GSM and SS7 Overview

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Session objective
To understand the main scenarios in a Global System for
Mobile Communication (GSM) network, from a signaling
perspective
Location update/ Registration
Phone Calls
Outgoing
Incoming

Short Messages
Outgoing
Incoming

Call Forwarding
Early
Late

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Concepts / Terminology encountered en route

GSM network elements

Home Location Register (HLR)
Visitor Location Register (VLR)
Mobile Switching Center (MSC)
Gateway Mobile Switching Center (GMSC)
Short Message Service Center (SMSC)
IMSI - International Mobile Subscriber Identity
MCC Mobile Country Code
MNC Mobile Network Code
MSIN Mobile Station Identification Number

MSISDN Mobile Station International ISDN Number

CC Country Code
NDC National Destination Code

Numbering plans E.164, E.212, E.214

Signaling basics Signaling System 7 (SS7) suite of protocols

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Mobile Network

MSC 1

MSC 2

HLR

VLR 1

VLR 2

Network Subsystem

Base Station Subsystem

BSC 1

BSC 2

Cell Sites (BTS)

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Roamwares veiw of a GSM network

MSC/
VLR

HLR

GMSC

To other
networks

MSC/
VLR

SMSC

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

IMSI, MSISDN and IMEI

IMSI
MCC

MNC

MSIN

NDC

Sub. No.

Total of 15 digits. MCC and MNC take up a max of

6 digits. MCC is 3 digit Country Code and MNC is
2-3 digit (mostly 2) Network Code in the country
e.g. 404-20-1234567890

MSISDN
CC

Country
UK
France
India

CC
44
33
91

CC = Country Code
NDC = National Destination Code
e.g. 91-9820-026174

MCC
234
208
404

IMEI
TAC

FAC

Roamware Proprietary and Confidential

SNR

SP

CC and MCC codes are different

TAC Type Approval Code (6 digits)

FAC Final Assembly Code (2 digits)
SNR Serial Number (6 digits)

Copyright Roamware Inc. 2003. All Rights Reserved.

Numbering Plans
E.164
The phone number world (CC + NDC + number)

E.212
IMSI range (MCC + MNC + MSIN)
Not routable on SS7 network directly

E.214

Routable address derived from IMSI

MCC+MNC translated to CC+NDC
Remaining digits retained unchanged
In GSM, only HLR can be addressed this way (wildcard)

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Main components of a GSM network

Cell sites (BTS Base Transceiver Stations)

BSC - Base Station Controller (controls several BTSs)
MSC - Mobile Switching Center (controls several BSCs)
HLR Home Location Register
VLR Visitor Location Register
GMSC Gateway MSC
EIR Equipment Identity Register
AuC Authentication Center

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

Some More Terminology

PLMN Public Land Mobile Network

HPLMN/HPMN Home Public Mobile Network
VPLMN/VPMN Visited Public Mobile Network
MS Mobile Station Handset + SIM Card

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

HLR Home Location Register

Stores a record for each subscriber of this network
IMSI
MSISDN
Subscription profile
Addresses of MSC and VLR currently serving the MS
The record is a permanent one it is there even if the
subscriber is roaming outside the home network
Has an interface to Customer Care / Billing system.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

10

VLR Visitor Location Register

Temporarily stores records for mobile subscribers who are
served/attached to a cell served by the MSC attached to this
VLR
Records are stored in VLR for local subscribers as well as
roamers.
Records are removed from the VLR as soon as the subscriber
leaves the area of this VLR and registers in a new MSC/VLR
pair
Caches subscriber data so that the HLR need not be queried
for everything.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

11

Primary functions of the VLR:

to inform the HLR that a subscriber has arrived in the particular area covered by
the VLR

to track where the subscriber is within the VLR area (location area) when no call
is ongoing

to allow or disallow which services the subscriber may use

to purge the subscriber record if a subscriber becomes inactive whilst in the area
of a VLR. The VLR deletes the subscriber's data after a fixed time period of
inactivity and informs the HLR (e.g. when the phone has been switched off and
left off or when the subscriber has moved to an area with no coverage for a long
time).

to delete the subscriber record when a subscriber explicitly moves to another, as

instructed by the HLR

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

12

MSC Mobile Switching Center

Also called the Switch

Controls multiple Base Stations; handles voice trunks
Responsible for setting up, routing and supervising calls to and from the
mobile subscriber
GMSC is a MSC with a capability to:
Interface between mobile network and other networks
Query the HLR to determine where to route an incoming call for a
subscriber of this network
A Pure GMSC is a GMSC that subscribers cannot latch on to (no VLR
attached and no BSCs connected)

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

13

What is SS7?

Is a global standard for telecommunication defined by the International

Telecommunication Union (ITU) .

Signaling System 7 (SS7) is a system that transports the information required to

set up and manage telephone calls by converting signaling information to digital
packets.

