IMSI Attach

A MS performs an IMSI Attach any time it comes onto a network. If a phone is just powering up, it will contact the network
and perform an IMSI Attach, letting the network know where the MS is.
For the purposes of these diagrams, the BTS and BSC are shown together as the BSS and their functions are considered one. The MSC and VLR are
also shown as one entity and will e treated as one networ! component, unless otherwise specified.
1) Channel e!uest
". The MS will send a Channel Request (CHAN_REQ) message to
the BSS on the R#C$.
%. The BSS responds on the #&C$ with an Immediate Assignment
(IMM_ASS_CMD) message and assigns an S'CC$ to the MS.
(. The MS immediately switches to the assigned S'CC$ and
sends a Location !date Request (L"C_#D_REQ) to the BSS.
The MS will send either an )MS) or a TMS) to the BSS.
*. The BSS will ac!nowledge the message. This ac!nowledgement
only tells the MS that the BTS has recei+ed the message, it does
not indicate the location update has een processed.
IMSI "erification # e!uest $riplets
,. The BSS forwards the Location -pdate Re.uest to the
MSC/VLR.
0. The MSC/VLR forwards the )MS) to the $LR and re.uests
+erification of the )MS) as well as #uthentication $%i!lets.
1. The $LR will forward the )MS) to the #uthentication Center
2#uC3 and re.uest authentication triplets.
4. The #uC generates the triplets and sends them along with the
)MS), ac! to the $LR.
5. The $LR +alidates the )MS) y ensuring it is allowed on the
networ! and is allowed suscrier ser+ices. )t then forwards the
)MS) and Triplets to the MSC/VLR.
Authentication
"6. The MSC/VLR stores the SR7S and the 8c and forwards the
R#9' to the BSS and orders the BSS to authenticate the MS.
"". The BSS sends the MS an Authentication Request
(A$H_REQ) message to the MS. The only parameter sent in the
message is the R#9'.
"%. The MS uses the R#9' to calculate the SR7S and sends the
SR7S ac! to the BSS on the S'CC$ in an Authentication
Res!onse (A$H_RS#). The BSS forwards the SR7S up to the
MSC/VLR.
"(. The MSC/VLR compares the SR7S generated y the #uC
with the SR7S generated y the MS. )f they match, then
authentication is completed successfully.
:For a more in;depth discussion of authentication and encryption, +iew the
#uthentication and 7ncryption Tutorial.
%ncryption
"*. The MSC/VLR forwards the 8c for the MS to the BSS. The
8c is 9<T sent across the #ir )nterface to the MS. The BSS stores
the 8c and forwards the Set Ci!he% Mode (CI#H_M"D_CMD)
command to the MS. The C)=$>M<'>CM' only tells the MS
which encryption to use 2#,/?3, no other information is included.
",. The MS immediately switches to cipher mode using the #,
encryption algorithm. #ll transmissions are now enciphered. )t
sends a Ci!he%ing Mode Com!lete (CI#H_M"D_C"M) message
to the BSS.
"0. The MSC/VLR sends a Location !dating Acce!t
(L"C_#D_ACC) message to the BSS. )t also generates a new
TMS) for the MS. TMS) assignment is a function of the VLR. The
BSS will either send the TMS) in the L<C>-='>#CC message or
it will send a separate $MSI Reallocation Command message
($MSI_REAL_CMD). )n oth cases, since the #ir )nterface is now
in cipher mode, the TMS) is not compromised.
&ocation 'pdate
"1. The MS sends a $MSI Reallocation Com!lete message
($MSI_REAL_C"M) up to the MSC/VLR.
"4. The BSS instructs the MS to go into idle mode y sending it a
Channel Release (CHAN_REL) message. The BSS then deassigns
the S'CC$.
"5. The MSC/VLR sends an !date Location message to the
$LR. The $LR records which MSC/VLR the MS is currently in,
so it !nows which MSC to point to when it is .ueried for the
location of the MS.
