3GPP TS 23.251 V10.1.

0 (2011-03)
Technical Specification

3rd Generation Partnership Project;

Technical Specification Group Services and System Aspects;
Network Sharing;
Architecture and functional description
(Release 10)

The present document has been developed within the 3rd Generation Partnership Project (3GPP TM) and may be further elaborated for the purposes of 3GPP.
The present document has not been subject to any approval process by the 3GPP Organizational Partners and shall not be implemented.
This Specification is provided for future development work within 3GPP only. The Organizational Partners accept no liability for any use of this Specification.
Specifications and reports for implementation of the 3GPP TM system should be obtained via the 3GPP Organizational Partners' Publications Offices.
Release 10 2 3GPP TS 23.251 V10.1.0 (2011-03)

Keywords
LTE, UMTS, Network

3GPP

Postal address

3GPP support office address

650 Route des Lucioles - Sophia Antipolis
Valbonne - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16

Internet
http://www.3gpp.org

Copyright Notification

No part may be reproduced except as authorized by written permission.

The copyright and the foregoing restriction extend to reproduction in all media.

© 2011, 3GPP Organizational Partners (ARIB, ATIS, CCSA, ETSI, TTA, TTC).
All rights reserved.

UMTS™ is a Trade Mark of ETSI registered for the benefit of its members
3GPP™ is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners
LTE™ is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners
GSM® and the GSM logo are registered and owned by the GSM Association

3GPP
Release 10 3 3GPP TS 23.251 V10.1.0 (2011-03)

Contents
Foreword ...................................................................................................................................................... 4
Introduction .................................................................................................................................................. 4
1 Scope .................................................................................................................................................. 5
2 References .......................................................................................................................................... 5
3 Definitions and abbreviations .............................................................................................................. 6
3.1 Definitions ................................................................................................................................................... 6
3.2 Void ............................................................................................................................................................ 6
3.3 Abbreviations............................................................................................................................................... 6
4 General Description ............................................................................................................................ 7
4.1 Overview ..................................................................................................................................................... 7
4.2 Core Network Operator and Network Selection ............................................................................................ 8
4.2.1 Core network operator identity ................................................................................................................ 8
4.2.2 Broadcast system information for network sharing .................................................................................. 8
4.2.3 Network selection in a shared network .................................................................................................... 8
4.2.3.1 Behaviour of supporting UEs (UTRAN and E-UTRAN) .................................................................... 8
4.2.3.2 Behaviour of non-supporting UEs (GERAN, UTRAN) ...................................................................... 9
4.2.4 Assignment of core network operator and core network node................................................................... 9
4.2.5 PS and CS domain registration coordination in UTRAN and GERAN...................................................... 9
4.2.5a PS and CS domain registration coordination in E-UTRAN .................................................................... 10
4.2.6 Attach/detach handling ......................................................................................................................... 10
4.3 Network Name Display for Supporting UEs ............................................................................................... 10
4.4 HPLMN Support ........................................................................................................................................ 10
4.5 Support of Cell Broadcast Services and Warning System ............................................................................ 10
5 Functional description ....................................................................................................................... 10
5.1 UE functions .............................................................................................................................................. 10
5.2 RNC functions ........................................................................................................................................... 11
5.2a eNodeB functions....................................................................................................................................... 11
5.2b BSC functions ............................................................................................................................................ 11
5.3 MSC functions ........................................................................................................................................... 12
5.4 SGSN functions ......................................................................................................................................... 12
5.5 MME functions .......................................................................................................................................... 13
6 Charging and accounting aspects ....................................................................................................... 13
7 Example signalling flows .................................................................................................................. 14
7.1 Network selection ...................................................................................................................................... 14
7.1.2 Non-supporting UEs in a GWCN configuration ..................................................................................... 14
7.1.3 Supporting UEs in a GWCN configuration ............................................................................................ 14
7.1.4 Non-supporting UEs in a MOCN configuration ..................................................................................... 15
7.1.4.1 UTRAN based MOCN configuration ............................................................................................... 15
7.1.4.2 GERAN based MOCN configuration ............................................................................................... 17
7.1.5 Supporting UEs in a MOCN configuration ............................................................................................ 21
7.1.5.1 UTRAN based MOCN configuration ............................................................................................... 21
7.1.5.2 GERAN based MOCN configuration ............................................................................................... 22

Annex A (informative): Network Resource Indicator (NRI) allocation examples .......................... 23

A.1 NRI in shared UTRAN/GERAN networks ........................................................................................ 23
A.2 Alternatives for NRI split in UTRAN and GERAN ........................................................................... 24

Annex B (informative): Change History .......................................................................................... 25

3GPP
Release 10 4 3GPP TS 23.251 V10.1.0 (2011-03)

Foreword
This Technical Specification has been produced by the 3rd Generation Partnership Project (3GPP).

The contents of the present document are subject to continuing work within the TSG and may change following formal
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an
identifying change of release date and an increase in version number as follows:

Version x.y.z

where:

x the first digit:

1 presented to TSG for information;

2 presented to TSG for approval;

3 or greater indicates TSG approved document under change control.

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates,
etc.

z the third digit is incremented when editorial only changes have been incorporated in the document.

Introduction
Network sharing is a way for operators to share the heavy deployment costs for mobile networks, especially in the roll-
out phase. In the current mobile telephony marketplace, functionality that enables various forms of network sharing is
becoming more and more important. These aspects have not really been addressed before Release 6 in 3GPP UTRAN
based access networks, before Release 8 in 3GPP E-UTRAN based access networks and before Release 10 in 3GPP
GERAN based access networks, although there has been functionality that supports a very basic type of network
sharing since the Release 5 versions of the 3GPP specifications.

To cope with 3GPP pre-Release 6 UTRAN UEs and with 3GPP GERAN UEs, this specification describes extra
functionality for MSCs, SGSNs, BSCs and RNCs in order to provide network sharing functionality to "non-supporting
UEs".

In this Release of the specifications, all UTRAN and E-UTRAN capable UEs are required to support these network
sharing requirements. Hence the E-UTRAN and MMEs (which were introduced in 3GPP Release 8) do not need
functionality to handle "non-supporting UEs".

The GERAN capable UEs are: "non-supporting UEs", as no modification is introduced in the Radio Interface for
GERAN network sharing (no PLMNs List broadcast on the Radio Interface).

Scenarios and user requirements are described in TR 22.951 [1], while the current document presents the stage 2 details
and descriptions of how these requirements are supported in a 3GPP GERAN, UTRAN and/or E-UTRAN based
network.

3GPP
Release 10 5 3GPP TS 23.251 V10.1.0 (2011-03)

1 Scope
The present document covers the details of Network Sharing for GERAN, UTRAN and E-UTRAN. It shows how
several core network operators can share one radio access network and details the impacts on the network architecture.
All UEs shall comply with existing requirements, among them PLMN selection and system information reception. The
present document also defines requirements for network-sharing supporting UEs.

2 References
The following documents contain provisions which, through reference in this text, constitute provisions of the present
document.

References are either specific (identified by date of publication, edition number, version number, etc.) or
non-specific.

For a specific reference, subsequent revisions do not apply.

For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same
Release as the present document.

[1] 3GPP TR 22.951: "Service Aspects and Requirements for Network Sharing".

[2] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications".

[3] 3GPP TS 25.331: "RRC Protocol Specification".

[4] 3GPP TS 23.122: "NAS Functions related to Mobile Station (MS) in idle mode".

[5] 3GPP TS 32.250: "Telecommunication management; Charging management; Circuit Switched

(CS) domain charging".

