ss7 call flow diagraams

Intoduction to SS7 and general Mobile network Architecture♦ SS7 signalling and its application parts are used to establish the communication path between the operators.. ♦ TCAP is a tran

SS7 Call Flow Diagrams

I Intoduction to SS7 and general Mobile network Architecture

II GSM & GPRS (2G, 2.5G & 3G) Call flows

1 Authentication & Location Update

2 Location Cancellation

3 MO call (Mobile to PSTN)

4 MT call (PSTN to Mobile)

5 a SMS MO

b SMS MT

II Prepaid CAMEL Call flows

i) MO call (Mobile to PSTN)

ii) MT call (PSTN to Mobile)

I Intoduction to SS7 and general Mobile network Architecture

♦ SS7 signalling and its application parts are used to establish the communication path between the operators The SS7 protocol follows the OSI model Refer to the diagram below

♦ SCCP (Signalling Connection Control Part) is the most suitably used for routing

of messages from a HPLMN network to a VPLMN network and vice versa in GSM SCCP provides advantage over MTP Level 3 routing MTP L3 does routing based on OPC and DPC which means it allows messages to be addressed to two

signalling points only Whereas SCCP provides subsystem numbers to allow

messages to be addressed to specific applications (called subsystems) at these signalling points

SCCP also provides the means by which an STP can perform global title

translation (GTT), a procedure by which the destination signalling point and subsystem number (SSN) is determined from digits (i.e., the global title) present

in the signalling message

♦ TCAP is a transport layer protocol which uses SCCP to establish concurrent dialogs between the same sub-systems on the same signaling points , using

Transaction IDs to differentiate these, similar to the way TCP ports facilitate multiplexing connections between the same IP address on the internet

♦ In a Mobile network, TCAP is used to transport various application parts like MAP, INAP and CAP

SS7 Protocol Stack Functions of each layer

SCCP

MTP LEVEL 2

MTP LEVEL 3

TCAP

I S U P

INAP CAP

MAP

Defines the physical, electrical, and functional characteristics of the digital signalling link Physical interfaces defined include E-1 (2048kb/s; 32 64 kb/s channels), DS-1 (1544 kb/s; 24 64 kb/s

channels), V.35 (64 kb/s), DS-0 (64 kb/s), and DS-0A (56 kb/s).

Accurate end-to-end transmission of a message across a signalling link Implements flow control, message sequence validation, and error checking When an error occurs on a signalling link, the message (or set of messages) is retransmitted

Provides message routing between signalling Points in the SS7 network MTP Level 3 re-routes traffic away from failed links and signalling points and controls traffic when congestion occurs.

MTP LEVEL 1

SCCP is a sub-part of other L4 protocols, together with MTP 3 it can be called the Network Service Part (NSP), it provides end-to-end addressing and routing, connectionless messages (UDTs), and management services for the other L4 user parts.

The ISDN User Part (ISUP) provides the protocol and procedures to set-up, manage, and release trunk circuits that carry voice and data calls over the public switched telephone network (PSTN) or ISDN network.

TCAP is used to create database queries and invoke advanced network functionality, or links to intelligent networks (INAP), mobile services (MAP), CAMEL Application Parts (CAP) etc.

SGSN GGSN

MSC/VLR

IP Network

GPRS Backbone BG

Other PLMN

SGSN

GGSN

BG

SS7

BSC/ RNC

BTS/ Node-B

HLR/AUC

2.5G & 3G Network Only in the case of 3G, the WCDMA radio access technology is used and a BSC is called RNC and BTS is called Node-B

2.5G & 3G Network Only in the case of 3G, the

WCDMA radio access technology is used and a

BSC is called RNC and BTS is called Node-B

♦ The Mobile network can be broadly divided into two parts: Core Network and Radio Access network

♦ The Core network does call control, call routing and call charging.It is also a gateway to the external networks like PSTN and an interface to other services like SMS, Voicemail and Billing etc

♦ The Radio Network gives the Mobile Station (MS) the wireless access into the network

♦ The Voice Core network is the same whether it is 2G, 2.5G or 3G For Data calls,

a Packet switched Core network is used but the Radio access differs The entire network Gs (generations) are basically classified on the basis of the rate of data transfer over the radio interface The slower the rate, the older the generation!

