includes RAND, AUTN and CKSN of selected authentication vector. USIM checks if
AUTN is accepted. If not, then authentication fails; otherwise, work out RES, CK and
IK, and return RES to VLR/SGSN. VLR/SGSN compares the RES returned from UE
with XRES in authentication vector set. IF they are the same, authentication succeeds;
otherwise, authentication fails. On successful authentication, the CK and IK that UE
calculated and stored in USIM, and the CK and IK that VLR/SGSN stored in
authentication vector set can be used for subsequent encryption procedures. If
authentication fails, UE will delete the stored CK and IK.
3-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
UMTS authentication procedure is initiated and controlled by the network, yet UE can
deny network authentication challenge.
1) UE indicates the stored CKSN in the first COMPLETE LAYER3 INFO (call
establishment/location update/supplementary service (SMS))
2) MSC/SGSN receives COMPLETE LAYER3 INFO message, checks if CKSN
value (that UE used in previous implementation) is the valued stored in UE. If so,
authentication procedure is skipped; otherwise, MSC/SGSB will send request to
VLR for authentication parameters.
3) If there is no quintet available in VLR, VLR will initiate a request to HLR/AuC for
authentication vector set. HLR receives the authentication set retrieval request, it
requests AuC (usually integrated in HLR) to generate five sets of authentication
vectors. Then, HLR returns the five sets to VLR in AUTHENTICATION
RESPONSE. If there is still any authentication vector quintet in VLR, HLR will not
participate in the procedure, and VLR will initiate AUTHENTICATION REQUEST
to MS directly.
4) MSC/SGSN sends UE an AUTHENTICATION REQUEST to invoke
authentication procedure. The request includes an RAND, an AUTN and a CKSN.
5) UE responses with an AUTHENTICATION RESPONSE message:
UE check AUTN. If the MAC is the same as the calculated one, UE will then
check if the range of SQN, which is calculated based on AUTN, is correct. If SQN
is correct, UE will make out RES (or RES+RES_EXT) based on RAND, and send
it to VLR in AUTHENTICATION RESPONSE message.
In UMTS authentication challenge, the newly generated CK and IK should
overwrite the original ones, and should be stored in USIM with CKSN.
3-6
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
I. Definition
A dual-mode MS refers to the mobile phone that can be used in two different mobile
communication systems. The basic architecture is that under the control of central
control unit, it adopts the same man-machine interface, and the same antenna, but
two separate systems. When the MS is powered on, the central control unit detects
between the two systems, and selects a path. It can select either mobile
communication system as specific environment or operation requires. Here, the
dual-mode MS is compatible with GSM (2G) and UMTS (3G). R99+ME is a dual-mode
MS that can access BSS as well as UTRAN.
Related concepts
Authentication and key agreement (AKA) of UMTS refers to the authentication
and encryption procedures of sending authentication vector quintet. AKA of GSM
refers to the authentication and encryption procedures of sending authentication
vector trio.
3-7
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
When the dual-mode MS opens an account, it can only be UMTS or GSM. The GSM
user requires authentication vector trio in GSM authentication; while UMTS user
requires the quintet in UMTS authentication. When the dual-mode MS roams between
GSM and UMTS network, it will apply authentication vector trio or quintet depending
on the network it situates in. In addition, it also requires conversion between trio and
quintet.
Opening an account of UMTS user
Figure 3-4 illustrates the AKA of UMTS user.
Release 99+
CK, IK--> Kc
HLR/AuC RES -->SRES
Quintets Triplets
CK, IK CK, IK Kc Kc
Kc Kc
USIM
When R99+UE UMTS user with USIM accesses UTRAN, AKA of UMTS is adopted
When R99+UE UMTS user with USIM accesses GSM BSS, and VLR is R99+, AKA of
UMTS is adopted Kc is calculated based on IK and CK.
3-8
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
When R99+UE UMTS user with USIM accesses GSM BSS, and VLR is R98-, AKA of
GSM is adopted. Kc of ME is calculated based on IK and CK. R98- mode VLR/SGSN
uses stored Kc and RES.
Opening an account of GSM user
Figure 3-5 illustrates the AKA of GSM user.
Triplets Triplets
Kc Kc Kc Kc
SIM
When R99+UE GSM user with SIM accesses UTRAN, AKA of GSM is adopted. IK and
CK used in access network and MS is calculated based on Kc of GSM.
When R99+UE GSM user with SIM accesses GSM BSS, and VLR/SGSN is R99+,
AKA of GSM is adopted.
When R99+UE GSM user with SIM accesses GSM BSS, and VLR/SGSN is R98-,
AKA of GSM is adopted.
3.3 Encryption
The purpose of encryption is to ensure transmission security of user data in the air. All
encryption and decryption implementations are done in the air.
GSM encryption: The encryption and decryption of user information is an “exclusive
or” operation on 114-bit wireless pulse code and 114-bit encryption serial code. It
applies A5 encryption algorithm. The algorithm calculates based on Kc of the MS and
the frame number of the pulse string. Kc is calculated based on RAND (in
authentication request message), and Ki in A8 algorithm.
3-9
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
UE/UTRAN CN
SECURITY MODE COMMAND
3-10
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Security Management
3-11
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
The following procedures are based on calls between two local office users. See
Figure 4-1 for the networking.
MSC
SERVER
/VLR
MGW
RNC-O RNC-T
UE-O UE-T
The procedures for a mobile subscriber calling another mobile subscriber are shown
in Figure 4-2.
Note:
MSC Server and VLR are combined, so interface B is an internal one and the messages at interface B
are internal messages.
4-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
CM_Service_Req(Initial UE)
MAP_SEND_AUTHENTICATION_INFO
MAP_SEND_AUTHENTICATION_INFO_ACK
COMMON ID
CM_SERVERICE_ACCEPT
SETUP
CALL PROCEEDING
PREP BEARER
PREP BEARER
User plane
RAB ASSIGNMENT REQUEST
bearer
establishment RADIO BEARER SETUP
procedure at
caller side RADIO BEARER SETUP COMPLETE
BEARER ESTABLISHMENT
4-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
MAP_SEND_ROUTING_INFORMATION
Procedure of MAP_PROVIDE_ROAMING_NUMBER
getting
roaming MAP_PROVIDE_ROAMING_NUMBER_ACK VLR
number
MAP_SEND_ROUTING_INFORMATION_ACK
PAGIN
G
PAGING RESPONSE
AUTHENTICATION REQUEST
Security
management AUTHENTICATION RESPONSE
procedure SECURITY MODE COMMAND
(optional)
SECURITY MODE COMPLETE
COMMON ID
SETUP
CALL CONFIRMED
PREP BEARER
PREP BEARER
4-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
ALERTING
SENDTONE
SENDTONE
CONNECT
STOP TONE
STOP TONE
CONNECT
CONNECT ACK
DISCONNECT
DISCONNECT
RELEASE
RELEASE COMPLETE
IU_RELEASE_COMMAND
Caller release
BEARER RELEASE
procedure
IU_RELEASE_COMPLETE
RELEASE_TERM
RELEASE_TERM
RELEASE
RELEASE COMPLETE
IU_RELEASE_COMMAND
Callee release
procedure BEARER RELEASE
IU_RELEASE_COMPLETE
RELEASE_TERM
RELEASE_TERM
4-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Note:
1) The difference between early assignment and late assignment is the time when a Traffic Channel
(TCH) is allocated. For the called party, early assignment refers to assignment performed before
off-hook while late assignment refers to assignment performed after off-hook. For the calling party,
assignment is performed before ALERTING message in an early assignment procedure while
assignment is performed after ALERTING message in a late assignment procedure.
2) Early assignment shortens call connection delay and increases call completion rate. Late assignment
avoids TCH resources from being occupied during alerting and thus improves the utilization ratio of TCH
resources.
1) The network receives the PAGING RESPONSE message from the called party.
If authentication is not performed, skip to Step 3.
4-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
1) During the conversation, if the calling party releases the call, the calling UE
sends the DISCONNECT message to the network and the network notifies the
called party of the disconnection message.
2) The called party sends the RELEASE message to the network to release the
resources on the current transaction. The network sends the RELEASE
message to the calling party to release the resources on the current transaction.
