Nov.09

CDMA (IS-41) Call Flows

Technical Tutorial

Overview

• Basic SS7 Concepts• Important Identities used in IS-41 MAP• IS-41 Call Flows

Basic SS7 Concepts

Basic SS7 Concepts

• Typical SS7 (Signaling System No. 7) protocol stack is depicted below:

MTP-1

MTP-2

MTP-3

SCCP

TCAP

OMAP

etc.

GSM MAP

IS-41 MAP

ISUP

• If compared with the OSI model, the MTP layer-1 does the function of Physical layer, MTP-2 provides the Data Link layer capabilities, the MTP-3 and SCCP layers provide Network & Transport layer functionalities.

• The different User Parts (UPs – like ISUP, TUP etc.) and Application Parts (APs – like Mobile Application part – MAP etc.) provide the application layer functionalities.

Basic SS7 Concepts

• At the MTP layer (3), the routing function uses the PC (Point Code) of the SEPs (Signaling End Points) to address them. The MTP layer, inherently, provides ConnectionLess services only.

• The SCCP layer can provide the ConnectionLess as well as the ConnectionOriented services. It also provides the Global Title (GT) translation services.

• TCAP layer provides the Database Query / Response kind of services. Some examples are – Number translation services, IN based services like CUG (Closed User Group) / VPN (Virtual Private Network) or Mobile Application Parts (GSM MAP / IS-41 MAP) etc.

Important Identities used in IS-41 MAP

Important Identities used in IS-41 MAP

• Some of the important identities used in CDMA networks (in AS-41 MAP layer) are listed below:– MSID: An MSID (Mobile Station Identity) can be in one of the two forms – the MIN (Mobile

Identification Number): a 10-digit number identifying a subscription in CDMA network; or the IMSI (International Mobile Station Identity): a 15-digit number conforming to E.212 standard.

– ESN: The Electronic Serial Number (ESN) is the number assigned by the manufacturer to the Mobile Equipment.

– MDN: Mobile Directory Number is an addressable (or diallable) number on which the subscriber can be called on.

– MSCID: MSC Identity is assigned to each network element (e.g. MSC, HLR, SMSC etc.) in an CDMA network.

– PC_SSN: Point Code and SubSystem Number of the Network Element.– MSCIN: MSC Identity Number is the Global Title address (or the number) assigned to the MSC.

• Some of the parameters (like the MSCIN or PC_SSN) are included at the MTP / SCCP layer too. But, the value provided in the IS-41 MAP layer override the values of the PC/SSN or the GT digits received at the MTP / SCCP layer.

IS-41 Call Flows

IS-41 Call Flows

• This presentation shows some of the important & most basic call flows for CDMA networks. The following call flows are included in this presentation:– Registration– Voice Call Origination– Voice call Termination– SMS Origination– SMS Termination

IS-41 Call Flows : Registration

• In any mobile services network, the most important network elements are the Mobile Switching Center / Visitor Location Register (MSC / VLR) and the Home Location Register (HLR). Being the most essential network elements, they are also called as Core Network elements.

• All the other network elements, required for other supplementary or value added services are called as Adjunct Network elements (like SMSC, SCP, VMS, OTAF etc.).

• As the name suggests, it’s the HLR, which is responsible to keep track of the current location of a Mobile Station. Whereas the VLR holds a temporary copy of the subscriber’s profile downloaded at the visited network & maintained only as long as the mobile is roaming in that network.

• It’s the combined responsibility of the MS (Mobile Station) and the MSC that, they should keep the HLR updated about the MS’s current location. This is done by virtue of “Registration” process.

IS-41 Call Flows : Registration….Contd..

• To keep the location of an MS to be the latest, there are different events when the registration can take place. Some of these events are:– MS Power On registration– MS Power Down de-registration– Timer based registration– Zone based registration– Distance based registration– Autonomous registration– Etc.

IS-41 Call Flows : Registration….Contd..

MSC / VLR – 1 HLR / AuC MSC / VLR – 2

Location Update Request

REGNOT (MIN, ESN, MSCID, PC_SSN, SMSAddress) REGCANC (MIN)

regcanc ()

regnot (MDN, Profile)

a

b

c

d

a. Mobile Station moves from MSC/VLR–2 to MSC/VLR–1. The Mobile Station requests for “Location Update” to the network. The MSC/VLR-1 sends IS-41 message called Registration Notification (or REGNOT in short) to the HLR with different parameters included in it. Most important parameter being the MIN. MIN is used as the primary key by the HLR to find the subscriber’s record in it’s database.

b. HLR compares the received MSCID / PC_SSN parameter against the value of these parameters stored in it’s dynamic database. As the HLR finds that the MS (identified by the MIN) was registered at MSC/VLR-2, earlier, it sends a message called as Registration Cancellation (REGCANC) to the MSC/VLR-2.

c. The MSC/VLR-2 deletes the record of this MIN from it’s database and sends the response to REGCANC to the HLR. The HLR stores the new MSCID / PC_SSN parameter in it’s dynamic data.

d. On receipt of ‘regcanc’ from MSC/VLR-2, the HLR sends the ‘regnot’ response to the MSC/VLR-1 with the subscriber’s profile included in it. The profile includes the MDN of the subscriber, Call Origination / Termination capabilities, SMS origination/termination capabilities, Data Services capabilities, other supplementary service like Call Waiting, Call Conferencing, Call Forward etc.