♦ 2G: RAN consists of BSC and BTS and only circuit switched voice and data are

supported TDMA is the access method used 2G uses a carrier bandwidth of 200 KHz on the air interface SS7 is widely used in Core and Radio networks The Voice and data are both circuit switched The rate of a data call is maximum 9.6Kbps

♦ 2.5G & 2.75G: To facilitate increased rate of data calls in a GSM network, two

technologies were evolved : GPRS and EDGE GPRS has a separate core

network, all IP based, parallel to GSM Core While GSM is responsible for Circuit switched call routing, GPRS is based on packed switching and is used explicitly for data calls and services like MMS, WAP internet To accommodate the packet switching, a minor hardware and software upgrade and configuration in the existing GSM RAN (BSC and BTS) is all that makes it a 2.5G network! The download data rate can be as high as 80Kbps

Unlike GPRS, EDGE (2.75G) is an enhancement of 2G GSM circuit switch technology and provides 3 times higher data rate than GPRS Some minor

hardware and software modifications are required in the BTS

♦ 3G: Also referred to as UMTS, the services associated with 3G provide the ability

to transfer simultaneously both voice data (a telephone call) and non-voice data (such as downloading information, exchanging email, instant messaging and video telephony)

3G uses 5 MHz channel carrier width to deliver significantly higher data rates and increased capacity compared with 2G networks Technically, W-CDMA is used in 3G It is a wideband spread-spectrum mobile air interface that utilizes the direct sequence Code Division Multiple Access signaling method (or CDMA) to achieve higher speeds and support more users compared to the older TDMA signaling method of GSM networks

♦ IN & CAMEL: Intelligent Networks basically form an overlay to the core

network Using IN, an operator can provide value added services in addition to the GSM services to the customers Examples of such services are Toll Free calls and prepaid calls The IN concepts, architecture and protocols were developed

originally as standards by the ITU-T The aim of the IN is to enhance the core telephony services offered by traditional telecommunications networks, which usually amounts to making and receiving voice calls and call divert

The main concepts surrounding IN services or architecture are:

Service Switching Point (SSP) This is co-located with the MSC and acts as the

trigger point for further services to be invoked during a call

Service Control Point (SCP) It receives triggers from the SSP It has the main

service logic and processes a call based on the logic as desired by the operator

Service Data Point (SDP) This is a database that contains additional subscriber data,

or other data required to process a call For example, the subscriber’s prepaid credit which is remaining may be an item stored in the SDF to be queried by the SCP in real time during the call The SDF may be a separate platform, or is sometimes co-located with the SCP

Service Creation Environment (SCE) It’s the environment used to create the

services present on the SCP It provides a front end to the operator

Intelligent Peripheral (IP) This is a node, sometimes co-located with in the SSP,

which provides additional resource and services to an IN call like collect DTMF (Dual Tone Multi Frequency) from user or play announcements

In Mobile networks, CAMEL is the widely used IN application protocol Camel Application Part (CAP) of SS7 is used to implement the CAMEL function between the SSP and the SCP All other interfaces in an IN are usually IP based or proprietary

to the Vendor

I GSM & GPRS Call Flows

CAMEL

Intelligent Network

IP

SS7

SCE SSP

MSC

Internal Protocol

Internal Protocol

Internal Protocol

SDP

SCE

1) Authentication & Location Update

1 The MS sends a Location update request on the air along with its IMSI and last Location Area Identity (LAI)

2 The request from the MS is forwarded to the MSC/VLR by the RAN

3 If the IMSI data is loaded in the MSC/VLR, the MSC does a Global title translation i.e converts MCC+MNC to MGT to obtain the HLR address of the roaming subscriber The resulting translation is in the format E.214 and is used to address the HLR for requesting the Authentication Information The IMSI and the requesting VLR address are sent to the HLR

4 On receipt of the request, the HLR obtains the Auth triplets (for 2G with MAPver2) or Auth Quintuplets (for 3G with MAP ver3) from AUC and forwards it to the VLR

Triplets RAND, SRES & Kc Quintuplet RAND, SRES, CK, IK & AUTN

5 The VLR then requests the SIM, through the MSC & RAN, for the authentication

6 The MS calculates the SRES and sends back to the network If this SRES is same as the one received by the VLR in the Triplets sent by HLR, the authentication succeeds and the Location update request is sent back to the HLR If Authentication fails, no LU request is sent by the VLR to HLR

7 After Authentication is successful, VLR sends LocUpd request to HLR

8 HLR sends all the services like speech, SMS, APNs etc that are provisioned on the SIM in

“InsSubData” MAP message to VLR

10.LocUp 10 UpdLocAck

3.SndAuthInfo

7.LocUpd

9 InsSubDataAck

8 InsSubData

4.SndAuthInfoResp

6.AuthResp 5.AuthReq

2.LocUpReq 1.LocUpReq

10.UpdLocAck

6 AuthResp

5.AuthReq

BSSAP GSM MAP

9 The VLR inserts all the data into it and acknowledges the HLR

10 The HLR finally confirms the location update to the VLR At the same time the HLR stores the VLR address to keep track of the current location of the MS

Common causes for Authentication Failure:

1 SIM is unknown in HLR/AUC i.e., it is not activated.

2 Auth_Req to USIM with MAP ver2 fails since USIM stores only Quintuplets and can

authenticate on MAP ver3 only

Common causes for Location Update Failure:

provisioned in the HLR.

The home carrier should provide the service before testing.