Upon receipt of the RELEASE message, the calling party responds with the
RELEASE COMPLETE message.
3) The network actively sends the IU RELEASE COMMAND message to start the
release of the signaling plane.
4) The network sends to MGW the RELEASE TERMINATION message to release
the user plane resources.
4-6
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
MSC
SERVER
/VLR
PSTN USER
UE-O
The procedures for a mobile subscriber calling a PSTN subscriber are shown in
Figure 4-4.
4-7
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
CM_Service_Req(Initial UE)
MAP_SEND_AUTHENTICATION_INFO
MAP_SEND_AUTHENTICATION_INFO_ACK
COMMON ID
CM_SERVERICE_ACCEPT
SETUP
CALL PROCEEDING
PREP BEARER
PREP BEARER
User plane
RAB ASSIGNMENT REQUEST
bearer
establishment RADIO BEARER SETUP
procedure at
caller side RADIO BEARER SETUP COMPLETE
BEARER ESTABLISHMENT
4-8
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
IAI
ACM
ALERTING
SEND TONE
SEND TONE
ANC
STOP TONE
STOP TONE
CONNECT
CONNECT ACK
通话
DISCONNECT
CLF
RELEASE
RELEASE COMPLETE
RLG
IU_RELEASE_COMMAND
Release
procedure BEARER RELEASE
IU_RELEASE_COMPLETE
RELEASE_TERM
RELEASE_TERM
RELEASE_TERM
RELEASE_TERM
a
4-9
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
4) The calling side starts the establishment of user plane bearer: MSC Server
sends the Prepare Bearer Req message to MGW. MGW allocates ATM
resources dynamically, and returns the Prepare Bearer Rsp message containing
TerminationId (T1). Then MSC Server invokes the RAB assignment procedure to
RNS-O. RNS-O establishes the ATM bearer resources at the access side
together with MGW through the BEARER ESTABLISHMENT procedure.
5) GMSC Server sends an initial address message with information (IAI) to PSTN.
6) After receiving the IAI, PSTN returns an address complete message (ACM).
After receiving the ACM, GMSC Server sends the SEND TONE message to
MGW for playing the ring back tone.
7) After the called party picks up the phone, the called UE sends an answer signal,
charge (ANC) to the network. GMSC Server sends the STOP TONE message to
MGW for stopping the ring back tone. After the calling party picks up the phone,
both parties talk with each other.
8) After the conversation, if the calling party hooks on first, the calling UE sends a
DISCONNECT message to GMSC Server. Then GMSC Server sends a clear
forward signal (CLF) message to notify PSTN to clear the connection. After
clearing the connection, PSTN returns a release guard signal (RLG) to GMSC
Server.
9) GMSC Server sends a RELEASE message to the calling party to release the
transaction resources. A RELEASE COMPLETE message is the response to the
RELEASE message.
10) The network sends to MGW the RELEASE TERMINATION message to release
the user plane resources.
4-10
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
PAGING
PAGE RESPONSE
AUTHENTICATION REQUEST
AUTHENTICATION RESPONSE
BEAR ESTABLISHMENT
RAB ASSIGNMENT RESPONSE
ALERTING ACM
CONNECT ANC
CONNECT ACKNOWLEDGE CONNECT ACKNOWLEDGE
CALL
DISCONNECT
CLF
RELEASE
RLG
RELEASE COMPLETE
IU RELEASE COMMAND
BEARER RELEASE
IU RELEASE COMPLETE
RELEASE_TERM
RELEASE_TERM
RELEASE_TERM
RELEASE_TERM
4-11
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
2) GMSC Server gets routing information from HLR. After getting the mobile station
roaming number (MSRN) of the called party, GMSC Server sends the IAI to
MSC Server. MSC Server then notifies VLR of the incoming call.
3) VLR fetches data about the incoming call and initiates a paging procedure. After
the network receives a paging response from the called UE, skip to Step 5 if
authentication, ciphering, or TMSI reallocation procedures do not happen.
4) The network initiates authentication, ciphering, and TMSI reallocation
procedures, during which initiation of getting authentication set information from
HLR/AUC may be required.
5) The network sends a SETUP message to the called UE.
6) Upon receipt of the CALL CONFIRMED message from the called UE, MSC
Server initiates a procedure of establishing user plane bearer: MSC Server
sends the Prepare Bearer REQ message to MGW. MGW allocates ATM
resources dynamically, and returns the Prepare Bearer Rsp message containing
TerminationId. Then MSC Server invokes the RAB assignment procedure to
RNS. RNS establishes the ATM bearer resources at the access side together
with MGW through the BEARER ESTABLISHMENT procedure.
7) The transport control plane and the user plane are established during the
assignment procedure. After RAN receives an ESTABLISH CONFIRM message
regarding the user plane, it sends a RAB assignment response message.
8) At the same time, MSC Server establishes the calling user plane bearer. The
called UE hooks off. MSC Server receives an ALERTING message and then
sends an ACM to the calling party.
9) The network awaits off-hook of the called party, that is, the CONNECT message,
and sends a CONNECT message to the calling party. The calling party returns a
CONNECT ACK. The network sends a CONNECT ACK to the called party. Then
the calling and called parties enter the conversation status.
10) During the conversation, if the called party hooks on, the called UE sends a
DISCONNECT message to the network and the network notifies the calling party
of the disconnection message. After releasing the call, the calling UE sends a
RLG to the network. The network sends a RELEASE message to the called
party for the purpose of releasing the transaction resources. The network
actively sends an IU RELEASE COMMAND to release the signaling plane
resources and a RELEASE TERMINATION message to MGW to release the
user plane resources.
4.4 Pre-paging
Pre-paging is a network function. Before GMSC Server originates to VMSC Server a
call setup request, VMSC Server initiates a paging procedure to the called UE when
HLR asks VMSC Server for the roaming number. Then VMSC Server sends the
roaming number to HLR. In this way, a radio connection between VMSC Server and
4-12
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
UE has been established when VMSC Server receives the call setup request from
GMSC Server.
A pre-paging procedure initiated during getting the roaming number makes it possible
to know whether or not the called party can be paged before a roaming number is
allocated. These actions make contributions to saving network resources as they
avoid such a possible case that the called party cannot be connected when GMSC
Server accesses VMSC Server according to the roaming number. In addition, data
restoration happens (if needed) before pre-paging, for the purpose of increasing the
efficiency of incoming calls.
The pre-paging procedure is shown in Figure 4-6.
PAN(Prepage)
Paging
paging
PAN_ACK
SRI_ACK
4-13
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Note:
The following call forwarding procedures are activated before MGW makes the selection. After the calls
are forwarded to different offices according to the actual situations, the user plane bearer is established.
Refer to sections 6.2.2 and 6.2.4 for the procedures for establishing user plane bearer for details.
4.5.1 CFU
GMSC MSC
MSa/TEa HLRb PSTN
Server Server b
Set-up
Info request
Info ack
OR1:N Set-up
OR1:Y Set-up
Notification
OR2:Y
As shown in Figure 4-7, the related message will be routed to MSC Server b if
forwarding is not required.
If the call is set to be forwarded to a PSTN subscriber, GMSC Server will forward the
concerned message to PSTN.
4-14
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Set-up
Info request
Info ack
OR1:N Set-up
4.5.2 CFB
CFB happens when the called party is busy or rejects the incoming call. When CFB is
activated, the forwarding party can still make calls.
It is divided into Network Determined User Busy (NDUB) and User Determined User
Busy (UDUB).
z Forwarded to a PSTN subscriber: NDUB
4-15
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
GMSC MSC
MSa/TEa HLRb VLRb MSb LEc
Server Server b
Set-up
Info-req
Info-ack
Set-up
Info request
Page MS
Busy Subscriber
Impossible Call Completion
OR1:N
Release
Release Connect to following address
OR1:Y Set-up
OR2:Y Notification
Notification
OR3:Y
4-16
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
GMSC MSC
MSa/TEa HLRb VLRb MSb LEc
Server Serverb
Set-up
Info-req
Info-ack
Set-up
Info request
Page MS
Set-up
UDUB
Busy Subscriber
4-17
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Set-up
Info-req
Info-ack
Set-up
Info request
Page MS
Busy Subscriber
Set-up
Info-req
Info-ack
Set-up
Info request
Page MS
Set-up
UDUB
Busy Subscriber
Impossible Call Completion
OR1:N
Release Release
Connect to following address
OR1:Y Information Req
Information Ack
Set-up
Notification
OR2:Y
4-18
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
The procedure of call forwarding to a mobile subscriber on user determined user busy
has the almost same activities as that of call forwarding to a PSTN subscriber on user
determined busy except that the call connection continues at MSC Server b in the
former procedure. The continuing process has been described in the procedure of call
forwarding to a mobile subscriber on network determined busy.
