7 gsm events.doc

8/11/2019 7 GSM Events.doc

1/16

IMSI Attach

A MS performs an IMSI Attach any time it comes onto a network. If a phone is just powering up, it will contact the network

and perform an IMSI Attach, letting the network know where the MS is.

For the purposes of these diagrams, the BTS and BSC are shown together as the BSS and their functions are considered one. The MSC and VLR arealso shown as one entity and will e treated as one networ! component, unless otherwise specified.

1) Channel e!uest". The MS will send a Channel Request (CHAN_REQ)message to

the BSS on the R#C$.

%. The BSS responds on the #&C$ with anImmediate Assignment

(IMM_ASS_CMD)message and assigns an S'CC$ to the MS.

(. The MS immediately switches to the assigned S'CC$ andsends aLocation !date Request (L"C_#D_REQ)to the BSS.

The MS will send either an )MS) or a TMS) to the BSS.

*. The BSS will ac!nowledge the message. This ac!nowledgement

only tells the MS that the BTS has recei+ed the message, it doesnot indicate the location update has een processed.

IMSI "erification # e!uest $riplets. The BSS forwards the Location -pdate Reuest to theMSC/VLR.

0. The MSC/VLR forwards the )MS) to the $LR and reuests

+erification of the )MS) as well as #uthentication $%i!lets.

1. The $LR will forward the )MS) to the #uthentication Center2#uC3 and reuest authentication triplets.

4. The #uC generates the triplets and sends them along with the)MS), ac! to the $LR.


2/16

5. The $LR +alidates the )MS) y ensuring it is allowed on thenetwor! and is allowed suscrier ser+ices. )t then forwards the

)MS) and Triplets to the MSC/VLR.

Authentication"6. The MSC/VLR stores the SR7S and the 8c and forwards the

R#9' to the BSS and orders the BSS to authenticate the MS.

"". The BSS sends the MS anAuthentication Request

(A$H_REQ)message to the MS. The only parameter sent in themessage is the R#9'.

"%. The MS uses the R#9' to calculate the SR7S and sends the

SR7S ac! to the BSS on the S'CC$ in anAuthenticationRes!onse (A$H_RS#). The BSS forwards the SR7S up to the

MSC/VLR.

"(. The MSC/VLR compares the SR7S generated y the #uC

with the SR7S generated y the MS. )f they match, thenauthentication is completed successfully.

:For a more in;depth discussion of authentication and encryption, +iew the

#uthentication and 7ncryption Tutorial.

%ncryption"*. The MSC/VLR forwards the 8c for the MS to the BSS. The8c is 9


3/16

TMS) for the MS. TMS) assignment is a function of the VLR. TheBSS will either send the TMS) in the L-='>#CC message or

it will send a separate $MSI Reallocation Command message

($MSI_REAL_CMD). )n oth cases, since the #ir )nterface is nowin cipher mode, the TMS) is not compromised.

&ocation 'pdate"1. The MS sends a $MSI Reallocation Com!lete message($MSI_REAL_C"M)up to the MSC/VLR.

"4. The BSS instructs the MS to go into idle mode y sending it aChannel Release (CHAN_REL)message. The BSS then deassigns

the S'CC$.

"5. The MSC/VLR sends an !date Locationmessage to the

$LR. The $LR records which MSC/VLR the MS is currently in,so it !nows which MSC to point to when it is ueried for the

location of the MS.

IMSI (etach

A MS will perform an IMSI (etach when it powers off. An IMSI (etach message informs the network that the MS is nolonger on the network and should not e paged. $his allows the network to process a call rejection faster, instead of waiting

for paging re!uests to not e answered. In most networks, the MSC#"& will initiate an IMSI (etach if the MS has not een

acti*e on the network for a specified period of time.

Channel e!uest and IMSI (etach e!uest


4/16

". The MS reuests a channel in the same manner it does in theLocation -pdate and )MS) #ttach. The MS sends a Channel

Reuest message on the R#C$. The BSS replies on the #&C$ andassigns the MS a S'CC$.

