national chung cheng university cellular networks and

National Chung Cheng UniversityDept. Computer Science & Information Engineering

Cellular Networks and

Mobility Management

Chiang, Wei-Kuo (江為國)

Assistant Professor Department of CSIE National Chung Cheng University Office : EA 311 Phone : 05-2720411~33126 Email : [email protected]

URL : http://www.cs.ccu.edu.tw/~wkchiang/

National Chung Cheng University


Mobile Communication Networks Cellular Networks and MM2

Outline

Cellular Networks

GSM & Mobility Management

GPRS & Mobility Management

CAMEL

Number Portability



Wireless Technology Evolution

1G – Analog System

AMPS (Advanced Mobile Phone System) : 中華電信090系統

2G – Digital System

GSM (Global System for Mobile Communication)

900MHz and 1.8GHz (DCS1800)

TDMA Technologies

9.6K bps Data Rate (Shore Message Service; SMS)

歐亞160 Countries, 全球55%市場, 約5億個用戶

CDMA (Code Division Multiple Access)

IS-95: Data Rate 14.4K bps (cdmaOne) IS-95B: Data Rate 64 Kbps

Qualcom

亞太北美市場, 約7,500萬用戶

D-AMPS

又稱IS-136



備忘稿

第一代行動通訊為AMPS系統，在台灣也就是中華電信的090系統。這個系統提供了類比式的語音服務。

第二代的行動通訊系統改進為提供數位式的語音服務，並提供更嚴密的安全機制。目前較為普遍的三種技術為GSM, CDMA和D-AMPS。 GSM為歐規的系統，採用TDAM和FDMA混和的技術，是目前世界

上使用者最多的系統。

CDMA系統採用code division的技術，佔有亞太北美的市場。

D-AMPS則是改進第一代行動電話系統AMPS，又稱為IS-136。

台灣則是採用歐規的 GSM 系統。



2.5G

GSM System

High Speed Circuit Switch Data (HSCSD)

Up to 115.2 Kbps

General Packet Radio Service (GPRS)

Up to 171.2 Kbps

Enhanced Data rates for GSM Evolution (EDGE)

改變調變技術

up to 384 Kbps (亦被視為3G技術)

GPRS EDGE

cdma System

cdma 1x

Up to 144 Kbps

Korea



備忘稿

在第二代和第三代行動通訊系統之間，存在了2.5代的系統。這個2.5代的系統主要是改進原本第二代系統只提供單純的語音服務與少量的數據服務而設計的。因此2.5代的系統並不是一個獨立的系統，它們皆是架構於原本2G

的系統，利用原本2G系統的infrastructure，提供較高速且大量的數據傳輸。

發展2.5G行動通訊(Mobile Technology)技術主要目的是提供較高速的資料傳輸速率。為了使行動通訊的進展是以演化(Evolution)的方式進行，2.5G的系統是基於2G

的系統架構上來開發；而非整套系統重新發展。



3G

IMT-2000

Year 2000 Ready

Operate at 2000 MHz

Provide 2000K bps Data Rate

3G Data Rate 要求 Vehicular -- 144 Kbps

Pedestrian --- 384 Kbps

Indoor --- 2Mbps

Three Important 3G Technologies Standards

W-CDMA (Wideband CDMA) (歐日系統)

GSM/GPRS/EDGE W-CDMA

cdma2000 (北美系統)

TD-SCDMA (Time Division Synchronize CDMA) (大陸系統)



備忘稿

第三代通訊系統當初為IMT-2000這個組織所制訂出來的。之所以稱為IMT-2000主要有下列三個原因：希望3G

系統能夠在西元2000年鋪設完成，並將3G頻帶設為2000 MHz且提供2000K bps的資料傳輸率。目前世界上有三個主要的3G技術: (1) 歐日系統的W-CDMA (由3GPP所訂定)，延續之前的GSM->GPRS的evolution

path。(2)北美亞太系統的cdma2000 (由3GPP2所制訂) (3) 中國大陸所發展的TDS-CDMA系統。



From 2G to 3G

From Voice Service to Rich, Interactive Multimedia-

based Personal Communication Service

Permanent Network Connection with High Data Rate

384 Kbps to 2 Mbps

Mobile Access to High-quality Video, Audio, Graphics

and Multimedia as Fixed Internet

Massive Increase in Network Capacity

To Support Billions of Subscribers

Global Roaming

Use Single Terminal to Access Identical Services All

Around the World



Three Types of Mobility

Terminal Mobility The terminal is connected to the network via

radio interface and move around freely.

Cordless and cellular phones

User Mobility The user can move from one terminal to another

and register for incoming and outgoing calls to

be made to and from this terminal

SIM cards, calling cards

Service Mobility The portfolio of services that a user has

subscribed to follows the user as he/she roams

to different networks.

