Prepared by : Rady AbdElWahed

Content Chapter 1: Architecture Chapter 2 : Nodes Chapter 3: IDENTITIES Chapter 4: GSM GEOGRAPHICAL Network Chapter 5 :Location Update Chapter 6 : Scenario Chapter 7 :Interfaces Chapter 8 :Protocols Chapter 9: SS7 Chapter 10 :SS7 Over IP Chapter 11: Signaling Messages

ARCHITECTURE

NETWORK ARCHITECTURE MODELS

VERTICALLY INTEGRATED NETWORKS Many older networks in existence today can

be described as “vertically integrated”.

Vertically integrated networks are optimized for a particular service category and typically offer a single service or set of closely related services.

The PSTN and PLMN are examples of vertically integrated networks.

HORIZONTALLY INTEGRATED NETWORKS

The rapid convergence of telecom and data com technologies has lead to the integration of vertical networks into multi-service (or next generation) networks that provide reliable and real-time communications for all service types.

All network functionality is split between: the connectivity layer, the control layer the application layer

LAYERS AND NODES

THE CONNECTIVITY LAYER The “Connectivity Layer” consists of the

transport nodes (MMGW,SGSN and GGSN) and connects to the various access networks.

The Access Network consists of the base stations and controllers in the mobile networks (GSM, UMTS, CDMA) or fixed access , transport and connectivity network that are able to handle different types of traffic (e.g. Circuit Switched and Packet Switched data).

THE CONTROL LAYER The “Control Layer” contains nodes that

control and direct traffic (both Circuit and Packet Switched).

The WCDMA Core Network will contain, for example, MSCs, HLR/HSS, GMSC/TSC, SGW and possibly IMS.

THE APPLICATION LAYER The “Application Layer” is responsible for

providing services to users via applications regardless of the device and method in which the user accesses the network.

MONOLITHIC ARCHITECTURE

THE SPLIT ARCHITECTURETHE SPLIT ARCHITECTURE : The split architecture is where the MSC server and the M-MGW’s are separated.

Nodes

MSCMobile services Switching Center :The primary node in a GSM network is the MSC.

It is the node, which controls calls both to MS’s and from MS’s.

The primary functions of an MSC include the following:

Switching and call routingChargingService provisioningCommunication with:( HLR-VLR-MSC’s)Control of connected BSC’s

MSCSMobile services Switching Center server:

The MSC Server is an MSC with signaling only connections toother network nodes.

It does not process the payload and has no Hardware ( such as conference devices, announcement machines , code receivers and senders, transcoders or data inter-working units for manipulating the user plane data).

The MSC Server contains all call and service control logic such as B-Number Analysis, Charging Analysis, Bearer Selection, Route Analysis, Media gateway Selection and other analysis functions to complete call handling requests.

MGWMedia Gate Way : A MGW( handles traffic -Signaling Gateway Handler-Media

Streaming Functions).

The MGW connects the Mobile Core Network with external networks .

The MGW makes IP, ATM and TDM transport possible in the backbone network .

The following items are functions of the MGW:

Echo Canceller- Multiparty Call-Announcement Machine Tone Sender/Receiver: Different tones (such as alerting,

busy, and so on) are played and sent.

VLRVisitor Location Register: The role of a VLR in a GSM network is to act as a temporary storage location for subscription information for MSs which are within a particular MSC service area.

Thus, there is one VLR for each MSC service area.

This means that the MSC does not have to contact the HLR every time the subscriber uses a service or changes its status.

including the following information: Identity numbers for the subscriber. Supplementary service information . Activity of MS (e.g. idle). Current LA of MS.

HLRHome Location Register : The HLR is a centralized network database that

stores and manages all mobile subscriptions.

It acts as a permanent store for a person’s subscription information.

The information stored includes: Subscriber identity Subscriber supplementary services Subscriber location information Subscriber authentication information

AUCAuthentication Center:The primary function of an AUC is to provide information, which is then used by an MSC/VLR to perform subscriber authentication and to, establish ciphering procedures on the radio link between the network and MS’s.

EIR Equipment Identity Register:The equipment identification procedure uses the identity of the equipment itself (IMEI) to ensure that the MS terminal equipment is valid . The EIR examines three lists: white list : containing all number series of all equipment identities that have been allocated in the different participating GSM countries.

black list : containing all equipment identities that has been barred.

gray list : (on operator level) containing faulty or non - approved mobile equipment.

FNRFLEXIBALE NUMBER REGISTER: keep CST MSISDN identity when

changing service provider or moving subscription between two service domains within the same country.

SSFService Switching Function : The Service Switching Function (SSF) acts as an interface between the normal mobile call control functions of an MSC/VLR and the functions that control a MIN service.

The SSP performs the necessary switching, signaling and charging to implement a MIN service, in response to the instructions it receives from the Service Control Function (SCF).