4.5.3 CFNRy
After a subscriber subscribes and activates this service, all calls relating to basic
services and all calls relating to certain particular services made to the subscriber will
be forwarded if no reply is received.
GMSC MSC
MSa/TEa HLRb VLRb MSb LEc
Server Server b
Set-up
Info-req
Info-ack
Set-up
Info request
Info ack
Set-up
1) After access, MSa originates a SETUP message to GMSC Server to start the
call setup procedure.
2) GMSC Server initiates the procedure of getting routing information to the MSb
(called party) resident HLRb with an INFO-REQ message. Upon receipt of the
routing information, HLRb returns an INFO-ACK message.
3) According to the routing information returned by HLRb, GMSC Server sends a
SET-UP message to MSb resident VMSC Server, that is, MSC Server b.
MSC Server b obtains the user data of the incoming call from VLRb. After VLRb
responds with the INFO ACK message, MSC Server b invokes a paging and call
4-19
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
setup procedure to MSb. MSb responds to the paging request. At the same time,
MSC Server b starts a timer of no response duration.
4) If the called party does not answer the call, MSC Server b initiates the release
procedure after the timer times out. At the same time, MSC Server b notifies
VLRb of the release with the INFO REQ message.
5) VLRb judges whether the call needs to be forwarded. If there is no forwarding
data, the call is released. If there is, VLRb sends the forwarding data to MSC
Server b. MSC Server b continues the call connection to the forwarded-to
subscriber.
4-20
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Set-up
Info-req
Info-ack
Set-up
Info request
Info ack
Set-up
Call Conf
Info Req
4-21
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
4.5.4 CFNRc
GMSC MSC
MSa/TEa HLRb VLRb MSb LEc
Server Server b
Set-up
Info-req
Provide Roam No
Info-ack Roam No
Set-up
Info request
Page MS
Paging
Absent Subscriber
No response
Impossible Call Completion
OR1:N
Release
Release
Connect to following address
OR1:Y Set-up
Notification
OR2:Y
1) MSa sends a SET-UP message to GMSC Server. GMSC Server requests HLRb
to provide routing information. HLRb asks VLRb for roaming number.
2) GMSC Server sends a SETUP message to MSC Server b. MSC Server b
requests VLRb for user data of the incoming call, which triggers VLRb to initiate
a paging procedure. However, a paging response is not received. MSC Server b
returns a PAGE RESPONSE with the cause value “absent subscriber”.
3) At this time, VLRb makes a judgment whether or not forwarding happens. If call
forwarding does not happen, the call ends. Otherwise, VLRb continues to
connect the call according to the forwarding data.
4-22
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Call Procedures
Set-up
Info-req
Provide Roam No
Roam No
Info-ack
Set-up
Info request
Page MS
Paging
Absent Subscriber
No response
Impossible Call Completion
OR1:N
Release
Release Connect to following address
OR1:Y Info req
Info ack
Set-up
Notification
OR2:Y
1) MSa sends a SET-UP message to GMSC Server. GMSC Server requests HLRb
to provide routing information. HLRb asks VLRb for roaming number.
2) GMSC Server sends a SETUP message to MSC Server b. MSC Server b
requests VLRb for user data of the incoming call, which triggers VLRb to initiate
a paging procedure. However, a paging response is not received. MSC Server b
returns a PAGE RESPONSE with the cause value “absent subscriber”.
3) At this time, VLRb makes a judgment whether or not forwarding happens. If call
forwarding does not happen, the call ends. Otherwise, VLRb continues to
connect the call according to the forwarding data.
4-23
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SMS Procedures
5.1 Overview
Short Message Service is one of basic telecommunication services. SMS enables the
mobile network system to provide users with a communication method different from
voice transport. A short message makes use of signaling channels of the mobile
network to transfer text information of a limited length. There are two types of SMSs,
namely peer-to-peer SMS and cell broadcast SMS.
A short message is sent from an entity to a specified called party through Short
Message Mobile Originated (SMMO) and Short Message Mobile Terminated (SMMT)
services. This is peer-to-peer SMS. The length of a single short message is 140 bytes
after coding. 160 English characters can be carried.
Cell broadcast SMS is like this: a short message is sent through BSC to all SMS
subscribers in a specified area. After coding, each page can accommodate 82 bytes
and the maximum number of pages is 15. Only peer-to-peer SMS is described in the
following section.
2.MAP_SEND_INFO_FOR_MO_SMS
7.ShortMessage 3.MAP_SEND_INFO_FOR_MO_SMS_ACK
Error(RP_ERROR)
4.MAP_MO_FORWARD_SHORT_MESSAGE(RP_DATA)
5.MAP_MO_FORWARD_SHORT_MESSAGE_ACK(RP_ACK)
6.Short Message
Acknowledgement(RP_ACK)
5-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SMS Procedures
1.MAP_SEND_ROUTING_INFO_FOR_SM
2.MAP_SEND_ROUTING_INFO_FOR_SM_ACK
3.MAP_MT_FORWARD_SHORT_MESSAGE(RP_DATA)
4.MAP_SEND_INFO_FOR_MT_SMS
5.MAP_PAGE/MAP_SEARCH_FOR_MOBILE_SUBSCRIBER
6.Page
9.MAP_SEND_INFO_FOR_MT_SMS_ACK
10.Short Message(RP_DATA))
11.Short Message
Acknowledgement(RP_ACK)
12.MAP_MT_FORWARD_SHORT_MESSAGE_ACK(RP_ACK))
1) After receiving the mobile originated short message, SMC gets the called number
from it. SMC makes use of the called number and initiates to HLR a procedure for
getting routing information.
2) Upon receipt of the routing information request, HLR retrieves information about
the subscriber in the database. A failure cause is returned to SMC if one of the
following conditions is encountered: the subscriber is absent, roaming is not allowed,
5-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SMS Procedures
ODB is active, terminated SMS is not supported, the Mobile station Not Reachable
Flag (MNRF) is set, MCEF is set, or the subscriber has been removed from the
roaming destination MSC/VLR. Otherwise, HLR returns to SMC the VMSC number
where the called party is resident. (Note: In the case that information about location of
the called MSC is valid but bit set is performed on MNRF, a failure response is
returned to SMC if the subscriber’s short message has a low priority; otherwise, the
routing information is returned.)
3) SMC delivers to VMSC a request for forwarding the short message according to
the received VMSC number.
4) Upon receipt of the forwarding request from SMC, VMSC initiates to VLR a request
for detecting SMMT user data.
5) VLR queries the existing subscription data and mobility management status. It may
be found that SMMT is not supported, MS is powered off, MNRF is set, roaming is not
allowed. If the subscriber can not be paged due to one of those reasons, MSC sends
a failure response to SMC gateway. Otherwise, initiation of a paging procedure to MS
starts in a specific location area in case of a known MS location area, or initiation of a
paging procedure starts in the whole MSC serving area in case of an unknown MS
location area.
6) MSC originates a PAGE message to MS.
7) MS returns a PAGE RESPONSE to MSC.
8) 9) 10) Upon receipt of the PAGE RESPONSE from MS, MSC initiates an access
procedure if it is required. After the access is completed, the short message is
delivered to MS through the A interface (2G) or the Iu interface (3G).
11) 12) After receiving the delivery outcome relating to the short message from MS,
MSC notifies SMC of the outcome. If several short messages are to be delivered (that
is, RP-MMS flag bit is contained in the short message forwarding request from SMC),
the connection is held and the procedures mentioned in 3) 10) 11) and 12) are
repeated. Otherwise, all connections will be released.