Exporting content and services to visited locations



Cellular Networks (1/3)

A cellular network employs many small radio

cells of limited coverage to cover a large area.

Advantages about the use of small cells

A mobile phone is always close to a network

transceiver, and therefore needs less

transmission power.

Channels can be reused in different cells, so

the capability of a network increases as the

cell size shrinks.

The first cellular network used analog radio

interfaces

Walkie-talkies (as early as 1950s)




Widespread deployment of analog cellular

networks began in the early 1980s (1G)

A lack of standardization

Many countries had their own systems

AMPS in USA, C-450 in Germany, RTMS in

France

Roaming was very limited

2G cellular networks appeared in the early

1990s

Digital transmission and higher capability

Encrypted digital transmission ensured much

better privacy




GSM is one of the best-known 2G networks

D-AMPS and IS-95 (USA), PDC (Japan)

The level of standardization was much better

than 1G systems

3G cellular networks (the beginning of 2000s)

Multimedia communications and mobile internet

UMTS is one of the most prominent

2.5G cellular networks (between 2G and 3G)

Use the existing frequency bands and radio

interface of 2G networks

But offer 3G capacity and services



Outline

Cellular Networks



CAMEL

Number Portability



GSM History

GSM started

1982 in Groupe Special Mobile of the European

Conference of Postal and Telecom. Admin. (CEPT)

GSM transferred

In 1988 CEPT transferred all GSM

standardization activities to ETSI

ETSI kept the acronym GSM but changed the

official name to Global System for Mobile Comm.

To ensure standardization on a more international scale

ETSI created 3GPP with other worldwide standard

bodies in 1998

3GPP responsible for all GSM spec.



GSM Architecture (1)

MSC

BSC

BSC

GMSC

HLR

VLR

MS – mobile station

BTS – base transceiver station

BSC – base station controller

MSC – mobile switching center

GMSC – Gateway MSC

HLR – home location register

VLR – visited location register

External – other GSM or fixed networks

External

MS

BTS



GSM Architecture (2)

3 main components in GSM MS (mobile station)

BSS (base station subsystem)

Manages the radio resources

BSC and BTS

NSS (network switching subsystem)

The core network part of GSM

MSC: a telephony switch

VLR: holds the subscribe data for visiting

subscribers

HLR: holds the subscriber information,

including information about the VLR to which

a subscriber is currently attached

GMSC: connected to other networks



Mobility Management (1/2)

Mobility management

Since terminals can move around in cellular

networks or even from one network to another

The network must have some way of locating and

alerting the terminal when a call comes in

GSM networks were divided into location areas

A location area typically covers several radio

cells

Each location area has a unique identifier (LAI)

that is transmitted on a special channel in all

the cells in the location area

Each terminal monitors this channel



Mobility Management (2/2)

When the terminal detects a change in the

broadcast LAI

It knows it has crossed into another location

area’s radio cell

At this time, it request a location update

If the new location area is served by the same MSC

and VLR, then the VLR registers the move

If served by another MSC and VLR, then the mobile

subscriber info is moved from the old to the new

VLR. The HLR is also updated so that is can route

all incoming calls to the new MSC and VLR.

Figure 4.4



GSM Location Updates

MSCBSC

BSC

HLR

VLR

MS

BTS

MSC

VLR

Location Area A

Location Area B

3

1

2

4



GSM Handover / Handoff

It is also possible that a mobile terminal will

move from one cell to another while in

conversation (mid-call)

A mobile terminal continually monitors the

quality of the radio signal from the current

cell, but also from surrounding cells

The network monitors the radio signals from the

mobile terminals

Handover or handoff

The mobile terminal detached in real time from

the radio channel of the old cell and attached

to the new channel in the new cell



GSM Connection Services

GSM Most Important Connection Services

Basic voice 13 Kbps codec

Half-rate voice 6.5 Kbps codec

CSD/Circuit-switched data 9.6 Kbps

Less suitable

Transmission speed < 56Kbps (telephony modem)

Connection to be set up, charged the same as voice

SMS/Short message service 160 characters

Cell broadcast 93 characters

USSD – service data between terminal and HLR

Note: voice modems do not work with GSM



Outline

Cellular Networks



CAMEL

Number Portability



GPRS Overview (1/2)

GPRS (General Packet Radio Service) Allows the GSM radio infrastructure to be used

for packet-based data communications

GPRS is typically deployed by operators that already have a GSM network; it is implemented as an extension of the existing GSM infrastructure

GPRS uses exactly the same frequencies and

radio technology as GSM, but it uses the GSM

channels in a different way

A GSM voice call occupies a specific time slot for its entire duration; GPRS occupies time slots only when a packet is sent or received, and a GPRS terminal can use any number of the eight time slot in a frequency channel.



