summaryrefslogtreecommitdiff
path: root/2012/core_net-odc2012/section-core_network.tex
blob: 629cac1782ba32cdb440e8ab0e634736b564ea7c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
\section{The GSM core network}

\subsection{GSM core network components}

\begin{frame}{GSM core network components}
    \begin{description}[MSC]
      \item[MSC] (Mobile Switching Center): The central switch
      \item[HLR] (Home Location Register): Database of subscribers
      \item[AUC] (Authentication Center): Database of authentication keys
      \item[VLR] (Visitor Location Register): For roaming users
      \item[EIR] (Equipment Identity Register): To block stolen phones
    \end{description}
\end{frame}

\begin{frame}{GSM network structure}
\begin{description}[BTS]
\item[MSC] Actual call switching and top-level mobility functions.  May serve dozens of location areas
\item[VLR] Temporary cache of subscriber data from HLR + TMSI
\item[HLR] Subscriber databases + subscriber location information
\item[AUC] Generation of authentication tuples
\item[SMSC] SMS Service Centre, store+forward for SMS
\end{description}
\end{frame}

\begin{frame}{GSM core network integration}
\begin{itemize}
	\item VLR often integrated into MSC
	\item AUC often integrated with AUC
	\item integration so common, many graphs/diagrams are actually
not 100\% correct
\end{itemize}
\end{frame}

%\begin{frame}{GSM Network Structure}
%\includegraphics[width=100mm]{GSMNetwork.pdf}
%\end{frame}

\begin{frame}{GSM network interfaces}
  \begin{description}[A-bis]
    \item[C] Interface between GMSC and HLR
    \item[D] Interface between MSC and HLR
    \item[E] Interface between MSC and MSC
  \end{description}
All of them based on MAP, so C/D/E not commonly distinguished
\end{frame}

\subsection{GSM core network protocols}

\begin{frame}{core network protocol stack}
Traditional telephony based on SS7 / CS7, GSM too
\begin{itemize}
	\item Lower layers (MTP2/MTP3) re-used
	\item ISUP used for actual call control signalling
	\item SCCP for routing / GTT
	\item TCAP for transaction supprt
	\item MAP for actual GSM related signalling
\end{itemize}
\end{frame}

\begin{frame}{SS7 networks}
\begin{itemize}
	\item STP - Signalling Transfer Point
	\begin{itemize}
		\item {\em Router} for SCCP
		\item performs GTT (see below)
	\end{itemize}
	\item SCP - Signalling Control Point
	\begin{itemize}
		\item {\em End-node} like MSC/HLR
		\item SCP has GT, PC, ..
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{SS7 addresses}
\begin{itemize}
	\item Point Code (PC)
	\begin{itemize}
		\item typically unique within PLMN / country
	\end{itemize}
	\item Global Title (GT)
	\begin{itemize}
		\item world-wide unique address
		\item translated into PC by GTT at STP
	\end{itemize}
	\item Subsystem Number (SSN)
	\begin{itemize}
		\item logical function address inside network (MSC, VLR, HLR, ...)
		\item not used on international links
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{SS7 GTT (Global Title Translation)}
Global Title Translation
\begin{itemize}
	\item can happen at any STP
	\item translates a Destination GT into new destination address
	\item new dest address can be any address, such as
	\begin{itemize}
		\item new global title (GT)
		\item point code (PC)
		\item sub-system number (SSN)
	\end{itemize}
	\item GTT rules explicitly configured by operator, e.g.
	\begin{itemize}
		\item prefix or range based match
		\item (inter)nationalize numbering plan
		\item add digits at beginning or end
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{SS7 physical layer}
\begin{itemize}
	\item{classic SS7 signalling over TDM circuits}
	\begin{itemize}
		\item E1 timeslot (64kbps)
		\item multiple E1 timeslots (N*64kbps)
		\item MTP Level 2 / MTP Level 3
	\end{itemize}
	\item modern networks use SIGTRAN
	\begin{itemize}
		\item IP as network layer replaces E1 lines
		\item SCTP on top(no TCP/UDP!)
		\item many different SIGTRAN stacking options
	\end{itemize}
	\item some vendor-proprietary protocols like SCCPlite
\end{itemize}
\end{frame}

\begin{frame}{SIGTRAN stacking options}
SIGTRAN != SIGTRAN
\begin{itemize}
	\item IP/SCTP/M2PA/MTP2/MTP3/SCCP/TCAP/MAP
	\item IP/SCTP/M2UA/MTP3/SCCP/TCAP/MAP
	\item IP/SCTP/M3UA/SCCP/TCAP/MAP
	\item IP/SCTP/SUA/TCAP/MAP
\end{itemize}
\end{frame}

\begin{frame}{SCCP}
SCCP takes care of
\begin{itemize}
	\item Global Title based addressing
	\item Global Title Translation
	\item connection-oriented or connectionless semantics
	\item GSM core network interfaces with MAP/CAP only use
connection-less UDT service
\end{itemize}
\end{frame}

\begin{frame}{TCAP}
\begin{itemize}
	\item Idea: decouple transaction logic from actual application
	\item transaction semantics can be used by multiple higher-layer protocols
	\item state machines on both sides maintained outside of application
	\item protocol specified in ASN.1, BER encoding
\end{itemize}
\end{frame}

\begin{frame}{MAP - Mobile Application Part}
\begin{itemize}
	\item used between all classic GSM core network components
	\item application protocol on top of TCAP
	\item protocol specified in ASN.1, BER encoding
\end{itemize}
\end{frame}

\begin{frame}{CAP - Camel Application Part}
\begin{itemize}
	\item used for CAMEL entities (gsmSCF, gsmSSF, gprsSSF, gsmSRF)
	\item application protocol on top of TCAP
	\item protocol specified in ASN.1, BER encoding
\end{itemize}
\end{frame}

\section{Roaming interfaces}

\subsection{Roaming introduction}

\begin{frame}{Introduction to Roaming}
Roaming enables subscribers to use other operators' networks
\begin{itemize}
	\item Home Network is called HPLMN
	\item Visited Network is called VPLMN
	\item Roaming requres between HPLMN and VPLMN
	\begin{itemize}
		\item Roaming agreement (contract)
		\item SS7 connectivity (ISUP/MAP/CAP)
		\item IP connectivity (for packet data)
	\end{itemize}
\end{itemize}
\end{frame}

\begin{frame}{Roaming principle}
\begin{itemize}
	\item MS, MSC, VLR and SGSN are in VPLMN
	\item HLR, AUC, GMSC and GGSN are in HPLMN
	\item they talk to each other via MAP, just like in non-roaming case
	\item selection of HPLMN based on IMSI of subscriber
	\item non-roaming caes: HPLMN == VPLMN
\end{itemize}
\end{frame}

\begin{frame}{MVNO - Mobile Virtual Network Operators}
A MVNO setup is a special case of roaming
\begin{itemize}
	\item MNO operates PLMN with RAN and CN
	\item MVNO operates HPLMN without RAN (BSC/BTS)
	\item MVNO subscribers always roam into MNO network
\end{itemize}
\end{frame}

%\subsection{Roaming transactions}
%FIXME

\subsection{Traditional Billing}

\begin{frame}{Traditional Billing}
Initially, GSM was designed for business users
\begin{itemize}
	\item Billing was always post-paid
	\item Each PLMN simply logs all call/sms
	\item Logs called CDR (Call Data Record)
	\item At the end of the month, invoices are generated
	\item CDR records are exchanged between roaming partners
\end{itemize}
\end{frame}

\begin{frame}{Billing for Roaming}
\begin{itemize}
	\item CDR files often vendor-specific / custom
	\item GSMA established a standard called TAP
	\item TAP is the standard for exchange of billing records
between roaming partners
	\item Summary: Intra-PLMN: CDR, Inter-PLMN: TAP
	\item TAP has many versions/generations
	\item Specified in ASN.1
\end{itemize}
\end{frame}

\begin{frame}{The advent of pre-paid}
\begin{itemize}
	\item At some point, users wanted pre-paid services
	\item Difficult to implement in traditional billing architecture
	\item In HPLMN, every operator could come up with custom
solution
	\item Thus, pre-paid initially not supported in roaming
	\item In the early pre-paid days, there were lots of ways to exceed pre-paid balance 
\end{itemize}
\end{frame}

\begin{frame}{Pre-paid required fundamental changes}
\begin{itemize}
	\item The pre-paid balance / account is maintained in HPLMN
	\item HPLMN needs much more control over user while roaming
	\item A new protocol (CAMEL) was introduced, as well as new
entities in the network
	\item Lots of changes all over netowrk elements (MSC, SGSN, HLR)
\end{itemize}
\end{frame}

\subsection{CAMEL}

\begin{frame}{CAMEL - Customized Applications Mobile Enhanced Logic}
\begin{itemize}
	\item gsmSCF - Service Control Function
	\begin{itemize}
		\item receives per-subscriber specific config from HLR
(CSI: CAMEL Subscription Information)
		\item remotely controls call, SMS, etc. processing
	\end{itemize}
	\item gsmSSF - Service Switching Function
	\begin{itemize}
		\item built into MSC
		\item hooks / triggers at key state changes
		\item allows gsmSCF to alter/override/abort transactions
	\end{itemize}
	\item gprsSSF provides similar feature inside SGSN
\end{itemize}
\end{frame}
personal git repositories of Harald Welte. Your mileage may vary