CS CORE- CALL FLOWS

PREPARED BY
SAIF UL ISLAM SAJID
 MS Authentication

Whenever an MS attaches to the network or its inter-MSS location update is required,

authentication is performed

a) MS attaches to the network or LU is performed

d) MSS sends RAND to MS.

e) MS sends SRES which it generates by using A3

algorithm on RAND & Ki. The two SRES are then
compared in MSS and if they are equal, the user is
authenticated.
b) MSS requests the HLR for
MSS also sends TMSI and LAI to MS and updates authentication triplets (RAND,
its location in VLR. Kc & SRES) which are
held/calculated with AuC
f) Ciphering is enabled between the MS & BSS
using 3-way handshake. Kc is generated using A8
algorithm on RAND & Ki c) HLR
forwards these
triplets to MSS
 Voice Call Setup
(step by step)

2. Cellular Management (CM) request is received by the

1. Radio Resource (RR) BSS, which then forms ‘BSSMAP complete layer3
and Mobility Management information’ msg. The BSS then piggybacks it on the
(MM) parameters are SCCP connection request msg and sends to MSS
negotiated between the MS
& BSS
3. MSS checks
4. MSS initiates ciphering
whether MS is
0. A-party dials and sends a ‘BSSMAP
authentic. Since
the number ciphering mode
authentication has
command’ to the BSS,
already been
which then ciphers (using
performed, the
A5 algorithm) the data
MSS does not re-
being sent on TCH to
authenticate.
prevent eavesdropping

5. BSS sends ‘BSSMAP ciphering mode

complete’ msg to the MSS. After this
point, the BSS becomes transparent for
communication between MSS & MS (thus
BSS will not be shown in following slides
unless necessary)
 Voice Call Setup
(step by step-contd.)

6. MS sends ‘Call
Control (CC) call setup’ 8. MSS reserves a
msg which contains the circuit on CGR and
digits of dest # informs the BSS, which
MSS- then informs the MS to
A switch to voice mode.
7. MSS replies with ‘CC
call proceeding’ msg
which tells the MS that
it is establishing link
with the B-party 14. HLR responds
MSS-
with SRI-Ack 12. HLR sends B
Provide Roaming
Number (PRN) to
10. IN responds
MSS of party-B
9. MSS sends Initial with Request
Detection Point (IDP) Return BCSM
msg to IN Event (RRBE)
and Apply
Charging (AC)
11. MSS sends 13. MSS of party-B
msg
Send Routing responds with Mobile
Info (SRI) msg to Subscriber Roaming
HLR Number (MSRN).
 Voice Call Setup
(step by step-contd.)

15. MSS of party-A sends Initial Address Msg

(IAM) to MSS-B

MSS-
16. MSS-B responds with Address Complete Msg
A MSS-B
(ACM) and establishes communication with
party-B
17. MSS-B then sends Answer Msg (ANM) when
party-B answers the call and communication is
established between the two parties.
 Voice Call Termination

18. Assuming that Subs-A drops 20. Voice circuits with

the call, ‘CC disconnect’ msg is 19. ‘ISUP release’ msg is
BSS are released sent to MSS-B
sent to MSS
21. MSS-A releases the
23. MSS responds with ‘CC circuits and sends
release’ msg MSS-A ‘ISUP released’ msg to MSS-B
MSS-B
24. MS sends ‘CC release
complete’ msg to MSS to indicate 22. MSS-B responds
that the call has been released. with ‘ISUP release
complete’ msg

27. BSS sends ‘BSSMAP

26. RR release is 25. MSS sends
clear complete’ msg to MSS
negotiated and the ‘BSSMAP clear
to indicate that all occupied
reserved radio command’ to BSS
resources are now free
resources are freed
 SMS Call Flow

iii) MSS sends ‘MO-

SMS’ msg to SMC (aka
SMSC)
i) MS sends the SMS to
MSS-A iv) SMC sends ‘MO- vi) SMC sends ‘MT
MSS
SMS ack’ msg to MSS forward short msg
(which contains the
original SMS)’ to MSS-B
vii) MSS-B
ii) MSS consults with sends ‘MT
IN if the user has forward short
sufficient balance and if msg ack’ to
so, it responds to MSS SMC

v) SMC MSS-
performs SRI B
for SMS with
HLR
 Location Update
LU can be done in 3 cases:
•IMSI attach (already covered in slide 2)
•Periodic LU
•Inter LAC LU
•Intra-MSS LU
•Inter-MSS LU