GPRS Overview (2/2)

Multislot class of the GPRS terminal

The maximum number of time slots that a

terminal can handle

The more time slots a terminal can use, the

higher the data communication rate it provides

Few terminals of multislot class 8

More complex, more energy consuming, high network load

Asymmetric in use of time slots

4(downlink)+1(uplink), 3+1, 2+2, 2+1, 1+1

13.4 Kbps per time slot

In practice most terminals does not support

more than multislot class 4



GPRS Architecture (1/2)

MSC

BSC

GMSC

HLR

VLR

BTS, MSC, VLR, HLR – software updates

PCU – Packet Control Unit

SGSN – Serving GPRS Support Node

GGSN – Gateway GPRS Support Node

PSTN, GSMMS

BTS

Internet

SGSN GGSN

PCU



GPRS Architecture (2/2)

SGSN

Similar to MSC function in GSM, except that the

SGSN is a router rather than a switch

Handles location updates and handovers

Needs to be connected to the HLR

Also connected to the MSC and VLR covering the same cells

To allow combined location management for dual-mode terminals

Several BSC can be connected to one SGSN

GGSN

Acts as the gateway to external packet networks

Several SGSN can be connected to one GGSN



GPRS System

Packet Switching Technology

Based on GSM Cellular Network

High Data Speed

21.4 Kbps per Time Slot

Up to 8 Time Slots

Physical Channel for Data Transmission

Assigned on Demand

Can Be Shared with Other Users

GPRS

External

Data

Network

PSTN

HLR

SGSN GGSN

GbGn Gi

GSM

PCU

BSS

Gateway

MSC/VLRVisited

MSC/VLR



備忘稿 GPRS (General Packet Radio Server)有別於GSM，是一種

packet-switched的電信網路。GPRS的技術使用了GSM的存取網路( cellular access network)，所以只需昇級骨幹網路(core network)就可以提供高速的資料傳輸。GPRS之所以可以提供較高的傳輸速率的原因就是在於可以同時使用多個時槽(time slots)，最多可以達八個，也就是可以達到 171.2Kpbs的傳輸速度。

我們以GPRS為例子來簡介2.5的系統。GPRS和GSM彼此共用infrastructure。也就是在BSS部分，GSM和GPRS網路並沒有太大的差別。只有當資料要傳至核心網路的時候，BSS中的PCU會判斷所傳輸的資料為語音或是數據。若是語音傳輸，PCU會將資料傳輸至原本GSM的核心網路。若是數據傳輸，則PCU會將資料傳輸至GPRS的核心網路。在骨幹網路上則是多了兩個元件: GGSN 以及SGSN，而骨幹網路則完全是以packet-switched的網路為主。

目前台灣的GPRS手機多半為雙模(dual mode)，同時兼具GSM與GPRS的功能。



GPRS Logical Architecture

other PLMN

MSC/VLR HLR

EIR

SGSN

GGSN

GGSN

SGSN

PDN TE

SMS-GMSC

SMS-IWMSC

MS BSSGiGn

Gn Gp

Gb

Gd

Um

GcGrGs

Gf

CE

D

A

Signalling &

Data Transfer

Signalling

GPRS Logical Architecture



備忘稿

既然利用現有的GSM網路就可以升級至GPRS，因此要了解GPRS

就必須先熟悉GSM網路如何運作。當GSM手機撥號時，訊號的傳遞是先連上 BTS，再繼續傳到 BSC 以及 MSC。MSC 主要是做各個網路間交換的功能，將傳送進來的撥號信號交換到另一個 MSC 或公眾有線電話 (PSTN) ，來進行整個連線的建立。GPRS的網路架構是在現有的GSM 網路架構上，再增加兩個新的網路設備節點，分別為SGSN (Serving GPRS Support Node) 以及 (GGSN) Gateway

GPRS Support Node 。SGSN 與 GGSN 具有封包 Packet 的處理與傳送功能。

簡單的說，SGSN 的角色是去維護HLR（儲存手機profile的資料庫）；而GGSN主要是負責外部網路以及內部網路資料的傳送，就像是(gateway)的角色。，主要是提供行動(Mobility)的管理。



SGSN and GGSN

IP based

Network

SGSN GGSNHLR

Serving GPRS Support Node. Mobility Management (Location

Update, Paging etc.)

. Access Control & Security

(Authentication, Ciphering)

. BSS Queue Management

. GSM Circuit-Switched Interactions

. Operation Data, such as Billing Info.

Gateway GPRS Support Node. Interworking between PDN and

GPRS PLMN

. Packet Screening

. Routing Tables about Attached

GPRS Subscribers

. Address Mapping

. PDU Tunneling

. Operation Data, such as Billing Info.