[6] 3GPP TS 32.251: "Telecommunication management; Charging management; Packet Switched

(PS) domain charging".

[7] 3GPP TS 24.008: "Mobile radio interface Layer 3 specification; Core network protocols; Stage 3".

[8] 3GPP TS 23.236: "Intra-domain connection of Radio Access Network (RAN) nodes to multiple
Core Network (CN) nodes".

[9] 3GPP TS 23.401: "Technical Specification Group Services and System Aspects; GPRS
enhancements for E-UTRAN access".

[10] 3GPP TS 36.300: "Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal
Terrestrial Radio Access (E-UTRAN); Overall description; Stage 2".

[11] 3GPP TS 36.331: "Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource
Control (RRC); Protocol specification".

[12] 3GPP TS 24.301: "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS);
Stage 3".

[13] 3GPP TS 25.413: "UTRAN Iu interface, Radio Access Network Application Part (RANAP)
signalling".

[14] 3GPP TS 36.413: "Evolved Universal Terrestrial Radio Access Network (E-UTRAN); S1
Application Protocol (S1AP)".

[15] 3GPP TS 23.272: "Circuit Switched (CS) fallback in Evolved Packet System (EPS); Stage 2".

[16] 3GPP TS 44.018: "Radio Resource Control RRC Protocol Specification".

3GPP
Release 10 6 3GPP TS 23.251 V10.1.0 (2011-03)

[17] 3GPP TS 25.467: "UTRAN architecture for 3G Home Node B (HNB); Stage 2".

[18] 3GPP TS 22.042: "Network Identity and Time Zone (NITZ); Service description; Stage 1".

[19] 3GPP TS 44.064: "General Packet Radio Service (GPRS); Mobile Station - Serving GPRS Support
Node (MS SGSN) Logical Link Control (LLC) layer specification".

[20] 3GPP TS 23.041: "Technical realization of Cell Broadcast Service (CBS)".

3 Definitions and abbreviations

3.1 Definitions
For the purposes of the present document, the following terms and definition below apply. Terms and definitions not
defined below can be found in TR 21.905 [2].

Conventional network: A PLMN consisting of radio access network and core network, by which only one serving
operator provides services to its subscriber. Subscribers of other operators may receive services by national or
international roaming.

Common PLMN: The PLMN-id indicated in the system broadcast information as defined for conventional networks,
which non-supporting UEs understand as the serving operator.

Core network operator: An operator that provides services to subscribers as one of multiple serving operators that
share at least a radio access network. Each core network operator may provide services to subscriber of other operators
by national or international roaming.

Gateway Core Network: A network sharing configuration in which parts of the core network (MSCs/SGSNs/MMEs)
are also shared.

Multi-Operator Core Network: A network-sharing configuration in which only the RAN is shared.

Non-supporting UE: A UE that does not support network sharing in the sense that it ignores the additional broadcast
system information that is specific for network sharing for 3GPP UTRAN. For 3GPP GERAN based network sharing,
no additional broadcast system information is sent and all GERAN UEs are non-supporting UEs. In other specifications,
the term "network sharing non-supporting UE" may be used.

Supporting UE: A UE that supports network sharing in the sense that it is able to select a core network operator as the
serving operator within a shared network. In other specifications, the term "network sharing supporting UE" may be
used.

3.2 Void

3.3 Abbreviations
For the purposes of the present document, the abbreviations given in TR 21.905 [2] and the following apply. An
abbreviation defined in the present document takes precedence over the definition of the same abbreviation, if any, in
TR 21.905 [2].

BSC Base Station Controller

CN Core Network
E-UTRAN Evolved Universal Terrestrial Radio Access Network
eNodeB E-UTRAN NodeB
GERAN GSM/EDGE Radio Access Network
GUTI Globally Unique Temporary Identity
GWCN Gateway Core Network
HLR Home Location Register

3GPP
Release 10 7 3GPP TS 23.251 V10.1.0 (2011-03)

MCC Mobile Country Code

MME Mobility Management Entity
MNC Mobile Network Code
MOCN Multi-Operator Core Network
MSC Mobile Switching Centre
NITZ Network Identity and Time Zone
PLMN Public Land Mobile Network
RNC Radio Network Controller
SGSN Serving GPRS Support Node
TMSI Temporary Mobile Subscriber Identity
UE User Equipment
UTRAN Universal Terrestrial Radio Access Network
VLR Visitor Location Register

4 General Description

4.1 Overview
A network sharing architecture shall allow different core network operators to connect to a shared radio access network.
The operators do not only share the radio network elements, but may also share the radio resources themselves. In
addition to this shared radio access network the operators may or may not have additional dedicated radio access
networks, like for example, 2G radio access networks. There are two identified architectures to be supported by network
sharing. They are shown in the figures below.

In both architectures, the radio access network is shared. Figure 1 below shows reference architecture for network
sharing in which also MSCs and SGSNs are shared. This configuration will be referred to as a Gateway Core Network
(GWCN) configuration.

......... CN
Operator A
CN
Operator B
CN
Operator C
.........

Shared Shared Shared

MSC/SGSN MSC/SGSN MSC/SGSN

Iu

RNC RNC RNC

Radio Access Network

Operator X

Figure 1: A Gateway Core Network (GWCN) configuration for network sharing.

Besides shared radio access network nodes, the core network operators also
share core network nodes

Figure 2 below shows the reference architecture for network sharing in which only the radio access network is shared,
the Multi-Operator Core Network (MOCN) configuration.

3GPP
Release 10 8 3GPP TS 23.251 V10.1.0 (2011-03)

......... CN
Operator A
CN
Operator B
CN
Operator C
.........

Iu

RNC

Radio Access Network

Operator X

Figure 2: A Multi-Operator Core Network (MOCN) in which multiple CN nodes are

connected to the same RNC and the CN nodes are operated by different operators

The UE behaviour in both of these configurations shall be the same. No information concerning the configuration of a
shared network shall be indicated to the UE.

For the Evolved Packet System, only the PS domain of the above figures is relevant. For E-UTRAN access Figures 1
and 2 both apply but with the MME replacing the SGSN, the eNodeB replacing the RNC, and the S1 reference point
replacing the Iu interface.

For GERAN access, only MOCN applies (Figure 2) but with the BSC replacing the RNC and the A/Gb-Interface
replacing the Iu interface. Furthermore, supporting UEs do not apply for GERAN, as no modification is introduced in
the UEs for GERAN network sharing.

RAN sharing for Closed Subscriber Group (CSG) and hybrid cells (see TS 36.300 [10] and TS 25.467 [17]) is not
supported in this release of the specifications. A CSG cell shall only broadcast one PLMN ID.

4.2 Core Network Operator and Network Selection

Network sharing is an agreement between operators and shall be transparent to the user. This implies that a supporting
UE needs to be able to discriminate between core network operators available in a shared radio access network and that
these operators can be handled in the same way as operators in non-shared networks.

4.2.1 Core network operator identity

A core network operator is identified by a PLMN-id (MCC+MNC).

4.2.2 Broadcast system information for network sharing

Each cell in shared radio access network shall in the broadcast system information include information concerning
available core network operators in the shared network. The available core network operators shall be the same for all
cells of a Location Area in a shared UTRAN or GERAN network. The available core network operators shall be the
same for all cells of a Tracking Area in a shared E-UTRAN network. A supporting UE decodes the broadcast system
information and takes the information concerning available core network operators into account in network and cell (re-
)selection procedures. Broadcast system information is specified in TS 44.018 [16] for GERAN, TS 25.331 [3] for
UTRAN and TS 36.331 [11] for E-UTRAN.

For GERAN, as only non supporting UEs are considered, the information concerning available core network operators
are never broadcast.

