Um931 1602

Course UM931
NSS16/UMTS03
Wireless CCN Overview
Student Guide
NSS16/UMTS03 Standard 16.02 May 2003 411-UM931-001.1602

test
NSS16/UMTS03
Student Guide
Document number: Course UM931

Product release: NSS16/UMTS03
Document version: Standard 16.02
Date: May 2003
Copyright Country of printing Confidentiality Legal statements Trademarks
Copyright 2001-2003 Nortel Networks, All Rights Reserved

Printed in France
NORTEL NETWORKS CONFIDENTIAL

The information contained herein is the property of Nortel Networks and is strictly confidential. Except as expressly authorized in
writing by Nortel Networks, the holder shall keep all information contained herein confidential, shall disclose it only to its employees
with a need to know, and shall protect it, in whole or in part, from disclosure and dissemination to third parties with the same degree
of care it uses to protect its own confidential information, but with no less than reasonable care. Except as expressly authorized in
writing by Nortel Networks, the holder is granted no rights to use the information contained herein.
Information is subject to change without notice. Nortel Networks reserves the right to make changes in design or components as
progress in engineering and manufacturing may warrant.
* Nortel Networks, the Nortel Networks logo, the Globemark HOW the WORLD SHARES IDEAS, and Unified Networks are
trademarks of Nortel Networks.
Trademarks are acknowledged with an asterisk (*) at their first appearance in the document.
ii Nortel Networks Confidential
Course UM931 Standard 16.02 May 2003 For training purposes only
Nortel Networks Confidential iii
Publication history
May 2002
Issue 16.02 UMTS03
This standard issue contains information on the NSS16/UMTS03 version.
November 2002
Issue 16.01 UMTS03
This draft issue contains information on the NSS16/UMTS03 version.
July 2002
Issue 15.02 UMTS02
This standard issue contains information on the NSS15/UMTS02 version.
April 2002
Issue 15.01 UMTS02
This draft issue contains information on the NSS15/UMTS02 version.
February 2002
Issue 14.02 UMTS01
This standard issue contains information on the UMTS01 version. The
major changes included in this document are: the product version, and the
curriculum paths.
October 2001
Issue 01.01 UMTS01
This standard issue contains information on UMTS01 version.
NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

iv Publication history Nortel Networks Confidential
Nortel Networks Confidential v
About this Course

This overview class is designed for anyone with an interest in the basic
functions and operations of the NSS16/UMTS03 communications network.
Objectives 0
Course Objectives
Upon completion of this course, you will be able to:

Summarize UMTS history and characteristics.
Describe UMTS system components and compare the Nortel Networks
implementation of UMTS following the UMTS recommendations.
"Confidential information -- may not be copied or disclosed without permission".
Describe the ISO model for communications and the CCS7 signaling
standard.
Discuss the UMTS implementation of CCS7 signaling and its role in the
UMTS interfaces.
Describe from a signaling perspective:
location update
authentication
ciphering
call setup and clear down
Describe the handover procedures.
Describe the supplementary services.
PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 2

vi About this Course Nortel Networks Confidential
UMTS Curriculum Paths 0

The following figures illustrate the three possible recommended CCN training
paths to acquire skills for the following jobs. You can find the training catalog
under the following bookmarks:
Internal : http://ets
External : http://www.nortelnetworks.com/training
DMS Maintenance Beginner
UM931 UM930
Wireless CCN Overview Wireless DMS Overview
UM950
Wireless DMS Maintenance (1)
Wireless CCN Overview (UM931/2 Days)

Wireless DMS Overview (UM930/3 Days)
These two courses provide the student with a basic understanding of a
DMS and Circuit Core Network (CCN) switches.
The following course in the curriculum path is:

Wireless DMS Maintenance Part 1 (UM950/5 Days)
Provides you with the generic skills required to maintain any DMS switch
in a network. A particular focus is placed on:
routine maintenance procedure

PMs (Peripheral Modules)/TRKS
Nortel Networks Confidential About this Course vii
IOM Input/output Module

ISM (Integrated Service Module)
DMS Maintenance Expert
UM931 UM930
UM950
UM951
Optional
UM955 UM957
Wireless SDM/FT Maintenance Wireless Supernode
and Administration Billing Application Overview
This curriculum path is designed for anyone involved as a team member into
the design of any DMS switch. This curriculum path begins with the DMS
Maintenance Beginner curriculum path, followed by:
Wireless DMS Maintenance Part 2 (UM951/10 Days)

Provides you with the generic skills required to maintain any DMS switch
in a network. A particular focus is placed on:
DMS-CORE
ENET
XA-CORE
Patches
FTP

viii About this Course Nortel Networks Confidential
Optional courses are:
Wireless SDM/FT Maintenance and Administration (UM955/2 Days)

Provides you with key fields and knowledge of the SuperNode Data
Manager Fault tolerant (SDM/FT) hardware, involving troubleshooting
and mainetnance procedures.
Wireless SuperNode Billing Application Overview (UM957/2 Days)

Provides you with key information and knowledge to setup and maintain
the billing information using the SBA feature on the SDM.
Nortel Networks Confidential About this Course ix
Core Circuit Specialist
UM 10
UMTS System Description
UM931 UM930
UM968
NSS16/UMTS03
Delta Release
The Core Circuit Specialist curriculum path begins with one of the following
course:
UMTS System Description (UM010/3 Days)

Followed by one of two courses:
Wireless CCN Overview (UM931/2 Days)

Wireless DMS Overview (UM930/3 Days)
Completed by:
NSS16 Delta Release (UM968/3*2 Hours)

This course gives you the features and enhancements introduced in
NSS16/UMTS03 release.

x About this Course Nortel Networks Confidential
Core Circuit Datafill Specialist
Core Circuit Datafill Specialist

UM 10
UMTS System Description
UM931 UM930
UM967
NSS15/UMTS02
Delta Release
UM970 UM974
Wireless DMS Wireless DMS CCS7
MSC/VLR Translations Operation and Datafill
UM972
Wireless DMS-HLR
Service Datafill
UM900
Wireless DMS IN
Operation and Datafill
Core Circuit Datafill

Specialist
The Core Circuit Datafill Specialist curriculum path begins with the
curriculum path of the Core Circuit Specialist curriculum path followed by
one of the two courses:
Wireless DMS CCS7 Operations And Datafill (UM974/5 Days)

Is designed for anyone implementing and maintaining CCS7 for GSM/
UMTS on a DMS.
Wireless DMS MSC/VLR Translations (UM970/10 Days)

Provides you with practical experience in planning and setting up a MSC/
VLR to perform the digit translations related to any call.
Completed by the two following courses:
Wireless DMS-HLR Service and Datafill (UM972/5 Days)

Provides you with practical experience in datafilling the DMS-MSC and
HLR tables used to create and manage subscriber profiles and services.
Nortel Networks Confidential About this Course xi
Wireless DMS IN Operations and Datafill (UM900/4 Days)

tables required to implement Intelligent Networks (IN) services and
register subscribers.
Core Circuit Supervisor
UM931 UM930
UM950
UM957
Wireless SuperNode Billing Application
Overview
UM 68
UMTS OAM Introduction
UM937
Wireless OMC-S OAM
The Core Circuit Supervisor curriculum path begins with the DMS
Maintenance Beginner curriculum path, followed by one the the two
following courses:
Wireless SuperNode Billing Application Overview (UM957/2 Days)

the billing information using the SBA feature on the SDM.
UMTS OAM Introduction (UM60/2 Days)

Followed by:
Wireless OMC-S OAM (UM937/2 Days)

Provides key information on tasks necessary for network operation and
administration, using the OMC-S (Operation and Administration Center
for the UMTS Network Switching Subsystem).

xii About this Course Nortel Networks Confidential
Support Material
Other materials related to the course include:
411-2231-010 DMS-MSC Product Guide
411-2231-310 GSM Family CCS7 Family Application Guide
411-2231-451 DMS-MSC Customer Data Schema
411-2281-451 DMS-HLR Customer Data Schema
411-3001-451 Base Telecom Customer Data Schema
Nortel Networks Confidential xiii
Contents 1
About this Course v

Objectives v
UMTS Curriculum Paths vi
DMS Maintenance Beginner vi
DMS Maintenance Expert vii
Core Circuit Specialist ix
Core Circuit Datafill Specialist x
Core Circuit Supervisor xi
Support Material xii
Lesson 1
GSM/UMTS History and Characteristics 1-1
Objectives 1-1
UMTS History and Characteristics 1-2
GSM 1-2
CDMA 1-3
D-AMPS 1-3
PDC 1-3
Third Generation Mobile Networks 1-4
Cellular System Architecture and Concepts 1-6
What is a Cell? 1-6
Cell Splitting 1-6
What is a Cellular Geographic Service Area? 1-7
UMTS Public Land Mobile Network Overview 1-7
Coverage Area of the UMTS PLMN 1-8
Routing Area (RA) 1-9
GSM versus UMTS 1-10
Review Questions 1-11
Lesson 2
UMTS Architecture and Components 2-1
Objectives 2-1
Evolving from GSM to UMTS 2-2
GSM Background 2-2
Evolving from a GSM to a GPRS Network 2-3
UMTS Architecture Overview 2-5
UMTS Network Components 2-7
User Equipment (UE) 2-8
Universal Subscriber Identity Module (USIM) 2-10
UMTS Terrestrial Radio Access Network (UTRAN) 2-13

xiv Contents Nortel Networks Confidential
Nortel Networks Implementation of the Circuit Switched Domain 2-14

Digital Multiplex System-Mobile Service Switching Center (DMS-MSC) 2-15
Integrated Visitor Location Register 2-15
Wireless Gateway 2-16
TRAU 2-16
Digital Multiplex System-Home Location Register (DMS-HLR) 2-17
Univity HLR 2-17
Integrated Authentication Center (AuC) 2-20
Equipment Identification Register (EIR) 2-21
UMTS Short Message Service Center (SMS-C) 2-22
UMTS InterWorking Function (IWF) 2-24
HLR Mated Pair Architecture 2-26
UMTS Network Management 2-29
Operations and Maintenance Center - switching (OMC-S) 2-30
Lesson 3
OAMP & Added Components 3-1
Objectives 3-1
Added Components 3-2
SuperNode Data Manager Fault/tolerant Cabinet 3-4
OMC-S Element Manager 3-5
OMC-S Element Manager Application 3-6
USP Graphical Interface 3-7
HLR-PS Application 3-9
Provisioning Interfaces 3-9
Call Intercept System 3-11
Call Monitoring 3-11
Call Intercept System Provisioning 3-12
SuperNode Billing Application 3-13
Voice Mail System 3-14
Intelligent Networks 3-16
Turnkey Services 3-18
CAMEL Ph3 and GSM16 3-20
Lesson 4
Introduction to CCS7 4-1
Objectives 4-1
Introduction to Common Channel Signaling System #7 4-2
Signaling 4-2
Per-Trunk Signaling (PTS) 4-3
Common Channel Signaling (CCS) 4-4
What is CCS7? 4-5
CCS7 Signaling Advantages 4-5
Transaction Services 4-6
Signaling Network Management 4-6
CCS7 Network 4-7
Signaling Point 4-7
Service Switching Point 4-8
Signaling Transfer Point 4-8
Service Control Point 4-8
Integrated Node 4-8
Nortel Networks Confidential Contents xv
Signaling Links 4-9

Link Types 4-9
Network Addressing 4-10
Point Codes 4-10
Linksets and Routesets 4-11
Linksets 4-11
Routesets 4-12
CCS7 Signaling Types 4-15
Connection-Oriented Signaling 4-15
Connectionless Signaling 4-16
Lesson 5
CCS7 Protocol 5-1
Objectives 5-1
CCS7 Protocol 5-2
Standardization 5-2
OSI Model and CCS7 5-4
UMTS CCS7 Protocol 5-5
Message Transfer Part Layer (MTP) 5-7
Signaling Connection Control Part layer (SCCP) 5-8
Radio Access Network Application Part (RANAP) 5-9
Transaction Capabilities Application Part Layer (TCAP) 5-10
Mobile Application Part Layer (MAP) 5-10
User Part Layer 5-10
Application Entities 5-11
UMTS CCS7 Protocol Architecture 5-13
Lesson 6
UMTS CCN Interfaces 6-1
Objectives 6-1
UMTS Interfaces 6-2
Iu-CS Interface 6-3
B-interface 6-6
C-interface 6-7
D-interface 6-8
E-interface 6-9
F/G-interfaces 6-10
Lesson 7
UMTS Call Signaling 7-1
Objectives 7-1
UMTS Procedures 7-2
UE Location Update Procedures 7-2
SuperCharger 7-6
Authentication and Key Agreement 7-11
Background 7-11
Translation Between 2G and 3G Security Information 7-12
Authentication Procedure 7-12
UMTS Security Mode 7-15

xvi Contents Nortel Networks Confidential
Integrity 7-15
Ciphering 7-17
Security Mode Call Flow 7-18
Call Processing 7-20
Mobile Station Paging 7-20
Paging 7-20
PSTN to Mobile Terminating Call Setup 7-21
UE to PSTN (mobile originated) 7-23
Mobile-to-mobile (UE to UE) 7-25
UE to UE call termination 7-27
Lesson 8
UMTS Handover 8-1
Objectives 8-1
UMTS Handover Overview 8-2
UMTS Handover Types 8-3
SRNS relocation 8-5
UMTS CCN Handover 8-6
RANAP and BSSMAP Handover Message Equivalency 8-7
Intra UMTS MSC SRNS Relocation 8-8
Procedure for Intra-UMTS MSC SRNS Relocation 8-8
Inter UMTS MSC Handover 8-10
Basic inter-MSC Handover 8-10
Subsequent inter-MSC Handover 8-12
Subsequent Handback Handover 8-14
Inter System Handover 8-16
Intra MSC Handover Procedures 8-17
Basic inter-MSC Inter System Handover 8-18
Lesson 9
UMTS Supplementary Services 9-1
Objectives 9-1
DMS-MSC Supplementary Services 9-2
Call Independent Supplementary Services (CISSs) 9-7
Supplementary Services (SS) 9-8
IMSI Based SS 9-9
BSG Based SS 9-9
Number Identification Supplementary Services 9-9
Call Offering Supplementary Services 9-11
Call Forwarding Busy 9-12
Call Forwarding Not Reachable 9-13
Call Completion Supplementary Services 9-15
Multi-Party Supplementary Services 9-15
Closed User Group 9-15
Charging Supplementary Services 9-16
Explicit Call Transfer 9-17
Malicious Call Trace (MCT) 9-17
Call Restriction Supplementary Services 9-17
Proprietary Services 9-23
Class of Service 9-23
Hotline Routing 9-25
Nortel Networks Confidential Contents xvii
Call Interception 9-25

Alternate Line Service 9-25
Local Calls only 9-25
Basic Services Matrix 9-26
Special Translation Enhancements 9-27
Extension Service 9-27
Software Option Control (SOC) 9-27
Extension Service Provisioning 9-27
Extension Service Sequential Alerting 9-28
Extension Service Simultaneous Alerting 9-29
UMTS02 Specific Services 9-30
LoCation Services Enhancements 9-30
Mobile Number Portability (MNP) Enhancements 9-33
IN Based Solution without SRF 9-34
IN Based MNP with SRF 9-35

xviii Contents Nortel Networks Confidential
Nortel Networks Confidential 1-1
Lesson 1
GSM/UMTS History and Characteristics
Objectives 1
Objectives
Given student lesson, instructor lecture, and appropriate

documentation, you will be able to:

Identify the driving forces that led to the development of
UMTS.
From the Circuit Core Network (CCN) perspective, describe
the basic components of a cellular system.
Describe the general characteristics of the UMTS network.
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 1. GSM/UMTS History and Characteristics 1-2

1-2 GSM/UMTS History and Characteristics Nortel Networks Confidential
UMTS History and Characteristics 1

GSM
A Third Generation of Mobile Systems: What for?

The Wireless Communications Generations
1st Generation 2nd Generation 3rd Generation
Digital
Worldwide
Analog Digital
not
IMT-2000
National Compatible
(ITU)
NMT GSM
TACS CDMA (IS-95)
AMPS D-AMPS
R2000 PDC
UMTS
CDMA 2000
1990 2000
In the early 1980s, the limitations of the existing analogue cellular systems
became obvious to European service providers.
The demand was increasing faster than the capacity of the existing
systems.
Incompatibility between the different systems did not allow mobile users
in the Total Access Communications Telephone Systems (TACS) to
access the Nordic Mobile Tlephone (NMT) networks. Likewise, the users
in the NMT networks could not access the TACS systems.
The redesign and implementation of a new system to overcome these
limitations would have been too costly for any single European market. The
solution seemed to lie in a new common design involving the cooperation of
several countries.
Nortel Networks Confidential GSM/UMTS History and Characteristics 1-3
In 1982, the governing body of European telecommunications, European Post

and Telecommunications Conference (CEPT) recognized the inadequacy of
existing analogue cellular systems. Two 25 MHz blocks of the electro
magnetic (EM) spectrum were allocated for a future Pan-European cellular
standard. Later that year, a group was formed under the title Groupe Spcial
Mobile (GSM) to develop this new common technical standard. In 1988, the
European Telecommunications Standards Institute (ETSI) was created and
most of the CEPT technical standardization activities were transferred to this
new body, including the GSM.
In 1990, interest in the GSM committee recommendations began to spread

beyond Europe. The United Arab Emirates, Hong Kong, New Zealand and
Australia expressed interest in adopting the GSM recommendations.
Australian service providers became the first non-European group to sign the
MOU in 1992.
CDMA
The origins of CDMA are in the military field and navigation systems.
During the 1950s, CDMA was used to counteract intentional jamming. It
may also have been used during World War II.
The first commercial launch of a CDMA system was made in September of

1995 by Hutchison Telecom in Hong-Kong. This system is known as CDMA
One, corresponding to the IS-95 standard completed in 1993. It is now used
all around the world, but mostly in the United States.
Spread spectrum is a highly efficient way of using the radio spectrum to

communicate, because it enables multiple users to share radio frequencies at
the same time, without interfering with each other.
D-AMPS
Advanced Mobile Phone Service: an analogue cellular communications
system derived from ADC and used in the US, and which operates in the 800-
MHz band. AMPS covers the entire country, and is utilized by 80% of the US
mobile phone subscribers. It has been introduced into the UK and Japan in
slightly modified form as the TACS system.
D-AMPS stands for Digital AMPS.
PDC
Personal Digital Communication: a digital cellular standard used in Japan.
Digital mobile phones have been standardized under PDC. In the case of the
PDC standard, primarily six channel TDMA technology is applied. PDC is a
standard unique to Japan, which renders such phone units incompatible with
devices that adopt the more worldwide prevalent GSM standard.

Third Generation Mobile Networks

International Mobile Telecommunications (IMT-2000) is the ITU
(International Telecommunication Union) vision of global mobile access in
the 21st century. IMT-2000 is a strategic priority of ITU. The key features of
IMT-2000 are:
high degree of commonality of design worldwide

compatibility of services within IMT-2000 and with the fixed network
high quality and integrity, comparable to the fixed network
accommodation of a variety of types of terminals including the pocket:
size terminal
worldwide roaming capability
capability for multimedia applications and a wide range of services like:
video-teleconferencing
high speed Internet
speech
high data rate up to 2 Mbit/s.
The Universal Mobile Telecommunications System (UMTS) is an ITU-2000
system incorporating mobile cellular and other functionality. The 3rd
Generation Partnership Project (3GPP) defines UMTS standards and
specifications. UMTS specifications are designed to encourage service
development so that operators can customize their service portfolio and allow
independent service providers to use the network.
Standardization Bodies
UMTS
T1 ETSI TTC / ARIB TTA CWTS TIA
3G *33
CDMA2000
3GPP includes five organizational partners:
ARIB and TTC from Japan

T1 from USA
TTA from Korea
ETSI from Europe
CWTS from China
Nortel Networks is also deeply involved with teams working on definition of
specifications.
UMTS uses a new radio technology called Wide Band Code Division
Multiple Access (W-CDMA) as opposed to the Time Division Multiple
Access (TDMA) radio technology used by GSM. The major difference being
that instead of using narrow radio channels which are time division
multiplexed, W-CDMA uses wide radio channels where each communication
channel is identified by a unique code. This allows greater flexibility in the
characteristics of the traffic channel that can be offered to the user. It also
enables easier radio planning, as there is no longer a requirement to ensure
that a buffer zone exists between transmitters using the same radio
frequencies.

Cellular System Architecture and Concepts 1

In modern cellular telephony, rural and urban regions are divided into areas
according to specific provisioning guidelines. Deployment parameters, such
as amount of cell-splitting and cell sizes, are determined by engineers
experienced in cellular system architecture.
What is a Cell?
The term cellular comes from the name given to the areas or cells into which
a coverage region is divided. Cells are represented as hexagonal in shape.
However, because of constraints imposed by natural terrain and man-made
structures, actual cells are not perfectly hexagonal in shape.
Cell Splitting
Splitting an area into smaller ones increases the number of served subscribers.
In this way:
Urban centers could be split into as many areas as necessary to provide

acceptable service levels in heavy traffic regions.
Larger, less expensive cells could be used to cover remote rural regions.
What is a Cellular Geographic Service Area?

Cells are grouped together in order to cover a region. These regions are called
Cellular Geographic Service Area (CGSA). Examples of CGSAs include
urban areas such as Paris and London or rural areas such as Westphalia,
Germany.
The following figure depicts one possible combination of cell deployed to

cover a geographic area CGSA.
Cellular Coverage in a CGSACell Splitting
Cellular Coverage in CGSA
24
23
23
Town
22 Rural
40
Suburb
100 60 60 60
24 Highway
100
100
20
60 100
100
20
UMTS Public Land Mobile Network Overview

A UMTS Public Land Mobile Network (PLMN) serves two main purposes:
To establish and process calls between UMTS and mobile subscribers
associated with that particular UMTS PLMN.
To give UMTS mobile subscribers access to users and services in existing
telecommunications networks, such as the PSTN, ISDN, and other UMTS
and GSM PLMNs.

Coverage Area of the UMTS PLMN

The entire coverage area of an UMTS PLMN is divided into subsections
called Location Areas, which are identified by Location Area Codes (LACs).
Location areas consist of cells (particular geographic locations) where the UE
does not need to update location and where the UE is paged for incoming
calls.
A location Area is managed by only one UMTS MSC.
UMTS-MSC Serving Area
UMTS-MSC Serving Area
UMTS Mobile-services Switching Center CCN

RNC RNC RNC
Node B Node B Node B Node B Node B Node B Node B Node B Node B
5
1 3 7 10 11 13 14 15 18
2 6 9 12
4 8 17 16
Location Area 1 Location Area 2 Location Area 3
The CS supports a maximum of 2048 Location Areas. The service provider

can provision anywhere between:
2048 location areas: 1 cell/location area

This example implies a high number of location updates.
8 location areas: 256 cells/location area

This example implies a saturation of paging channels when trying to
locate a UE for call termination.
Routing Area (RA)

A UMTS Routing Area (RA) contains a group of cells, each cell belonging to
one RA. RAs are used by the Core Network PS domain to get information on
the user location when in Idle mode. One RA consists of a number of cells
belonging to RNCs that are connected to the same CN node, for example one
Call Server. The mapping between one RA and RNCs is handled within the
SGSN owning the RA.
The following relations between LA and RA are possible:
RA and LA are identical.

One RA is a subset of one, and only one, LA, meaning that an RA does
not span over more than one LA.
Example of UMTS PLMN Coverage Area
3G SGSN
3G SGSN VLR
3G SGSN
VLR
RA 5
RA 2
RA 4
RA 3
RA 1
LA 3
LA 2
LA 1

GSM versus UMTS

In GSM15, for the first time, GSM software and UMTS software can coexist.
The GSM software is incremented from GSM13 and the UMTS software is
incremented from GSM14.
MSC Supports GSM and UMTS
MSC provides combined support for UMTS (3G) and GSM (2G) subscribers
TSC
BTS 2G
UMSC
&LUFXLW &RUH
RA2
RA1
RA1
LA1
Wireless ,QWHUQHW
GWY GGSN
RNC
3DFNHW &RUH
3G SGSN
RA1 Packet
SAC1 SAC2 ,QWUDQHWV
GwY
LA1
Since GSM15 supports both GSM and UMTS:
The CellId information is used when a call is accessed from a GSM radio
network.
CellId is used for both routing and services.
The SAC is used when accessed from an UMTS radio network.

RNCId is used for routing purposes and SAC is used for services.
Review Questions 1
1. List two third generation standards for mobile communication.
2. List three enhancements of the 3G Networks compared to 2G networks.
3. Define a Location Area.

Lesson 2
UMTS Architecture and Components
Objectives 2
Objectives

Describe the evolution of mobile networks towards UMTS.

Explain the basic UMTS architecture.
Describe the UMTS network components.
Introduce the Univity HLR.
List the components in the Nortel Networks implementation
of the UMTS Circuit Core Network.
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 2. UMTS Architecture and Components 2-2

2-2 UMTS Architecture and Components Nortel Networks Confidential
Evolving from GSM to UMTS 2

GSM Background
GSM Network Architecture
NSS
BSS
MSC
BSC TRAU
Um
A
Ater PSTN
Abis
B
MS
C
BTS
D VLR
HLR/
AuC
A GSM system is designed as a combination of two major subsystems: the

radio subsystem called the BSS (Base Station Subsystem) and the NSS
(Network and Switching Subsystem).
To ensure that network operators have several sources of cellular

infrastructure equipment, GSM decided to specify not only the radio
interface, but also the main interfaces that identify the different parts. There
are three main interfaces, as follows:
Um interface between the MS (Mobile Station) and BTS (Base

Transceiver Station)
Abis interface between BTS and BSC (Base Station Controller)
A interface between the BSS and NSS.
The BSS includes the equipment and functions related to the management of
connections on the radio path, including handover treatment. It consists of a
BTS, a BSC, and its associated component part: the TRAU (Transcoder/Rate
Adaptation Unit). The TRAU is called TCU (TransCoder Unit) within the
Nortel Networks products range.
Nortel Networks Confidential UMTS Architecture and Components 2-3
The NSS (Network and Switching Subsystem) includes the equipment and
functions related to end-to-end calls, management of subscribers, mobility,
and interfaces with the fixed network also called the PSTN (Public Switched
Telephone Network).
In particular, the NSS consists of MSC (Mobile services Switching Centers),

VLR (Visitor Location Registers), HLR (Home Location Registers), and AuC
(Authentication Center).
Evolving from a GSM to a GPRS Network
From GSM to GSM/GPRS Network
MSC
Um PSTN
PSTN
BSC TRAU
A
Abis Ater VLR

C
MS BTS
D
HLR/
Agprs AuC
Gr
GGSN
Gb Gb Private
Frame Private
Frame IPIP
Relay
Relay Backbone Gn
Backbone Gn Backbone
Backbone
PCU
SGSN Gi
External
PacketExternal
PacketNetworks
Intranet, Networks
Intranet,Internet
Internet
GPRS (General Packet Radio Service) adds two new network entities, the
SGSN (Serving GPRS Support Node) and the GGSN (Gateway GPRS
Support Node). There is no hardware impact on the BTSs. GPRS represents a
software upgrade of the BSS, except for the introduction of PCUs to support
the packet-oriented nature of the Gb interface between the PCU and the
SGSN.
The architecture of the GPRS is designed so that signaling and high-level data
protocols are system independent. Only the low-level protocols in the radio
interface must be changed to be capable of operating the same service.

