ss7 call flow diagraams

SS7 Call Flow Diagrams Contents: I. Intoduction to SS7 and general Mobile network Architecture II. GSM & GPRS (2G, 2.5G & 3G) Call flows 1. Authentication & Location Update 2. Location Cancellation 3. MO call (Mobile to PSTN) 4. MT call (PSTN to Mobile) 5. a. SMS MO b. SMS MT II. Prepaid CAMEL Call flows i) MO call (Mobile to PSTN) ii) MT call (PSTN to Mobile) 2 I. Intoduction to SS7 and general Mobile network Architecture ♦ SS7 signalling and its application parts are used to establish the communication path between the operators. The SS7 protocol follows the OSI model. Refer to the diagram below. ♦ SCCP (Signalling Connection Control Part) is the most suitably used for routing of messages from a HPLMN network to a VPLMN network and vice versa in GSM. SCCP provides advantage over MTP Level 3 routing. MTP L3 does routing based on OPC and DPC which means it allows messages to be addressed to two signalling points only. Whereas SCCP provides subsystem numbers to allow messages to be addressed to specific applications (called subsystems) at these signalling points. SCCP also provides the means by which an STP can perform global title translation (GTT), a procedure by which the destination signalling point and subsystem number (SSN) is determined from digits (i.e., the global title) present in the signalling message. ♦ TCAP is a transport layer protocol which uses SCCP to establish concurrent dialogs between the same sub-systems on the same signaling points , using Transaction IDs to differentiate these, similar to the way TCP ports facilitate multiplexing connections between the same IP address on the internet ♦ In a Mobile network, TCAP is used to transport various application parts like MAP, INAP and CAP. 3 SS7 Protocol Stack Functions of each layer SCCP MTP LEVEL 2 MTP LEVEL 3 TCAP I S U P INAPCAPMAP 4 Defines the physical, electrical, and functional characteristics of the digital signalling link. Physical interfaces defined include E-1 (2048kb/s; 32 64 kb/s channels), DS-1 (1544 kb/s; 24 64 kb/s channels), V.35 (64 kb/s), DS-0 (64 kb/s), and DS-0A (56 kb/s). Accurate end-to-end transmission of a message across a signalling link. Implements flow control, message sequence validation, and error checking. When an error occurs on a signalling link, the message (or set of messages) is retransmitted Provides message routing between signalling Points in the SS7 network. MTP Level 3 re-routes traffic away from failed links and signalling points and controls traffic when congestion occurs. MTP LEVEL 1 SCCP is a sub-part of other L4 protocols, together with MTP 3 it can be called the Network Service Part (NSP), it provides end-to- end addressing and routing, connectionless messages (UDTs), and management services for the other L4 user parts. The ISDN User Part (ISUP) provides the protocol and procedures to set-up, manage, and release trunk circuits that carry voice and data calls over the public switched telephone network (PSTN) or ISDN network. TCAP is used to create database queries and invoke advanced network functionality, or links to intelligent networks (INAP), mobile services (MAP), CAMEL Application Parts (CAP) etc. SGSN GGSN MSC/VLR IP Network GPRS Backbone BG BG Other PLMN SGSN GGSN BG BG SS7 BSC/RNC BTS/Node-B HLR/AUC 2.5G & 3G Network. Only in the case of 3G, the WCDMA radio access technology is used and a BSC is called RNC and BTS is called Node-B 2.5G & 3G Network. Only in the case of 3G, the WCDMA radio access technology is used and a BSC is called RNC and BTS is called Node-B 5 ♦ The Mobile network can be broadly divided into two parts: Core Network and Radio Access network. ♦ The Core network does call control, call routing and call charging.It is also a gateway to the external networks like PSTN and an interface to other services like SMS, Voicemail and Billing etc. ♦ The Radio Network gives the Mobile Station (MS) the wireless access into the network. ♦ The Voice Core network is the same whether it is 2G, 2.5G or 3G. For Data calls, a Packet switched Core network is used but the Radio access differs. The entire network Gs (generations) are basically classified on the basis of the rate of data transfer over the radio interface. The slower the rate, the older the generation! ♦ 2G: RAN consists of BSC and BTS and only circuit switched voice and data are supported. TDMA is the access method used. 2G uses a carrier bandwidth of 200 KHz on the air interface. SS7 is widely used in Core and Radio networks. The Voice and data are both circuit switched. The rate of a data call is maximum 9.6Kbps. ♦ 2.5G & 2.75G: To facilitate increased rate of data calls in a GSM network, two technologies were evolved : GPRS and EDGE. GPRS has a separate core network, all IP based, parallel to GSM Core. While GSM is responsible for Circuit switched call routing, GPRS is based on packed switching and is used explicitly for data calls and services like MMS, WAP internet. To accommodate the packet switching, a minor hardware and software upgrade and configuration in the existing GSM RAN (BSC and BTS) is all that makes it a 2.5G network! The download data rate can be as high as 80Kbps. Unlike GPRS, EDGE (2.75G) is an enhancement of 2G GSM circuit switch technology and provides 3 times higher data rate than GPRS. Some minor hardware and software modifications are required in the BTS. ♦ 3G: Also referred to as UMTS, the services associated with 3G provide the ability to transfer simultaneously both voice data (a telephone call) and non-voice data (such as downloading information, exchanging email, instant messaging and video telephony). 