Call set-up within GSM consists of the following main steps:
- RR connection establishment
- Service request
- Authentication
- Ciphering mode setting
- IMEI Check
- TMSI-Reallocation
- Call initiation
- Assignment of a traffic channel
- User alerting
- Call accepted
Note: The above steps are taken for both mobile originating and mobile terminating calls. However,
for mobile terminating call they must be preceded by an interrogation phase.....
Overview of Call Set-up in GSM
Mobile Terminating (MT)
Messages Overview Between MS and Network (MT)
Interrogation Phase (MT)
RR Connection Establishment (MT)
Service Request (MT)
Authentication (MT), Ciphering (MT)
Authentication and Ciphering process remains same as in LU
IMEI Check (MT)
TMSI Reallocation (MT)
Call Initiation (MT)
Assignment of a Traffic Channel (MT)
Call Confirmation and Call Accept (MT)
Call Release MT
Signaling Diagram MT
Mobile Originating (MO)
Messages Overview Between MS and Network
(MO)
Signaling Diagram MO
Timers for RR Connection Establishment &
Service Request (ALOHA)
Above figure shows timers used at RR connection
establishment on the MS and on the network side.
RR Connection Establishment (LU) 1
The procedure of location updating, is started by the MS which sends the Channel Request message on the RACH. The BTS then sends Channel Required to the BSC.
If a free SDCCH is available, the BSC sends the Channel Activation message to the BTS. When a channel has been activated, the BSC sends the Immediate Assignment message to the MS and starts timer T3101.
Service Request (LU) 2
After receiving the Immediate Assignment message MS switches to the ordered channel and establishes the main signaling link by sending a SABM message including the Location Updating Request message. The Location Updating Request message contains the type of location updating (normal, periodic or
attach), the ciphering key sequence number, the old LAI stored in the MS, the mobile station classmark1, either IMSI or TMSI and possibly IMEI.
When the Location Updating Request arrives in the BTS, it is looped back to the MS in a UA frame and forwarded to the BSC in an Establish Indication message.
When the Establish Indication is received at the BSC, the T3101 timer that was set when the Immediate Assignment message was sent is stopped. The BSC then establishes the SCCP connection to the MSC by sending the Connection Request message with the Location Updating Request included in the information field. This Location Updating Request message is somewhat modified because the BSC adds the new CGI, indicating where the mobile is now. The MS itself identifies its previous location. The modified message is Complete Layer 3 information. The MSC acknowledges the message by sending a Connection Confirmed frame.
Authentication (LU) 3
The MSC/VLR checks the relevant exchange property and performs analysis on the IMSI series to
establish whether or not authentication is to be performed. An Authentication Request is sent transparently
to the MS. The parameters in the Auth. Req. message are the random (RAND) number, 128 bits, and
CKSN, 3 bits.
When the MS receives the Auth. Req. message it stores the CKSN, which is to be sent in the next service
request message. It then calculates the authentication parameter SRES by inserting Ki, the subscriber
authentication key that is stored in the SIM card; and RAND in algorithm number A3 as well as Kc by
inserting Ki and RAND in algorithm A8. The SRES parameter is returned to MSC/VLR in the
Authentication Response message.
The Data Indication (DI) frame is used to send a layer 3 message transparently in the direction from BTS
to BSC. In the opposite direction, the Data Request (DR) frame is used. Authentication is supervised by
timer T3260 on the network side. It is set in the MSC when Auth. Req. is sent and stopped when Auth
Resp is received. On the first expire Auth. Req. is sent again, but on the second expire the channel is
released.
Note that the authentication procedure might be delayed if the MSC/VLR must ask the HLR for parameters
which is the case with new visitors.
If the CKSN sent from the MS in the Location Updating Request message is identical to the one that is
stored in the MSC, authentication can be omitted (selective authentication) and ciphering may start
immediately.
Unsuccessful Authentication (LU) 4
If authentication fails that is, SRES from the MS does not correspond with the SRES value stored in
MSC/VLR; the network can distinguish between two different ways of
identification used by the MS:
• TMSI
• IMSI
If TMSI is used, the network may initiate the identification procedure, where the MS is told to send its IMSI
value. If the IMSI given by the MS differs from that which is stored in the network, the authentication is
restarted using the correct parameters. If the IMSI provided is the expected one, the MSC should proceed
as described below.