備忘稿

GSM網路中，一個BSC同時連接許多BTS，BSC與BTS 的所在區域即組成一個服務區域。GPRS網路增加節點SGSN，會佈設在網路內的各個服務區域內，SGSN負責紀錄在服務區域內有哪些使用者，並且更新使用者的資訊到HLR上。同時也負責使用者的認證、計費、以及存取的控制。若是使用者傳送的是屬於封包的資料，經由BSC的判斷，會將封包的資料傳給 SGSN，由SGSN做封包的交換與傳輸。

GGSN中，第一個G是指 Gateway，代表 GGSN 是GPRS與外界網路(IP Network)的一個閘道，所以GGSN工作便是將外界網路的封包傳送進GPRS網路，或將GPRS網路內的封包傳出到外界的網際網路上。

GGSN與SGSN的連線主要是GTP(GPRS Tunneling Protocol)穿隧技術。



GPRS MM/SM

Mobility Management

Attach

Detach

Security

Routing Area Update

Session Management

PDP Context Activation

PDP Context Deactivation

PDP Context Modification



備忘稿

在GPRS運作中，主要分別兩大主要的程序：行動管理(Mobility

Management) 與議程管理(Session Management)。

行動管理主要發生在手機與SGSN之間，當手機開機、關機以及位置更改的時候，必須通知網路（發送一個 routing area update），以便後續的位置追蹤。另外，行動管理中也包含和安全性相關的程序

。這些程序皆由SGSN負責處理。

議程管理大部分是發生於手機與GGSN之間，主要管理手機和外界網路的連結。當手機執行完 PDP Context Activation 的程序後，手機便取得一個IP address並能夠和外界網路相溝通（或是決定使用者的QoS level）。SGSN和GGSN皆須涉入議程管理的程序中。



GPRS Data Transfer

MS Sends Packet, Destined to Another MS’s PDP Address, to SGSN.

SGSN Delivers Packets to GGSN.

GGSN Determines the SGSN where MS Registered by Checking the

PDP Context Corresponding to PDP Address.

GGSN Tunnels the PDU to SGSN Using GPRS Tunneling Protocol

(GTP).

SGSN Receives and Decapsulates the Packet, and Delivers to MS.

BSS SGSN GGSNGPRS

Backbone IP Network

SGSN

BSS

Internet



GGSN Function

Manage the addressing of GPRS subscribers GGSN manages the pool of IP addresses

Keeps track of the current SGSN that a

subscriber is attached to

In most cases IP addresses subscribers have are

dynamically assigned from a pool

This IP address assignment is done by GGSN

GGSN routes packets to the right SGSN through

IP tunnels Tunneling means that an IP packet destined for

a certain subscriber is put in the payload of

another IP packet that has as address the SGSN

that the subscriber is attached to



GPRS Mobility

GPRS network is divided into routing areas

GSM network is divided into location areas

To facilitate the interworking between GSM and

GPRS, a routing area is always the same as, or

a subset of a location area

Why?

GSM location updates automatically imply routing

area updates. This avoids the need for duplicate

updates and saving signaling overhead

An incoming GSM call can be paged in the GPRS

routing area, which is smaller than the location

area. This results in less use of radio resources for

paging.



GPRS Connection Model

GPRS Connection States

Idle: MS is detached from GPRS, no mobility

management, SGSN & HLR have no updated routing

information

When the subscriber performs a detach, power off, or switching to GSM mode

Ready: sending or receiving data, handles

handover (cell tracking)

When sending or receiving data

Standby: MS is attached to GPRS, but not

sending or receiving packets. MS can receives

paging requests, routing area updates

When no data has been sent or received for a certain period



GPRS State Transitions

IDLE READY STANDBY

GPRS AttachREADY timer expiry or

Force to STANDBY

PDU transmission

IDLE READY STANDBY

GPRS Attach

GPRS Attach Reject orCancel Location

READY timer expiry,

Force to STANDBY, orAbnormal RLC Condition

PDU reception

GPRS Detach, Implicit Detach, or Cancel Location

IDLE READY STANDBY

IDLE READY STANDBY

GPRS Detach,RAU Reject,

GPRS Detach,RAU Reject or

GPRS Attach Reject

(b) SGSN MM States for GPRS(b) SGSN MM States for GPRS

(a) MS MM States for GPRS(a) MS MM States for GPRS

The state of a GPRS subscriber is maintained

both in the terminal and in the network



References

Modeling GPRS Mobility Management

Mechanism

Lin, Y.-B. and Yang, S.-R. “A Mobility

Management Strategy for GPRS,” IEEE

Transactions on Wireless Communications, vol.

2, no. 6, November 2003.

Pending Patent: Lin, Y.-B., Yang, S.-R., and

Feng, V. W.-S. “Mobility Management Method and

System for Wireless Data Networks” (with

CCL/ITRI).



