Core Networks and Interconnects
Release 4 Network Elements
The MSC Server (known variously as an MSC-S or MSS in vendor/operator architectures) inherited the signalling and call control functions from the legacy MSC. It handles subscriber management and call management and is responsible for the VLR functions.
The MGW (or MGw depending on the vendor) is an example of a device known as a ‘softswitch’, so called because it manages the switching and connection of call flows in a more flexible, software-based manner than was employed in legacy switches.
A legacy PCM-based MSC consisted of bespoke hardware elements (known as ‘time-space-time’ switches) that handled the cross-connection of call traffic between timeslots belonging to inbound and outbound 2 Mbit/s links. A softswitch, as the name suggests, performs a similar interconnection function but manages it in software running on generic processor cards. This means that the hardware employed is less expensive than bespoke switching equipment and also that the service functionality of the switch can be altered with a simple software upgrade rather than a hardware change.
The main benefits of a move to R4 softswitching are economy of scale and increased flexibility. One MSC server is able to manage multiple MGWs and connects to them via the Mc interface, which can be physical (e.g. the MSC Server is directly connected to the MGW via cable) or logical, meaning that the interface takes the form of a connection across an ATM or IP network. Control messages are sent using the H.248 MGCP (Media Gateway Control Protocol, which was originally known as MeGaCo and is also known in some implementations as GCP).
A typical MGW is able to handle much greater traffic throughput levels than a legacy MSC could and occupies far less space at an operator’s switch site. The MGW is also able to perform the transcoding functions of the TRAU, meaning that less equipment is required in the access network.
Core Networks and Interconnects
GSM Databases
Within the GSM network there are four main databases: HLR, VLR, AuC and Equipment Identity Register EIR.
The HLR is the main network database. There is (logically) only one of these in any network. The information stored relates to all of the subscribers registered with that network. The presence of the information is independent of the location of the subscribers.
The type of information stored includes the MSISDN(s), IMSI, current location (MSC address), subscription levels (relating to roaming authority and supplementary services) and security parameters. The VLR holds similar information to the HLR. However, the VLR is diverse; there is one associated with each MSC. The information contained in the VLR is temporary and relates to all subscribers in the MSC area only. When a subscriber moves out of an MSC area the database entry will be deleted. The VLR will also contain details of subscribers roaming in its network.
Additionally, the VLR will contain the security parameters, MSRN and TMSI.
The VLR plays an important part in the signalling to the mobile during the early stages of the set-up including authentication, enabling ciphering and initial service requests.
3.6
GSM and UMTS Core Network
GSM Databases (continued)
The AuC stores Ki and IMSIs on its database. The AuC also contains a random number generator and two algorithms. Together they are responsible for generating the security parameters known as a triplet. These triplets are stored in the HLR and VLR for each subscriber.
The EIR records and monitors the IMEI. The rationale behind the EIR is to discourage the theft of GSM equipment. The EIR comprises three lists: Black, White, and Grey.
An ME that is on the Black List may have been stolen, or it may be faulty to the extent that it is causing problems within the network. Any equipment on the Black List will not therefore be given access to the network.
MEs on the Grey List may have some minor fault (such as not giving correct responses during signal sequences) or may be old equipment that will not respond to new services offered by the network. The Grey List could be used to generate a letter to the equipment user explaining the problems.
The White List contains all mobiles that are functioning correctly and cause no problem to network operation.
For this anti-theft concept to work on a global basis, a Global EIR would be required.
Core Networks and Interconnects
OMC (Operations and Maintenance Centre)
An essential element of any telecommunication network is the ability to manage the machines that constitute the network. In GSM, network management comprises a two-tier hierarchy consisting of OMCs (Operations and Maintenance Centres), which are regional centres, and a single NMC (Network Management Centre).
The OMC is a computer with an associated database, which connects to the BSS it is managing. It provides network controllers with a graphical interface through which the network can be managed. As OMC devices tend to be highly proprietary, the network contains elements for radio management (OMC- R) and switch management (OMC-S).
The functions performed by the OMC can be divided into the following categories.
Fault management can be considered as the complete process of detecting a fault and tracing all activities through to clearing the fault. A fault reported by a customer may trigger an alarm.
Event Management collates events occurring within the network. An ‘event’ may be a switch between a primary unit and a standby unit. Event management logs all such events.
Configuration Management allows the hardware and software network configuration to be changed. Network elements may be configured via either remote access from the NMC or the Man–Machine Interfaces (MMI) associated with the relevant network element.
Performance Management collates statistics relating to network performance so that resources can be allocated to appropriate locations, for example to alleviate congestion at particular points. Performance management may also be used to detect ‘sleeping elements’. For example, a BTS may have stopped processing calls but may not have reported an alarm to say why. The performance management application is able to detect this since the call rate will have dropped to zero, i.e. far below expected performance parameters.
Security management controls data to and from the OMC and checks data validity. Operator access to the OMC, the network elements it supports and also OMC functional areas may be controlled. For example, operators may be granted ‘Read Only’ access, or they may granted ‘Read/Write’ access.
3.8
GSM and UMTS Core Network
NMC (Network Management Centre)
OMCs provide a regional view of the network elements and their performance. The NMC allows the entire network to be managed from a central point. While the NMC may not necessarily be concerned with an individual alarm from a radio, for example, it will have a top-level view that will allow for long-term planning.
