GSM Events

IMSI Attach
A MS performs an IMSI Attach any time it comes onto a network. If a phone is just powering up, it will contact the network and perform an IMSI Attach, letting the network know where the MS is.

For the purposes of these diagrams, the BTS and BSC are shown together as the BSS and their functions are considered one. The MSC and VLR are also shown as one entity and will be treated as one network component, unless otherwise specified.

Channel Request
1. The MS will send a Channel Request (CHAN_REQ) message to the BSS on the RACH. 2. The BSS responds on the AGCH with an Immediate Assignment (IMM_ASS_CMD) message and assigns an SDCCH to the MS. 3. The MS immediately switches to the assigned SDCCH and sends a Location Update

Request (LOC_UPD_REQ) to the BSS. The MS will send either an IMSI or a TMSI to the BSS. 4. The BSS will acknowledge the message. This acknowledgement only tells the MS that the BTS has received the message, it does not indicate the location update has been processed.

IMSI Verification / Request Triplets

5. The BSS forwards the Location Update Request to the MSC/VLR. 6. The MSC/VLR forwards the IMSI to the HLR and requests verification of the IMSI as well as Authentication Triplets. 7. The HLR will forward the IMSI to the Authentication Center (AuC) and request authentication triplets.

8. The AuC generates the triplets and sends them along with the IMSI, back to the HLR. 9. The HLR validates the IMSI by ensuring it is allowed on the network and is allowed subscriber services. It then forwards the IMSI and Triplets to the MSC/VLR.

Authentication
10. The MSC/VLR stores the SRES and the Kc and forwards the RAND to the BSS and orders the BSS to authenticate the MS. 11. The BSS sends the MS an Authentication Request (AUTH_REQ) message to the MS. The only parameter sent in the message is the RAND. 12. The MS uses the RAND to calculate the SRES and sends the SRES back to the

BSS on the SDCCH in an Authentication Response (AUTH_RSP). The BSS forwards the SRES up to the MSC/VLR. 13. The MSC/VLR compares the SRES generated by the AuC with the SRES generated by the MS. If they match, then authentication is completed successfully.
*For a more in-depth discussion of authentication and encryption, view the Authentication and Encryption Tutorial.

Encryption
14. The MSC/VLR forwards the Kc for the MS to the BSS. The Kc is NOT sent across the Air Interface to the MS. The BSS stores the Kc and forwards the Set Cipher Mode (CIPH_MOD_CM D) command to the MS. The CIPH_MOD_CM D only tells the MS which encryption to use (A5/X), no

other information is included. 15. The MS immediately switches to cipher mode using the A5 encryption algorithm. All transmissions are now enciphered. It sends a Ciphering Mode Complete (CIPH_MOD_CO M) message to the BSS. 16. The MSC/VLR sends a Location Updating Accept (LOC_UPD_ACC) message to the BSS. It also generates a new TMSI for the MS. TMSI assignment is a function of the VLR. The BSS will either send the TMSI in the LOC_UPD_ACC message or it will send a separate TMSI Reallocation Command message (TMSI_REAL_CM D). In both cases, since the Air Interface is now in cipher mode, the TMSI is not compromised.

Location Update

17. The MS sends a TMSI Reallocation Complete message (TMSI_REAL_CO M) up to the MSC/VLR. 18. The BSS instructs the MS to go into idle mode by sending it a Channel Release (CHAN_REL) message. The BSS then deassigns the SDCCH. 19. The MSC/VLR sends an Update Location message to the HLR. The HLR records which MSC/VLR the MS is currently in, so it knows which MSC to point to when it is queried for the location of the MS.

IMSI Attach Introduction

IMSI Detach

Location Update

Mobile-Originated Call

Mobile-Terminated Call Timing Advances

Architecture

TDMA

Logical Channels Authentication & Encryption Speech Encoding GSM Events Updates Bulletin Board Sitemap Contact Me

Home