4.2.3 Network selection in a shared network

4.2.3.1 Behaviour of supporting UEs (UTRAN and E-UTRAN)

A supporting UE decodes the broadcast system information to determine available core network operators in the shared
network. The UE regards both the core network operators indicated in the broadcast system information and
conventional networks as individual networks. The core network operators together with all conventional networks are
candidate PLMNs for the PLMN selection procedure that shall be performed by the UE as specified in TS 23.122 [4].

3GPP
Release 10 9 3GPP TS 23.251 V10.1.0 (2011-03)

In UTRAN, non-supporting UEs use the broadcast "common PLMN-id" in their PLMN (re)selection processes. For
UTRAN, a supporting UE shall use the PLMN-ids that are broadcast in the Multiple PLMN ID List information
element.

For E-UTRAN, the UE uses all of the broadcast PLMN-ids in its PLMN (re) selection processes.

4.2.3.2 Behaviour of non-supporting UEs (GERAN, UTRAN)

Non-supporting UEs ignore the broadcast system information that is relevant for network sharing. The common PLMN
together with all conventional networks are candidate PLMNs for the PLMN selection procedure that shall be
performed by the UE as specified in TS 23.122 [4].

It is recommended for the network and the UE to support the Network Identity part of the Network Identity and Time
Zone (NITZ) feature (see TS 22.042 [18]) for providing the UE with the name of the serving PLMN operator.

4.2.4 Assignment of core network operator and core network node

When a UE performs an initial access to a shared network, one of available CN operators shall be selected to serve the
UE. For non-supporting UEs, the shared network selects an operator from the available CN operators. For supporting
UEs, the selection of core network operator by the UE shall be respected by the network. Supporting UEs inform the
RNC/eNodeB of the network identity of the chosen core network operator.

In a UTRAN GWCN configuration, the RNC relays the chosen network identity to the shared core network node. In
E-UTRAN GWCN, the eNodeB always relays the chosen network identity to the shared MME.

In a MOCN configuration, the RAN routes the UE's initial access to the shared network to one of the available CN
nodes. Supporting UEs shall inform the RAN of the chosen core network operator so that the RAN can route correctly.
For non-supporting UEs the shared network selects an operator from the available CN operators. A redirection to
another CN operator may be required for non-supporting UEs until an operator is found that can serve the UE.
Redirection is described in clause 7.1.4.

After initial access to the shared network the UE does not change to another available CN operator as long as the
selected CN operator is available to serve the UE's location. Only the network selection procedures specified in
TS 23.122 [4] may cause a reselection of another available CN operator. . Also the network does not move the UE to
another available CN operator, e.g. by handover, as long as the selected CN operator is available to serve the UE's
location. Furthermore the UE does not change to another CN node as long as the selected CN node is available to serve
the UE's location.

In UTRAN, when the network signals location/routing area identities to supporting UEs, e.g. in location updating
accept messages, these identities shall contain the chosen core network operator identity. For non-supporting UTRAN
UEs, they shall contain the common PLMN. The UE stores the received LAI/RAI on the SIM/USIM, as already
specified in TS 24.008 [7].

In E-UTRAN, the chosen core network operator identity is included in the GUTI in e.g. the Attach Accept message.
The UE shall store the received GUTI on the USIM according to the rules specified in TS 24.301 [12].

In GERAN, all UEs are non-supporting UEs and only the common PLMN is signalled by the network to the UE.

4.2.5 PS and CS domain registration coordination in UTRAN and GERAN

In conventional networks, the same CN operator always serves the UE in CS and PS domains. In a shared network,
supporting UEs shall behave as UEs in conventional networks with respect to registration with CS and PS domains. For
non-supporting UEs, the Gs interface may be configured to guarantee that the same CN operator serves the subscriber in
CS and PS domains.

Alternatively, in networks not using Gs the RNC/BSC may for non-supporting UE's coordinate that the CS and PS
registrations for a given subscriber are always sent to the same CN operator. In that case RNC/BSC based coordination
of PS and CS domain registration is configured in CN nodes and RNC/BSC. When a CN node receives a registration
from a subscriber with a non-supporting UE having a P-TMSI/TMSI not belonging to the pool, and no IMSI is provided
by RNC/BSC, it returns a Reroute Command message to the RNC/BSC (according to clause 7.1.4 "Non-supporting
UEs in a MOCN configuration") with an indication that it is for coordination purposes. The coordination is done in the
RNC/BSC (without memorising IMSI information for IDLE mode UEs), e.g. uses a fixed split of IMSI ranges or IMSI

3GPP
Release 10 10 3GPP TS 23.251 V10.1.0 (2011-03)

hash table between operators. The coordination may result in that the registration is sent back to the same CN node or
CN operator again.

A network should not be configured to use RNC/BSC coordination when Gs interface is in use.

4.2.5a PS and CS domain registration coordination in E-UTRAN

When multiple core network operators share the E-UTRAN using a GWCN configuration, separate MSCs may still be
used for the CS Fall Back functionality. In this case the MME uses the 'selected network' information received from the
E-UTRAN to select an MSC from the already selected operator.

When multiple PLMNs are available for CS domain, the MME selects the MSC for CS Fallback functionality based on
the 'selected network' information received from the E-UTRAN, current TAI, old LAI provided by the UE and operator
selection policies as specified in TS 23.272 [15]. In this case, the selected PLMN-id for CS domain may be different
with the PLMN-id for EPS domain.

4.2.6 Attach/detach handling

To attach to the same core network operator from which it detached, a UE uses information stored in the UE (e.g. on the
SIM/USIM) when the UE was detached. For a supporting UE in a shared network, the stored information indicates the
core network operator it detached from (as specified in clause 4.2.4). This information enables a supporting UE to
attach to the same core network operator from which it detached. For non-supporting UEs in a shared network, the
stored information indicates the common PLMN.

4.3 Network Name Display for Supporting UEs

A supporting UE shows the name of the PLMN-id it has registered with. In case of a shared network, it is the PLMN-id
of the chosen core network operator. The name stored in the UE for the PLMN-id is displayed except when the network
indicates to the UE a name to be displayed, as already specified for non-supporting UEs.

4.4 HPLMN Support

The use of a shared VLR/SGSN/MME shall not result in service restrictions, e.g. roaming restrictions. Since a HSS
derives whether the subscriber roams in H- or V-PLMN from the VLR/SGSN/MME identifier, a shared
VLR/SGSN/MME in a GWCN shall be allocated a separate identifier from each operator sharing that CN node, i.e. a
shared VLR/SGSN/MME has multiple identifiers. The VLR/SGSN/MME identifier of a user's serving CN operator is
used in signalling with the HSS.

4.5 Support of Cell Broadcast Services and Warning System

In shared networks Cell Broadcast and Warning System services are provided via a single common CBC, which
connects to GERAN/UTRAN as described in TS 23.041 [20] and connects to E-UTRAN as described in TS 23.401 [9].
The deployment and configuration of the common CBC is per agreement between the sharing operators. The sharing
operators need to coordinate the broadcast services between each other, e.g. how to provide Warning System services.

5 Functional description
The new behaviours of network nodes needed in order to describe network sharing are described.

5.1 UE functions
A supporting UE selects the core network operator and provides the PLMN-id of this operator to the network for
routing purposes.