%. The MS sends anIMSI Detach Indication (IMSI_DE$_IND)

message to the BSS on the S'CC$. The BSS forwards the

message to the MSC/VLR

:#t this point, the networ! would reuire the MS to authenticate prior to

continuing. See the #uthentication and 7ncryption Tutorialfor more

information.

IMSI (etach e!uest

(. The MSC/VLR sends aLocation Cancel Requestto the $LR.

*. The $LR mar!s the )MS) as detached and remo+es any pointersfor the )MS) from its registry. )t then sends aLocation Cancel

Ac&no'ledgemntmessage to the MSC/VLR.

&ocation 'pdate

A MS will need to update its location whene*er it mo*es to a tower that is ser*iced y a different "& then the one it is

currently on. An MS c an mo*e from +$S to +$S without e*er telling the network, as long as it is within the same location

area. nce it mo*es to a new location area, it is re!uired to inform the network.

$he MS mo*es to another &ocation Area
http://www.gsmfordummies.com/encryption/encryption.htmlhttp://www.gsmfordummies.com/encryption/encryption.htmlhttp://www.gsmfordummies.com/encryption/encryption.html


5/16

#s a MS mo+es around it is constantly monitoring the signal

strength of the BCC$ of its current BTS, as well as neighoringBTS@s to determine if the neighors ha+e a stronger signal. Ahen

the MS is in idle mode 2not in a call3, it will determine for itself

when to mo+e from its current BTS to a more attracti+e one. Ahenthe MS switches from a BTS in one VLR to a BTS in a different

VLR, it must do an location update, so the networ! !nows whichMSC/VLR the MS is currently using.

)n the diagram on the right, we see two different location a%eas

ser+iced y two different VLR@s. The MS is currently sitting on

BTS;% in Location #rea ". #s the MS mo+es towards the edge ofthe location area, it measures BTS;( as eing stronger and decides

to switch to that BTS. Since BTS;( is in another location area, itwill need to do a location update.

1) Channel e!uestust li!e the )MS) #ttach, and e+ery other time the MS reuests

access, it goes through the same procedures.

". The MS reuests a channel y sending a Channel Request2C$#9>R73 message on the R#C$.

%. The BTS responds y sending anImmediate Assignment

Commandmessage 2)MM>#SS>CM'3 on the #&C$.

(. The MS switches to the assigned S'CC$ and replies with a

Location !date Request2L-='>R73. )ncluded in the

L-='>R7 is the TMS) the MS is currently using as well astheLocation A%ea Identiie%2L#)3 of the VLR it is lea+ing.

*. The BTS ac!nowledges receipt of the message.

- aining "& re!uests data from &osing "&


6/16

. The BSS forwards the Location -pdate Reuest to the gainingMSC/VLR.

0. The gaining MSC/VLR does not recogniDe the TMS)/)MS) ofthe MS, so it contacts the losing MSC/VLR that corresponds to the

L#) that was pro+ided y the MS. The new MSC/VLR reueststhe suscrier data for the gi+en TMS).

1. The gaining MSC/VLR will then authenticate the MS. There aretwo ways this could occur. First, the losing MSC/VLR may ha+e

forwarded any sets of triplets that it was retaining for the MS. Thegaining MSC/VLR would then Eust use the net set of triplets.

Second, the gaining MSC/VLR could contact the $LR and reuestauthentication triplets from the #uC and proceed with

authentication that way.

/) &ocation 'pdate

4. #CC may ha+e a TMS) assignment in it, otherwise

the TMS) will e assigned in a TMS)>R7#L>CM' message.

5. The MS will respond with a TMS) Reallocation Complete

message 2TMS)>R7#L>C


7/16

The &aining MSC/VLR sends an !date Locationmessage to the$LR. The $LR updates its records to point to the gaining

MSC/VLR when it is as!ed for its location. )t also passes onsuscrier information for the MS to the gaining MSC/VLR.