Signaling communication between different network elements to achieve some

purpose (most common and oldest purpose setting up a phone call)

SS7 is a type of Common Channel signaling as it achieves signaling by sending

formatted messages on a common channel dedicated for signaling

Evolved to control mobile/wireless and intelligent networking (800, LNP, callerID)

E1 and T1 physical links

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

14

SS7 Stack

Cellular/wireless
Intelligent
Networking
Call control

MTP = Message Transfer Part

Routing, datalink, physical
Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

15

MTP1/2/3 in brief

MTP 1
SS7 architectural level that defines the physical, electrical, and
functional characteristics of the digital signaling link.
Deals with H/W and electrical configuration at the level of link, interface
cards and multiplexers.

MTP 2:
SS7 data link layer protocol.
Exercises flow control, message sequence validation, error checking,
and retransmission.

MTP 3:
Introduces addresses and can perform routing
The address is called a Signaling Point Code (14-bit integer in ETSI
and 24-bit integer in ANSI networks)
MTP3 header has 2 addresses the Originating (senders) point code
and the Destination (receivers) point code

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

16

SCCP, TCAP in brief

SCCP (Signaling Connection Control Part):

Introduces more sophisticated routing and addressing
Adds the concept of a Global Title, which is a higher level address than the point code
Global Titles are similar to phone numbers (CC+NDC+num)
Makes true End to End communication practical
SCCP is used as the transport layer for TCAP-based services such as freephone
(800/888), calling card, local number portability

TCAP(Transaction Capabilities Application Part):

Introduces the concept of transactions allowing applications to associated related
messages with each other
Supports primitives like Begin, Continue, End and Abort
Supports Transaction Ids for both sides (Orig and Dest), but transactions that have a
Begin-End pattern use only 1 Transaction id (Orig).
An SSP uses TCAP to query an SCP to determine the routing number(s) associated with
a dialed 800, 888, or 900 number. The SCP uses TCAP to return a response containing
the routing number(s) (or an error or reject component) back to the SSP. Calling card calls
are also validated using TCAP query and response messages.
TCAP is used largely by switching locations to obtain data from databases or to invoke
features at another switch.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

17

MAP Mobile Application Part

Enables real time communication
between nodes in a mobile network.
Signaling protocol for
Location Updating incl. GPRS
Call handling
Supplementary services
SMS Delivery
IS-41D: TDMA/CDMA variant

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

18

ISUP, TUP

ISUP (ISDN User Part):

Defines the protocols and procedures to set up, manage and
release trunk circuits that carry voice and data calls.

TUP (Telephone User Part):

In some parts of the world the TUP supports basic call processing.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

19

ISUP Call Scenario

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

20

ISUP Messages

IAM - Initial Address Message

This is an ISUP message containing all the information necessary for a
switch to establish the connection.

ACM - Address Complete Message

This message serves as the acknowledgment of an IAM. The ACM indicates
that the switch sending it has reserved the circuit designated for reservation
in the IAM. Receipt of the ACM triggers the originating exchange to send the
phone ringing (ringback) tone to the calling party.

ANM - Answer Message

When the called party picks up the phone, the destination exchange senses
DC loop current on its subscriber interface. As a result, that exchange sends
an answer message (ANM) back to the intermediate exchange.
Each switch in the circuit completes its portion of the circuit and returns an
ANM to the next switch closer to the calling party. When the ANM reaches
the originating exchange, the call is connected.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

21

ISUP Messages contd.

REL - Release
This message is sent first by the exchange sensing that the phone was
hung up. Each subsequent exchange sends its own REL to the next
exchange and initiates release of the circuitry.

RLC - Release Complete

Each exchange receiving an REL sends an RLC message back to
acknowledge receipt of the REL and to indicate that circuit release has been
initiated.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

22

INAP Intelligent Network Application Part

INAP is a signaling protocol between a
service switching point (SSP), network media
resources (intelligent peripherals), and a
centralized network database called a
service control point (SCP).

Through INAP, operators have gained

independence from the software features offered
by switch vendors.

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

23

SS7 Stack

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

24

Roaming Scenario simplified view

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
MSC/
VLR

HLR

GMSC

GMSC

HLR

MSC/

MSC/

VLR

VLR

SMSC

SMSC

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

25

Location Update
Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
MAP Insert Subscriber Data

MAP Update Location Ack

MSISDN, Subscriber Profile

Info

MAP ISD Ack

LU Req

GMSC

GMSC

HLR

LU Cnf

MSC/
VLR

MAP Update Location

IMSI, VLR Address, HLR Address

MSC/
VLR
MAP Cancel Location

MAP Update Location Area

HLR -> old VLR

MSI, Loc Info (Cell id, Loc Area)

MAP Can Loc Ack

MAP Upd Loc Area
Ack
Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

26

Calls

Outgoing calls are called Mobile Originating Calls (MO Calls)

Incoming calls are called Mobile Terminated Calls (MT Calls)

Calls in a GSM network involve MAP as well as ISUP signaling

Calls in a wireline network involve ISUP signaling only (exception special

services such as 800 numbers that involve database queries)

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

27

Outgoing (MO) Call to a wireline number

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)

ISUP IAM CIC=7

GMSC

ISUP IAM CIC=5

GMSC

HLR

Point to note:
- Call does not involve home
network

MSC/
VLR

(Exception CAMEL)

