MSC Innovation Configuration

SSNC: Signaling
Trunks and LTG System
SS7 Links PCM30/24
Network
Control
LTG LTG: Line Trunk
High Speed SN B Group
SS7 Links SN: Switching
Network
MB: Message
NetM Buffer Typ D
SSNC IOP: Input/Output
207Mb/s Processor
MB D AMP: ATM Bridge
Processor
207Mb/s CP: Coordination
Processor
AMPC IOP:MB NetM: Net Manager
CP
 MSC structure
Access
Switching
DLU LTG SN

LTG

Signaling Coordination
System
Network SYP
SSNC
Control MB CP
CCG
 Some terms of the Circuit Switched Exchange Telephony
Switching
Exchange Switching
Transit Call and Exchange
1 Outgoing Traffic
3

Switching
Lines Trunks Exchange

2
Incoming
Calling Party Traffic
(A Subscriber)
Originating
Call Transit
Exchange

Switching
Exchange Switching
Exchange
Busy
4
5

Originating Idle
Exchange Terminating
Exchange

Called Party
Note: The network shown here is only an example.
(B Subscriber)
 Routing

Routing in general is the method, how to find a way through a network
for a given Routing Information.

Whithin a Switch, Routing is to find an outgoing trunk, according to the

evaluation results of the Routing Information

Some typical elements of the Routing Information whithin a Switch:

Called Party Number (= dialed number, the most classical element)
Originating Trunk (where the call comes from, see Origin. Depend.
Routing)
Category of the Calling Subscriber (Ordinary, Priority, Operator,..)
Calling Party Number
Transmission Medium Required (Any, Only Digital, Analog,..)
….

During the evaluation of the of the Routing Information, one, some or

all elements can be considered.
Authentication and Ciphering
 Authentication and ciphering execution

In the personalization center (PCS), the SIM cards are produced on the one hand and the
database for the subscriber are generated in the authentication center on the other.

The following parameters are necessary on the SIM card along with the IMSI for
authentication and ciphering:
Ki General key
A3 Algorithm 3. Used for generating the authentication code
A8 Algorithm 8. Used for generating the ciphering key

The following parameters are necessary in the database commands along with theIMSI for
authentication and ciphering:
KiA4 General key, however enciphered with algorithm A4 and additional key K4
A3 version Version of the algorithm 3 stored in the AC and to be used.
A8 Version Version of the algorithm 8 stored in the AC and to be used.
The KiA4 is deciphered in the AC with the help of algorithm A4 and key K4 (Ki=A4(K4,KiA4))
and is stored, enciphered again (KiA2=A2(K2,Ki)), in the subscriber database as KiA2 with
A2 and K2.

As soon as the subscriber is set up in the HLR, the AC begins with the generation of the
security parameters. These consist of three values: the rand (a random value), the Sres or
signed response (electronic signature for authentication) and the kc (key for the ciphering on
the radio interface). These three values are designated "triples". A reserve of 6 "triples" are
provisioned.
Authentication and ciphering execution (part2)
Authentication
• The Rand is relayed to the mobile station. This generates the Sres with
the help of the parameter Ki stored on the SIM card and A3 (Sres
=A3(ki ,rand)). The Sres is sent back to the MSC/VLR and there
compared with the Sres of the triple. If both Sres are the same, the
authentication is successful. If they are different, the SIM card is
rejected, and only emergency calls are possible depending on the
project.

Ciphering
• For the ciphering, the Rand is also used in the MS. The key Kc is
generated (Kc=A8(Ki, Rand)) with the help of the parameter Ki stored
on the SIM card and A8. The ciphering is thereupon carried out with the
algorithm 5 stored in the mobile equipment and the key Kc. The key Kc
contained in the triple is meanwhile relayed to the BSS. The algorithm
A5 is also available here, so that the ciphering can be carried out here
as well.
 Location Registration
Since subscribers can change their locations in the PLMN any number of times, it is
absolutely necessary to log the current site to a central position for the availability of
the subscriber. This central position is the HLR of the respective subscriber.
Therefore the routing label of the visited MSC/VLR is entered there.