3GPP
Release 10 11 3GPP TS 23.251 V10.1.0 (2011-03)

5.2 RNC functions

Network sharing information, i.e. available core network operators in the shared network, shall be transmitted in
broadcast system information. If system information is transmitted to a supporting UE in dedicated signalling, the RNC
shall indicate the PLMN-id of the core network operator towards which the UE already has a signalling connection (if a
PLMN-id is included in the signalling). If the UE is non-supporting, the RNC shall indicate the common PLMN (if a
PLMN-id identity is included in the signalling)

The RNC shall indicate the selected core network operator to the CN for supporting UEs when transferring initial layer
3 signalling. The selected CN operator is (i) indicated by the UE in RRC signalling or (ii) known implicitly from an
already existing signalling connection. For non-supporting UEs, the RNC shall not indicate any selected core network
operator to the CN.

In case of relocation to a GWCN or a MOCN in UTRAN or E-UTRAN:

- the source RNC determines a core network operator to be used in the target network based on available shared
networks access control information, current PLMN in use, or similar information present in the node, the source
RNC shall at relocation indicate that selected core network operator to the source core network node as part of
the TAI/RAI sent in the Relocation required message. The selected target core network operator should be the
same as the one in use. This is accomplished by not changing the serving PLMN if the PLMN in use is supported
in the target cell. If the PLMN in use is not supported in the target cell the RNC selects the target PLMN based
on either (i) pre-configured information in the RNC, or (ii) the SNA (Shared Network Area) Access Information
IE (see TS 25.413 [13]) provided by the SGSN.

5.2a eNodeB functions

Network sharing information, i.e. available core network operators in the shared network, shall be transmitted in
broadcast system information.

The eNodeB shall indicate the selected core network operator when transferring initial layer 3 signalling. The eNodeB
uses the selected core network information (provided by the UE at RRC establishment, or, provided by the MME/source
eNodeB at S1/X2 handover) to select target cells for future handovers appropriately.

In case of handover to a GWCN or a MOCN:

- the source eNodeB determines a core network operator to be used in the target network based on current PLMN
in use, or other information present in the eNodeB, the source eNodeB shall at handover indicate that selected
core network operator to the MME as part of the TAI/RAI sent in the HO required message. The selected target
core network operator should be the same as the one in use. This is accomplished by not changing the serving
PLMN if the PLMN in use is supported in the target cell. If the PLMN in use is not supported in the target cell
the eNB selects the target PLMN based on either (i) pre-configured information in the eNB, or (ii) the Equivalent
PLMNs list (see TS 36.413 [14]) provided by the MME.

- when multiple PLMNs are available for CS domain to support CS Fallback functionality, the source eNodeB
determines a core network operator to be used in the target GERAN/UTRAN network based on the allocated
LAI provided by the MME as specified in TS 23.272 [15]. The source eNodeB shall at handover indicate that
selected core network operator to the MME as part of the Target ID sent in the HO required message. If the
selected PLMN for CS domain is not supported in the target cell the eNodeB selects the target PLMN based on
either (i) pre-configured information in the eNodeB, or (ii) the Equivalent PLMNs list (see TS 36.413 [14])
provided by the MME.

- the target eNodeB uses the selected core network information to select target cells for future handovers
appropriately.

5.2b BSC functions

For Inter-RAT handover to a GWCN or a MOCN from GERAN:

- the source BSC determines a core network operator to be used in the target network based on current PLMN in
use, or other information present in the BSC, the source BSC shall at handover indicate that selected core
network operator to the source core network node as part of the TAI/RAI sent in the PS handover required

3GPP
Release 10 12 3GPP TS 23.251 V10.1.0 (2011-03)

message. The selected target core network operator should be the same as the one in use. This is accomplished
by not changing the serving PLMN if the PLMN in use is supported in the target cell. If the PLMN in use is not
supported in the target cell the BSC selects the target PLMN based on pre-configured information in the BSC.

5.3 MSC functions

When a UE accesses an MSC the first time, i.e. when there is no VLR entry for this UE, the MSC verifies whether the
UE belongs to one of the operators sharing the MSC or their roaming partners. For that purposes the MSC derives the
IMSI from another MSC/VLR or from the UE. The MSC determines a serving CN operator unless the old MSC/VLR or
the UE have indicated a core network operator. The MSC/VLR shall also store the identity of the serving core network
operator.

In case of a MOCN configuration, an MSC may not able to provide service to the UE. The UE may then have to be
redirected to a MSC of another core network operator. The MSC/VLR that finally serves the UE assigns a NRI to the
UE. This will allow the RAN to route any subsequent UE accesses the to the serving MSC/VLR.

For supporting UEs, i.e. when a selected core network operator has been indicated to the MSC by the RNC/BSC, the
MSC indicates the selected core network operator PLMN-id in the LAI signalled to the UE in dedicated signalling.

For sharing scenarios with both E-UTRAN and GERAN/UTRAN access, where the network also applies idle-mode
signalling reduction (see TS 23.401 [9]), the contents of the SNA Access Information IE (see TS 25.413 [13]) provided
by the MSC to the RNC/BSC for a specific UE guides the target PLMN selection if the UE's registered PLMN is not
available in the target cell. The SNA Access Information IE should be configured such that for any target cell there is
only one PLMN-ID that can be selected for the cell.

Also, for the above scenario, in the routing areas and tracking areas between which ISR may be activated the
"equivalent PLMNs" list provided by the SGSN, MSC and MME to a UE (see TS 24.008 [7]) should result in a single
consistent "equivalent PLMNs" list stored by the UE. The single "equivalent PLMNs" list applies to all the UE's
registered routing areas, location areas and tracking areas.

In case of relocation to a GWCN or a MOCN:

- There is no functionality in the source MSC to select a target core network operator or to modify the target core
network operator selected by the RNC/BSC.

- If the source MSC has the capability to indicate the core network operator selected by the source RNC/BSC to
the target MSC, the source MSC shall forward the selected core network operator chosen by the source
RNC/BSC to the target MSC, which relays this information unchanged to the target RNC/BSC so that the
appropriate PLMN-id can be signalled to the UE in dedicated system information signalling, as described in
clause 5.2.

5.4 SGSN functions

When a UE accesses an SGSN the first time, i.e. when the UE is not yet known by the SGSN, the SGSN verifies
whether the UE belongs to one of the operators sharing the SGSN or their roaming partners. For that purpose the SGSN
retrieves the IMSI from another SGSN/MME or from the UE. The SGSN determines a serving core network operator
unless the old SGSN or the UE have indicated a core network operator. The SGSN shall store the identity of the serving
core network operator.

In case of a MOCN configuration, a SGSN may not able to provide service to the UE. The UE may then have to be
redirected to a SGSN of another core network operator. The SGSN that finally serves the UE assigns a NRI to the UE.
This will allow the RAN to route any subsequent UE accesses to the serving SGSN.

For supporting UEs, i.e. when a selected core network operator has been indicated to the SGSN by the RNC/BSC, the
SGSN indicates the selected core network operator PLMN-id in the LAI/RAI signalled to the UE in dedicated signalling.

For sharing scenarios with both E-UTRAN and GERAN/UTRAN access, where the network also applies idle-mode
signalling reduction (see TS 23.401 [9]), the contents of the SNA Access Information IE (see TS 25.413 [13]) provided
by the SGSN to the RNC for a specific UE guides the target PLMN selection if the UE's registered PLMN is not
available in the target cell. The SNA Access Information IE should be configured such that for any target cell there is
only one PLMN-ID that can be selected for the cell.

3GPP
Release 10 13 3GPP TS 23.251 V10.1.0 (2011-03)

Also, for the above scenario, in the routing areas and tracking areas between which ISR may be activated the
"equivalent PLMNs" list provided by the SGSN, MSC and MME to a UE (see TS 24.008 [7]) should result in a single
consistent "equivalent PLMNs" list stored by the UE. The single "equivalent PLMNs" list applies to all the UE's
registered routing areas, location areas and tracking areas.

At relocation/handover to a GWCN or a MOCN:

- There is no functionality in the source SGSN to select a target core network operator or to modify the target core
network operator selected by the RNC/BSC. Instead, the source SGSN uses the selected PLMN received from
the RNC/BSC to determine the target core network operator. The source SGSN shall forward the selected core
network operator chosen by the source RNC/BSC to the target SGSN/MME.

- The target SGSN indicates the selected core network operator chosen by the source RNC/BSC/eNodeB to the
target RNC so that the appropriate PLMN-id can be signalled to the UE in dedicated system information
signalling, as described in clause 5.2.

5.5 MME functions

When a UE accesses an MME for the first time, i.e. when the UE is not yet known by the MME, the MME verifies
whether the UE is permitted to access the selected PLMN. For that purpose the MME retrieves the IMSI from another
MME/SGSN or from the UE. The MME shall store the identity of the selected core network operator.

The MME indicates the selected core network operator PLMN-id to the UE in the GUTI.

For sharing scenarios with both E-UTRAN and GERAN/UTRAN access, where the network also applies idle-mode
signalling reduction (see TS 23.401 [9]), the PLMN IDs included in the equivalent PLMN list (as defined in
TS 24.008 [7]) provided by the MME to the eNB guides the target PLMN selection if the UE's registered PLMN is not
available in the target cell. The equivalent PLMN list should be configured such that for any target cell there is only one
PLMN-ID that can be selected for the cell.

Also, for the above scenario, in the routing areas and tracking areas between which ISR may be activated the
"equivalent PLMNs" list provided by the SGSN, MSC and MME to a UE (see TS 23.008 [7]) should result in a single
consistent "equivalent PLMNs" list stored by the UE. The single "equivalent PLMNs" list applies to all the UE's
registered routing areas, location areas and tracking areas.

For sharing scenarios with both E-UTRAN and GERAN/UTRAN access, when multiple PLMNs are available for CS
domain to support CS Fallback functionality, the MME provides the allocated LAI including the selected PLMN ID for
CS domain along with "CS Fallback indicator" to the eNodeB as specified in TS 23.272 [15], to guide the selection of
the target GERAN/UTRAN network.

At handover/relocation to a GWCN or a MOCN:

- The source MME uses the TAI/RAI information supplied by the eNodeB to select the target MME/SGSN. There
is no additional functionality in the source MME to select a target core network operator or to modify the target
core network operator selected by the eNodeB. Instead, the source MME uses the selected PLMN received from
the eNodeB to determine the target core network operator. The source MME shall forward the selected target
core network operator chosen by the source eNodeB to the target MME/SGSN.

- The target MME indicates the selected target core network operator chosen by the source eNodeB/RNC/BSC to
the target eNodeB so that the eNodeB can select target cells for future handovers appropriately. Subsequent
Tracking Area Update signalling is used to update the UE about any change of core network operator.

6 Charging and accounting aspects

To support inter-operator accounting in a shared network, it shall be possible to distinguish the share of usage of the
shared core network node(s) between the sharing partners. The identity of the core network operator is included in the
CDR types as specified in TS 32.250 [5] (CS) and TS 32.251 [6] (GPRS)/EPS.

3GPP
Release 10 14 3GPP TS 23.251 V10.1.0 (2011-03)

7 Example signalling flows

7.1 Network selection

Signalling flows for manual and automatic network selection in a shared network architecture for successful and
unsuccessful registration attempts are presented.

7.1.2 Non-supporting UEs in a GWCN configuration

This example shows network selection for a non-supporting UE towards the PS domain in a shared UTRAN network.

Non-supporting
Shared SGSN RNC
UE

1. System information

2. UE cannot decode network sharing

information in system broadcast
information.

3. Network selection
(Common PLMN is candidate)

4. ATTACH REQUEST

5. CN node determines whether the

UE is allowed to attach.

6. ATTACH ACCEPT/REJECT

Figure 3: Network selection for a non-supporting UE in a shared UTRAN network

1. The UE reads the broadcast system information in the shared RAN.

2. A non-supporting UE cannot decode the shared network information in the broadcast system information. The
common PLMN is the only candidate to be considered together with other PLMNs for network selection.

3. The UE performs network selection among available PLMNs.

4. The UE sends an ATTACH REQUEST message to the network.

5. The shared SGSN determines whether the UE is allowed to attach.

6. The shared SGSN sends the appropriate ACCEPT/REJECT message back to the UE.

7.1.3 Supporting UEs in a GWCN configuration

This example shows network selection for a supporting UE towards the PS domain in a shared UTRAN network.

3GPP
Release 10 15 3GPP TS 23.251 V10.1.0 (2011-03)

Shared SGSN RNC Supporting UE

1. System information

2. UE decodes network sharing

information in system broadcast
information.

3. Network selection

4. ATTACH REQUEST

5. CN node determines whether the

UE is allowed to attach.

6. ATTACH ACCEPT/REJECT

Figure 4: Network selection for a supporting UE in a shared UTRAN network

1. The UE reads the broadcast system information in the shared RAN.

2. A supporting UE decodes the shared network information and supplies the available core network operator
PLMN-ids as candidates to the PLMN selection procedure. Only PLMNs in the Multiple PLMN ID List are
candidates for network selection.

3. The UE performs network selection among available PLMNs.

4. The UE sends an ATTACH REQUEST message to the network indicating the chosen core network operator.

5. The shared SGSN determines whether the UE is allowed to attach.

6. The shared SGSN sends the appropriate ACCEPT/REJECT message back to the UE.

7.1.4 Non-supporting UEs in a MOCN configuration

7.1.4.1 UTRAN based MOCN configuration

An example of an information flow for redirection in UTRAN is shown below.

In this example an attach request from a non-supporting UE is directed to three different CN operators. The first rejects
since it has no roaming agreement with the subscribers Home PLMN. The second rejects because of a roaming
restriction found in HLR. The third CN operator accepts and completes the attach request. The different "MSC/SGSNs"
in the example below shall be seen as different CN operators. One specific CN operator may also have several pooled
MSCs/SGSNs connected to the RNC if Iu-flex is used.

3GPP
Release 10 16 3GPP TS 23.251 V10.1.0 (2011-03)

UE RNC MSC/ MSC/ MSC/ HLR

SGSN A SGSN B SGSN C

1. RRC Connection Establishment

2. Initial Direct Transfer 3. Initial UE (Attach request, redirect attempt flag)

4. Identity Req
4. Identity Resp (IMSI)
Roaming not allowed for HPLMN of IMSI /
Roaming allowed but CS/PS coordination required

5. Reroute Command

6. Initial UE (Attach request, redirect attempt flag, IMSI, …)

7. Authentication & Ciphering

8. Update Location / Insert Subscr. Data

Roaming not allowed for HPLMN of IMSI

9. Reroute Command

10. Initial UE (Attach request, redirect attempt flag, IMSI, …)

11. Authentication & Ciphering

12. Update Loc./ Cancel Loc./

Insert Subscr. Data

13. Reroute Complete ( Attach accept, …)

14. Direct Transfer( Attach accept )
15. Attach Complete

Figure 5: Information flow for redirection in UTRAN

1) The RRC connection is established.

2) RNC receives an Initial Direct Transfer from an UE. The RNC is configured to work in a Shared RAN MOCN,
and therefore it forwards the NAS message in an Initial UE with an additional redirect attempt flag set. The flag
indicates that the MSC/SGSN shall respond to the attach request with a Reroute Command or Reroute Complete
message. Selection of CN node is based on NRI (valid or invalid) if present in IDNNS or by random selection.
A redirect attempt flag could also simply be the fact that the Initial UE message does not include any selected
PLMN-ID (later RAN3 decision), which a supporting UE would include. Redirect is never done for supporting
UEs.

3) The MSC/SGSN receives the Initial UE with the redirect attempt flag set. It then knows it shall answer with a
Reroute Command or Reroute Complete message. Those new messages might also be extensions to the Direct
Transfer message (later RAN3 decision).

4) The MSC/SGSN needs the IMSI of the UE. It is retrieved either from old MSC / old SGSN or from the UE as in
this example. By comparing the IMSI with the roaming agreements of the CN operator, the MSC/SGSN
discovers that roaming is not allowed or that roaming is allowed but CS/PS coordination required. Attach
procedure is aborted.

5) A message is sent back to the RNC with two NAS messages, the attach reject message and the original attach
request message received from the UE (alternatively the original NAS message may be stored in the RNC). The
IMSI is also included in the message, plus a reject cause code to the RNC. The message should be a new
RANAP message, Reroute Command. It might also be an extended Direct Transfer message (later RAN3
decision).

The signalling connection between RNC and MSC/SGSN A is released. The RNC selects a MSC/SGSN in the
next step. The already tried MSC/SGSNs is stored in the RNC during the redirect procedure so that the same
node is not selected twice.

3GPP
Release 10 17 3GPP TS 23.251 V10.1.0 (2011-03)

6) The RNC sends a new Initial UE to the next selected MSC/SGSN with the original NAS attach request message
(in case of CS/PS coordination the Initial UE may also be sent back to the first MSC/SGSN depending on the
outcome of the coordination). Redirect attempt flag is set and IMSI shall also be included to avoid a second
IMSI retrieval from UE or old MSC/SGSN and to indicate that PS/CS domain coordination has been done in
RNC (if enabled in RNC). The MSC/SGSN receiving the message starts its attach procedure.

7) MSC/SGSN B does in general support roaming for the HPLMN of the IMSI and hence authentication is done
and RAN ciphering is established.

8) MSC/SGSN B updates the HLR and receives subscriber data from HLR.

9) The subscription data do not allow roaming (e.g. regional or 3G). MSC/SGSN B sends a Reroute Command
message including the attach reject message, a reject cause code, the original attach request message
(alternatively stored in the RNC), and the N(SD) (for MSC only). IMSI is included in Reroute Command
message only if it was not included in the Initial UE received by the MSC/SGSN.

The signalling connection between the RNC and the MSC/SGSN B is released. The RNC then selects a new
MSC/SGSN as in step 5.

10) The MSC/SGSN C receives an Initial UE (with the original NAS attach request message) with the redirect
attempt flag is set, an IMSI, and N(SD) (if MSC). The MSC/SGSN C starts the attach procedure and uses
provided information (IMSI and N(SD)).

11) MSC/SGSN C does in general support roaming for the HPLMN of the IMSI and hence authentication is done
and RAN ciphering is established.

12) MSC/SGSN C updates the HLR and receives subscriber data from HLR. Subscriber data allows roaming, and
the MSC/SGSN C completes the attach procedure. This includes the assignment of a new TMSI/P-TMSI with an
NRI that can be used by RNC to route subsequent signalling between UE and correct MSC/SGSN (Iu-flex
functionality). The Update Location sent to HLR also triggers a Cancel Location sent to the MSC/SGSN B.

13) A Reroute Complete message with the NAS Attach accept message is sent to RNC. By usage of a specific
Reroute Complete message, the RNC knows that the redirect is finished and can both forward the NAS message
to the UE and clean up any stored redirect data (it is a later RAN3 decision if an extension to the Direct Transfer
message shall be used instead of a new message).

14) The Attach Accept is forwarded to the UE. The UE stores the TMSI/P-TMSI with the Iu-flex NRI to be used for
future signalling, even after power off. This is existing functionality.

15) UE responds with an Attach Complete message.

If the RNC finds no more MSC/SGSN to redirect to after receiving a Reroute Command message, e.g. step 5 or step 9,
it compares the cause code with cause codes from other Reroute Command messages it has earlier received for this UE.
A cause code ranking is done and the "softest" cause code is chosen and the corresponding saved NAS attach reject
message is returned to the UE.

Each CN node that receives an Initial UE, shall run its own authentication procedure. This may in some rare situations
cause the UE to be authenticated more than once, however the trust-model used is that one CN operator shall not trust
an authentication done by another CN operator. This will of course not be an optimal usage of radio resources, but
given the rare occurrence of this, the increased signalling should not be of any significance.

During the redirect procedure the RNC keeps a timer, which corresponds to the UE timer of releasing the RR
connection (20 seconds). If the RNC when receiving a Reroute Command message finds that there is not sufficient time
for another redirect, further redirect attempts are stopped (for this attach request message). The UE will repeat its attach
request four times (each time waiting 15 seconds before it re-establishes the RR connection for another try).

7.1.4.2 GERAN based MOCN configuration

An example of an information flow for redirection in GERAN is shown below. For GERAN, all UEs are non-
supporting UEs.

In this example an attach request from a non-supporting UE is directed to two different CN operators. The first CN
operator rejects since it has no roaming agreement with the subscribers Home PLMN. The second CN operator accepts
and completes the attach request. The different "MSC/SGSNs" in the example below shall be seen as different CN

3GPP
Release 10 18 3GPP TS 23.251 V10.1.0 (2011-03)

operators. One specific CN operator may also have several pooled MSCs/SGSNs connected to the BSC if A/Gb-Flex is
used.

Separate call flows are shown for CS domain and for PS domain.

MSC A MSC B HLR B

UE BTS BSC

1. RRC Connection Establishment

2. SABM

2. Establish Ind 3. Complete Layer 3 Information (Attach request, redirect attempt flag)

4. Identity Req
4. Identity Resp (IMSI)
Roaming not allowed for HPLMN of IMSI /
Roaming allowed but CS/PS coordination required

5. Reroute Command (Attach request, Attach reject, IMSI)

6. Complete Layer 3 Information (Attach request, redirect attempt flag, IMSI …)

7. Authentication & Ciphering

8. Update Location / Insert Subscr. Data

9. ( Attach accept )

10. Attach Complete

11. Reroute Complete

Figure 6: Information flow for redirection in GERAN (CS domain)

1) The RRC connection is established.

2) BSC receives the Layer 3 message from an UE. The BSC is configured to work in a Shared RAN MOCN, and
therefore it forwards the message in a Complete Layer 3 Information message with an additional redirect attempt
flag set. The flag indicates that the MSC shall respond to the attach request with a Reroute Command message to
inform the BSC that a redirection to another CN has to be performed.

The selection of CN node is based on NRI (valid or invalid) or by random selection. The same mechanism as
defined for A-Flex in TS 23.236 [8] is used.

3) The MSC receives the Complete Layer 3 Information message with the redirect attempt flag set. It then knows it
may have to provide the BSC with a Reroute Command message.

4) The MSC needs the IMSI of the UE. It is retrieved either from old MSC or from the UE as in this example. By
comparing the IMSI with the roaming agreements of the CN operator, the MSC A discovers that roaming is not
allowed or that roaming is allowed but CS/PS coordination required. Attach procedure is aborted.

5) A Reroute Command message is sent back to the BSC with the attach reject message and the original attach
request message received from the UE. The IMSI is also included in the message, plus a reject cause code to the
BSC.

3GPP
Release 10 19 3GPP TS 23.251 V10.1.0 (2011-03)

The signalling connection between BSC and MSC A is released. The BSC selects a MSC B in the next step. The
already tried MSC A is stored in the BSC during the redirect procedure so that the same node is not selected
twice.

6) The BSC sends a new Complete Layer 3 Information to the next selected MSC B with the original attach request
message (in case of CS/PS coordination the Complete Layer 3 Information may also be sent back to the first
MSC depending on the outcome of the coordination). Redirect attempt flag is set and IMSI shall also be included
to avoid a second IMSI retrieval from UE or old MSC and to indicate that PS/CS domain coordination has been
done in BSC (if enabled in BSC). The MSC B receiving the message starts its attach procedure.

7) MSC B does in general support roaming for the HPLMN of the IMSI and hence authentication is done and RAN
ciphering is established.

8) MSC B updates the HLR and receives subscriber data from HLR. Subscriber data allows roaming, and the MSC
B completes the attach procedure. This includes the assignment of a new TMSI with an NRI that can be used by
BSC to route subsequent signalling between UE and correct MSC (A-Flex functionality).

9) The Attach Accept is forwarded to the UE. The UE stores the TMSI with the A-Flex NRI to be used for future
signalling, even after power off. This is existing functionality.

10) UE responds with an Attach Complete message (TMSI (re-)allocation if not already made in Attach accept).

11) A Reroute Complete message is sent to BSC. The BSC knows that the redirect is completed and clean up any
stored redirect data.

If the BSC finds no more MSC to redirect to after receiving a Reroute Command message, it compares the cause code
with cause codes from other Reroute Command messages it has earlier received for this UE. A cause code ranking is
done and the "softest" cause code is chosen and the corresponding saved attach reject message is returned to the UE.

Each CN node that receives a Complete Layer 3 Information shall run its own authentication procedure. This may in
some rare situations cause the UE to be authenticated more than once, however the trust-model used is that one CN
operator shall not trust an authentication done by another CN operator. This will of course not be an optimal usage of
radio resources, but given the rare occurrence of this, the increased signalling should not be of any significance.

During the redirect procedure the BSC keeps a timer, which corresponds to the UE timer of releasing the RR connection
(20 seconds). If the BSC when receiving a Reroute Command message finds that there is not sufficient time for another
redirect, further redirect attempts are stopped (for this attach request message). The UE will repeat its attach request
four times (each time waiting 15 seconds before it re-establishes the RR connection for another try).

3GPP
Release 10 20 3GPP TS 23.251 V10.1.0 (2011-03)

SGSN A SGSN B HLR B

UE BTS BSC

1. TBF Establishment
2a. LLC (foreign TLLI=X, Attach Request)

2b the NRI of TLLI=X points to SGSN A

3. BSSGP UL-UNIDATA (TLLI=X, Attach request, redirect attempt flag)
4. Identity Req
4. Identity Resp (IMSI)
Roaming not allowed for HPLMN of IMSI /
Roaming allowed but CS/PS coordination required
5a. BSSGP DL-UNIDATA (Attach request, Attach reject, redirection indication, IMSI)

5b BSC links TLLI=X to SGSN B

6. BSSGP UL-UNIDATA (Attach request, redirect attempt flag, IMSI …)
7a. Send Authentication Info

7b. Send Authentication Info Ack

7c. Authentication & Ciphering Request

7d. Authentication & Ciphering Response: Uplink LLC frame NOT routed on NRI of TLLI=X

8. Update Location / Insert Subscr. Data

10. ( Attach accept ) 9. BSSGP DL-UNIDATA ( Attach accept, redirection completed…)

11. Attach Complete: new TLLI

Figure 7: Information flow for redirection in GERAN (PS domain)

1) The TBF is established.

2, 2a) BSC receives the LLC frame with foreign [or random] TLLI =X.

The BSC is configured to work in a Shared RAN MOCN, and therefore it forwards the message in a BSSGP UL-
UNITDATA message with an additional redirect attempt flag set. The flag indicates that the SGSN shall respond
to the attach request with a BSSGP DL-UNITDATA message providing when relevant a redirection indication
flag set to inform the BSC that a redirection to another CN has to be performed.

The selection of CN node is based on NRI (valid or invalid) or by random selection. The same mechanism as
defined for Gb-Flex in TS 23.236 [8] is used.

3) The SGSN receives the BSSGP UL-UNITDATA message with the redirect attempt flag set. It then knows it may
have to provide the BSC with a redirection indication flag set or a redirection completed flag set.

4) The SGSN needs the IMSI of the UE. It is retrieved either from old SGSN or from the UE as in this example. By
comparing the IMSI with the roaming agreements of the CN operator, the SGSN A discovers that roaming is not
allowed or that roaming is allowed but CS/PS coordination required. Attach procedure is aborted.

5a) A BSSGP DL-UNITDATA message is sent back to the BSC with a redirection indication flag set containing the
reject cause, the attach reject message and the original attach request message received from the UE. The V(U)
used for LLC-PDU setting (refer to TS 44.064 [19]) is included in the message. The IMSI is also included in the
message.

The BSC selects a SGSN B in the next step. The already tried SGSN A is stored in the BSC during the redirect
procedure so that the same node is not selected twice.

5b) The BSC makes a short-lived binding between the TLLI =X and SGSN ID so that it points to SGSN B.

3GPP
Release 10 21 3GPP TS 23.251 V10.1.0 (2011-03)

6) The BSC sends a new BSSGP UL-UNITDATA to the next selected SGSN B with the original attach request
message (in case of CS/PS coordination the BSSGP UL-UNITDATA may also be sent back to the first SGSN
depending on the outcome of the coordination). Redirect attempt flag is set and IMSI shall be included to avoid a
second IMSI retrieval from UE or old SGSN and to indicate that PS/CS domain coordination has been done in
BSC (if enabled in BSC). The V(U) shall also be included in the message. The SGSN B receiving the message
starts its attach procedure.

7) SGSN B does in general support roaming for the HPLMN of the IMSI and hence authentication is done and
RAN ciphering is established. The value of V(U) in SGSN-B shall be set according to the received value from
BSC.

Uplink LLC frames shall be routed to SGSN B despite the NRI of the TLLI=X pointing to SGSN A.

8) SGSN B updates the HLR and receives subscriber data from HLR. Subscriber data allows roaming, and the
SGSN B completes the attach procedure. This includes the assignment of a new P-TMSI with an NRI that can be
used by BSC to route subsequent signalling between UE and correct SGSN (Gb-Flex functionality).

9) A BSSGP DL-UNITDATA Attach accept message is sent to BSC with the redirection completed flag set . The
BSC knows that the redirect is finished and can both forward the Attach Accept message to the UE and clean up
any stored redirect data.

SGSN B is allowed to reset the XID parameter only after the attach request is accepted.

10) The Attach Accept is forwarded to the UE. The UE stores the P-TMSI with the Gb-Flex NRI to be used for
future signalling, even after power off. This is existing functionality.

11) UE responds with an Attach Complete message (P-TMSI (re-)allocation if not already made in Attach Accept).
The Attach Complete uses new TLLI. After this, the BSS releases the binding between TLLI=X and SGSN B.

If the BSC finds no more SGSN to redirect to after receiving a BSSGP DL-UNITDATA message with the redirection
indication flag set, it compares the cause code with cause codes from other BSSGP DL-UNITDATA messages it has
earlier received for this UE. A cause code ranking is done and the "softest" cause code is chosen and the corresponding
saved attach reject message is returned to the UE.

Each CN node that receives a BSSGP UL-UNITDATA, shall run its own authentication procedure. This may in some
rare situations cause the UE to be authenticated more than once, however the trust-model used is that one CN operator
shall not trust an authentication done by another CN operator. This will of course not be an optimal usage of radio
resources, but given the rare occurrence of this, the increased signalling should not be of any significance.

During the redirect procedure the BSC keeps a timer, which corresponds to the UE timer of releasing the RR connection
(20 seconds). If the BSC when receiving a BSSGP DL-UNITDATA message with the redirection indication flag set
finds that there is not sufficient time for another redirect, further redirect attempts are stopped (for this attach request
message). The UE will repeat its attach request four times (each time waiting 15 seconds before it re-establishes the RR
connection for another try).

7.1.5 Supporting UEs in a MOCN configuration

7.1.5.1 UTRAN based MOCN configuration

Supporting UEs can make use of the additional information in the broadcast system information. The UTRAN
signalling flow is shown in the figure below.

3GPP
Release 10 22 3GPP TS 23.251 V10.1.0 (2011-03)

SGSN SGSN
RNC Supporting UE
Operator A Operator B

1. System information

2. UE decodes network sharing

information in system broadcast
information.

3. Network selection

4. ATTACH REQUEST RNC uses information in header to

route the ATTACH REQUEST to the
chosen core network operator

5. CN node determines
whether the UE is allowed
to attach.

6. ATTACH ACCEPT/REJECT

Figure 8: Network selection by a supporting UE in a UTRAN MOCN

1. The UE reads the broadcast system information in the shared RAN.

2. A supporting UE decodes the shared network information and supplies the available core network operator
PLMN-ids as candidates to the PLMN selection procedure. Only PLMNs in the Multiple PLMN ID List are
candidates for network selection.

3. The UE performs network selection among available PLMNs.

4. The UE sends an ATTACH REQUEST message to the network. It also indicates to the RNC the chosen core
network operator. The RNC uses the routing information to determine which core network operator the message
should be routed to and the ATTACH REQUEST message is sent to the core network operator chosen by the UE.

5. The core network determines whether the UE is allowed to attach to the network.

6. The shared core network node sends the appropriate ACCEPT/REJECT message back to the UE. In case of an
ATTACH ACCEPT message, the core network assigns the UE an appropriate TMSI/P-TMSI so that this identity
can be used for any further rerouting of messages by the RNC.

7.1.5.2 GERAN based MOCN configuration

Not applicable (no supporting UEs for GERAN).

3GPP
Release 10 23 3GPP TS 23.251 V10.1.0 (2011-03)

Annex A (informative):
Network Resource Indicator (NRI) allocation examples
This annex contains examples for NRI co-ordination in shared networks.

A.1 NRI in shared UTRAN/GERAN networks

The Network Resource Identifier (NRI) is specified in Rel-5 for Intra Domain Connection of RAN Nodes to Multiple
CN nodes (see TS 23.236 [8]). NRI is part of the temporary identity TMSI (CS domain) or P-TMSI (PS domain), which
is assigned by the serving CN node to the MS.

Within the shared network NRIs has to be coordinated between the operators at least due to following reasons:

- to avoid redirection when the non-supporting UE performs LA/RA update.

- to guarantee that correct UE answers to paging (TMSI/P-TMSI shall be unique within shared network).

- to guarantee that a non-supporting UE in visited PLMN will not change network due LA/RA update or
Detach/Attach function.

NRI coordination is also required between the shared network and the dedicated networks of the sharing partners:

- to guarantee that non-supporting UE in visited PLMN remain registered in the same operators network when the
UE moves from dedicated network to a shared network.

- to avoid redirection when the non-supporting UE in home PLMN performs LA/RA update from dedicated
network to a shared network.

In figure A.1 below operators A, B and C have both shared and dedicated networks, operator D has only dedicated
network and operator E only shared network.

D C

A + B + C+ E

B
A

Figure A.1: Shared and Dedicated network example

In the above, one or more of the operators in the shared network may deploy Iu-Flex or A/Gb-Flex between that shared
radio access network and their core networks. Additionally, operators may deploy Iu-Flex or A/Gb-Flex within their
dedicated core networks. For non-supporting UEs, NRI coordination is needed not only within the shared network, but
also between the shared network and the dedicated networks.

3GPP
 Release 10 24 3GPP TS 23.251 V10.1.0 (2011-03)

A.2 Alternatives for NRI split in UTRAN and GERAN

Sharing operators need to coordinate the used NRI, following alternatives are considered:

1) even split of NRI space, 1…3 most significant bits of NRI is used to identify the CN operator.

2) individual NRI values used to identify the CN operator.

Alternative 1; even split of NRI space

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
CS/PS 'VLR- CN Non shared NRI for
restart' operator CN operator internal
ID use.

A calculation for the possible number of subscribers in this scenario is:

- With max 4 sharing CN operators, two most significant bits of NRI is required to identify the CN operator.

- 3 bits are used for the restart counter.

- 5 bits of NRI allows 32 independent NRI values for each CN operator.

- This leaves 20 bits for every MSC that is 1 M non-purged TMSI.

The following aspects need to be considered for this solution:

- If more bits are needed for the restart counter or CN operator ID, each additional bit reduces the available TMSI
space half.

- The basic configuration allows 32 M TMSI values for each CN operator, a lot of TMSI values are wasted if
some sharing partners have substantially less subscribers than others.

- It may not be feasible in large networks that use Iu-Flex or A/Gb-Flex for load balancing (see Annex A, network
configuration examples in TS 23.236 [8]).

- The number of NRI bits used for CN operator ID may need to be fixed in the initial planning. Otherwise
configuration of all existing nodes must be changed when new partners join the shared network.

Alternative 2; individual NRI values used to identify the CN operator

This could be considered in the case where a network is shared between one big and many small CN operators.

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
CS/PS 'VLR-restart' Shared NRI space

- The biggest CN operator who needs more pool areas and TMSI space takes NRI values 32…63, [1xxxxx], this
means 32M TMSI values when 4 bit is used for restart counter.

- Rest of shared NRI space is allocated to other CN operators in blocks of 4M TMSI values like NRI = 28 - 31
[0111xx], 24 - 27 [0110xx] …. 0 – 3 [000xx]. Initially gaps can be left between allocated NRI range that can be
used for expansion.

Following aspects need to be considered for this solution:

- If more bits are needed for the restart counter or NRI, each additional bit reduces the available TMSI space half.

- The initial planning of NRI length should take into account the pool area configurations of all sharing operators.

TMSI per LA:

Taking the example configurations mentioned above but changing the TMSI allocation per LA would result in an
increase of the addressing space, then the same TMSI value can be used multiple times in the same VLR. More
considerations with this TMSI per LA approach can be found in TS 23.236 [8].

3GPP
Release 10 25 3GPP TS 23.251 V10.1.0 (2011-03)

Annex B (informative):
Change History
Change history
Date TSG # TSG Doc. CR Rev Cat Subject/Comment Old New
2010-12 SP-50 SP-100693 0023 2 B Introduction of MOCN GERAN 9.1.0 10.0.0
2011-01 - - - - - Update of LTE logo to LTE-Advanced logo 10.0.0 10.0.1
2011-03 SP-51 SP-110076 0027 1 F NITZ in connection with network sharing 10.0.1 10.1.0
2011-03 SP-51 SP-110076 0028 2 F LLC sequence number handling in the redirection procedure 10.0.1 10.1.0
2011-03 SP-51 SP-110061 0029 1 A RAN sharing for the H(e)NB (CSG cell in the closed access 10.0.1 10.1.0
mode and in the hybrid access mode)
2011-03 SP-51 SP-110076 0030 4 F Cell Broadcast and Warning System Services for network 10.0.1 10.1.0
sharing configuration

3GPP