The main functions of the SGSN are:
detecting and recording GPRS MS (Mobile Station) in its service area

sending/receiving data packets to/from the MS.
The main function of the GGSN is to forward data packets between an
external packet network and the GPRS network.
In addition to routing and data transfer functions, the SGSNs and GGSNs
collect charging statistics used as a basis for billing.
UMTS Architecture Overview 2

UMTS networks are a collection of communications systems that serve two
main purposes:
establishing and processing calls to and from UMTS mobile subscribers

allowing UMTS mobile subscribers access to services in other major
telecommunication networks such as the Public Switched Telephone
Network (PSTN), the integrated services digital network (ISDN), Internet
and corporate intranets.
To accomplish these tasks, UMTS networks are divided into subsystems
including:
User Equipment (UE)

Is the user access point to the system. It provides the user with the means
of speaking, receiving/transmitting data. The equipment is in general split
into three sub-parts:
TE (Terminal Equipment): the piece of equipment that is in direct

contact with the user (it can be the screen of the UE, or a connected
laptop for example).
TAF (Terminal Adaptation Function): is either integrated or separate,
and is in charge of making adaptation between the TE and the MT.
MT (Mobile Termination): is technology-dependent and provides the
means to access the network. It provides the functions common to all
services.
UMTS Terrestrial Radio Access Network (UTRAN)
UMTS uses a new radio technology called W-CDMA (Wide Band Code
Division Multiple Access) for the access network. The introduction of a
new radio technology led to the creation of a complete new radio access
infrastructure also known as UTRAN.
Core Network (CN)

The CN is split into:
The CS (Circuit Switched) domain. Is an evolution of GSM, with

substitution of the Iu-CS interface for the A interface and relocation of
the transcoders (TCU) to the CN side of the Iu-CS interface. The CS
domain uses 64 kbit/s TDM (Time Division Multiplexed) channels, it
provides a similar set of services to those provided by GSM.

The PS (Packet Switched) domain. Is based on GPRS, with

substitution of the Iu-PS interface for the Gb interface. The most
significant addition is a viable architecture for the QoS (Quality of
Service). This is essential for the support of voice and other real-time
media services on the PS domain. Other improvements have been
made to the GTP (GPRS Tunnelling Protocol) and the mobility
mechanisms. These changes are designed to make real-time services
viable over a packet infrastructure.
Network Management
Is used to manage the UMTS network, from the FCAPS functions: Fault,
Configuration, Accounting, Performance, and Security.
The following figure illustrates the subsystems of a UMTS network.
UMTS Architecure Overview
UMTS Architecture Overview
User Access Services

Circuit Domain
Terminal UMTS Terrestrial

Terminal Mobile
Adaptation Radio Access Network Core
Equipment Termination
Function (UTRAN)
Network
Packet Domain
User Equipment
Network
NetworkManagement
Management
UMTS Network Components 2
UMTS Network Components

UTRAN Core Network
Uu 3G MSC
RNC PSTN
Iu TRAU PSTN
Iub (ATM) (CS & PS) Iu CS
UE Node B B C
(BTS)
Iur
TRAU Circuit Domain
VLR D
SGSN HLR/
Uu AuC Internet
Internet
Iur Gr
Wireless GateWay
Iub (ATM)
Packet
Packet
Packet 3G
Backbone
Backbone Intranets
UE Node B Backbone GGSN Intranets
RNC
(BTS)
Iu PS Packet Domain
A UMTS network is composed of four major areas:
User Equipment (UE)

the UMTS Terrestrial Radio Access Network
a core network Packet Switched (PS) domain
a core network Circuit Switched (CS) domain.

User Equipment (UE)

User Equipment and Universal Subscriber Identity Module
User Equipment and USIM
Global UMTS Mobility

Card
The Smart Card to use
UMTS
Mobile
Equipment
Speech USIM Card
Subscriber IMEI
Data IMSI
MSISDNs Fax TMSI
The User Equipment provides generic radio and processing functions to access
the UMTS network through the radio interface. The basic mandatory features
of the MS are:
display of the called number
indication of the call progress signals
country/PLMN indication and country/PLMN selection
short message service
service indicator
emergency calls capabilities (possible without USIM card)
dual tone multi - frequency (DTMF)
support encryption
subscription identity management
error protecting
signal modulation.
The User Equipment includes radio equipment to receive and send calls
through the air interface. A human machine interface allows the subscriber to
access the services provided by the UMTS provider including voice, short
message, E-mail, video.
User Equipment can offer either an interface to the human user as a phone, or
an interface to some other terminal equipment such as a PC or fax machine.
The UE has two main working states:
idle mode
It listens to the broadcast channels but has no channel of its own.
dedicated mode
A bi-directional channel is assigned to it for its communications needs.
Each UE has an International Mobile Equipment Identity (IMEI) that is

stored in the UE. The IMEI contains the status of the UE (stolen, needs
maintenance, approved mobile). The operator can verify or change the status
of the IMEI stored in the Equipment Identity Register (EIR) at any time.
When the mobile station is in a visited PLMN, the MSC/VLR verifies the
IMEI status stored in the EIR and authorizes or rejects the mobile request.
The User Equipment consists of a handset into which a smart card called
Universal Subscriber Identity Module (USIM) is fitted.

Universal Subscriber Identity Module (USIM) 2

The USIM is the key that allows subscribers to access the UMTS network. It
includes important information that identifies valid subscribers to the network
and provides a list of the subscriber calling privileges.
USIM cards are plastic and contain a chip that houses subscriber information
such as the International Mobile Subscriber Identity (IMSI), the Mobile
Subscriber ISDN Number (MSISDN) and information used for security
functions. The following figure shows a USIM card.
USIM Card
USIM Card
USIM-CARD
15 mm
25 mm
Permanent data: Removable Data:

Unique mobile subscriber identity through IMSI Temporary Mobile Subscriber Identity (TMSI
number and P-TMSI)
Authentication parameter K Location Area Identification (LAI). Routing
Operator dependant: Area Identifier (RAI)
Authentication algorithm Ciphering and integrity keys: CK, IK
Encryption algorithm Short message folder

Personal Identity Number (PIN)
Programmable Data: Dialing shortcut
Mobile Subscriber Identity ISDN Numbers (MSISDN)

Because they provide access to the UMTS network, USIMs can be protected
by passwords similar in format to the Personal Identification Number (PIN)
used by most credit cards. One unique USIM feature allows users to
customize their passwords at any time.
USIMs contain information that identifies the subscriber to the UMTS

network.
The following information is contained in the USIM:

IMSI (International Mobile Subscriber Identity)
MSISDN (Mobile Subscriber ISDN Number).
Once the USIM card is removed from the mobile, the UE cannot be used
except for emergency call.
The IMSI number is unique to each individual UMTS subscriber. It is no

longer than 15 digits. The IMSI identifies to the UMTS network the home
country, the home network and the identity of the mobile subscriber. The
following figure describes the format of the IMSI number.
International Mobile Subscriber Identity (IMSI)
International Mobile Subscriber Identity (IMSI)
IMSI
Nature
International Mobile Subscriber Identity

(conformity with E212)
Format MSIN
MCC MNC H1 H2 x x x ......... x x x
Mobile Mobile Mobile Subscriber

Meaning Country National Ident. Nb
Code Code (national definition)
H1 H2 = Nb of logical HLR
Nb. Digits 3 2 max 10

The MSISDN is the number dialled when a call is placed to a UMTS mobile
subscriber. It contains the subscriber country code, the national destination
code and the subscriber number. It is no longer than 15 digits.
The following figure displays the format of the MSISDN.
Mobile Subscriber ISDN Number (MSISDN)
Mobile Subscriber ISDN Number (MSISDN)
MS - ISDN
Nature
Mobile Station ISDN Number

(conformity with E164)
SN
Format CC NDC M1 M2 xx xx xx xx
Country National Mobile Subscriber

Code Destination (national definition)
Meaning Code * M1 M2 = identify the HLR
1 to 3 2 to 4 total max 15
Nb. Digits
Note: This code may indicate a service area or an operator.
For example: 1 972-423-3632
a. where CC = 1 = USA
b. NDC = 972 = Dallas, Tx area code or
c. SN = Subscriber Number
For example: 49 171 5205787
a. where CC = 49 = Germany
b. NDC = 171 = D1 operator
c. SN = Subscriber Number
UMTS Terrestrial Radio Access Network (UTRAN) 2
UTRAN Architecture
UMTS Terrestrial Radio Access Network (UTRAN)
Uu
RNC
Iu
Iub (ATM) (CS & PS)
Circuit Domain
UE Node B
(BTS) Iur
Iu CS
Core
ATM
Backbone
Iu PS
Network
Iur
Uu
Packet Domain
Iu
Iub (ATM) (CS & PS)
UE RNC
Node B
(BTS)
A UMTS UTRAN is composed of one or more Radio Network Subsystems

(RNSs).
Each RNS is made up of one or more Radio Network Controllers (RNCs).
Each RNC controls one or more UMTS Node B Base Transceiver Stations
(BTSs), which communicate with the User Equipment devices.
The core network uses the Iu interface to communicate with the RNCs,
including both Iu CS (Circuit Switched) and Iu PS (Packet Switched)
sessions.
The RNCs use the Iub interface to communicate with the radio towers.

Nortel Networks Implementation of the Circuit Switched Domain 2

The Circuit Switched (CS) domain:
Performs the main circuit switching functions of a UMTS network.

Contains the databases that create, manage and store data for subscriber
identification and mobility.
Is also called the Circuit Core Network (CCN).
Nortel Networks implements the CS domain using the components depicted
in the following figure.
Nortel Implementation of the CS Domain
Nortel Implementation of CS Domain
AuC
AuC
DMS-HLR
DMS-HLR
IuCS IWF
VLR
VLR VLR
VLR
Wireless Gateway Gateway
Other UMTS,
PSTN, or ISDN
Iu DMS-MSC
DMS-MSC
DMS-MSC DMS-MSC
Universal
Universal
Terrestrial
Terrestrial
Radio
RadioAccess
Access
Network EIR
Network
(UTRAN)
(UTRAN)
SMS-
SMS-SC
The two major products used to implement the UMTS CS domain are:
DMS-MSC with integrated VLR
DMS-HLR with integrated AuC.
The DMS-MSC performs all of the call processing, switching, interface,

handover and other functions required of an 3G MSC in a UMTS network. It
also contains an integrated VLR. The DMS-MSC is also called Call Server
(CS).
The DMS-HLR supports all the functions required of an HLR in a UMTS

network. It also contains an integrated AuC, which helps to ensure that only
authorized users have access to the network.
The MSC and the HLR are built on the DMS Supernode or Supernode SE
cabinet and also perform functions as a Signaling Transfer Point (STP).
The following CCN components are available as stand-alone units:

SMS-C
EIR
InterWorking Function (IWF)
billing server.
Digital Multiplex System-Mobile Service Switching Center (DMS-

MSC) 2
The DMS-MSC performs the following functions:
establishing and routing calls from and to UEs
performing digit translations
handling call control, signaling and billing capture
providing handover service support
providing supplementary service support
providing short message support
echo control.
Integrated Visitor Location Register 2

The DMS-MSC implements the VLR as an internal database, residing
entirely in the DMS eXtended Architecture Core (XA-Core) memory. This
database stores permanent and temporary location information about mobile
stations. When a mobile station roams into a service area outside its assigned
geographic area, data is furnished to the DMS-MSC to support call routing.
The VLR performs the following functions:

allocation of TMSI
allocation of MSRN and HONs
authentication
supplementary service support (call barring, call forwarding, etc.)
mobility management
subscriber status management.

Wireless Gateway 2
The Wireless Gateway (WG):
Is a common Iu interface termination point for PS (Packet Switched) and

CS (Circuit Switched) domains.
Provides signaling and bearer services across both Circuit and Packet
Domains, as well as communication between the Core and Access
Networks.
Is part of both the 3G-MSC and the 3G-SGSN according to the 3G
Standards definitions.
Nortel Networks chose to have a single product, the Wireless Gateway,
housing the SGSN functionality (PS domain) and the TRAU functionality
(CS domain).
The WG is located between the RNC and the other Core Network nodes.
The functional elements of the WG are:
3G-SGSN
Signaling Gateway (SG)
Virtual Media Gateway (VMG)
Aggregation Node (AN).
TRAU
The Transcoder/Rate Adapter Unit (TRAU) is a device that takes UMTS
speech packets and converts them into standard ISDN 64 Kbit/s speech
packets.
In UMTS, this functionality is part of the Core Network.
Some optimization procedures allow to pass through it, without transcoding,

in the case of UE to UE communication for example, when double-
transcoding would be performed for nothing. In UMTS the default vocoder is
the Adaptive Multi Rate (AMR) vocoder. Its rate varies between 12.2 kbit/s
and 4.75 kbit/s.
But the rate in the CS domain is still 64 kbit/s.
The TRAU interfaces with:
the RNC through the ATM backbone (AAL2 layer used for UMTS)
the DMS-MSC Call Server with PCM links.
Digital Multiplex System-Home Location Register (DMS-HLR) 2

The DMS-HLR supports all the required HLR functions in a UMTS network.
It is the central database for both temporary and permanent information for
mobile subscribers in a wireless system. The HLR updates temporary
information such as current location in real-time from the network.
Permanent data changes only when the service provider (the telephone
company) manually amends it. It also contains an integrated AuC, which
helps ensure that only authorized users have access to the network.
From a hardware point of view, the DMS-HLR is similar to the DMS-MSC.

The DMS-HLR performs the following functions:
provisioning of subscribers
provisioning of basic and supplementary services
provisioning of roaming restrictions
location information indicating which MSC is curently serving the UE.
Univity HLR
The new Univity HLR evolves the present DMS HLR in all areas of HLR
capacity; network routing, footprint reduction, subscriber management and IP
based signaling for future R5 functionality.
The following figure illustrates the NSS16 HLR configurations.
NSS16 Based HLR Configurations
HLR Univity
GSM HLR
SBA Core
Element
Mgr
SDM
XA Core IPIP
FLPP
MS
ENET
OAU
USP
SS7
SS7

Univity HLR introduces:
M3UA/IP connection between USP and HLR

USP replaces LIU7/LPP
USP provides many link types and high capacity
Depending on sofware package, USP 8.0 gives:
480 V35,DS0 and Channelized links at 56 or 64Kbit/s
56 ANSI HSL (1.544 Mbit/s)
each equivalent to up to 20 64Kbit/s links
56 E1 HSL
56 IP HSL (SCTP/M2PA 10/100 Mbit/s)
each equivalent to up to 20 64Kbit/s links
USP Components in the HLR Platform

The Universal Signaling Point (USP) interfaces to the SS7 network and the IP
network. It terminates SS7 links from the PSTN network and terminates IP
links from the IP network.
The USP:
Enhances the signal capacity of the DMS-HLR by offering more signaling

links and a greater number of point codes in order to cater for future
growth.
Provides an IP interface to the XA-Core as well as a variety of SS7 to the
network such as V35, E1/T1, ATM High Speed Links and IP High Speed
Links.
The following figure illustrates the Communication Application Module

(CAM) shelf.
Communication Application Module (CAM) Shelf
Transition module
18 card slots front and rear
19-inch & 23-inch mounting
48 VDC A/B power

Redundant cooling unit
EMI compliance
VME 6U cards
Latest VME standard mechanics
(VME64, 1101.10)
Mission card
DMS-HLR USP Support

The USP replaces the LIU7 (Link Interface Unit for SS7 networks)
functionality for both ITU (International Telecommunication Union) and
ANSI (American National Standards Institute) links.
The USP offers more signaling links and a greater number of point codes in
order to prepare future growth.
This feature is the in-service cutover Method Of Procedure (MOP) from LPP
(Link Peripheral Processor)/FLPP (Fiberized LPP) to USP. This covers both
point to point links as well as channelized links (E1/T1).
Note: This feature requires USP version 8.0.

HLR-USP Interface: Hardware Configuration

Core Core
maintenance maintenance
address XA-Core address
47.135.238.34 47.135.238.35
High Performance High Performance
Input/Output Processor Input/Output Processor
Card2 IP
Card1 IP 47.135.238.33
47.135.238.32
Fault Tolerant 47.135.238.240

Ethernet Switch
IPLink card IPLink card IPLink card IPLink card
USP
SS7 card SS7 card
SS7 Network
SS7 Network
The IP connection to the USP on the XA-Core is facilitated by the High

Performance Input Output Processor (HIOP) cards which are located on the
XA-Core shelf. The HIOP cards provide an ethernet interface which connects
the XA-Core to the USP.
The USP has an IP interface facing the XA-Core and a SS7 interface facing
the network. The SS7 interface supports a variety of link types including
ATM High Speed Links (HSL), E1/T1 channelized links and IP HSL.
Integrated Authentication Center (AuC) 2

The AuC:
Is a database that is stored in the memory of the HLR.

Protects both the user and the operating company from fraud by securing
subscriber identity.
Generates Authentication Quintets.
The DMS-HLR implements the AuC internally, placing the HLR and AuC in
the memory of the DMS XA-core. This format provides the full functionality
of the AuC as described in the UMTS recommendations with added speed
benefits.
Equipment Identification Register (EIR) 2

Equipment Identity Register (EIR)
Equipment Identity Register (EIR)
CEIR
CEIR
PLMN Equipment
Equipment Identity
Identity Register
Register
FTAM Security
Security equipment
equipment defined
defined by
by GSM
GSM MoU
MoU
and
and 33 GPP
GPP
EIR Checks
Checks Mobile
Mobile IMEI
IMEI against
against three
three lists
lists
HLR
Central
Central EIR
EIR (CEIR)
(CEIR) per
per geographical
geographical region
region
MAP IMEI Check
MAP
IMEI Check Resp Operator
Operator Values
Values
(Black, Grey or
Block
Block use
use of
of unapproved
unapproved or or stolen
stolen Mobiles
Mobiles
MSC MSC White)
Mobile
Mobile inventory
inventory tracking
tracking
NORTEL
NORTEL EIR
EIR Solution
Solution
NORTEL
NORTEL has
has selected
selected the
the Teleguard
Teleguard EIR
EIR
product
product from
from Aldiscon
Aldiscon (Dublin,
(Dublin, Ireland)
Ireland)
EIR in a
Leader
Leader in
in EIR
EIR installations
installations -- European
European
UMTS Network Central
Central EIR
EIR (CEIR)
(CEIR) inin Dublin
Dublin
The EIR is a database that performs a screening function within the network.
The EIR tracks all valid and non-valid UEs by storing their International
Mobile Equipment Identities (IMEI). Each UE is inscribed with a registration
(serial) number when it is made as shown in the above figure.
The MSC periodically or through a percentage of selection of mobile activity

will request the IMEI of the mobile subscriber and initiate a check of this
IMEI with the EIR. The DMS-MSC will initiate a check of IMEI based on the
percentage of the following transactions: Mobile Originated Call (speech,
data), Mobile Terminated calls (speech, data), Short Message originated or
terminated. Location Update Procedures are not candidates for IMEI
Checking.
The EIR maintains three lists of IMEIs which categorize UEs as being permitted
to use the network, barred from using the network or suspicious (that is,
delinquent on payments or faulty).
The three lists are:
white list - equipment OK
black list - equipment stolen or being used fraudulently
gray list - temporary equipment fault.

UMTS Short Message Service Center (SMS-C) 2
UMTS Short Message Service Center (SMS-C)
PLMN
HLR MAP
Integrated
Integrated Text
Text Messaging
Messaging
Capability
Capability on
on the
the Mobile
Mobile
MSC MSC
Stations
Stations
MAP
SMS-C Messages
Messages sent
sent or
or received
received while
while
Mobile
Mobile idle
idle or
or engaged
engaged in
in calls
calls
Guaranteed
Guaranteed delivery
delivery
Confirmed
Confirmed message
message delivery
delivery option
option
Operator
Operator and
and Subscriber
Subscriber Values
Values
Voice
Voice Mail
Mail Alert
Alert
Creation
Creation of
of innovative
innovative services
services
Key
Key differentiator
differentiator to
to build
build market
market
share
share
Mobile to
Mobile
Short
Messaging Meeting rescheduled
at 14h00, same place.
John
The SMS comprises the following components within the network: the SMS-
C where short message delivery or reception is handled and an SMS-Gateway
MSC (dedicated MSC with the capability to initiate transfer of short message
to the MSC where the subscriber is currently located) as shown in the figure
above.
When a mobile subscriber initiates a short message, the MSC will forward the
short message to the appropriate SMS-C for the designated mobile subscriber.
The SMS-C will then set a priority for the message to be sent and attempt to
send the short message (via the SMS-GMSC) towards the terminating mobile.
If the mobile is not available (detached) or delivery fails, the VLR of the
mobile subscriber will set a flag to indicate that a message is awaiting the
subscriber. The Gateway MSC will be informed of the delivery failure and
will notify the HLR to set a message waiting data indication against the
subscriber (SMS-C address).
The mobile on returning to the network will trigger the VLR to inform the
HLR (update location procedure). The HLR is tasked to alert the appropriate
SMS-C(s), at which point the SMS-C will resend the waiting message.
The main customer applications:

simple person to person messaging
voice mail and fax notifications
unified messaging
Internet email alerts
ringtones
information services.

UMTS InterWorking Function (IWF) 2

IWF to DMS-MSC Connection
IWF to DMS-MSC Connection
PSTN
PSTN
DMS-MSC
DMS-MSC
Modem
RNC
Copyright 1996 Northern Telecom
IP
IP
E1/T1 E1/T1
Digital Card Modem Ethernet
Conversion
Conversion
Local Console Remote Management Console
IWF
The IWF is an optional function of the DMS-MSC that is hosted in a GSM

PassPort (GPP) as shown in the above figure.
The IWF logically consists of a Digital Interface for transmissions towards

the Mobile and a Modem Interface for transmissions towards the PSTN.
Each interface is connected to the DMS-MSC via an E1 connection to
provide for data call setup, establishment and release. Control of these
connections for the duration of a data call is provided via an Ethernet (EIU
card located in LPP cabinet) connection utilizing UDP/IP.
It provides the following advanced services:

facsimile group 3
alternate speech and facsimile group 3
circuit duplex asynchronous data transfer
V42 bis data compression
14.4 kbit/s user data rate
wireless Internet access to an Internet service provider.
The GPP IWF:

Is a translation and conversion point in a digital cellular network.
Provides the required rate adaptation, radio link protocol and modems for
interfacing the digital UE with the PSTN or ISDN.
Note: One GPP IWF can be connected to six DMS-MSCs.

HLR Mated Pair Architecture 2

The HLR is a critical component in the UMTS network. If a complete loss of
an HLR occurs, a loss of service to the associated subscribers occurs:
loss of all incoming service
inability to change location or join the network
inability to be authenticated if a Visitor Location Register (VLR) requires
fresh vectors and make calls
inability to perform Call Independent Supplementary Services (CISS)
inability to change subscriber services/data
To protect the subscriber against an HLR loss, the Mated Pair Disaster
Standby function allows:
two geographically separate HLRs (a mated pair) to provide a mutual

standby capability as shown in the following figure.
Standby with Geographic Redundancy
Standby with Geographic Redundancy
Up to Date Copy of
Complete
Copyrig ht 1996 Nor thern Telecom
Subscriber
Database
HLR 1 HLR 2
Geographic
Redundancy
Service is
Maintained for DMS-MSC
Customers
Administration Diversion
Administration Diversion
Subscriber B
is Standby
Copyrig ht 1996 Nor thern Telecom
Subscriber B
is Active
The normal administration includes:
Response
Provisioning Server (HLR-PS)
Request
for B supports Mated Pair.
Like Message Diversion, HLR-PS can

TCP/IP
A A be used to support four HLRs with
Request
Peer and Standby Diversion.
B Re-routed B
SDM/FT SDM/FT
Automatic re-routing locates active
HLR 2
subscriber.
Active subscriber distribution is
managed.
Active Single HLR operation is automatically
Standby
handled.
Both HLRs have a copy of the data for all subscribers, however responsibility
for processing requests for subscribers is split between the nodes as shown in
the above figure.
The subscriber is regarded as:

acting in one node
The HLR provides service to these subscribers:

standby in the other
The HLR acts as a backup for these subscribers. This HLR only provides
service to standby subscribers in the event of a disaster occurring to its mate
HLR.
Mated Pair Diversion Messages are optional. They result from the fact that
the Acting/Standby status is a relatively static arrangement which can only be
changed by the operator.

If a disaster happens to one HLR in the pair, the surviving HLR:

Continues to treat the acting subscribers with:
no loss of data integrity,
a possible loss of service.
Takes over the treatment of the standby subscribers with:
some loss of data integrity due to data discrepancy,
loss of service resulting from lost messages not processed by the
failed node.
UMTS Network Management 2
Preside for Wireless Internet

A comprehensive, pre-integrated management solution tailored to meet the needs of
UMTS service providers
Customer Management
Service Management
Service Accounting Service Provisioning
Network Management
Network Management Platform Performance Management Trouble Ticketing Interface
Fault Management Charging Gateway Function OSS Interfaces
Network Element Configuration INA (DNS/DHCP) Management
Interfaces
M edia
O ther Server
W AP
G atew ay
Apps & Service Platforms Packet & Circuit Cores Radio Access
* Four domains are indicative of UMTS coverage.
Nortel Networks delivers complete, end-to-end, next-generation network,

service and customer management capabilities to Wireless Internet service
providers. With these Nortel Networks solutions, Wireless Internet service
providers can manage their networks efficiently and effectively and deliver
profitable, high performance services to their customers.
The Nortel Networks offer addresses three key management needs of UMTS
service providers:
Network Management
managing the UMTS network (across the radio access, circuit core,
packet core and applications and services domains).
Service Management
managing the voice services, data services and high value applications
delivered on the network.
Customer Management
managing and empowering the customers who use these services.