Location update is carried out for the following situations:

• When first checking into a network.
– The subscriber checks into a network for the first time.
• Upon change of location.
– The subscriber changes to another MSC area.
• Periodical location update (only in the VLR)
– A time provider in the mobile station runs out and a location update is carried out
in the VLR.
• After failure of the HLR
– After a HLR failure, all affected VLRs are informed of the possible data loss. After
subsequent originating traffic (mobile originating call), for instance, a location update is
carried out in the HLR.
 Location up-date
MS BS/MSC/VLR
old LAI & old TMSI

Allocate
new TMSI

ciphered(new TMSI)

Acknowledgement

• While staying in the old MSC area, the identification code of the location area (LAI location area ID) is
noted on the SIM card (subscriber identity Module)
• If the subscriber now moves to a new MSC area and thus also to a new location area, the mobile
subscriber receives a new LAI from the MSC/VLR.
• Since the new LAI is different from the old LAI, the mobile subscriber sends both LAIs back to the MSC.
• If the new MSC knows the old LAI or the corresponding old MSC/VLR, it requests from there the security
parameters not used (triples) and the subscriber identification IMSI (international mobile subscriber identity).
• Hereupon the new location area is transmitted to the HLR from the new VLR/MSC.
• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
in the VLR.
Location up-date –
TMSI unknown
MS BS/MSC/VLR
old LAI & old TMSI

old TMSI
unknown
ID request

IMSI

Allocate
new TMSI

ciphered(new TMSI)

Acknowledgement
 Location Update with Location Change to an
Unknown MSC/VLR

• While staying in the old MSC area, the identification code of the location area
• (LAI location area ID) is noted on the SIM card (subscriber identity Module)
• If the subscriber now moves to a new MSC area and thus also to a new location
• area, the mobile subscriber receives a new LAI from the MSC/VLR.
• Since the new LAI is different from the old LAI, the mobile subscriber sends both
• LAIs back to the MSC.
• Since in this case the old MSC/VLR is unknown in the new MSC/VLR, the MSC/
• VLR requests the subscriber identification number (IMSI international subscriber
• identity) from the mobile subscriber and transmits the new location to the HLR.
• The HLR thereupon informs the old MSC/VLR that the subscriber is to be deleted
• in the VLR.
Mobile Originated Call (MOC) in D900

•The dialing information is received via BSSAP in the MSC.

•An audit of possible subscriber restrictions takes place in the MSC/VLR.
•The dialing information is converted in the MSC and via the routing a route into
the PSTN is determined.

A-interface Signalling
BSSAP e g by ISUP, TUP, MFCR2
based on SCCP

VLR
Visited Transit Transit Terminating
BSC B B B B
MSC switch switch exchange
number number number number

MOC Transit Call Transit Call Terminating Call B-side

Outgoing Traffic Outgoing Traffic Outgoing Traffic Terminating Traffic terminal
equipment
BTS

Air interface
A-side
Mobile Station
MOC macro

Message 1 MSC <- BSS CR(Complete L3 info(CM service request))

Message 2 MSC -> BSS CC(Authentication Request)
Message 3 MSC <- BSS DT1(Authentication Response)
Message 4 MSC -> BSS DT1(Cipher Mode Command)
Message 5 MSC <- BSS DT1(Cipher Mode Complete)
Message 6 MSC -> BSS DT1(ID Request (IMEI))
Message 7 MSC <- BSS DT1(Setup)
Message 8 MSC -> BSS DT1(Call Proceeding)
Message 9 MSC -> BSS DT1(Assignment Request)
Message 10 MSC <- BSS DT1(ID Response (IMEI))
Message 11 MSC <- BSS DT1(Assignment Complete)
Message 12 MSC -> BSS DT1(TMSI Reallocation Command)
Message 13 MSC <- BSS DT1(TMSI Reallocation Complete)
Message 14 PSTN <- MSC IAM
Message 15 PSTN -> MSC ACM
Message 16 MSC -> BSS DT1(Alerting)
Message 17 PSTN -> MSC ANM
Message 18 MSC -> BSS DT1(Connect)
Message 19 MSC <- BSS DT1(Connect Acknowledge
Mobile Originated Call (MOC) in D900 with MNP (QoD – query on digits)

•The dialing information is received via BSSAP in the MSC.