GPRS/UMTS Architecture

BSS: Base Station Subsystem

BTS: Base Transceiver Station

GGSN: Gateway GPRS Support Node

MS: Mobile Station

Node B: Base Station

RNC: Radio Network Controller

SGSN: Serving GPRS Support Node

UTRAN: UMTS Terrestrial Radio Access Network

Data

NetworkSGSN GGSN

Core Network

(packet-switched service domain)

RNC

Node B

UTRAN

UMTS MS

BSC

BTS

BSS

GPRS MS



BSC1/RNC1 BSC2/RNC2 BSC3/RNC3 BSC4/RNC4

C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 C14 C15 C16 C17 C18 C19 C20 C21 C22 C23 C24

SGSN2

URA1 URA2 URA3 URA4 URA5 URA6 URA7 URA8 URA9 URA10

RA1 RA2 RA3 RA4 RA5 RA6

SGSN1

UMTS

only

In GPRS, the SGSN tracks the cell and RA of an MS.

In UMTS, for an MS

the SGSN tracks the RA, and

the RNC tracks the cell and the URA.

GPRS/UMTS Mobility Management (MM)



In the cell tracking mode, if allocated a channel for packet transmission, the

MS is in the power active mode;

otherwise, the MS is in the power saving mode.

In the URA tracking or RA tracking mode, the

MS is in the power saving mode.

URA trackingcell tracking RA tracking

power saving modepower

active mode

*

UMTS Power Saving (PS)



cell

tracking

URA

tracking

RA

tracking

RA

tracking

cell

tracking

MS tracking in GPRS MS tracking in UMTS

T1 T2 T3

Transitions T1, T2 and T3 in GPRS/UMTS MM are

determined by inactivity timers/counters.

Transition T4 in UMTS PS is also determined by the

inactivity timer mechanism.

power savingpower active

MS power operation in UMTS

T4

Inactivity Timer/Counter for GPRS/UMTS MM and PS



State Machine for GPRS MM

In READY state, the MS is tracked by the SGSN

at the cell level.

In STANDBY state, the MS is tracked by the

SGSN at the RA level.

IDLE READY STANDBY

GPRS AttachREADY timer expiry or

Force to STANDBY

PDU transmission

IDLE READY STANDBY

GPRS Attach

GPRS Attach Reject orCancel Location

READY timer expiry,

Force to STANDBY, orAbnormal RLC Condition

PDU reception

GPRS Detach, Implicit Detach, or Cancel Location

IDLE READY STANDBY

IDLE READY STANDBY

GPRS Detach,RAU Reject,

GPRS Detach,RAU Reject or

GPRS Attach Reject

(b) SGSN MM States for GPRS(b) SGSN MM States for GPRS

(a) MS MM States for GPRS(a) MS MM States for GPRS



SGSN

Location update

RA Tracking

RA changed

Low paging cost

High location update cost

High paging cost

Low location update cost

SGSN

Location update

Cell Tracking

RA

Cell changed

Location Update vs. Paging

Transitions between cell and RA trackings

determine the location update and paging

signaling costs.



READY Timer Mechanism

3GPP TS 23.060 proposed the READY Timer (RT)

approach, where an RT threshold T is defined.

t4

tp

time

the end of

the previous

packet transmission

t0 t1

the beginning of

the next

packet transmission

. . . . .t1 t2 t3 ti ti+1 ti+2 ti+3

. . . .ti+4 ti+5

Cell Updates RA Updates

......

tNc

Ready timer T

expiration

Drawbacks of the RT approach

The RT approach has a major fallacy that the RT

timers in both the MS and the SGSN are

independent and thus may lose synchronization.

When the MS mobility rate changes from time to

time, the RT timer can not adapt to the change.



READY Counter Mechanism

To resolve the drawbacks of the RT approach, they

propose the READY Counter (RC) approach.

In the RC approach, an RC counter counts the

number of cell movements in the packet idle period.

If the number of movements reaches a threshold K,

then the MS is switched from cell tracking to RA

tracking.

tm,4

tp

time

the end of

the previous

packet transmission

t0

t1

the beginning of

the next

packet transmission

. . . . .tm,1

tm,2

tm,3

tm,K

tm,K+1

tm,K+2

tm,K+3

. . . .tm,K+4

tm,K+5

K Cell Updates Nu-K RA Updates

......

Threshold K

tm,Nc



Mix two types of user mobility patterns Type I pattern: mobility rate λm’ = 1/500min

Type II pattern: mobility rate λm’’ = 1/5min

Consider 1,000,000 packet idle periods with mean 100min, in which Type I pattern is exercised with probability 0.5, and

Type II pattern is exercised with probability 0.5.

Let the expected signaling cost of location update and paging in a packet idle period be

CT’ for Type I pattern, and CT’’ for Type II pattern.

Comparison of RC and RT (1)



In RC (E[tp] = 100min, E[tm’] = 500min, E[tm’’] = 5min) the lowest C

T’ is expected when K ≥ 2

the lowest CT’’ is expected when K = 0

good performance can be expected when K = 1 or 2

In RT (E[tp] = 100min, E[tm’] = 500min, E[tm’’] = 5min) the best threshold value for C

T’ occurs when T > 100min

the best threshold value for CT’’ occurs when T < 5min

no T value will satisfy both patterns

Comparison of RC and RT (2)



They proposed READY Counter (RC) to

resolve the fallacies of READY Timer (RT).

They devised an adaptive algorithm dynamic

RC (DRC) to reduce the net cost of location

update and paging.

They proposed analytic and simulation

models to investigate RT, RC and DRC.

They provided numerical examples to show

how to select appropriate operation

parameters.

Summary



Outline

Cellular Networks



CAMEL

Number Portability



CAMEL Overview

Customized Applications for Mobile Network Enhanced Logic

CAMEL: IN for mobile networks (both GSM and GPRS)

ETSI Standards

Why not done by ITU-T?

IN CS-2 & CS-3 includes features support mobile networks

ITU-T specifications must have a worldwide scope and not

be biased toward European standards such as GSM.

ETSI found the CS-2/CS-3 standards are insufficiently

specific for GSM

WIN (Wireless IN) for ASNI-41 (US)

Different protocols

Almost identical architectures, and similar concepts



CAMEL Architecture (1/2) IN vs CAMEL

In most uses of IN, the SSF, SCF and SRF belong the same

service provider

CAMEL: home network, visited network, interrogating network

A CAMEL service is executed in an SCF in the home network of the subscriber, but where the service is triggered depends on the location of mobile terminal.

HLR: as a special kind of SDF from the IN viewpoint

MAP (Mobile AP): the protocol used to access the HLR

MSC~HLR, SCF~HLR

CAP (CAMEL Application Part): adapted version of INAP

SSF~SCF, SRF~SCF

CAMEL simplifies the call model (compared with IN CS-2)

CAMEL BCSM almost identical to IN



CAMEL Architecture (2/2)

CAMEL Call Control

Home (A)

Mobile originated Mobile terminated

gsmSCF

Visited

MSC

gsmSSF

O-BCSM

Home (B)

gsmSCF

Interrogating

GMSC

gsmSSF

T-BCSM

Visited

MSC

gsmSSF

T-BCSM

AB

Service is executed in an SCF in the home network

Service is triggered

-an outgoing call: visited network’s MSC

-an incoming call: interrogating network’s GMSC or visited network’s MSC

The interrogating network is usually the home network



Triggering the CAMEL Services

CAMEL Subscription Information (CSI)

Contents

TDP List (DP to be armed)

SCF address (SS7 address of SCF)

Service key (service to be invoked when DP is met)

Default call handling (error handling, SCF not reached)

Others: DP criteria, CAMEL capability handling, CSI

state, notification flag

CSI Types

O-CSI (outgoing CSI) – held in visited network VLR

T-CSI (terminating CSI) – held in interrogating network

GMSC

VT-CSI (visited terminating CSI) – held in visited

network VLR



Why we need CAMEL ?

Prepaid subscription with roaming

Many operators implement their prepaid accounts

on a service node with a specialized database

Such prepaid implementations based service

nodes or local IN systems do not allow the

subscriber to place calls in other networks

No standardized interface that lets the MSC in a visited network consult a service node in the home network

The only interface defined in GSM for roaming is between the HLR and VLR, for location management

CAMEL lets the MSC consult the SCF in the home

network



CAMEL Prepaid with Roaming

SSF SCF

Home networkVisited network

VLR

Subscriber

Place outgoing call

CAMEL?

O-CSI found

(1)

CAMEL(2)

Start O-BCSM

Collected_Info

initialDP

Check creditCreditsufficient

Continue for x sec.

(3)

(4)

Complete call setup

Time expired

time expired event

Update creditCreditinsufficient

(5)

Clear call



CAMEL Standardization CAMEL Phase 1 (1996)

based on IN CS-1 (ETSI CS-1 Core INAP)

routing, number translation, screening, user

interaction, charging, ...

CAMEL Phase 2 (1997)

based on IN CS-1 (ETSI CS-1R Core INAP)

extended call model

user interactions with SRF

interaction with GSM supplementary services

CAMEL Phase 3 (1999)

3GPP R99, 3GPP R4

support GPRS

CAMEL Phase 4

Many IN CS-2 Capabilities (e.g., mid-call announcement)



CAMEL Phase 1 Architecture

CAMEL Phase 1

Roaming leg

HLR gsmSCF

GMSC

gsmSSF

MSC

gsmSSFVLR

Home Network

Interrogating Network Visited Network

Incoming line

Forwarded leg

MAP

MAP

MAPCAP CAP

MO call - Outgoing leg(or Forwarding leg)

MS

MAP



CAMEL Phase 2


Roaming leg

HLR gsmSCF

GMSC

gsmSSF

MSC

gsmSSFVLR

gsmSRF

Home Network


Home/Interrogating/Visited Network

Incoming line

Forwarded leg

MAP

MAP

MAPCAP CAP

CAP


MS

MAP



CAMEL Phase 3


Roaming leg

HLR gsmSCF

GMSC

gsmSSF

MSC

gsmSSFVLR

gsmSRF

Home Network


Home/Interrogating/Visited Network

Incoming line

Forwarded leg

MAP

MAP

MAPCAP CAP

CAP

MAP

SGSN

gprsSSF

CAP

MAP

SMSC

MAP


MAP

MS



CAMEL Phase 3 for GPRS

Extensions in CAMEL Phase 3

CAMEL phase 3 enables an SCF in the subscriber’s

home network to control

GPRS Mobility Management

Activation of PDP Contexts

CAMEL services for GPRS are triggered by

an SSF associated with the SGSN that the subscriber

is attached to

Two new state models for GPRS:

Attach-Detach state

Tracks the mobility management

PDP Context state

Represents the establishing PDP contexts process



CAMEL Attach-Detach State

2 states & 4 detection points

Intra-SGSN Location Update

the terminal stays attached

can send notification only

DP only EDP-N

Inter-SGSN Location Update

the terminal detaches from old SGSN

and then attaches to the new

the HLR is notified of the move

DP can be TDP-R

mobility management can be suspended

and controlled by service logic in the

SCF

Detached

AttachedAD_Exception

Attach

User- or network

initiated detach

Attach request

Detach

Intra SGSN Routeing

area update

Inter SGSN Routeing area update

Change of Position

GPRS Session

(location update DP)



CAMEL PDP-Context State

Before a subscriber can send or

receive data, the GGSN must set

up a PDP Context.

The state model is started for each

activated PDP context.

A request to send or receive data

causes the state transitions from

Idle to PDP_Cotext_Setup.

When GGSN has set up OK, it

notifies SGSN that data

transmission can begin. This

causes a transition.

Change-of-position-context DP

moves from one routing area to

another

Idle

PDP_Context_Setup

Change of

Position context

C_Exception

PDP_Context_Established

Change of Position Context

PDP Context Est.

PDP ContextDisconnection

PDP Context Est. Ack.

Routeing area update

User or networkinitiated disc.

Routeing area update

PDP ContextSetup Ack.

PDP ContextSetup Req.



Enhancements for GSM It allows the SCF to control the sending of short message

SMS (short message services)

Terminal submit messages to MSC;

Store and forward;

Receive in destination terminal

Transported on a signaling channel, and do not

involve the setup of a call.

It notifies SCF when GSM supplementary services is

started in the MSC

MSC-based supplementary services (programmed in MSC)

can interfere with CAMEL services.

It controls mobility management (from the SCF)

VLR notifies SCF of attach, detach, location-update

events for a subscriber.



CAMEL Phase 4 O-BCSM

O_Null & Authorise_Origination_Attempt_Collect_Info O_Exception

Collected_Info

Route_Select_Failure

O_Busy

O_No_Answer

O_Abandon

O_Alerting

Routing

Analysed_Information

Analyse_Information

invalid_information

O_alerting_failure

O_routing_failure

O_Term_Seized

O_AnswerBasic Call transition

O_Disconnect O_active_failure

O_Mid_Call

O_Active

O_Mid_CallO_Change_Of_Position

O_Change_Of_Position

Source: 3GPP TS 23.078 V5.1.0



CAMEL Phase 4 T-BCSM

T_Null

Terminating Call Handling

T_Exception

Terminating_Attempt_Authorised

T_Answer

T_Busy

T_No_Answer

T_Abandon

T_Disconnect

T_active_failure

T_call_handling_failure

T_Alerting

Call_Accepted

Call_rejected

T_Active

T_Mid_Call

T_Mid_Call

T_ Change_Of_Position

T_ Change_Of_Position

Basic Call transition

Source: 3GPP TS 23.078 V5.1.0



Mobile-Specific Services

Mobile networks have specific characteristics

Calling a mobile phone is equivalent to calling a

person, whereas calling a fixed phone is calling a

location

Service Examples:

SMS (Short Messaging)

Whereas voice services are synchronous, short

messaging is an asynchronous way of comm.

Like email

Location Services

The network knows approximately where a subscriber is

located

Mobile Payment Services

Mobile phone – carry it with you, linked to an account



CAMEL – SMS (1/2)

SMS Interworking MSC

replays outgoing messages to other networks

SMS Gateway MSC

a gateway for incoming messages from another

network

SMSC (SMS Center)

store and forward messages

SMPP (Short Message Peer-to-Peer Protocol)

CAMEL cannot look inside messages

MSC

SMSGMSC

SMSIW-MSC

SMSC



CAMEL – SMS (2/2)

CAMEL SMS State Model

Like the BCSM, this state model runs in the SSF

associated with the MSC.

Triggers are activated by CSI in the VLR.

SMS Analyse &Routing

SMS_ExceptionSMS Null & Start &Authorize

DP SMS_Collected_Info

DP O_SMS_Submitted

DP O_SMS_Failure

O_SMS_Exception



Location Services (1/2)

Mobile phones tend to travel with their owners

Location-based services

emergency calls

finding facilities (e.g., hotel, restaurants,

police stations, ...)

location-based charging, e.g. special home-zone

tariffs

locating friends, children, ...

tracking vehicles

games

GSM and GPRS networks do not offer any

protocol to query a user’s location



Location Services (2/2)

Positioning techniques to increase precision

Cell identifier: hundred meters

Measurements on the radio interface

GPS-assisted positioning: difficult in building

GSM generic positioning functions: LMU (location measurement unit)

Co-located in the BTS

SMLC (serving mobile location center)

Calculates the position from measurement

GMLC (gateway mobile location center)

Acts as the point through which external client applications can request



Location Service Example

Location-based charging

Home-Zone Service MS initiates a call

MSC triggers home-zone service

SCF requests the location of the MS from the GMLC

GMLC directs the request to the SMLC, which

determines the position of the MS

GMLC provides location information to the SCF

If the subscriber is in his/her home zone, the

SCF instructs the MSC to complete the call

using home-zone tariffs.

LMU

Home-zone service

gsmSCF

MSC

gsmSSF

GMLC

(1)

(2)

(3)

(5)

(4)

(6)

(4)SMLC

BSC



Mobile Payment Service

Mobile e-commerce

Industrial payment solutions

Dual-slot terminals

Bluetooth

IN-based (CAMEL-based) payments

Mobile payment with CAMEL

gsmSCF

MSC

gsmSSF

(1)

(2)

(3)

(6)

(4)

(4)

Beverage 1: dial 123456Beverage 2: dial 123457Beverage 3: dial 123458

gsmSDF

(5)



References

ITU-T Recommendation, Series Q.1200

Q.12x0 ~ Q.12x9

3GPP Specifications

TS 23.078, “Customized Applications for Mobile

network Enhanced Logic (CAMEL) Phase 4 – Stage 2”

3GPP

http://www.3gpp.org/



Outline

Cellular Networks



CAMEL

Number Portability



Types of Number Portability

Service Provider Number Portability (SPNP) The ability to change the service provider

while keeping the same phone number

Location Number Portability (LNP) The ability to change the subscriber’s fixed

service location while keeping the same phone

number

Service Number Portability (SNP) The ability to change the subscribed services

while keeping the same phone number

from plain old telephone service to ISDN

NP/ ENUM Address for RoutingA list of URI

Number for NamingE.164 Number



Four of SPNP Schemes (1/2)

ALL Call Query (ACQ)

Most efficient

New

Network

Old

Network

Orig.

Network

Donor

Network

Internal

NPDB

Central

NPDB

1 2

3

Number

Ported

Query on Release (QoR)

Reserved one-by-one

Released one-by-one

New

Network

Old

Network

Orig.

Network

Donor

Network

Internal

NPDB

Central

NPDB

3 4

5

Number

Ported

1 2

RFC 3482Number Portability in the Global Switched Telephone Network (GSTN) : An Overview



Four of SPNP Schemes (2/2)

Call Dropback

Reserved one-by-one

Released one-by-one

New

Network

Old

Network

Orig.

Network

Donor

Network

Internal

NPDB

Central

NPDB

1 4

3

Number

Ported

Onward Routing

Two call segments

Least efficient

New

Network

Old

Network

Orig.

Network

Donor

Network

Internal

NPDB

Central

NPDBNumber

Ported

14

2

5

3

2

RFC 3482Number Portability in the Global Switched Telephone Network (GSTN) : An Overview



GSTN NP Implementations

NP Database Queries

Switch-to-NPDB

IN/AIN INAP or GSM MAP over TCAP

STP-to-NPDB

examined ISUP IAM to perform NP translations

NP supported

US: across the wireline/wireless boundary

Europe: only within wireline or wireless domain

Avoid caller confusion about call charge

SPNP Schemes chosen

Onward Routing: Austria,France,UK,Italy,Japan,

All Call Query: US,Germany,Denmark,Finland,

OR for short-term and ACQ for long-term: Norway,Sweden

Mobile All-IP Networking LaboratoryDepartment of Computer Science & Information Engineering

Any Question?


national chung cheng university cellular networks and

Documents