Fault, Configuration, and Performance Management

Architecture
Presentation,
Graphical User interfaces, OSS interfaces NSP, Fault and Performance
Management clients
Fault, Performance
Configuration, Performance
Processing
NSP, Fault Management

Application Building Blocks applications, Performance
Management applications
Fault Configuration
Performance
Access Device Adapter, XA-Core

Device Adapters Device Adapter
Fault
Fault
MDM, OMC-S
Element Management Systems
Fault, Configuration, Performance
Network Elements iRNC, DMS-MSC, GGSN
The PWI (Public Windows Interface) UMTS Solution is pre-integrated,

delivering a superior management solution that reduces the delays and risks
associated with extensive system integration. Because it is built around a
standards-based, open and modular architecture, it can also be easily
customised or integrated with other third party management systems. This
forward-thinking approach to solution design contributes to faster network
deployment, improving operators time-to-market and competitive
positioning. In other words, it helps generate profits more quickly, with
lowered risk.
Operations and Maintenance Center - switching (OMC-S)

Preside will support the OMC-S allowing the UMTS operator to view and
control the CCN components through a Graphical User Interface (GUI).
Review Questions 2
1. What are the major subsystems of the UMTS network?
2. Name 5 components of the Circuit Core Network.
3. List 4 functions of the DMS-MSC.
4. List 4 functions of the DMS-HLR.
5. What types of information does the USIM contain? Describe them.

Lesson 3
OAMP & Added Components
Objectives 3
Objectives
Given student lesson, instructor lecture and appropriate documentation,

you will be able to:
List the different operation administration maintenance &
provisioning (OAMP) functions based on the Supernode Data
Manager-Fault Tolerant (SDM/FT):

9 Operation & Maintenance Center-switch (OMC-S)
9 HLR-Provisioning Server (HLR-PS)
9 Call Intercept System (CIS)
9 SuperNode Billing Application (SBA)
Have an understanding of:
9 Voice Mail System (VMS)
9 Echo Canceller (EC)
9 Intelligent Networks (IN)
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 3. OAMP and Added Components 3-2

3-2 OAMP & Added Components Nortel Networks Confidential
Added Components 3
Added equipment consists of systems manufactured by companies other than
Nortel Networks that are integrated into the network to provide additional
functionality.
Added equipment can include some or all of the following components listed
hereafter.
Voice Mail System (VMS)
Short Message Serve Center (SMS-C)
customer care and billing system
network management center
equipment identification register.
An example of a Nortel Networks UMTS network with integrated added

equipment is shown in the following figure.
Note: The above list is not exhaustive.
UMTS Network and Added Components
UMTS Network & Added Components

Intelligent Networks
Customer
Customer Care
Care &
& Billing
Billing System
System
Network
Network Management
Management Center
Center
IP
OMC-S SCP
SMS
VMS EIR
CIS
OMC-S
LAN
LAN VLR AuC
DMS-MSC
HLR-PS
SDM/FT DMS-HLR SDM/FT
IWF
B EC
SR Wireless
N CN Gateway
o C
d N
e o
B d PSTN
e PSTN
UTRAN B
Nortel Networks Confidential OAMP & Added Components 3-3
Equipment vendors whose systems Nortel Networks uses to supply the added
equipment solutions are:
Hewlett Packard
Sun Microsystems
Comverse Technologies
Glenayre
Aldiscon
OSI
Motorola
Sema
Some examples of equipment and the suppliers include:

VMS service equipment is manufactured by Glenayre or Comverse
SMSC and EIR systems are manufactured by Aldiscon
Customer Care and Billing systems are manufactured by Sema.

SuperNode Data Manager Fault/tolerant Cabinet 3

SDM/FT and its Applications
SDM/FT and its Applications
SuperNode
HLR-Provisioning OMC-S Call Intercept
Billing
Server Element Manager System
Application
TCP/IP
TCP/IP TCP/IP TCP/IP TCP/IP
LAN/WAN
LAN/WAN
TCP/IP
TCP/IP
HLR
SDM/FT
SDM/FT DMS-HLR SDM/FT
SDM/FT DMS-MSC
DMS-MSC
DMS-HLR
ANSI/ETSI ISUP
(PET7) ANSI/ETSI ISUP
(PET7)
PLMN
The SuperNode Data Manager/Fault Tolerant (SDM/FT) platform employs

Motorola-supplied fault tolerant computing hardware that is based on the
PowerPC family of processors as shown in the above figure.
It provides:
high performance, fault tolerant computing
redundant I/O buses, mirrored disk storage, and redundant
communications ports
industry standard hardware interfaces
a wide selection of third-party software and software development tools
scalability and upgradability.
Data is stored in redundant mirrored disks. Communication between the SDM

and the DMS XA-Core is conducted over redundant direct DS512 links to
both sides of the message switch.
OMC-S Element Manager

OMC-S
OMC-S Server on a Sun Platform
OMC-S browser
LAN/WAN
OMC-S
server
TCP/IP
TCP/IP
TCP/IP
DMS-MSC
DMS-MSC DMS-MSC
DMS-MSC
DMS-MSC
DMS-MSC
SDM-FT SDM-FT SDM-FT
The Nortel Networks OMC-S product is designed to offer efficient operations

and maintenance capabilities as shown in the above figure.
Within a customer Circuit Core Network, the OMC-S:

Allows a centralized management of multiple DMSs.
Provides operators with the following three toolsets:
configuration management
fault management
performance management.
Takes advantage of the secure and powerful hardware, based on an SDM-
FT platform.
The SDM/FT is a UNIX-based computing platform on which a variety of

services and applications can be hosted to provide OAM&P services to
the DMS.
On engineering requirements, OMC-S server can be installed on a SUN

platform.

OMC-S Element Manager Application

The OMC-S Element Manager manages the administrative and maintenance
operations within a Public Land Mobile Network (PLMN). PLMNs consist
of switching and radio subsystems.
The OMC-S Element Manager application is installed on a Pentium-based PC

workstation, which manages the network elements and performs the following
functions:
Configuration Management (CM) also known as resource discovery
application:
Uses information available in tables.
Displays existing elements in any managed DMS.
The Configuration Management application uses a graphic
representation of the DMS nodes, links and trunks to model a
Telecommunication Management Network (TMN) containment tree.
In the TMN containment tree, each node, link or trunk is represented
by a Managed Object Instance (MOI) identified with icons.
Fault Management (FM)

Uses information available in log reports.
Displays alarms and statuses on any managed DMS.
Performance Management (PM)
Uses information available in operational measurements (OMs).
Displays performance metrics of any managed DMS.
Traces call information related to individual mobile subscriber
activity in the PLMN to determine networks problems or tracking
subscriber activity.
In addition, the OMC-S Element Manager application:
Serves as Graphical User Interface (GUI) to the SDM/FT and the switch.
Provides access to the elements from a Maintenance and Administration
Position (MAP) pass-through.
In GSM16, the Core Element Manager (CEM), referred as OMC-S, can
monitor Passports, Data Packet Network (DPN), and any element that the
Preside Multi-service Data Manager (MDM) monitors.
USP Graphical Interface

The OMC-S provides operational, administration, maintenance, and
performance management of the Universal Signalling Point (USP) through the
OMC-S Element Manager:
Manages USP alarms in the OMC-S alarm list.
Provides configuration management and maintenance through the USP
Graphical User Interface (GUI).
Provides performance management through storage and retrieval of USP
performance data.
Launching the UPS Interface

Before launching the USP GUI, you must install it on the PC.
1. To launch the USP interface, select the USP GUI menu item in the
Tools Menu.
2. The USP GUI opens the Launch GUI command line box
The Launch GUI dialog box displays when the command to
launch is not found. This occurs even if the Dont ask again
box has been checked.
3. Clicking the OK button launches the USP GUI.

2
1
4. This screen prompts the user to select the connect USP

site or to configure the desired USP.

The folowing figure illustrates the possible launching of the MDM tool.
Launching OMC-S from Preside Desktop

Seamless integration with Preside desktop & Preside servers

In context launch from NE icon in Preside Desktop
Integrated FM & PM view of NE
Access to component-level fault summary
Access to detailed component-level performance data
HLR-PS Application
HLR-PS General Architecture
HLR-PS General Architecture
HLR-
HLR-PS
X.25
Network Transfer Network PSTN
NFS Manual Transfer

32 Links RS-232 or
TCP/IP
X.25 TERMINAL FTP
GATEWAY SERVER
LAN
TCP/IP
Service Provisioning S Subscriber Creation

AuC
AuC
D
Per-sub service provisioning Console M SIM Personalization
Bulk service provisioning / Supports DES decryption of Ki
Supports up to 32 links F
T Batch creation and deletion of
subscribers
DAT Tape
DMS-HLR
Provisioning Interfaces
The HLR-PS application is attached to a DMS-HLR as shown in the above
figure.
The provisioning interfaces are proprietary and the interface specifications

are maintained and published by Nortel Networks.
The HLR-PS provides the following provisioning interfaces:

Administration Center (AdC) provisioning interfaces between a
customer AdC and the DMS-HLR manipulates subscriber data on the
DMS-HLR interactively. A single MSP message can retrieve or modify
any number of subscribers services/attributes. One AdC message is
processed at a time, it must wait for a response before sending another
MSP message in for processing.
AdC is a third party vendor equipment or can be developed by operators.
The Administration Center is not provided with the HLR-PS.
The AdC Provisioning Function provides a network operator with the

ability to add, delete, modify and display a mobile subscriber data
maintained on the DMS-HLR, using the proprietary provisioning protocol
Mobile Subscriber Provisioning (MSP).

The AdC interface has been designed for interactive use for real-time
updates. For example, subscribers can telephone a customer care center to
request changes to their service subscription.
Bulk Service Provisioning (BSP) interface enables a BSP source (e.g.

AdC or BSP) to capture several provisioning operations within data
files. BSP files are text files that contain MSP commands. There can be
any number of BSP files waiting to be processed.
The results of the provisioning operations are recorded in a file and

transferred back to the BSP source.
BSP supports up to 32 sources of bulk provisioning files that correspond

to one BSP source per AdC.
The bulk file format supports:

all the provisioning commands and data provided by MSP
software upgrade of the HLR-PS by versioning the MSP contained in
the bulk files and the file format itself
authentication of the source of the bulk file
BSP supports VHLR capabilities to enforce partitioning of subscriber
data
optional encryption of both input and output files using filters and
keys that are configured on the HLR-PS.
BSP scheduling controls on the HLR-PS allowing process periods to be

configured when BSP files can, or cannot, be processed.
Note: Bulk provisioning operations can be processed out of peak hours.
The BSP files, containing provisioning commands, are created with a

certain file format.
BSP files can be encrypted and transferred to the HLR-PS as follows:

the HLR-PS reads the file and initiates the commands to the DMS-
HLR
a results file is created with the results of every provisioning
command in the corresponding input file.
Call Intercept System

Call Intercept Centralized Configuration
Call Intercept Centralized Configuration

Service Provider Site Security Agency A
Security Agency B
CALL INTERCEPT MONITORING CENTERS
MONITORING CENTERS
PROVISIONING CENTER
Call Contents CADRs/

NCADRs only CADRs/
Provisioning ANSI/ NCADRs only Call Contents
ETSI-ISUP ANSI/
X.25 or Ethernet Network ETSI-ISUP
TCP/IP
LAN
TCP/IP
FTAM/X.25
TCP/IP Ethernet
TCP/IP-Ethernet
TCP/IP
DMS-
MSC
DMS- ANSI/
MSC ANSI/ SDM/FT
Call Contents ETSI-ISUP
ETSI-ISUP
Provisioning PET7
PET7
SDM/FT PLMN
CADR/NCADR &/or
Provisioning
The Call Intercept System (CIS) is attached to a DMS-MSC and performs the
following main functions as shown in the above figure.
Call Monitoring
Every voice call that either originates from or terminates at a targeted
subscriber, and every non-call mobility event, is intercepted at the DMS-MSC,
and routed to the monitoring center of the authorized agency. Both call contents
and the associated call data are intercepted and routed to the monitoring center.
call content of the intercepted call is sent using voice trunks
Call monitoring is undetected by the monitored target subscriber.
call associated data of the intercepted call is sent as Call Associated Data
Records (CADRs) over X.25 or Ethernet data lines
CADRs contain information about a particular event associated with the
monitored call.
Note: The release for CIPC is the last release before the new IAF
platform.

non-call associated data of the intercepted call is sent as Non-Call

Associated Data Records (NCADRs) over X.25 or Ethernet data lines
The MSC generates the non-call associated data for mobility related
events of the target subscriber. NCADRs contain information such as
normal location updates and International Mobile Subscriber Identity
(IMSI) attach/detach.
The provisioning center allows for call interception a maximum of 32K

monitoring instances on any particular MSC.
Up to five monitoring centers may monitor a particular mobile subscriber at a

time.
Each MSC allows a maximum or 1024 (1K) simultaneous monitoring.
Call content, call associated data, and non-call associated data of voice calls
only are reported. Data communications and Type 1 emergency calls are
supported for call interception.
Call Intercept System Provisioning

The CIS allows either an authorized security agency, or the service provider
on behalf of an authorized security agency to provision mobile subscribers for
call interception.
A provisioning operator performs the following functions at the CIPC:

provision or deprovision target subscribers for call interception
distribution of provisioning information to specified MSCs within the
service provider network
generation of daily journal reports for each security agency that contain
summaries of provisioning and deprovisioning activities.
SuperNode Billing Application

The SuperNode Billing Application (SBA) is a robust high capacity billing
system designed to work with the SuperNode Data Manager/Fault Tolerant
(SDM/FT) product running the AIX operating system. UMTS SBA (USBA)
is the next generation application to support UMTS billing streams on the
SDM, which replaces the File Processor (FP) Billing Application.
SBA features include:
UMTS record and file formats, using the Device Independent Recording
Package (DIRP)/DRM file format with additional auxiliary records.
Transmission Control Protocol (TCP) Base Interface allowing Near-Real
Time and Hot Billing
MSC Tape backup and restore capability at the XA-Core to handle long
SDM outages
Tape backup on the SBA
Cdrview supported in the SDM for UMTS billing
Inbound File Transfer Access and Management (FTAM) interface for
SDM.
UMTS SBA Interface Architecture
UMTS SBA Interface Architecture
UMTS DMS Customer

Customer
Downstream
DownstreamBilling
Billing
Processor
Processor
FTAM/802.3
DS 512
4 mm DAT Tape
Local
LocalArea
Area
SDM/FT
SDM/FT Network
Network
USBA
USBA (LAN)
(LAN)
FTP
Customer
CustomerDownstream
Downstream
Billing
BillingProcessor
Processor

Voice Mail System

Voice Messaging Services (VMS)
Voice Messaging Services (VMS)

Why Voice Messaging? Call Answering
Benefits for Mobile Subscribers
9 No more missed calls Busy/No
Answer
9 Notification of messages waiting
9 Multimedia messaging Msg
9 Advanced and unique services Caller
Deposit
VMS Alert
Benefits for Operators T1/E1 (SMS) Mobile
9 Increased Call Completion rate and Air time
9 Increased revenue SS7/ISUP
Msg
Retrieval
9 Rapid return on investment
9 Increased market penetration
Voice Mail System MSC
NORTEL VMS solution Call Answering generates increased revenue and
air time via Message Deposit and Retrieval
- Comverse TRILOGUE INfinity - Glenayre MVP

- Leader in Digital Wireless - Cost-effective solution for small
Operators
- For medium and large Operators - Cost-effective solution for medium
Operators
The MSC supports access to an integrated and nonintegrated Voice Mail

System (VMS) interface. This allows for a network based VMS to attach to a
MSC and be utilized by mobiles regardless of which MSC coverage area they
are currently served by (assuming network connectivity between MSCs) as
shown in the above figure.
The Voice Mail System enables voice messages to be store. Incoming calls
can be forwarded into the subscribers voice mailbox when he/she is busy, is
out of the coverage area, is switched off, does not answer or activates
unconditional call forwarding into his/her mailbox. Some VMSs can also
provide an intelligent alert system. Repeated delivery calls can inform the
subscriber of a new message in his/her voice mailbox.
When the UMTS system contains an SMSC, delivery calls can be combined
with short messages. A short message is delivered to the customer subsequent
to receiving a message in his/her voice mailbox and delivery calls are only
activated if the short message was unsuccessfully delivered.
From an architectural point of view, the VMS is divided into message storage
units (winchesters) and call, message and alarm management units.
VMS Routing
Normal UMTS call forwarding will be used at the local MSC, where the UE
resides, to route calls to a VMS. The subscribers set call forwarding to the DN
of their mailbox on their VMS. When call forwarding occurs, normal network
routing functions will route the call to the VMS. The MSC is capable of
connecting to a VMS via standard PSTN protocols supported by the MSC.
Message Waiting Notification

The VMS is responsible for notifying the mobile subscriber of a Message
Waiting Indication (MWI). It is assumed that:
the VMS will interconnect to a service center which will in turn deliver an
MWI to the UE via the mobile terminated short message service
the subscriber will periodically poll his/her VMS to check/obtain voice
messages.
Message Retrieval
Assuming that the UE is registered with the MSC VLR, voice message retrieval
appears as a mobile originated call.
1. a subscriber dials the DN of his/her VMS
when the call is delivered to the center, without indication of call
forwarding, the center prompts inband for the mailbox and password
to be entered using DTMF
2. the subscriber is able to retrieve messages using in-band signaling.
Voice Mail Transfer

Voice Mail Transfer provides the calling party with a set of available options
when the VMS is connected:
The caller is given the opportunity to leave a message, transfer to an
operator, or transfer to a predefined number.
The owner of the voice mail box can originate calls from the VMS.
The VMS user accesses redirection options.
The Voice Mail Call Drop Back (VMCDB) feature provides:

A new service to a party that is connected (through an answered voice
channel) to a VMS located in a Nortel Networks CCN.
This service provides the ability to transfer the existing call from the
VMS to a desired destination, provided that the call was terminated to the
VMS, not originated from the VMS.

Intelligent Networks 3
An Intelligent Network is an architecture that supports the provision of added
telecommunications services and facilitates the introduction and management
of those services.
To effect radical changes:

As the market for traditional basic telephony services reaches saturation
point, the operators need to offer new services.
Users become more sophisticated in their needs and expectations.
Operators must therefore make a large and continuous investment in new
technology, and can be refound through additional revenue.
In the fundamental concept of IN:

There is a clear separation of the call processing and switching logic from
the software that provides a particular service.
The basic call processing is performed by the switch. When the switch
identifies an IN service request, this service processing is oriented to
another entity.
the use of standard, re-usable software modules:

Reduce development time and cost. The service features that have
already been developed and tested can be combined and modified.
Allow the operator to buy from any vendor, and ensure that equipment
in a multi-vendor network interoperable.
increased service velocity to enable rapid market-driven introduction
of new services, from conception to deployment.
increased range of services to go beyond the traditional voice and
data bearer services to a much broader range, including information
services, broadband and multi-media bearer capabilities.
consistent service operation in a multi-vendor environment to
ensure that the services will work correctly and consistently on any
vendor equipment, and across several vendor equipment.
evolution from existing networks to interwork with and evolve from
existing networks that cannot rapidly be replaced.
service independent implementation to allow service providers to
define their own services independent of service specific development by
equipment providers.
Nortel Networks IN Architecture
Nortel IN Architecture
Service Creation and
Management Environment
ServiceBuilderTM
Intelligent Network Internet
HLR
SMS
SCP
SMS-C
Intranets
IP IN gives you:
Open Architecture
DMS-SSP DMS-100 Multivendor Interworking
SSP Global Roaming
Voice
Fixed-Mobile Convergence
signaling Ready
UMTS Network Service Breaking the Limits of
Management
Fixed Network
Service Offering
Nortel Networks ServiceBuilder is a complete, end-to-end solution non-

switching support offering Intelligent Network, also known as Service
Control Function (SCF), for a UMTS network as shown in the above figure.
The ServiceBuilder system architecture consists of:

a Service Control Point (SCP) supporting the CCS7 protocol software and
the SCP application software including FSL (Flexible Service Logic)
Intelligent Peripherals (IP) supporting voice processing multimedia
functions
a single Service Management System (SMS), supporting service
provisioning, service orders, and service administration functions
a Service Creation Environment (SCE) supporting service design and
programming
Using the ServiceBuilder, operators can design, execute and manage
advanced services in order to differentiate from their competitors. Moreover,
ServiceBuilder reduces the time to market of new services.
GSM15 is fully compliant with CAMEL Ph2.

Turnkey Services
Nortel Networks ServiceBuilder solution provides the design and flexibility
to handle a wide range of services and applications.
The ServiceBuilder system is capable of providing the following turnkey

service applications:
personal number service
Gives the UMTS subscribers more control over incoming calls.
pre-paid calling services

Allows subscribers to pay in advance for the calls they will make.
sponsored cell/call
Allows a third party, as sponsor, to display an announcement at the
beginning of the call.
location inquiry (as shown in the following figure)

Provides UMTS subscribers with information on where to locate useful
services.
virtual private networking

Is a set of corporate services that enables similar functions to those of
private network, among a group of UMTS subscribers.
IN: Location Inquiry Procedure
IN: Location Inquiry Procedure
PSTN 7
8 SCP
3 2
DMS-MSC
6
1 4
VLR
UTRAN
5
5 IP
1- UE dials a specific IN number.
2- DMS-MSC suspends call processing and gives control to SCP.
3- SCP requests DMS-MSC to connect to IP.
UE 4- DMS-MSC establishes voice path (PRI link) to IP.
5- UE/IP interaction: announcement, digit collection, choice through menu.
6- IP sends successful report to SCP.
7- End of UE/IP interaction and return of final destination number.
8- Routing call to destination (PSTN number).

CAMEL Ph3 and GSM16
CAMEL Ph3 Introduction in NSS16 / UMTS03
Services
Services &&Signaling
Signaling
CAMEL
CAMELPhase
Phase33Features
Features
CAP
CAP callp/messagingenhancements
callp/messaging enhancements CAMEL Ph3
SMS-CSI
SMS-CSI
D-CSI
D-CSI
ETSI
ETSIISUP
ISUPversion
version33
CAMEL
CAMELPhase
Phase22wrap-up
wrap-up
Assisting
AssistingSSP
SSP
Resume
Resume callhandling
call handlingrest
restremoval
removal
The major change introduced in GSM16 supports the CAMEL Ph3 SMS-CSI
(Short Message Service - CAMEL Subscription Information) feature.
SMS-CSI provides a mechanism for the Operator to interwork IN services

with the SMS Teleservice. This would include the ability to offer an IN-
based PPD (Partial Packet Discard) or VPN (Virtual Private Network)
SMS service suitable for roaming. Mixed vendor networks can easily
support IN based SMS services.
Review Questions 3
1. List the OAMP components within the SDM/FT.
2. List the added components.
3. Describe the function of each added component.
4. List 3 services given by an Intelligent Network.

Lesson 4
Introduction to CCS7
Objectives 4
Objectives
Given student lesson, instructor lecture and appropriate

Define signaling.
Describe several features and benefits of signaling that
are enabled or enhanced by CCS7 technology.
Describe the CCS7 network nodes.
Describe the CCS7 network architecture.
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 4. Introduction to CCS7 4-2

4-2 Introduction to CCS7 Nortel Networks Confidential
Introduction to Common Channel Signaling System #7 4

The network protocols used to define the interfaces between the components
of a UMTS network are based on Common Channel Signaling System #7
(CCS7) technology.
Signaling 4
For call processing components to interact with one another and to process
voice and data calls, signals must pass among the components. Signals are
used by telecommunication networks for addressing and routing purposes.
Some examples of signals are

On-hook or off-hook signals indicate to the network that a user is
requesting or terminating service from the network.
Dialed digits determine the routing of the call from the origination point
through the network to the termination point.
Calling party digits inform the originating network of a call or
transaction.
The evolution of communications technology has created an increasing
demand for new and enhanced network services.
To meet these and other signaling demands, telecommunications networks use

two distinct types of signaling:
Per-Trunk Signaling (PTS)
Common Channel Signaling (CCS)
These two types of signaling support the following two components of a User
Equipment call:
The signaling component contains the supervisory and address signals
used to control the setting up, monitoring and taking down of the call.
The voice and data component contains the traffic between the
originator and the recipient of the call, regardless of whether it is a voice
or a data call.
Note: The terms voice, voice component, voice trunk, voice traffic and
voice path also include data information.
Nortel Networks Confidential Introduction to CCS7 4-3
Per-Trunk Signaling (PTS)

For many years, telephone systems transmitted the signaling component of a
call on the same facility that is used for the voice component. This type of
signaling is referred to as Per Trunk Signaling (PTS). Both signaling traffic
and voice traffic occur on one trunk dedicated specifically to that call.
PTS requires the voice component to be completely built, even if the call
cannot be completed. For instance, if the number being dialled was busy, a
voice facility that could be used for another call is wasted. This is especially
important for toll switches, as wasted voice facilities can mean loss of
income.