The NMC will be connected to OMCs and other network elements.
Core Networks and Interconnects
SMS Architecture
All SMS messages, whether MO (Mobile-Originated) or MT (Mobile-Terminated), must pass through a SMSC (Short Message Service Centre). Short Message Service Centre This has the effect of splitting the delivery of the message into two point-to-point procedures.
GSM does not specify the functionality of the SMSC or the transport protocols that connect it to the GSM network. It simply identifies the information elements that must be passed between the mobile station and the SMSC.
An SMS gateway function is used to connect the SMSC to the network. For MT messages, this gateway is similar in function to a GMSC; for MO messages, the gateway provides the interworking between GSM and the SMSC, which is still essentially a gateway process.
It is important to note that only one SMSC is involved in receiving and forwarding short messages to the final recipient. This SMSC will reside in the sender’s network. This is in contrast to MMS (Multimedia Messaging Service), in which more than one service centre is involved, one residing in the sender’s network and another in the receiver’s network.
3.10
GSM and UMTS Core Network
CBC (Cell Broadcast Centre)
CBS messages are collected from cell broadcast entities (network operator or outside organization) and passed to a central CBC (Cell Broadcast Centre). The CBC tables the messages and then passes them on for transmission from the appropriate BTS (Base Transceiver Station); alternatively the messages may be loaded manually at the BSS. Messages will then be transmitted cyclically by the BTS for a duration specified by the information provider.
A CBS message can be up to 93 characters long. However, it is possible to join up to 15 of these messages together to form a macro-message. Each page of such a message will have the same message identifier and serial number, enabling the mobile to associate them. The repetition and information updating rate will depend on information type. For example, traffic news may change more quickly than weather news.
Core Networks and Interconnects
CAMEL Architecture
CAMEL (Customized Applications for Mobile Network Enhance Logic) provides the mechanisms to support services, independent of the serving network.
CAMEL facilitates service control of operator-specific services external from the serving PLMN. It is a tool to help the network operator to provide subscribers with such services even when they are roaming outside the HPLMN (Home PLMN).
Because IN architecture is used in the fixed as well as the mobile network, the ‘gsm’ prefix is used to differentiate between IN fixed and IN mobile network elements.
The GSM Service Control Function (gsmSCF) is a functional entity that contains the CAMEL service logic to implement operator-specific services. In other words, that is where the service is executed from. It interfaces with the gsmSSF (GSM Service Switching Function), the gsmSRF (GSM Specialized Resource Function) and the HLR.
The gsmSSF is a functional entity that interfaces the MSC/GMSC to the gsmSCF. Triggers within the MSC and gsmSSF can be set based on information defined in the user’s subscription sent from the HLR to the VLR. These triggers dictate when the gsmSSF will communicate with the gsmSCF.
The gprsSSF (GPRS Service Switching Function) is a functional entity that interfaces with the gsmSCF to allow interaction between CAMEL and GPRS. The gprsSSF resides at the SGSN.
The gsmSRF is a functional entity that provides various specialized resources like voice interaction, the playing of announcements, and decoding DTMF (Dual Tone Multi Frequency) digits. It interfaces with the gsmSCF and with the MSC.
The concept of the gsmSSF and gprsSSF is derived from the IN (Intelligent Network) SSF (Service Switching Function), but uses different triggering mechanisms because of the nature of the mobile network.
3.12
GSM and UMTS Core Network
International Roaming Enablers
One of the driving forces behind the development of the original GSM specifications was the perceived need to provide pan-European roaming services to mobile users. In all but a few cases, first-generation cellular networks did not allow subscribers of one network to use their phones whilst they were abroad, which was seen as a limiting factor for the development of the EU.
International roaming in GSM is a fundamental service and is anchored on the functionality of and interaction between the VLRs and HLRs.
When a subscriber’s MS attaches to the user’s home network it communicates with the local VLR, which in turn contacts the network’s central HLR to gather subscriber details. When that same subscriber attempts to use their mobile phone whilst travelling abroad, the MS and the network follow exactly the same process; the ‘visited’ VLR contacts the user’s ‘home’ HLR to obtain subscription details before allowing the MS to access local services.
The ability to support international roaming is a consequence of three factors: firstly, that all MSCs, VLRs, HLRs and many other GSM core network elements share a common SS7-based addressing scheme which allows any VLR to contact any HLR. In addition to commonly-formatted SS7 SPCs (Signalling Point Codes), GSM core network elements generally also have a set if unique addresses or ‘names’, which are tied to their SPC. For example, every HLR has a unique address allocated to it from the E.164 address range consisting of a CC and NDC and a node address allocated from the operators numbering block for that network. An identifier of this kind can be resolved into a specific SPC using the SCCP (Signalling Connection Control Part) facilities of SS7.
The second factor is the use of the SIM card and especially of the IMSI that it carries; each IMSI starts with the MCC/MNC of the user’s home network, allowing a visited network to determine which HLR to contact with its subscriber query.
The third factor supporting International Roaming is the GSM Association and the set of bilateral ‘roaming agreements’ established between network operators around the world. Roaming subscribers are only permitted to access the services of foreign networks with which their home operator has a roaming agreement.