An SSF includes functions for: Initiating a MIN service (triggering). Call handling and switching. Activation of resources such as announcement machines. Charging. Communication with the MSC/VLR and with the SCF.

SCFService Control Function :The logic and data required to execute a MIN service is located in a SCP. The SCP is the platform for the execution of MIN services. An SCF contains functions for: Service script interpretation Service script storage Error handling Communication with the SSF and SDF

SDPService Data Point :SDP manages the data which is used by a MIN service.

BSCBase Station Controller :The BSC manages all the radio-related functions of a GSM network.

It is a high capacity switch that provides functions such as MS handover, radio channel assignment and the collection of cell configuration data.

RNCRadio Network Controller:The RNC controls the RBS and the radio resources.

The RNC is the service access point for all WCDMA RAN providing services to the Core Network.

TRCTranscoder Controller :The TRC provides the BSS with rate adaptation capabilities.

This is necessary because the rate used over the air interface and that used by MSC/VLR are different 16kbits/s and 64 Kbits/s respectively.

Base Transceiver Station :The BTS controls the radio interface to the MS.

The BTS comprises the radio equipment such as transceivers and antennas which are needed to serve each cell in the network. A group of BTSs are controlled by a BSC.

BTS

Node Bprovides the physical radio resources and converts thedata flow between the Iub and Uu interface.

IDENTITIES

MSISDN

MOBILE STATION ISDN NUMBER :The MSISDN is a number that uniquely identifies a mobile telephone subscription.MSISDN is composed of:

MSISDN = CC + NDC + SNCC = Country CodeNDC = National Destination CodeSN = Subscriber Number

IMSI

INTERNATIONAL MOBILE SUBSCRIBER IDENTITY

The IMSI is a unique identifying code allocated to each subscriber allowing correct identification over the radio path and through the GSM and WCDMA PLMN network.

IMSI = MCC + MNC + MSINMCC = Mobile Country Code MNC = Mobile Network Code MSIN = Mobile Subscriber Identification

Number

TMSI

TEMPORARY MOBILE SUBSCRIBER IDENTITY

The TMSI can be used to keep subscriber information confidential on the air interface. It also increases paging capacity, as the length of the TMSI is shorter than the length of the IMSI.

MSRNMOBILE STATION ROAMING NUMBER:When a mobile terminating call is to be set up, the HLR of the called subscriber requests the current MSC/VLR to allocate a MSRN to the called subscriber.

MSRN = CC + NDC + SNCC = Country CodeNDC = National Destination CodeSN = Subscriber Number

IMEIINTERNATIONAL MOBILE EQUIPMENT IDENTITYThe IMEI uniquely identifies User Equipment (UE) as a piece or assembly of equipment.

Using the IMEI, stolen mobiles or mobile not type-approved, can be barred.

IMEISVInternational Mobile Equipment Identity and Software Version number:The International Mobile Equipment Identity and Software Version number (IMEISV) provides a unique identity for every MS and also refers to the version of software which is installed in the MS. The version of software is important as it may affect the services offered by the MS or its speech coding capabilities.

GTGLOBAL TITLE:A Global Title (GT) is an identifying code, such as dialed digits, which does not explicitly contain information that allows routing in the signaling network.

This requires the Signaling Connection Control Part (SCCP) translation function,

MGTMobile GLOBAL TITLE:When a UE is powered on in a PLMN, the VLR must communicate with the UE’s HLR to perform location updating.

The only data available in the MSC/VLR for the SCCP addressing of the HLR is the IMSI number , However, for signaling in the international PSTN/ISDN network IMSI cannot be used.

Thus, it is necessary to convert the IMSI number in the MSC/VLR into a Global Title (GT), which enables routing of the S7 signaling to the proper HLR .

This converted number is called the Mobile Global Title (MGT).

GSM GEOGRAPHICAL NETWORK

GSM GEOGRAPHICAL NETWORK

CELL A cell is the basic unit of a cellular

system and is defined as the area of radio coverage given by one BS antenna system.

Each cell is assigned a unique number called Cell Global Identity(CGI).

LOCATION AREA (LA) A Location Area (LA) is defined as a group of cells.

Within the network, a subscriber’s location is known by the LA which they are in.

The identity of the LA in which an MS is currently located is stored in the VLR.

When an MS crosses a boundary from a cell belonging to one LA into a cell belonging to another LA, it must report its new location to the network1.

When an MS crosses a cell boundary within an LA, it does need to report its new location to the network.

When there is call for an MS, a paging message is broadcast within all cells belonging to an LA.

MSC SERVICE AREA An MSC service area is made up of a number of

LAs and represents the geographical part of the network controlled by one MSC.

In order to be able to route a call to an MS, the subscriber’s MSC service area is also recorded and monitored.

The subscriber’s MSC service area is stored in the HLR.

PLMN SERVICE AREA A Public Land Mobile Network (PLMN) service

area is the entire set of cells served by one network operator and is defined as the area in which an operator offers radio coverage and access to its network.