Common Channel Signaling (CCS)

Comparison of Per-Trunk Signaling to CCS
Comparison of Per-Trunk Signaling to CCS

Per-trunk Signaling
Single Trunk Carries

Signaling and Voice
Common Channel signaling
signaling Link Dedicated

to signaling
Trunks dedicated to
voice
Represents Voice
Represents signaling
CCS is a generic term for a telecommunications system using two separate

paths for information transfer.
Specifically, these paths for information transfer include:

one path for voice and data
one common path for all-related signaling information
CCS allows full use of interoffice trunk facilities for voice or data. CCS also
provides additional bandwidth for signaling on a common, separate trunk.
The amount of signaling information on a signaling link during a mobile

station call is small compared to the voice component of that call. One
signaling link can be used for several voice calls without becoming
overloaded.
CCS allows the voice component to be built separately. In the previous

example, no voice facilities would be assigned to the call if the dialled
number is busy. For a toll switch, this leaves the voice facility available for
income producing calls as shown in the above figure.
What is CCS7? 4
CCS7, sometimes called Signaling System #7 (SS7), is a version of CCS
designed for digital networks. CCS7 technology enables CCS over dedicated
data links using packet switching techniques. Packet switching techniques
allow for more signaling information to be transferred between points in the
network.
CCS7 signaling is overlaid on the existing network, using existing DS1

transmission facilities. Since it provides interoffice signaling, CCS7 is
transparent to subscribers. CCS7 technology provides standard access to all
nodes across the public network. This access allows services to communicate
from office to office using a common protocol.
CCS7 Signaling Advantages 4

The following table compares CCS to per-trunk signaling and shows the
advantages of CCS.
Comparison of Common Channel to Per-trunk Signaling
CCS PTS
1. Large message repertoire
1. Small message repertoire
call messages
service messages
administrative messages
2. Speed64 kbps and steady 2. Speedslow and variable
3. signaling occurs during speech phase 3. signaling cannot occur during
speech phase
4. signaling for multiple voice circuits 4. signaling on a per-trunk basis
simultaneously
5. Error detection and correction
6. Intelligent
7. Securityall messaging has multiple
paths over which to travel
8. Capability to launch query and
response messages to databases
Nortel Networks uses CCS7, which is a version of CCS designed for digital
networks. CCS7 offers benefits to both subscribers and operating companies.
These benefits can be divided into two groups:

transaction services
signal network management

Transaction Services
The transaction services area provides benefits for the subscribers and may
include such services as
custom local area signaling service (CLASS) provides a group of custom
calling features aimed at residential and small business customers. Some
of these services include
ring back
caller ID
call barring
Automatic Calling Card Services (ACCS) allows toll calls that are
charged to a calling card number, which is verified using the CCS7
network database.
Virtual Private Network (VPN) allows private networks to be accessed
using public networks.
Advanced Intelligent Network (AIN) provides service information that
resides in a centralized location. As a result, offices can access it as
needed to provide routing, billing and other necessary call parameters.
Signaling Network Management
The signaling network management functions provide procedures to monitor
the CCS7 network status and maintain signaling service by rerouting or
controlling traffic when there is either congestion or failure in the CCS7
network.
CCS7 reduces equipment cost. While in-band trunk signaling requires that
each of the trunks have access to signaling equipment, this equipment need is
eliminated with CCS7 since all trunk signaling is performed over the
common CCS7 signaling link.
CCS7 Network 4
A CCS7 network consists of several different hardware components called
nodes or signaling points.
The following node types are available in a Nortel Networks CCS7 network:
Signaling Point (SP)
Service Switching Point (SSP)
Signaling Transfer Point (STP)
Service Control Point (SCP)
INtegrated NODE (INODE)
The following figure shows the different CCS7 network nodes in a signaling
network.
CCS7 Nodes in Signaling Network
CCS7 Nodes in Signaling Network
STP Pair A STP Pair B
STP STP SCP

SCP
SSP
INODE STP SCP

SCP
SP
Signaling Point
A Signaling Point (SP) is a switching office that supports CCS7 voice trunk
capability (ISUP messaging). It provides an interface between subscriber
lines and the CCS7 network. An SP originates and terminates signaling
messages.

Service Switching Point

The Service Switching Point (SSP) generates query messages to the
application databases that are located at SCPs. SSPs are also capable of trunk
signaling (SP functionality).
Signaling Transfer Point

The Signaling Transfer Point (STP) transfers messages between nodes; it
does not support voice trunks. The STP is the only node that can transfer
messages. The STPs are not a source or ultimate destination for CCS7
messages.
To ensure absolute reliability, STPs are deployed in mated pairs located at

separate sites. If problems develop in one STP, the mate node transfers
messages to all connected points in the network. Shifting to the in-service
mate ensures that service continues without interruption.
Regional and local are terms used to describe STP pairs. The term used
depends on the position of an STP pair relative to other types of CCS7 nodes.
A local pair is the primary transfer point for signaling traffic from a localized
group of SSPs. A regional pair is any STP pair that provides local STP pairs
access to regional resources such as SCPs.
Service Control Point

The Service Control Point (SCP) is a node that supports transaction services
subsystems.
The function of an SCP is to accept a query for information from a subsystem

in the CCS7 network, retrieve the requested information from one of its
subsystems and send a response message to the originator of the request.
Integrated Node
An INODE integrates the function of an SSP and STP within a single node.
Therefore, this node can generate query messages to the application databases
and also transfer messages to other nodes. This product is Nortel Networks
specific.
Signaling Links 4
Direct communication between two adjacent signaling points occurs through
a signaling link. A link is the physical connection between two nodes.
Signaling links transfer signaling messages between two signaling points.
Link Types
Six types of link can be configured in a CCS7 network. The type configured
depends on the function of the nodes that the link connects.
The signaling links can be categorized into several types depending on the
functions being performed. However, regardless of the function, all signaling
links operate in the same manner and have the same technical requirements.
Following is a list of all link types and their functions:

Access links (A-links) connect SSPs, SCPs and signaling points to STPs.
Bridge links (B-links) join mated STP pairs to other mated STP pairs of
equal hierarchy such as local to local. These links form the Quad
structure, which provides complete STP redundancy.
Cross links (C-links) connect to STP nodes to create an STP pair.
C-links also provide alternate routing via the mate of the pair.
Diagonal links (D-links) connect local and regional STP pairs.
D-links provide communication between STP pairs. One level of STP
pairs, the secondary or local level, supports SSPs. The secondary level
connects to the additional level, called the primary or regional level. SCPs
are typically supported at the regional STP level. Regional and local STP
pairs are for larger networks that service so much traffic that they require
another level of STP pairs to provide efficient signaling. Telephone
operating companies often join their networks at the local level but may
also interconnect at the regional level.
Extended links (E-links) connect an SCP, SSP or SP to a remote STP pair
to perform transaction services. E-links are deployed when a network
requires additional redundancy, such as during high traffic periods.
Fully-associated links (F-links) connect SCPs, SSPs and SPs directly
with one another. F-links do not connect to STPs.

The following figure shows an example of a CCS7 network with its link
types.
Signaling Link Types
Signaling Link Types
STP
STP STP
STP DMS-HLR
DMS-MSC HLR
A-link C-link
B/D-link A-link
C-link
INODE STP
STP
F-link DMS-MSC
E-link
Wireless Gateway
(transparent node)
Network Addressing 4
Point Codes
Each signaling point in the network has its own address. These addresses are
point codes. The point code is the standardized method of addressing a
particular node within the CCS7 signaling network.
Linksets and Routesets 4

Linksets
A group of links directly connecting one node to another is called a linkset. A
linkset consists of one to 16 links. (A linkset of C-links is a special case; it
consists of up to eight links.) All links within a linkset share the same
attributes.
For example, they are all A-links or all D-links. Multiple-link linksets are
deployed for redundancy and traffic distribution.
Linkset Definition
Linkset Definition
A linkset is a set of links connecting two nodes
PC=100 PC=200
Link 1
MSC A Link 2 MSC B

Link 3
Linkset AB:
OPC=100
FEPC=200

Routesets
Just as a linkset is a group of links, a routeset is a group of all routes going
from one node to another. Every destination in the network has at least one
routeset. Routesets may have from one to 6 routes (linksets).
The following two basic rules are used to determine whether a routeset needs
to be defined between two signaling points:
if a CCS7 node has trunks connecting to another CCS7 node, a routeset
must be defined to that node,
if a CCS7 node has a linkset to another node, a routeset must be defined
for the node.
The routeset is made up of the following linksets:

LKSETAB (associated signaling mode)
LKSETAC (quasi-associated mode).
Routset Definition
Routeset Definition
Routeset
Routeset AB:
AB: Routeset
Routeset BA:
BA:
Linkset
Linkset AB
AB Linkset
Linkset BA
BA
Linkset
Linkset AC
AC Linkset
Linkset BC
BC
Linkset
Linkset AB:
AB:
OPC=100
OPC=100 PC=200 OPC=200
OPC=200
PC=100 DPC=200
DPC=200 OPC=100
OPC=100 DPC=100
DPC=100
FEPC=200
FEPC=200 Linkset BA
MSC B
MSC A
Linkset
Linkset AC:
AC: Linkset BC
PC=300
OPC=100
OPC=100
FEPC=300
FEPC=300
MSC C Linkset CB
Linkset CA
A routeset:
Is a signaling path between two nodes. MSC C must be an STP.
Is made of linksets.
A signaling route is the path between nodes over which signals travel.
A route cannot be touched.
It is a description of one way to travel from an origination point through
the network to a destination point.
Direct communication between CCS7 nodes becomes impractical as the

distances between nodes in the network increase. As a result, signals must
be able to reach their destinations:
Either directly, where signals travel to destinations that are in adjacent
nodes.
Or indirectly, where signals travel to destinations that require them to
go through intermediate nodes before reaching the destination. Either
path, direct or indirect, is called a route.
Several routes may exist between nodes.
If the route is a path between two adjacent nodes, it is using associated
signaling.
If a route is operating in the associated mode, as shown in the following
figure, only one linkset is being used between the origination and the
destination nodes.
Signaling Route (associated mode)
Signaling Route (associated mode)

DMS MSC Signaling Link DMS MSC
In associated mode:
a route uses one linkset between
origination and destination nodes.

Quasi-associated signaling uses routes made of multiple linksets,

including routes between two nodes separated by other nodes.
If a route is operating in the quasi-associated mode, shown in the
following figure, two or more linksets may be in the route from
origination to destination.
Signaling Route (quasi-associated mode)
Signaling Route (quasi-associated mode)
DMS-MSC DMS-MSC
Signaling Link
STP
STP In the quasi-associated mode:
two or more linksets may

be in the route from
origination to destination.
CCS7 Signaling Types 4

CCS7 signaling is divided into the following two types:
connection-oriented signaling
connectionless signaling.
Connection-Oriented Signaling
Connection-oriented signaling, also referred to as trunk signaling, sets up,
monitors and clears down a CCS7 call. The connection-oriented signaling
configuration is shown in the following figure. An example of connection-
oriented signaling is when the RNC sends a message to a DMS-MSC
regarding call setup.
Voice Trunks
RNC DMS-MSC
signaling Link

Connectionless Signaling
Connectionless signaling is not directly involved with digit translations
during the setup and clear down of a UMTS mobile-station-related call; the
signal must go through an STP before reaching its final destination.
The connectionless signaling configuration is shown in the following figure.

An example of connectionless signaling is when a DMS-MSC sends a
message to a DSM-HLR.
STP
signaling Link
DMS-MSC DMS-HLR
signaling Link
STP
Review Questions 4
1. Name three advantages of the CCS7versus per-trunk signaling.
2. Name the advantages of signaling network management.
3. What is the function of a Service Control Point?
4. Name two types of CCS7 technology.
5. What is a linkset?
6. What is a routeset?

Lesson 5
CCS7 Protocol
Objectives 5
Objectives

List the groups involved in setting the standards for the CCS7
protocol.
Describe UMTS CCS7 protocol architecture.
Describe the UMTS CCS7 protocol layers.
PE/TRD/CN/UM931 16.021/EN May, 2003 Lesson 5. CCS7 Protocol 5-2

5-2 CCS7 Protocol Nortel Networks Confidential
CCS7 Protocol 5
The CCS7 network is driven by a protocol. A protocol is a set of rules or
standards governing a communications exchange. All software functions and
hardware implementation are determined by the rules of the protocol.
The CCS7 protocol uses a standard set of information elements for reliable
exchange of signaling information in a multivendor environment. Use of the
protocol ensures that everyone in the network communicates in the same
language no matter which vendor equipment is used.
CCS7 uses a protocol to convey signaling messages in packets. Elements of

information are grouped into packets called signaling units, in a standard
manner determined by the protocol. The protocol determines the type and
sequence of information to send.
Standardization
Standardization is the result of several international groups that have
recognized the need for uniformity in the implementation of CCS7.
At the top of the hierarchy, shown in the following figure, is the International
Telecommunications Union (ITU).
The ITU is part of the United Nations. Under the ITU is the Consultative
Committee for International Telephone and Telegraph (CCITT).
CCITT issued the preliminary specifications for the digital CCS7 system
in 1980. The original system was called CCITT#7 signaling system.
The CCS7 Model is defined by the T1X1 working group of American

National Standards Institute (ANSI). Like other packet switching
technologies, such as ISDN and frame relay, CCS7 is based on the Open
System Interconnection (OSI) communications model.
The following figure illustrates the relationships between the governing

bodies of telecommunications and the OSI and CCS7 models.
Nortel Networks Confidential CCS7 Protocol 5-3
Standard Organizations
Standard Organizations
International
International Bell
Bell
Telecommunications
Telecommunications Core
Core
Union
Union
(ITU)
(ITU)
Open
Open Systems
Systems
Interconnection
Interconnection
(OSI)
(OSI)
Reference
ReferenceModel
Model American
American
National
National
Standards
Standards
Consultative
Consultative Institute
Institute
Committee
Committee on on (ANSI)
(ANSI)
International
International
Telephone
Telephoneand and
Telegraph
Telegraph
(CCITT)
(CCITT) 7 Layers
Application 7
Presentation 6
5 T1X1
T1X1
Session
Transport 4
Network 3
International
International Link 2
Standards
Standards 1
Physical
Organization
Organization
(ISO)
(ISO) CCS7
CCS7
Model
Model

OSI Model and CCS7

CCITT based the CCS7 protocol structure on the seven-layer OSI reference
model developed by the International Standards Organization (ISO) and
CCITT.
The layers of the OSI reference model are:

application
presentation
session
transport
network
link
physical.
The CCS7 protocol has four levels that correspond to the functionality of the
seven layers of the OSI reference model:
user functions
signaling network
signaling link
signaling data link.
UMTS CCS7 Protocol 5

During a communication exchange, all software functions and hardware
implementations are determined by the rules of the protocol.
CCS7 is a message-based signaling protocol that separates the

interconnection and exchange of information that occurs between signaling
points in a network into layers. CCS7 protocol is defined by CCITT#7.
With each message, the CCS7 protocol carries the enhanced routing
information needed to deliver advanced network services.
This routing data enables the following three significant network capabilities:
CCS7 trunk signaling
Permits feature transparency for services, such as an ISDN, to be
extended beyond the reach of a single central office.
network database access

Allows the efficient querying of centralized information to assist in call
routing for network-wide features and applications, such as credit card
access.
network management
Allows control of the CCS7 network.
UMTS CCS7 is a four-layer protocol that is implemented in the following

layers:
Message Transfer Part (MTP)
Signaling Connection Control Part (SCCP)
Radio Access Network Application Part (RANAP)
Transaction Capabilities Application Part (TCAP)
Mobile Application Part (MAP)
User Part (UP)

The following figure illustrates the four-layer protocol of UMTS CCS7.
UMTS CCS7 Protocol
UMTS CCS7 Protocol

Layer
4 Mobile
Mobile
Application
Application
Part
Part
(MAP)
(MAP)
Radio
Radio Access
Access Network
Network User
User
Application
Application Part
Part Part
Part
(RANAP)
(RANAP)
Transaction
Transaction
Capabilities
Capabilities
Application
ApplicationPart
Part
(TCAP)
(TCAP)
Signaling
Signaling Connection
Connection and
and Control
Control Part
Part (SCCP)
(SCCP)
3 Network
Message
Message
2 Link Transfer
Transfer Part
Part
(MTP)
(MTP)
1 Physical
Message Transfer Part Layer (MTP)

The MTP transfers signaling messages in the correct sequence, without loss
or duplication, between signaling nodes in a network.
The following three levels comprise the MTP, which make up the first three
layers of the UMTS CCS7 protocol:
The physical level (MTP 1) defines the physical, electrical and
procedural characteristics of the signaling data link. The bit rate of this
digital interface is 64 Kbit/s or 56 Kbit/s. The link speed depends on the
physical medium used and is not part of the MTP specification.
The data link functions level (MTP 2) ensures a secure signaling link
between pairs of signaling points. This layer provides signaling unit
alignment, error detection and correction, signaling link alignment,
signaling link error monitoring, and flow control. The function of MTP 2
is to transfer each message to the other end of the signaling link correctly
and in sequence.
The network functions level (MTP 3) provides signaling transfer, even
when signaling links or signaling points fail. This layer performs two
major sub-functions:
Signaling message handling: ensures that a message reaches its right
destination.
Signaling network management: provides reconfiguration of the
signaling network in case of failure and controlling traffic in case of
congestion.
The MTP provides the basic transport system for all CCS7 signaling
messages.
The three layers of the MTP have the following two basic responsibilities:
signaling network management
signaling message handling.
The MTP signaling network management transfers signaling messages in the

UMTS CCS7 network. When a network node creates a signaling message,
MTP signaling network management is responsible for coding routing
information into that message.
The MTP signaling message handling ensures that signaling messages travel
between UMTS CCS7 network nodes in correct sequence and without loss or
duplication.

Signaling Connection Control Part layer (SCCP)

The Signaling Connection Control Part (SCCP) layer transfers messages from
the original signaling point to the destination signaling point once the
destination point is reached. In other words, the MTP finds the destination SP
and the SCCP gives that signaling point the message from the originating SP.
For example, when a DMS-MSC queries the DMS-HLR, the SCCP is
responsible for transferring the query from the DMS-MSC to the DMS-HLR
when the correct DMS-HLR has been identified.
SCCP addressing allows routing to the applications or subsystems residing

within a node in the CCS7 network. SCCP addressing also enables routing to
subsystems residing outside a particular UMTS network. This addressing is
called global title translation.
SCCP management enables the tracking of application status at nodes. Using

tracking information, SCCP management informs an application user at one
node when an application at another node is not available.
To implement these functions, the SCCP has the following four control
functions:
routing control
connectionless control
connection-oriented control
management control.
Radio Access Network Application Part (RANAP)

RANAP is a signaling service for the UMTS Iu interface, between the
UTRAN and the Circuit Core Network (CCN). RANAP provides connection-
oriented and connectionless services, similar to the Base Station Subsystem
Managment Application Part (BSSMAP) for GSM.
RANAP Procedures
Circuit Core Network
DMS-MSC
Radio Network Subsystem
Iu Interface
Wireless
Gateway
RANAP Protocol is composed of:
Elementary procedures (EPs) or unit interactions

between the Radio Network Subsystem and the Core
Network.
Three Classes of EPs exist:
Class 1: EP with response

Class 2: EP without response
Class 3: EP with possibility of multiple response
Implementing the RANAP protocol in the LIU7 provides a means of

transporting RANAP information between the WG and the DMS-MSC in
such a way that no information is lost and the LIU7 and DMS-MSC
performance impact is minimized. The LIU7 mimics the processing of the 2G
GSM BSSMAP or DTAP messages in the equivalent 3G UMTS RANAP
messages.
To do this, the Layer 3 messages from the WG to the LIU7 are contained in
the user data field of the exchanged SCCP frames. There is an intermediate
layer of protocol between SCCP and Layer 3 referred to as the distribution
sublayer. The protocol for this sublayer includes the management of a 1-byte
DDU (Data Distribution Unit). The low order bit of the DDU is currently
used to determine whether the message is transparent (i.e. DTAP) or not
transparent (i.e. BSSMAP).

Transaction Capabilities Application Part Layer (TCAP)

The Transaction Capabilities Application Part (TCAP) layer provides a set of
protocol and services that can be used by an application process at one node
to invoke remote execution of a procedures at another node.
The TCAP is divided into the following two subsystems:

the component portion
Consists of a sequence several TCAP components, that invoke an
operation at a remote signaling point or return the results of an
operation.The component portion is responsible for the following:
correlating responses to requests at the TCAP level

providing basic error detection
ensuring that message components are properly formatted and
exchanged
the transaction portion
Is responsible for initiating, maintaining and clearing down
connectionless signaling. The transaction portion identifies each TCAP
message and contained components as belonging to a particular
application transaction.
Mobile Application Part Layer (MAP)

The MAP layer uses the TCAP and the SCCP to transfer signaling
information between the functional entities of the UMTS PLMN.
MAP is responsible for the following activities:

defining signaling node functionality
defining the interfaces between signaling nodes
defining the signaling functions required for using CCS7 to provide the
services needed by voice and non-voice applications in the UMTS CCS7
network.
User Part Layer

The user part layer builds on services of the MTP to provide connection-
oriented signaling for setting up, monitoring and clearing down the voice
trunks of UMTS CCS7 calls.
The user part is called such because it transports signaling messages

associated with the connection between two users in a network. The user part
supplies the trunk signaling capabilities that enable network-wide feature
transparency for some network services.
Telephone User Part (TUP)

The Telephone User Part interfaces with the MTP layers and defines the
necessary telephone signaling functions to use CCS7 for national and
international applications.
Examples of different TUPs are as follows:

ATUP, australia telephone part
BTUP, british telephone part
CTUP, china telephone part.
ISDN User Part (ISUP)

The Integrated Service Digital Network User Part (ISUP) layer of the UMTS
CCS7 protocol is a part of the ISDN and provides out-of-band signaling
functions required by the UMTS CCS7. The ISUP is responsible for
transporting the voice and signaling components of a call.
Application Entities
In a UMTS network, each component of the CCN has been designated as an
AE.
Each AE provides certain services to other AEs in the CCN subsystem. For
example, an MSC (an AE) would request an HLR (another AE) for routing
information regarding a particular mobile subscriber.
Application Service Elements

The services provided by the AEs are called Application Service Elements
(ASEs).
In the communication process, there is always an ASE requester and an ASE

provider. An example of an ASE is Send Routing Information (SRI). The
MSC AE uses the SRI service requester ASE to ask the HLR for routing
information.
Similarly, the HLR uses the SRI service provider ASE to respond.

CCS7 Functional Layers in AEs

Each of the CCN AEs (components) contains software that implements the
CCS7 layers. A layer in one AE logically communicates with its peer layer in
another AE.
Physically, however, each layer in an AE communicates only with the

adjacent layers within that same AE. The rationale between these different
paths for information flow stems from the OSI model. Because each layer
within an AE is only responsible for a portion of the communication process,
service requests must flow through all the layers in an AE to be converted
into electrical signals.
Message Flow between Application Entities
Message Flow between Application Entities
DMS-MSC Other AEs

Mobile Application Mobile Application
Part (MAP) Part (MAP)
Transaction Capabilities Transaction Capabilities

Application Part (TCAP) Application Part (TCAP)
Signaling Connection Signaling Connection

Control Part (SCCP) Control Part (SCCP)
Message Transfer Message Transfer

Part (MTP) Part (MTP)
Physical Layer Physical Layer

(PCM30) (PCM30)
Logical Message Flow Physical Message Flow
UMTS CCS7 Protocol Architecture 5

The following figure illustrates how the different UMTS CCS7 layers are
implemented in different network nodes, and how the GSM CCS7 protocol
layers interact with the GSM interfaces as shown in the following figure.
UMTS CCS7 Protocol Architecture
Nortel UMTS CCS7 Protocol Architecture
UP UP UP
PSTN PSTN
MAP MAP MAP

MTP MTP MTP
TCAP TCAP TCAP
CM Iu-CS
SCCP SCCP SCCP
MM Air
MTP MTP MTP
RR RANAP RANAP Relay RANAP
LAPDm SCCP SCCP SCCP SCCP

Ph. E/G C/D
Layer MTP MTP MTP MTP
ATM ATM
Wireless
UE RNC Gateway DMS-MSC/VLR DMS-GMSC/VLR DMS-HLR PSTN

Review Questions 5
1. What organisation is at the top of the CCS7 standard hierarchy?
2. List the layers of the CCS7 protocol.
3. What is the purpose of the MTP layers?
4. What is the purpose of the SCCP layer?
5. What is the purpose of the RANAP layer?
6. What is the purpose of the TCAP and MAP layers?
7. What is the purpose of the UP layer?
Lesson 6
UMTS CCN Interfaces
Objectives 6
Objectives

Describe the UMTS CCN interfaces.
Outline the responsibilities of the MAP layer.
Describe an Application Entity (AE).
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 6. UMTS CCN Interfaces 6-2

6-2 UMTS CCN Interfaces Nortel Networks Confidential
UMTS Interfaces 6
The interfaces connecting components of a UMTS network are specified in
the UMTS recommendations. In the UMTS network, interfaces, not signaling
links, connect the nodes. The following figure shows the Nortel Networks
implementation of the UMTS network components, the network signaling
points (SPs) and the UMTS interfaces. The interfaces used with the UMTS
signaling points are listed in the following table.
UMTS CCN Interfaces and AEs
Iu-CS-Interface MSC to RNC

B-Interface MSC to VLR
C-Interface MSC to HLR
D-Interface HLR to VLR
E-Interface MSC to MSC
F-Interface MSC to EIR
G-Interface VLR to VLR
Network Interfaces in a Nortel Networks UMTS Network
Interfaces in a Nortel UMTS CCN
G-Interface
VLR D-In VLR

terf ce
ace terfa
DMS-HLR D-In
HLR
C-Interface
face
ace
SMS-SC
rf
r
B-Inte
B-Inte
rface
C -Inte
E-Interface
EIR
F-Interface
E-Interface
DMS-MSC DMS-GMSC
Iu-CS
Network
Interface
RNC Wireless
Iu Gateway PSTN
(CS+PS) PSTN
Voice Trunk
Signaling Link
Nortel Networks Confidential UMTS CCN Interfaces 6-3
Iu-CS Interface
The Iu interface is between RNC and either the SGSN (for the packet
domain) or the MSC (for the circuit domain).
This interface is an equivalent to the A GSM interface.
Regarding the Iu interface, PS and CS planes have been separated, since

different protocol stacks have been defined with regard to the core network
domain in use.
Circuit Switched
Iu-CS C-Plane
Network layer RANAP
Transport layer SCCP
MTP
Iu-Interface Functions and Services

The Iu-interface of UMTS handles the call control, mobility management and
resource management messages between the CS and the RNS. This interface
utilizes signaling over either CCS7 or ANSI SCCP, MTP and RANAP.
UMTS Call Processing Architecture

The UMTS call-processing signaling between the CS and an RNS is handled
across the Iu-interface. This interface provides the functions to establish,
maintain, and terminate circuit-switched connections across a UMTS PLMN.