The $LR sends a Cancel Locationmessage to the losing

MSC/VLR. The losing MSC/VLR deletes the MS@s record and

also releases the TMS) for reassignment. The losing MSC/VLRsends a Cancel Location Resultmessage ac! to the $LR,

confirming the cancellation.

Moile riginated Call

A Moile riginated Call is a call that is initiated y the MS. $he following eample is a moile2originated call that

terminates outside the 3&M4.

1) e!uest Access

". The MS sends a Channel Request2C$#9>R73 message on

the R#C$.

%. The BSS responds with a radio resource assignment

2)MM>#SS>CM'3 on the #&C$.

(. The MS sends a Se%ice Request2CM>S7RV>R73 messageto the BSS on the S'CC$.


8/16

-) Authentication*. Before the networ! will pro+ide any ser+ices to the MS, the

networ! will reuire the MS to authenticate itself. The BSS sendsanAuthentication Request2#-T$>R73 message to the MS.

The R#9' ser+es as the GchallengeG for authentication.

. The MS calulates the proper SR7S ased on the R#9' that

was gi+en and sends the SR7S to the BSS in an Authentication

Res!onse2#-T$>R7S=3 message.

0. The BSS +erifies the SR7S. )f the SR7S is correct then the MS

is authenticated and allowed access to the networ!. The BSS willsend a Se%ice Acce!t2CM>S7RV>#CC3 message letting the MS

!now that the ser+ice reuest was recei+ed and processed.

1. MM


9/16

"%. The MSC sends anInitial Add%ess Message 2)#M3 to the&MSC. The )#M contains the MS)S'9 of the called party as the

MS dialed it.The MSC will also send a Call =roceeding 2C#LL>=R


10/16


11/16


12/16

1.The MSC/VLR then orders all of its BSCs and BTSs to page

the MS. Since the MSC/VLR does not !now eactly which BSCand BTS the MS is monitoring, the page will e sent out acrossthe entire Location #rea.

/) Initial Setup4. The MS recei+es the#age Request2=#&>R73 on the =C$.

The MS recogniDes that the page is intended for it, ased on a

TMS) or an )MS).

5. The MS sends a Channel Request2C$#9>R73 message onthe R#C$.

"6. The BSS responds on the #&C$ y sending anImmediate

Assignment2)MM #SS3 message which assigns an S'CC$ tothe MS. #t this point, the networ! does not !now that the MS isthe one that it is paging, it only !nows that this MS wants access

to the networ!.

"". The MS immediately switches to the assigned S'CC$ and

sends a#aging Res!onse2=#&>R7S3 message on the S'CC$.This lets the networ! !now that the MS is responding to its page.

0) Authentication


13/16

"%. Before the networ! will pro+ide any ser+ices to the MS, thenetwor! will reuire the MS to authenticate itself. The BSS sends

anAuthentication Request2#-T$>R73 message to the MS.

The R#9' ser+es as the GchallengeG for authentication.

"(. The MS calulates the proper SR7S ased on the R#9' thatwas gi+en and sends the SR7S to the BSS in an Authentication

Res!onse2#-T$>R7S=3 message.

"*. The BSS +erifies the SR7S. )f the SR7S is correct then the

MS is authenticated and allowed access to the networ!.

". MC


14/16

"4. The BSS then sends anAssignment Command2#SS>CM'3message to the MS on the assigned S'CC$. The #SS>CM'

message assigns a Traffic Channel 2TC$3 to the MS.

"5. The MS immediately switches to the TC$ and responds withanAssignment Com!lete2#SS>C


15/16

7) %stalishing the Call

%".


16/16

8) (isconnecting the Call%(. # disconnect happens the same way as for any other call. )n

this eample, the calling party initiates the disconnect.:

7 gsm events.doc

Documents