In any one country there may be several PLMN service areas, one for each mobile operator’s network

GSM SERVICE AREA The GSM service area is the entire

geographical area in which a subscriber can gain access to a GSM network.

LNLocation Number :The Location Number (LN) is a number related to a certain geographical area, which the network operator specifies by “tying” the location numbers to cells, location areas, or MSC/VLR service areas.

The LN is used to implement features like regional/local subscription and geographical differentiated charging.

The LN consists of the following:

Location Update

Location UpdateLocation Update Types:1.IMSI attach

2.Location Updating Same MSC/VLR

3.Location Updating New MSC/VLR

4.Location updating type periodic registration

5.IMSI detach

IMSI attach When an MS is switched on, the IMSI attach procedure is executed , This involves the following steps:

The MS sends an IMSI attach message to the network indicating that it has changed state to idle.

The VLR determines whether there is a record for the subscriber already present, If not the VLR contacts the subscriber’s HLR for a copy of the subscription information.

The VLR updates the MS status to idle.

Acknowledgement is sent to the MS.

Location Updating Same MSC/VLRIf an MS detects a change in LAI on the BCCH, it informs the network. When the MS sends the Location Updating message, the MSC/VLR determines whether it is an MS which is already registered, or if it is an MS visiting from another MSC/VLR.

The MS listens to BCCH in the new cell to determine the LAI.

The received LAI information is compared to the old one , If they differ a location update is necessary.

The MS establishes a connection with the network via SDCCH Authentication is performed.

If authentication is successful, the MS sends a Location Updating Request to the system.

The system acknowledges Location Updating and requests RBS and MS to release the signaling channel.

Location Updating New MSC/VLRWhen an MS roams into a new LA, location updating is performed. The LA may belong to a new MSC/VLR. When the Location Update Request is received by the new VLR, it executes the procedure below.

Authentication is performed. If authentication is successful , the VLR checks its database to determine whether or not it has a record for this MS-subscription.

When the VLR finds no record for the MS, it sends a request to the subscriber’s HLR for a copy of the MS-subscription.

The HLR passes the information to the VLR and updates its location information for the subscriber.

The HLR instructs the old VLR to delete the information it has about the MS subscription.

The VLR stores its subscription information for the MS including the latest location and status (idle).

The VLR sends acknowledgement to the MS.

Location updating type periodic registration

Periodic registration is a feature which forces MS’s to send a registration message to the network at predefined intervals.

If an MS should miss such a registration, the network will mark the MS as detached.

This may occur if an MS is out of the area of coverage and ensures that needless paging is not performed.

IMSI detach IMSI detach enables the MS to indicate to the

network that it is switched off.

At power off, the MS sends an IMSI detach message to the network.

On reception, the VLR marks the corresponding IMSI as detached.

The HLR is not informed. No acknowledgement is sent to the MS.

Traffic Cases

Traffic Cases1. CALL FROM AN MS

2. Call To MS

3. MOBILE ORIGINATED SMS

4. MOBILE TERMINATED SMS

CALL FROM AN MSThis example describes what happens when a mobile subscriber wants to set up a voice call to a subscriber in the PSTN.

The MS uses RACH to ask for a signaling channel.

The BSC/TRC allocates a signaling channel, using AGCH.

The MS sends a call set-up request via SDCCH to the MSC/VLR. Over SDCCH all signaling preceding a call takes place. This includes:

Marking the MS as “active” in the VLR. The authentication procedure. Start ciphering. Equipment identification. Sending the B-subscriber’s number to the network. Checking if the subscriber has the service “Barring of

outgoing calls” activated.

The MSC/VLR instructs the BSC/TRC to allocate an idle TCH.

The RBS and MS are told to tune to the TCH.

The MSC/VLR forwards the B–number to an exchange in the PSTN, which establishes a connection to the subscriber.

If the B-subscriber answers, the connection is established.

Call To MSCThe major difference between a call to an MS and a call from

an MS is that in a call to an MS the exact location of the mobile subscriber is unknown.

1. The MSISDN is analyzed in the PSTN, which identifies that this is a call to a mobile network subscriber. A connection is established to the MS’s home GMSC.

2. The GMSC analyzes the MSISDN to find out which HLR the MS is registered in, and queries the HLR for information about how to route the call to the serving MSC/VLR.

3. The HLR translates MSISDN into IMSI, and determines which MSC/VLR is currently serving the MS. The HLR also checks if the service, “Call forwarding to C–number” is activated, if so, the call is rerouted by the GMSC to that number.

4. The HLR requests an MSRN from the serving MSC/VLR.

5. The MSC/VLR returns an MSRN via HLR to the GMSC.

6. The GMSC analyses the MSRN and routes the call to the MSC/VLR.

7. The MSC/VLR knows which LA the MS is located in , A paging message is sent to the BSC’s controlling the LA.

8. The BSC’s distribute the paging message to the RBS's in the desired LA.

9.The RBS’s transmit the message over the air interface using PCH. To page the MS, the network uses an IMSI or TMSI valid only in the current MSC/VLR service area.

10. When the MS detects the paging message, it sends a request on RACH for a SDCCH.

11. The BSC provides a SDCCH, using AGCH.

12. SDCCH is used for the call set-up procedures , Over SDCCH all signaling preceding a call takes place. This includes:

Marking the MS as “active” in the VLRThe authentication procedure Start ciphering Equipment identification

13. The MSC/VLR instructs the BSC/TRC to allocate an idle TCH.

14.The RBS and MS are told to tune to the TCH.

15. The mobile phone rings , If the subscriber answers, the connection is established.

MOBILE ORIGINATED SMSMobile originated SMS transfers a short message submitted by the MS to an SMS-C. It also provides information about the delivery of the short message, either by a delivery report or failure report.

1. An MS establishes a connection to the network as in the case of a normal call set-up , This step is not performed if the MS is in active mode since the connection already exists.

2. If authentication is successful, the MS sends the short message using SDCCH to the SMS–C via the MSC/VLR.

3. The SMS–C in turn forwards the short message to its destination.

MOBILE TERMINATED SMSMobile terminated SMS has the capability to transfer a short message from the SMS–C to an MS.

1. A user sends a message to a SMS–C.

2. The SMS–C sends the message to the SMS–GMSC.

3. The SMS–GMSC queries the HLR for routing information.

4. The HLR returns routing information to the SMS-GMSC.

5. The SMS-GMSC re-routes the message to the MSC/VLR.

6. The MS is paged and a connection is set up between the MSand the network, as in the normal call set-up case.

7. If authentication is successful, the MSC/VLR delivers themessage to the MS. Short messages are transmitted on theallocated signaling channel, SDCCH.

8. If the delivery was successful, a report is sent from the MSC/VLR to the SMS–C, if not, the HLR is informed by the MSC/VLR, and a failure report is sent to SMS–C.

In the case of an unsuccessful delivery, the SMS-C informs the HLR and VLR that there is a message waiting to be delivered to the MS. The HLR then informs the SMS–C when the MS becomes available.

Interfaces

Interfaces

D interface The MSC – HLR interface is a MAP interface

used to exchange data related to the location of the mobile station and to the service management of the subscriber.

The MSC – FNR (Flexible Numbering Register) interface is a MAP interface used for the routing information of messages to the specific node in the network when Mobile Number Portability is used.

C interface MSC – HLR is a MAP interface for

interrogation of home HLR of visiting mobiles.

F interface The MSC – EIR interface is a MAP interfaces

and is used for exchange of information needed for the validation of the mobile terminal equipment.

L interface The MSC – SCF interface includes an Intelligent

Network Application Part ( INAP) based interface between the SCF and a SSF co-located with the MSC Server.

This interface is used for the SCF to provide IN services.

It also includes the L interface, which is MAP based and used for supplementary service invocation notifications.

G Control Part (CP) Interface: The MSC – MSC interface is a Mobile Application

Part MAP, interface for retrieval of identity and authentication parameters from the old MSC Server when the mobile subscriber makes a location registration in a new MSC Server.

Iu Interface The MSC – RNC interface is a RANAP (Radio

Access Network Application Part) signaling interface to provide signaling means to establish, maintain, and release connections in the Iu-user plane (WCDMA RAN – MSC Server/Media Gateway).

A interface The MSC – BSC interface is a BSSMAP signaling

interface used only in GSM networks to provide signaling means to establish , maintain, and release connections and the handling of hand-over(Access Network (AN) – MSC Server/Media Gateway).

Gs Interface The Gs interface links the databases in the MSC

Server and the SGSN.

The interface is used to co-ordinate the location update of Mobile Subscribers that are attached both to the packet based and the circuit based network.

The Gs interface is also used to convey some circuit-based procedures such as Short Message Services (SMS)via the SGSN.

Protocols

Protocols

MAPMOBILE APPLICATION PART:The Mobile Application Part (MAP) is an SS7 protocol which provides services to mobile phone users using the various nodes in GSM, UMTS, and GPRS networks. Specifically, it’s the application-layer protocol used to share subscriber’s information among different networks.

The Mobile Application Part (MAP) provides the necessary signaling procedures required for information exchange between the MSC and the Location Registers (HLR, FNR and EIR), and between the MSCs.

When a mobile subscriber roams into a new mobile switching center (MSC) area, the integrated visited location register (VLR) requests service profile information from the subscriber's home location register (HLR) using MAP information carried within TCAP messages.

The primary facilities provided by MAP are:

Mobility Services: location management (roaming), authentication, and fault recovery.

O&M (Operation and Maintenance): subscriber tracing, retrieving a subscriber's IMSI.

Call Handling: routing, managing calls whilst roaming, checking that a subscriber is available to receive calls.

Supplementary Services.

SMS (Short Message Service).

Location Management Services: obtaining the location of subscribers

INAPINTELLIGENT NETWORK APPLICATION PROTOCOL:The INAP protocol enables the Service Control Function (SCF) to remotely control circuit based call processes in real time through the Service Switching Function (SSF).

The INAP is a SS#7 protocol and uses TCAP/SCCP signaling.

N-ISUPNARROW BAND ISDN USER PART :

The signaling system used between the MSC Server and the PSTN or ISDN is based on ITU-T SS #7 signaling.

The transport of N-ISUP signaling to external nodes is done via the M-MGW where a transparent mapping of the lower layer protocols is performed.

ISDN User Part (ISUP) supports basic telephone call connect/disconnect between end offices.

ISUP defines the protocol and procedures used to setup, manage and release circuits that carry voice and data calls over the public switched telephone network.

Calls that originate and terminate at the same switch do not use ISUP signaling.

ISDN User Part messages are carried on the signaling link by means of signal units.

BICCBEARER INDEPENDENT CALL CONTROL: BICC is similar in function to the N-ISUP protocol and based on the ITU-T standard which provides the means for supporting narrowband ISDN services across an ATM or IP network.

BICC is a network-network interface (NNI) call control protocol that supports the defined ISDN services and transport technologies other than Synchronous Transfer Mode, STM, that is ATM and IP.

The BICC protocol has two main functions:

To pass Call Control information between servers, including B number and service requirements of the connection. To transfer information related to bearer set up and M-MGW identity, which is used to establish a bearer at the connectivity (M-MGW) layer.

GATEWAY CONTROL PROTOCOL This protocol describes the remote control

services that are implemented via GCP to control Call setup for circuit switched speech and circuit switched data calls too.

This external control interface is used by the MSC Server/ MSC Media Gateway to add and remove media stream functions into a speech and data connection.

BSSAP

BSS MOBILE APPLICATION PART:The MSC Server handles Radio Access Bearers in the GSM Access Network utilizing the BSSMAP protocol.

BSSGPBSS GPRS PROTOCOL :The primary function of Base Station System GPRS Protocol (BSSGP) is to provide the radio-related, QoS , and routing information required to transmit user data between a base Station Controller (BSC) and an SGSN in a GSM network.

A secondary function is to enable two physically distinct nodes, the SGSN and the BSC, to operate node management control functions.

RANAPRADIO ACCESS NETWORK

APPLICATION PART: The MSC Server handles Radio Access

Bearers in WCDMA RAN utilizing the RANAP protocol.

TCAPTRANSACTION CAPABILITIES APPLICATION PART:Transactional Capabilities Application Part (TCAP) facilitates connection to an external database.

TCAP is designed for non-circuit related messages.

TCAP provides a means for SCP-to-SCP communication via STPs.

TCAP messages are used by SSPs to query an SCP (via an STP) to determine the routing numbers associated with a global title.

The SCP uses TCAP to return a response containing the routing numbers back to the SSP via STP.

TCAP messages are transferred end-to-end using the services of SCCP.

CAPCAMEL Application Part : is a real time protocol used to support the information flows between CAMEL (Customized Application for Mobile network Enhanced Logic) functional elements such as the SCF (Service Control Function) and SSF (Service Switching Function).

TUPTelephone User Part :is an analog protocol that performs the basic telephone call connect and disconnect. It has been replaced by ISUP, but is still used in some parts of the world (China).

SS7

SS7 Signaling Signaling means the transfer of information

and the instructions relevant to control and monitor telephony connections.

external signaling has been divided into two basic types:

Access signaling : This means signaling between a subscriber terminal (telephone) and the local exchange.

Trunk signaling : This is used for signaling between exchanges.

ACCESS SIGNALING There are many types of access signaling, for

example, PSTN analog subscriber line signaling, ISDN Digital Subscriber Signaling System (DSS1), and signaling between the MS and the network in the GSM system.

Digital Subscriber Signaling System No. 1 (DSS1) is the standard access signaling system used in ISDN. It is also called a D-channel signaling system.

D-channel signaling is defined for digital access lines only. The signaling protocols are based on the OSI (Open System Interconnection) reference model, layers 1 to 3.

TRUNK SIGNALING The Inter-exchange Signaling information is

usually transported on one of the time slots in a PCM link, either in association with the speech channel or independently.

There are two commonly used methods for Inter Exchange Signaling:

CASChannel Associated Signaling:

means that the signaling is always sent on the same connection (PCM link) as the traffic. The signaling is associated with the traffic channel In a 2 Mbps PCM link, 30 time slots are used for speech, whereas TS 0 is used for synchronization and TS 16 is used for the line signaling . All 30 traffic connections share TS 16 in a multi frame consisting of 16 consecutive frames.Line Signals:Line Signals are used during the whole duration of a call to monitor the status of the connection and traffic circuit. Example: Seizure, Answer signals.