The Iu-interface is a multilayer signaling interface which consists of the

subareas shown in the following figure.
Call Processing through Iu Interface

RNS Iu interface CS
D CC, SS, SMS Connection Management
T
A
P MM Mobility Management
RANAP
SCCP Class 0 and 2

Data
Link
Layer
MTP
Trunk Physical Layer (PCM 30)
Connection Management
The Connection Management (CM) sublayer includes the Call Control (CC),
the Short Message Service (SMS), and the Supplementary Service (SS)
functions. The CM sublayer of the CS supports the following functionalities:
Basic call control

Mobile originations includes interworking to fixed network
Mobile terminations includes paging and interworking from fixed
network
Emergency calls
DTMF tone generation
Gateway CS call processing to insure routing to proper CS
SS support
SMS support
Data Services.
Mobility Management
The main function of the Mobility Management (MM) sublayer is to provide
procedures to handle the mobility aspects of the subscriber. Mobility
Management procedures are divided into three categories:
MM-Common Procedures:
MM-Common procedures can be initiated while there is a radio
connection between the UE and the network.
MMSpecific Procedures:
MM-Specific procedures can be initiated only if the UE is IDLE
MM-Connection Management Procedures:
MM-Connection Management procedures are internal to the CS
MM-Common Procedures
MM-Common procedures are defined as follows:
TMSI Reallocation Procedure

Identification Procedure
Authentication Procedure
IMSI Detach Procedure.
MM-Specific Procedures
MM-Specific procedures are defined as follows:
Location Update Procedure

Periodic Update Procedure
IMSI Attach Procedure
IMEI Check Procedure
RANAP Message Examples
RANAP messages between RNC and CS:
RAB Assignment
Iu release Command
Relocation Request
Relocation Command
Relocation Failure
Relocation Detection

B-interface
The B-interface handles signaling messages between the DMS-MSC and its
VLR.
However, in the DMS-MSC, the B-interface is implemented internally

because the DMS-MSC and the VLR are co-located. Support for an external
B-interface is not provided.
Examples
B-Interface Message Examples

G
VLR VLR
D HLR D
B
C C B
EIR
F F
RNC RNC
Iu-CS E Iu-CS
DMS-MSC DMS-MSC
Allocate Handover Number

Attach IMSI PSTN
PSTN
Authenticate
Complete Call
Detach IMSI
Page
Process Call Waiting
Update Location Area
C-interface
The C-interface supports communication between the DMS-GMSC and the
HLR.
Messages passed over the C-interface include routing information in response

to requests from the DMS-MSC. The DMS-MSC that is acting as a GMSC
queries the HLR for routing information on every mobile-terminated call. The
request retrieves the IMSI number and routing information from the HLR.
This information enables the call to be routed to the DMS-MSC currently
serving the UE. The C-interface also connects the SMS-SC to the DMS-HLR.
C-Interface Message Examples

G
VLR VLR
D HLR D
B
C C B
EIR
F F
RNC RNC
Iu-CS E Iu-CS
DMS-MSC DMS-MSC
PSTN
PSTN
Alert Service Center
Register Charging Information
Send Routing Information
Send Routing Information Ack
Set Message Waiting Data

D-interface
The D-interface is used to exchange location information and subsets of
subscriber data between the DMS-HLR and the VLR.
The main service provided to the mobile subscriber is the capability to set up
or receive calls within the entire service area.
To support that purpose, the following information is sent across the D-

interface:
location updates, which are written to the HLR database when a mobile
station passes a location boundary
authentication keys requested from the HLR and AUC by the VLR
fault handling information
Exchanges of data also occur over the D-interface when:

a mobile subscriber requires a particular service
some parameters of the mobile subscription are modified by
administrative means
D-Interface Message Examples

G
VLR VLR
D HLR D
B
C C B
EIR
F F
RNC RNC
Iu-CS E Iu-CS
DMS-MSC DMS-MSC
Activate SS
Cancel Location PSTN
PSTN
Deactivate SS
Deactivate Trace Mode
Delete Subscriber Data
Send Authentication Info
Provide Roaming Number
Register Password
E-interface
The E-interface connects DMS-MSCs. The E-interface also connects the
SMS-SC to the GMSC.
E-Interface Message Examples

G
VLR VLR
D HLR D
B
C C B
EIR
F F
RNC RNC
Iu-CS E Iu-CS
DMS-MSC DMS-MSC
Forward Access Signaling PSTN

PSTN
Forward Short Message
Perform Handover
Process Access Signaling
Send End Signal
Trace Subscriber Activity

F/G-interfaces
The F-interface connects the DMS-MSC to the EIR. The G-interface connects
VLRs.
F/G Interface Message Examples

G
VLR VLR
D HLR D
B
C C B
EIR
F F
RNC RNC
Iu-CS E Iu-CS
DMS-MSC DMS-MSC
PSTN
PSTN
G interface:
F interface: Send Identification
Check IMEI
Review Questions 6
1. List UMTS CCN interfaces.
2. Describe the interface between UMTS MSC and UTRAN.
3. What is an Application Service Element?
4. Give at least one Application Service Element for each UMTS CCN
interface.

Lesson 7
UMTS Call Signaling
Objectives 7
Objectives
Given student lesson, instructor lecture, and appropriate documentation,

you will be able to:
Describe the signaling procedures associated with the following
steps of call progression:
9 User Equipment location update

9 authentication and key agreement (AKA)
9 UMTS security mode
9 User Equipment paging
9 mobile-to-land call sequence
9 land-to-mobile call sequence
9 mobile-to-mobile call sequence
9 mobile-to-mobile call termination
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 7. UMTS Call Signaling 7-2

7-2 UMTS Call Signaling Nortel Networks Confidential
UMTS Procedures 7
This lesson introduces the CCS7 signaling procedures for call progression.
The steps of call progression are associated with specific signaling

procedures.
Following are signaling procedures detailed in this module:

User Equipment (UE) location update
authentication and key agreement
UMTS security mode
call processing
UE paging
UE-originating call establishment
UE-terminating call establishment
UE Location Update Procedures

Location updating provides the UMTS databases (DMS-HLR and VLR) with
information regarding the location of mobile subscribers. This procedure is
triggered by an UE when the need for updates concerning the subscriber
location arise.
Examples of events that may trigger a UE to perform a location update

procedure include the following:
the mobile travels into an MSC serving area
the UE is powered on or off
In the UMTS network, the location of the UE is stored in the DMS-HLR and
the DMS-MSC/VLR in which the subscriber resides.
To maintain current information in each of these network elements, procedures

have been specified. These procedures are as follows:
UE to DMS-MSC/VLR location update procedure
DMS-MSC/VLR to DMS-HLR location update procedure
DMS-HLR to MSC/VLR insert subscriber data procedure
DMS-HLR to MSC/VLR location cancellation procedure
IMSI attach and detach procedure
A SuperCharger procedure that increases network capacity and decreases

network signaling has also been added.
Nortel Networks Confidential UMTS Call Signaling 7-3
Location Update Concepts


UE send a LU Request to the VLR
Old LAI
New LAI
IMSI or TMSI
No [IMSI]
No [TMSI]
Is the IMSI or No [TMSI]
TMSI in the
New VLR?
Get IMSI from UE
Yes Is Old LAI in

Table Remote
LAC
New VLR sends LU
Req to the HLR
Yes [TMSI]
Get IMSI and Authentication

HLR sends:
vectors from old VLR
1. ISD
4. CL 5. CL Ack 2. ISD Ack
VLR:
Updates Database Old VLR New VLR
Sends ULAccept back to UE 3. LU Ack
This location update procedure consists of a request and an answer. A radio

connection between the UE and the network must have been established.
The request in this location update procedure is carried by the Mobility

Management (MM) location update request message. This message contains
the information necessary to identify the subscriber.
Before responding, the VLR can consult the HLR to determine if a HLR
update is necessary. If this is the case, the VLR must first identify which HLR
contains the subscriber data. This is accomplished by analyzing the
International Mobile Subscriber Identity (IMSI).
This number is provided to the VLR through one of the following possible
ways:
send identity message to the UE (if old LAI is not in table

REMOTELAC)
send identification message to the previous VLR (if old LAI is in table
REMOTELAC).

If the HLR information is incorrect (for example, if the UE is turned off while
roaming across location areas), the VLR updates the HLR through the
location update procedure. If no HLR update is needed or the necessary HLR
update is completed, the VLR may perform the authentication and ciphering
procedures described later in this module. The last step in the UE to VLR
location update procedure occurs when the VLR responds with the MM
location update accept or the MM location update reject message.
The UE to VLR location update procedure is not only processed when an UE

moves between location areas or when the UE is powered on or off. UMTS
service providers have the option of setting up periodic location updates that
inform the network of the location of all UEs. The update period is broadcast
to UEs and can be set from six minutes to twenty-four hours. The advantage
of this automatic location update method is a trade-off between quickness of
recovery after a network failure and the traffic load due to periodic location
updating.
Location Update Message Flow

The following example of a location update message flow illustrates the use
of the IMSI.
Location Update Message Flow (IMSI usage)
SRNS HLR
3G-MSC
1. RRC connection
establishment
2. MM LA Update Request (IMSI)
Authentication and Security Procedures
4. MAP Update Location
5. MAP Insert Subscriber Data
5. MAP Insert Subscriber Data Ack
6. MAP Update Location Ack

7. MM Location Update Accept (new LAI, new TMSI)
8. MM TMSI Reallocation Complete (new TMSI)
9. Iu Release
9. RRC Connection Release
The following example of location update message flow illustrates the use of
the TMSI.
Location Update Message Flow (TMSI usage)

SRNS HLR
New 3G- Old 3G-
MSC / VLR MSC / VLR
1. RRC connection
establishment
1. MM LA Update Request (old LAI, old TMSI)
2. MAP Send Identification Request (old TMSI)

2. MAP Send Identification Ack (IMSI, Auth quintets)
Authentication and Security Procedures
4. MAP Update Location (IMSI)
6. MAP Insert Subscriber Data
6. MAP Insert Subscriber Data Ack
7. MAP Update Location Ack

5. MAP Cancel Location (IMSI)
5. MAP Cancel Location Ack

8. MM Location Update Accept (new LAI, new TMSI)
9. MM TMSI Reallocation Complete (new TMSI)
10. Iu Release
10. RRC Connection Release
Conversion of V3 Quintets to V2 Triplets in SID

When a 2G VLR sends a Send Identification Request (SIRv2) to a 3G
previous VLR which has stored Quintets for the requested subscriber, Quintet
to Triplet conversion will be performed, before the Triplets are sent to the 2G
VLR.
DMS-HLR to DMS-MSC/VLR Location Cancellation Procedure

This procedure is performed by two messages. The DMS-HLR sends a MAP/
D cancel location message to the previous DMS-MSC/VLR. The
acknowledgment is sent through the MAP/D cancel location result message.
The DMS-HLR does not depend on this acknowledgment to update the DMS-
MSC/VLR where the UE resides.

SuperCharger
SuperCharger is a function provided for the DMS-HLR and the DMS-VLR.
SuperCharger increases HLR capacity for handling active subscribers, and
reduces signaling throughout the UMTS network.
SuperCharger allows the information about a particular subscriber to exist in

more than one VLR. This means that subscriber data will remain in a VLR even
after the subscriber has changed location to another VLR. Hence each VLR
contains data for subscribers who are:
currently located in the VLR
not currently located in the VLR, but were recently (and have not been
deleted yet).
Subscriber information is allowed to remain in previously visited VLRs by
not sending a Cancel Location (CL) message when the subscriber arrives at
another VLR.
Subscriber data integrity is maintained by ensuring that when there is a

change of a particular subscriber data, each VLR which has an old version
of the subscriber data receives the latest copy of that subscriber data. Apart
from the current VLR, all other VLRs which have a particular subscriber data
only get the latest copy when the subscriber next arrives at that VLR. The
current VLR will always receive the latest copy of a subscriber data when a
change occurs.
Thus, when a subscriber roams to a VLR which already has that subscriber
data, the HLR will always send imbedded ISD messages as part of the Inter
VLR Update Location (UL) request, if that subscriber data has changed.
Holding a particular subscriber data in multiple VLRs in the GSM network

means that the HLR does not need to send Insert Subscriber Data (ISD)
messages when the subscriber roams to one of those VLRs. Thus an Inter
VLR UL request from a VLR that already has a particular subscriber data will
not necessarily require embedded ISD messages to be sent from the HLR
(thus reducing network signaling).
The HLR can contain inconsistent subscriber location information if radio

contact is lost to a mobile station during a location update. To prevent this, a
CL message is sent to the subscribers old or previous VLR. The CL is sent
by the HLR when the VLR the subscriber is registering at sends a PurgeMS.
The PurgeMS is sent when the VLR detects that radio contact has been lost.
Inter-VLR Location Update with Supercharger
Update Location Procedure with Supercharger
ISD CL
ISD Ack HLR
UL
UL Ack CL Ack DMS-MSC 2

DMS-MSC 1
(IMSI found)
VLR VLR
UL Request
RNC 2
RNC 1
LAC 2
LAC 1
Comment:
1. No ISD is sent from HLR to MSC 1 if subscriber info has not changed.
2. No cancel location is sent from HLR to MSC 2.

IMSI Attach and Detach Procedure
IMSI Attach/Detach Procedure
Power ON DMS-MSC Power OFF

VLR
Available Not Available
IMSI Attach Procedure IMSI Detach Procedure
Before GSM and UMTS, cellular networks lost revenue and radio resources
from efforts involved in attempting to place a call to an UE that had been
turned off. The IMSI attach and detach procedures in UMTS offer a solution
to this dilemma.
The DMS-MSC/VLR houses a database where a single bit of data indicates

whether an UE is available to receive calls. When an UE is turned off, the
IMSI detach procedure will set this bit to not available. When the UE is
powered up, the bit is reset to available by the IMSI attach procedure (or a
location update request if the UE is in a new location area).
The above figure illustrates the IMSI attach and detach procedures.
TMSI Allocation Procedure

This is a way of avoiding IMSI interception over the radio path. Generally,
IMSI is sent to the network when the UE is powered on, afterwards only its
corresponding TMSI will be sent. This TMSI is allocated by the network on a
Location Area basis.
TMSI is used by the mobile to identify itself within the radio interface
signaling procedures. The TMSI has only local significance within a VLR.
Outside the VLR it has to be combined with the Location Area Identifier
(LAI) to provide an unambiguous identity.
TMSI reallocation is only and always performed during updating.
TMSI Allocation/Reallocation Message Flow
TMSI Allocation/Reallocation Message Flow
UE
UE RNC
RNC MSC
MSC VLR
VLR
2. Forward New TMSI

3. TMSI _REALLOCATION_COMMAND
4. TMSI _REALLOCATION_COMPLETE 6. Store TMSIs and

Deallocate Old TMSI
The general flow of TMSI Reallocation, is illustrated in the above figure.

During location updating:

1. The network decides to update the TMSI for a particular UE.
2. The VLR is told to allocate a TMSIn, and return it to the MSC.
3. The MSC forwards the TMSIn to the UE inside a
TMSI_REALLOCATION_COMMAND message.
4. The UE receives the TMSI_REALLOCATION_COMMAND, it stores
the TMSIn in its non-volatile store, and responds with a
TMSI_REALLOCATION_COMPLETE message.
5. The MSC receives this message and informs the VLR that TMSI
Reallocation was successful.
6. The VLR associates the TMSIn with the IMSI by storing the TMSIn in
the mobile tuple in the VLR, and the old TMSI (TMSIo) is deallocated.
Authentication and Key Agreement 7

This mechanism achieves mutual authentication by the user and the network.
Background
For GSM subscribers:
GSM AKA shall always be used. The security context depends on
whether the access is via GSM BSS or UTRAN.
In case of a GSM BSS, GSM ciphering is applied. When the GSM
subscriber is in the UTRAN, UMTS ciphering and integrity keys CK
and IK are derived from GSM ciphering key Kc and UMTS ciphering
is applied. (UMTS01).
For UMTS subscribers in a mixed network:
Authentication and key agreement shall be performed depending on
whether it is attached to a UTRAN or BSS and whether the user has R99+
or R98- UE.
The following figure shows the different scenarios that can occur with UMTS
subscribers.
AKA of UMTS Subscribers

Release 99 + CK, IK >Kc
HLR/AuC XRES > SRES
Quintets Triplets
Release 99+ VLR/SGSN

Release 98-VLR/SGSN
CK, IK > Kc
CK, IK > Kc XRES > SRES
CK, IK Kc Kc
Kc
UTRAN GSM BSS
RAND RAND SRESm RAND

RES RAND, AUTN SRESm
AUTN
R99 + UE
R99 + UE capable of UMTS AKA UE
or R98-UE
CK, IK Kc Kc Kc
CK, IK CK, IK >Kc CK, IK >Kc CK, IK >Kc U

RES > SRES RES > SRES S
I
UMTS01 UMTS02 M
UMTS02 UMTS01

Translation Between 2G and 3G Security Information

To support inter-generational (2G to/from 3G) Location Update and
Handover/Relocation:
The 3G MSC/VLR must be able to convert Security Information between

2G and 3G.
The strategy to be employed with the DMS-MSC is that the onus for
backward compatibility is on the 3G node. There should be no impact to
the 2G network when interworking procedurally with the 3G network.
Derivation of Security Information
To generate 2G information given 3G and vice-versa:

Conversion functions are summarized in the following table.
Conversion function Definition
c1 RAND[GSM] = RAND
c2 SRES[GSM] = XRES1 [+ XRES2 [+ XRES3 [+ XRES4]]]
c3 Kc[GSM] = CK1 + CK2 + IK1 + IK2
c4 CK[UMTS] = concat (00, Kc)
c5 IK[UMTS] = concat (Kc, Kc)
Authentication Procedure
A secret key is shared between the user and the network. It is available only to
the USIM and the authentication center. This method provides a maximum
compatibility with the current GSM security architecture. It uses a challenge/
response protocol identical to the GSM subscriber authentication and key
establishment protocol.
Each time authentication procedure runs, a new ciphering key and a new
integrity key (CK, IK) are produced. AUTN (Authentication Token) is used
by the mobile to identify and recognize the network.
Upon receipt of a request from the VLR:
1. The AuC sends an ordered array of n authentication vectors (the

equivalent of a GSM "triplet") to the VLR.
Each authentication vector consists of the following components: a
random number RAND, an expected response XRES, a cipher key CK, an
integrity key IK and an authentication token AUTN. Each authentication
vector is good for one authentication and key agreement between the
VLR and the USIM.
UMTS Algorithm Framework
Authentication
Subscriber Specific vectors
Inputs
Authentication Algorithm Encryption engine
RAND, XRES, CK, IK, AUTN
SQN, AMF, RAND, K
Flavour information
C1, C2, C3C5

R1, R2, R3R5

When the VLR initiates an authentication and key agreement:
2. It selects the next authentication vector from the array and sends the
parameters RAND and AUTN to the user.
3. The USIM checks whether AUTN can be accepted and, if so, produces a
response RES which is sent back to the VLR.
4. The USIM also computes CK and IK.
5. The VLR compares the received RES with XRES.
If they match the VLR considers the authentication and key agreement
exchange to be successfully completed. The established keys CK and IK
then are transferred by the USIM and the VLR to the entities which
perform ciphering and integrity functions.
Authentication and Key Agreement
HLR
HLR
VLR
Authentication Data Request
Distribution of Generate authentication vectors

authentication vector AV(15)

from HLR/AuC to VLR
Authentication Data Response AV(15)
Store authentication vectors
Select authentication vectors AV(i)
User authentication request RAND(i)

AUTN (i)
Authentication and
Verify AUTN(i) key establishment
Compute RES(i)
User authentication response RES(i)
Compare RES(i) and XRES(i)
Compute CK(i) and IK(i) Select CK(i) and IK(i)
UMTS Security Mode 7

Security mode includes integrity and ciphering control.
Integrity
Integrity protection verifies that signaling data has not been modified in an
unauthorized way since it has been sent by the sending entity (SuperNode or
UE) and that the origin of the signaling data received is the one claimed.
This procedure:
Needs an IK key and an UIA (UMTS Integrity Algorithm) implemented

in both the RNC and the UE.
Prevents modification for signaling data on the radio interface.
The input parameters of the algorithm are:
the IK (Integrity Key)

a time-dependent input (COUNT-I)
a random value generated by the network side (FRESH)
the direction bit (DIRECTION)
the signaling data (MESSAGE)
Based on these input parameters, the user computes a Message
Authentication Code for data Integrity (MAC-I) using the UIA. The MAC-I is
then added to the message when sent over the radio access link.
The receiver computes XMAC-I on the message received in the same way as
the sender computed MAC-I on the message sent. It verifies the data integrity
of the message by comparing it with the received MAC-I.
The input parameter COUNT-I protects against replay during a connection. It

is a value which is incremented for each integrity-protected message.
COUNT-I contains two parts:
the HFN (HyperFrame Number) as the most significant part

a Radio Ressource Control (RRC) Sequence Number as the last
significant part
The initial value of the hyperframe number is sent by the user to the network
at connection setup. The user stores the greatest used hyperframe number
from the previous connection and increments it.
In this way the user is sure that no COUNT-I value is reused (by the network)
with the same integrity key.

The integrity mechanism is described in the following figure.
UMTS Integrity
Sender (UE or RNC) Radio interface Receiver (UE or RNC)
Generated by the network

(SRNC)
COUNT-I IK
FRESH
MESSAGE COUNT-I
DIRECTION FRESH DIRECTION

Bit (UL or DL) Bit (UL or DL)
MESSAGE
UMTS Integrity UMTS Integrity
Algorithm (UIA) Algorithm (UIA)
IK
XMAC-I
MAC-I
MESSAGE MAC-I
OK
+ - MAC-I =
Ciphering
User data and some signaling information elements are considered sensitive
and must be protected.
The confidentiality of user traffic concerns the information transmitted on

traffic channels. The confidentiality function fulfills the needs for a protected
mode of transmission. This function is applied on dedicated channels between
the UE and the RNC.
The UMTS Encryption Algorithm (UEA) is implemented in both the UE and

the RNC. The UEA produces one output as a sequence of key stream bits
referred to as a KSS (Key Stream Segment).
A KSS of length n is produced to encrypt a given segment of plain text of

length n. The KSS bits are labeled KSS(0), KSS(n-1), where KSS(0) is the
first bit output from the generator. The KSS bits are used to encrypt or decrypt
the data.
The ciphering mechanism is described in the following figure.
Ciphering
Sender (UE or RNC) Radio interface Receiver (UE or RNC)
BEARER
BEARER LENGTH LENGTH
COUNT-C COUNT-C
DIRECTION DIRECTION
CK
UMTS Encryption
Algorithm (UEA) UMTS Encryption CK
Algorithm (UEA)
Key Stream Segment (KSS) Key Stream Segment (KSS)

Length n Length n
Data to transmit Received data
Length n
+ +

Security Mode Call Flow
Security Mode Call Flow

SRNC
VLR
1. RRC connection establishment including transfer of the

HFN and the UE security capability from UE to SRNC.
1. Storage of HFN and UE capabilities

2. Initial L3 message with user identity, KSI etc.
3. Authentication and key generation
4. Decide allowed UIAs and UEAs
5. Security mode command (UIAs, IK, UEAs, CK)
6. Select UIA and UEA, generate FRESH.

Start integrity and start deciphering
7. Security control command (CN domain, UIA, FRESH, UE

security capacity, UEA, etc.)
8. Control of UE security capbility. Verify

message, start integrity and ciphering.
9. Security control response
10. Verify received message: start ciphering

11. Security mode complete (selected UEA and UEA)
Detailed description of the flow above:
1. RRC connection establishment includes the transfer from UE to RNC of

the UE (User Equipment) security capability and the HFN to be used as
part of one of the input parameters for the integrity algorithm and for the
ciphering algorithm. The COUNT-I parameter (together with COUNT
which is used for ciphering) is stored in the SRNC.
2. The UE sends the Initial L3 message (Location update request, CM
service request, Routing area update request, attach request, paging
response etc.) to the relevant CN (Core Network) domain. This message
contains relevant MM information e.g. KSI. The KSI (Key Set Identifier)
is the number allocated by the CN at the last authentication for this CN
domain.
3. Authentication of the user and generation of new security keys (IK and
CK) may be performed. A new KSI will then also be allocated.
4. The CN node determines which UIAs (UMTS Integrity Algorithm) and
UEAs (UMTS Encryption Algorithm) are allowed to be used.
5. The CN initiates integrity (and possibly also ciphering) by sending the

RANAP message Security Mode Command to SRNC. This message
contains a list of allowed UIAs and the IK to be used. It may also contain
the allowed UEAs and the CK to be used.
6. The SRNC decides which algorithms to use by selecting from the list of
allowed algorithms, the first UEA and the first UIA it supports. The
SRNC generates a random value FRESH and initiates the downlink
integrity protection. If SRNC supports no UIA algorithms in the list, it
sends a SECURITY MODE REJECT message to CN.
7. The SRNC generates the RRC message Security control command. The
message includes the UE security capability, the UIA and FRESH to be
used and possibly also the UEA to be used. Additional information (start
of ciphering) may also be included. Since we have two CNs with an IK
each, the network must indicate which IK to use. This is obtained by
including a CN type indicator information in "Security control
command". Before sending this message to the UE, the SRNC generates
the MAC-I (Message Authentication Code for Integrity) and attaches this
information to the message.
8. At reception of the Security control command message, the UE controls
that the UE security capability received is equal to the UE security
capability sent in the initial message. The UE computes XMAC-I
(Message Authentication Code) on the message received by using the
indicated UIA, the stored COUNT-I and the received FRESH parameter.
The MS verifies the integrity of the message by comparing the received
MAC-I with the generated XMAC-I.
9. If all controls are successful, the UE compiles the RRC message Security
control command response and generates the MAC-I for this message. If
any control is not successful, a SECURITY CONTROL REJECT
message is sent from the MS.
10. At reception of the response message, the SRNC computes the XMAC-I
on the message. The SRNC verifies the data integrity of the message by
comparing the received MAC-I with the generated XMAC-I.
11. The transfer of the RANAP message Security Mode Complete response,
including the selected algorithms, from SRNC to the CN node ends the
procedure.
The Security mode command to UE starts the downlink integrity protection,
i.e. also all following downlink messages sent to the UE are integrity
protected and possibly ciphered. The Security mode command response from
UE starts the uplink integrity protection and possible ciphering, i.e. also all
following messages sent from the MS are integrity protected and possibly
ciphered.