2 HLR sends some service in ‘Insert Sub Data’ which is not supported in VLR This leads

VLR to abort the communication Services like CUG, PLMN specific barring are mostly rejected by VLRs The HPLMN tester should be requested to remove such services on the test SIM

2) Location Cancellation

1 This service is used between HLR and VLR to delete a subscriber record from the VLR

2 It may be invoked automatically when an MS moves from one VLR area to another, to remove the subscriber record from the old VLR, or by the HLR operator to enforce a location updating from the VLR to the HLR, e.g on

withdrawal of a subscription.

2 LocUpdReq

2 UpdLocAck

2 Loc_CancelAck

2 Cancel_Loc

1 Cancel_Loc

1 Loc_ CancelAck

BSSAP GSM MAP

3) Mobile Originated Call (Mobile to PSTN)

1 The MS requests the call setup for MOC This request is also used for a channel allocation for the call in the air and A interface Request message contains the called party address

2 MSC analyses the called party digits, obtains the route from the B-Number analysis table and shoots Initial Address Message to the destination PSTN The IAM contains Calling party, called party and other info like CLIR etc

3 The PSTN exchange analyses the B-number, if correct, then sends Address Complete Message

to the GMSC

4 While the B-number is being alerted (ring) , a Call Progress may be sent back to the GMSC

5 When the PSTN answers the call, an ANswer Message is sent by the terminating PSTN

exchange This is also the point when charging starts in the MSC

6 If the MS disconnects the call, a RELease message is sent to the PSTN If the PSTN disconnects first, then REL is sent by the PSTN

7 To acknowledge the REL, a Release Complete message is sent The pair REL and RLC is required to clear the circuit connections currently held by the call

8 Finally the air interface channel occupied by MS is released

Common causes for MOC failure:

1 Outgoing call barring is active on SIM and hence MSC rejects the call.

2 B-number is not configured/routed in the MSC and hence MSC cannot route the call.

3 There is congestion in the national/International Network.

6 REL

6 REL

6 Disconnect

4 CPG

4 CPG

4 Alerting

3 call proceeding 3 ACM 3 ACM

2 IAM

2 IAM

1 Setup

VMSC/VLR

BSSAP ISUP (circuit related)

4) Mobile Terminated Call (PSTN to Mobile)

1.1 The calling PSTN sends IAM to the GMSC of the called MS Regardless of the location of PSTN in Home country or anywhere else is the world, the call is first routed to the Home GMSC via intermediate exchanges/carriers by doing digit analysis of the called number The main components of IAM are OPC, DPC, Calling, Called and other optional parameters 2.1 After receiving the IAM, the GMSC does a B-Number digit analysis to find the appropriate HLR and send a MAP message SRI – Send Routing Info to the HLR The SRI contains the MSISDN, GMSC address and other parameters

2.2 Once SRI request is received, the HLR checks the current VLR address in its dynamic data table for the MS and sends MAP message PRN – Provide Roaming Number to the VLR This

is a request to obtain the MSRN from the VLR

4.3 Release 1.5 RLC

1.4.REL

3.4 REL 3.3 ANM

4.2.PAGINGResp,setup

4.1.PAGINGReqst

3.2 ACM

3.1 IAM 2.4 SRIResp

2.3 PrvdRoamNumResp 2.2 PrvdRoamNum 2.1 SRI

1.2 ACM

1.1 IAM

PSTN(home n/w)

1.3.ANM

3.5 RLC

ISUP (circuit related) GSM MAP BSSAP

HLR (home n/w)

2.3 The VLR responds with an MSRN in PRN response MAP message to the HLR It also stores this MSRN against the IMSI for use in call setup

2.4 The HLR forwards the same MSRN to the GMSC and closes the SRI procedure

3.1 The GMSC now does a MSRN digit analysis and if found, routes IAM to the appropriate VMSC The IAM contains the MSRN as the Called party Internationally, this call is handled and routed by various intermediate carriers

3.2 The VMSC, upon digit analyses, sends ACM- Address Complete Message to the Calling GMSC

4.1 The VMSC obtains the LAC of the MS from VLR, then sends a Paging Request to the relevant BSC at which the MS is located currently

4.2 The BSC pages the MS and if the MS is attached to the network, it send back the Paging Response to the BSC The BSC inturn confirms that same to the GMSC The call is then setup, alerted and then connected when the MS answers the call

3.3 An ANM – Answer Message is sent to the GMSC to confirm the connection and this is where the conversation starts

1.3 An ANM is also sent simultaneously by the GMSC to the originally calling PSTN exchange 1.4, 3.4 REL- RELease message is sent on both the ISUP legs once the call is released

1.5, 3.5, 4.3 Once the call is released, RLC- ReLease Complete is returned and the call is also cleared on the MS side

4.3 The traffic channel held by the MS on the air is finally released

Common Causes for MTC failure

1 The MSRN digit analysis is not done in the Home GMSC.

2 There are delays is International Network due to which the call timer expires causing the call to be unsuccessful