Periodic LU:
•It is done to keep a check on the presence of MS in the network.
•There is an IMSI detach timer in the VLR, which if times out, will detach the subscriber, delete
its entry and inform the HLR.
•Thus, to keep the user attached a timer, T3212, is implemented in the BSS.
•This timer is network dependent and for TP it is 6 hours.
•BSS keeps the MS informed about this timer through its BCCH channel and MS keeps track of
time expiry through its own counter.
•When the time expires, the MS performs an LU.
 Location update
Inter-LAC, Intra-MSS

iv) BSS sends ‘BSSMAP

complete layer 3 msg’ to
the MSS which contains
new ‘location update request’

vi) ‘BSSMAP
ii) Radio Resources clear command’ is
assignment is negotiated sent to the BSS
between MS & BSS
iii) MM ‘location
update request’ is vii) ‘BSSMAP
sent by MS to BSS. clear complete’ is
i) MS continuously monitors new
This msg contains sent to the MSS
the BCCH channel and
upon changing cells during LAI & TMSI.
movement when it notices
that broadcasted LAC has
viii) Ciphering is
changed, it will initiate LU v) MSS notes that the LAC is
enabled and MM & RR
are released by the BSS covered by itself and updates the
with a 3-way VLR with new LAC
handshake
 Location update
Inter-MSS

i) MS continuously
monitors the BCCH ii) Radio Resources
channel and upon assignment is negotiated
changing cells during between MS & new BSS
movement when it iv) BSS sends ‘BSSMAP
notices that broadcasted complete layer 3 msg’ to
LAC has changed, it will the MSS which contains
initiate LU iii) MM ‘location update
‘location update request’
request’ is sent by MS to
new BSS. This msg new
contains LAI & TMSI. viii) MSS sends
‘MAP/D update
location’ msg to ix) HLR sends
viii) MM & RR are the HLR ‘MAP/D insert
released by the BSS subs data’ which
with a 3-way contains
handshake authentication
triplets

vi) New MSS contacts the old one using ‘MAP/G send
parameters’ msg which contains TMSI and requests the new
old IMSI of the subs

vii) Old MSS sends ‘MAP/G send parameters result’ msg to

the new MSS
v) MSS notes that old LAC was
covered by another MSS, so it
contacts that MSS using TMSI of
the subs and HLR for its Database
 Location update
Inter-MSS (contd.)

xi) HLR sends ‘MAP/D cancel

location’ msg to the old MSS

old xii) MSS sends ‘MAP/D cancel

location result’ msg to HLR and
releases TMSI & deletes subs
entry from its VLR

x) MSS replies xiii) HLR sends

with ‘MAP/D ‘MAP/D update
insert subs data location result’
result’ msg after updating its
record

xiv) MS is authenticated by MSS.

xv) Ciphering mode is enabled on radio channels for
secure communication.
xvi) MSS sends ‘MM location updating accept’ msg to
MS which contains new TMSI. new

xvii) MS sends ‘MM TMSI reallocation complete’ msg

to MSS
xviii) RR are cleared between MS & BSS upon request
of MSS.
 Inter-MSS HO During Call
8) MSS allocates a HO
number through which inter-
6) BSS allocates a TCH. MSS call will be initiated.
5) ‘BSSMAP HO request’ msg is sent to the new
BSS. It contains target cells and origin cell
new new
7) ‘BSSMAP HO request ack’ msg is sent to the
MSS. It contains ‘RR HO command msg’ which
contains all the parameters which the MS will need
to switch to the best cell.

9) New MSS sends ‘MAP 4) Anchor MSS sends

prepare HO response’ ‘MAP prepare HO’
msg. It contains ‘RR HO msg to the new MSS. It
command’ and ‘HO also contains target and
number’ msg origin cells

ancho 3) ‘BSSMAP HO required’ msg is sent to MSS. It

1) MS sends periodic RR r contains target cells and origin cell ancho
measurement report of its r
current and neighboring
cells to the BSS
2) BSS analyses the measurements
received and when the signal
quality of its serving cell falls below
threshold, HO is requested. A list of
target cells is provided to the MSS.
 Inter-MSS HO During Call
(contd)

15) BSS sends ‘BSSMAP HO detected’ to the MSS

and then MSS switches to the voice path.
new new

14) ‘RR HO accept’ is

sent to the BSS through
access burst and it
contains HO reference

10) IAM msg sent 11) ACM msg sent

to the new MSS to the anchor MSS
using HO number and call is setup.

13) ‘RR HO command’

is sent to MS which 12) ‘BSSMAP HO command’ msg is sent to BSS. It
contains HO reference ancho ‘RR HO command’.
and TCH r
ancho
r
 Inter-MSS HO During Call
(contd)

19) ‘BSSMAP HO complete’ msg is sent to MSS. It

‘RR HO command’.
new new
17) BSS sends ‘RR physical
info’ to the MS. This msg
contains time & freq
correction
18) Signaling connection is 16) ‘MAP access signaling
completed between the MS & request’ is sent to the old MSS to
BSS. Then, MS sends ‘RR HO inform that HO has been detected
complete’ msg to the BSS.

20) ‘MAP send end signal’ is sent

to the old MSS. It contains ‘HO
complete’

21) ‘ISUP Ans’ msg is sent to the

old MSS to establish voice call.

22) ‘BSSMAP clear command’ msg is sent to the

ancho old BSS to release the RR connection
r ancho
23) ‘BSSMAP clear complete’ msg is sent to the r
MSS to indicate that RR connection have been
released.
Inter-MSS HO During Call
(Call Cleared)

new

25) ‘ISUP RLC’ msg is sent

by the new MSS.
24) SUBS HAVE HUNG UP:
‘ISUP Release’ msg is sent by
the anchor MSS.

26) ‘MAP send end signal

response’ is sent to indicate that
HO call has ended.

ancho
r
Thank you