Call Processing 7
Call processing involves the series of events necessary for call setup and call
control. Call processing functions can be viewed as a flow of messages
between two or more network elements that send and receive call processing
events. Call processing agents are the network elements, such as the DMS-
MSC, the VLR, and the DMS-HLR.
The flow of call processing is organized as follows:

paging of the called mobile station
Public Switching Telephone Network (PSTN) originated call to UE
(mobile terminated)
UE to PSTN (mobile originated)
mobile-to-mobile call processing.
Mobile Station Paging

Before a call is terminated at an UE, the exact location of the UE must be
determined using the paging procedures:
Paging
The following figure illustrates the paging process:
Paging
Paging
1. Paging Command
2. IMSI or TMSI
DMS/MSC
DMS/MSC 3. LAC and Cell ID 3. LAC and Cell ID
4. Voice Path
5. Traffic Channel Allocation
UE
UTRAN
PSTN to Mobile Terminating Call Setup

The following figure and procedure describe the steps for a PSTN to UE call
setup:
1. A land line subscriber dials an UE number (MSISDN). An Initial Address
Message (IAM) is sent to the GMSC to set up the voice facilities for the
call.
2. Gateway MSC (GMSC) launches a database query using the feature Send
Routing Information (SRI). The SRI command is routed to the DMS-
HLR.
3. HLR sends a provide roaming number request to the serving VLR.
4. VLR returns a Mobile Station Roaming Number (MSRN) to the HLR.
5. HLR returns the routing information to the GMSC.
6. GMSC sends a send information on incoming call request to the VLR.
7. VLR sends a message instructing the GMSC to page the UE.
8. GMSC sends the page request to the RNC.
9. RNC sends an Initial UE message containing the paging response to the
GMSC.
10. CM service accept.
11. GMSC sends a process access message to the VLR.
12. The Authentication procedure takes place. For more information, refer to
Authentication and Key Agreement.
13. The security procedure takes place. For more information, refer to
UMTS Security Mode.
14. TMSI allocation procedure takes place.
15. VLR sends a Complete Call to GMSC.
16. GMSC sends a call setup request through the RNC to the UE.
17. UE sends a call confirmation message through the RNC to the GMSC.
18. GMSC sends a RANAP RAB (Radio Access Bearer) assignment request
to the RNC.
19. RNC returns RAB assignment response to the GMSC.
20. UE sends an alerting message to the GMSC.
21. GMSC sends an Address Complete Message (ACM) to the PSTN.
22. MS sends a connect message through the RNC to the GMSC.
23. GMSC returns a connect acknowledge message through the RNC to the
UE to verify the connection has been established.
24. GMSC sends an ANswer Message (ANM) to the PSTN.

PSTN to MS Call Setup
PSTN to UE Call Setup

3) Provide Roaming Number
4) Provide Roaming Number ACK [MSRN]
6) Send Info I/C Call

VLR 7) Paging HLR
11) Process Access Request 2) Send Routing Info. [MSISDN]
UE 12) Authentication procedure
TERMINATING 5) Send Routing Info. ACK [MSRN]
13) Security procedure
14. TMSI allocation procedure
15. Complete Call ORIGINATING

GMSC
8) Paging
GMSC
GMSC
9) Paging Response PSTN
RNC
BSS 10) CM service accept
12) Authentication procedure 1) Initial Address MSG (IAM) MSISDN]

14) TMSI allocation procedure
16) Setup
17) Call Confirmed
18) RAB Assignment Request
19) RAB Assignment response
20) Alerting
21) Address Complete MSG (ACM)
22) Connect
23) Connect ACK 24) Answer MSG (ANM)
UE to PSTN (mobile originated)

System components do not make any routing decisions about the called
number. The call is forwarded to a GMSC and is routed out of the system.
The following figure illustrates a mobile-originated call.
1. UE sends a CM service request to the RNC.

2. RNC sends an Initial UE message containing the CM service request to
the MSC.
3. MSC sends a CM Service accept message to the VLR.
4. MSC sends a Process Access Request response to the VLR.
5. Authentication procedure.
6. Security procedure.
7. TMSI allocation procedure.
8. UE returns a call setup command through the RNC to the MSC.
9. MSC sends a send information for outgoing call message to the VLR.
10. VLR sends a complete call message to the MSC.
11. MSC sends a call proceeding message through the RNC to the UE.
12. MSC sends a RAB assignment request to the RNC.
13. RNC returns the RAB assignment response to the MSC.
14. MSC sends an IAM to the PSTN to set up the voice component of the call.
15. PSTN returns an ACM.
16. MSC sends an alerting message to the UE.
17. If the PSTN phone answers, an ANM is sent to the MSC to indicate the
call can be completed.
18. MSC sends a connect message to the UE to instruct it that conversation
can begin.
19. UE sends a connect acknowledgment message to the MSC and
conversation begins.

MS to PSTN Call Setup
UE to PSTN Call Setup

4) Process Access Request
5) Authentication procedure
VLR
7) TMSI Allocation
GMSC ORIGINATING
9) Send Info. O/G Call

MSC
MSC
10) Complete Call
TERMINATING
2) Initial UE message. 1) CM Service Request

PSTN RNC
BSS
RNC
3) CM service accept
7) TMSI Allocation procedure
8) Call Setup
11) Call Proceeding
12) RAB Assignment Request
14) Initial Address MSG (IAM) 13) RAB Assignment Response
15) Address Complete MSG

16) Alerting
17) Answer MSG (ANM) 18) Connect
19) Connect ACK
Mobile-to-mobile (UE to UE)

The steps involved in a mobile-to-mobile call combine the steps in an MS to
PSTN call and a PSTN to an MS call. The following figure illustrates a
mobile-originated call.
1. The UE sends a CM service request message to the RNC.

2. The RNC sends an Initial UE message containing the CM service request
to the MSC.
3. CM service accept is sent from MSC to UE.
4. The GMSC sends a process access request message to the VLR.
8. The UE sends a call setup request through the RNC to the GMSC.
9. The GMSC sends a send information on outgoing call message to the
VLR.
10. The VLR sends a complete call message to the GMSC.
11. The GMSC sends a call proceeding message through the RNC to the UE.
12. The GMSC sends a RAB assignment request to the RNC.
13. The RNC returns the RAB assignment response to the GMSC.
14. The GMSC launches a database query using the SRI feature. The SRI is
routed to the DMS-HLR.
15. The HLR sends a provide roaming number request to the serving VLR.
16. The VLR returns an MSRN to the HLR.
17. The HLR returns the routing information to the GSMC.
18. The GSMC sends a send information on incoming call request to the
VLR.
19. The VLR sends a command instructing the GSMC to page the UE.
20. The GMSC sends the page command to the RNC.
21. The RNC sends an Initial UE message containing the paging response to
the GMSC.
22. The GMSC sends a Complet Call message to the UE.
23. The GMSC sends a process access request message to the VLR.


27. The VLR sends a Complete Call message to the GMSC.
28. The GMSC sends a call setup request through the RNC to the UE.
29. The UE sends a call confirmation message through the RNC to the
GMSC.
30. The GMSC sends a RAB assignment request to the RNC.
31. The RNC returns the RAB assignment response to the GMSC.
32. The terminating UE sends an alerting message to the GMSC.
33. The GMSC sends an alerting message to the originating UE.
34. The terminating UE sends a connect message to the GMSC to instruct it
that conversation can begin.
35. The GMSC sends a connect message to the originating UE to instruct it
that conversation can begin.
36. The originating UE sends a connect acknowledgment message to the
GMSC.
37. The GMSC sends a connect acknowledgment message to the terminating
UE and conversation begins.
UE to UE Call Setup
UE to UE Call Setup
TERMINATING
15) Provide Roam Num.
VLR 16) Result Roam Num.
RNC
BSS 18) Send Info. I/C Call setup 4) Process Access HLR
19) Page MS Command 5) Authentication procedure
23) Process Acc. Req.
ORIGINATING
25) Security mode 9) Send Info. O/G Call
26) TMSI allocation procedure 10) Complete Call
27) Complet Call

GMSC
20) Paging
14) SRI
RNC
BSS
GMSC
GMSC
21) Initial UE (Paging Response) 17) Routing Info.
1) CM-Service Req.
2) CM-Service Req.
22) CM service accept
3) CM Service Accept
24), 25), 26)
5), 6), 7)
28) Call Setup Request
8) Setup Request
29) Call Confirmed
11) Call Proceeding
30) RAB Assignment Request 12) RAB Assignment Request
31) RAB Assignment Complete 13) RAB Assignment Complete
32) Alerting
33) Alerting
34) Connect
35) Connect
36) Connect ACK

37) Connect ACK.
UE to UE call termination
As illustrated in the following figure, the steps describe a UE to UE call
termination:
1. The terminating UE sends a disconnect message through the RNC to the
GMSC.
2. The GMSC sends a release message to the terminating UE.
3. The GMSC sends a disconnect message through the RNC to the
originating UE.
4. The terminating UE sends a release complete message to the GMSC.
5. The GMSC sends an Iu Release command to the RNC.
6. The originating UE sends a release message through the RNC to the
GMSC.
7. The GMSC sends a release complete message through the RNC to the
originating UE.
8. The GMSC sends an Iu Release command to the RNC.
9. The RNC sends an Iu Release complete message to the GMSC.
10. The RNC sends a Iu release complete message to the GMSC.
UE to UE Call Termination
UE to UE Call Termination
ORIGINATING
TERMINATING
UE
UE
GMSC
GMSC
GMSC
RNC
BSS
RNC RNC
BSS
RNC
1) Disconnect
2) Release
3) Disconnect
4) Release Complete
5) Iu Release Command
6) Release
7) Release Complete
8) Iu Release Command
9) Iu Release Complete
10) Iu Release Complete

Review Questions 7
1. When is the location update procedure triggered?
2. What is the purpose of authentication?
3. Which procedure is used to determine the exact location of the UE?
4. What is the purpose of the integrity procedure?
5. List the components of an authentication vector generated by the AuC.
Lesson 8
UMTS Handover
Objectives 8
Objectives

documentation, the you will be able to:
Define handover.
Define UMTS handover types.

Describe handover messages.
Describe the Intra UMTS MSC SRNS relocation.
Discuss the Inter UMTS MSC SRNS relocation:
9 basic inter-MSC
9 subsequent inter-MSC
9 subsequent handback
Discuss Inter System handover.
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 8. UMTS Handover 8-2

8-2 UMTS Handover Nortel Networks Confidential
UMTS Handover Overview 8

Handovers switches a UE from one radio link to another. Many circumstances
can cause handover including movement of the UE, radio propagation, and
equipment failure.
UMTS has a new radio interface to the mobile. The mobile is connected to the
Core Network by an RNS (Radio Network System). The RNS is equivalent to
the BSS in GSM and an RNC (Radio Network Controller) is equivalent to a
BSC in GSM.
UMTS Handover
UMTS handover over Iu interface is
called Relocation RNC
Node B
Iu interface
MSC
MSC A
A
RNS Iur
Node B RNC
Iu interface
User Equipment RNS
GSM handover A interface

MSC
MSC B
B
BSS
BSC
BSC
MSC
MSC C
C
BSS
A interface
The interface between the RNC and the MSC is called the Iu-interface
(equivalent to A-interface in GSM). The messages that go over the interface
are known as RANAP (Radio Access Network Application Part) messages.
Relocation of Serving Radio Network System (SRNS) is a UMTS

functionality used to relocate the serving RNS role from one RNS to another
RNS, and represents a handover over the Iu-interface.
Nortel Networks Confidential UMTS Handover 8-3
UMTS Handover Types

In UMTS, two RNCs can communicate with each other via the Iur interface.
This and other capabilities in the RNC and the UE allow for three handover
types in the UTRAN:
Soft HO - is fully performed within UTRAN, without involving the Core

Network. In a Soft HO, the UE has several radio connections established
to one or more Node Bs connected to one or more RNC(s). When the UE
moves from one cell to another, establishment of a new radio connection
is therefore not necessary.
If radio links are with multiple RNCs, the RNC that controls the
communication toward the Core Network is known as the Serving RNC
and the others that the UE might be connected to are known as Drift
RNCs.
Softer Handover - If an UE hands over from one cell to another and both
cells belong to the same Node B, the channel on the Iub interface does not
change : this is called a softer handover.
Hard HO - may be also performed within UTRAN, or the Core Network
may be involved if the Iur interface between RNSs does not exist.
In UMTS, Hard HO is similar to GSM HO. In order to maintain the
communication with the UE, establishment of a new radio connection is
necessary.
If the two RNCs have an Iur interface, this handover can occur without
CN involvement.
Intra RNC Inter RNC, Intra MSC Inter MSC, Intra PLMN
Soft This combination is This combination is This combination is not
HO applicable, but there applicable and there is applicable/possible.
is no impact to CN. impact to CN if there is
SRNS Relocation. The UE
is not involved in this type
of handover.
Hard This combination is This combination is This combination is
HO applicable, but there applicable, however, there applicable, however, there
is no impact to CN. is no impact to CN if IUR is no impact to CN if IUR is
interface is used. CN is used. CN is impacted if
impacted if there is SRNS there is SRNS Relocation
Relocation or if there is no or if there is no IUR
IUR interface. The UE is interface. The UE is
involved in this type of involved in this type of
handover. handover.

Handovers in UMTS
Inter RNC
Soft Handover
RNS SRNC
Node B
Core
CoreNetwork
Network
Iub
Iur
Node B
DRNC
Iub
RNS
Softer Handover Intra Node B
Iub Core
Node B Core
Network
SRNC Network
RNS
Hard Handover SRNC

Core
Iub Core
Network
Network
UMTS
UMTSRNC
RNC
GSM
GSMBSS
BSS
SRNS relocation
SRNS Relocation is defined as a reconfiguration of the network route while
the radio link to the UE remains constant.
Note: SRNS Relocation is not the same as Relocation of SRNS. While

Relocation of SRNS deals with all kinds of handover in UMTS, SRNS
Relocation is a term used only for streamlining.
The following figure illustrates the SRNS relocation process:
Before SRNS relocation, soft handover is performed via the Iur interface.
After SRNS relocation, the data path is optimized.
SRNS Relocation
SRNC
Iub Iu
3G_MSC
3G_MSC A
A
Node B
Iur
DRNC
Node B
If Iur interface exists between two (or more) RNCs and Relocation
Required is sent to the CN because of SRNS Relocation procedure, the UE is
not involved in the relocation. This relocation procedure is entirely located
and executed by RNC and the CN.
However, if there is no Iur interface between RNCs and a relocation needs to

take place, the UE is involved in the relocation procedure. This relocation is
termed just handover.

UMTS CCN Handover 8

Handover between RNCs connected to different MSCs is termed as an Inter-
MSC handover. This category can be sub-divided into four further
procedures:
The Basic Inter-MSC Handover procedure: the UE is handed over from

a controlling MSC (MSC-A) to another MSC (MSC-B).
The Subsequent Inter-MSC Handover procedure: the UE is handed
over from MSC-B to a third MSC (MSC-C).
The Subsequent Inter-MSC handback procedure: the UE is handed
back from MSC-B to MSC-A.
The Intra-MSC handover procedure: the UE is handled by one MSC.
GSM15 Intra MSC GSM/UMTS Handovers
Node B SRNC
UMSC
UMSC A
A
Iub
BSS MSC
MSC B
B
SRNC
BSS
Handover functionality supports Circuit Switch Data (CSD) calls. If there is

no Iur interface between RNCs and a relocation needs to take place, the UE is
involved in the relocation procedure. This relocation is termed just handover.
Only Inter MSC Handover of a TCH (Traffic Channel) is supported.
RANAP and BSSMAP Handover Message Equivalency

The following table shows the messages between the CS and the RNC.
RANAP and BSSAP Handover Messages
BSSMAP RANAP FROM TO
Handover Request Relocation Request CS RNC
Handover Required Relocation Required RNC CS

Handover Required Reject Relocation Preparation Fail CS RNC
Handover Request Ack Relocation Request Ack RNC CS
Handover Command Relocation Command CS RNC
Handover Complete Relocation Complete RNC CS
Handover Failure Relocation Failure RNC CS
Relocation Detect RNC CS
Handover Detect Relocation Cancel RNC CS
Relocation Cancel Ack CS RNC

Intra UMTS MSC SRNS Relocation 8

Procedure for Intra-UMTS MSC SRNS Relocation
SRNS Relocation is used to relocate the serving RNS functionality from one
RNS to another. The procedure may or may not involve change of the radio
resources assigned for the corresponding UE. Whether or not the Relocation
includes change of radio resources assigned for the UE does not affect the
SRNS Relocation procedure in the Core Network.
The following figures describe the procedure for a successful Intra-3G_MSC

SRNS Relocation.
Intra-MSC SRNS Relocation: Iur Usage
RNC-A RNC-B
3G_MSC
3G_MSC A
A
Relocation-Required
Relocation-Request
Service/Target RNC ID
RAB parameters
1 Relocation Relocation 2
preparation Allocation
Relocation-Request-Ack
Relocation Command
SRNS-Relocation-Commit (Iur interface)
Relocation-detect
Relocation 3
Relocation-Complete completion
Release-Command
Release-Complete
SRNS relocation is alwys composed of the three following steps:
relocation preparation
relocation allocation
relocation completion
Intra-MSC SRNS Relocation: without Iur Usage
RNC-A RNC-B
3G_MSC
3G_MSC A
A
Relocation-Required
Relocation-Request
Relocation Command
Detection of UE in target RNS

HO-Command
Relocation-detect
HO-Complete
Relocation-Complete
Release-Command
Release-Complete
A hard HO is triggered when:
No Iur interface is present.

Iur interface is not used for relocation.
In both cases, the radio ressource change occurs.

Inter UMTS MSC Handover 8

Basic inter-MSC Handover
The following figure shows the basic inter-MSC handover process.
Basic Inter-MSC Handover
Basic Inter-MSC Handover
3G_MSC
3G_MSC A
A
3G_MSC
3G_MSC B
B
RNC A
RNC B
LAC 1
LAC 2
When a UE is in use, the RNS monitors the UE movement and is responsible

for determining that a relocation is necessary.
For intra-MSC handover, the DMS-MSC may not be notified that a handover
has taken place. However, for inter-MSC handovers, the DMS-MSC is
notified because the DMS-MSC must find the next DMS-MSC where to
complete the call handover.
Call Flow of a Basic Inter-MSC Handover
Basic Inter-MSC Handover Procedure
3G_MSC A 3G_MSC B
RNS-A RNS-B
Reloc-Required
Prep. HO req. Allocation of Handover
Number = HON within
(Target RNC Id + LAC)
VLRB
Reloc. Request
Reloc Request Ack

Prep-Handover resp (HON)
HON Translation
IAM
Relocation Command ACM

Relocation-Detect
Process-Access-Sig req.
Rel-CMD/COM Send-End-Signal-req. Relocation-Complete
Answer
Release
End of call Send-End-Signal resp.
Release Complete

Subsequent inter-MSC Handover 8

The following figure describes a subsequent inter-MSC handover.
Subsequent Inter-MSC Handover
Subsequent Inter-MSC Handover
3G-MSC
3G-MSC A
A 3G-MSC
3G-MSC B
B
3G-MSC
3G-MSC C
C
RNS A
RNS B
RNS C
LAC 1
LAC 2 LAC 3
Subsequent inter-MSC HO occurs when:
MSC-A has performed a handover to the MSC-B.

The call subsequently requires a second handover to the MSC-C because
the subscriber has moved under the coverage of this MSC.
The following figure shows the subsequent inter-MSC handover procedure.
Call Flow of a Subsequent Inter-MSC Handover
Subsequent Inter-MSC Handover Procedure
3G_MSC C 3G_MSC A 3G_MSC B
RNS C RNSB
Reloc. Required
Prepare Subs HO Req
Prepare HO Request
Allocation of HON
Reloc. Request
Reloc. Request Ack

Prep. HO response Translation of HON
IAM
ACM
Prep. Subs HO response

Reloc. Detect
PAS req. Relocation Command
Reloc. Complete
SES
ANS
Release
SES
Release Command
Release Complete

Subsequent Handback Handover

The following figure describes a subsequent handback handover.
3G_MSC
3G_MSC A
A 2, 3
5 3G_MSC
3G_MSC B
B
6
1
RNS A
RNS B
LAC 1
LAC 2
Subsequent handback handover occurs when the 3G_MSC B hands a call

back to the 3G_MSC A, the anchor switch. This scenario occurs when a
mobile equipment roams back into its original RNS area.
The following figure shows the subsequent handback handover procedure.
Call Flow of a Subsequent Handback Handover
Subsequent Handback Handover Procedure
3G_MSC A 3G_MSC B
RNS B RNS A
Relocation Request
Prep-Sub-HO req.
Relocation Request
Relocation Request Ack

Prep. Sub-HO resp.
Relocation Command
Relocation Detect
Relocation Complete
Send-End-Signal req. Release Command
Release Complete
Release
Send-End-Signal resp.
Release Complete

Inter System Handover 8
Inter System Handover
Intersystem handover refers to interoperability between UMTS 3G and

GSM 2G networks. The following list summarizes the types of
handovers:
Intra MSC UMTS to GSM and GSM to UMTS

Inter MSC UMTS to GSM and GSM to UMTS
Inter MSC subsequent handover UMTS to GSM and GSM to UMTS
Inter MSC subsequent handback UMTS to GSM and GSM to UMTS
In both cases, the 3G-MSC has the responsability to translate the messages
and parameters received from the radio interface from (or given to) BSSAP to
RANAP and from RANAP to BSSMAP.
Intra MSC Handover Procedures

In GSM:
Handover Request was sent out in an SCCP (Signaling Connection

Control Part) Connect Request message to the target BSS.
In Nortel UMTS MSC:
1. Sends an empty SCCP Connect Request.

2. Receives a positive response (SCCP Connect Confirm).
3. Sends Relocation Request to the target RNC.
The time-out/error responses to the SCCP Connect Request are treated by

the handover application similar to time-out/error responses to Relocation
Request message.
Intra MSC GSM to UMTS Handovers

SRNC
MSC
MSC A
A
BTS target
Handover Required
SCCP Connect Request

Start T101 timer
Stop T101 timer SCCP Connect Confirm
Relocation Request
Start T101 timer
Relocation Request Ack.
Stop T101 timer
Handover Command
Start T102 timer Relocation Detect
Stop T102 timer Relocation Complete

Clear Command
Handover preparation procedure
Clear Complete Handover allocation procedure
Handover completion procedure


Basic inter-MSC Inter System Handover

From UMTS to GSM Handover
The handover from UMTS to GSM requires RANAP relocation on the
UMTS side, MAP signaling between MSCs and BSSMAP handover
signaling on the GSM side.
The anchor point is the UMTS MSC. Classmark and ciphering information is
sent to the 2G side. The 3G_MSC does the conversion from RANAP to
BSSMAP so the message sent over the E-interface is a MAP message with
BSSMAP encapsulated.
Basic Inter MSC Inter System:

UMTS to GSM Handover
3G_MSC A MSC B
UE/RNS A BSS B/MS/UE
Relocation Required
Prep-HO req.
HO Request
HO-Request-Ack
Prep. -HO resp.
IAM
ACM
Relocation Command
Process-Access-Sig req. HO Detect
Release-CMD/COM Send-End-Signal req. HO Complete
Answer
Release
End of call Send-End-Signal resp.
Release Complete
Iu interface A interface
The 3G_MSC also computes the GSM Kc from UMTS ciphering and
integrity information.
From GSM to UMTS Handover

In Inter MSC GSM to UMTS Handover:
The target UMTS RNC uses 14.4k for all handovers from source GSM
BSS.
This information is set in the MSC, replacing the original negotiated rate
i.e All subsequent handovers starts with 14.4k.
After receiving Relocation Request Ack, if the channel information is

changed then it is stored in MSC-B for subsequent intra-MSC handover,
and encoded in IE in Prepare Handover Ack to bring back to MSC-A.
This information is used for subsequent inter-MSC handover.
Basic Inter MSC Inter System:

GSM to UMTS Handover
MSC A 3G_MSC B
UE/BSS A RNS B/UE
HO Required
Prep-HO req.
Relocation Request
Prep. -HO resp.
IAM
ACM
HO Command
Process-Access-Sig req. Relocation Detect
Send-End-Signal req. Relocation Complete

Clear-CMD/COM
Answer
Release
End of call
Send-End-Signal resp.
A interface Release Complete Iu interface

Adaptation Rate for CSD Handover

Handover functionality is enhanced to support CSD calls.
The swithed data rates supported during handovers are as follows:
Handovers UMTS CSD rates GSM CSD rates

UMTS to GSM handover 64K Not available
14.4K 14.4K
GSM to UMTS 14.4K 300 bps
14.4K 1200 bps
14.4K 2400 bps
14.4K 4800 bps
14.4K 9600 bps
14.4K 14.4K
Not available Alternate speech/data
Not available Speech followed by data
Review Questions 8
1. List the three types of UMTS handover.
2. Describe SRNS relocation purpose.
3. List the four types of UMTS CCN handovers.
4. List the three steps involved in a handover.
5. What is an Inter system handover?