If the IMSI has been used or the network decides not to use the identification procedure, an Authentication
Reject message is sent to the MS. All connections in progress are then released. The MS receiving the
Auth. Rej. message deletes its TMSI, LAI, Kc, and CKSN and switches to the “IDLE no IMSI" state. In this
state, the MS is only allowed to perform default cell selection, and only emergency calls are permitted.
This is a serious case because it means barring the SIM card from use. To prevent this from happening
because of dues to bit errors or software errors, the GSM systems have an exchange parameter
controlling unsuccessful authentication. If this parameter is set, then the MSC does not send the
Authentication Reject message, but instead rejects the MS access to the system by sending one of the
following messages depending on the establish cause (in brackets):
• “IMSI unknown in VLR" (Mobile originating call)
• No message, only disconnection (Mobile terminating call)
• “PLMN not allowed" (Location updating)
• “IMSI unknown in VLR" (Support services control operations)
Ciphering (LU) 5
If the authentication procedure is successfully performed, the ciphering mode setting procedure can be initiated by the MSC/VLR (depending on the exchange property setting in the MSC/VLR), which then sends the Ciphering Mode Command to the BSC. This is a BSSMAP message which contains the Kc. Kc is forwarded by BSC to the BTS.
BTS stores Kc and tells the MS to start ciphering. BTS starts the deciphering. The Ciphering Mode Command message sent from BTS to MS is non-ciphered.
The MS inserts Kc and TDMA frame number into algorithm A5, which yields a ciphering sequence that is added to the message to be sent. The message is called Ciphering Mode Complete, and it does not have any parameters. It only tells the BTS that ciphering has started.
When the BTS receives the Ciphering Mode Complete message or any other correctly deciphered layer 2 frame, ciphering is started on the network side. Ciphering Mode Complete is then sent in a DI frame to the MSC.
Ciphering must be activated if TMSI is to be reallocated. However, there are exchange
properties defining when ciphering is to be used. Normally, when location updating is used
for periodic registration or the network does not allocate a new TMSI, ciphering need not be activated.
Ciphering (LU) 6
Ciphering Key Sequence Number
The CKSN is used in the following way:
The authentication message sent from the MSC/VLR contains the RAND number and the CKSN. CKSN is
stored in VLR together with Kc.
When the MS receives the authentication message it calculates SRES and Kc, storing Kc together with the
CKSN in the SIM card. The next time the MS wants to access the system, it sends the CKSN in the
service request message. Now the MSC knows what Kc is stored in the MS, and therefore does not need
to send the Authentication Request message containing the RAND.
Instead, the MSC can go directly to the ciphering procedure. This is called selective authentication. It
means that authentication does not take place every time. This function is defined by a number of
exchange properties, set in the MSC/VLR, appropriate to different traffic cases and the frequency of
repeating the authentication.
Update Location (LU) 7
If the MSC/VLR accepts location updating, the MSC/VLR now sends the Location Updating Accepted message to the MS. A new TMSI value may be included. Timer T3250 is started in the MSC.
The TMSI can be sent to the MS at any time. This is performed in the TMSI Reallocation Command. When the MS has stored the new TMSI it sends a TMSI Reallocation Complete message back to the MSC.
If the Location Updating Accepted message received in the MS contains a new TMSI, the MS acknowledges the receipt of the TMSI by sending the TMSI Reallocation Complete message.
When this message is received in the MSC, timer T3250 is stopped.
RR Connection Release (LU) 8
The network initiates the channel release by sending a Clear Command message to the BSC including the cause for the release. The BSC then sends the Channel Release message transparently to the MS. The BTS has no knowledge about the release at this point.
The BSC then sends the Deactivate SACCH message to the BTS, telling the base station to stop sending messages every 480 ms on the Slow Associated Control Channel.
When the MS gets the Channel Release message, it disconnects the main signaling link (here SDCCH) and sends the layer 2 Disconnect message. This message indicates that the link is no longer in acknowledged mode. The Disc message is acknowledged by a UA frame.
When the main signaling link has been disconnected, that is, when the BTS receives the Disc frame; it sends the Release Indication message to the BSC. Now the link is disconnected, but the radio channel is still in use. To halt transmission on the radio frequency, the BSC sends the Rf Channel Release message to the BTS which is acknowledged as soon as the BTS has stopped transmission on the radio channel. The timer
T3111 is started when the Rf Channel Release message is sent.
On expire of timer T3111 the BSC considers the released channel free for use and sends the
Clear Complete message to MSC/VLR.
SCCP, Connection Oriented, Release (LU) 9
The SCCP Released (RLSD) message is sent by MSC to BSC to indicate that the SCCP wants to release the signaling connection and Release Complete is sent in response indicating that the appropriate procedure has been completed.
Interrogation Phase (MT) 1
When setting up a mobile terminating call an additional initial stage is required. Before a call can be routed
to a mobile subscriber, the system must first find out where the subscriber is located at that moment. This
is called the interrogation phase.
During this phase, the GMSC interrogates the subscriber’s HLR to find out where he/she is located.
The GMSC uses the information it receives in the Initial Address Message (IAM) from a fixed exchange to
determine which HLR should be interrogated. (Part of the MSISDN is used to determine which HLR should
be interrogated.)
GMSC can contact the Flexible Numbering Register (FNR) node and the
SCCP address used in the Send Routing Information will be changed from the MSISDN to MGT as defined
in the FNR database. After this the request is sent further on to the HLR. This allows more flexible
assignment and changes of the MSISDN numbers independent of the IMSI number of the subscriber.
The contacted HLR should come back with an answer: a number that can be used to route the call from
GMSC to MSC/VLR. That can either be a C-number if Call Forwarding Unconditional service is activated,
or, most often, the MSRN. As the Roaming Number is not part of the information stored in the HLR, it must
be retrieved from the appropriate MSC/VLR.
Call routing between the GMSC and MSC/VLR is performed using the Initial Address Message. This is one
of the few possible situations in which two GSM nodes use non-GSM specific protocols (e.g. ISUP or TUP) to communicate with each other instead of using MAP to communicate.
RR Connection Establishment (MT) 2
MSC/VLR initiates the call set-up procedure by sending the Paging message to the relevant BSCs.
The actual information contained in the Paging message depends on whether IMSI or TMSI is used in the
Paging Request message. The IMSI is, however, always sent because the BSC needs the IMSI to
calculate the correct paging group. The MS can be paged in all cells of a specific location area or
globally in all cells in the MSC/VLR Service Area depending on how the appropriate exchange property
(exchange properties are exchange parameters set by the operator) is defined in MSC. If the BSC does
not have the information about which cells belong to which LAs, the MSC must provide the specific CGI.
Otherwise it is enough to provide the LAI. Note that only one MS can be paged in one message on the A-
interface.
The BSC detects the Paging message and translates the LAI into a Cell Global Identity (CGI) if the cell has
not been provided in the paging message. The BSC sends the Paging Command message to the relevant
BTSs. This message contains the IMSI or TMSI, channel number (channel type and time slot number),
and paging group. In this case, the channel type is downlink CCCH (PCH). The paging group is
determined by the IMSI and two other parameters defined in BSC and broadcast as system information.
The paging group is a way to spread out the paging over a certain number of frames. When the MS
receives the system information and knows its IMSI, it calculates when its paging group will occur and
listens for paging only when it is expected to.
RR Connection Establishment (MT) 3
Finally, the BTS sends the Paging Request message to the MS. It is sent on the PCH, and it occupies four
bursts. By using TMSI instead of IMSI, up to four MSs can be paged in one Paging message as shown
below.
When the paged MS receives a Paging Request message it responds by sending a Channel Request message, thereby requesting a signaling channel for call set-up. The Channel Request message is sent on the Random Access Channel (RACH) and consists of 8 information bits: a random number (5 bits) and an establish cause (3 bits). In GSM specifications phase 2, the number of bits used to establish cause can be 3 through 6.
Accordingly, the random number will be described using 5 down to 2 bits.
RR Connection Establishment (MT) 4
The establish cause can be:
• Answer to page
• Originating call
• Location updating
• Emergency call
• Others, for example IMSI detach, SMS, supplementary services management
The establish cause can be used to set priority if there are numerous requests.
Emergency calls can for example, have priority over answer to page, which in its turn has priority over mobile originating calls.
When the BTS detects an access burst, it sends a Channel Required message to the BSC to request a signaling channel for the MS. This message contains the access delay of the access burst and the request reference parameter. This parameter contains the eight bits from the access burst (random number and establish cause) and the TDMA frame number when the access burst was detected.
RR Connection Establishment (MT) 5
BSC compares the access delay value with the maximum permitted timing
advance parameter value. The timing advance parameter is defined for each cell
in BSC to ensure that the MS is within the allowed range. BSC then determines
which channel to use and sends the identity of this channel to the BTS in the
Channel Activation message. The contents of this message are:
• Reason for allocation
• A complete description of the channel containing the channel description information element
• DTX applied or not
• MS power
• BS power
• Timing Advance (TA)
The BTS then activates the channel and confirms this by sending the Channel Activation Acknowledge message.
RR Connection Establishment (MT) 6
The BSC then sends the Immediate Assignment command message containing an Immediate Assign message to the mobile station. The message tells the MS to switch to the allocated signaling channel (SDCCH+SACCH). The message
contains:
• The channel description information element
• In case of a hopping channel, a list of frequencies the MS should hop between is provided
• The frame number when the Channel Required message was detected
• The random reference and the establishment cause from the access burst
• The TA that the MS will use
The MS compares the random reference and the frame number with those stored in the MS. If they correspond, the MS goes to the service request step.
Service Request (MT) 7
The layer 2 message Set Asynchronous Balanced Mode (SABM) is sent to the BTS as soon as the MS has tuned to the new channel. SABM may contain a layer 3service request message. In this case, the information field in SABM contains the Paging Response message.
The SABM message is used to start the acknowledged mode on the SDCCH channel. In practice, this means that the counters for send and receive sequence numbers are reset to zero.
The Paging Response message received from the MS contains the following information:
• MS identity (IMSI or TMSI)
• the ciphering key sequence number (CKSN)
• the mobile station classmark 2, that is, the type of MS station being used
The CKSN can be used by the MSC to start ciphering without authentication.
When the Paging Response arrives at the BTS, it is forwarded to the BSC in an Establish Indication message. This message tells the BSC that a change to acknowledged mode has been made. BSC activates radio connection quality supervision in the Transceiver Handler (TRH) which starts the locating function on SDCCH. It also initiates the power control algorithm for dynamic MS power control.
Service Request (MT) 8
Paging Response is an Initial MS message, which means that it was initially meant to be sent transparently to the MSC. However, the BSC adds CGI before forwarding the Paging Response to the MSC as a Complete L3 message.
The Paging Response is also looped back to the MS in a Unnumbered Acknowledgment (UA) frame. This confirms that only one MS is using the signaling channel. If the paging response is not returned the following case might occur:
Two MSs access the system at the very same frame number, with the same establish cause and the same random reference (there are only 32). If both MSs are strong, they must send another access burst in accordance with the Aloha procedure, which is a way to spread out random accesses in order to avoid consecutive collisions. However, if one of the MSs is weak, the signal does not reach the BTS. Unaware of this, the MS receives the reply sent to the other MS a short while after its own access attempt. The MS tunes to the signaling channel, sends the Paging Response message and then listens for the Paging Response to be looped back. Now the MS hears that the MS identity given is not its own and leaves the channel.
The BSC sets up a logical SCCP connection towards the MSC by sending the Connection Request message including a complete Layer 3 information - the Paging Response message piggybacked. The SCCP Connection Confirm message is returned to the BSC which means that the connection oriented signaling is established on the A interface.
IMEI Check (MT) 9
The exchange properties in the MSC/VLR define whether or not the IMEI check is performed. If it is, the MSC/VLR orders the mobile station to send its IMEI number. The downlink message, Identity Request, contains information about what the mobile should send back. In case of an IMEI check, the mobile receives a request to send back its IMEI number. The same Identity Request message can be used in other situations to order the mobile to send back its IMSI number.
The IMEI sent by the mobile is checked against information in the network’ s Equipment Identity Register (EIR). If the EIR returns the answer "white listed" the mobile is allowed to use the network. If the mobile is "black listed" it will be rejected. The EIR can also return the answer "gray listed" or "unknown". In these cases the operator can decide whether the mobile is permitted access to the network.
TMSI Reallocation (MT) 10
Exchange properties, as well as the result of the IMSI series analysis, defines whether TMSI is used for a particular traffic case and a particular IMSI. TMSI is allocated by MSC software and sent transparently to the MS.
TMSI is stored in the SIM and TMSI Reallocation Complete message is returned by the MS.
Call Initiation (MT) 11
Call initiation is started when the MSC sends the Setup message to the MS. This message contains a request for bearer services (GSM - bearer capabilities). That is, speech, data, fax, bit rate, etc. If the MS can handle
the required service, it sends a Call Confirmed message to the MSC. If the MS cannot handle the requested bearer services, it sends the release complete message to the MSC with reject cause No. 88, "Incompatible
destination". The MSC then releases the connection to the MS and also releases the connection to the calling subscriber with cause number 88.
The call initiation procedure is supervised at the network side with the timer T303. This timer is set when the Setup message is sent and stopped when the Call Confirmed message is received. If the network does not
receive the Call Confirmed message before timer T303 expires it releases the connection to the calling subscriber with cause No. 18, "No user responding". It also releases the connection to the MS. The Setup
message is only sent once.
Assignment of a Traffic Channel (MT) 12
The assignment procedure is initiated by the MSC, which sends the Assignment
Request message to BSC. This message contains:
• priority (a value between 1 and 14)
• CIC for trunk select to carry the traffic (speech or data) between MSC and BSC
• a DTX flag indicating whether DTX should be used on the
downlink
• optionally, radio channel identity
By using this parameter the MSC can force the BSC to choose one particular radio channel for O&M reasons.
The BSC can then, with the message Physical Context Request, ask the BTS for physical information. That is, BS power, MS power and timing advance.
The list from the locating function is then evaluated in BSC and depending on the result, one of the following assignment procedures is started:
• Assignment to serving cell
• Assignment to another cell in the same BSC
• Assignment to an external cell
Assignment of a Traffic Channel (MT) 13
Only assignment to serving cell is described below. The BSC software reads the value of the timing advance and calculates MS power level from the locating function, selects an idle traffic channel and sends the Channel Activation to the BTS. Channel Activation is the same type of message that is used for assigning the SDDCH + SACCH in the RR connection establishment. But in this case the channel type is set to Bm +ACCH meaning full rate TCH + SACCH + FACCH. The BTS acknowledges the allocation of the speech channel by sending a Channel Activation Acknowledge message.
The BSC then sets up a path through the group switch, and ensures that there will be no disconnection due to missing Measurement Reports from the MS when the MS disappears from the old channel. The BSC sends the Assignment Command towards the MS, telling the mobile station to switch to the new channel (TCH + SACCH + FACCH). This message is sent on the SDCCH, and it consists of a complete channel description.
Assignment of a Traffic Channel (MT) 14
The MS tunes to the new physical channel and sends SABM (on FACCH) to indicate that the channel is correctly seized and that SACCH is then started in acknowledged mode. As the BTS receives this message, it returns UA to the MS and sends an Establish Indication message to the BSC.
The MS then sends an Assignment Complete message to the MSC indicating that the traffic channel is up and running.
Finally, the BSC tells the BTS that the signaling channel is no longer needed by sending the RF Channel Release message. This message is acknowledged as soon as the connection is released.
Call Confirmation (MT) 15
The call confirmation procedure starts as the MS sends the Alerting message to the MSC. This message indicates that a ringing tone has been generated in the MS and it can be used for user-to-user signaling or
for invocation of supplementary services. The message is sent transparently. When the Alerting message is received, the MSC/VLR sends the TUP Address Complete (ACM) message to the calling
subscriber, who can now hear the ringing tone generated in the MSC.
When the MS user answers, the Connect message is sent to the MSC. This message contains facility, user-user signaling and a progress indicator. When the message is received at the MSC, a Connect
Acknowledgment is sent back to the MS, and the originating exchange is informed by means of a TUP or ISUP Answering message and also charging information.
Call Release (MT) 16
In this case the call was ended by the mobile subscriber.
When MSC receives a Disconnect message it initiates the release of the CM connection. This is done with a Release message, which is acknowledged, by the Release Complete message from the MS. If there
were no other connections on the CM level (e.g., held calls, SMSs, etc.) the network initiates a release on the RR level.
The network initiates the channel release by sending a Clear Command message to the BSC, including the cause for the release. The BSC then sends the Channel Release message transparently to the MS. The BTS
has so far no knowledge about the release.
Call Release (MT) 17
The BSC then sends the Deactivate SACCH message to the BTS, telling the base station to stop sending messages every 480 ms on the Slow Associated Control Channel.
When the MS gets the Channel Release message, it disconnects the main signaling link (here TCH) and sends the LAPDm Disconnect frame. This message indicates that the link is no longer in the acknowledged mode. This message is acknowledged by a UA frame.
When the main signaling link has been disconnected, that is, when the BTS receives the Disc frame, it sends the Release Indication message to the BSC. Now the link is disconnected, but the radio channel is still in use.
To halt transmission on the radio frequency, the BSC sends the RF Channel Release message to the BTS, which is acknowledged as soon as the BTS has stopped transmission on the radio channel. The timer T3111
is started when the Rf Channel Release message is sent. After this timer expires the resource can be allocated for another user.