In the mobile terminated SMS procedure, if the short message fails to be delivered as
there is no page response, the subscriber does not reply, or due to other reasons,
SMC initiates to HLR a “short message status report” so that HLR can get information
about MSISDN of the called party and address of originated SMC. HLR stores the
information in the data record of the called party (named Message Waiting Data). Bit
set is performed on MNRF contained in HLR. In addition, SMC temporarily stores the
failed short message. When MS is found in the network again, MSC initiates to HLR a
notification that it is ready for the short message. The notification cause is “mobile
5-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SMS Procedures
station reachable”. Figure 5-3 shows the procedure of alerting SMC due to mobile
station reachable.
MS M SC VLR H LR SM C
5-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 5 SMS Procedures
stores the information in the data record of the called party (named Message Waiting
Data). Bit set is performed on MCEF contained in HLR. In addition, SMC temporarily
stores the failed short message. If MS memory capacity becomes available again
since a short message is deleted, MS sends a “memory capacity available” message
to MSC. Upon receipt of the message, MSC originates to HLR a notification that it is
ready for the short message. The notification cause is “memory capacity available”.
Figure 5-4 shows the procedure of alerting SMC due to memory capacity available.
2. MAP_READY_FOR_SM
3. MAP_READY_FOR_SM_ACK
5. MAP_ALERT_SERVICE_CENTRE
6. MAP_ALERT_SERVICE_CENTRE_ACK
5-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
O_CSI trigger
IDP
FCI
Continue
SRI PRN
PRN_ ack
SRI_ Ack (MSRN)
IA M (MSRN)
ACM
ANC
ACR
ERB(DP9)
Release Call
CAP signaling
MAP signaling
ISUP signaling
Figure 6-1 Procedure of prepaid subscriber calling ordinary WCDMA subscriber (O-CSI trigger)
6-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
Release Call
CAP signaling
MAP signaling
ISUP signaling
6-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
It is assumed that the calling pre-paid subscriber is resident in the serving area of
MSCa/VLR/SSP. O-CSI is used to trigger a service. The call procedure is shown in
Figure 6-3.
6-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
FCI
Continue
Send Routing Info
SRI_ ack (O-CSI+T-CSI)
T_CSI trigger
IDP
CAP signaling
MAP signaling
ISUP signaling
6-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
It is assumed that the calling pre-paid subscriber is resident in the serving area of
MSCa/VLR/SSP. O-CSI is used to trigger a service. The call procedure is shown in
Figure 6-4.
6-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
ACR
ERB(DP9)
RC
ACR
ERB(DP17)
RC
Figure 6-4 Pre-paid subscriber calling ordinary WCDMA subscriber with CFU to pre-paid subscriber
6-6
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
PA
Usage life
SRR
P&C Options for other procedures
ERB(o-Abandon)
User on-hook
6-7
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
RRSE
Continue SMS
ERS
FCI SMS
Continue SMS
CAP messages
MAP messages
6-8
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 6 IN Service Handling Procedures
VLR gsmSCF
M-CSI trigger
MAP NOTE MM EVENT
6-9
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
7.1 Overview
LoCation Service (LCS) specifies for operators, subscribers and third party service
providers all the necessary network elements and entities, their functionalities,
interfaces, as well as communication messages, so as to implement the positioning
functionality in a cellular network. The LCS is able to position a Mobile Station (MS) to a
cell degree. The LCS covers a wide range of applications, including public security
services as emergency calls and alarms, location-based billing and tracing, and
location-based information services as navigation, city-touring, and located
broadcasting.
LMU CBC
Type A Note 1)
3G- HLR
Uu IuBC SGSN
Lh
Node B Iub SRNC Iu 3G- Lg Le
UE (SMLC External
MSC/VLR Gateway
(LMU functio- LCS client
Type B) nality) MLC
Iur Lg Lc
The LCS Client, which invokes a LCS request, is divided into external LCS Client and
internal LCS client. The LCS Server contains RNC, MSC/VLR, HLR, and SGSN. RNC
accomplishes location measurement and calculation. MSC/VLR, HLR and SGSN fulfill
addressing of UE, sending and receiving of location messages, and subscriber data
storage management. GMLC provides interface between LCS Client and LCS Server.
I. Related Entities
LCS Client
7-1
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
The LCS Client consists of external LCS Client and internal LCS Client. An external
LCS Client is an application server providing location-based services. It connects with
GMLC through Le interface. An internal LCS Client can be included in CN equipment
(as MSC or gsmSCF), or operation & maintenance (O&M) equipment which can be a
separate one or the O&M equipment of MSC. LCS Client invokes a location request,
and implements location-based services with the results.
As functions differ, LCS Client can be divided into four types:
1) The Commercial LCS Clients (or Value Added Service LCS Client), which support
value-added services, can be subscriber specific or non-subscriber specific.
2) The Internal LCS Clients support, or enhance with LCS, certain O&M related tasks,
supplementary services, IN related services and GSM bearer services and
teleservices.
3) The Emergency LCS Clients assists subscribers who place emergency calls.
4) The Lawful Intercept LCS Client uses the location information to support various
legally required or sanctioned services
LCS Server
The LCS Server is a group of software and/or hardware entities offering LCS
capabilities, including MSC, SGSN and RNC. It is a group of entities implementing
location function coordinately rather than a specific entity. The LCS Server accepts
LCS requests, services requests, and sends back responses to the received requests.
Gateway Mobile Location Center (GMLC)
GMLC is a gateway connecting with external LCS Client. It receives location requests
from Le interface, then starts addressing HLR and sends location request to VMSC.
GMLC can also send the location results to related LCS Client, and convert the result
into local coordinates.
MSC/VLR
MSC/VLR implements codec, version negotiation, and signaling processing of location
messages; and provides interface functions as signaling tracing and O&M. It is required
to accomplish the processing and control of location procedures, protecting subscriber
private information, and providing billing according to processing results.
HLR
It stores LCS subscription data, and provides MSC number to located subscriber.
Target UE
Target UE, which is also named MS hereinafter, refers to the located mobile phone. The
present position or the previously-located position of the mobile phone need to be
provided according to location requests. Usually, the target UE is the located object, but
for Mobile Originated Location Request (MO-LR), the target UE sends location
requests.
7-2
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
On receiving the location request from an external client, GMLC verifies LCS
Client identifier and subscription data of the requested LCS, and obtains MSISDN
or IMSI, LCS QoS data of target UE. For call-related location requests, GMLC
shall obtain and verify called number of LCS client. To process location requests
to multiple UEs, repeat step 2) till step 12).
7-3
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
2) If GMLC knows VMSC and IMSI of a certain MSISDN, skip to step 4). Otherwise,
GMLC sends to HLR a MAP_SEND_ROUTING_INFO _FOR_LCS message of
IMSI or MSISDN with target UE.
3) HLR verifies the caller address of GMLC, which has been authorized and can
request UE location information, and returns VMSC address and IMSI or MSISDN
(MSISDN is not included in step 2).
4) GMLC sends MAP_PROVIDE_SUBSCRIBER_LOCATION message to related
VMSC. The message included requested location information type, IMSI, LCS
QoS of UE, and indication of whether LCS Client has override capability. For
call-related location request, the message also includes called number of LCS
Client. For value-added LCS Client, client name can be included. For non-call
related location request, LCS Client identifier is included. For other cases, client
name or identifier is optional.
5) If GMLC locates in another PLMN or another nation, VMSC will verify whether
invoking a location request from that PLMN or nation is permitted. If not, it will
return related error messages. If so, VMSC verifies LCS prohibition restriction of
UE subscription file stored in VLR. If LCS is prohibited, there is no need to inform
UE, and LCS Client does not have override capability, VMSC returns an error
message. If UE is in idle mode, the core network will invoke paging, authentication
and ciphering procedures. If target UE supports UE-based or UE-assisted location
method, UE will provides its location method in controlled early classmark sending
to SRNC and MSC.
6) If the location request comes from a value-added LCS Client, and UE subscription
file indicates that UE requires notification (with private verification), and UE
supports notification of LCS, then VMSC sends an LCS Location Notification
Invoke message to target UE, indicating location request type , LCS Client
identifier, and whether private verification is required.
7) Target UE informs subscriber that a location request comes. If private verification
is authorized, target UE inquires that whether location request shall be permitted
in case of no response, and waits for subscriber for decision. Then, UE returns the
LCS Location Notification Return Result message to VMSC, which could also be
returned between Step 6) and Step 11). If no message is returned within specified
time, VMSC thinks no response, and shall return an error message to GMLC when
private verification is required, and indicates whether the reason is subscriber not
allowing location or no response.
8) VMSC sends RANAP Location Report Control message to SRNC, which includes
location request type, UE location capability, and QoS of request.
9) SRNC determines and implements the location method.
10) When obtaining QoS-satisfied location results, SRNC returns the results in
RANAP Location Report message to VMSC. If no location result is obtained, the
cause of failure shall be included in RANAP Location Report message.
7-4
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
Note:
Steps 1) to Step 8) cover location preparation, Step 9) is location measurement setup process, and Steps
10) to 12) are location calculation and release processes.
7-5
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
7-6
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
6) For LCS procedures of other location results, they are the same as described in
MT-LR procedure.
7) SRNC reports location results to VMSC.
8) VMSC reports location results to GMLC.
9) GMLC responses whether the correct location information is received.
10) GMLC returns the results to UE-requested LCS client.
11) Finally, MSC returns location request response (including location results)
12) Release Connection Management (CM), Mobility Management (MM), or Radio
Resource Control (RRC) connection.
9. Location Information
7-7
Protocols and Signaling Analysis Signaling Procedures
HUAWEI UMTS Circuit-Switched Core Network Chapter 7 Location Service Procedures
7-8
HUAWEI
Table of Contents
i
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Table of Contents
ii
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
1-1
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
You can set a user interface for tracing the messages generated during power-on of
an UE, as shown in Figure 1-2.
1-2
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
I. RN_MM_LOCATION_UPDATION_REQUEST
This message is sent by the mobile station to the network either to request update of
its location file (normal updating or periodic updating) or to request IMSI attach. See
Figure 1-3 for details
Skip Indicator: Bits 5 to 8 of the first octet of every Mobility Management message
and general packet radio service (GPRS) Mobility Management message contain the
skip indicator.A message received with skip indicator different from 0000 shall be
ignored. A message received with skip indicator encoded as 0000 shall not be
ignored (unless it is ignored for other reasons).A protocol entity sending a Mobility
Management message or a GPRS Mobility Management message shall encode the
skip indicator as 0000.
1-3
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
for normal location updating; 01 stands for periodic updating; 10 stands for IMSI
attach; 11 stands for a reserved bit.
8 7 6 5 4 3 2 1
Location updating FOR 0 LUT octet 1
Type IEI spare
FOR (octet 1)
The Follow-On Request bit (FOR) is coded as follows:
Bits
4
0 No follow-on request pending
1 Follow-on request pending
Ciphering key sequence num: In a global system for mobile communications (GSM)
authentication challenge, the purpose of this information element is to make it
possible for the network to identify the ciphering key Kc which is stored in the mobile
station without invoking the authentication procedure.In a UMTS authentication
challenge, the purpose of this information element is to make it possible for the
network to identify the ciphering key CK and the integrity key IK which are stored in
the mobile station without invoking the authentication procedure.
Mobile identity: The purpose of this information element is to provide either the
international mobile subscriber identity (MSISDN), international mobile subscriber
identity (IMSI), temporary mobile subscriber identity (TMSI), or international mobile
equipment identity together with the software version number (IMEISV).
II. RN_MM_AUTHENTICATION_REQUEST
This message is sent by the network to the mobile station to initiate authentication of
the mobile station identity. See Figure 1-4 for the detailed information of this
message.
1-4
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Spare half octet: This element is filled with spare bits set to zero and is placed in bits
5 to 8 of the octet unless otherwise specified.
III. RN_MM_AUTHENTICATION_RESPONSE
This message is sent by the mobile station to the network to deliver a calculated
response to the network. See Figure 1-5 for the detailed information of this message.
1-5
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
IV. RN_MM_IDENTITY_REQUEST
This message is sent by the network to the mobile station to request a mobile station
to submit the specified identity to the network. See Figure 1-6 for the detailed
information of this message.
1-6
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Identity type: The purpose of this information element is to specify which identity is
requested.The least significant three bits of this element indicate the identify type: 001
stands for IMSI; 010 stands for IMEI; 011 stands for IMEISV; 100 stands for TMSI.
Type of identity (octet 1)
Bits
3 2 1
0 0 1 IMSI
0 1 0 IMEI
0 1 1 IMEISV
1 0 0 TMSI
V. RN_MM_IDENTITY_RESPONSE
1-7
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Mobile identity: The purpose of this information element is to provide either the
international mobile subscriber identity (MSISDN), international mobile subscriber
identity (IMSI), temporary mobile subscriber identity (TMSI), or international mobile
equipment identity together with the software version number (IMEISV).
VI. SECURITY_MODE_COMMAND
This message is sent by the core network to trigger the integrity and ciphering
functions over the radio interface. See Figure 1-8 for the detailed information of this
message.
1-8
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Encryption Information: This element contains the user data encryption information
(key and permitted algorithms) used to control any encryption equipment at the radio
network controller (RNC).
Key Status: This information element tells if the keys included in the SECURITY
MODE COMMAND message are new or if they have been used previously.
VII. SECURITY_MODE_COMPLETE
1-9
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Chosen Integrity Protection Algorithm: This element indicates the integrity protection
algorithm being used by the RNC.
Chosen Encryption Algorithm: This element indicates the encryption algorithm being
used by the RNC.
VIII. COMMON_ID
This message is sent by the core network to inform the RNC about the permanent
non-access stratum (NAS) UE identity for a user. See Figure 1-10 for the detailed
information of this message.
1-10
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
IX. RN_MM_LOCATION_UPDATING_ACCEPT
This message is sent by the network to the mobile station to indicate that updating or
IMSI attach in the network has been completed. See Figure 1-11 for the detailed
information of this message.
1-11
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
X. RN_MM_TMSI_REALLOCATION_COMPLETE
This message is sent by the mobile station to the network to indicate that reallocation
or deletion of a TMSI has taken place. See Figure 1-12 for the detailed information of
this message.
1-12
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Skip Indicator: Bits 5 to 8 of the first octet of every Mobility Management message
and GPRS Mobility Management message contains the skip indicator. A message
received with skip indicator different from 0000 shall be ignored. A message received
with skip indicator encoded as 0000 shall not be ignored (unless it is ignored for other
reasons). A protocol entity sending a Mobility Management message or a GPRS
Mobility Management message shall encode the skip indicator as 0000.
XI. IU_RELEASE_COMMAND
This message is sent by the core network to order the RNC to release all resources
related to the Iu connection. See Figure 1-13 for the detailed information of this
message.
1-13
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Cause: The purpose of this information element is to indicate the reason for a
particular event for the Radio Access Network Application Part (RANAP) protocol.
XII. IU_RELEASE_COMPLETE
1-14
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
When a UE is powered off, it initiates IMSI detach. See Figure 1-15 for the Iu-CS
interface protocol.
1-15
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
I. RN_MM_IMSI_DETACH_INDICATION
This message is sent by the mobile station to the network to indicate the mobile
station is deactivated or the SIM is detached from the mobile station. See Figure 1-17
for the detailed information of this message.
IMSI Detach Indication message type: This information element indicates the type of
the IMSI detach indication message.
Mobile identity: The purpose of this information element is to provide either the
international mobile subscriber identity (MSISDN), international mobile subscriber
1-16
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
II. IU_RELEASE_COMMAND
This message is sent by the core network to order the RNC to release all resources
related to the Iu connection. See Figure 1-18 for the detailed information of this
message.
Cause: The purpose of this information element is to indicate the reason for a
particular event for the RANAP protocol.