Register Signals: The Register Signals are used during the set-up phase of a call to transfer address and category information.

CCSCommon Channel Signaling :In this case a dedicated channel, completely separate from the speech channel, is used for signaling.

Due to the high capacity, one signaling channel in CCS can serve a large number of speech channels.

In a GSM network, CCITT Signaling System No. 7 is used , Signaling System No. 7 is a Common Channel Signaling system.

In CCS, signaling messages are transmitted over time slots in a PCM link reserved for the purpose of signaling, instead of Line Signals and Register Signals (which do not exist in CCS).

SIGNALING SYSTEM NO. 7

CHARACTERISTICSHigh flexibility:Many different types of telecommunication services can use SS7.

It is used to set up and release connections in traditional telephony and data communication, in mobile telephony and data communication, for the provision of ISDN services, and many other applications.

High capacity:A single signaling link can support several thousand traffic circuits.

High speed :Setting up a call through a number of exchanges takes less than a second.

OSI MODEL AND SS NO.7

OSI REFERENCE MODEL The Signaling System No. 7, is structured in a modular and layered

way.

Such a design of SS7 is similar to the Open System Interconnection model.

The Signaling Connection Control Part (SCCP) together with the Message Transfer Part (MTP) provide OSI layers 1-3 services.

For each layer in the Reference Model the standardization is split into two main parts: Service definition defines the functions that each layer

should contain and with which services the layer should provide the user or the layer closest above.

Protocol definition specifies how the functions within a layer in one system co-operate with the corresponding functions in another system.

Signaling Network Elements

SPSignaling Point :

A Signaling point can be described as, the switching orprocessing node in a signaling network .

Every SP is identified by a number determined by the Network Indicator (NI) and Signaling Point Code (SPC).

The Signaling Point Code (SPC) uniquely identifies an SP within the signaling network.

OP&DPOriginating Point:The Signaling Point (SP) at which the signaling message is generated. It is identified by an Originating Point Code (OPC).

Destination Point:The Signaling Point (SP) to which the signaling message is destined. It is identified by a Destination Point Code (DPC).

STPSignaling Transfer Point:This is a Signaling Point (SP) that is able to route/reroute the signaling messages. In GSM, every SP is an STP as soon as it routes the signaling message that must be delivered to a different destination point.

SL&LSSignaling Link:The packet data link that connects two SPs is a Signaling Link (SL).

Link Set:A number of parallel Signaling Links (SLs), to a maximum of 16, connecting the same Signaling Points (SPs) is referred to as a signaling Link Set (LS).

SR&SRSSignaling Route :The predetermined path a message takes through the signaling network between the Origination Point (OP) and the Destination Point (DP) is called a Signaling Route (SR).

A Signaling Route is defined as a link set which is assigned to carry traffic to a particular destination.

Signaling Route Set:The signaling network groups all Signaling Routes (SRs) that may be used for message traversing between an Origination Point (OP) and a Destination Point (DP), and refers to them as a Signaling Route Set (SRS) for that signaling relation.

The general structure of CCITTSignaling System No. 7

FUNCTIONAL LEVELS

Level 1Signaling Data link:Defines the functions of the physical interface of the signaling link to the exchange and to the trunk network.

A signaling data link is a bi-directional transmission path for signaling, that is, two data channels working together in opposite directions at the same bit rate. This path can be either digital or analog.

DIGITAL SIGNALING DATA LINK: Usually, one channel of a first-order PCM system is used as a signaling data link. CCITT recommends channel (that is, time slot)16, but states that if channel 16 is unavailable, any of the channels 1-31 may be used. The bit rate of the transmission is thus 64 kbps.

ANALOG SIGNALING DATA LINK : In exceptional cases an analog signaling data link may be used.

Level 2Signaling Link functions:Includes all functions required to ensure reliable transfer of signaling messages on each individual signaling link.

The signaling data link and the signaling link functions together constitute the whole Signaling Link (SL) that is used for reliable transmission of signaling messages between two signaling points.

Level 3Signaling Network functions:The main purpose of the Signaling Network functions on level 3 is to ensure reliable handling of incoming or outgoing signaling messages sent from one signaling point – via interconnected signaling links – to other signaling points.

SCCPThe Signaling Connection Control Part:Is added as a functional layer above the Message Transfer Part in order to meet a number of new requirements ..

The combination of the MTP and the SCCP is called the Network Service Part (NSP).

SCCP Addressing

The SCCP uses the following addresses:

Calling address — identifies call origination.Called address — identifies call destination.

SCCP addressing is very flexible and makes use of three separate Elements:

Destination Point Code (DPC)Global Title (GT)SCCP Sub System Numbers (SSN)

GTGLOBAL TITLE:

The GT contain specified combinations of:

ADDRESS INFORMATION (AI)

NATURE OF ADDRESS (NA)

NUMBERING PLAN (NP)

TRANSLATION TYPE (TT)

SCCP Subsystem Number

HIGH-SPEED SIGNALING LINK The limit for the link sets is 16 signaling links per LS.

This limits the LS capacity to 1 Mbps (that is, 16 * 64 kbps).This can be greatly enhanced by High-speed Signaling Links (HSL), which have almost 2 Mbps capacity per SL.

High-speed Signaling Links use : MTP level 3 (the signaling network level) of the

SS7 . ATM (Asynchronous Transfer Mode) .SAAL (Signaling ATM Adaptation Layer for B-

ISDN , that is, Broadband ISDN) protocols.

Traditional MTP versus ATM-based MTP

SAAL : Signaling ATM Adaptation Layer

NNI : Network Node Interface SSCS : Service Specific

Convergence Sub layer SSCF : Service Specific

Coordination Function SSCOP : Service Specific

Connection-Oriented Protocol AAL5 : ATM Adaptation Layer type

5 CPCS : Common Part Convergence

Sub layer SAR : Segmentation and Reassembly ATM : Asynchronous Transfer Mode

SIGTRAN

SS7 OVER IP In telecommunication today there is a greater drive to migrate all

traffic generated in a network to packet switched transport protocols.

The horizontal integrated network was defined into three different areas. The Application Layer the Control layer and the connectivity layer. The whole concept of the connectivity layer was to provide the network with a common transmission platform from which to switch all call scenario types.

As IP is considered to be a more efficient way of transporting information around a network, there is a push to have it as the primary transport mechanism. This signaling transport mechanism is referred to as SS7 over IP, or more commonly known as SIGTRAN.

In the beginning the TDM network provided a 64Kb/s-signaling link between two places, This is traditionally known as Narrowband SS7.

Then when the CN model was introduced, ATM was considered to be the common transport mechanism given the role it plays in the connectivity layer. This allowed our signaling links to increase through put to deliver larger amounts of data with a little less effort.

ATM allowed links to be established as needed instead of allocating permanent resources. The use of ATM to transfer SS7 messages is known as Broadband SS7. This increased the link from 64K b/s to 2M b/s.

NETWORK STRUCTURE

TRADITIONAL SS7 SIGTRAN SS7

SIGTRAN PROTOCOL STACKS

M3UA Protocol Layer Its main function is to provide MTP routing for

SS7 messages, also provides a supervisory function, maintaining communication towards other nodes in the network.

The function and features provided by M3UA are to maintain routes and association states between peer M3UA layers of other nodes.

M3UA Association The M3UA association is the representation

of the SCTP association in M3UA layer.

M3UA maintains variables relating to established associations , For flow and congestion control M3UA assigns states to each of the established associations.

M3UA Route A signaling route in M3UA is the same as the

MTP routing for both narrowband and broadband SS7.

A route identifies an outgoing association that can be used to send data towards a specific signaling destination.

The route information is combined between an association and a signaling destination.

M3UA Route Set A M3UA route set is a collecting of all

alternative routes toward a specific signaling destination.

If the route set is not available then a destination is considered to be unreachable.

M3UA Signaling destination The M3UA signaling destination is a node that

can be signaled to.

The use of a SPC is used to identify a Signaling Destination (it is referred to as the DPC of an outgoing message).

The sending node doesn’t know if the receiving node is an SS7 (traditional narrowband or broadband) or an IP-SEP (IP Signaling end point).

M3UA Signaling Procedures

M3UA Signaling Procedures1. M3UA sends an Associate primitive to the SCTP instance.

This primitive contains the Association Id, the destination IP address and outbound stream count.

2. The SCTP protocol then uses the INIT chunk to establish an SCTP association between two SCTP endpoints.

3. The receiving SCTP entity then responds with an INIT Ack chunk.

4. The initiating SCTP entity then forwards a COOKIE EHCO chunk.

5. Then the receiving SCTP entity responds with a COOKIE Ack chunk. This chunk is always used to acknowledge a COOKIE ECHO once it is received.

6. Once the SCTP entities have established their associations then SCTP at both ends send the Communication UP primitive to the M3UA layers. This indicates that the M3UA layers can communicate Peer to Peer now. The Communication UP primitive is used by the SCTP protocol to indicate that it is ready to send or receive information between to two SCTP endpoints.

7. The M3UA layer sends an ASP UP protocol message towards its peer M3UA layer to indicate that it is ready to receive any messages from the peer. This message is a State Maintenance message.

8. The receiving M3UA layer responds with an ASP UP Ack protocol message. It is used to acknowledge the receipt of the ASP UP protocol message. This message is a State Maintenance message.

9. From here the originating M3UA layer will send an ASP activate protocol message. The M3UA layer to indicate to its peer M3UA layer it is ready to receive signaling messages uses this message. This message is a Traffic Maintenance message.

10. Once the ASP activate message is received by the M3UA layer will respond with the ASP activate Ack message. This message is a Traffic Maintenance message.

11. Finally the Data to be sent is sent across the Active association between the two M3UA peers.

.

SCTP Protocol Layer The SCTP protocol layer is responsible for providing the

reliable connection between two IP signaling nodes. The signaling connection is established by means of an SCTP association.

The Stream Control Transmission Protocol (SCTP) layer provides connection - orientated services between SCTP peer nodes by means of SCTP associations. These SCTP associations provide the reliable connection between two signaling end points. It offers acknowledged, error free non-duplicated transfer of messages.

For a SCTP node to communicate with other SCTP nodes in the network an SCTP association is defined. This association is created so each signaling point in the network

SCTP ASSOCIATION The SCTP association is the logical

relationship between two SCTP end points.

This association includes the protocol state information , Verification Tags and the currently active set of Transmission Sequence Numbers between the two SCTP end points.

It can be said that the SCTP association is like the logical grouping of signaling links in traditional SS7, called a link set.

SCTP END POINT The SCTP endpoint is the logical

sender/receiver of SCTP packets . It comprises of a set of transport addresses (a

combination of IP addresses and port numbers) for sending and receiving SCTP packets between the two SCTP endpoints.

These transport addresses must be unique to the SCTP endpoint throughout the network. This is very similar to the signaling point code of a node being unique within the signaling network.

SCTP Signaling procedures

IP Protocol Layer The IP protocol layer provides connectionless

services between IP nodes. IP routers provide normal IP routing between sending and receiving nodes. The routing paths are established and maintained through the use of routing protocols like RIP, OSPF, BGP, static routes, etc.

It is expected that the Quality of Service of the IP protocol layer is worse than the QoS achieved in a SS7 network. Here, QoS means for example network reliability, transmission time and recovery time after path failure.

Signaling Messages

Location Update

1. The SIM card contains the unique IMSI which every subscriber has, along with the authentication parameters

to ensure that this user authenticated to this network.

2. The SIM card sends the message called (Send Authentication Info) SAI by IMSI number to MSC.

3. The MSC converts the IMSI to MGT (Mobile Global Title) to direct the message to SCCP relay.

4. The MSC sends the IMSI to the SCCP relay, in order to direct the SAI for correct HLR.

5. The HLR replies to the MSC with the TRIPLETS.

6. * RAND = Random number used for authentication.

7. * KC = a key that’s used for ciphering.

8. * SRES = the signed response to an authentication request.

9. The MSC compares the authentication parameters.

10. If the authentication passes, the MSC sends the UPL (Update Location) to the HLR.

11.The HLR replies to the MSC with the ISD (Insert Subscriber Data) message.

1. When a call request is delivered to the MSC-A, the MSC-A functions are triggered. A request named SRI (Send Routing Information) is sent to the HLR. The message contains the requested call type and the B#.

2. The MSC-A send the B number to FNR (Flexible Number Register)..

3. The FNR checks the number, if in same network or not, then forwards the SRI request with the B# to the HLR-B.

4. The HLR-B checks in its database in which VLR the B# is currently attached on (the MSC-B address was received earlier during the last LU). Then the HLR sends a PRN (Provide Roaming Number)

request to the serving MSC-B for assigning a roaming number from the pool.

5. The MSC-B checks if the service request can be granted and returns an allocated MSRN (Mobile Subscriber Roaming Number)

to the HLR-B.

6. The HLR-B sends the MSRN TO MSC-A to open an ISUP call between MSC-A and MSC-B.

During Call

1. IAM (Initial Address Message): This is usually the first message that is sent when setting up the connection

between two exchanges, and consequently it is always sent in the forward direction, The IAM contains

parameters carrying information about the called subscriber’s number (B-number).

2. ACM (Address Complete Message): This message is sent in the backward direction from the terminating exchange to the originating one. It indicates that all

the necessary address information is received and that the called subscriber is identified and free and alerted

by a ringing signal.

3. ANM (Answer Message): ANM indicates that a call has been answered. Typically, when this message is

received, the charging of the call starts.

4. REL (Release Message): This message initiates the release of a circuit used for a call. The call release can be initiated by either of the

subscribers or the network.

5. RLC (Release Complete): RLC is sent in response to REL. It confirms that the release of the circuit is completed so that the circuit can

return to idle state again and serve new call.

1. The MSC-A sends a FSM-MO (Forward Short Message - Mobile Originating) request to SMSC. The request contains the B#, the

message content, and the IMSI of the A#.

2. The SMSC sends a SRI-SM message to HLR-B through GMSC-B.

3. The HLR-B sends to SMSC the IMSI and the last update location of the B#.

4. The SMSC sends the FSM-MT (Forward Short Message - Mobile Terminated) to the MSC-B.