3G uses 5 MHz channel carrier width to deliver significantly higher data rates and increased capacity compared with 2G networks. Technically, W-CDMA is used in 3G. It is a wideband spread-spectrum mobile air interface that utilizes the direct sequence Code Division Multiple Access signaling method (or CDMA) to achieve higher speeds and support more users compared to the older TDMA signaling method of GSM networks. ♦ IN & CAMEL: Intelligent Networks basically form an overlay to the core network. Using IN, an operator can provide value added services in addition to the GSM services to the customers. Examples of such services are Toll Free calls and prepaid calls. The IN concepts, architecture and protocols were developed 6 originally as standards by the ITU-T. The aim of the IN is to enhance the core telephony services offered by traditional telecommunications networks, which usually amounts to making and receiving voice calls and call divert. The main concepts surrounding IN services or architecture are: Service Switching Point (SSP). This is co-located with the MSC and acts as the trigger point for further services to be invoked during a call. Service Control Point (SCP). It receives triggers from the SSP. It has the main service logic and processes a call based on the logic as desired by the operator. Service Data Point (SDP). This is a database that contains additional subscriber data, or other data required to process a call. For example, the subscriber’s prepaid credit which is remaining may be an item stored in the SDF to be queried by the SCP in real time during the call. The SDF may be a separate platform, or is sometimes co-located with the SCP. Service Creation Environment (SCE). It’s the environment used to create the services present on the SCP. It provides a front end to the operator. Intelligent Peripheral (IP). This is a node, sometimes co-located with in the SSP, which provides additional resource and services to an IN call like collect DTMF (Dual Tone Multi Frequency) from user or play announcements. In Mobile networks, CAMEL is the widely used IN application protocol. Camel Application Part (CAP) of SS7 is used to implement the CAMEL function between the SSP and the SCP. All other interfaces in an IN are usually IP based or proprietary to the Vendor. I. GSM & GPRS Call Flows CAMEL Intelligent NetworkIP SS7 SCE SSP MSC Internal Protocol Internal Protocol Internal Protocol SDP SCE 7 1) Authentication & Location Update 1. The MS sends a Location update request on the air along with its IMSI and last Location Area Identity (LAI). 2. The request from the MS is forwarded to the MSC/VLR by the RAN. 3. If the IMSI data is loaded in the MSC/VLR, the MSC does a Global title translation i.e. converts MCC+MNC to MGT to obtain the HLR address of the roaming subscriber. The resulting translation is in the format E.214 and is used to address the HLR for requesting the Authentication Information. The IMSI and the requesting VLR address are sent to the HLR. 4. On receipt of the request, the HLR obtains the Auth triplets (for 2G with MAPver2) or Auth Quintuplets (for 3G with MAP ver3) from AUC and forwards it to the VLR. Triplets RAND, SRES & Kc. Quintuplet RAND, SRES, CK, IK & AUTN 5. The VLR then requests the SIM, through the MSC & RAN, for the authentication. 6. The MS calculates the SRES and sends back to the network. If this SRES is same as the one received by the VLR in the Triplets sent by HLR, the authentication succeeds and the Location update request is sent back to the HLR. If Authentication fails, no LU request is sent by the VLR to HLR. 7. After Authentication is successful, VLR sends LocUpd request to HLR. 8. HLR sends all the services like speech, SMS, APNs etc that are provisioned on the SIM in “InsSubData” MAP message to VLR. 10.LocUp 10. UpdLocAck 3.SndAuthInfo 7.LocUpd 9 InsSubDataAck 8 .InsSubData 4.SndAuthInfoResp 6.AuthResp 5.AuthReq 2.LocUpReq 1.LocUpReq 10.UpdLocAck 6. AuthResp 5.AuthReq RAN VMSC/VLR HLRMS GMSC BSSAP GSM MAP 8 9. The VLR inserts all the data into it and acknowledges the HLR 10. The HLR finally confirms the location update to the VLR. At the same time the HLR stores the VLR address to keep track of the current location of the MS Common causes for Authentication Failure: 1. SIM is unknown in HLR/AUC i.e., it is not activated. 