III. IU_RELEASE_COMPLETE
1-17
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
1-18
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
1-19
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
I. RN_MM_LOCATION_UPDATION_REQUEST
This message is sent by the mobile station to the network either to request update of
its location file (normal updating or periodic updating) or to request IMSI attach. See
Figure 1-22 for details
Skip Indicator: Bits 5 to 8 of the first octet of every Mobility Management message
and general packet radio service (GPRS) Mobility Management message contain the
skip indicator.A message received with skip indicator different from 0000 shall be
ignored. A message received with skip indicator encoded as 0000 shall not be
ignored (unless it is ignored for other reasons).A protocol entity sending a Mobility
Management message or a GPRS Mobility Management message shall encode the
skip indicator as 0000.
1-20
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Ciphering key sequence num: In a GSM authentication challenge, the purpose of this
information element is to make it possible for the network to identify the ciphering key
Kc which is stored in the mobile station without invoking the authentication
procedure.In a UMTS authentication challenge, the purpose of this information
element is to make it possible for the network to identify the ciphering key CK and the
consistency ciphering key IK which are stored in the mobile station without invoking
the authentication procedure.
Mobile identity: The purpose of this information element is to provide either the
international mobile subscriber identity (MSISDN), international mobile subscriber
identity (IMSI), temporary mobile subscriber identity (TMSI), or international mobile
equipment identity together with the software version number (IMEISV).
II. COMMON_ID
The purpose of the Common ID procedure is to inform the RNC about the permanent
NAS UE Identity of a user. See Figure 1-23 for the detailed information of this
message.
1-21
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
III. MAP_OPEN_REQ
This message is used for establishing a Mobile Application Part (MAP) dialogue
between two MAP service-users. See Figure 1-24 for the detailed information of this
message.
Application context name: This parameter identifies the type of the application context
being established. If the dialogue is accepted, the received application context name
shall be echoed.In case of refusal of dialogue, this parameter shall indicate the
highest version supported.
IV. MAP_UPDATE_LOCATION_REQ
This message is used by the visited location register (VLR) for updating the location
information stored in the home location register (HLR). See Figure 1-25 for the
detailed information of this message.
1-22
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
V. MAP_DELIMITER_REQ
This message is used to explicitly request the transfer of the MAP protocol data units
to the peer entities. See Figure 1-26 for the detailed information of this message.
1-23
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
VI. MAP_OPEN_CNF
This message is used for establishing a Mobile Application Part (MAP) dialogue
between two MAP service-users. See Figure 1-27 for the detailed information of this
message.
1-24
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Result: This parameter indicates whether the peer entity accepts the dialog.
VII. MAP_INSERT_SUBSCRIBER_DATA_IND
This message is used by an HLR to update a VLR with certain subscriber data when
subscriber data changes. See Figure 1-28 for the detailed information of this
message.
1-25
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
VIII. MAP_INSERT_SUBSCRIBER_DATA_RSP
1-26
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
IX. MAP_UPDATE_LOCATION_CNF
This message is sent by the HLR to confirm the location update requrest intiated by
the VLR. See Figure 1-30 for the detailed information of this message.
1-27
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
X. RN_MM_LOCATION_UPDATING_ACCEPT
This message is sent by the network to the mobile station to indicate that updating or
IMSI attach in the network has been completed. See Figure 1-31 for the detailed
information of this message.
1-28
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
1-29
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
I. RN_MM_LOCATION_UPDATION_REJECT
This message is sent by the network to the mobile station to indicate that updating or
IMSI attach has failed. See Figure 1-34 for the detailed information of this message.
1-30
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 1 Analysis of Location Update Signaling
Reject cause: This parameter indicates the cause for rejecting the location update
request.
1-31
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
2-1
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
I. RELOCATION_REQUIRED
This message is sent by the source RNC to inform the core network that a relocation
is to be performed. See Figure 2-3 for the detailed information of this message.
II. RELOCATION_REQUEST
This message is sent by the core network to request the target RNC to allocate
necessary resources for a relocation. See Figure 2-4 for the detailed information of
this message.
2-2
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
III. RELOCATION_REQUEST_ACKNOWLEDGE
This message is sent by the target RNC to inform the core network about the result of
the resource allocation for the requested relocation. See Figure 2-5 for the detailed
information of this message.
2-3
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
IV. RELOCATION_COMMAND
This message is sent by the core network to the source RNC to inform that resources
for the relocation are allocated in target RNC. See Figure 2-6 for the detailed
information of this message.
2-4
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
V. RELOCATION_DETECT
This message is sent by the target RNC to inform the core network that the relocation
execution trigger has been received. See Figure 2-7 for the detailed information of
this message.
VI. RELOCATION_COMPLETE
This message is sent by the target RNC to inform the core network that the relocation
is completed. See Figure 2-8 for the detailed information of this message.
2-5
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
2-6
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
I. RELOCATION_CANCEL
This message is sent by the source RNC to the core network to cancel an ongoing
relocation.
2-7
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 2 Analysis of Relocation Signaling
II. RELOCATION_CANCEL_ACKNOWLEDGE
This message is sent by the core network to inform the source RNC that the
relocation has been cancelled.
2-8
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
The following procedure introduces the messages traced at the caller side.
3-1
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
I. RN_MM_CM_SERVICE_REQUEST
This message is sent by the mobile station to the network to request a service for the
connection management sub-layer entities, for example, circuit switched connection
establishment, supplementary services activation, short message transfer, and
location services. See Figure 3-3 for the detailed information of this message.
3-2
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
II. RN_CC_SETUP
This message is sent by the network to the mobile station to initiate a mobile
terminated call establishment. See Figure 3-4 for the detailed information of this
message.
3-3
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
III. MAP_SEND_ROUTINE_INFORMATION_REQ
The message is invoked by the gateway MSC (GMSC) to interrogate the HLR in
order to route a call to the called MS. See Figure 3-5 for the detailed information of
this message.
3-4
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
IV. RN_CC_CALL_PROCEEDING
This state exists for a mobile originating call when the mobile station has received
acknowledgement that the network has received all call information necessary to
effect call establishment. See Figure 3-6 for the detailed information of this message.
3-5
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
V. MAP_SEND_ROUTINE_INFORMATION_CNF
3-6
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
VI. ADD_REQ
This message is a request sent by the media gateway controller (MGC) to the media
gateway (MGW) for adding a termination to a context. See Figure 3-8 for the detailed
information of this message.
3-7
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
VII. ADD_REPLY
This message is a response to the ADD_REQ message. See Figure 3-9 for the
detailed information of this message.
3-8
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
VIII. RN_RAB_ASSIGNMENT_REQUEST
This message is sent by the core network to request the establishment, modification
or release of one or more radio access bearers (RABs) for the same UE. This
message is a request for RAB assignment. See Figure 3-10 for the detailed
information of this message.
3-9
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
IX. NTFY_REQ
This message is a request for reporting the events occurring in the MGW to the MGC.
See Figure 3-11 for the detailed information of this message.
3-10
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
X. NTFY_REPLY
This message is a response to the NTFY_REQ message. See Figure 3-12 for the
detailed information of this message.
XI. RN_RAB_ASSIGNMENT_RESPONSE
This message is sent by the RNC to report the outcome of the request from the RAB
ASSIGNMENT REQUEST message. See Figure 3-13 for the detailed information of
this message.
3-11
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XII. RN_CC_ALERTING
This message is sent by the network to the calling mobile station to indicate that the
called subscriber alerting has been initiated. See Figure 3-14 for the detailed
information of this message.
3-12
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XIII. MOD_REQ
This message is a request for modifying a termination. See Figure 3-15 for the
detailed information of this message.
3-13
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XIV. RN_CC_CONNECT
This message is sent by the network to the calling mobile station to indicate call
acceptance by the called subscriber. See Figure 3-16 for the detailed information of
this message.
3-14
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XV. MOD_REPLY
This message is a response to the MOD_REQ message. See Figure 3-17 for the
detailed information of this message.
XVI. RN_CC_CONNECT_ACKNOWLEDGE
This message is sent by the network to the called mobile station to indicate that the
mobile station has been awarded the call. It shall also be sent by the calling mobile
station to the network to acknowledge the offered connection. See Figure 3-18 for the
detailed information of this message.
3-15
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XVII. RN_CC_DISCONNECT
This message is sent by the network to indicate that the end-to-end connection is
cleared. See Figure 3-19 for the detailed information of this message.