MAP Send Info For Outgoing Call

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

28

Incoming (MT) Call

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
ISUP IAM CIC=10

Page and Ring

ISUP IAM

ISUP IAM
GMSC

MAP Send Routing Info

GMSC

SRI Ack (MSRN)

HLR

MAP Provide Roaming Number

MSC/
VLR
MAP PRN Ack (MSRN)
MAP Send Info For Incoming Call

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

29

SMS (Short Message Service)

Very popular service

Very efficient in terms of network resources
When A sends an SMS to B, it involves 2 steps:
A submits SMS to As home SMSC (MO SMS from A)
As SMSC delivers SMS to B (MT SMS to B)

Point to note SMS passes through only 1 SMSC (senders SMSC)

Either of the 2 steps (submit/delivery) can be done with a program (e.g.
News, Sports services on SMS) instead of a mobile station:
E.g. SMS NEWS to 8888. Delivery step involves application instead of MS.
News application responds: Submit step involves application instead of MS.

SMSC Application communication is on TCP/IP, not SS7

These applications are called SMEs (Short Message Entities)
Several standard SMSC SME protocols such as SMPP, UCP, CIMD2

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

30

Outgoing (MO) SMS

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)

MO SMS
(IMSI, Text, B #, SMSC
Address)
GMSC

GMSC

HLR

MAP MO Forward SM

MSC/
VLR

MAP MO Forward SM
Ack

MAP Send Info For MO SMS

Roamware Proprietary and Confidential

SMSC

Copyright Roamware Inc. 2003. All Rights Reserved.

31

Incoming (MT) SMS

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)

Page and deliver

MAP MT Fwd SM Ack

GMSC

GMSC

SMSC

Roamware Proprietary and Confidential

HLR

MAP SRI_SM Ack (MSC Address)

MSC/
VLR

MAP SRI_SM

MAP MT Fwd SM

Senders
SMSC

Copyright Roamware Inc. 2003. All Rights Reserved.

SMSC

32

Call Forwarding
There are several different Call Forwarding cases

Call Forwarding Unconditional (CFU)

Call Forwarding on mobile subscriber Busy (CFB)
Call Forwarding on No Reply (CFNRy)
Call Forwarding on mobile subscriber Not Reachable (CFNRc)
Out of coverage
IMSI Detach (Phone switched off)

Each case can have a distinct Forward To number (FTN)

But usually call forwarding is set to Voicemail

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

33

Call Forwarding Unconditional (CFU)

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
ISUP IAM CIC=10

MAP Send Routing Info

GMSC

GMSC

SRI Ack (FTN)

HLR

ISUP IAM (FTN)

MSC/
VLR

Roamware Proprietary and Confidential

VoiceMail

Copyright Roamware Inc. 2003. All Rights Reserved.

34

CFNRc (IMSI Detach)

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
ISUP IAM CIC=10

MAP Send Routing Info

GMSC

GMSC

SRI Ack (FTN)

HLR

MAP Provide Roaming Number

ISUP IAM (FTN)
MSC/

VoiceMail

VLR
MAP PRN Ack (Error IMSI Detach)

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

35

CFB/CFNRy/CFNRc (no coverage)

Airtel, Delhi
(VPLMN)

Vodafone, Mumbai
(HPLMN)
ISUP IAM CIC=10
ISUP IAM (FTN)

Page
Failed

ISUP IAM
ISUP IAM (FTN)

GMSC

MAP Send Routing Info

GMSC

SRI Ack (MSRN)

HLR

MAP Provide Roaming Number

ISUP IAM

ISUP IAM (FTN)

MSC/

VoiceMail

VLR
MAP PRN Ack (MSRN)
MAP Send Info For Incoming Call

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

36

Early and Late Call Forwarding

Call Forwarding cases are classified as Early or Late
Early : Call (ISUP IAM) is forwarded from Home GMSC
Late: Call (ISUP IAM) goes to Serving MSC, and is
forwarded from there
Early Call Forwarding: CFU, CFNRc (IMSI Detach)
Late Call Forwarding: CFB, CFNRy, CFNRc (No coverage)
Late Call Forwarding is expensive when the subscriber is
roaming
Further, the VoiceMail system may not received the original
called number and hence may have to prompt the caller to
input the called number

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

37

Passive Node, Active Node, ISUP Loopback

Passive node
Monitoring/ eavesdropping
No address needed (point code / global title)
No load added to network

Active node
Participant in global SS7 network
Connectivity to at least one MSC/GMSC
Addresses needed (point code, global title)

ISUP Loopback
Convenient technique when a service/application needs to process
ISUP but not voice
Uses the MSCs ability to physically separate voice trunks from
signaling on 2 different lines (e.g. E1/T1s)
Signaling E1/T1 sent to application (e.g. Roamware node)
Voice trunk E1/T1 looped back to switch

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

38

Thank you

Thank you!

For more information:

Email : tarun.bhagattjee@roamware.com

Roamware Proprietary and Confidential

Copyright Roamware Inc. 2003. All Rights Reserved.

39