For further details about Registration Process visit :: http://ashishgayal.8m.net/registration.htm

IS-41 Call Flows : Voice Call Origination

• Once a Mobile Station is registered in a given MSC / VLR area, the subscriber’s call origination capabilities are known to VLR. As such, at the time of call origination, the MSC checks the subscriber’s profile in VLR to allow or disallow the origination of calls to the given subscriber. Apart from Authentication, at the time of Call Origination no other IS-41 messages are exchanged.

IS-41 Call Flows : Voice Call Termination

• In the mobile environment, a Mobile Station belongs to one and only one HLR. Even though the subscriber might be roaming across different networks or the MSC/VLRs, the latest location information is stored at the subscriber’s HLR.

• As such, for every terminating call (or, for that matter, for every Terminating SMS too) the HLR needs to be interrogated to find out the subscriber’s current location.

• The detailed call flow for a terminating call is given in the following slide.

IS-41 Call Flows : Voice Call Termination ..contd..

An ISUP call arrives at an G-MSC (Gateway MSC) for a Mobile Station.

a. The G-MSC sends a message called Location Request (LOCREQ) to the HLR that is serving the dialed MDN. The LOCREQ message includes the dialed number & the MSCID / PC_SSN of the G-MSC.

b. By virtue of Registration Process the HLR knows that the subscriber is registered in MSC/VLR-1 area. The HLR sends a message called as Routing Request (ROUTREQ) to get a temporary routable number using which, the G-MSC can establish a voice call with the ‘Serving’ MSC (i.e. MSC/VLR-1, in this case).

c. On receipt of the ROUTREQ message, the Serving MSC checks the subscriber’s current status (whether busy or otherwise etc.) and if the MS is found to be available, it picks up a temporary routing number from it’s pool of numbers called as TLDN (Temporary Local Directory Number). The ‘Serving’ MSC stores the association between the MIN and the TLDN in the call context memory (temporary storage area) & starts the timer for holding the TLDN.

d. On receipt of TLDN from the serving MSC, the HLR sends ‘locreq’ response to the G-MSC with the TLDN. The G-MSC, uses the TLDN to establish voice path to the Serving MSC. On receipt of the ISUP call, the Serving MSC, finds out the MIN (using the TLDN as a key) from the memory & ‘pages’ the MS & release the TLDN for reallocation for the next call.

G-MSC HLR MSC / VLR – 1

LOCREQ (MDN, MSCID, PC_SSN)

ROUTREQ (MIN)

routreq (MIN, TLDN)

locreq (TLDN, InterSystemTermination)

a

b

c

d

PSTN ISUP Call

ISUP Call (TLDN)

IS-41 Call Flows : SMS Call Flows

• In case of CDMA networks, each MS belongs to one and only one Message Center (MC or the SMSC). SMS being a store-and-forward type of application, it is the responsibility of the Home MC of any given CDMA subscriber, to store & subsequently deliver the terminating message to the subscriber.

• When a CDMA user originates a Short Message, there are two methods of routing the message to it’s destination. One method is called as the “Direct” method & the other is called as “Indirect” method of routing. In case of the “Direct” method, the Originating MSC delivers the message to the Destination subscriber’s MC. In case of “Indirect” method, the message is first delivered to Originator’s MC & then forwarded to the Destination subscriber’s MC. Ultimately, the message gets deposited in the destination subscriber’s MC for delivery.

Network Network

MCMCIndirect

Direct SMDPP

SMDPP

SMDPP / SMPP

SMDPP

Origination Home

Destination Home

IS-41 Call Flows : SMS Call Flows (A) … Contd..

MSC-1 MC-2 MSC-2HLR-2

REGNOT (SMSAddress)

regnot (profile)

A

B

SMDPP (SMS Bearer, MDN)

smdpp (ACK)

SMSREQ (MDN)

smsreq (MIN, SMSAddress)

SMDPP (MIN, SMS Bearer)

smdpp (ACK)

a

b

c

d

e

f

g

h

SMS Call Flows (A) explains the successful SMS delivery scenario.

a. MS ‘B’ registers at MSC/VLR-2. MSC sends ‘REGNOT’ message to the HLR with it’s own address (PC/SSN) as ‘SMSAddress’ to the HLR.

b. HLR Stores the ‘SMSAddress’ and sends ‘regnot’ response to the MSC/VLR-2.

c. MS ‘A’ sends an SMS for MS ‘B’. The MSC-1 delivers the message to the MC of MS ‘B’ (i.e. MC-2) through the IS-41 message called as SMDPP (Short Message Delivery Point-to-Point).

d. The Message Center sends ‘smdpp’ response to acknowledge the receipt of the message.

e. The MC-2 sends ‘SMSREQ (SMS Request)’ message to the HLR of MS ‘B’, to find out the subscriber’s current location & status.

f. If HLR finds that the MS ‘B’ is registered, it sends ‘smsreq’ response with the MIN & the ‘SMSAddress (the address of the serving MSC)’ to the MC-2.