3-16
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XVIII. RN_CC_RELEASE
This message is sent from the network to the mobile station to indicate that the
network intends to release the transaction identifier, and that the receiving equipment
shall release the transaction identifier after sending RELEASE COMPLETE. See
Figure 3-20 for the detailed information of this message.
3-17
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XIX. RN_CC_RELEASE_COMPLETE
This message is sent from the network to the mobile station to indicate that the
network has released the transaction identifier and that the mobile station shall
release the transaction identifier. See Figure 3-21 for the detailed information of this
message.
3-18
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XX. SUB_REQ
This message is a request for deleting the connection between a termination and a
context. See Figure 3-22 for the detailed information of this message.
3-19
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
XXI. SUB_REPLY
This message is a response to the SUB_REQ message. See Figure 3-23 for the
detailed information of this message.
3-20
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
Figure 3-24 Procedure of call failure due to non-existence of the called number
3-21
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 3 Analysis of Call Signaling
Figure 3-25 Call failure messages generated due to non-existence of the called number
3-22
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4.1 Overview
OoB Codec
Negotiation
Bearer is established by interaction between MGW and RNC through Q.AAL2 protocol
and user plane negotiation is implemented over Iu UP protocol. Q.AAL2 and lu UP
protocols are closely associated with services and the key to understand mobile service
processing of MGW and locate Iu interface problems.
AAL2 signaling system mainly implements the following functions: establish and
release AAL2 connection between two AAL2 signaling nodes; maintain and manage
path and channel resources within the signaling system.
At service subscriber module (CMU) requests, related nodes in AAL2 signaling network
exchange signaling messages to establish and release AAL2 connection. Maintenance
and management function is activated based on indication of maintenance console or
4-1
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
by system due to detected faults. And the function must be implemented in conjunction
with two adjacent nodes of managed objects such as path and channel.
At Iu interface, RNC initiates Q.AAL2 establishment, while both RNC and MGW can
initiate release.
Entities of Q.AAL2 protocol use primitives such as ERQ, ECF, REL, RLC, RES, RSC,
BLC, and UBL to interact.
Service Subscriber
RNC QAAL2 Module (CMU)
ERQ
EST.IND
Timer_ERQ
EST.RSP
ECF
When MS originates a call, RNC sends a Q.AAL2 establishment request to MGW upon
receiving a RAB assignment request.
Upon receiving an establishment request, the Q.AAL2 module of MGW allocates AAL2
resources. In the event of successful allocation, the Q.AAL2 module of MGW sends
establishment indication to service subscriber module (CMU) to facilitate allocating call
handling and control resources.
4-2
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
Service Subscriber
RNC QAAL2 Module (CMU)
ERQ
RLC
After receiving a RNC establishment request, the Q.AAL2 module sends a release
ackowledgement message to RNC in the case of failed AAL2 resource allocation. The
call fails.
Causes of AAL2 resource allocation failure involves the following: unvailable physical
ports corresponding to PATH; insufficient remaining bandwidth of PVC corresponding
to PATH; insufficicent users supported by VMGW.
Service Subscriber
RNC QAAL2
Module (CMU)
ERQ
EST.IND
Timer_ERQ
REL.RSP
RLC
After receiving a RNC establishment request message, the Q.AAL2 module of MGW
sends establishment indication to service subscriber module (CMU) in the case of
sucessful AAL2 resource allocation.
4-3
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
Common faults of service subscriber module (CMU) involve the following: insufficient
call control resources; session control resource timeout; and failure of AAL2 resource
occupation.
Service Subscriber
RNC QAAL2 Module (CMU)
ERQ
EST.IND
Timer_ERQ
RLC
After receiving a RNC establishment request, the Q.AAL2 module of MGW sends
establisment indication to the service subscriber module (CMU) in the case of
successful AAL2 resource allocation.
During resource processing, if service subscriber module (CMU) does not send a
response before timer_ERQ expires, the Q.AAL2 module sends a release
acknowledgement message to RNC, and the call fails.
Common causes for service subscriber module (CMU) expiry involve the following:
insufficient voice handling resources; and internal communication timeout.
4-4
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
Service Subscriber
RNC Q.AAL2 Module (CMU)
REL
REL
Timer_REL
RLC
RLC
After MS subscriber hooks on, RNC sends a release request of Q.AAL2 module to
MGW and QAAL2 module of MGW informs the service subscriber module (CMU) of
call resource release. Then QAAL2 module of MGW returns a RLC.
Example of Q.AAL2 trace during normal call and release is as shown in Figure 4-7.
Figure 4-7 The process Q.AAL2 trace during normal call and release
I. ERQ message
ERQ is to establish request messages. Give prime concern to “ceid”, “osaid”, “nsap”,
“alc”, and “sugr”.
These messages will determine successful connection of AAL2. While failure occurs, it
is necessary to analyze if these messages are properly input.
4-5
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4-6
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
In the case of abnormal release, you can locate causes through cause values of
several protocol standards.
4-7
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
When Q.AAL2 establishment of Iu interface fails, you shall check RLC message.
4-8
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4.3 Iu UP Application
Used at user plane of radio network layer at lu interface, namely lu UP protocol layer, lu
UP is applied to transmit user data related to RAB.
One lu UP protocol instance is only associated with one RAB. For a designated UE, the
number of lu UP instances used by RAB is identical to that of one RAB.
Access Stratum
Iu UP Iu UP
Radio
Radio
protocols protocols User plane User plane
Transport
Data Data
Bearers Layer Bearers
protocols protocols
UE UTRAN CN
Radio Iu
(Uu)
4-9
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
RNC/ CN/
CN RNC
Initialization
* ((RFCI, SDU sizes[, IPTIs2)])m)
Initialization ACK
RNC CN
Initialization
((RFCI, SDU sizes[, IPTIs2)])m)
*
(1) Initialization NACK
* after n repetitions
2) optional
(2) (1) Negative ACKnowledgement
(2) Acknowledgement timeout
4-10
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
The interaction process between MGW and RNC at Iu interface is listed in the
following:
1) User originates a call and Q.AAL2 is established.
2) UP is initialized.
3) User hooks on and Q.AAL2 is released.
Compared with UP support mode, UP initialization is absent in transparency mode.
Typical services in support mode involve voice and non-transparent data services. And
typical services in transparency mode include VP (H324M) and transparent data
services.
Voice call establishment and release processes are shown in Figure 4-16:
INIT ACK
REL
REL.IND Release UP
instance
REL.RSP
RLC
4-11
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
REL
REL.IND Release UP
instance
REL.RSP
RLC
4-12
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
Give prime concern to “ackNack” whose value is “ack” in the case of successful
initialization and “nack” in the case of initialization failure.
4-13
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4.5.1 Overview
Call failure is the common service problem at Iu interface. In some cases, you can
locate causes through traced messages of Q.AAL2 and Iu UP interface in
conjunction with Mc interface trace, internal interface trace and configuration
query.
4-14
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
I. Symptom
An intra-VMSC call originated by a MS subscriber fails before the called party answers
the call. You can find that MGW replies RLC after receiving ERQ through tracing
Q.AAL2 interface messages, as shown in Figure 4-21.
1) Check “cause” of RLC. The “cause” is “temporary failure”. You must draw a
conclusion through specific analysis.
2) As shown in Figure 4-23, Open the “ERQ message” and analyze important
information and probable errors.
4-15
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
“path identifier” in “ceid” is 1, which indicates “PATH ID” used by RNC is 1. Check MGW
configuration. PATH with ID of 1 is available and correct.
Bi-directional rates and packet sizes in “alc” are correct. Check PVC flow configuration
in MGW. Remaining bandwidth is sufficient and correct.
4-16
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
two values are correct. Then query ATM resource number in ASU board by executing
LST AAL2VMGW. Resource number corresponding to No.0 VMGW is 0. In this case,
ATM resources cannot be allocated in No. 0 VMGW. The causes for unsuccessful
subscriber call and Q.AAL2 signaling establishment lie in here.
LST AAL2VMGW: BN=0, VMGWID=0;
RETCODE = 0 Successful execution
Query VMGW information
--------------------
Board number VMGW number maximum user number
0 0 0
(Result = 1)
END
3) Modify configuration. Set user number of No.0 VMGW by executing SET
AAL2VMGW to 12000. Re-call succeeds.