2. Auth_Req to USIM with MAP ver2 fails since USIM stores only Quintuplets and can authenticate on MAP ver3 only Common causes for Location Update Failure: 1. “Roaming not allowed” cause received from HLR if IR is not provisioned in the HLR. The home carrier should provide the service before testing. 2. HLR sends some service in ‘Insert Sub Data’ which is not supported in VLR. This leads VLR to abort the communication. Services like CUG, PLMN specific barring are mostly rejected by VLRs. The HPLMN tester should be requested to remove such services on the test SIM 9 2) Location Cancellation 1. This service is used between HLR and VLR to delete a subscriber record from the VLR. 2. It may be invoked automatically when an MS moves from one VLR area to another, to remove the subscriber record from the old VLR, or by the HLR operator to enforce a location updating from the VLR to the HLR, e.g. on withdrawal of a subscription. 2. LocUpdReq 2. UpdLocAck 2. Loc_CancelAck 2. Cancel_Loc 1. Cancel_Loc 1. Loc_ CancelAck Old VLR New VMSC/VLR HLRMS GMSC BSSAP GSM MAP 10 [...]... Release ISUP (circuit related) GSM MAP BSSAP 1.1 The calling PSTN sends IAM to the GMSC of the called MS Regardless of the location of PSTN in Home country or anywhere else is the world, the call is first routed to the Home GMSC via intermediate exchanges/carriers by doing digit analysis of the called number The main components of IAM are OPC, DPC, Calling, Called and other optional parameters 2.1 After... connections currently held by the call 8 Finally the air interface channel occupied by MS is released Common causes for MOC failure: 1 Outgoing call barring is active on SIM and hence MSC rejects the call 2 B-number is not configured/routed in the MSC and hence MSC cannot route the call 3 There is congestion in the national/International Network 11 4) Mobile Terminated Call (PSTN to Mobile) MS RAN PSTN(home... Originated Call (Mobile to PSTN) MS RAN VMSC/VLR PSTN Exchange GMSC 1 Setup 2 IAM 2 IAM 3 call proceeding 3 ACM 3 ACM 4 Alerting 4 CPG 4 CPG 5 ANS 5 ANS 5 ANS 6 Disconnect 6 REL 6 REL 8 Release 7 RLC 7 RLC BSSAP ISUP (circuit related) 1 The MS requests the call setup for MOC This request is also used for a channel allocation for the call in the air and A interface Request message contains the called party... The call is then setup, alerted and then connected when the MS answers the call 3.3 An ANM – Answer Message is sent to the GMSC to confirm the connection and this is where the conversation starts 1.3 An ANM is also sent simultaneously by the GMSC to the originally calling PSTN exchange 1.4, 3.4 REL- RELease message is sent on both the ISUP legs once the call is released 1.5, 3.5, 4.3 Once the call. .. use in call setup 2.4 The HLR forwards the same MSRN to the GMSC and closes the SRI procedure 3.1 The GMSC now does a MSRN digit analysis and if found, routes IAM to the appropriate VMSC The IAM contains the MSRN as the Called party Internationally, this call is handled and routed by various intermediate carriers 3.2 The VMSC, upon digit analyses, sends ACM- Address Complete Message to the Calling... address 2 MSC analyses the called party digits, obtains the route from the B-Number analysis table and shoots Initial Address Message to the destination PSTN The IAM contains Calling party, called party and other info like CLIR etc 3 The PSTN exchange analyses the B-number, if correct, then sends Address Complete Message to the GMSC 4 While the B-number is being alerted (ring) , a Call Progress may be sent... call is released, RLC- ReLease Complete is returned and the call is also cleared on the MS side 4.3 The traffic channel held by the MS on the air is finally released Common Causes for MTC failure 1 The MSRN digit analysis is not done in the Home GMSC 2 There are delays is International Network due to which the call timer expires causing the call to be unsuccessful 13 5) a SMS MO b SMS MT MSB MSA RAN... the GMSC 4 While the B-number is being alerted (ring) , a Call Progress may be sent back to the GMSC 5 When the PSTN answers the call, an ANswer Message is sent by the terminating PSTN exchange This is also the point when charging starts in the MSC 6 If the MS disconnects the call, a RELease message is sent to the PSTN If the PSTN disconnects first, then REL is sent by the PSTN 7 To acknowledge the REL,... forwarded again when the MS comes back to the network 15 II Prepaid CAMEL i) MO Call MS GMSC/VLR/SSP     2 IDP      6 ACH, CUE     CAP (CAMEL) ISUP (circuit related)  16 i) MT Call PSTN VMSC/VLR GMSC/SSP  HLR         . Cancellation 3. MO call (Mobile to PSTN) 4. MT call (PSTN to Mobile) 5. a. SMS MO b. SMS MT II. Prepaid CAMEL Call flows i) MO call (Mobile to PSTN) ii) MT call (PSTN to Mobile) 2 I. Intoduction to SS7 and. SS7 Call Flow Diagrams Contents: I. Intoduction to SS7 and general Mobile network Architecture II. GSM & GPRS (2G, 2.5G & 3G) Call flows 1. Authentication &. BSC is called RNC and BTS is called Node-B 5 ♦ The Mobile network can be broadly divided into two parts: Core Network and Radio Access network. ♦ The Core network does call control, call routing