Lesson 9
UMTS Supplementary Services
Objectives 9
Objectives
Given student lesson, instructor lecture, and appropriate documentation,

you will be able to describe DMS-MSC supplementary services, including:
Call forwarding and related supplementary services

Call restriction (call barring) and related supplementary services
Call completion and related supplementary services
User control of supplementary services
Special translation enhancements
Extension services
Location Services
Mobile Network Portability
PE/TRD/CN/UM931 16.02/EN May, 2003 Lesson 9. UMTS Supplementary Services 9-2

9-2 UMTS Supplementary Services Nortel Networks Confidential
DMS-MSC Supplementary Services 9

Supplementary services provide capability to the DMS-MSC to modify or
supplement basic telecommunication services, such as call waiting and call
barring.
The supplementary services handling process takes place in the following three
stages:
Provisioning enrolls the User Equipment (UE) with various services, such
as call forwarding. Registration of subscription options and the entry of
supplementary services parameters may be performed at this stage.
Supplementary services are assigned in the subscriber DMS-HLR.
The UE, VLR, and DMS-HLR are involved in retrieving subscription
options, registration parameters and activation parameters from the DMS-
HLR database.
The final stage of the supplementary services handling process occurs
during the use of supplementary services features as the call progresses
and as these features are turned on and off.
The DMS-MSC supports the supplementary services and related services

listed in the following table. The tables list and describe all available
supplementary services, and list the call types the supplementary service may
be applied to.
Nortel Networks Confidential UMTS Supplementary Services 9-3
DMS-MSC Supplementary Services
Supplementary Call Type Description

Service
Call forwarding speech, Forwards all incoming calls to a specified
unconditional (CFU) data, fax destination address regardless of the current
status of the call forwarding UE.
Call forwarding busy Forwards incoming call to a specified
(CFB) destination address when the call forwarding
UE is busy.
Call forwarding no reply Forwards an incoming call to a given
(CFNRy) destination address when the call is not
answered by the call forwarding UE within a
specified period of time.
Call forwarding not Forwards incoming calls to a specified
reachable (CFNRc) destination when the call forwarding UE is not
registered, is experiencing radio congestion
or is not responding to the page.
Call forwarding Notifies the served UE that a call has been
notification to served forwarded due to CFB (network determined
UE user busy only) or CFNRy. Also, notifies the
served UE that call forwarding is active when
the UE makes an outgoing call.
Call forwarding Notifies the calling and forwarded-to parties
notification to calling that a call has been forwarded because the
party and forwarded-to called party has call forwarding active.
party


Services
Barring of all incoming speech, Prevents the UE from receiving any incoming
calls (BAIC) data, fax calls.
Barring of all incoming Prevents the UE from receiving any incoming
calls when roaming calls if the mobile subscriber is roaming
outside the home outside of the mobile subscriber home PLMN
PLMN country country.
(BIC-roam)
Barring of all outgoing Prevents the mobile subscriber who has
calls (BAOC) activated BAOC from making any outgoing
calls, except emergency calls.
Barring of outgoing Prevents the mobile subscriber from making
calls when roaming any outgoing calls if the mobile subscriber is
outside the home roaming outside of the mobile subscribers
PLMN country (BAOC- home PLMN country.
roam)
Barring of outgoing Allows the mobile subscriber with BOIC to call
international calls only subscribers of any PLMN or fixed
(BOIC) network in the country in which the mobile
subscriber with BOIC is currently roaming.
Barring of outgoing Allows the mobile subscriber with BOIC-exHC
international calls to make international calls only to subscribers
(BOIC) except those of its home PLMN country. The mobile
directed to the home subscriber with BOIC-exHC can also call
PLMN country subscribers locally within the visited PLMN
(BOIC-exHC) where it is currently roaming.
Barring of outgoing Prevent the mobile subscriber from making
premium rate calls calls to directory numbers classified as
(information) premium-rate numbers.
Barring of outgoing Prevents the mobile subscribers from making
premium rate calls calls to directory numbers classified as
(entertainment) premium-rate numbers.
Barring of Prevents the mobile subscriber from
supplementary performing any supplementary service
services management operations. It does not prevent invocation of
any currently activated supplementary
service.
Call barring notification Notifies the calling mobile subscriber (who
to calling mobile has subscribed to any outgoing call barring
subscriber service) when outgoing call barring is active
and applicable to the call. Also, notifies the
calling UE when the called mobile subscriber
has incoming call barring active and it is
applicable to the call.

Services
Local calls only (LCO) Allows the mobile subscriber with LCO to call
only to a specific set of local destination
numbers. LCO subscribers may not call
beyond the local source area in which they
are roaming.
Operator-determined Allows network operators to bar mobile
barring (ODB) subscribers from certain categories of
incoming calls, outgoing calls, roaming
outside HPLMN, premium rate calls,
supplementary services, explicit call forward,
conditional forward. In addition, network
operators can configure up to four of their
own barring programs based their specific
requirements. These customizable barring
programs are variants of the existing barring
programs.
Advice of charge (AOC) speech Provides the mobile subscriber with real-time
information about the cost of a call.
Alternate line service Allows a mobile subscriber to have two
(ALS) telephony lines, each associated with a
different MSISDN number (one normal and
one auxiliary). The two telephony lines are
associated with one IMSI.
Call waiting (CW) Allows the mobile subscriber to be notified of
an incoming call, which the called UE may
answer, reject or ignore, while the called
mobile subscriber is in the busy state.
Call hold/retrieve Allows the mobile subscriber to place an
active call on hold or retrieve a currently held
call.


Services
Class of service (COS) speech, Provides customer group (CUSTGRP) and
data, fax network class of service (NCOS)
classifications to mobile subscribers within a
user group. These classifications allow a
community of subscribers to have uniform
and group-specific services.
Applications of COS are:
hotline routing and private numbering plan.

Directs all calls to a specified destination
regardless of the dialled destination number.
Allows mobile subscribers to use private

numbers, that are different from the public
numbering plan numbers, to establish calls to
other users of that private numbering plan,
even when calls span different networks and
geographical locations.
Calling line Provides the called mobile subscriber with
identification identification information about the calling
presentation (CLIP) party.
Calling line Restricts the display of identification
identification restriction information about the calling mobile
(CLIR) subscriber to the called party.
Multiparty service speech Allows the mobile subscribers with multi-party
service to make three-way conference calls
by joining a held and an active call into one
conference call using a conference bridge.
Call Independent Supplementary Services (CISSs) 9

A CISS is a supplementary service that can be verified or updated by the
mobile subscriber. The updating or verification is accomplished by a CISS
procedure performed at the mobile station. The CISS procedure verifies or
updates the user supplementary services information held in the HLR. A
CISS procedure does not require the existence of a bearer channel connection.
Note: Not all user equipments can perform CISS procedures.
The DMS-MSC supports user equipment CISS procedures on the following

supplementary services:
password control
call barring - registration
call forwarding SS - registration, erasure, interrogation
call restriction SS - interrogation, activation, deactivation
call waiting - interrogation, activation, deactivation
CLIP - interrogation
CLIR - interrogation
temporary calling line ID restriction - interrogation
Password Control of Supplementary Services

The DMS-MSC supports mobile subscriber password control of some
supplementary services. The mobile subscriber HLR determines when a
password is required. When a password is required, the DMS-MSC and VLR
do not process the password in any way, but perform functions such as
prompting for the password and transferring it to the appropriate node.
Example for User Control of Supplementary Services

The DMS-MSC allows mobile subscribers to verify or update certain
supplementary services. For example, after requesting call waiting activation
or deactivation, the controlling mobile subscriber is informed of the result.
After call waiting interrogation, the controlling mobile subscriber is told
whether call waiting is supported and, if appropriate, is given a list of all basic
service groups for which call waiting is active. The user can then program his/
her call waiting services.

Supplementary Services (SS) 9

An SS modifies or supplements a basic telecommunication service. An SS
must be offered together with a basic telecommunication service.
Following is a list of supplementary services procedures:
Provision of an SS can be made on a subscription basis, that is, after pre-

arrangement with the service provider or the SS can be made generally
available to all UEs with access to UMTS PLMNs.
Withdrawal of an SS can be the result of a subscriber's request or for

administrative reasons. Both withdrawal actions are performed by the service
provider.
Registration of an SS is only applicable to those SSs in which specific data is

required to enable operation of the service. This registration can be the result
of provision or it can be a subscriber-controlled procedure. Registration of an
SS may mean simultaneous activation of that service.
Erasure of an SS is only applicable to those SSs for which registration is

necessary. Erasure may result from withdrawal or being overridden by a new
registration. Overriding can erase the previous registration or it can be a
subscriber-controlled procedure. Erasure of an SS may also result from
simultaneous deactivation of that service.
Activation of an SS can be the result of provision. In some cases the SS is

only activated if the conditions in the subscription options are met. An SS can
also be activated by means of a procedure controlled either by the UE or the
service provider. Some SSs may also be activated as a result of registration.
Deactivation of an SS can be the result of withdrawal or erasure of the

service. In some cases, the SS is deactivated if the conditions in the
subscription options are not met. An SS can also be deactivated by a
procedure controlled either by the UE or the service provider. An SS can be
automatically deactivated at the end of a call if the SS was specifically
activated for that call. An SS may be automatically deactivated by the
network as a consequence of activation of another SS if it conflicts with the
other activated SS.
Invocation of an SS can take place either by means of a subscriber controlled

procedure or automatically by the network as a result of a particular
condition.
Interrogation of an SS is only applicable for a few SSs for which it is useful

to get information from the network about the status or relevant data
concerning the SS.
IMSI Based SS 9
SS that are registered and activated against an IMSI
they become active upon provisioning
the presence of these SS denotes a fully active service
if deactivated then the service is withdrawn (no longer provisioned)
NOT activated/deactivated by the subscriber
Examples: AOCC, AOCI, CLIP, CLIR, HOLD, MPTY, LCO, COLP, COLR,
HOTBILL, ACC, CNAM, MCT AND ECT
BSG Based SS 9
SS that are registered and activated against a specific BSG (Basic
Services Group = Teleservices = Bearer Services)
provision does not result in activation
they are registered and activated per BSG
deactivation leaves the service provisioned
deprovision must be done explicitly
may be activated or deativated by the subscriber
Examples: BAIC, BAOC, BICROAM, BOIC, BOICEXIC, CW, CFB,

CFNRC, CFNRY, CFU, COS and EXT
Number Identification Supplementary Services 9

Number identification supplementary services allow the calling and called
parties to enable and or restrict the presentation of calling and or connected
number information. Number identified supplementary services are listed and
described here.
Calling Line ID Presentation (CLIP)

CLIP allows the called party (mobile subscriber) to receive identification of
the calling party.
In addition to or instead of the calling line ID, the subscriber may be given the
following information:
Presentation Indicator (PI) indicating
presentation allowed
presentation restricted
number not available due to interworking

screening indicator indicating:

user provided, verified and passed
network provided
CLIP is provided either after prearrangement with the service provider or is

generally available to all subscribers.
Calling Line ID Restriction (CLIR)

CLIR enables the calling party to restrict presentation of its number to the
called party. CLIR overrides CLIP. CLIR is provided either after
prearrangement with the service provider or is generally available to all
subscribers. Per call control for CLIR is also available.
Calling Line ID Override

The override feature is used to provide the connected party with calling line
identification regardless of whether the CLIR option has been provisioned.
The CLI data is made available to the connected party at the time of call
setup. If the calling line identity is not provided or the connection is not fully
supported due to interworking conflicts, the called PLMN subscriber with
CLIP override provisioned receives an indication that the identification
information is not available.
Calling Name Delivery (CNAM)

CNAM allows the calling party name to be displayed on the terminator
mobile station. It supports mobile terminations only.
Call Offering Supplementary Services 9

Call offering supplementary services allow the called subscriber to
conditionally or unconditionally divert incoming calls to one or more stations.
Notification is also supported for call offering supplementary services.
Note: Before call forward is invoked, an optional recorded

announcement can be provided to the calling party.
Call Forward Unconditional

Call Forward Unconditional Flowchart
Call Forward Unconditional Flowchart
Gateway MSC
5. IAM
2. SRI HLR
[FTN]
[MSISDN]
DMS-MSC DMS-HLR
PSTN
4. SRI-ACK
[FTN]
1. Setup 3. SS info:
[MSISDN] CFU [FTN]
CFU allows the called subscriber to have the network divert all incoming
calls addressed to the called UE's directory number (DN) or those associated
with a basic service group, to another DN. Once CFU is activated, all
incoming calls are forwarded despite the condition of the termination. The
ability of the subscriber to originate calls is not affected by this feature.
CFU overrides all other types of call forwarding. Registration of CFU can
take place either by the service provider or with a control procedure by the
subscriber as shown in the above figure.

Call Forwarding Busy 9

Call Forward Busy Flowchart
Call Forward Busy Flowchart
Gateway MSC
10. IAM
DMS-MSC 7. SIIC
PSTN [FTN] VLR

9. REJECT
* Local Exchange [Subscriber Busy; FTN]
6. IAM
[MSRN] 3. PRN
[IM SI]
8. SS info
Sub Stat = busy
Gateway MSC
4. PRN-ACK
HLR
2. SRI [MSRN]
DMS-MSC [MSISDN]
DMS-HLR
5. SRI-ACK
[MSRN]
1. Setup
[MSISDN]
CFB allows the called UE to have the network divert all incoming calls
addressed to the called UE DN or those associated with a basic service group.
These calls are diverted to another DN when they encounter a UE busy state.
Only incoming calls that meet conditions are forwarded as shown in the
above figure.
The CFB service can be further divided into the following types:
The served UE is identified as being in the busy state before paging the
mobile.
The served mobile may send a call confirm message with busy indicator
after the serving DMS-MSC sends a setup message to the mobile.
When responding to a setup request message, the served mobile sends a
release complete message with busy indicator to the DMS-MSC. In all
three cases, the VLR is notified by a busy error message. This instructs
the VLR to message the serving DMS-MSC, which then forwards the
call.
If CFU is active, activation of CFB is rejected. If CFB is active, activation of

CFU will be accepted and will take precedence, until CFU is deactivated.
Registration of CFB can take place either by the service provider or with a
control procedure by the subscriber.
Call Forwarding Not Reachable 9

Call Forward Not Reachable Flowchart
Call Forward not Reachable Flowchart

Paging Unsuccessful
HLR
DMS-HLR 3. PRN
2. SRI
4. PRN-Ack
5. SRI-Ack
1. IAM VLR 8. Paging Unsuccessful
[MSISDN] TIMEOUT
6. IAM [MSRN] SS- info=CFNRc
DMS-MSC DMS-MSC
PSTN
9. IAM [FTN]
9. IAM [FTN]
Gateway MSC
7. Paging
CFNRc allows the called mobile subscriber to have the network divert all
incoming calls, or those associated with a basic service group. These calls are
diverted to another DN when they are addressed to the called UE DN which is
either not reachable or to which no response is received.
The ability of the subscriber to originate calls is principally not affected, but
practically it is affected if the UE is deregistered, if there is radio congestion
or if the UE is out of radio coverage. Once CFNRc is activated incoming calls
that meet CFNRc conditions are forwarded as shown in the above figure.
If CFU is active, activation of CFNRc is rejected. If CFNRc is active,

activation of CFU will be accepted and will take precedence, until CFU is
deactivated. Registration of CFNRc can take place either by the service
provider or with a control procedure by the subscriber.


(IMSI Detach)
Gateway MSC 2. SRI

1. IAM
[MSISDN]
[MSISDN]
DMS-MSC HLR
PSTN 6. SRI-Ack
[FTN]
7. IAM [FTN] DMS-HLR
3. PRN
5. SS Info
CFNRc 4. PRN-Ack
[absent subscriber]
VLR
IMSI Detach
DMS-MSC
Mobile powered off
Call Forward no Reply

CFNRy allows the called UE to have the network divert all incoming calls or
those associated with a basic service group. These calls are diverted to
another DN when they are addressed to the called UE's DN and encounter no
reply. The ability of the subscriber to originate calls remains unaffected. Once
CFNRy is activated, incoming calls that meet no reply are forwarded as
shown in the above figure.
If CFU is active, activation of CFNRy is rejected. If CFNRy is active,

activation of CFU will be accepted and will take precedence, until CFU is
deactivated. Registration of CFNRy can take place either by the service
provider or with a control procedure by the subscriber.
Call Completion Supplementary Services

Call Waiting
CW notifies the UE of an incoming call (as per basic call procedures) while
the traffic channel (Bm or Lm) is not available for the incoming call.
Subsequently, the subscriber can either accept, reject or ignore the incoming
call.
Call Hold/retrieve
The call hold service allows a served UE, who is provisioned with this
supplementary service, to interrupt communication on an existing active call
and subsequently reestablish communication. The traffic channel remains
assigned to the UE after the communication is interrupted to allow the
origination or possible termination of other calls.
Multi-Party Supplementary Services

This supplementary service provides a UE with the ability to have a multi-
connection call, that is, communication with more than one party. To facilitate
a multi-party service, the mobile subscriber must maintain one active call and
have another call on hold. In this situation the mobile subscriber can request
the network begin the multi-party service. Once a multi-party call is active,
remote parties may be added, dropped, separated (also referred to as split)
or put on hold. The maximum number of parties is five.
Closed User Group

The Closed User Group (CUG) supplementary service enables UEs to form a
user group to and from which access is controlled. A specific user may be a
member of one or more CUGs (10 CUGs maximum). A CUG can be defined
for one or more basic service groups. Members of a specific CUG can
communicate among each other. The ability to set up emergency calls
remains unaffected.
CUG members can have additional capabilities that allow them to originate
calls outside the group (outgoing access), and/or to receive calls from outside
the group (incoming access). CUG members can also have additional
restrictions that prevent them from originating calls to other members of the
CUG (outgoing call barring within the CUG), or from receiving calls from
other members of the CUG (incoming call barring within the CUG).

Charging Supplementary Services

Advice of charge
AoC is a call related supplementary service (CRSS). AoC allows the DMS-
MSC to supply an UE with information to make a real-time estimate of the
bill that will eventually be levied by the HPLMN.
AoC is comprised of the following two services, of which only one of these
services may be subscribed to at a time:
AoCI (Advice of Charge Information)
AoCC (Advice of Charge Charging)
AoCI is for user information only. It allows an UE to display the cost of a call.
However, AoCC is for the charging of an UE in real-time. AoCC applies to
applications where the user is generally not the subscriber.AoCC applies
where the user pays the subscriber for calls placed, rather than the service
provider. An example of this is a phone in a rental car.
Hot Billing
Hot billing is stored in the HLR and is provisioned per IMSI. Billing records
generated by a subscriber are marked and are segregated from other billing
records by being redirected to a hot billing stream.
Hot billing is a non-UMTS IMSI-based supplementary service. It provides

the capability to indicate, per subscriber, whether a subscriber billing records
are to be classified as hot. This indication is useful when immediate line and
or call billing is required. For example, car hire firms may want to bill
customers for the use of mobile phones returned with the rental vehicle. Hot
billing allows the rental firm to present the customer with an up-to-date
billing record upon return of the rental vehicle so payment can be made
immediately. Hot billing is provisioned on the basis of international UE
identity (IMSI). Billing records generated by such a subscriber are marked
and redirected to a new hot billing stream.
This feature enhances:

the VLR database so that a subscriber IMSI can be provisioned for hot
billing
Mobile Application Part (MAP) messages so that a subscriber hot billing
information can be transported over the D and B interfaces
the DMS-MSC so that a subscriber Call Detail Records (CDR) can be
marked hot and written to a new hot billing stream
Explicit Call Transfer

The Explicit Call Transfer (ECT) supplementary service enables the served
UE to transfer an established incoming or outgoing call to a third party. This
service differs from the Call Forwarding supplementary service in that Call
Forwarding deals only with incoming calls that have not yet reached the
fully-established state, that is, have an established end-to-end connection.
Malicious Call Trace (MCT)

The MCT feature enables an UE to invoke a log report for the last incoming
call output by the DMS-MSC. The report contains call information about the
calling party, if available, that may be used to trace a presumably malicious
caller.
MCT stores the calling party number and other call related information at the
DMS-MSC for subscribers provisioned with MCT. This information is
continually updated with the information of the last incoming call received by
the subscriber.
When a subscriber provisioned with MCT receives a threatening, harassing or

obscene call, he can invoke the MCT feature by dialling a *xx code. The
exact number the subscriber must enter may differ, as it is changeable through
datafill.
Call Restriction Supplementary Services

Call restriction supplementary services allow the UE to enable barring of
certain categories of outgoing or incoming calls. Notification is also
supported for all barring calls.
Barring services for a UE can be added through a prearrangement with the

service provider. The barring service can be provisioned with the subscription
option that either the service provider or the subscriber controls the service.
Subscriber passwords allowing user control is supported.
The DMS-MSC supports the call restriction supplementary services

described in the following sections.

Barring of Outgoing Calls

The BAOC service allows the subscriber to deny any outgoing call setup,
except emergency calls.
Barring of Outgoing International Calls

Barring of Outgoing International Call (BOIC)
Barring of Outgoing International Call (BOIC)

Flowchart
Send info for Outgoing Call

Classification international number
Subscriber profile:
SS Info= BOIC
2. SIOC
[00 34 728 922 312]

DMS-MSC
VLR
3. REJECT
[Call Barred]
1. SETUP
4. RELEASE [dialed digits: 00 34 728 922 312]
[error barring]
BOIC provides the subscriber with the ability to deny outgoing call setup
which are International calls from the current location. Outgoing call setup
possibilities exist only to subscribers of the PLMN(s) and the fixed
network(s) of the country where the mobile subscriber is presently located.
As a result, the present PLMN may be the home PLMN or a visited PLMN,
while the fixed network may be that of the home PLMN country or that of a
visited PLMN country as shown in the above figure.
Barring of Outgoing International Calls Except those Directed to

HPLMN Country
BOIC-exHC allows the subscriber to deny outgoing call setup with
exceptions. Those exceptions include calls directed to the PLMN and fixed
network of the country where the mobile subscriber is presently located
(roamed) or calls to mobile subscribers and fixed network(s) subscribers of
the caller's home PLMN country.
Barring of Outgoing Calls when Roaming Outside the HPLMN

Country
BAOC-roam calls which are initiated by the served subscriber will be barred
if the subscriber is roaming outside the home PLMN country when this
feature is activated. The ability to initiate calls in the home PLMN country
remains unaffected. Almost all the functions concerned with BAOC are
located at the HLR.
Barring of all Incoming Calls
Barring of All Incoming Call (BAIC) Flowchart
2. SRI
[MSISDN]
DMS-MSC
HLR
4. SRI-Ack
[error: Call Barred]
DMS-HLR
1. SETUP
5. RELEASE
[MSISDN] 3. IMSI
SS info = BAIC
BAIC allows the subscriber to deny incoming call setup. This service does
not affect the ability of the subscriber to make outgoing calls. Almost all the
functions concerned with BAIC are located at the HLR as shown in the above
figure.
Barring of all Incoming Calls when Roaming Outside the Home

PLMN Country
BAIC-roam affects calls that are destined to be terminated to the served
subscriber if the subscriber is roaming outside the home PLMN country. The
ability to receive calls in the home PLMN country remains unaffected.
Almost all the functions concerned with BAIC are located at the HLR.

Call Barring Notification to Calling UE

Notifies the calling UE (that has subscribed to any outgoing call barring
service) when outgoing call barring is active and applicable to the call. This
service also notifies the calling UE when the called UE has incoming call
barring active and is applicable to the call.
Local Calls only

Allows the UE with LCO to call only to a specific set of local destination
numbers. LCO subscribers may not call beyond the local source area in which
they are roaming.
Operator Determined Barring

Operator Determined Barring (ODB) allows the HPLMN operator or service
provider to regulate access by the subscribers to UMTS services, by the
barring of certain categories of outgoing, incoming or roaming calls. The
purpose of this network feature is to limit the service provider financial
exposure to new subscribers and to those who have not promptly paid their
bills. Notification to the barred user may take the form of announcement or
routing to an operator station. This service is not applicable to emergency
calls. ODB overrides all other forms of call barring.
The ODB categories supported include the following options.
An operator may choose to invoke multiple barring options as follows:

BAOC
BOIC
BOIC-exHC
barring of outgoing calls when roaming outside the HPLMN country
prevents the subscriber from making any outgoing calls when roaming
outside the HPLMN country
and/or one of
BAIC prevents the subscriber from receiving any incoming calls.

BAIC-roam prevents the subscriber from receiving incoming calls when
roaming outside of the HPLMN country.
and/or one of
barring of roaming outside the HPLMN is handled by the HLR.

barring of roaming outside the HPLMN country is handled by the HLR.
and/or one of both of the following
barring of outgoing premium rate calls (information) - This barring

service prevents the served subscriber from calling directory numbers that
are classified as premium rate calls. These calls are defined as premium
rate by the network operator.
barring of outgoing premium rate calls (entertainment) - This barring
service prevents the served subscriber from calling directory numbers that
are classified as entertainment calls. These calls are defined as
entertainment calls by the network operator.
and/or
when registered in the HPLMN, operator specific barring (Type 1,2,3 and
4) are network defined barring types. These are an extension of premium
rate calls as the barring is performed on the dialled digits.
and/or
barring of supplementary services management prevents the served

subscriber from performing any additional supplementary services
operations (including: activation, deactivation, register, erasure and
interrogation). It does not affect any currently activated supplementary
service as shown in the following figure.

Barring of Supplementary Services Flowchart
Barring of Supplementary Services Flowchart
2. Modify SS
DMS-MSC HLR
4. SS Management Barred
DMS-HLR
5. Reject
Modify SS
1. Modify SS
3. SS info= Management Barred
operator determined barring of conditional call forwarding

subscriber management - This allows service providers to prohibit
subscribers from erasing, deactivating, and re-registering conditional call
forwarded numbers of supplementary services. This means that
subscribers are only allowed to change or cancel unconditional call
forward. This eliminates the possibility that a subscriber cancels his or her
conditional call forward to a voice mail service.
Proprietary Services 9
Proprietary services that require subscriber data stored in the HLR and
downloaded and or stored in the VLR indicate a proprietary change to the
UMTS MAP protocol. The strategy for transferring proprietary information
via UMTS MAP is to use a set of RESERVED values of the SS-code
parameter to indicate the proprietary supplementary service. There must be
mutual agreement between the HLR and serving MSCs on these proprietary
SS codes.
Currently, the DMS-MSC supports the proprietary SS codes for:

Class Of Service (COS)
call interception
Alternate Line Service (ALS)
Local Call Only (LCO)
Calling name delivery
Extension services
Class of Service
COS allows association of an UE with a CUSTGRP or an NCOS. A
CUSTGRP is given to a subscriber community to logically relate and
uniquely identify each member of a group and to provide them with uniform
and group-specific services. An NCOS overrides the CUSTGRP attribute list.
The COS information is optionally assignable to the subscriber and is stored
in the HLR. It is downloaded and stored in the VLR at location update time,
along with the rest of the subscriber data, as well as insert subscriber data
(ISD) transactions, which impacts the UMTS MAP.
The following supplementary services are provided under CUSTGRP and

NCOS.
private numbering plan
hotline routing

Private Numbering Plan

Class of Service: Private Numbering Plan (COS-PNP))
Class of Service: Private Numbering Plan

(COS-PNP) Flowchart
3. SS info: COS-PNP
PNP Normalization:
4859 01 39 44 4859
5. IAM 2. SIOC
[01 39 44 4859] [4859]
VLR
PSTN DMS-MSC
DMS-MSC 4. COMPLETE CALL
[01 39 44 4859]
1. SETUP
[4859]
The private numbering plan service allows UEs to communicate across one or
more networks by defining, managing and using digit sequences that have
different structures and meanings than provided by the public numbering
plan. A PNP, is a separate and additional numbering plan to the UMTS
supported ISDN/E.164 public network as shown in the above figure.
The DMS-MSC implementation of PNP service allows for a subscriber to use

a predefined private number to establish calls between nominated user access
interfaces while using the resources of one or more public networks. An
example application could be a business having multiple offices requiring a
numbering plan which would appear the same to all users regardless of
location. Under this PNP service, it is the responsibility of the DMS-MSC to
support mobile originations made with PNP numbers. It is the responsibility
of the DMS-HLR to allow provisioning and messaging of PNP services to the
NT-compatible VLR and to allow the service interaction of call forwarding
number registration.
Hotline Routing
The hotline routing service facilitates the routing of calls, irrespective of what
the originator dials, to predefined destinations such as operators and
attendants. It is the responsibility of the DMS-HLR to provision and activate
this service for all applicable users, including new users with minimum to no
subscription or provisioning information.
Call Interception
Call interception allows security agencies to transparently monitor designated
subscribers calls. Any basic service of the subscriber can be monitored.
Alternate Line Service

Alternate Line Service (ALS) extends the base UMTS functionality by
providing a mobile user with the capability of associating two alternate lines
with one IMSI. ALS provides this extra MSISDN or the alternate line, by
introducing a new teleservice called auxiliary speech or auxiliary telephony.
With ALS, a mobile user is allowed to make and receive speech or telephony
calls on either line as desired and is billed separately for calls on each line.
Each line is associated with a separate directory number (MSISDN) and
separate subscription profile.
Local Calls only

Local Call Only (LCO) service bars calls made to areas outside the originator
local calling area. This service does not affect the subscriber ability to receive
incoming calls. The local concept is based on a set of local DNs for the caller,
called the target area. All DNs outside the target area are defined as not local.
When subscribers roam outside the HPLMN area and originate a call, the
local target area of the visiting MSC is checked to determine whether the call
is local. If the terminating number is present, the call continues. Otherwise, it
is deemed not local and the call is barred.