•An audit of possible subscriber restrictions takes place in the MSC/VLR.
•Based on the dialled digits, MNP query is started; MNP server is triggered
•The information from MNP server is converted in the MSC and via the routing a
route into the PSTN is determined.

A-interface MNP server Signalling

BSSAP e g by ISUP, TUP, MFCR2
based on SCCP

VLR
Visited Transit Transit Terminating
BSC B B B B
MSC switch switch exchange
number number number number

MOC Transit Call Transit Call Terminating Call B-side

Outgoing Traffic Outgoing Traffic Outgoing Traffic Terminating Traffic terminal
equipment
BTS

Air interface
A-side
Mobile Station
 Mobile Terminating Call e.g. from PSTN

• The dialing information is received by PSTN e.g. via ISUP in the PLMN
gateway MSC
• The dialing information is converted in the gateway MSC.
• A so-called "interrogation" is started as a response; i.e. a MAP message
is sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
• The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the gateway MSC.
• The gateway MSC converts this temporary directory number and sets up
a circuit connection (ISUP) to the visited MSC. The location area is
specified in the MSC/VLR owing to the cross-connection between
temporary directory number and mobile subscriber.
• The visited MSC now sends a "paging" to all BSCs situated in the location
area.
• The BSC in which the subscriber is currently situated answers with a
"paging response".
• The MSC makes the connection to the called subscriber.
 Mobile Terminating Call

A-side
terminal A-interface
equipment Signalling BSSAP
e g by ISUP (TUP, MFCR2) Mobile based on SCCP
Terminating
Traffic
BSC
Transit MSISDN Gateway MSRN Transit MSRN Visited
MSISDN
switch MSC switch MSC MSRN
local
Outgoing VLR
exchange Transit Call
Interrogation Traffic
Outgoing BTS
SendRoutingInfo
Originating Call Traffic
Outgoing Traffic Provide
MSRN MSRN RoamingNr

Air interface
HLR

MAP signalling B-side

Mobile Station
based on SCCP and TCAP
MTC macro

Message 1 PSTN -> MSC IAM

Message 2 MSC -> BSS UDT(paging)
Message 3 MSC <- BSS CR(ComL3Inf (Paging response)
Message 4 MSC -> BSS CC(Authentication Request)
Message 5 MSC <- BSS DT1(Authentication Response)
Message 6 MSC -> BSS DT1(Cipher Mode Command)
Message 7 MSC <- BSS DT1(Cipher Mode Complete)
Message 8 MSC -> BSS DT1(ID Request)
Message 9 MSC -> BSS DT1(Setup)
Message 10 MSC <- BSS DT1(ID Response)
Message 11 MSC -> BSS DT1(TMSI Reallocation Command)
Message 12 MSC <- BSS DT1(Call Confirmed)
Message 13 MSC -> BSS DT1(Assignment Request)
Message 14 MSC <- BSS DT1(Assignment Complete)
Message 15 MSC <- BSS DT1(TMSI Reallocation Complete)
Message 16 MSC <- BSS DT1(Alerting)
Message 17 PSTN <- MSC ACM
Message 18 MSC <- BSS DT1(Connect)
Message 19 MSC -> BSS DT1(Connect Acknowledge)
Message 20 PSTN <- MSC ANM
 Mobile Terminating Call with MNP (QoHLR – query on HLR)

A-side
terminal
equipment Signalling Transit
e g by ISUP (TUP, MFCR2) switch

Transit MSISDN Gateway Transit

MSISDN
switch MSC switch
local
exchange Outgoing
Transit Call Traffic
Interrogation
Outgoing
SendRoutingInfo
Originating Call Traffic
Outgoing Traffic
Unknown subscriber

HLR

MAP signalling
based on SCCP and TCAP
 Call Forwarding Unconditional

A-side
terminal
equipment Signalling
e g by ISUP (TUP, MFCR2)

Transit MSISDN Gateway FTNO Transit FTNO

MSISDN terminating
switch MSC switch exchange
local
exchange Transit Call Transit Call
Transit Call
Interrogation Outgoing Traffic Terminating Call
Outgoing
Terminating Traffic
Originating Call Traffic
Outgoing Traffic
SendRoutingInfo FTNO

C-side
B side (mobile) to terminal
HLR C side equipment

MAP signalling
based on SCCP and TCAP
 Mobile to Mobile Call (Mobile Subscribers in
different MSC/VLRs)
• The dialing information is received via BSSAP in the MSC
• An audit of possible subscriber restrictions takes place in the MSC/VLR
• The dialing information is converted in the visited MSC of the calling
subscriber.
• A so-called "interrogation" is started as a response; i.e. a message is
sent to the HLR in order to obtain location-specific routing information.
The HLR knows the location routing label i.e. the MSC/VLR by the
"location update" and relays the query there.
• The MSC/VLR makes a temporary directory number available and sends
it back via the HLR to the MSC of the calling subscriber.
• The MSC of the calling subscriber converts this temporary directory
number and sets up a circuit connection (ISUP) to the visited MSC. The
location area is specified in the MSC/VLR owing to the cross-connection
between temporary directory number and mobile subscriber.
• The visited MSC now sends a "paging" to all BSCs situated in the
location area. The BSC in which the subscriber is currently situated
answers with a "paging response".
• The MSC makes the connection to the called subscriber.
 MIC LOOP: (Mobile Internal Call Loop)
MS BSSAP - LTG

CP
MOC
LOOP - LTG

MTC
CP

MS BSSAP - LTG
MIC-Code would be
neccesary
 The ORIG1 Story

When we need to perform different actions in differnet callsetup-states with the
same digits, then we use the ORIG1 parameter in command CR CPT

The ORIG1 can be imagined as an additional digit suffix. It is copied into the CPB
and is together with the digits an additional input for the digittranslator.

There are two kinds, how an ORIG1 can be assigned to a call (and copied to the
CPB):
a) assignment via incoming trunk group
b) assignment within specific callsetup

An incoming trunkgroup can be forced to assign an ORIG1 by the ORIG1

parameter in CR TGRP. (see Origination Dependent Routing in the EWSD).
This method is used in D900 MIC/PBX-loop treatment to distinguish between
BSSAP, Trunk or PBX call origination

In specific cases during call setup, the assignement occurs with a procedural
access to preadministered ORIG1 values for MSRN, CF, IN Loop, NP,...
(see MML command ENTRMPRDDAT)
 Quiz
• Q1: Does the HLR know the respective location of the subscriber?
• Q2: Does the AC generate the mobile station roaming number?
• Q3: Does the MSC serve to through connect the call from the BSC
to other MSCs?
• Q4: Which number serves to identify the subscriber and is stored on
the SIM card?
• Q5: With which number can the subscriber be internationally dialed?
• Q6: Which number is transmitted to the equipment identification
register for auditing?
• Q7: Which number is used instead of the IMSI in order to avoid
unnecessary interchange of the IMSI via the radio interface?
• Q8: Which three components does a so-called triple comprise?
• Q9: Which parameter of the triple compares the MSC/VLR for the
authentication test?
• Q10: Did you find this course interesting/usefull?
 Answers

• A1: Yes
• A2: No
• A3: Yes
• A4: IMSI
• A5: MSISDN
• A6: IMEI
• A7: TMSI
• A8: Sres, rand, kc
• A9: Sres
• A10: Of course