IMSI (etach
A MS will perform an IMSI (etach when it powers off. An IMSI (etach message informs the network that the MS is no
longer on the network and should not )e paged. $his allows the network to process a call rejection faster, instead of waiting
for paging re!uests to not )e answered. In most networks, the MSC#"& will initiate an IMSI (etach if the MS has not )een
acti*e on the network for a specified period of time.
Channel e!uest and IMSI (etach e!uest
". The MS re.uests a channel in the same manner it does in the
Location -pdate and )MS) #ttach. The MS sends a Channel
Re.uest message on the R#C$. The BSS replies on the #&C$ and
assigns the MS a S'CC$.
%. The MS sends an IMSI Detach Indication (IMSI_DE$_IND)
message to the BSS on the S'CC$. The BSS forwards the
message to the MSC/VLR
:#t this point, the networ! would re.uire the MS to authenticate prior to
continuing. See the #uthentication and 7ncryption Tutorial for more
information.
IMSI (etach e!uest
(. The MSC/VLR sends a Location Cancel Request to the $LR.
*. The $LR mar!s the )MS) as detached and remo+es any pointers
for the )MS) from its registry. )t then sends a Location Cancel
Ac&no'ledgemnt message to the MSC/VLR.
&ocation 'pdate
A MS will need to update its location whene*er it mo*es to a tower that is ser*iced )y a different "& then the one it is
currently on. An MS c an mo*e from +$S to +$S without e*er telling the network, as long as it is within the same location
area. ,nce it mo*es to a new location area, it is re!uired to inform the network.
$he MS mo*es to another &ocation Area
#s a MS mo+es around it is constantly monitoring the signal
strength of the BCC$ of its current BTS, as well as neighoring
BTS@s to determine if the neighors ha+e a stronger signal. Ahen
the MS is in idle mode 2not in a call3, it will determine for itself
when to mo+e from its current BTS to a more attracti+e one. Ahen
the MS switches from a BTS in one VLR to a BTS in a different
VLR, it must do an location update, so the networ! !nows which
MSC/VLR the MS is currently using.
)n the diagram on the right, we see two different location a%eas
ser+iced y two different VLR@s. The MS is currently sitting on
BTS;% in Location #rea ". #s the MS mo+es towards the edge of
the location area, it measures BTS;( as eing stronger and decides
to switch to that BTS. Since BTS;( is in another location area, it
will need to do a location update.
1) Channel e!uest
Bust li!e the )MS) #ttach, and e+ery other time the MS re.uests
access, it goes through the same procedures.
". The MS re.uests a channel y sending a Channel Request
2C$#9>R7C3 message on the R#C$.
%. The BTS responds y sending an Immediate Assignment
Command message 2)MM>#SS>CM'3 on the #&C$.
(. The MS switches to the assigned S'CC$ and replies with a
Location !date Request 2L<C>-='>R7C3. )ncluded in the
L<C>-='>R7C is the TMS) the MS is currently using as well as
the Location A%ea Identi(ie% 2L#)3 of the VLR it is lea+ing.
*. The BTS ac!nowledges receipt of the message.
- .aining "& re!uests data from &osing "&
,. The BSS forwards the Location -pdate Re.uest to the gaining
MSC/VLR.
0. The gaining MSC/VLR does not recogniDe the TMS)/)MS) of
the MS, so it contacts the losing MSC/VLR that corresponds to the
L#) that was pro+ided y the MS. The new MSC/VLR re.uests
the suscrier data for the gi+en TMS).
1. The gaining MSC/VLR will then authenticate the MS. There are
two ways this could occur. First, the losing MSC/VLR may ha+e
forwarded any sets of triplets that it was retaining for the MS. The
gaining MSC/VLR would then Eust use the neFt set of triplets.
Second, the gaining MSC/VLR could contact the $LR and re.uest
authentication triplets from the #uC and proceed with
authentication that way.

/) &ocation 'pdate
4. <nce the MS has een authenticated and is in Cipher Mode, the
MSC/VLR sends a Location -pdate #ccept message
2L<C>-='>#CC3 through the BSS to the MS. The
L<C>-='>#CC may ha+e a TMS) assignment in it, otherwise
the TMS) will e assigned in a TMS)>R7#L>CM' message.
5. The MS will respond with a TMS) Reallocation Complete
message 2TMS)>R7#L>C<M3 indicating it has recei+ed the
TMS).
"6. The BSS then sends the MS a Channel Release message
2C$#9>R7L3 instructing it to go into idle mode. The BSS then
unassigns the S'CC$. #s far as the MS is concerned, the location
update has een completed.
0) 'pdating the egisters
The &aining MSC/VLR sends an !date Location message to the
$LR. The $LR updates its records to point to the gaining
MSC/VLR when it is as!ed for its location. )t also passes on
suscrier information for the MS to the gaining MSC/VLR.
The $LR sends a Cancel Location message to the losing
MSC/VLR. The losing MSC/VLR deletes the MS@s record and
also releases the TMS) for reassignment. The losing MSC/VLR
sends a Cancel Location Result message ac! to the $LR,
confirming the cancellation.
Mo)ile ,riginated Call
A Mo)ile ,riginated Call is a call that is initiated )y the MS. $he following e1ample is a mo)ile2originated call that
terminates outside the 3&M4.
1) e!uest Access
". The MS sends a Channel Request 2C$#9>R7C3 message on
the R#C$.
%. The BSS responds with a radio resource assignment
2)MM>#SS>CM'3 on the #&C$.
(. The MS sends a Se%)ice Request 2CM>S7RV>R7C3 message
to the BSS on the S'CC$.
-) Authentication
*. Before the networ! will pro+ide any ser+ices to the MS, the
networ! will re.uire the MS to authenticate itself. The BSS sends
an Authentication Request 2#-T$>R7C3 message to the MS.
The R#9' ser+es as the GchallengeG for authentication.
,. The MS calulates the proper SR7S ased on the R#9' that
was gi+en and sends the SR7S to the BSS in an Authentication
Res!onse 2#-T$>R7S=3 message.
0. The BSS +erifies the SR7S. )f the SR7S is correct then the MS
is authenticated and allowed access to the networ!. The BSS will
send a Se%)ice Acce!t 2CM>S7RV>#CC3 message letting the MS
!now that the ser+ice re.uest was recei+ed and processed.
1. <nce authenticated, the BSS orders the MS to switch to cipher
mode with the C)=$>M<'>CM' message.
/) Initial Call Setup
4. The MS will immediately switch to cipher mode and send a
Ci!he% Mode Com!lete 2C)=$>M<'>C<M3 message.
5. The MS then sends a Call Setu! 2S7T-=3 message to the BSS.
The message includes the address information 2MS)S'93 of the
called party.
"6. The BSS assigns a TC$ to the MS y sending an Assignment
Command 2#SS>CM'3 message. This message includes which
Transcei+er 2TR?3 and which Time Slot 2TS3 to use.
:The BSS does not actually assign a TC$ to the MS until the MSC sends a
Call #%oceeding 2C#LL>=R<C3 message to the BSS indicating that the )#M
has een sent.
"". The MS imemdiately switches to the assigned TC$. The MS
sends an Assignment Com!lete 2#SS>C<M3 message ac! to the
BTS on the F#CC$.
:Rememer that a F#CC$ is not a separate channel, it is simply a stolen time
slot from the TC$ that is used for signalling data instead of +oice traffic.
0) Call Setup
"%. The MSC sends an Initial Add%ess Message 2)#M3 to the
&MSC. The )#M contains the MS)S'9 of the called party as the
MS dialed it.
The MSC will also send a Call =roceeding 2C#LL>=R<C3 message down to
the BSS and this is when the BSS would assign a TC$ to the MS, as descried
in step "6 ao+e.
"(. Based on the dialed numer, the &MSC decides where to
route the )#M within the =ST9.
"*. The =ST9 will continue to route the )#M until it reaches the
correct Switching Center and the call routing is complete. The
=ST9 will then estalish the call circuit and send an Add%ess
Com!lete Message 2#CM3 ac! to the &MSC.
",. The &MSC then forwards the #CM ac! to the responsile
MSC indicating that the call circuit has een estalished.
5) Call %sta)lishment
"0. <nce the MSC recei+es the #CM, it sends an #L7RT
message to the MS indicating that the call is going through. The
BSS sends the #L7RT message on the F#CC$. <nce the MS
recei+es the #L7RT, it will generate the ringing sound in the
earpiece. The BSS sends an alerting message the suscrier will
hear the line ringing.
"1. <nce the called party answers the phone, the =ST9 will send
an #nswer message to the MSC. The MSC forwards this to the
MS in a Connection 2C<93 message.
"4. <nce the MS recei+es the C<9 message, it switches o+er to
+oice and egins the call. #ll +oice traffic occurs on the assigned
TC$.
6) Call $ermination
"5. Ahen either the caller or the called party hangs up, the call
will e disconnected. 7ither party can initiate the disconnect. )n
this eFample, the MS initiates the disconnect. The MS sends a
Disconnect 2')SC3 message to the BTS on the F#CC$.
%6. The BSS forwards the ')SC to the MSC. <nce the MSC
recei+es the ')SC message, it sends a Release 2R7L3 message
through the &MSC to the =ST9 as well as down through the BSS
to the MS.
%". The MS responds y sending a Release Complete
2R7L>C<M3 message to the BSS on the F#CC$. The BSS
forwards the R7L>C<M message up to the MSC. <nce the MSC
recei+es the R7L>C<M message the call is considered ended
from the call cont%ol perspecti+e.
%". #lthough the call has ended, the BSS still has a TC$ allocated
to the MS. The MSC sends a Channel Release 2C$#9>R7L3
message to the BSS. The BSS forwards the C$#9>R7L message
to the MS.
%%. The MS responds with a ')SC 2L#='m3 message and returns
to an idle mode. The BSS deallocates the channel and releases the
TR?.
Mo)ile $erminated Call
$he term Mobile Terminated Call refers to when the MS is the recei*er of a call. In this e1ample, the call is originating from
outside the 3&M4.
1) oute %sta)lishment
". The calling party dials the MS)S'9 for the moile suscrier.
The =ST9 identifies the networ! 2=LM93 that the dialed
MS)S'9 elongs to and will locate a &MSC for that networ!.
The =ST9 sends an Initial Add%ess message to the &MSC.
%. The &MSC forwards the MS)S'9 to the $LR and re.uests
routing information for it. The $LR loo!s up the MS)S'9 and
determines the )MS) and the SS* address for the MSC/VLR that
is ser+icing the MS.
(. The $LR then contacts the ser+icing MSC/VLR and as!s it to
assign a Moile Station Routing 9umer 2MSR93 to the call.
*. The MSC/VLR allocates the MSR9 and forwards it to the
$LR.
:9oteH )t is important to rememer that the MSC/VLR assigns a MSR9 to the
call not to the MS itself.
,. The $LR forwards the MSR9 as well as routing information
for the ser+icing MSC/VLR to the &MSC.
0. The &MSC sends an )nitial #ddressing message to the
ser+icing MSC/VLR and uses the MSR9 to route the call to the
MSC/VLR. <nce the ser+icing MSC/VLR recei+es the call, the
MSR9 can e released and may e made a+ailale for
reassignment.
:9oteH This is implementation dependent.
-) 3aging the Mo)ile Station
1.The MSC/VLR then orders all of its BSCs and BTSs to page
the MS. Since the MSC/VLR does not !now eFactly which BSC
and BTS the MS is monitoring, the page will e sent out across
the entire Location #rea.
/) Initial Setup
4. The MS recei+es the #age Request 2=#&>R7C3 on the =C$.
The MS recogniDes that the page is intended for it, ased on a
TMS) or an )MS).
5. The MS sends a Channel Request 2C$#9>R7C3 message on
the R#C$.
"6. The BSS responds on the #&C$ y sending an Immediate
Assignment 2)MM #SS3 message which assigns an S'CC$ to
the MS. #t this point, the networ! does not !now that the MS is
the one that it is paging, it only !nows that this MS wants access
to the networ!.
"". The MS immediately switches to the assigned S'CC$ and
sends a #aging Res!onse 2=#&>R7S3 message on the S'CC$.
This lets the networ! !now that the MS is responding to its page.
0) Authentication
"%. Before the networ! will pro+ide any ser+ices to the MS, the
networ! will re.uire the MS to authenticate itself. The BSS sends
an Authentication Request 2#-T$>R7C3 message to the MS.
The R#9' ser+es as the GchallengeG for authentication.
"(. The MS calulates the proper SR7S ased on the R#9' that
was gi+en and sends the SR7S to the BSS in an Authentication
Res!onse 2#-T$>R7S=3 message.
"*. The BSS +erifies the SR7S. )f the SR7S is correct then the
MS is authenticated and allowed access to the networ!.
",. <nce the MSC/VLR has authenticated the MS, it will order
the BSS and MS to switch to cipher mode using the
C)=$>M<'>CM' message. <nce the MS in in encryption
mode, the VLR will normally assign a new TMS) to the MS.
5) %sta)lishing a Channel
"0. <nce the MS is authenticated and in encryption mode, The
MSC sends a Setup Message to the BSS, the BSS forwards the
S7T-= message to the MS on the assigned S'CC$.the assigned
S'CC$. The S7T-= message may include the Calling Line
Identi(ication #%esentation 2CL)=3, which is essentially caller )'.
"1. The MS responds y sending a Call Con(i%med
2C#LL>C<93 messageI which indicates that the MS is ale to
estalish the re.uested connection. The BSS relays the message
up to the MSC.
,rJ
6)Call Setup
"4. The BSS then sends an Assignment Command 2#SS>CM'3
message to the MS on the assigned S'CC$. The #SS>CM'
message assigns a Traffic Channel 2TC$3 to the MS.
"5. The MS immediately switches to the TC$ and responds with
an Assignment Com!lete 2#SS>C<M3 message on the F#CC$.
The MS egins ringing once it has estalished the TC$.
:Rememer that all signaling that occurs on the traffic channel actually occurs
on a F#CC$, which is a time slot that is stolen from the TC$ and used for
signaling.
%6. The MS sends an #L7RT message to the MSC on the
F#CC$. The BSS forwards the #L7RT message through the
=ST9 to the calling party and the caller hears the line ringing.
7) %sta)lishing the Call
%". <nce the user answers the call 2y pressing the send utton3,
the MS will send a Connect C<9 message to the MSC. The
Connect message is forwarded ac! to the caller@s switch to
acti+ate the call.
%%. The MSC sends a Connect Ac&no'ledge C<9>#C8
message to the MS and the call is estalished.
8) (isconnecting the Call
%(. # disconnect happens the same way as for any other call. )n
this eFample, the calling party initiates the disconnect.
:<nly the #ir )nterface is shown here.
%*. Ahen the calling party hangs up, the calling party@s switch
initiates a Release 2R7L3 message. The message is forwarded to
the ser+ing MSC, which is then forwarded to the BSS.
%,. The BSS will send a Disconnect 2')SC3 message to the MS
on the F#CC$.
%0. The MS confirms release of the call y sending a Release
2R7L3 message on the F#CC$, which is forwarded to the MSC.
%1. The MSC sends e Release Com!lete 2R7L>C<M3 message
through the BSS to the MS. #s far as call control 2CC3 is
concerned, the connection has een terminated.
%4. The MS still has a TC$ assigned to it, so the BSS sends a
Channel Release 2C$#9>R7L3 message to the MS. This releases
the radio resource on the #ir )nterface.
%5. The MS responds e sending a final Disconnect message and
returns to idle.