1) Check RLC bit error. For error code, locate cause of bit error with a unique cause
and probable causes of common bit errors.
2) Analyze ERQ messages and exclude incorrect RNC messages and configuration.
3) Query MGW data configuration and troubleshoot errors.
I. Symptom description
An intra-VMSC call originated by a MS subscriber fails before the called party answers
the call. Trace QAAL2 interface messages and find no error. Trace Iu UP interface
messages and find that negotiation fails because MGW replies NACK directly after
receiving an initialization request, as shown in Figure 4-24.
4-17
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
1) As shown in Figure 4-25. Check the cause value of NACK message. If the cause
value is “initialization failure”, RFCI negotiation fails.
4-18
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4-19
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
4 subflow 5 subflow 6
7 20 0 244 7 3 81 103 60 0 0 0
0 20 0 95 0 2 42 53 0 0 0 0
1 20 0 103 1 2 49 54 0 0 0 0
2 20 0 118 2 2 55 63 0 0 0 0
3 20 0 134 3 2 58 76 0 0 0 0
4 20 0 148 4 2 61 87 0 0 0 0
5 20 0 159 5 2 75 84 0 0 0 0
6 20 0 204 6 3 65 99 40 0 0 0
8 20 0 39 8 3 39 0 0 0 0 0
63 20 0 0 15 3 0 0 0 0 0 0
16 5 0 320 16 1 320 0 0 0 0 0
17 10 0 640 17 1 640 0 0 0 0 0
18 20 0 576 18 1 576 0 0 0 0 0
19 20 0 672 19 1 672 0 0 0 0 0
20 40 0 576 20 1 576 0 0 0 0 0
(Result = 15)
RFCI set (continuation)
--------
Rfci number subflow 7
7 0
0 0
1 0
2 0
3 0
4 0
5 0
6 0
8 0
63 0
16 0
17 0
18 0
19 0
20 0
(Result = 15)
END
4) Modify RFCI number corresponding to 0 to 9 by executing SET RFCI in MGW.
Re-call succeeds.
4-20
Protocols and Signaling Analysis Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Chapter 4 Analysis of Iu Interface Protocol
1) You can locate causes of initialization NACK bit error of Iu UP. Causes include:
failed initialization; incorrect CRC; frame number mismatch; and incorrect version.
2) Check initialization messages based on bit errors. For failed initialization, you
must check the consistency between messages and MGW configuration. For
incorrect version, you must check traced messages of Mc interface to determine
whether the version delivered by MSC Server is compatible with that by RNC.
4-21
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
Appendix A Abbreviations
3
3GPP 3rd Generation Partnership Project
3PTY Three-Party service
A
AAL ATM Adaptation Layer
AAL1 ATM Adaptation Layer Type 1
AAL2 ATM Adaptation Layer type 2
AAL5 ATM Adaptation Layer type 5
ACK ACKnowledgement
ACM Address Complete Message
AG Access Gateway
ALCAP Access Link Control Application Part
ANM Answer Message
AoC Advice of Charge
APM APplication transport Mechanism
ASE Application Service Element
ASN.1 Abstract Syntax Notation One
ATM Asynchronous Transfer Mode
B
BC Bearer Control
BCF Bearer Control Function
BCSM Basic Call State Module
BER Bit Error Rate
BIB Backward Indicator Bit
BICC Bearer Independent Call Control
B-ISUP Broadband ISDN User Part
BLA Block Acknowledge signal
BLO Blocking signal
BNC Backbone Network Connection
A-1
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
C
CAI Charge Advice Information
CAMEL Customized Applications for Mobile network Enhanced Logic
CAP CAMEL Application Part; Amplitude Phase modulation
CC Connection Confirm
CCR Continuity Check Request
CFB Call Forwarding Busy
CFN Connection Frame Number
CFNRC Call Forwarding on mobile subscriber Not Reachable
CFNRY Call Forwarding No Reply
CFU Call Forwarding Unconditional
CGB Circuit Group Blocking
CGBA Circuit Group Blocking ACK
CGI Cell Global Identification
CGU Circuit Group Unblocking
CGUA Circuit Group Unblocking ACK
CIC Circuit Identification Code
Call Instance Code
CLIP Calling Line Identification Presentation
CLIR Calling Line Identification Restriction
CM Call Management
CMD Command
CMN Call Mediation Node
CN Core Network
COLP COnnected Line Identification Presentation
COLR COnnected Line Identification Restriction
CPG Call Progress
A-2
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
D
DCCH Dedicated Control CHannel
DDI Direct-Dialing-In
DP Detection Point
DPC Destination (Signaling)Point Code
DTAP Direct Transfer Application Part
DTMF Dual Tone Multi Frequency
DUP Date User Part
E
EC Echo Cancellation
ECT Explicit Call Transfer
ED Expedited Data
EDP Event Detection Point
F
FAA FAcility Accepted
FAC Facilities
FACCH Fast Associated Control Channel
FISU Fill-In Signal Unit
FOT FOrward-Transfer signal
FRJ Facility ReJect
FSN Frame Switching Network Board
G
GMLC Gateway Mobile Location Center
GMSC Gateway Mobile Switching Center
GPRS General Packet Radio Service
A-3
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
H
HLR Home Location Register
HOLD Call Hold
I
IAM Initial Address Message
ID IDentification/IDentity
IDP Individual Development Plan
IDS Informix Dynamic Server
IETF Internet Engineering Task Force
IF Information Frame
IMSI International Mobile Subscriber Identity
INAP Intelligent Network Application Protocol
INR Information Request
IP Internet Protocol
ISDN Integrated Services Digital Network
ISUP ISDN User Part
ITU International telecommunications union
ITU-T International Telecommunication Union - Telecommunication
Standardization Sector
IWF InterWorking Function
L
LA Location Area
LAI Location Area Identity
LCS Location Services
LM Layer Management
A-4
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
N
NGN Next Generation Network
NMS Network Management System
NSS Network SubSystem
O
OAM Operation Administration and Maintenance
O-CSI Originating CAMEL Subscription Information
OMAP Operation and Maintenance Application Part
OMC Operation and Maintenance Center
OPC Originating signaling Point Code
OSI Open Systems Interconnection
A-5
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
R
RACH Random Access CHannel
RAN Radio Access Network
RANAP Radio Access Network Application Part
REL RELease
REQ REQuest
RES Resume
RFC Request for Comments
RLC Radio Link Control
RNC Radio Network Controller
RNS Radio network sub-system
S
SAAL Signaling ATM Adaptation Layer
SAAL-NNI Signaling ATM adaptation layer for network to network interfaces
SCCP Signaling Connection Control Part
SCP Service Control Point
SCTP Stream Control Transmission Protocol
SDCCH Stand-alone Dedicated Control Channel
SDP Session description protocol
SDU Service data unit
SG Signaling Gateway
SGSN Serving GPRS Support Node
SI Service Indicator
SIF Signaling Information Field
SIO Service Information Octet
SLC Signaling Link Code
SLS Signaling Link Selection Code
SMC Short Message Center (used for SMS)
A-6
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
T
TC Transcoder
TCAP Transaction Capabilities Application Part
TCH Traffic CHannel
TCP Transmission Control Protocol
TDM Time Division Multiplexing
TE Terminal Equipment
TFO Tandem Free Operation
TMG Trunk Media Gateway
TMSI Temporary Mobile Subscriber Identifier
TS Technical specification
TUP Telephone User Part
U
UDT Unit DaTa
UDTS Unit DaTa Service
UE User Equipment
UMTS Universal Mobile Telecommunications System
UNI User Network Interface
UP User Plane
UTRAN UMTS Terrestrial Radio Access Network
V
V5UA V5 User Adaptation Layer
VLR Visitor Location Register
VMSC Visited Mobile Switching Center, Visited MSC
VPN Virtual Private Network
A-7
Protocols and Signaling Analysis
HUAWEI UMTS Circuit-Switched Core Network Appendix A Abbreviations
W
WCDMA Wide(band) Code Division Multiple Access
A-8