GSM and SS7 Overview

Terminology

GSM network elements

Home Location Register (HLR)
Visitor Location Register (VLR)
Mobile Switching Center (MSC)
Gateway Mobile Switching Center (GMSC)
Short Message Service Center (SMSC)
IMSI - International Mobile Subscriber Identity
MSIN Mobile Station Identification Number
MSISDN Mobile Station International ISDN Number
MCC Mobile Country Code
MNC Mobile Network Code
CC Country Code
NDC National Destination Code
Numbering plans E.164, E.212, E.214
Signaling basics Signaling System 7 (SS7) suite of protocols

IMSI, MSISDN and IMEI

IMSI
MCC MNC

MSIN

MSISDN
CC
NDC

Sub. No.

Country
UK
France
India

CC
44
33
91

MCC
234
208
404

Total of 15 digits. MCC and MNC take up a max of 6

digits. MCC is 3 digit Country Code and MNC is 2-3
digit (mostly 2) Network Code in the country
e.g. 404-20-1234567890
CC = Country Code
NDC = National Destination Code
e.g. 91-9820-026174
CC and MCC codes are different

Main components of a GSM network

Cell sites (BTS Base Transceiver Stations)
BSC - Base Station Controller (controls several
BTSs)
MSC - Mobile Switching Center (controls several
BSCs)
HLR Home Location Register
VLR Visitor Location Register
GMSC Gateway MSC
EIR Equipment Identity Register
AuC Authentication Center

HLR Home Location

Register
Stores a record for each subscriber of this network

IMSI
MSISDN
Subscription profile
Addresses of MSC and VLR currently serving the MS
The record is a permanent one it is there even if the
subscriber is roaming outside the home network
Has an interface to Customer Care / Billing system.

VLR Visitor Location

Register
Temporarily stores records for mobile subscribers who

are served/attached to a cell served by the MSC

attached to this VLR
Records are stored in VLR for local subscribers as well
as roamers.
Records are removed from the VLR as soon as the
subscriber leaves the area of this VLR and registers in
a new MSC/VLR pair
Caches subscriber data so that the HLR need not be
queried for everything.

Primary functions of the

VLR:
to inform the HLR that a subscriber
has arrived in the particular area
covered by the VLR

to track where the subscriber is within the VLR area (location area)
when no call is ongoing

to allow or disallow which services the subscriber may use

to purge the subscriber record if a subscriber becomes inactive whilst

in the area of a VLR. The VLR deletes the subscriber's data after a fixed
time period of inactivity and informs the HLR (e.g. when the phone has
been switched off and left off or when the subscriber has moved to an
area with no coverage for a long time).

to delete the subscriber record when a subscriber explicitly moves to

another, as instructed by the HLR

MSC Mobile Switching

Center

Also called the Switch

Controls multiple Base Stations; handles voice trunks
Responsible for setting up, routing and supervising calls to and
from the mobile subscriber
GMSC is a MSC with a capability to:
Interface between mobile network and other networks
Query the HLR to determine where to route an incoming call for
a subscriber of this network
A Pure GMSC is a GMSC that subscribers cannot latch on to (no
VLR attached and no BSCs connected)

What is SS7?

Is a global standard for telecommunication defined by the International

Telecommunication Union (ITU) .

Signaling System 7 (SS7) is a system that transports the information

required to set up and manage telephone calls by converting signaling
information to digital packets.

Signaling communication between different network elements to

achieve some purpose (most common and oldest purpose setting up
a phone call)

SS7 is a type of Common Channel signaling as it achieves signaling

by sending formatted messages on a common channel dedicated for
signaling

Evolved to control mobile/wireless and intelligent networking (800,

LNP, callerID)
9

SS7 Stack
Cellular/wireless
Intelligent
Networking
Call control

10

MTP = Message Transfer Part

Routing, datalink, physical

SCCP, TCAP in brief

SCCP (Signaling Connection Control Part):

Introduces more sophisticated routing and addressing
Adds the concept of a Global Title, which is a higher level address than the
point code
Global Titles are similar to phone numbers (CC+NDC+num)
Makes true End to End communication practical
SCCP is used as the transport layer for TCAP-based services such as freephone
(800/888), calling card, local number portability

TCAP(Transaction Capabilities Application Part):

Introduces the concept of transactions allowing applications to associated
related messages with each other
Supports primitives like Begin, Continue, End and Abort
Supports Transaction Ids for both sides (Orig and Dest), but transactions that
have a Begin-End pattern use only 1 Transaction id (Orig).
An SSP uses TCAP to query an SCP to determine the routing number(s)
associated with a dialed 800, 888, or 900 number. The SCP uses TCAP to return
a response containing the routing number(s) (or an error or reject component)
back to the SSP. Calling card calls are also validated using TCAP query and
response messages.
TCAP is used largely by switching locations to obtain data from databases or to
11
invoke features at another switch.

Roaming
Scenario
Airtel, Delhi
Hutch, Mumbai
(VPLMN)
(HPLMN)
simplified view
HLR

12

GMSC

GMSC

MSC/
VLR

HLR

MSC/
VLR

MSC/
VLR

SMSC

SMSC

Location Update
Vodafone,
Mumbai

Airtel, Delhi

MAP Insert Subscriber Data

MSISDN, Subscriber Profile Info

MAP Update Location Ack

MAP ISD Ack
LU Req

GMSC

GMSC

HLR

LU Cnf

MAP Update Location

MSC/
VLR

IMSI, VLR Address, HLR Address

MAP Update Location Area

IMSI, Loc Info (Cell id, Loc Area)

MSC/
VLR
MAP Cancel Location
HLR -> old VLR
MAP Can Loc Ack

MAP Upd Loc Area Ack

13

SMS (Short Message

When A sends an SMSService)
to B, it involves 2 steps:
A submits SMS to As home SMSC (MO SMS from A)
As SMSC delivers SMS to B (MT SMS to B)

Point to note SMS passes through only 1 SMSC (senders SMSC)

Either of the 2 steps (submit/delivery) can be done with a
program (e.g. News, Sports services on SMS) instead of a mobile
station:
E.g. SMS NEWS to 8888. Delivery step involves application instead
of MS.
News application responds: Submit step involves application instead
of MS.

SMSC Application communication is on TCP/IP, not SS7

These applications are called SMEs (Short Message Entities)
Several standard SMSC SME protocols such as SMPP, UCP,
CIMD2
14

Outgoing (MO) SMS

Airtel, Delhi

Orange, Mumbai

MO SMS
(IMSI, Text, B #, SC Address)

GMSC

GMSC

HLR

MAP MO Forward SM

MSC/
VLR

MAP Send Info For MO SMS

15

SMSC

Incoming (MT) SMS

Airtel, Delhi
(VPLMN)

Orange, Mumbai
(HPLMN)

Page and deliver

MAP MT Fwd SM Ack

GMSC

GMSC

MAP SRI_SM

HLR

MAP SRI_SM Ack (MSC Address)

MSC/
VLR

SMSC

16

MAP MT Fwd SM

Senders
SMSC

SMSC