IS-41 Call Flows : SMS Call Flows (A) … Contd..

g. On receipt of response to ‘SMSREQ’ the MC-2 sends ‘SMDPP’ message to the MSC identified by the ‘SMSAddress’.

h. The MSC-2 pages the MS ‘B’ & delivers the message & sends successful response to the MC-2 in ‘smdpp’ message.

IS-41 Call Flows : SMS Call Flows (B) … Contd..

MSC-1 MC-2 MSC-2HLR-2

MSINACT (MIN)

msinact ()

A

BSMDPP (SMS Bearer, MDN)

smdpp (ACK)

SMSREQ (MDN)

smsreq (MIN, SMSAccessDeniedReason)

SMDPP (MIN, SMS Bearer)

smdpp (ACK)

a

b

c

d

e

f

k

l

SMS Call Flows (B) explains the first unsuccessful SMS delivery attempt.

a. MS ‘B’ de-registers from MSC/VLR-2. MSC sends ‘MSINACT’ message to the HLR, which indicates to HLR that the MS ‘B’ is not available any more.

b. HLR marks the MS ‘B’ as ‘Inactive’ and sends ‘msinact’ response to the MSC/VLR-2.

c. MS ‘A’ sends an SMS for MS ‘B’. The MSC-1 delivers the message to the MC of MS ‘B’ (i.e. MC-2) through the IS-41 message called as SMDPP (Short Message Delivery Point-to-Point).

Power Down De-

Registration

B

Power Up Registration

REGNOT (MIN)

regnot (Profile)

SMSNOT (MIN)

smsnot ()

g

h

i

j

SMDPF flag ‘set’

SMDPF flag ‘reset’

IS-41 Call Flows : SMS Call Flows … Contd..

d. The Message Center sends ‘smdpp’ response to acknowledge the receipt of the message.

e. The MC-2 sends ‘SMSREQ (SMS Request)’ message to the HLR of MS ‘B’, to find out the subscriber’s current location & status.

f. HLR finds that the MS ‘B’ is marked as ‘Inactive’ and sends ‘smsreq’ response with the ‘SMSAccessDeniedReason’ parameter set to a value indicating that the SMS to this MS (‘B’) can not be delivered at this moment. The HLR also sets a flag called ‘SMS Delivery Pending Flag (SMDPF)’ indicating that there was an attempt to deliver an SMS to this MS, but, it was not delivered.

g. After some time when the MS ‘B’ turns ‘ON’, it performs “Power-Up Registration”. The MSC/VLR-2 sends ‘REGNOT’ to the HLR.

h. HLR responds to ‘REGNOT’ with the subscriber’s profile. The HLR also finds that, against ‘this’ MIN, the SMDPF flag is set.

i. Because the SMDPF flag for MS ‘B’ was set, the HLR sends a message called ‘SMSNOT (SMS Notification)’ to the Home MC of MS ‘B’. The ‘SMSNOT’ message includes the MIN, MDN & the SMSAddress.

j. The MC-2 responds with ‘smsnot’ to the HLR. On receipt of the ‘smsnot’ message, the HLR resets the SMDPF flag.

k. On receipt of SMSNOT, the MC-2 comes to know that the MS ‘B’ is now available & is located at the MSC identified by the ‘SMSAddress’ received in ‘SMSNOT’. The MC-2 retries the delivery of message by sending ‘SMDPP’ message to the MSC-2.

l. On successful delivery of message to MS ‘B’, the MSC sends the ‘smdpp’ response message to the MC-2. If the originating MS had requested for delivery acknowledgement, then the MC-2 forms the delivery confirmation message to be sent to MS ‘A’ & goes ahead with SMS delivery call flow for message delivery confirmation to MS ‘A’.

References / Related sites

• Details of MTP, SCCP & TCAP layers (ITU-T) can be found in a shared folder called “ITUT” in my PC (IP Address = 202.75.201.112). Username (if required) is ‘agayal’ & password is ‘RKway123’. MTP layers are defined in Q.701 to Q.705; SCCP layers in Q.711 to Q.715 and TCAP in Q.771 to Q.775.

• All CDMA related standards (IS-41, IS-771, IS-826 etc.) can be downloaded from http://www.3gpp2.org/Public_html/specs/index.cfm

• Other interesting sites are:– http://www.howcdmaworks.com– http://www.ifast.org– http://www.cdg.org