Basic Services Matrix

The following table illustrates the level of basic services interaction with
supplementary services.
Basic Services Matrix
Supplementary Basic services

services
Speech AUX Sp Fax SMS CDA CDS
Call forward x x x x x
(all types)
CW x x x x x
Call hold x x
or call retrieve
CLIP x x x x x
CLIR x x x x x
CB (all types) x x x x x x
AOC x x x x x
LCO x x x x x
ODB x x x x x x
COS x x x x x
MCT x x
x - Supported interactions
Special Translation Enhancements 9

This feature provides mobile subscribers to invoke certain supplementary
services with * codes, and to use abbreviated dialing and dedicated routing
with * and # codes. Since some mobiles cannot send the * digit, this
feature also allows the DMS-MSC to be datafilled to recognize invocation
codes without the *. For example, *67 and 67 can be datafilled to invoke
the supplementary service CLIR. It is recommended, but not required, that
CLIR be invoked with *67, CLIR SUPP (calling line ID restriction
suppression) with *82, and MCT with *57.
In addition, a mobile subscriber can dial # or * codes for abbreviated

dialing, where the subscriber is not required to know the true routing number.
If the abbreviated dialing code is converted to a routing number by a pre-VLR
translation, call barring and other service interactions still apply to the actual
routing number. The provider has the option of datafilling * or # codes for
abbreviated dialing.
Extension Service 9
Extension service combines the services known as Flexible Alerting
(simultaneous alerting) and Mobile Access Hunting (sequential alerting) into
a single service.
Software Option Control (SOC)

The functionality provided by this feature is controlled by SOC (software
option control). SOC is part of the overall DMS evolution product delivery,
allowing software features to be delivered in a timely and controlled fashion.
SOC is included in all the DMS-MSC/GMSC software, and the extension
service functionality can be activated by a password controlled SOC option.
The SOC option order code and option name are GMSP3608 and GMSP
Ext Services Ph1. Once the transition state of SOC option for this feature is
ON it enables the MSC to support the optional extension service allowed
parameter in the SRI query, and enables the DMS-MSC to support the
extension service information retrieved in the SRI response. Customers have
the flexibility to control the extension service feature when they have
purchased the appropriate password.
Extension Service Provisioning

When extension service is provisioned for a DMS-MSC, an indication
(EXT_Allow flag) can be sent to the HLR in the SRI request to indicate that
the MSC is ready to receive extension service information. When the HLR
supports extension service and the subscriber for which the SRI request is
sent is a Pilot DN, the SRI response received from the HLR will include
extension service information. This information is passed to the extension
service sequential alerting or simultaneous alerting feature.

Extension Service Sequential Alerting

Basic Extension Service Sequential Alerting Scenario
Basic Extension Service:

Sequential Alerting Scenario
RNS
UE busy
DMS-MSC
DMS-MSC 2
3 RNS
1
4 UE busy
PSTN
1 Origination (from PSTN or a mobile) arrives for pilot MSISDN. SPEAKING

2 First group member is a local UE. MSC pages UE and UE is busy.
3 Second member is a local UE. MSC pages UE and no answer is received.
4 Third group member is a landline (possibly a voice mail) and the call is connected.
Extension service sequential alerting allows a call to be routed to the first

terminal in the extension service list, if it is busy or not responding before a
timer expires, the call is routed to the second terminal in the list. This action is
repeated to a third terminal, should the second terminal not respond. The busy
condition for a mobile subscriber can either be network determined, or user
determined as shown in the above figure.
The terminals, (or members) in the extension service list can consist of a
single DN or group of DNs (called a subgroup). There are a maximum of
three members in the extension service group.
Extension Service Simultaneous Alerting

Extension service simultaneous alerting (also called flexible alerting) allows
all members of a group to be alerted simultaneously and the first subscriber to
answer is connected to the calling party. For example, there may be a support
group consisting of three people where it does not matter which person
answers. All members will be alerted at the same time. The following figure
illustrates a simultaneous alerting example.
Extension Service Simultaneous Alerting Example
Basic Extension Service:

Simultaneous Alerting Scenario
RNS
3 Call not Connected
2
DMS-MSC
DMS-MSC
RNS
2 3
Call not Connected
1. SETUP 2
PSTN
SPEAKING
3
Extension service simultaneous alerting feature is responsible for setting up

calls to multiple directory numbers (extension service members), so that they
are alerted simultaneously. The directory numbers can be either MSISDNs or
wireline numbers. Members to be alerted are specified as an extension service
subgroup in the subscription data received from the HLR in the SRI response.

UMTS02 Specific Services 9

LoCation Services Enhancements
LoCation Services (LCS) is available to the following categories of LCS
clients:
Value added Services LCS clients - supports value added services

including MS subscribers as well as non-subscribers to other services.
PLMN Operator LCS clients - enhances or supports certain O&M
related tasks, supplementary services, IN related services, bearer services
and teleservices.
Emergency Services LCS clients - enhances support for emergency calls
from subscribers.
Lawful Intercept LCS clients - supports various legally required or
sanctioned services.
Location Services
Safety Residential Customers

y E911 emergency y Information services
dispatch
y Traffic information
y Child tracking
y Direction finding
y Criminal tracking
y Roadside assistance y E-Yellow Pages
Business Customers Operators

y Fleet management y Location-based billing
y Rental car tracking y Location targeted
advertisements
y Trucking companies
y Customer service
y Network performance
GSM/UMTS LCS Architecture

The LCS entities within the access network:
Communicate with the Core Network (CN) across the A interface or Iu

interface.
Communication among the access network LCS entities uses the
messaging and signaling capabilities of the Access Network.
GSM/UMTS LoCation Service Architecture
*60 RQO\ HLR

SMLC
BSC
LMU Ls MAP
Type A A Lh Lc
Uu
SRNC External LCS

Wireless client
Iub (SMLC) MSC/VLR
MSC/VLR Gateway
Iu GWY
Node B Lg MLC
(LMU Type B)
Lg
Iur
RNC Gateway
Node B
2WKHU 3/01
(LMU Type B)
MLC
Iub
MSC affected interfaces
Location Measurement Unit (LMU)
LMUs are fixed measuring points that are used to measure the time of arrival
of signals from several BTSs in unsynchronized networks.
Two types of LMUs are defined:

Type A LMU: accessed over the normal GSM air interface.
Type B LMU: accessed over the Abis interface (currently not supported)

SMLC (Serving Mobile Location Center) Overview
The SMLC:
Contains functionality to support LCS.
Manages the overall coordination and scheduling of resources required to
perform positioning of a mobile.
Calculates the final location estimate and accuracy.
Is located in RNC for UMTS network and, in BSS for GSM network.
UMTS network does not support the NSS-based SMLC architecture.
Two types of SMLC are possible in GSM networks:

NSS based SMLC (NSMLC): Ls interface (MSC SMLC).
BSS based SMLC (BSMLC): Lb interface (MSC BSC/RNC
SMLC)
GMLC (Gateway Mobile Location Center) Overview
The GMLC:
Contains functionality required to support LCS.

In one Public Land Mobile Network (PLMN) there may be more than one
GMLC.
Is the first node that an external LCS client accesses in a GSM PLMN to
obtain the location information of a particular subscriber.
Performs registration authorization.
For MT-LR (Mobile Terminating Location Request) requests, the
GMLC queries the HLR (SRI for LCS operation) to determine the
VMSC the subscriber is located in and then sends the Provide
Subscriber Location (PSL) to the corresponding MSC.
For MO-LR (Mobile Originating Location Request) requests, after the
MSC receives the geographical location of the subscriber from the
RNC/SMLC, it sends it to the GMLC associated with the LCS client
using the MAP Subscriber Location Report (SLR) operation.The
GMLC then sends it to the appropriate LCS client.
Location requests can be classified into the following types:
Mobile Originating Location Request (MO-LR) - mobile initiates the

location request.
Mobile Terminating Location Request (MT-LR) - external client
initiates the location request
Network Initiated Location Request (NI-LR) - network initiates the
location request
Mobile Number Portability (MNP) Enhancements
Mobile Number Portability (MNP)

Number Range SRF Solution
Originating Network Network Example
NPDB
MNP
SRF 3
M . SR
ap I
v3 ac
M kR
SI
2.
SD N
SR
N
IM
1. I
SIS
AM
Calling Party A - MS
DN
ISD
N
,
Subscription Network SI SDN
+M
RN
M OA=x
4. I A N
DMS-GMSC/UMSC
MNP is the ability for a Mobile Subscriber to change the

GSM Subscription Network within a Portability Domain
while retaining the subscriber Original Portable Mobile
Ported Party B
Station ISDN Number (MSISDN) or MSISDNs.
The two following approaches can solve the MNP problem:
Intelligent Network based solution

without SRF (GSM13)
with SRF support (GSM14)
Signaling Transfer Point based solution (new in GSM15)

IN Based Solution without SRF

When the Gateway MSC receives Connect message:
The RN returned in this message is compared with the CDPN received in
the incoming ISUP IAM message.
If the RN (in Connect) matches with the RN in RN+MSISDN (ISUP
IAM), it indicates a loop.
If the MNP_LOOP_PREVENTION (Table OFCVAR) is set to Y, the
call is taken down.
Loop Prevention for IN Based Solution without SRF
Visited
GMSC Visitednetwork
network
GMSC oror
4. IAM (RN+MSISDN) Visited Switch
Visited Switch
2. InitialDP(MSISDN)
Release the Call

3. Connect (RN)
Originating
Originating
network
network
1. IAM (RN+MSISDN)
NPDB
Number Range Holder/Subscriber Network
IN Based MNP with SRF

This feature adds the functionality to support special SCCP Nature Of
Address (NOA) value for SRI query message.
IN Based MNP Solution with SRF
1. IAM (RN+MSISDN, MNP_NOA) or

Visited
MNP_Prefix+RN+MSISDN, NOA=3)
GMSC
6. IAM (MRN) Visitednetwork
network
GMSC
Pa
2. SRI (SCCP NOA=MNP_SCCP_NOA)

g e
5.
SR
IA
ck
Originating (M
Originating SR
network
network N
)
PRN
4. SRI
HLR
PRN_Ack
MNP-SRF
NPDB
3
Number Range Holder (non-ported)/
Subscriber Network (ported-in)

Review Questions 9
1. What are the supplementary services?
2. How does call baring of all outgoing calls work?
3. Describe Operator determined barring.
4. List the 4 types of call forward.
5. List Nortel proprietary services.
6. Describe class of service supplementary service.
Nortel Networks Confidential A-1
List of terms A
Numerics
3GPP
3rd Generation Partnership Project 1-4
A
ACCS
Automatic calling card services 4-6
ACM
Address Complete Message 7-21
Administration Centre (AdC) 3-9
AIN
Advanced Intelligent Network 4-6
A-links
Access links 4-9
ALS
Alternate Line Service 9-23, 9-25
ALS
Alternate line service 9-5
AMR
Adaptive Multi Rate 2-16
AN
Aggregation Node 2-16
ANM
ANswer Message 7-21
ANSI
American National Standards Institute 2-19, 5-2
AOC
Advice of charge 9-5
AoCC
Advice of Charge Charging 9-16
AoCI
Advice of Charge Information 9-16
ASE
Application Service Elements 5-11
AuC
Authentication Center 2-3, 2-20

A-2 List of terms Nortel Networks Confidential
B
BAIC
Barring of all incoming calls 9-4
BAOC
Barring of all outgoing calls 9-4
B-links
Bridge links 4-9
BOIC
Barring of outgoing international calls 9-4
BSC
Base Station Controller 2-2
BSP
Bulk Service Provisioning 3-10
BSS
Base Station Subsystem 2-2
BSSMAP
Base Station Subsystem Managment Application Part 5-9
BTS
Base Transceiver Station 2-2
C
CADR
Call Associated Data Records 3-11
CAM
Communication Application Module 2-19
CC
Call Control 6-4
CCITT
Consultative Committee for International Telephone and Telegraph 5-2
CCN
Circuit Core Network vi, 2-14, 5-9
CCS7 3-17
CCS7
Common Channel Signaling system 7 4-2
CCS
Common Channel Signaling 4-2
CDA
Circuit Data Asynchronous 9-26
CDR
Call Detail Records 9-16
CDS
Circuit Data Synchronous 9-26
CEM
Core Element Manager 3-6
CEPT
European Post and Telecommunications Conference 1-3
Nortel Networks Confidential List of terms A-3
CFB
Call forwarding busy 9-3
CFNRc
Call forwarding not reachable 9-3
CFNRy
Call forwarding no reply 9-3
CFU
Call Forwarding Unconditional 9-3
CGSA
Cellular Geographic Service Area 1-7
CIS
Call Intercept System 3-11
CISS
Call Independent Supplementary Services 9-7
CL
Cancel Location 7-6
C-links
Cross links 4-9
CLIP
Calling line identification presentation 9-6
CLIR
Calling line identification restriction 9-6
CM
Configuration Management 3-6
CM
Connection Management 6-4
CNAM
Calling name delivery 9-10
CN
Core Network 2-5, 7-18, 9-31
COS
Class Of Service 9-23
CS
Call Server 2-14
CS
Circuit Switched 2-5, 2-14, 2-16
CSD
Circuit Switch Data 8-6
CUG
Closed User Group 9-15
CW
Call waiting 9-5

D
DDU
(Data Distribution Unit 5-9
DIRP
Device Independent Recording Package 3-13
D-links
Diagonal links 4-9
DPN
Data Packet Network 3-6
E
ECT
Explicit Call Transfer 9-17
EIR
Equipment Identification Register 2-21
EIR
Equipment Identity Register 2-9
E-links
Extended links 4-9
ETSI
European Telecommunications Standards Institute 1-3
F
F-links
Fully-associated links 4-9
FLPPiberized LPP 2-19
FM
Fault Management 3-6
FP
File Processor 3-13
FSL
Flexible Service Logic 3-17
FTAMFile Transfer Access and Management 3-13
G
GGSN
Gateway GPRS Support Node 2-3
GMLC
Gateway Mobile Location Center 9-32
GMSC
Gateway MSC 7-21
GPP
GSM Passport 2-24
GPRS
General Packet Radio Service 2-3
GSM
Groupe Spcial Mobile 1-3
GTP
GPRS Tunnelling Protocol 2-6
GUI
Graphical User Interface 2-30, 3-6, 3-7
H
HFN
HyperFrame Number 7-15
HIOP
High Performance Input Output Processor 2-20
HLR
Home Location Register 2-3
HSL
High Speed Link 2-20
I
IAM
Initial Address Message 7-21
IK
Integrity Key 7-15
IMEI
International Mobile Equipment Identities 2-21
IMEI
International Mobile Equipment Identity 2-9
IMSI
International Mobile Subscriber Identity 2-10, 7-3
IMT-2000
International Mobile Telecommunications 1-4
INODE
INtegrated NODE 4-7
IOM
Input/output Module vii
IP
Intelligent Peripherals 3-17
ISD
Insert Subscriber Data 7-6
ISDN
Integrated Services Digital Network 2-5
ISM
Integrated Service Module vii
ISO
International Standards Organization 5-4
ISUP
Integrated Service Digital Network User Part 5-11
ITU
International Telecommunication Union 1-4, 2-19
IWF
InterWorking Function 2-15, 2-24

K
KSI
Key Set Identifier 7-18
KSS
Key Stream Segment 7-17
L
LAC
Location Area Codes 1-8
LAI
Location Area Identifier 7-9
LCO
Local Call Only 9-23, 9-25
LCO
Local calls only 9-5
LCS
LoCation Services 9-30
LIU7
Link Interface Unit for SS7 networks 2-19
LPP
Link Peripheral Processor 2-19
M
MAC-I
Message Authentication Code for data Integrity 7-15
MAC-I
Message Authentication Code for Integrity 7-19
MAP
Maintenance and Administration Position 3-6
MAP
Mobile Application Part 5-5
MAP
Mobile Application Part Layer 5-10
MCT
Malicious Call Trace 9-17
MDM
Multi-service Data Manager 3-6
MM
Mobility Management 6-5, 7-3
MNP
Mobile Number Portability 9-33
MOI
Managed Object Instance 3-6
MO-LR
Mobile Originating Location Request 9-32
MOP
Method Of Procedure 2-19
MSC
Mobile services Switching Center 2-3
MSISDN
Mobile Subscriber ISDN Number 2-10
MS
Mobile Station 2-2
MSP
Mobile Subscriber Provisioning 3-9
MSRN
Mobile Station Roaming Number 7-21
MT-LR
Mobile Terminating Location Request 9-32
MT
Mobile Termination 2-5
MTP
Message Transfer Part 5-5
MTP
Message Transfer Part Layer 5-7
MWI
Message Waiting Indication 3-15
N
NCADR
Non-Call Associated Data Records 3-12
NMT
Nordic Mobile Tlephone 1-2
NOA
Nature Of Address 9-35
NSS
Network and Switching Subsystem 2-2, 2-3
O
ODB
Operator Determined Barring 9-20
ODB
Operator-determined barring 9-5
OM
Operational Measurements 3-6
OSI
Open System Interconnection 5-2
P
PIN
Personal Identification Number 2-10
PI
Presentation Indicator 9-9
PLMN
Public Land Mobile Network 1-7, 9-32

PM
Performance Management 3-6
PMs
Peripheral Module vi
PPD
Partial Packet Discard 3-20
PSL
Provide Subscriber Location 9-32
PS
Packet Switched 2-6, 2-16
PSTN
Public Switched Telephone Network 2-3, 2-5
PSTN
Public Switching Telephone Network 7-20
PTS
Per-Trunk Signaling 4-2
PWI
Public Windows Interface 2-30
Q
QoS
(Quality of Service 2-6
R
RAB
Radio Access Bearer 7-21
RANAP
Radio Access Network Application Part 5-9, 8-2
RA
Routing Area 1-9
RNC
Radio Network Controller 2-13, 8-2
RNS
Radio Network Subsystems 2-13
RNS
Radio Network System 8-2
RRC
Radio Ressource Control 7-15
S
SCCP
Signaling Connection Control Part 5-5
SCCP
Signalling Connection Control Part 8-17
SCE
Service Creation Environment 3-17
SCF
Service Control Function 3-17
SCP
Service Control Point 3-17, 4-7, 4-8
SDM/FT
SuperNode Data Manager Fault tolerant viii
SDM/FT
SuperNode Data Manager/Fault Tolerent 3-4
SG
Signalling Gateway 2-16
SGSN
Serving GPRS Support Node 2-3
SIR
Send Identification Request 7-5
SLR
Subscriber Location Report 9-32
SMLC
Serving Mobile Location Center 9-32
SMS-C
Short Message Serve Center 3-2
SMS-C
Short Message Service Center 2-22
SMS-CSI
Short Message Service - CAMEL Subscription Information 3-20
SMS
Service Management System 3-17
SMS
Short Message Service 6-4
SP
Signaling Point 4-7
SRI
Send Routing Information 5-11, 7-21
SRNS
Serving Radio Network System 8-2
SS7
Signaling System 7 4-5
SSP
Service Switching Point 4-7, 4-8
SS
Supplementary Service 6-4
SS
Supplementary Services 9-8
STP
Signaling Transfer Point 2-15, 4-7, 4-8

T
TACS
Total Access Communications Telephone Systems 1-2
TAF
Terminal Adaptation Function 2-5
TCAP
Transaction Capabilities Application Part 5-5
TCH
Traffic Channel 8-6
TCP
Transmission Control Protocol 3-13
TCU
TransCoder Unit 2-2
TDMA
Time Division Multiple Access 1-5
TDM
Time Division Multiplexed 2-5
TE
Terminal Equipment 2-5
TMN
Telecommunication Management Network 3-6
TRAU
Transcoder/ Rate Adapter Unit 2-16
TRAU
Transcoder/Rate Adaptation Unit 2-2
TUP
Telephone User Part 5-11
U
UEA
UMTS Encryption Algorithm 7-17, 7-18
UE
User Equipment 2-5, 7-2
UIA
UMTS Integrity Algorithm 7-15, 7-18
UL
Update Location 7-6
UP
User Part 5-5
USIM
Universal Subscriber Identity Module 2-9
USP
Universal Signaling Point 2-18
USP
Universal Signalling Point 3-7
UTRAN
UMTS Terrestrial Radio Access Network 2-5
V
VLR
Visitor Location Register 2-3
VMCDB
Voice Mail Call Drop Back 3-15
VMG
Virtual Media Gateway 2-16
VMS
Voice Mail System 3-2, 3-14
VPN
Virtual Private Network 3-20, 4-6
W
W-CDMA
Wide Band - Code Division Multiple Access 1-5
WCDMA
Wide Band Code Division Multiple Access 2-5
WG
Wireless Gateway 2-16
X
XA-Core
eXtended Architure Core 2-15
XA-Core
eXtended Architure Core 2-15

test
Family Product Manual Contacts Copyright Confidentiality Legal
NSS16/UMTS03
Student Guide
To order documentation from Nortel Networks Global Customer Care Services Training and Documentation Services, call
(1) (877) 662-5669
To report a problem in this document, call

(1) (877) 662-5669
or send e-mail from the Nortel Networks Customer Training & Documentation World Wide Web site at
http://www.nortelnetworks.com/td
Copyright 2001-2003 Nortel Networks, All Rights Reserved
NORTEL NETWORKS CONFIDENTIAL

The information contained herein is the property of Nortel Networks and is strictly confidential. Except as expressly authorized in
writing by Nortel Networks, the holder shall keep all information contained herein confidential, shall disclose it only to its
employees with a need to know, and shall protect it, in whole or in part, from disclosure and dissemination to third parties with the
same degree of care it uses to protect its own confidential information, but with no less than reasonable care. Except as expressly
authorized in writing by Nortel Networks, the holder is granted no rights to use the information contained herein.
Information is subject to change without notice. Nortel Networks reserves the right to make changes in design or components as
progress in engineering and manufacturing may warrant.
* Nortel Networks, the Nortel Networks logo, the Globemark HOW the WORLD SHARES IDEAS, and Unified Networks are
trademarks of Nortel Networks.
Trademarks are acknowledged with an asterisk (*) at their first appearance in the document.
Document number: Course UM931
Product release: NSS16/UMTS03
Document version: Standard 16.02
Date: May 2003
Printed in France

Um931 1602

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Um931 1602

Загружено:

Авторское право:

Доступные форматы

Course UM931

NSS16/UMTS03 Standard 16.02 May 2003 411-UM931-001.1602

Document number: Course UM931

Copyright Country of printing Confidentiality Legal statements Trademarks

Copyright 2001-2003 Nortel Networks, All Rights Reserved

NORTEL NETWORKS CONFIDENTIAL

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

About this Course

Upon completion of this course, you will be able to:

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 2

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

UMTS Curriculum Paths 0

DMS Maintenance Beginner

DMS Maintenance Beginner

DMS Maintenance Beginner

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 3

Wireless CCN Overview (UM931/2 Days)

The following course in the curriculum path is:

routine maintenance procedure

IOM Input/output Module

DMS Maintenance Expert

DMS Maintenance Expert

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 4

Wireless DMS Maintenance Part 2 (UM951/10 Days)

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

Optional courses are:

Wireless SDM/FT Maintenance and Administration (UM955/2 Days)

Wireless SuperNode Billing Application Overview (UM957/2 Days)

Core Circuit Specialist

Core Circuit Specialist

Core Circuit Specialist

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 5

UMTS System Description (UM010/3 Days)

Wireless CCN Overview (UM931/2 Days)

NSS16 Delta Release (UM968/3*2 Hours)

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

Core Circuit Datafill Specialist

Core Circuit Datafill Specialist

Core Circuit Datafill

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 6

Wireless DMS CCS7 Operations And Datafill (UM974/5 Days)

Wireless DMS MSC/VLR Translations (UM970/10 Days)

Completed by the two following courses:

Wireless DMS-HLR Service and Datafill (UM972/5 Days)

Wireless DMS IN Operations and Datafill (UM900/4 Days)

Core Circuit Supervisor

Core Circuit Supervisor

Wireless DMS Maintenance (1)

Core Circuit Supervisor

PE/TRD/CN/UM931 16.02/EN May, 2003 Wireless CCN Overview 7

Wireless SuperNode Billing Application Overview (UM957/2 Days)

UMTS OAM Introduction (UM60/2 Days)

Wireless OMC-S OAM (UM937/2 Days)

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

About this Course v

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

Nortel Networks Implementation of the Circuit Switched Domain 2-14

Signaling Links 4-9

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

Call Interception 9-25

NSS16/UMTS03 Wireless CCN Overview Student Guide NSS16/UMTS03

Given student lesson, instructor lecture, and appropriate

documentation, you will be able to: