ZXC10 HLRe (V3 (1) .00.30) Technical Description

ZXC10 HLRe
cdma2000 Home Location Register emulator
Technical Description
Version 3.00.30
ZTE CORPORATION ZTE Plaza, Keji Road South, Hi-Tech Industrial Park, Nanshan District, Shenzhen, P. R. China 518057 Tel: (86) 755 26771900 800-9830-9830 Fax: (86) 755 26772236 URL: http://support.zte.com.cn E-mail: doc@zte.com.cn
LEGAL INFORMATION Copyright 2005 ZTE CORPORATION. The contents of this document are protected by copyright laws and international treaties. Any reproduction or distribution of this document or any portion of this document, in any form by any means, without the prior written consent of ZTE CORPORATION is prohibited. Additionally, the contents of this document are protected by contractual confidentiality obligations. All company, brand and product names are trade or service marks, or registered trade or service marks, of ZTE CORPORATION or of their respective owners. This document is provided as is, and all express, implied, or statutory warranties, representations or conditions are disclaimed, including without limitation any implied warranty of merchantability, fitness for a particular purpose, title or noninfringement. ZTE CORPORATION and its licensors shall not be liable for damages resulting from the use of or reliance on the information contained herein. ZTE CORPORATION or its licensors may have current or pending intellectual property rights or applications covering the subject matter of this document. Except as expressly provided in any written license between ZTE CORPORATION and its licensee, the user of this document shall not acquire any license to the subject matter herein. The contents of this document and all policies of ZTE CORPORATION, including without limitation policies related to support or training are subject to change without notice.
Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
This Class A digital apparatus complies with Canadian ICES-003.
Revision History Date 2006/12/06 Revision No. R1.0 Serial No. sjzl20062401 Description
ZTE CORPORATION Values Your Comments & Suggestions!

Your opinion is of great value and will help us improve the quality of our product documentation and offer better services to our customers. Please fax to: (86) 755-26772236; or mail to Publications R&D Department, ZTE CORPORATION, ZTE Plaza, A Wing, Keji Road South, Hi-Tech Industrial Park, Shenzhen, P. R. China 518057. Thank you for your cooperation!
Document Name Product Version ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description V3.00.30 Document Revision Number R1.0
Equipment Installation Date Presentation: (Introductions, Procedures, Illustrations, Completeness, Level of Detail, Organization, Appearance) Good Your evaluation of this documentation Accessibility: (Contents, Index, Headings, Numbering, Glossary) Good Fair Average Poor Bad N/A Fair Average Poor Bad N/A
Intelligibility: (Language, Vocabulary, Readability & Clarity, Technical Accuracy, Content) Good Fair Average Poor Bad N/A Please check the suggestions which you feel can improve this documentation: Improve the overview/introduction Improve the Contents Improve the organization Include more figures Your suggestions for improvement of this documentation Add more examples Add more detail Other suggestions __________________________________________________________________________ __________________________________________________________________________ __________________________________________________________________________ __________________________________________________________________________ __________________________________________________________________________ # Please feel free to write any comments on an attached sheet. If you wish to be contacted regarding your comments, please complete the following: Name Postcode Telephone Company Address E-mail Make it more concise/brief Add more step-by-step procedures/tutorials Add more troubleshooting information Make it less technical Add more/better quick reference aids Improve the index
This page is intentionally blank.
Contents
About this Technical Description ..............................................................ix
Purpose of this Technical Description ........................................................................ x Typographical Conventions..................................................................................... xi Mouse Operation Conventions................................................................................. xi Safety Signs..........................................................................................................xii How to Get in Touch .............................................................................................xiii
Customer Support.................................................................................................................xiii Documentation Support.........................................................................................................xiii
Chapter 1...................................................................................... 15
Basic Knowledge ..................................................................................... 15
Evolution of the CDMA Network to the All-IP Network .............................................. 15 LMSD Network Architecture of the cdma2000 All-IP Circuit Domain Core Network...... 18
Network Entities....................................................................................................................20 Interface Description .............................................................................................................21
Vision of the All-IP Core Network............................................................................ 21
Chapter 2...................................................................................... 23
System Architecture................................................................................ 23
Introduction to the System.................................................................................... 23
Overall System Architecture...................................................................................................23 Main Functions ......................................................................................................................26 Normative Reference.............................................................................................................26 System Characteristics ..........................................................................................................27
Hardware Structure .............................................................................................. 28

Access Unit ...........................................................................................................................29 Switching Unit.......................................................................................................................30 Processing Unit......................................................................................................................30 Clock Unit .............................................................................................................................31
Software Structure ............................................................................................... 31

BSP Subsystem.....................................................................................................................32 OS Subsystem ......................................................................................................................33 Database Subsystem.............................................................................................................35 System Control Subsystem....................................................................................................37
Bearer Subsystem.................................................................................................................37 PP Subsystem .......................................................................................................................37 Signaling Subsystem .............................................................................................................38 Service Subsystem................................................................................................................38 NM Subsystem......................................................................................................................39
Chapter 3...................................................................................... 41
Technical Indices..................................................................................... 41
System Indices..................................................................................................... 41
Capacity Indices....................................................................................................................41 Synchronous Clock Indices ....................................................................................................41 Reliability Indices...................................................................................................................42
Mechanical and Electrical Indices............................................................................ 42

Service Cabinet Indices..........................................................................................................42 Server Cabinet Indices...........................................................................................................43 Alarm Box Indices .................................................................................................................43 BCTC Plug-in Box and Board Indices ......................................................................................43 Cooling Fan Indices ...............................................................................................................44
Environmental Requirements................................................................................. 44
Temperature and Humidity Requirements ..............................................................................44 Cleanness Requirements........................................................................................................45 Lighting Requirements...........................................................................................................45 Air Pressure Requirements.....................................................................................................45 Air Pollution Requirements .....................................................................................................45 Fire-control Requirements......................................................................................................45 Quakeproof Requirements .....................................................................................................46 Lightning-proof Requirements................................................................................................46 Electromagnetic Radiation Interference Resistance Requirements ............................................46 Antistatic Requirements.........................................................................................................46 Power Supply and Its Grounding Requirements ......................................................................47
Unit/Module Indices .............................................................................................. 48

Internal Communication Unit Indices......................................................................................48 SS7 Signaling Processing Unit Indices.....................................................................................48 IP Signaling Processing Unit Indices .......................................................................................49 Signaling Processing Module Indices.......................................................................................49 Service Processing Module Indices .........................................................................................49 Monitoring Indices .................................................................................................................50
Chapter 4...................................................................................... 51
Interfaces and Communications............................................................. 51
Physical Interfaces................................................................................................ 51 Logical Interfaces.................................................................................................. 52
MAP Interface .......................................................................................................................52 Accounting System Interface .................................................................................................52 Operation & Maintenance Interfaces.......................................................................................54
SS7 Signaling....................................................................................................... 55
MTP2 Protocol .......................................................................................................................55 MTP3 Protocol .......................................................................................................................56 SCCP Protocol .......................................................................................................................59 TCAP Protocol........................................................................................................................62
SIGTRAN Protocol................................................................................................. 64
SCTP Protocol........................................................................................................................65 M3UA Protocol.......................................................................................................................70
Chapter 5...................................................................................... 79
Service Functions .................................................................................... 79
Overview ............................................................................................................. 79 Basic Mobile Telecommunications Services.............................................................. 80
Location Registration .............................................................................................................80 Call Processing ......................................................................................................................82 VLR Restart Exception Handling .............................................................................................84 Data Synchronization ............................................................................................................85 Data Deletion ........................................................................................................................86
Authentication Service .......................................................................................... 88

Authentication Center (AUC)..................................................................................................88 Authentication Service...........................................................................................................89 Implementation Procedure.....................................................................................................91
Functions of Supplementary Services ..................................................................... 92

Call Forwarding Supplementary Services ................................................................................92 Call Barring Supplementary Services......................................................................................93 Number Identification Supplementary Services.......................................................................94 Other Supplementary Services...............................................................................................94
Short Message Service.......................................................................................... 96

Mobile-Originated Short Message (MO SM).............................................................................96 Short Message Notification.....................................................................................................97 Implementation Procedure of the SM Address Request............................................................98
Mobile Data Service Functions................................................................................ 98 Functions of IN Services ........................................................................................ 99

Pre-Paid Charging (PPC) Service ............................................................................................99 Wireless Virtual Private Network (WVPN) Service ....................................................................99 FreePhone Service (FPS)......................................................................................................100
Chapter 6.................................................................................... 103

Networking Modes and System Configuration..................................... 103
Networking Modes .............................................................................................. 103 System Configuration.......................................................................................... 104

Configuration for Capacity of 800,000 Subscribers ................................................................105 Configuration for Capacity of 2 Million Subscribers.................................................................106 Configuration for Capacity of 4 Million Subscribers.................................................................108 Configuration for Capacity of 6 Million Subscribers.................................................................109
Index .......................................................................................... 113 Abbreviations ............................................................................. 115 Figures........................................................................................ 119 Tables ......................................................................................... 121
About this Technical Description

As the core network equipment of the third generation (3G) mobile communication system, the ZXC10-3GCN system is developed on the basis of CDMA2000 ALL-IP architecture. The ZXC10-3GCN provides more service contents in addition to a more powerful processing capacity of circuit domain and packet domain services. Capable of transmitting such multimedia services as voice and data and location service, it features a higher rate and a higher resource utilization. The ZXC10-3GCN supports access of the 2G and 3G end users, and provides a variety of services related to 3GCN. The ZXC10-3GCN system consists of many kinds of devices: ZXC10 MGW ZXC10 MSCe ZXC10 HLRe ZXC10 SCPe ZXC10 SGW ZXC10 AGW The ZXC10 HLRe home location register emulator (hereinafter referred to as the ZXC10 HLRe, unless specified otherwise) functions as the central data processing center in the 3GCN system. It implements signaling interaction with other functional entities through the SS7/IP signaling, processes subscriber services, manages subscriber data and implements system maintenance and service handling. The ZXC10 HLRe supports not only the networking mode of bearer and control separation, but also IS95 and cdma2000 1X networking. In addition to the common mobile switching networks, it is also applicable to the signaling network and mobile intelligent network. Thus, the ZXC10 HLRe is suitable for various complicated networking of mobile switching networks and ensures the sustainable development capability of networks.
Confidential and Proprietary Information of ZTE CORPORATION
ix
ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description
Purpose of this Technical Description

This manual describes the system architecture, technical indices, communication protocol and supported services of the ZXC10 HLRe. It consists of 6 chapters. The contents of each part are as follows: Chapter 1 Basic Knowledge describes the evolution to the all-IP network from the CDMA network as well as the network structure and interfaces of the 3G core network. Chapter 2 System Architecture describes the system architecture of the ZXC10 HLRe product, including the hardware structure and software structure. Chapter 3 Technical Indices describes the technical indices of the ZXC10 HLRe product, covering the system indices, mechanical electric indices, environmental requirement indices and unit/module indices. Chapter 4 Interfaces and Communication describes the interfaces and communication protocols that the ZXC10 HLRe product supports. The interface consists of physical interface and logical interface. The communication protocol includes the SS7 signaling and SIGTRAN protocols. Chapter 5 Service Functions describes the service functions that the ZXC10 HLRe product supports, including the basic service function, supplementary service function, value-added service function and intelligent service function. Chapter 6 Networking Mode and System Configuration describes the networking modes and system configuration of the ZXC10 HLRe product.
Typographical Conventions
ZTE documents employ the following typographical conventions.
TABLE 1 TYPOGRAPHICAL CONVENTIONS
Typeface
Meaning References to other guides and documents. Links on screens. Menus, menu options, function names, input fields, radio button names, check boxes, drop-down lists, dialog box names, window names. Keys on the keyboard and buttons on screens and company name. Text that you type, program code, files and directory names, and function names. Optional parameters Mandatory parameters Select one of the parameters that are delimited by it Note: Provides additional information about a certain topic. Checkpoint: Indicates that a particular step needs to be checked before proceeding further. Tip: Indicates a suggestion or hint to make things easier or more productive for the reader.
Italics
Quotes Bold
CAPS Constant width [] {} |
Mouse Operation Conventions

TABLE 2 MOUSE OPERATION CONVENTIONS
Typeface Click Double-click Right-click Drag
Meaning Refers to clicking the primary mouse button (usually the left mouse button) once. Refers to quickly clicking the primary mouse button (usually the left mouse button) twice. Refers to clicking the secondary mouse button (usually the right mouse button) once. Refers to pressing and holding a mouse button and moving the mouse.
xi
Safety Signs
This equipment involves high voltages and can only be installed, operated and maintained by qualified professionals. Please observe the local safety codes and relevant operating procedures in equipment installation, operation and maintenance. The safety precautions introduced in this manual are only supplementary to the local safety codes. ZTE should not bear any liabilities incurred by violation of the universal safety operation requirements, or violation of the safety standards for designing, manufacturing and using the equipment. Table 3 shows the safety signs used in this book and on ZTE's products.
TABLE 3 S AFETY SIGNS
Safety Signs
Meaning Danger: Indicates an imminently hazardous situation, which if not avoided, will result in death or serious injury. This signal word should be limited to only extreme situations. Warning: Indicates a potentially hazardous situation, which if not avoided, could result in death or serious injury. Caution: Indicates a potentially hazardous situation, which if not avoided, could result in minor or moderate injury. It may also be used to alert against unsafe practices.
Erosion: Beware of erosion.
Electric shock: There is a risk of electric shock. Electrostatic: The device may be sensitive to static electricity.
Microwave: Beware of strong electromagnetic field. Laser: Beware of strong laser beam.
No flammables: No flammables can be stored.
No touching: Do not touch.
No smoking: Smoking is forbidden.
xii
How to Get in Touch

The following sections provide information on how to obtain support for the documentation and the software.
Customer Support
If you have problems, questions, comments, or suggestions regarding your product, contact us by e-mail at support@zte.com.cn. You can also call our customer support center at (86) 755 26771900 and (86) 8009830-9830.
Documentation Support
ZTE welcomes your comments and suggestions on the quality and usefulness of this document. For further questions, comments, or suggestions on the documentation, you can contact us by e-mail at doc@zte.com.cn; or you can fax your comments and suggestions to (86) 755 26772236. You can also explore our website at http://support.zte.com.cn, which contains various interesting subjects like documentation, knowledge base, forum and service request.
xiii
14
Chapter
Basic Knowledge
In this chapter, you will learn about:
Evolution from the CDMA network to the all-IP network System architecture and features of cdma2000 all-IP LMSD STEP2 Vision of all-IP core network
Evolution of the CDMA Network to the All-IP Network

With the rapid development of mobile communication technologies and the promotion of various services, the demand for higher-level mobile communication is increasing. In addition to high-quality voice services, customers also require richer data and multimedia services, thus raising higher requirements for spectrum efficiency of mobile communication. Current 2G systems such as GSM and CDMA can no longer meet expanding requirements for mobile communication. Against this background, the third generation mobile communication system (3G) has come into being. At present, the ITU-T adopts the following 3G technical standards: WCDMA of Europe cdma2000 of USA TD-SCDMA of China Among them, cdma2000 has evolved from the 2G CDMA IS-95 network architecture. The CDMA technical system has evolved from the initial IS-95 system to cdma2000 series, through Phase0, Phase1, Phase2 and Phase3, and will ultimately develop into cdma2000 ALL-IP network. In the present Phase0/Phase1, at the radio side, the air interface has undergone the technical evolution process from cdma2000 1X, cdma2000 1X EV-DO to cdma2000 1X EV-DV. At the core network side, the Packet
15
Data Switching Node (PDSN) is added; but little change is made in the MSC/VLR that supports voice and enhanced circuit switching data services. At present, cdma2000 is developing towards Phase2. Phase 2 can be further divided into STEP1, STEP2 and STEPn. It is the first step towards ALL-IP. The principle of signaling-bearer separation and that of access network and core network separation are being implemented in this phase. Generally speaking, Legacy Mobile Station Domain (LMSD) is added at the core network side of STEP2, and the IP switching technology is adopted to implement the access of 2G BSS and 3G ALL IP BSS, as well as to support legacy MS service. Figure 1 illustrates the evolution of the CDMA network to the all-IP network in all the four phases:
FIGURE 1 DIAGRAM OF CDM A NETWORK EVOLUTION
1. Phase0 This phase introduces the radio network of the traditional circuit mode, which supports the circuit switching and packet switching technologies. It follows the N.S0005 (TIA/EIA-41-D), cdma2000 Release 0 and IOS 4.0 protocol standards. See the specific description as follows: Core network It supports TIA-41 network. The support of the packet data network is provided by the service option 33 capability set defined
16
Chapter 1 - Basic Knowledge
in IS-707. But it does not the packet data switching based on the TIA-41 network. The packet data network follows the P.R0001 Release A standard to implement the simple IP and mobile IP access technologies. The authentication charging server function is implemented through AAA. Access network It is defined in the IOS 4.0, specifying the interface between the MSC and BSC that are based on the traditional TIA-41 network and the interface between the PCF and PDSN. Air interface It is defined in the cdma2000 Release 0. 2. Phase1 In this phase, the circuit switching technology and the early networkbased packet switching technology are supported, which include: Packet data session handoff. Originating the packet data sessions after the handoff of the circuitswitched call. Originating or terminating the circuit-switched voice call after the packet session handoff. Circuit-switched voice call and concurrent services of the activated packet session. In this phase, the supported protocol standards include N.S0005, N.S0029-0, cdma2000 Release A and IOS 4.1. See the following for detail: Core Network It supports traditional TIA-41 network, and is defined by N.S0005 and N.S0029-0. For the packet data network, it supports P.S0001 Release B as the standard protocol for radio IP network data. Access network It provides IP transmission signaling access to traditional TIA-41 networks The signaling link and bearer stream transmission is regulated in the IOS4.1 Air interface The evolution of the air interface is independent of that of the core network. It is based on the cdma2000 Release 0 or Release A standard. 3. Phase2 In this phase, the LMSD concept of the mobile station domain is introduced, indicating the first step of evolution to the All-IP network. The signaling and transmission bearer are evolved independently; the core network and access network are evolved independently. The core network can use the existing bearer architecture to provide support to the available services of the traditional TIA-41 network. in the access network for and packet data networks. are separated. The bearer standards.
17
Core Network In Phase2, the core network can also be divided into Step-1, Step-2 and Step-N, respectively corresponding to LMSD-Step 1, LMSDStep 2 and LMSD-Step N. Each of the steps has different system requirements. In Phase2, the MSC is evolved into network entities MSCe and MGW/MRFP, with some new interfaces such as the xx, yy, zz and 39. The original interfaces are enhanced in their functions. And its bearer mode also changes. For example, the 27 interface corresponds to the A2 and A5 interfaces, and the 48 interface corresponds to the A1 interface. The core network STEP-2 and its subsequent phases support packet-based TrFO and RTO. Access network It supports the LMSD. The interface between the access network and LMSDS supports independent signaling links and the transmission of bearer streams. The access network in Step 2 and Step N evolves towards IP transmission. Air interface The evolution of the air interface is independent of the evolution of the core network. 4. Phase3 This phase marks the peak of the evolution to the All-IP network. An obvious feature of this phase is the expanded IP transmission of the air interface and the absence of LMSDS.
Note: The ZXC10 HLRe is developed and designed according to the requirements of Step-2 of Phase2. It is compatible with the functions in Phase1 and Phase0, namely, the functions of the ZXC10 HLRE.
LMSD Network Architecture of the cdma2000 All-IP Circuit Domain Core Network
Figure 2 illustrates the LMSD network architecture of the cdma2000 All-IP circuit domain core network.
18
FIGURE 2 BASIC NETWORK ARCHITECTURE OF LMSD OF STEP2
Other LMSD
MSCe AAA Media Gateway zz
21
22
yy cdma2000Access Network BTS BSC/RNC + PCF MM ( FA /

Attendant )
27 31
Access Gateway
Media Resource Function Processor xx 41 43 Mobile IP Home Agent
Media Gateway 39 34 40 IP Network
35 PDSN
44 45
48 47 Mobile Station
MAP 14 TIA/EIA-41 GSM
Legacy MS Domain Support HLRe MSCe SCPe 13 PSTN
In the above diagram, the part surrounded by the thick dashed lines and thick solid lines stands for the NE of LMSD, and the thick dashed line connecting the entities indicates the interface between the NEs of LMSD. Compared to the traditional circuit domain MSS system, the LMSD shows its biggest difference in the separation of the call control from bearer and in the substitution of the TDM technology with the packet network technology. The LMSDS has three network entities: MSCe, HLRe and SCPe. The traditional MSC NE is evolved into the MSCe and MGW. The MSCe provides the call control and mobility management functions. The MGW provides the media control function, transmission resources, and media stream operation function. The LMSDS core network provides the access to the 3G BSS system and the traditional 2G BSS system, as well as the interworking with the TIA/EIA/IS-41 network, GSM MAP network and fixed PSTN network.
19
Network Entities
Compared to the traditional circuit domain MSS system, the LMSD shows its biggest difference in the separation of the call control from bearer and in the substitution of the TDM technology with the packet network technology. The LMSD contains the following network entities: MSC emulator (MSCe) The MSCe integrates multiple logical functional entities, supports mobility management, and provides the call control, connection and VLR functions as well as some service functions. It is the core equipment for providing the call, control and service functions of the real-time circuit domain voice/data services in this phase. Media gateway (MGW) The MGW provides: The bearer service support for the packet environment in the core network and the circuit switching environment in the PSTN network The vocoder function of the voice coder/decoder The MODEM/IWF functions (the two functions are converted mutually between the circuit frequency modem tone and the digital frequency byte stream) The capability of terminating the PPP connection. Media resource function processor (MRFP) In the LMSD, the MRFP and the control entity MSCe together provide the multi-party session bridging, notification playback, and announcement playback services. HLR emulator (HLRe) In addition to the functions of HLR, the HLRe has an IP signaling interface to manage the subscriber voice service and data service features and the subscriber location and accessibility information. SCP emulator (SCPe) The SCPe provides the IP signaling interface for processing the requests for call control and customized services during the WIN process. It interacts with other functional entities to access to the supplemented logics to obtain the information required for call processing and service logic instances. Signaling gateway (SGW) The SGW implements the conversion of the SS7 transmission (SS7 MTP) in the core network and the IP-based signaling transmission (SIGTRAN SCTP/IP), thus providing an effective guarantee for the integration of the services of different networks.
20
Interface Description
The LMSD circuit core network can provide the access to the 3G BSS system and the traditional 2G BSS system. The LMSD can provide the interworking with the TIA/EIA/IS-41 network, GSM MAP network and fixed PSTN network. In detail, there are the following interfaces: 13 interface A signaling interface between the MSCe and PSTN, which adopts the SS7 ISUP signaling. 14 interface A signaling interface between the MSCe and the TIA/EIA-41 network, which adopts the ANSI/TIA/EIA-41 Revision D signaling. 27 interface An interface (supporting voice bearer and circuit data bearer) between the MGW and BSS, which adopts the IOS (A2 and A2p) signaling. 34 interface An interface (media stream) between the MGW and PSTN. 39 interface An interface (merely a signaling interface of the LMSD) between the MGW and LMSDS. 48 interface A signaling interface between the cdma2000 access network and LMSDS. xx interface A signaling interface between the MRFP and LMSDS. The MSCe controls the MRFP to play announcements via this interface, or inserts announcements on the bearer. yy interface An interface between the MGWs, which adopts the IP-based bearer mode (media stream). zz interface An interface between the MSCes, which supports the SIP-T protocol.
Vision of the All-IP Core Network

In terms of the 3GPP2 standard, the LMSD will evolve to the multimedia domain (MMD) and disappear in this phase. The AGW (FA) and HA NEs provide the IP bearer path for the MMD services. The MMD network is a pure SIP softswitch network. The HLR and AAA will also evolve to a unified
21
home subscriber server (HSS). The NE device related to multimedia calls mainly refers to CSCF. Thereby, in terms of the network architecture, the MMD and softswitch are consistent. Their networks are both divided into the service layer, control layer, bearer layer and access layer. In such a hierarchical architecture, the service provision is separated and service generation and billing are implemented by the various application servers and authentication servers. In the service layer, standard interfaces are always available for a third party to provide services. In cdma2000 Phase2, the evolution proceeds towards the all-IP network structure and transmission control, diversification of services and service implementation modes, and the integration with the NGN. The process from Phase2 to Phase3 represents the peak of the cdma2000 All-IP network evolution. In this process, the IP bearer mode is adopted throughout the air interface, access network and core network.
22
Chapter
System Architecture
Overall system architecture, functions and characteristics System hardware structure System software structure
Introduction to the System

The ZXC10 HLRe system incorporates the AUC and adopts the design idea of the All-IP architecture and softswitch. Its design gives full consideration to system reliability, availability and data consistency. It is also designed based on the flexible multi-level and multi-module structure for the convenience of capacity expansion.
Overall System Architecture

The ZXC10 HLRe functions as the central data processing center in the CDMA 3G mobile communication system. It processes subscriber services, manages subscriber data, exchanges signaling with other functional entities via No.7 signaling/IP signaling, and implements system maintenance and service handling. Its system structure is shown in Figure 3.
23
FIGURE 3 OVERALL SYSTEM ARCHITECTURE OF ZXC10 HLRE
No.7 signaling network
IP network
Accounting system
HLRe front PC
HDBAgent- 140
HDBAgent - 141
134 Server (DBIO)
170 Client (agent)
10/100M Fast Ethernet
Database server 151

d i gi a l t
Database server 152
OMC Server
OMC Client
Disk array
The ZXC10 HLRe system comprises the following parts: FEP The front end processor (FEP) serves as the core module of the interface between the HLRe and other functional entities and the service processor. It has the following functions: i. Processing No.7 signaling and IP signaling. ii. Using its memory database to store the background subscriber data that is home to this module. iii. Processing the HLRe MAP service. The HLRe MAP distributes subscriber messages not belonging to this module to the homed module. iv. Using its integrated O&M foreground module to process the operation and maintenance instructions sent from the background and returning the processing results to the background. Configuration of the FEP varies with the subscriber capacity. HDBAgent The HDBAgent implements the access of the physical database as an agent of the FEP module. It adopts the structure of load sharing among several modules, and consists of one or multiple processing modules. Once a processing module is faulty, the others can share the outstanding task. The HDBAgent has the following functions: i. Uploading the background out-of-syn subscriber data to the FEP.
24
Chapter 2 - System Architecture
ii. Downloading the FEP out-of-syn subscriber data to the physical database. iii. Accessing the physical database at the request of the FEP and returning the corresponding results. The number of HDBAgent modules can be configured flexibly according to the requirement of the subscriber capacity. Application server The DBIO program is run on the application server 134 to provide the database access interface for the agent and accounting system. Agent The agent offers man-machine operations, through which carriers can manage subscribers. In addition, a router can be used to implement the remote service handling. O&M component The O&M component includes the OMC Server and OMC Client. The maintenance console allows you to perform man-machine operations, through which carriers can know about the running status of the HLRe system, and detect and clear the faults. In addition, a router can be used to implement the remote operation and maintenance. Database server ZXC10 HLRe supports two database plans: Windows+SQL or Unix+Oracle. Subscriber capacity and operator requirements decide which plan is to be adopted. The database server comprises one or multiple HLR data processing modules (HLR Data processing Modules, or to be short, HDM) according to the subscriber capacity of the HLRe system. It adopts the distributed storage mode. The database server divides subscriber data into different fields and places these fields on different HDMs. Each HDM consists of two servers and one disk array. It adopts the Cluster technology to enhance system reliability and saves data in the form of RAID1+0. ZXC10 HLRe supports the functions as below: Over-the-Air (OTA) services The service processing subsystem performs the functions of adding subscriber in database, modifying A-Key or MIN and Re-authentication operations. Disaster Recovery services The ZXC10-HLRe can run as an independent HLR office and at the same time has the function of disaster recovery. It can run as a master HLR, and also can run as a disaster recovery HLR for all the HLRs in an area to backup all the static subscriber data, and take over the service automatically or manually when the master HLRs fail due to various problems.
25
Main Functions
The ZXC10 HLRe has the following functions: 1. Mobility management function Supports the location update of 2G and 3G subscribers; supports the roaming of a dual-mode terminal between the 2G network and 3G network; supports the authentication encryption arithmetic of the 2G network and 3G network as well as their mutual conversion. 2. Basic call function Supports various calls made between mobile subscribers and between a mobile subscriber and a PSTN subscriber. 3. Data service function Supports the circuit-type transparent services of maximum 64kbps. 4. Sort message service function Supports the SM service originated and terminated by mobile subscribers. 5. Supplementary service function Supports the abundant supplementary services, such as number display, call forwarding, call restriction, multiple calls making, and so on. 6. WIN service function Supports the prepaid service (PPS), virtual private network (VPN) service, and free phone (FPH) service. and non-transparent data
Normative Reference
The ZXC10 HLRe complies with the following standards: 3GPP2 Technical Specification Series ITU-T recommendations series TIA/EIA Related Protocols IETF RFC Related Protocols GF001-900: Technical Specifications for SS7 of China Domestic Telephone Network YD/T627-93: Digital Switch Trunk Interface (2048 Kbit/s) Parameters, Transmission Characteristics Between Digital Interfaces and Test Methods GB 4943-1995: General Technology Products Safety Requirements for Information
General Technical Requirements for Mobile Softswitch Equipment
26
System Characteristics
The ZXC10 HLRe has the following characteristics: 1. Advanced technology Satisfies the protocol standard of 3GPP2 LMSD STEP2. Draws on the strong points of various mobile switching systems both at home and abroad; its hardware structure, software system and whole equipment process all reach the advanced level of the same type of products. In terms of hardware design, the system adopts industry leading very large-scale integrated circuits. This reduces the number of discrete elements, greatly improves system reliability and integration, and decreases power consumption. The software development conforms strictly to the software engineering design requirements, and follows a top-down, hierarchical, and modular design to make the software easier to maintain and expand. The system features powerful processing capability and large switching capacity. It supports a maximum of 6 million mobile subscribers. 2. Flexible networking capability Provides the open standard protocol interface. Provides a broad range of external physical interfaces, including the E1 interface, 10/100Base-TX interface, and 1000Base-FX interface. Provides the full capability of processing signaling protocols, such as SS7, IOS, SIGTRAN and CAS, to facilitate the interconnection with other NEs. 3. Good compatibility and scalability The system conforms to the 3GPP2 standard, CDMA technical specifications and other related standards, and can interconnect with other products in compliance with the standards. Capacity expansion and system application are flexible. You can make configurations flexibly as required. The system implements smooth expansion and provides a solution with the best performance/cost ratio. Adaptive to the evolution of the cdma2000 core network and easy to expand new functions 4. Perfect operation & maintenance system Unified NM subsystem, pursuant to the ITU-T and 3GPP2 standards and the description of TMN in the standards MO-based object management, providing the standard CORBA interface with the upper-level NM, and implementing the centralized management and maintenance of the NM Multiple remote and local system access modes are provided. The operation and maintenance can be fulfilled not only locally but also
27
remotely through the network system. The operation and maintenance are accessible not only to the entire system, but also to the specific entity. Reliable security through the adoption of multi-level authority protection The system has such functions as performance management, security management, service observation, signaling tracing, configuration management, version management, and fault management. It provides multiple accurate, reliable, practical and convenient O&M approaches. Functions can be added according to the actual network operation and users demands. Friendly NM system interface and extensive online help functions Comprehensive NM system functions and flexible networking, allowing centralized management of various NEs of the ZXC10 5. High reliability All critical parts work in active/standby and hot backup mode and are equipped with the automatic switchover function upon failures to ensure the uninterrupted operation of the system. Dual-network control mode, improving the system reliability Redundancy design, reserving adequate resources The perfect traffic control technology, routing policy and network processor technologies ensure the network security and smoothness. Layered and modular software design, and such technologies as fault tolerance and overload control come together to ensure high system reliability. System running monitoring and tracing mechanism and various types of resource management, monitoring and protection mechanism, ensuring speedy detection and location of faults, and timely recovery of the system
Hardware Structure
In terms of hardware, the ZXC10 HLRe system consists of one or multiple control subsystems. The control subsystems are interconnected through the tandem of Ethernet on the control plane. The hardware structure of the control subsystem is shown in Figure 4:
28
FIGURE 4 HARDWARE STRUCTURE OF ZXC10 HLRE
Interconnection of subsystems
BCTC Ethernet of UIM control plane FE E1/ T1 SPB
FE
SP B OMP
OMC Server
FE
FE MNIC
FE
CL K SMP
The control subsystem comprises the signaling processing board (SPB), multi-function network interface board (MNIC), service processing board (SMP), and operation & maintenance processing board (OMP). It transits and processes the control stream and forms the distributive system processing platform. The control subsystem adopts the backplane of the control center (BCTC) as its bearer backplane. Signals involving with the subsystem include the TDM signal, control stream Ethernet signal, clock signal and other control signals. The CHUB board transits the control plane Ethernet between multiple control subsystems. The CLKG board provides the global clocks. The CLKG board can be placed on any BCTC. It is connected to the UIM inside the subsystem via the RS485 bus. The ZXC10 HLRe consists of the following four subsystems: Access unit Switching unit Processing unit Clock unit
Access Unit
The access unit provides various external interfaces for accessing the HLRe to the SS7 signaling network and IP network, so that the system can interconnect with the MSCe and interwork with the PSTN and PLMN. The access unit includes the SPB and MNIC. It implements the L1 physical interface and the processing of L2 protocol relative to the interface.
29
1. SPB The SPB provides the access of 16 E1s/T1s and the processing of the MTP2 protocol of SS7, encapsulates the messages above MTP3 as net load in the internal messages, and sends them through the control plane switching network (IP switching unit) to the corresponding SMPs for processing. The SPB can extract the 8K synchronous clock from the lines, and transfers them to the clock board as the clock reference. 2. MNIC (the logical board includes SIG-IPI and USI) The MNIC provides four external FE interfaces. When serving as the SIG-IPI board, the MNIC transfers the signaling streams of the control plane and implements the signaling reception and distribution. After the reception of the IP signaling message, it starts to process the SCTP/IP protocol stack, and then distributes the processed upper-layer signaling message to each SMP through the control plane switching network (IP switching unit) for further processing. The processing course in the reverse direction is the opposite to the above description. When the MNIC serves as the USI board, it transfers the background information to the SMP for processing.
Switching Unit
The switching unit connects the access unit and processing unit to exchange the control plane Ethernet in the system. The switching unit consists of the UIM board and CHUB board. 1. UIM (universal interface module) The UIM implements the exchange of the control plane Ethernet (48FE+2GE) inside the subsystem, and provides the FE interface for interconnection of subsystems. 2. CHUB (control stream hub) The CHUB provides 46 external FE interfaces and one GE interface to transit the control planes of different subsystems, thus making up of the HLRe system with large capacity.
Processing Unit
The processing unit is the core of the HLRe system. It fulfils the processing of the upper-layer signaling and the HLRe service functions. The processing unit includes several main processing boards (MPB) with different functions, which are respectively: 1. OMP (operation & maintenance processing unit) The OMP provides the operation and maintenance function and the Ethernet interface between the control subsystem and the background OMC server.
30
2. RPU (route processing unit) The RPU processes such routing protocols as RIP, OSPF and BGP. 3. SMP (service processing unit) The SMP implements the processing of the upper-layer SS7 signaling and IP signaling and the service functions of the HLRe.
Clock Unit
The clock unit provides the global synchronous clock for the units requiring clock synchronization in the HLRe. The clock unit provides the CLKG board, and implements the access of BITS clock and line extracted clock, clock genlock, and clock distribution. The global clock topology is shown in Figure 5.
FIGURE 5 GLOBAL CLOCK TOPOLOGY
Other control subsystems
16M8K
16M
Control subsystem 16M8K 16M
16M8K 16M
MPB
CLKG CLKG 2MHz 2Mbit
RS485
UIM T20ms )
16M8K 16M Extract 2 sets of 8K via the line
SPB
The active and standby CLKG boards each provide 15 sets of 16M8K and 16M clocks. After the active and standby multiplexing, they provide 16M8K and 16M clocks to the active and standby UIMs of each subsystem. The CLKG communicates with the UIM in the subsystem via the RS485 bus.
Software Structure
The software of the ZXC10 HLRe adopts the top-down design and modular design.
31
Pursuant to the idea of software hierarchy, the whole system comprises the bottom-layer hardware platform, BSP subsystem, OS subsystem, system control subsystem, database subsystem, bearer subsystem, PP subsystem, signaling subsystem, service subsystem, and NM subsystem. The division of the software subsystems and their relationship are shown in Figure 6.
FI G U R E 6 OV ER AL L S O F T W AR E AR C H I T E C T U R E O F Z X C1 0 HLR E
N M subsystem System control subsystem Databasesubsystem
Service subsystem
Signaling subsystem
Bearer subsy stem
P P subsystem
O S subsystem BSP subsystem H ardw are platform
BSP Subsystem
The BSP subsystem boots and drives the hardware of the entire system. Specifically, it has three functions: Boot CPU minimum system Hardware equipment drive To make the software subsystem above the operating system independent of the hardware, the BSP must: Screen the hardware device operation details from the upper-layer software module, abstract the hardware functions, and provide only the logical function layer of the hardware device for other software modules. Provide to the upper-layer software subsystem (mainly the real-time operating system) with the unified and encapsulated function interface, and screen the parameters unnecessary to the upper-layer software. The BSP has high reliability and stability requirements on the device driver.
32
In principle, the BSP provides interfaces only to the real-time operating system. Whereas, to improve the efficiency of data receiving and transmission, some software modules, such as MTP2, may also directly invoke the device driver interface provided by the BSP. Support the on-line and off-line test of the hardware boards, and provide the necessary interfaces. The BSP provides a complete process invoking environment, in which the interfaces are provided through invoking the functions. The upper-layer software enjoys the hardware functions also by using these functions.
OS Subsystem
The operating system (OS) works above the BSP subsystem and below all the other subsystems. It screens all the device driver interface to the user processes, and provides the process scheduling, timer, memory management and file system services based on one processor as well as the inter-process communication service based on multiple processors. The core of the OSS is the commercial OS core. The encapsulation layer is above the core. The encapsulation layer encapsulates the system schedules, and screens the functions that are unnecessary to the user processes while providing to the user processes with necessary primitive and function invoking interfaces. The OS has two levels of scheduling units: task and process; that is, it provides two levels of scheduling. The main tasks created by the OS include communication task, several scheduling tasks, device driver task, timer scanning task, and idle tasks. These tasks are assigned with different priorities depending on the actual needs. The commercial OS shall be responsible for scheduling the tasks based on the message-driven preemptive priority scheduling. The running tasks may be interrupted and its CPU utilization right may be preempted by a task with higher priority. All the user processes are attached under the scheduling tasks. Each scheduling task is assigned with a different priority; the user processes with different priorities shall be attached under the scheduling tasks of the corresponding priorities; and the user processes with the same priority shall be attached under one scheduling task. Under a specific scheduling task, all the processes shall have the same priority, and the processes shall be scheduled in a message-driven circulation mode. The customized message queue is used for the inter-process communications in the same task. In this case, the messages are directly assigned to the message queue of the destination process. But the interprocess communications between different tasks use a task mailbox. In this case, the messages are first put into the mailbox of the scheduling task where the destination process is located and then dispatched by the scheduling task to the destination process. The communication between different processors is based on the TCP (rUDP)/IP/Ethernet mode. The communication module between the
33
processors shall be responsible for setting up and maintain the socket for communication with the peer processor, and receive/send messages over the socket. There should be fixed corresponding relationship between the control plane IP address and MAC address of the board. For the sake of simplicity, the IP address and MAC address shall both be calculated according to the slot number of the board. Two active and standby communication links are available on each board and the message-related processing board in the active/standby mode, and are maintained by the communication layer. When the processing board is switched between the active and standby states, the communication layer of the board shall be responsible for the switchover of the active and standby communication links. In the switchover process, all the messages sent from the user processes of the board should be cached until the buffer area overflows. Upon completion of the switchover, the cached messages shall be sent out in the original sequence. To prevent a user process from generating large amount of memory fragment due to frequently applying for/releasing the memory blocks of different sizes, the memory management module splits the memories managed by the OS into several memory block pools of different sizes ranging between 64 Bytes, 128 Bytes and 256 Bytes. They are referred to as UB pools. In addition, to avoid system abnormities resulted from large occupation of UB by a user process, the UB pool is divided into two parts, one for the inter-process communications and the other for use by the user processes. The memory management module also provides the user processes with the registration of the interface of the global variable that need be protected. In this way, the user processes can use this interface to register to the OS their own global variables to be protected, and the protected global variables will not be modified by other processes. The memory management module also provides the page-restricted memory protection so that exceptions will occur once the access of memories is beyond the threshold. The timing management module provides to the user processes with various timer functions, such as nameless timer, named timer, relative timer and absolute timer. The timer precision is 100 ms by default and can be adjusted as required on each processor. The minimum precision is 10 ms. In addition, the timing management module also provides a special timer precise at 1 ms through its hardware. The Epilogue protocol stack of the bearer subsystem uses its own timer system, which, however, is dependent upon the 20 ms timer provided by the OS.
34
Database Subsystem
The database subsystem works above the OS managing the service, signaling and protocol configuration information, and at the same time provides to other subsystems with the database access interface. The database is a relational database comprising the foreground database and background database. The background DbAgent shall be responsible for the data distribution work. The relation table data will then be directly transmitted to various MPBs from the agent according to the background distribution result. The MPBs will save the data received from the background temporarily in the buffer area other than in the active/standby data area. After the data transmission, they load the data to the table memory at the specified moment of the absolute timer and then trigger the data saving operation. The verification of the consistency of the foreground data table shall be implementd by the background. The data synchronization between the active and standby MPs is similar to the foreground and background data synchronization. The resource management mode varies with NEs. It must be specified in the NE design part. The database resource management mode can be selected flexibly because every two boards can communicate directly via the control plane path. The database is distributed on such boards as OMP, SMP and RPU. The HLRe subscriber database has two service objects: service processing subsystem and operation & maintenance subsystem, as shown in Figure 7.
FIGURE 7 SERVICE OBJECTS OF DAT AB ASE SUBSYSTEM
Service processing subsystem
O&M subsystem
Database subsystem Function invoking
The subscriber database stores various subscriber data, such as the authentication information, basic subscriber information, subscribers supplementary service information, location information and IN service information. The contents of subscriber database are listed in Table 4.
35
TABLE 4 SUBSCRIBER DATAB ASE CONTENTS
Classification of Subscriber Data
Detailed Contents Terminal type, authentication key, authentication capability, authentication arithmetic version, authentication instruction, authentication status, current SSD, to-be-determined SSD, authentication failure counts, call history counts, timer ID, subscription date, subscriber name, ID number, family address, company address, contact, carrier code, route digit, charging account, charging digit, call originating indication, call originating trigger parameters, call termination trigger parameters, call termination restriction code, restriction code matching the call originating indication, geographical approval, access priority, interception password trigger parameters, approval period, denial period, subscriber status, roaming restriction, SM originating restriction, SM termination restriction, SM status, message waiting indicator count, message waiting indicator type, statistical data, Service Options, three-way connection, call roaming, call forwarding on subscriber busy, default forwarding, call forwarding unconditional, call forwarding on subscriber not reachable, call waiting, caller identification display, calling number identification restriction, call transfer, do not disturb, priority access and channel assignment, voice encryption, voice mailbox query, preferred language, password call receiving, call receiving selection, message waiting indicator, remote feature control, conference call, negligence of calling number identification restriction, IN service information, personal identification number interception, personal identification number access, no reply duration, PIN code integration, preferred language, PCA password list, SCA number list, SCA final call number, LAI cell number information, MAH group (mobile station access hunting), MAH group ID, MAH group number, MAH group description, group charging ID, group member ID, and registration number. Subscriber activation status, subscriber-homed VLR flag, subscriber-homed MSC flag, SMC address type, SMC address, SMC flag, SM status, subscriber status, and cell roaming number. Storage contents, VLR ID, VLR ID number, VLRs manufacturer code, VLR supported authentication capability, VLR signaling point code, and effective VLR flag. Storage contents, current subscriber, denied subscriber, calling number identification presentation 1, calling number identification presentation 2, calling number identification restriction, negligence of calling number identification restriction, do-not-disturb service, voice encryption service, subscriber PIN interception, subscriber PIN access, call transfer, call forwarding on subscriber busy, default forwarding, call forwarding unconditional, call forwarding on no reply, call transfer, call waiting, conference call, three-way connection, SM, preferred language, message waiting notification, remote feature control, PCA (password chosen acceptance), SCA (selective call acceptance), voice mailbox extraction, PIN code integration, PPC (pre-paid charging), PACA (priority access and channel assignment), MAH (mobile station access hunting), authentication, and activated subscriber.
Terminal subscribers subscription information
Terminal subscribers location information
VLR management information
Terminal subscriber statistic information
36
Classification of Subscriber Data
Detailed Contents
Note: With the development of new services, the ZXC10 HLRe database stores the terminal subscriber data of these new services.
System Control Subsystem

The system control subsystem works above the OS and database subsystem, responsible for the monitoring, boot and version download of the whole system. The core processing board, such as the MP board and switching network board, must be able to work in the 1+1 active and standby modes. The 1+1 active and standby processing boards transmit the active/standby information through the special active/standby path instead of the path of the control plane. Once the physical slot of the OMP is fixed, the IP address and MAC address of its control plane are also determined and serve as the reference point of the system. After the whole system is powered on, the OMP first activates configuration information of all the basic boards, such as the logical address and the home relationship between the resource board and the MP. The OMP also stores the versions and version information of all boards. Besides OMP, the background OMC also stores the versions of all boards. In principle, each board has a FLASH to store its own version. After a board is powered on, the boot module will first compare with the OMP to see whether the board versions on the FLASH are consistent. If the version number is consistent, the version on the FLASH of the board is loaded first. If the loading fails, the version will be applied for from the OMP, background OMC or the version server on the network. The system control subsystem provides the function of monitoring the process execution time.
Bearer Subsystem
The bearer subsystem works above the OS subsystem and database subsystem. It provides the bearer services such as IP service for the signaling subsystem and NM subsystem.
PP Subsystem
The peripheral processing (PP) subsystem manages the digital trunk interface, connects the switching network, and provides the system environment monitoring, clock management and power management functions.
37
Signaling Subsystem
The signaling subsystem works above the OS subsystem, database subsystem and bearer subsystem. It processes the SS7 signaling, SIGTRAN signaling and CAS. For the link layer protocols of SS7 signaling, the message transfer part 2 (MTP2) will be processed on the SPB board, and the other parts above the MTP shall be processed on the SMP board. The SMP board can work in the 1+1 active and standby modes. The signaling link layer implements the link-level load sharing. When the system has enough capacity, the load can be shared among multiple pairs of SMP boards. The SS7 signaling supports the signaling links at the rate of 64 kbps, 2 Mbps and n64 kbps. It also supports the multiple SP function on different signaling networks.
Service Subsystem
The service subsystem implements all kinds of services provided by the HLRe NEs. It is the core of the whole HLRe system. It works above the OS, database subsystem, bearer subsystem and signaling subsystem. The service subsystem includes the following functional modules: 1. Mobility management services During subscriber location update, the service subsystem implements relevant processing of the HLR. processing
When the VLR fails and restarts, it triggers the HLR recovery program during service processing to recover the data. When the HLR fails, the service processing subsystem notifies the related VLR of this message after system restart. The Operation & Maintenance Center (OMC) deletes subscribers from the VLR. After the VLR informs the HLR of this, the service processing subsystem performs related processing of the HLR. The service processing subsystem also implements authentication. When the subscription information of an HLR subscriber changes, the service processing subsystem automatically sends a synchronization message to ensure that the data registered in the VLR are consistent with the data in the HLR. 2. OAM services Operators can handle such matters as mobile station loss reports and overdue payment of subscribers through the OMC. 3. Call processing services The service processing subsystem queries the VLR where the subscriber is currently located to get the roaming number and returns the route information to the GMSC of the calling subscriber.
38
4. Supplementary services The service processing subsystem performs the functions of registration, cancellation, activation and deactivation of supplementary services. The service processing subsystem performs service operation password check and registration of subscribers in the HLR. 5. Short message service The service processing subsystem works with the ZXC10-MSC/VLR and the SMC to process short messages. 6. Wireless intelligent network (WIN) services The service processing subsystem cooperates with the ZXC10MSC/VLR/SSP, the SCP and other IN functional entities to process WIN services.
NM Subsystem
The NM subsystem works above the OS subsystem, database subsystem and bearer subsystem. It allows you to perform such operations as configuration, analysis and diagnostic test of the HLRe equipments, and to obtain the equipment alarms and statistical data. The NM subsystem includes the foreground part and background part. The foreground part runs on all the board as a part of the embedded system. The background part runs on a high-performance server. The foreground and background communication is based on the TCP (UDP)/IP/Ethernet protocol. The OMP is connected to the background through Ethernet. The operation and maintenance messages of all the other boards are transferred by this board to implement the foreground and background communication. The OMP is also responsible for sending all the configuration commands from the background to the foreground boards. On the foreground boards, there are such resident agents as alarm agent, performance statistics management agent, signaling tracing agent, service observation agent and dynamic data management agent, through which they interacts with the OMC Server. In addition, the OMP controls the diagnostic test of all boards.
39
40
Chapter
Technical Indices
System indices Mechanical and electrical indices Environmental requirements Unit/module indices
System Indices
The under-mentioned performance indices are given when the HLRe system are fully configured.
Capacity Indices
Table 5 lists the capacity indices of the ZXC10 HLRe.
TABLE 5 ZXC10 HLRE CAPACITY INDICES
Processing Capability
System Capacity SCTP coupling
6,800,000 subscribers 128 channels 40 FE interfaces 1024 64K signaling links, or 32 2M signaling links
Interface and resource
IP signaling interface SS7 link quantity
Synchronous Clock Indices

Table 6 lists the synchronous clock indices of the ZXC10 HLRe.
41
TABLE 6 SYNCHRONOUS CLOCK INDICES OF ZXC10 HLRE
Synchronous Clock Type Lowest clock accuracy: Pull-in range: Maximum frequency deviation: Initial maximum frequency deviation: Clock running mode:
Stratum-2 Clock Class A 410-7 410-7 10-9/day 510-10 Catch (fast pull-in), trace, hold and free run Signal jitter and wander at inlet: 1.5 UI, 20 Hz ~ 2400 Hz Signal jitter and wander at outlet: 1.5 UI, 20 Hz ~ 10000 Hz 0.2 UI, 18,000~100,000 Hz
Interface requirement of clock synchronization link (1 UI = 488 ns)
Reliability Indices
Table 7 lists the reliability indices of the ZXC10 HLRe.
TABLE 7 RELIABILITY INDICES OF ZXC10 HLRE
Basic Failure Rate Built-in reliability MTBF Mean time to repair (MTTR) Availability (A) (%) = MTBFs/(MTBFs + MTTRs) Life circle
nim
= 0.0000081/h
123457 h 0.5 h 99.9996% 20 years
Mechanical and Electrical Indices

Service Cabinet Indices
Table 8 lists the service cabinet indices.
TABLE 8 SERVICE CABINET INDICES
Indices Outline size Dimensions (height width depth) Weight Loading capacity requirement of floor Power supply Power consumption
Value Standard 19-inch rack with the maximum internal space capacity of 42U. 2000 mm 600 mm 800mm 350 kg (full configuration of one cabinet) > 450 kg/m2 -48 VDC; tolerable value range: -57 V ~ -40 V < 4000 W (full configuration of the cabinet)
42
Chapter 3 - Technical Indices
Server Cabinet Indices

Table 9 lists the server cabinet indices.
TABLE 9 SERVER CABINET INDICES
Indices
Value Standard 19-inch rack with the maximum internal space capacity of 42U. The universal PC server, HUB and router should be installed inside the server cabinet. 2000 mm 600 mm 1000mm 350 kg (full configuration of one cabinet) > 450 kg/m2 AC220 V10%, 50Hz5% < 3000 W (full configuration)
Outline size
Dimensions (height width depth) Weight Loading capacity requirement of floor Power supply Power consumption
Alarm Box Indices

Table 10 lists the indices of the alarm box.
TABLE 10 ALARM BOX INDICES
Indices Dimensions (height width depth) Weight Power supply Power consumption
Value 220 mm 309 mm 56mm 2 kg -48 VDC; tolerable value range: -57 V~ -40 V 20 W
BCTC Plug-in Box and Board Indices

The BCTC plug-in box and board indices are shown in Table 11.
TABLE 11 PLUG-IN BOX AND BOARD INDICES
Indices Plug-in box dimensions (height width depth) BCTC plug-in box power consumption MNIC board power consumption UIMC board power consumption SPB board power consumption OMP board power consumption SMP board power consumption
Value 354.8 mm 482.6 mm 479.2 mm < 1000 W (full configuration) < 24 W < 41 W < 31 W < 48W (P3 CPU)/42W (PM CPU) < 46W (P3 CPU)/39W (PM CPU)
43
Indices CLKG
Value < 17 W
Cooling Fan Indices

Table 12 lists the indices of each cooling fan inside the service cabinet.
TABLE 12 INDICES OF E ACH COOLING FAN IN SERVICE CABINET
Indices Voltage Current Power Wind volume Wind pressure Rotation speed Noise Life Ambient temperature
Value -48 V 0.78 A Maximum: 37 W 600.6 CFM (cubic feet/minute) 6.0 mmH2O 2800 RPM 45 dBA 62500 h -10 C ~ +75 C
Environmental Requirements
Temperature and Humidity Requirements
Table 13 lists the temperature and humidity requirements of the ZXC10 HLRe.
TABLE 13 ZXC10 HLRE TEMPERATURE AND HUMIDITY REQUIREMENTS
Temperature Equipment Type ZXC10 HLRe Long Term Operating Condition 0C ~ 40C Short Term Operating Condition -5C ~ 45C
Relative Humidity Long Term Operating Condition 20% ~ 90% Short Term Operating Condition 5% ~ 95%
Note 1: The measurement point of the operating environment temperature and humidity in the equipment room refers to the data measured 1.5m above the floor and 0.4m away from the front side of the rack. Note 2: The short-term working condition means that the continuous running period is no more than 48 hours, and the accumulated running period a year is no more than 5 days.
44
Cleanness Requirements
The concentration of a dust particle whose diameter is greater than 5 um should be no more than 3104 grains/m3.
Lighting Requirements
Incandescence lights or emergency illumination devices should be located properly between the cabinets to provide illumination for equipment installation and maintenance. However, the equipment should not be exposed long under lighting or sunshine, to prevent the circuits or components from aging and distorting by high temperature. It is recommended that colored glass and dark transparent curtains be used for windows. The principal illumination of the equipment room employs fluorescent lamps that are embedded into the ceiling, with an average illumination of 150 lx ~ 200 lx.
Air Pressure Requirements

The equipment has no special requirements for air pressure.
Air Pollution Requirements

There should be no explosive, conductive, magnetoconductive and corrosive dusts and no metal-erosive and insulation-damaging gases in the equipment room.
Fire-control Requirements
The main building of the equipment room must meet the requirements of related fire control standards. Based on the local fire control regulations, the corresponding fire equipment should be equipped and sufficient fire passages should be reserved. Notice boards bearing "Key Fire Control Site" should be put at proper locations. Neither the main equipment room nor the accessory equipment room should have flammable or explosive materials placed inside. Warning boards bearing No Smoking or No Fire should be located in notable places. Prepare effective fire-protection appliances and put them within the reach. Install fire-fighting water devices in proper positions. The water in store should suffice two-hours continuous fire-fighting use. But the supplying pipe (and the drainpipe, rain pipe) should not traverse the equipment room; neither can the fireplug be placed in the equipment room. Alarming devices for smog and heat should be installed and inspected frequently to guarantee their good performances.
45
Quakeproof Requirements
The quakeproof intensity of telecom equipment building should be designed one degree higher than local construction intensity. Those equipment buildings in short of quakeproof intensity requirements have to be strengthened. The construction departments should be invited to join the design and its execution. The equipment should be strong enough to resist against a 7-magnitude quake.
Lightning-proof Requirements
When the height of the main building itself or its auxiliary facilities (such as chimneys, antennas, and water towers) exceeds 16.40 yd, effective lightning protection measures should be taken according to the lightningproof requirements for the Class-II civil buildings and structures. In the lightning protection design, measures should be taken to guard against direct-strike lightning and the incursion of lightning current. Protective measures should also be taken to defend against side flash when a tall building serves as the equipment room. Flank lightning happens often in lightning-prone areas. Therefore, protective measures against side flash shall be taken based on the specific conditions in design, for example, connect the metal window frames of the building with the lightning-proof down leads, or install metal lightningproof straps on the external surface of the wall at certain intervals along the building.
Electromagnetic Radiation Interference Resistance Requirements

The equipment room should be far away from high-power radio transmission stations, radar transmission stations, or high-frequency and high-current equipment. The actual radiation to the equipment room should be kept below 300 mv/m, and the intensity of magnetic field should be less than 11Gs.
Antistatic Requirements
The influence of static electricity on the equipment is often liable to be neglected, though it is proved a very serious problem, which demands high attention. Electrostatic damages to the devices are seldom fatal at one time but accumulate gradually. In this process, intermittent failure or performance deterioration occurs now and then during equipment operations as a result. Such damages may also cause software failures, resulting in breakdown or even malfunction of electronic switches and control circuits. Static induction comes from the following: External electrical fields, such transmission lines and lightning. as outdoor high-voltage power
46
Internal systems like the indoor environment, floor material and the integrated equipment structure Discharge of the static electricity on the body from the O&M person to the equipment through body contact In order to effectively eliminate the harm incurred by electric static discharge (ESD), the following measures should be taken: Ground the equipment well. Use anti-static floorboards and have them grounded. The O&M personnel must wear ESD wrist during operation, and connect the ESD wrist with the static discharge hole on the equipment cabinet.
Power Supply and Its Grounding Requirements

1. Power supply requirements of the service cabinet and alarm box: The nominal input voltage should be equal to -48V DC, fluctuant from 57V to -40 V. The DC power should have the overvoltage/overcurrent protection and corresponding indications. The level indices of the contained noise should comply with the requirements of relevant technical specifications, as listed in Table 14.
TABLE 14 DC POWER INDICES
Item Nominal value Allowed fluctuation of voltage 0 Hz ~ 300 Hz 300 Hz ~ 3400 Hz 3.4 kHz ~ 150 kHz Noise voltage 150 kHz ~ 200 kHz 200 kHz ~ 500 kHz 500 kHz~ 30 MHz
Indices -48 V -40 V ~ -57 V 100 mV peak-to-peak value 2 mV weighted noise of psophometer Single frequency 5 mV valid value; broadband 100 mV valid value Single frequency 5 mV valid value; broadband 100 mV valid value Single frequency 3 mV valid value; broadband 30 mV valid value Single frequency 1 mV valid value; broadband 30 mV valid value
2. Power supply requirements of the server cabinet Power supply for the server cabinet should be 220V AC at 50Hz, which is supplied using UPS or an inverter (converting -48V DC to 200V AC). A standby generator is also required for such equipment.
47
The voltage waveform distortion ratio of the standby power generator ranges from 5% to 10%. 3. Grounding requirements Grounding plays an important role in guaranteeing a good electromagnetic condition and anti-interference ability of the operating environment of the principal and auxiliary equipment in the system, which requires high attention. The ZXC10 HLRe system has three types of grounding wires: -48 VGND (-48 V ground) GNDP (system protection ground) GND (working ground) GNDP and GND are connected to the shelf through the mechanical parts and to the DC stake via the busbar. The -48 VGND is supplied with the primary power and is not connected with GNDP, GND and cabinet. For joint grounding, the grounding resistance should be smaller than 1 .
Unit/Module Indices
Internal Communication Unit Indices
Table 15 lists the indices for the internal communication unit.
T A B L E 1 5 I N T E R N A L C O M M U N I C AT I O N U N I T I N D I C E S
Indices Physical interfaces
Value 288 FEs
Note: Internal communications are conducted over the 100M Ethernet, which can be expanded into a 3-layer switching network with one GE Switch and several FE Switches.
SS7 Signaling Processing Unit Indices

Table 16 lists the indices for the SS7 signaling processing unit.
TABLE 16 SS7 SIGNALING PROCESSING UNIT INDICES
Indices Physical interfaces SS7 signaling processing capacity
Value 16 E1 interfaces 4 2M signaling links, or 64 64k signaling links
Note: Each SPB board provides 16 E1 interfaces and supports both 64k signaling links and 2M signaling links.
48
IP Signaling Processing Unit Indices

Table 17 lists the indices for the IP signaling processing unit.
TABLE 17 IP SIGNALING PROCESSING UNIT INDICES
Indices Physical Interfaces IP signaling processing capacity
Value 4 FE interfaces 80 Mbit/s
Signaling Processing Module Indices

Table 18 lists the indices for the signaling processing module.
TABLE 18 SIGNALING PROCESSING MODULE INDICES
Indices
Value Message loss rate < 10-7
Message error rate
Message wrong sequence rate < 10-10 Message error rate < 10-10 Normal load: Average (50%) < 20 ms; adverse (95%) < 40 ms
Transmission delay
Over normal load for 15%: Average (50%) < 40 ms; adverse (95%) < 80 ms Over normal load for 30%: Average (50%) < 100 ms; adverse (95%) < 200 ms
Maximum signaling link capacity Number of processed messages GTT capability
1024 64kbps signaling links, or 64 2M signaling links 100 000 MSU/s 32 000 GTT/s
Service Processing Module Indices

Table 19 lists the indices for the service processing module.
TABLE 19 SERVICE PROCESSING MODULE INDICES
Indices HLRe
Value Supports 1,200,000 dynamic subscribers Call processing: 0.5 processing/ subscriber in busy hours
Reference load:
Mobility management: 2 processing/subscriber in busy hours Authentication: 0.5 processing/subscriber in busy hours
49
Indices Message loss probability: Information retrieval delay: Registration delay: GTT capability
Value P 10-7 1000ms (95% probability) 2000ms (95% probability) 32 000 GTT/s
Note 1: The service processing module mainly processes the mobility management service, call service, SMS service and supplementary service of the MS. Note 2: The service processing module is located on one CPU on the SMP board. Its processing capability is related to the SMP configuration, especially the CPU configuration on the SMP.
Monitoring Indices
Table 20 lists the technical indices for the environment parameter monitoring module.
TABLE 20 MONITORING INDICES
Indices Protection scope of smoke sensor alarm Protection scope of infrared alarm Test scope of flooding Test scope of temperature
Value 60 m2 Number of sensors Sector with 15 m radius and 90 degrees Number of sensors 10 mm ~ 1000 mm 0C ~ 50C (frequency output: 1 kHz ~ 1.5 kHz); measured precision: 0.5C 20% ~ 100% (frequency output: 1 kHz ~ 2 kHz, corresponding to 0% ~ 100%); measured precision: 3% 0 revolution/minute ~ 5000 revolutions/minute; precision: 1% Configurable through a program (default value: 30C) Configurable through a program (default value: 15C) Configurable through a program (default value: 60%) Configurable through a program (default value: 45%) Configurable through a program (default value: -57 V); precision: 2% Configurable through a program (default value: -40 V); precision: 2% Configurable through a program (default value: 80% rated rotation speed)
Test scope of humidity
Test scope of fan rotation speed Upper-threshold alarm of temperature Lower-threshold alarm of temperature Upper-threshold alarm of humidity Lower-threshold alarm of humidity Upper-threshold alarm of -48 V power Lower-threshold alarm of -48 V power Fan rotation speed alarm
50
Chapter
Interfaces and Communications

Physical and logic interfaces provided by ZXC10 HLRe externally Signaling protocols of ZXC10 SIGTRAN protocols HLRe, including SS7 signaling and
Physical Interfaces
The ZXC10 HLRe provides the following standard interfaces: E1 interfaces T1 interfaces 10Base-TX/100Base-TX interfaces Table 21 lists the standard and type of cables suitable for each interface of the HLRe.
TABLE 21 STANDARD AND TYPE OF CABLE SUITABLE FOR E ACH INTERFACE OF HLRE
Type of Interface SS7 signaling interface SIGTRAN signaling interface NM Interface Synchronous clock interface
Physical Standard E1/T1 100Mbps Ethernet network 100Mbps Ethernet network E1
Type of Cables Coaxial cables/balanced wires Category-5 twisted pair Category-5 twisted pair Coaxial cables
51
Logical Interfaces
MAP Interface
1. Interface between MSCe and HLRe (interface C) The mobile application part of the system adopts the ANSI TIA/EIA41E protocol; the signaling process part is in compliance with the Technical Requirements for the Mobile Application Part (MAP) of the 800MHz CDMA Digital Cellular Mobile Communication Network. This interface is based on the 2 Mb/s digital interface or 64 kb/s interface. The electrical performance of the interface complies with the related specifications in Chapter 7 of General Technical Requirement for Digital SPC Switching Equipment, volume 1 of GF002-9002.1 Ministry of Post & Telecommunications General Technical Requirement for Telephone Exchanging Equipment, and GB7611-87 Parameters of Digital Interface for PCM System over Telecommunication Network. For descriptions of the SCCP part, refer to the Technical Specifications for the SS7 Signaling Mode --- Signaling Connection Control Part (SCCP). For descriptions of the TCAP part, refer to ANSI T1.114-1988 Signaling System No. 7 (SS7)- Transaction Capabilities Application Part (TCAP). For the MTP part, refer to GF001 - 9001 Technical Specifications of Signaling System No.7 for the National Telephone Network of China. The 24-bit No.7 mode is adopted in interface C. 2. Interface between VLR and HLR (interface D) The same as interface between HLRe and MSC 3. Interface between HLRe and AUC (interface H) Currently an internal interface is used. 4. Interface between HLRe and SC (interface N) The same as interface between HLRe and MSC 5. Interface between HLRe and SCP The same as interface between HLRe and MSC
Accounting System Interface

1. Overview The accounting interface provides the function of managing the HLRe subscriber information, including various operations on the related information. Figure 8 shows how the accounting system visits the ZXC10 HLRe.
52
Chapter 4 - Interfaces and Communications
FIGURE 8 ACCOUNTING INTERFACE
Application server
LAN switch
Subscriber database
Router ZXC10-HLR/AUC
Remote accounting system
Router
LAN switch
Service console
Service console
By means of the TCP/IP protocol, the accounting system is connected through Port 3000 with the application server of ZXC10-HLRe. The application server gains access to a subscriber database through the internal interface. It assigns the IP address to the accounting system with the configuration file, and the accounting system uses this IP address for connection. The accounting system and the application server implement the corresponding service functions through the accounting interface. The ZTE HLRe system provides the user name and password. The application server can serve as an independent physical entity or be integrated on the maintenance server. 2. Functions of the accounting interface Adding user authentication information Add user authentication information, namely, the MIN, Akey, and ESN. Adding a new user The accounting system must provide the users MIN and MDN numbers, and the brief service information. Querying user information Query user information according to the users MDN number. Modifying user information
53
Based on user information queried by the users MDN number, modification may be implemented, including power on/suspension and modifying user subscription information functions. Deleting a user Delete a user according to the MDN number. Deleting authentication Delete the authentication according to the MIN number. Changing card/number Change a card/number according to the users MDN number. Intelligent network services Modify the users attributes (including the prepaid service and the VPN users) according to the MDN. 3. Business process The service flow of the accounting interface is as follows: The accounting system sends the service request to the HLRe application server, and then the application server gives the service request response message to the accounting system according to the processing result.
Operation & Maintenance Interfaces

ZXC10 HLRe network management complies with the TMN structure, including the following interfaces: Interface N to the network management center The interface N implements interconnection between the EMS and the network management center OMC through the CORBA/CNMP/CMIP protocol. Interface F to the client As an interface between the network management server and the client, the interface F describes commands and command responses in texts between the client and the server. Interface Q3 between modules of the network management center Interface Q3 is an interface between network management modules such as the LMF, LAF, and NAF. When the CMIP specification is adopted, the message code stream is CMIS stream. Interface between the network management system and the HLRe An internal message interface or SNMP interface may be adopted between the network management and the HLRe. Structure of the network management protocol is shown in Figure 9.
54
FIGURE 9 NETWORK M AN AGEMENT INTERFACE PROTOCOL
NM
Internal interface or SNMP interface Client F interface (XML) Adapter Server
N interface Upper-level NM
center
HLRe
All the network management interfaces are application interfaces, which are used for interconnection and interaction between systems and devices. The interfaces run on the TCP/IP protocol. No concrete communication protocol is involved, and only the interconnection specification is applied to these interfaces. Because there is no concrete command form for interface F specified in the TMN protocol, the XML text form is adopted in the network management system.
SS7 Signaling
SS7 signaling hierarchy in the HLRe is shown in Figure 10.
FIGURE 10 SS7 SIGNALING HIERARCHY
TCAP SCCP TUP ISUP
MTP3 MTP3 MTP2 MTP1
MTP2 Protocol
The MTP2 implements SS7 signaling link functions, including SS7 signaling link management, maintenance, and signaling message transmission. The MTP2 can manage the 64K signaling link, n*64K signaling link, and 2M high-speed signaling link.
55
Functions of MTP2 protocol include: Signal unit delimitation and positioning There is a special 8-bit code at the start and the end of each signal unit. During delimitation, if an unallowable type of bit code (larger than 111111) is received or the signal unit exceeds a certain maximum length, it indicates loss of positioning. Error detection Error detection: implemented by the 16-bit check code provided by the end of each signal unit Error correction There are two ways to correct the error, namely, the basic way and preventive cyclic retransmission. Initial positioning During first start (after successful connection) or recovery from link malfunction, a period of message transmission is implemented first, and the link begins running if the error is allowable. Otherwise, the link will exit. Signaling link error monitoring During initial positioning and the service state, the error ratio of messages transmitted over the link is monitored. If the error ratio is higher than the preset value, the link will exit. Processor fault Detect local processing fault and report it to the opposite end; report opposite processor fault to the MTP3. Link state control Control link state conversion and report link state change to the MTP3 when the link state changes. Traffic control Judge whether congestion occurs according to use of the buffer on the link and report to the upper layer or the opposite end.
MTP3 Protocol
MTP3 structure is shown in Figure 11.
56
FIGURE 11 MTP3 STRUCTURE
Level 3 Signaling Message Transfer Part MTP3
Signaling message processing Message distribution HMDT Message authentication HMDC
Message routing HMRT
SCCP Signaling network management Signaling service management
MTP2
Signaling route management
Signaling link management
MTP3 management
The MTP3 is equal to the network layer of the OSI model. It consists of two modules: 1. Signaling message handling Message handling includes message routing and message distribution. Message handling is designed to ensure that the signal message generated by the user part of a signaling point is transferred to the same user part of the destination designated by this user part, and load of this signaling message is shared among different links according to the users selection to prevent message transfer from loss, retransmission or disorder. Signaling message handling includes message routing, message authentication, and message distribution. Message routing (HMRT) At each signaling point, select from the route list the signaling link group and the signaling link routing to the destination of the signaling message.
57
Message routing is implemented through route labeling. A route label includes the DPC, OPC, and SLS. DPC indicates the SP code of the message destination. OPC indicates the SP code of the message source. SLS indicates the signaling routing code, used in load sharing between signaling links. For some messages that are transmitted to the third stage only, the SLS corresponds to the SLC (Signaling Link Code) of the signaling link between the destination and the start point, but for some stage-3 messages independent of any signaling link, the SLC is 0000. Message authentication (HMDC) After receiving a message signaling unit from the signaling link function stage, the signaling point implements message authentication. According to the DPC in the message route label, judge whether the signaling point is the destination SP. If yes, transfer it for message distribution; otherwise, transfer it through message routing. Message distribution (HMDT) After receiving a message, the destination SP of the signaling message implements message distribution. According to the code of the 8-bit service information SIO in the signaling unit received, determine the user part to which the message belongs and deliver it to the corresponding upper layer user. 2. Signaling network management In case of any fault of the signaling network, signaling network management is implemented through interaction with other signaling points in the network to update the route and ensure reliable transmission of messages. Signaling network management has its own message format and coding method. In the signaling network, when the signaling link or signaling point is faulty, signaling network management provides actions and processes for maintaining signaling services and restoring normal signaling conditions. Signaling network management consists of the following three parts: Signaling traffic management This function implements changeover/changeback, forced rerouting, controllable rerouting, signaling point reboot process, flow control, and management blocking/unblocking. Signaling link management Signaling link management is a basic process of signaling link management. It implements signaling link start, exit, state query, and corresponding service management start notification when the signaling link state is changed. Signaling route management Signaling route management ensures the reliability of information exchange on the signaling route between the SPs. It consists of
58
four processes, namely, barred delivery, allowable delivery, limited delivery, and controllable delivery.
SCCP Protocol
The MTP3 has network-layer functions, but the MTP address is not global, so the SCCP is introduced. Located above the MTP layer 3, the SCCP provides connectionorientated/connectionless network services and GTT (Global Title Translation), enhances the addressing function, and implements networklayer functions together with the MTP3, directly transmitting signaling between different SS7 signaling networks that are globally connected. Structure of the SCCP protocol is shown in Figure 12.
FIGURE 12 SCCP STRUCTURE MODEL
SCCP subscriber N_Transmiss ion primitive

SCCP connectionoriented transmission control module (SCOC)
SCCP Connectionoriented message Routing error Connectionless message Routing error

Receive messages sent to the subsystem but not available to this node
SCCP routing control module (SCRC)
MTP
MTP_Transmis sion primitive
N_Transmiss ion primitive
SCCP connectionless transmission control module (SCLC)

S O R S O G S S S S AP S S T
N_Managem ent primitive
SCCP management control module (SCMG)
MTP_Manage ment primitive
The SCCP protocol consists of four functional modules, namely, SCCP routing control, connection-orientated transmission control, connectionless transmission control, and SCCP management control. 1. SCCP routing control (SCRC) After receiving a message from the MTP, SCCP routing control implements message authentication and route selection, and then sends the message to the connectionless transmission control (SCLC), connection-orientated transmission control (SCOC), or MTP. The SCCP routing control also receives internal messages from the SCOC and the SCLC, implements necessary routing functions, and transmits the messages to the MTP. There are two modes of SCCP route:
59
DPC+SSN addressing GT addressing GT is a global address. Generally, GT addressing is used when the destination SP code is unknown to the originating node. To transfer messages to the MTP, the SCCP must translate GT into DPC+SSN or combination of DPC, SSN, and GT. As the resource for each node is limited, it is impossible for the SCCP of one node to translate all the GTs. Therefore, the GT may be first translated by the SCCP of the originating node into the DPC of an intermediate node, whose SCCP continues to translate the GT. In this way, the message is sent to the destination node. All these intermediate nodes are called trunk nodes of the SCCP message. 2. SCCP connectionless transmission control (SCLC) SCCP connectionless transmission service falls into two types: class0 and class1.class1 requires delivery in order, while class1 does not. During connectionless transmission, the SCCP user is allowed to request for user data delivery directly without preset signaling connection. The SCCP user of the data originating node uses the N-UNITDATA request primitive to request for SCCP transmission of connectionless data, and informs the SCCP through the primitive parameters of the called address of the connectionless data currently transmitted With its and the MTPs routing function, SCCP transfers the connectionless data (UDT and XUDT) to the specified destination. The called address may be various combinations of the DPC, SSN, and GT. When GT is concluded in the called address, it must be translated for data delivery to the destination. If the connectionless data UDT and XUDT fail to be transferred to the destination due to various causes, the SCCP node which detects the message transmission error will start the message return procedure, returning the user data to the released SCCP node through UDTS and XUDTS and giving explanation to the error. The connectionless data service can transmit not only SCCP upperlayer user data, but also SCMG messages. SCCP management message content is in the user data area of the UDT message. When the SCCP of the destination node receives the UDT, XUDT, and LUDT message, it uses the N-UNITDATA indication primitive to inform the SCCP user in case of non-SCMG messages; for SCMG messages, it transmit them to the SCMG for processing. 3. SCCP connection-orientated transmission control (SCOC) Connection-orientated services fall into two types: class2 and class3.class3 has traffic control, while class2 does not.class3 services have not been applied yet. The connection-orientated transmission control part (SCOC) implements a series of connection-orientated data transmission processes, including connection establishment, data transmission, connection release, and inactivity test. Now, we take SCCP connection as an example to describer the processes respectively.
60
i.
SCCP connection establishment The SCCP user uses the N-CONNECT.request primitive to send a request for SCCP connection establishment to the SCCP, which receives the N-CONNECT.request, assigns resources such as local reference number to the source ports, frames the CR message and sends it to the destination, and enables the timer T (conn est). After receiving the CR message, the destination end uses the NCONNECT.indication to inform the SCCP user on the higher layer. Upon receiving the N-CONNECT.response from the SCCP user, the destination end assigns local reference number to the input connection segments, frames the connection response CC message and send it to the source port, and enable inactivity test timers T (ias) and T (iar). After receiving the CC message, the source port uses the NCONNECT.confirm to inform the SCCP user of successful SCCP connection establishment, disables the timer T (conn est), and enables inactivity test timers T (ias) and T (iar). So far, SCCP connection between the source node and the destination node has been established successfully. And SCCP users can use the connection to transmit data.
ii. SCCP connection release SCCP connection release may be originated by any end of the connection. When the SCCP user at one end node of the SCCP connection uses the N-DISCONNECT.request primitive to send a request to the SCCP for connection release, the current connection segment at the SCCP connection release originating node sends the SCCP connection release request message RLSD, enables the release timer T (rel), and disables inactivity test timers T (ias) and T (iar). After receiving the RLSD message, the other end of the SCCP connection sends the release completion message RLC to the originating node, disables inactivity test timers T (ias) and T (iar), releases all the resources related to the current connection segment, including the local reference number, and uses the NDISCONNECT.indication primitive to inform the SCCP upper-layer user. After receiving the RLC, the release originating node also releases all the resources related to the current connection segment, including the local reference number and the timer T (rel). iii. Inactivity test SCCP connection inactivity test is to set the received inactivity control timer T (iar) and the transmitted inactivity control timer T (ias) at both ends of the connection segment respectively. For any message sent on the connection segment, the T (ias) should be restart; for any message received on the connection segment, the T (iar) should be restarted. In case of T (ias) timeout, send the IT message to the opposite end on the connection segment. In case of T (iar) timeout, release the current connection segment.
61
iv. Data transmission In the cdma2000 system, only the class2 services are applied, so here we describe DT1 transmission only. After successful establishment of SCCP connection, users at both ends of the connection can use the connection to transmit DTI. The upper-layer user at any end of the SCCP connection can use the N-DATA.request primitive to request for user data transmission. After receiving the N-DATA.request, the SCCP checks the length of the user data to see whether it should be segmented. If no segmentation is needed, user data can be sent to the opposite end just by one DT1 message. When the opposite end receives the DT1, it sends the data to the SCCP user through the NDATA.indication primitive. If the data which the SCCP user requests to transmit is too long, the data source node must segment the user data before inserting the upper-layer user data into the DT1 message. Then, multiple DT1 messages will be used to transmit the data to the destination end. After receiving the segmented DT1, the destination end regroups the data in multiple DT1s, and finally uses the NDATA.indication primitive to send the data to the upper-layer user. 4. SCCP management control (SCMG) The SCCP management function is applicable to both connectionless services and connection-oriented services. According to different management objectives, SCCP management falls into the following types: i. Signaling point status management According to the signaling point status message provided by the MTP, signaling point status management modifies the SCCP address translation table and the node status, modifies and regroups related routes, to make the user able to take measures to stop sending or send less signaling messages to the related signaling point. Signaling point status management includes SP allowable processing, SP barred processing, SP congestion, and congestion clearing. ii. Subsystem status management According to received information on related subsystem fault, out of service, and restoration, modify the SCCP translation table and update the subsystem status label. Subsystem status management includes subsystem barred visit control, subsystem allowable visit control, and subsystem status test.
TCAP Protocol
In the hierarchical structure of SS7, TCAP (Transaction Capability Application Part) belongs to the upper-layer part of the SCCP.
62
The TCAP is used to provide unified support for the information interaction of application services in a network environment, and to transmit such circuit-irrelevant information as the address translation information, subscriber data information, billing or management information between switching nodes and control nodes. The TCAP signaling process is the handling and control procedure over operations and sessions. TCAP consists of two parts: 1. Transaction Capability Application Part Sub-Layer (TCAPTSL) TCAPTSL serves to manage the transaction, namely, the signaling communication process between the local transaction sublayer users and remote transaction sublayer users. The transaction sublayer user is the TR-user. The only TR-user known at present is the component sublayer (TCAPCSL). Communication between peer TCAPCSLs is performed between peer TC-subscribers, called a session. Therefore, in the current definition of the TCAP protocol, the transaction is completely equal to the session, with one corresponding to the other. To implement the signaling process of one application service, two TC-subscribers make a two-way exchange of a series of TCAP messages. The starting, finishing, sequence of message exchange and the message content are all controlled and explained by TC-subscribers. The TSL manages the starting, holding and termination of a session, including the detection and processing of session abnormality. The protocol process is applicable to the session of any application service. 2. Transaction Capacity Application Part Component Sub-layer (TCAPCSL) The main functions of the TCAPCSL include operation management, component error detection and session component assignment. Normally, the invocation request of one operation is initiated by a TC user, and the TCAPCSL establishes a status diagram for each operation, to implement operation management. Component errors include the protocol error and response timeout. Protocol errors exactly refer to the inconsistency between the component type received by the component sublayer and the expected input into the operation status diagram, syntax error or unrecognizable on the component format. Response timeout refers to the timeout of operation timers. The TCAPCSL allocates the management over session IDs. session components through its
63
SIGTRAN Protocol
The signaling gateway (SGW) is used between the SS7 signaling network and the IP network. It is the proxy transceiver of signaling messages, implementing trunk translation or terminal handling to signaling messages. SIGTRAN is a signaling transmission protocol made by the IETF. It is used to implement SS7 signaling transmission over the IP network in the SGW. The SIGTRAN protocol system consists of two parts, namely, the signaling adaptation layer and the signaling transmission layer. The bottom layer is the standard IP bearer, as shown in Figure 13.
FIGURE 13 SIGTR AN STRUCTURE
S IG T R A N
S S 7 s ig n alin g ad ap tatio n lay er
P u b lic s ig n alin g tran s p o rt p ro to co l
S tan d ard IP
SS7 signaling adaptation layer It supports specific primitives. According to the functions implemented by the signaling gateway, the SS7 signaling adaptation layer can adopt the MTP2 user adaptation layer M2UA, MTP2 peer adaptation layer M2PA, MTP3 user adaptation layer M3UA, SCCP user adaptation layer SUA, and TCP user adaptation layer TUA. Besides, the SIGTRAN signaling adaptation layer also includes the ISDN Q.921 user adaptation layer IUA and V5.2 user adaptation layer V5UA. Common signaling transmission protocols It supports common and reliable signaling transmission, which is provided by the traffic control transmission protocol SCTP. The stack protocol of the SIGTRAN is shown in Figure 14.
64
FIGURE 14 SIGTR AN STACK PROTOCOL
TCAP Q931/QSIG IUA MTP3 M2UA/ M2PA SCCP ISUP M3UA SCTP IP TUP TCAP SUA V5.2 V5UA Signaling application layer Signaling adaptation layer Signaling transport layer IP layer
SCTP Protocol
SCTP is used to bear signaling in the IP network. It implements signaling message exchange in the IP-based Public Packet Switched Network (PPSN) and end-to-end traffic control and error control. SCTP is a reliable transmission protocol, established on the connectionless unreliable packet switched network. It is as real-time and fast-rated as the UDP and as reliable as the TCP connection. Similar to the TCP, SCTP overcomes the limits of the TCP: The TCP is for single address connection, while the SCTP connects multi-homed nodes, with multiple IP addresses and higher reliability. TCP connection supports one stream only and has HOL (Head of Line) congestion, while one SCTP connection supports multiple streams and enhances real-time performance. SCTP stream is a series of messages (message based), while the TCP stream is a series of octets (bit based). Four times of handshake are needed to establish the SCTP connection, while three times of handshake are needed to establish the TCP connection. During SCTP connection establishment, the COOKIE system is adopted to prevent from malicious attacks, with higher security. SCTP observes requirements specified in IETF RFC2960. Hierarchical model of SCTP application is shown in Figure 15.
65
FIGURE 15 HIERARCHICAL MODEL OF SCTP APPLIC ATION
SCTP subscriber application SCTP layer One or multiple IP addresses Network transmission
SCTP subscriber application SCTP layer IP SCTP End point B
IP SCTP End point A
1. Functions of SCTP Functional structure of the SCTP consists of several functional modules, as shown in Figure 16.
FIGURE 16 FUNCTIONAL STRUCTURE OF SCTP
SCTP subscriber application Intra-stream message delivery Coupling setup and release Packet validity verification Channel management Subscriber data segmentation Congestion verification and prevention Data block bundling
Association establishment and release Association is SCTP connection. The SCTP user originates a request for association establishment. In view of security, the COOKIE system is adopted to the association originating process to avoid malicious attack. Connection establishment and release implements connection status change and anomaly handling. Intra-stream message delivery in order A stream is a unidirectional logic channel between the SCTP ends. It is used to indicate the user message queue, which needs to be delivered to the high-layer protocol in order. When a connection is established between two ends, they should define the quantity of supported streams at the same time.
66
User messages are associated through the stream number. At the receiving end, the SCTP ensures that messages in specific streams are delivered to the SCTP user in order. User data segmentation When sending a user message, the SCTP segments the message to guarantee the packet length meets the requirement of the maximum transmission unit MTU; for the receiving end, it needs to regroup the segmented into a complete message and then deliver it to the SCTP user. Verification and congestion avoidance The SCTP allocates one transmission sequence number TSN to each user message, places the number into the queue waiting for confirmation, sets the waiting timeout timer, and prepares for round trip time (RTT) measurement. The receiver implements buffering and restoring to all the received messages and generates TSN verification. The verification and congestion avoidance function retransmits the packets not verified within the specified time. The retransmission function is similar to congestion avoidance of the TCP. Data block (Chunk) binding The SCTP user have an option to request for binding more than one user messages into one SCTP packet for transmission. The receiving end is charged to break down the packet. Packet validation verification Each SCTP public packet head contains one necessary verification label segment and one 32bit verification segment to provide additional protection. The receiving end discards the packets with invalid verification code. Channel management According to the indication of the SCTP users and the reachable status of each destination, select one destination transmission address for each transmitted SCTP packet. Probe the reachability of multiple paths connected and implement conversion of the main path according to the indication. 2. SCTP packet format and chunk type The SCTP packet consists of public packet head and several chunks. The chunk may contain the control information and the user data. The SCTP packet format is shown in Figure 17.
67
FIGURE 17 SCTP P ACKET FORM AT
1 Source port number
16
32 Destination port number SCTP public } packet head
Packet validity verification label Check code Data block type Data block ID Data block length
} Data block 1 Data block content
Data block type
Data block ID
Data block length } Data block n
Data block content
Source port number/destination port number (16 bit) It is used together with the source IP address/destination IP address to identify the packets belonging to a certain association. Verification label (32 bit) The sender sets the verification label to the value in the originating label received from the opposite end in the association originating stage. The receiver uses it to identify the validation of the SCTP packet. Verification code (32 bit) It is used to transmit SCTP packets. Chunk type (8 bit) Its value ranges from 0 to 254. The value 255 is reserved for expansion. Code allocation is shown in Table 22.
TABLE 22 CHUNK TYPE CODE
Value 0 1 2 3 4
Meaning Payload data (DATA) Initialing (INIT) Initialing acknowledge (INIT ACK) Selection acknowledge (SACK) Heartbeat request (HEARTBEAT)
Value 12 13 14 15~62 63
Meaning Reserved for congestion note response confirmation (ECNE) Reserved for congestion reducing window (CWR) Shutdown complete (SHUTDOWNCOMPLETE) IETF reservation Chunk expansion defined by IETF
68
Value 5 6 7 8 9 10 11
Meaning Heartbeat acknowledge (HEARTBEAT ACK) Abort (ABORT) Shutdown (SHUTDOWN) Shutdown acknowledge (SHUTDOWN ACK) Operation error (ERROR) Status Cookie (COOKIEECHO) Cookie acknowledge (COOKIE ACK)
Value 64~126 127 128~190 191 192~254 255
Meaning IETF reservation Chunk expansion defined by TF IETF reservation Chunk expansion defined by IETF IETF reservation Chunk expansion defined by TF
Chunk flag bit (8 bit) It is valued according to the chunk type, usually set to 0 and insignificant at the receiver. Chunk length (16 bit) It consists of such bytes of the chunk type segment, chunk flag bit segment, chunk length segment, and chunk content segment. Chunk content (length variable) This segment is the information to be transmitted. Its format depends on the chunk type. The total length of the chunk must be integral times of 4 Byte; otherwise, the sender should fill full-0 bytes into the chunk, but the bytes filled are not accounted into the chunk length. The filled bytes are insignificant at the receiver. 3. SCTP flow sample As shown in Figure 18, end A is used to originate establishment of association. It sends a user message to end B, which then sends a message to A.
69
FIGURE 18 SCTP FLOW S AMPLE
End point A INIT INIT ACK COOKIE ECHO COOKIE ACK
End point B
a b c d
DATA SACK
e f
DATA SACK
g h
a. The SCTP user at end A uses the ASSOCIATE primitive to request for establishment of association with end B. After receiving the association originating indication from the high-layer protocol ULP, end A sends an INIT chunk to end B. b. After receiving the INIT chunk, end B returns the INIT ACK chunk. In the response chunk, end B must generate a status COOKIE, which is sent out together with the INIT ACK. c. After receiving the INIT ACK, end A disables the T1-init timer, exits the COOKIE-WAIT status, and sends the received status Cookie in the COOKIE ECHO chunk. d. After receiving the COOKIE ECHO chunk, end B returns the COOKIE ACK chunk and sends a notification of successful association establishment to its SCTP upper-layer user. After receiving the COOKIE ACK, end A informs the SCTP upper-layer user of successful establishment of association. After four times of handshake, association is established unidirectional stream is available to data transmission. e. End A sends the upper-layer user data. f. End B returns the SACK response. g. End B sends the upper-layer user data. h. End A returns the SACK response. and
M3UA Protocol
During interconnection with the SS7, the signaling gateway adopts four adaptation layer protocols: M2UA
70
M2PA M3UA SUA Among these four types, the M3UA provides strong routing function and perfect signaling network management. And it has strong capability in networking and is suitable for inter-network telephone interconnection, so it is universally adopted. 1. M3UA protocol system structure Structure of the M3UA protocol system is shown in Figure 19.
FIGURE 19 STRUCTURE OF M3UA PROTOCOL SYSTEM
MTP3 subscriber
M3UA LM SCTP IP
The M3UA provides standard MTP3 interfaces to its upper-layer MTP3 users. Its lower-layer SCTP serves the M3UA by providing it with association. The M3UA has special layer management (LM) to provide management services. 2. Typical M3UA application M3UA is used for MTP3 message adaptation, which facilitates transmission of MTP3 user messages of SS7 signaling between the SS7 signaling network nodes and the IP network nodes. M3UA application in SGW As shown in Figure 20, the network interconnection function (NIF) of the SGW receives the message routing to the media gateway controller MGC (for example, MSCe) from the MTP3, sends it into local M3UA for network address translation and mapping, and routes to the final IP destination. The NIF sends the primitive received from the local M3UA to the MTP3 high-layer interface and routes to the signaling end point (SEP) or signaling transfer point (STP) of the SS7 network.
71
FIGURE 20 M3U A APPLIC ATION IN SGW
SEP/STP
SS7
SG
IP
MGC
TUP/ISUP MTP3 MTP2 L1 MTP3 MTP2 L1
NIF M3UA SCTP IP
TUP/ISUP M3UA SCTP IP
M3UA application between IPSPs In Figure 21, no signaling gateway is used and the SCCP message is exchanged directly between two IPSPs with SCCP user protocol, RANAP for example. Any MTP primitive from the M3UA to the SCCP should consider the SCTP association, lower-layer IP network, and status of the congestion message received from the remote.
FIGURE 21 M3U A APPLIC ATION BETWEEN IPSPS
IPSP
IP
IPSP
SCCP subscriber SCCP M3UA SCTP IP
SCCP subscriber SCCP M3UA SCTP IP
3. Related concepts Application server (AS)
72
It is the logic entity of routing key words specified for the service. AS contains a unique group of application server processes, one or several of which are activated processing services. Application server process (ASP) The process instance of the application server works as an AS activation or standby process. The ASP contains the SCTP endpoint and can be configured to process multiple AS signaling services. Association It refers to SCTP association and delivers the MTP3 user protocol data unit and the M3UA adaptation layer peer messages. IP server process (IPSP) It is a process instance based on IP application. In essence, the IPSP is the same as the ASP. However, the IPSP uses the end-toend M3UA rather than the signaling gateway services. Signaling gateway (SGW) The SGW receives or sends the SS7 high-layer user message at the borders of the IP network and the SS7 signaling network. As a signaling point in the SS7 signaling network, the SGW contains one or several signaling gateway processes, one or several of which are normally processing services. Signaling gateway process (SGP) The process instance of the signaling gateway works the signaling gateway activation, standby, or load sharing process. Routing key It describes a set of SS7 signaling parameters and parameter values. It defines uniquely signaling services processed by specific application servers. Parameters in the routing key cannot be based on multiple destination signaling point codes. Routing keys used in M3UA include DPC, SIO+DPC, SIO+DPC+OPC, and SIO+DPC+OPC+CIC. Routing context It identifies values of the routing keys uniquely. 4. Main functions of M3UA Provide the MTP3 user adaptation function and support transmission of all the messages of the MTP3 user part over the IP network. Support distributed IP-based signaling nodes. Support SCTP transmission connection management. Support seamless operations of the MTP3 user protocol peer layer. Support MTP3 network management. Support real-time observation of important data on the protocol layer. Protocol functions of M3UA are shown in Figure 22.
73
FIGURE 22 M3UA FUNCTION STRUCTURE
Signaling network management
AS management Message processing ASP management SCTP connection management LM
Address mapping
Primitive provision The M3UA provides the upper-layer application (users) with the invocation primitive that can be provided by the MTP3, for example the MTP-TRANSFER primitive. MTP3 message handling The SGW maps the message from the MTP into different SCTP streams and uses the address mapping function to send the message to the corresponding ASP; it assembles the message from the SCTP into the MTP3 user message and transfers it to the MTP. Distribute various management messages to the internal functional modules. The address mapping function implements translation between the ROUTE KEY and the ASP address and maintains the address mapping table. Manage ROUTE KEY registration of the ASP (optional). Local management function The M3UA provides lower-layer SCTP transmission protocol management to guarantee transmission of user messages. The M3UA also provides error indication to the upper-layer or the opposite end. Signaling network management The SGW processes signaling point reachability, congestion, and restart indications at the MTP side and sends corresponding indications to the related ASP. After receiving the signaling network management message from the peer M3UA, convert it into the corresponding primitive and inform the upper-layer users. Implement the transmission control function. SCTP connection management
74
Manage SCTP connection establishment and dismantlement, and management blocking and deblocking. SCTP connection under management includes connection between the SGW and the ASP, the SGWs, and ASPs. AS status maintenance Save the status of the AS connected and process the messages related to the AS status. ASP status maintenance Save the status of the ASP connected and implements ASP start, exit, activation, and inactivation. LM-layer management According to the local configuration, originate SCTP connection establishment, dismantlement, and blocking, and receive the ASP status message and the SCTP connection status message. Traffic control and congestion control 5. Format and types of M3UA message The M3UA consists of the public message head and zero or several variable length parameters following. The message format is shown in Figure 23.
FIGURE 23 M3U A MESSAGE FORM AT
1 Version Standby
16 Message category Message type
32 Public } message head
Message length Message tag Message length Parameter value
} Parameter data block 1
Message tag
Message length Parameter value } Parameter data block n
The public message head applies to all the signaling protocol adaptation layers, including the version, message class, message type, and message length. The version segment of the version currently supported is 0000 0001. Message length defines the octet length of the message. The message head is contained in the length. If the last parameter of the message includes the filler, the message length should include the filler message.
75
Table 23 lists defined message classes and Table 24 and Table 29 list message types defined by M3UA.
TABLE 23 M3UA MESSAGE CLASS
Message Class Management (MGMT) message Transmission message SS7 signaling network management (SNM) message ASP status maintenance (ASPSM) message ASP service maintenance (ASPTM) message Standby for other SIGTRAN adaptation layers Standby for other SIGTRAN adaptation layers Standby for other SIGTRAN adaptation layers Standby for other SIGTRAN adaptation layers Routing key management (RKM) message IETF standby Used for message type expansion defined by IETF
Message Class Code 00 01 02 03 04 05 06 07 08 09 0A-7F 80-FF
TABLE 24 M3U A MAN AGEMENT (MGMT) MESSAGE TYPE
Message Type Error (ERR) Notify (NTFY) IETF standby Standby for MGMT expansion defined by IETF
Message Type Code 00 01 02-7F 80-FF
TABLE 25 M3U A TR ANSMISSION MESSAGE TYPE
Message Type Standby Data (DATA) IETF standby Standby for transmission expansion defined by IETF
Message Type Code 00 01 02-7F 80-FF
76
TABLE 26 M3UA SIGNALING NETWORK MANAGEMENT (SSNM) MESSAGE TYPE
Message Type Standby Destination unavailable (DUNA) Destination available (DAVA) Destination Status Query (DAUD) SS7 signaling network congestion message (SCON) Destination users partially unavailable (DUPU) Destination restricted (DRST) IETF standby Standby for SSNM expansion defined by IETF
Message Type Code 00 01 02 03 04 05 06 07-7F 80-FF
TABLE 27 M3UA STATUS MAINTENANCE (ASPSM) MESSAGE TYPE
Message Type Standby ASP up (ASPUP) ASP down (ASPDN) Heartbeat (BEAT) ASP up acknowledge (ASPUP ACK) ASP down acknowledge (ASPDN ACK) Heartbeat acknowledge (BEAT Ack) IETF standby Standby for ASPSM expansion defined by IETF
Message Type Code 00 01 02 03 04 05 06 07-7F 80-FF
T A B L E 2 8 M 3 U A S E R V I C E M A I N T E N A N C E ( AS P T M ) M E S S A G E T Y P E
Message Type Standby ASP activation (ASPAC) ASP deactivation (ASPIA) ASP activation acknowledge (ASPAC ACK) ASP deactivation acknowledge (ASPIA ACK) IETF standby Standby for ASPTM expansion defined by IETF
Message Type Code 00 01 02 03 04 05-7F 80-FF
77
TABLE 29 M3U A ROUTING KEY M AN AGEMENT (RKM) MESSAGE TYPE
Message Type Standby Registration request (REG REQ) Registration response (REG RSP) Deregistration request (DEREG REQ) Deregistration response (DEREG RSP) IETF standby Standby for RKM expansion defined by IETF
Message Type Code 00 01 02 03 04 05-7F 80-FF
78
Chapter
Service Functions
Overview Basic Mobile Telecommunications Services Authentication service Functions of Supplementary Services Short Message Service Functions of mobile data services Functions of IN Services
Overview
The ZXC10 HLRE stores subscriber-related data and provides abundant telecom services and value-added services to subscribers: including: Service item information (Profile) Mobile Identification Number/International MS Identity (MIN/IMSI) Electron sequence number (ESN) Mobile Directory Number (MDN) MS approval data Telecom service data Data service data Intelligent Network (IN) service data Short message service data Service restriction (for example, roaming restriction) Supplementary service data Store the current position information of the home subscriber, including the MSCe address.
79
The ZXC10-HLRe, together with other functional entities such as the MSCe and SC in the CDMA mobile telecommunications system, implements related mobility management and calls processing services and handles the authentication service related to security management. Briefly, the ZXC10-HLR can provide the following services: basic mobile telecommunications service, authentication service, supplementary service, SMS service and IN services. Among them, the telecommunication services, authentication service and supplementary services are implemented by the ZXC10-MSCeand ZXC10-HLRe together. The SMS service is implemented by the ZXSC100, ZXC10-MSCe, ZXC10-HLRe and extended SMS entity. The IN services are implemented by the ZXC10MSC/VLR/SSP, ZXC10-SCP and ZXC10-HLRe.
Basic Mobile Telecommunications Services

Location Registration
1. Function description Due to the mobility of MSs, their locations are in constant changing status. To obtain the MSs location information during the processing of the call service, SMS and supplementary services, and to enhance the utilization of radio resources, the system requires that the MSs locations in the network be registered and the MSs activation statuses be reported, that is, location registration. The CDMA system supports the following nine registration types: i. Power-on registration: when an MS is powered on or switched from an analog system to the CDMA system, the MS initiates a registration.
ii. Power-off registration: if the MS has already registered in the current service system, the MS initiates registration when it is powered off. iii. Periodic registration: When the timer times out, the MS initiates a registration. iv. Distance-based registration: When the distance between the current MS and the MS of the last registration exceeds the threshold, the MS initiates a registration. v. Zone-based registration: When the MS enters a new registration zone, the MS initiates a registration. vi. Parameter-change-based registration: when the MS enters a new system or when the parameters stored in the MS are changed, the MS initiates a registration. vii. Request-based registration: The MS initiates a registration as requested by the BS.
80
Chapter 5 - Service Functions
viii. Implicit registration: When the MS sends a call initiation message or a paging response message successfully, the network can determine the location of the MS. This can be regarded as implicit registration. ix. Traffic channel registration: when the network obtains the registration information of the MS that has been assigned with a traffic channel, the network can inform the MS that it has registered. As described above, the location registration operation falls into multiple categories with somewhat different processing processes. The following is an example to describe the details of location registration implemented by the ZXC10-HLRe. When a subscriber conducts power-on registration in a new zone, MSCe in the visited zone initiates a registration to HLRe of the subscriber. If the subscriber has registered with MSCe in the visited area, the MSCe in the visited are is required to modify the location information of the subscriber instead of initiating registration to HLRe. The process of initiating the location registration operation to HLRe is shown in Figure 24.
FIGURE 24 LOCATION REGISTRATION PROCESS
VLR RegistrationNotification Invoke
HLRe
PVLR
a RegistrationCancellation Invoke RegistrationCancellation Response RegistrationNotification Response c d b
a. The VLR where MS is currently located initiates a location registration request to HLRe. The HLRe determines whether to allow this subscriber to register. If so, continue with next step; b. The HLRe returns the location deregistration request to the VLR (PVLR) where the MS is previously located. c. The PVLR responds to and then deletes the subscriber data, and returns the deregistration response. d. The HLRe returns the registration response to the VLR where the subscriber is currently located. 2. Implementation procedure The location registration function is to report the MS location (MSCID, VLRID, VLRIN) and MS status (activated or deactivated), and get the MS approval information (approval period) and subscribers service list (Profile).
81
Figure 25 shows the implementation procedure of the service subsystems registration message.
FIGURE 25 IMPLEMENTATION PROCEDURE OF HLRE REGISTRATION MESSAGE
Receive registration message from VLR
Subscriber subscribed? Y Subscriber roaming? N Write subscriber database to update subscriber location information Y Send registration cancellation message to the previous VLR
Retrieve service list and approval data
Return response to VLR
Call Processing
1. Function description Take the called party a MS as an example to describe the call processing. The home MSCe of the caller first finds the home HLRe of the called number, and requests the HLRe to provide the route information of the called number. The HLRe will ask the called subscribers VLR for a temporary local directory number (TLDN). VLR assigns one TLDN to the called subscriber, and then sends it to the callers MSCe, which then sets up a link with the TLDN. The HLRe processing flow is shown in Figure 26.
82
FIGURE 26 CALL PROCESSING FLOW
MSCe
HLRe
VLR
LocationRequest Invoke RoutingRequest Invoke RoutingRequest Response LocationRequest Response
a b c d
Implementation procedure: a. The calling MSC requests the HLRe for the routing information of the called MS. b. The HLRe requests the current VLR of the called MS to provide the called subscribers TLDN. c. The VLR responds to the request from the HLRe, and provides it with the TLDN of the called MS. The HLRe provides the requested routing information of the called MS to the originating MSCe. 2. Implementation procedure When the HLRe receives a location request message, it gets the call connection information of the called subscriber, and executes the callrelated supplementary services, including CFU, DND and getting the forwarded-to number. If the caller and the called belong to the same MSCe, the call connection information is directly returned. If the caller and the called belong to different MSCes, the HLRe will initiate the ROUTREQ message to the called VLR, and return the obtained TLDN to the calling the MSCe. The functions to be implemented include: i. Determining the subscribers access permission. When the subscriber is in the non-activated status such as delinquent and fraud, the access is denied.
ii. Getting the forwarded-to number when the CFU is activated. iii. Denying the access when the DND is activated. iv. Denying the access when the called subscriber is in the roaming status (outside the HLR) and has no roaming right. v. Getting the forwarded-to number when the MS is not registered or is in the deactivated status.
83
vi. Returning the response message directly when the caller and the called belong to the same MSCe. vii. Initiating the ROUTREQ, and returning the response message with the TLDN to the calling MSCe when the caller and the called belong to different MSCes. viii. Forwarding the CFB call when the called is busy and returning the obtained forwarded-to number to the MSCe.
VLR Restart Exception Handling

1. Function description The VLR may be faulty due to various causes. At this time, the VLR will notify all related the HLRes. The HLRe deletes the faulty VLR address, indicating the subscriber roaming in this VLR cannot receive incoming calls. It has to wait for the re-registration of the subscriber and restore the incoming call ability of the subscriber. The service processing flow of VLR restart is shown in Figure 27.
FIGURE 27 VLR RESTART FLOW
VLR
HLRe
BulkDeregistration Invoke
BulkDeregistration Response
a. The VLR sends the failure message to the HLRe. b. The HLRe responds with a message of successful operation to the VLR, and deletes the VLR address. 2. Implementation procedure Figure 28 shows the HLRe implementation procedure during VLR restart.
84
FIGURE 28 HLRE IMPLEMENTATION PROCEDURE DURING VLR RESTART
Receive great number of deletion messages
Clear current subscriber location information in VLR resetting
Data Synchronization
1. Function description When a subscribers subscription information in the HLRe is changed, it will initiate a synchronization message to keep the subscriber data in the VLR consistent with those in the HLRe. The service procedure is shown in Figure 29:
FIGURE 29 DATA SYNCHRONIZATION PROCESS
HLRe
QualificationDirective Invoke
VLR a
QualificationDirective Response
a. The HLRe initiates a QualificationDirective request to the VLR, and modifies subscriber data. b. The VLR returns a QualificationDirective response after successfully modifying subscriber data. 2. Implementation procedure Figure 30 shows the data synchronization implementation procedure. The following four kinds of QualificationDirective message: Approval period; Service list; parameters are included in the
Denial period and denial reason;
85
Approval period and service list.
FIGURE 30 IMPLEMENTATION PROCEDURE OF DAT A SYNCHRONIZATION BETWEEN HLRE AND VLR
Start
N Subscriber valid? Y Change approval period only? N Change service list only? N Y Y Y
Contained message parameters: Denial reason; Approval denial period
Contained message parameters: Approval period Send qualification instruction message to VLR
Contained message parameters: Service list
Change both service list and approval period?
Contained message parameters: Approval period; Service list
Data Deletion
1. Function description Data deletion means deletion of the subscriber records from VLR, including data deletion initiated by the HLRe and data deletion notice initiated by the VLR. i. In the case that the subscriber roams to a new VLR, the HLRe will initiate a data deletion operation to the original VLR to delete the subscriber data in the VLR after receiving a location registration message from the new VLR. The service flow is shown in Figure 31.
86
FIGURE 31 PROCEDURE OF HLRE-INITIATED DAT A DELETION
PVLR
HLRe
RegistrationCancellation Invoke
RegistrationCancellation Response
a. HLRe, after receiving the location registration request of VLR where MS is located, will initiate a RegistrationCancellation request operation to the VLR (PVLR) where MS is previously located so as to request PVLR to delete data of this subscriber; b. The PVLR deletes this subscribers data, and then sends a response message to the HLRe. ii. If the subscriber makes no operation for a long time (flexibly set by the system administrator, normally 24 hours) or if the system administrator requests to delete invalid subscriber records in the VLR through the maintenance and management function, the VLR will delete the data of this subscriber and notify the HLRe. The service procedure is shown in Figure 32.
FIGURE 32 PROCEDURE OF VLR-INITIATED DAT A DELETION
VLR
HLRe
MSInactive Invoke
MSInactive Response b
a. The serving VLR sends the MSINACT containing the registration cancellation type parameter to the MS-related HLRe, and deletes all records of the MS in its memory.
87
b. The HLRe cancels the registration of the MS (in other words, deleting the pointer point to the VLR), and sends a blank msinact to the serving the VLR to confirm the operation. 2. Implementation procedure The following example takes the MS Inactive operation to describe the implementation procedure of the HLRe, as shown in Figure 33. The RegistrationCancellation operation is similar.
FIGURE 33 MSINACTIVE OPERATION IMPLEMENTATION AT HLRE
HLR receives the MS Inactive operation request
Receive DEREG parameter? Y Set deactivation flag, and delete subscriberlocation information
Set deactivation flag
Authentication Service
Authentication service is one of the security management services for authenticating legality of the subscribers. Technically, radio transmission is more vulnerable to eavesdropping and deceit than fixed line transmission. But ZXC10-HLRe guarantees system security with multiple measures. Barring unauthorized MSs by means of authentication Protecting subscribers privacy through encryption.
Authentication Center (AUC)

The authentication center (AUC), provides the system with the data necessary for the subscriber authentication and protects air interfaces
88
from unauthorized use. In the ZXC10-HLRe system, the AUC and the HLRe share one physical entity to implement the following functions: Authentication data storing: It stores the mobile identification number/authentication key/shared secret data (MIN/A-Key/SSD) of each subscriber and the authentication algorithm CAVE. Subscriber authentication and generating subscriber encryption keys CDMAPLCM and SMEKEY. SSD update
Authentication Service
Authentication service is used to protect legal subscribers against the "intrusion" of illegal subscribers. During registration, each subscriber is allocated with a subscriber number, subscriber identification number (MIN), and ciphering key A_KEY. MIN and A_KEY are written into the subscribers mobile phone by means of air activation service or special equipment. By means of the SSD update, a shared secret data (SSD) parameter is generated in both the AUC and the users mobile phone for future authentication and encryption algorithm calculation. If the VLR visited supports the SSD sharing, this SSD is also saved in the VLR. The 128-bit SSD is divided into two parts, which are respectively used for 64-bit SSD_A for authentication calculation and the 64-bit SSD_B for encryption calculation. The VLR, AUC, or BSC sends the random number RAND to the MS, which uses the encryption key SSD_A stored internally and the authentication algorithm to get a result AUTH_MS, which is returned to the VLR or the AUC. The VLR or the AUC uses the encryption key SSD_A stored internally and the same authentication algorithm to get a result AUTH_NET. Compare AUTH_MS and AUTH_NET: If they are the same, the MS is legal; otherwise, the MS is illegal. Both the MS and the AUC have one encryption key, which is called A-Key. This encryption key is kept in MS and AUC only and is not transmitted in the network. The key is not directly used for authentication, but used to produce an SSD (128 Bits, divided into SSD_A 64 bits and SSD_B 64 bits) with a specific algorithm. The SSD generation algorithm is shown in authentication algorithm is shown in Figure 35. Figure 34 while the
89
FI G U R E 3 4 S SD GE N E R AT I O N AL G O R I T H M
RANDSSD 56
ESN 32
A-Key 64
SSD_Generation Procedure
SSD_A_NEW 64
SSD_B_NEW 64
FIGURE 35 AUTHENTICATION ALGORITHM
RAND 32
ESN 32
MIN1 24
SSD-A
Auth_Signature Procedure
AUTHR 18
There are the following two authentication modes in the CDMA system: 1. Mode 1: The AUC or VLR generates RAND, which is sent to the MS through the air interface to instruct the MS for authentication. The process is called unique query. 2. Mode 2: The BS generates RAND and transmits it to all MSs that spread to the BS through the broadcast channel. Any MS can conduct authentication calculation with the RAND. The authentication result produced and the RAND are sent to the VLR or AUC during access to the network for comparison of authentication information. During the authentication, the message flow in which the VLR requests the HLRe for authentication is shown in Figure 36.
90
FIGURE 36 VLR REQUEST FLOW FOR AUTHENTICATION
VLR AuthenticationRequest Invoke
HLRe
AuthenticationRequest Response
Implementation procedure: a. The VLR requests the HLRe for subscriber authentication. b. The HLRe sends an authentication response after authenticating the subscriber.
Implementation Procedure
The SSD is an authentication parameter stored in the AUC and the MS. For new subscribers, their SSDs are invalid because it is not initialized. Therefore, the SSD must be updated when the new subscriber accesses to the CDMA network. The SSD of the old subscriber has been updated successfully. So the authentication is generally successful. However, some illegal subscribers or network abnormities may lead to authentication failure. The AUC therefore must initiate the SSD update procedure. In the CDMA network, power-on authentication, caller authentication and called authentication are available and adopt the SSD sharing mode. a. The VLR initiates the AUTHREQ to the HLRe. b. If the AuthenticationCapability in the subscriber profile in the HLRe is 1 (which means no authentication required), a null authreq will be returned. c. If the AuthenticationCapability in the subscriber profile in the HLRe is 2 (which means authentication required), the authentication must be implemented. d. If the user authentication fails, the HLRe must be capable of initiating the SSD update, and carry the RandSSD, RandU and AuthU in authreq. If the VLR does not support the SSD update in this case, it must give the response: "SSD Update Not Attemp". e. If SSD update succeeds, the VLR sends the ASREPORT to the HLRe, with SSDUpdateReport=3 (indicating SSD Update successful). The HLRe returns the asreport that does not carry the SSD.
91
f. If SSD update fails, the VLR sends ASREPORT to the HLRe with SSDUpdateReport!=3. The HLRe returns the asreport carrying the SSD. g. If the VLR has no SSD, it will initiate the AUTHREQ to the HLRe; or if the VLR has the SSD, the authentication will be conducted in the VLR. h. If the authentication fails in the VLR, the VLR initiates the AFREPORT to the HLRe with ReportType=14 (AUTHR mismatch). i. The HLRe returns the afreport, which carries the RandSSD and RandU, and AuthU. j. The HLRe includes the RandSSD and RandU, and AuthU in authreq. k. If SSD update fails, the VLR sends ASREPORT to the HLRe with SSDUpdateReport!=3. The HLRe returns the asreport with DenyAccess=2 (SSD Update failure). In this case, the MSCe must release the traffic channel immediately and terminates the call.
Functions of Supplementary Services

Call Forwarding Supplementary Services
1. Call forwarding on busy (CFB) The service allows a subscriber to forward his/her incoming calls to a preset phone number or the voice mailbox when the subscriber is busy. 2. Call forwarding-no answer (CFNA) The service permits a subscriber to forward all his/her incoming calls to another preset phone number or to the voice mailbox under the following circumstances: i. The system fails to page the MS or the subscriber does not answer after being alerted for a long period of time.
ii. The subscriber is deactivated. iii. The system does not know the subscribers current location. iv. The subscriber cannot be accessed currently, such as deactivating the call deflection (CD) service or activating the do-not-disturb service. 3. Call forwarding-unconditional (CFU) The service allows a subscriber to forward all his/her incoming calls to a preset phone number or the voice mailbox. When the system executes the service to forward an incoming call, the subscribers mobile phone will receive a prompt tone. 4. Call forwarding default (CFD)
92
The service permits a subscriber to forward all his/her incoming calls to another preset phone number or to the voice mailbox under the following circumstances: i. The subscriber is busy. ii. The system fails to page the MS or the subscriber does not answer after being alerted for a long time. iii. The subscriber is deactivated. iv. The system does not know the subscribers current location. v. The subscriber cannot be accessed currently, such as deactivating the call deflection (CD) service or activating the do-not-disturb service. Functionally, CFD combines the functions of CFNR and CFB.
Call Barring Supplementary Services

1. Originating call restriction i. User password access (PIN access) This is a method of preventing mobile phone theft. When the service is activated, the mobile station is barred from any outgoing call or other service operations except the deactivation operation. The mobile station cannot be used until the service is deactivated. ii. User password interception (PIN interception) Once the service is activated, a specific call or service operation (for example, toll call) can be made only when the password is input. 2. Incoming call restriction i. Do not disturb (DND) Once the service is activated, the subscriber will refuse any incoming call. In the meantime, the system will no longer send the CF tone or the message waiting notification to the subscriber. ii. Password call acceptance (PCA) With the service, subscribers can selectively accept some calls and reject other calls. If the service is activated, the system will require the calling subscriber to provide a password during call connection. The call connection can proceed only after the calling subscriber enters the correct password, otherwise the call will be rejected or forwarded to the voice mailbox or another preset number. iii. Selective call acceptance (SCA) The service enables subscribers to selectively receive some calls while rejecting others. When the service is activated, subscribers enter a set of permitted caller numbers into the system. After receiving an incoming call, the system will compare it with the preset numbers. If it is not the same as the preset number, the call will be rejected or will be forwarded to the voice mailbox or a preset forwarded-to number.
93
Number Identification Supplementary Services

1. Calling number identification presentation (CNIP) The service provides the called with the callers identification information. The data includes the callers number and the callers name. When the system executes the CF service, the service will enable the called partys mobile station to display the caller data of the forwarded call. The destination mobile station of the forwarded call will display the caller data and the original called data. 2. Calling number identification restriction (CNIR) With the service, a calling subscriber can reject the presentation of his or her own subscriber data to the called subscriber. For the convenience of tracing malicious calls, no matter whether the service is used, the call establishment process in the CDMA system should include the caller data. The service only affects the transfer of the caller data over the air interface.
Other Supplementary Services

1. Call transfer (CT) During a two-party call, one of the subscribers can transfer the call to a third party and disconnect himself, so that the other subscriber can talk to the third subscriber. 2. Call deflection (CD) It describes the called capability of the subscriber after he leaves the home location. After the service is deactivated, neither the called capability of the subscriber at the home location nor the calling capability at/out of the home location will be affected. 3. Call waiting (CW) When a subscriber is busy, the service notifies the subscriber that there is a new incoming call, and the subscriber can choose to accept or reject the new call. If the subscriber answers the new incoming call, he can switch between the two calls. 4. Conference call (CC) The service enables conversation among multiple subscribers. A subscriber having applied for the service can convene a conference at anytime as the host. The host can add new members attending the conference by entering phone numbers one by one. 5. Message waiting notification The service uses a certain prompt tone to tell the subscriber that a voice mailbox message or short message is waiting to be received. 6. MS access hunting (MAH)
94
When an incoming call is received, the system alerts to multiple terminals according to the preset sequence (These terminals may include CDMA MSs, PSTN phone sets or MSs of other systems) until one of the terminals answers the call. 7. Preferred language (PL) The service is related to network services. It determines the language or code list used when the network plays an announcement or sends a short message. 8. Priority access and channel assignment (PACA) When the service is activated in the case of no idle traffic channel, the mobile station will be in the waiting state. When another subscriber releases a channel, the system will first assign the channel to the subscriber who has activated the service. 9. Remote feature control (RFC) The service enables users to make some service operations on other terminals (fixed telephones or other mobile phones). 10. 1Three-way calling (3WC) The service enables the telephone conversation among three parties. 11. Voice mail service (VMS) The service enables the subscriber to retrieve messages from the voice mailbox. In the CDMA system, this operation is defined as an independent service. Because the MS often gets voice messages from his/her mailbox with his/her own mobile station, an easy operation method is defined for implementing this function. In ANSI664 two methods are defined, one is that the subscriber dials his/her own mobile phone number and the other is that the subscriber dials a short number. 12. MS/AT dual-mode subscriber information management HLRe supports MS/AT dual-mode subscriber information management, and provides the following functions: HLRe can store MS/AT dual-mode subscriber information. HLRe can manage MS/AT dual-mode through agent / accounting system. HLRe can manage MS/AT dual-mode through agent / performance statistics. subscriber subscriber information information
HLRe can pass MS/AT dual-mode subscriber information to MSCe through the messages such as regnot, qualreq and QUALDIR. 13. Stolen MS alert management With this function, the system will log the details of registration location of stolen MS and alerts the operator. HLRe supports stolen MS alert management, and provides the following functions: The alert function can be enabled/disabled through security variables.
95
HLRe can send notification to background when it judges that the stolen MS has registered in the network. HLRe can carry and display the stolen MS information in the notification message. 14. Mobile hotline number management Mobile hotline number enables the system to switch all subscriber calls to a predefined number. HLRe supports hotline following functions: number management, and provides the
HLRe supports the store, management and statistics of hotline number management function authorization information. HLRe supports the flexible configuration of supplementary service code for hotline number management. HLRe supports subscribers management on hotline number through supplementary service code operation (FEATREQ). 15. Password call restriction (PCR) The subscriber can restrict call services by password, such as toll call and services of other local mobile networks. 16. Anonymous call rejection (ACR) When a call with the presentation indicator set to "Restricted" is made to a user with the ACR service active, the call will be rejected and rerouted to an appropriate treatment. The number of the calling party will not be shown to the ACR subscriber. 17. CFU notification With this function enabled, when CFU occurs, the subscriber will be informed by receiving a notification tone.
Short Message Service

The ZXC10-HLRe, in coordination with the MC, the MSCe and the extended SM entity, provides the SMS to terminal subscribers.
Mobile-Originated Short Message (MO SM)

The short message center may deliver a short message submitted by the SME to the CDMA mobile station. The originating SME can be either the visitor MSCe or the home SC of the MS that originates the short messages. The signaling flow of mobile stations receiving short messages is as shown in Figure 37.
96
FIGURE 37 SIGNALING PROCEDURE OF MO SM
SC SMSRequest Invoke
HLRe
MSCe
a SMSRequest Response b SMSDeliveryPointToPoint Invoke c SMSDeliveryPointToPoint Response d
Implementation procedure: a. The SC receives an SMDPP request to send the SMS to the MS. If the SC does not know the current temporary address of the SMS or the MS status, it sends the SMSRequest to the HLRe to request for the SME address. b. The HLRe returns a response, which includes the temporary SMS routing address of the served MS. c. The destination SC forwards the SMSDeliveryPointToPoint to the destination SME by using the SMEs temporary routing address. d. The MSCe returns a response to the SC.
Short Message Notification

However, in practice, it is possible that short messages can not temporarily be received due to the MS unreachable, the MS short of storage space or other reasons. If the SC fails to send short messages to the MS, the SC will use different re-sending mechanisms depending on the settings of the SC. 1. Forced resend If the current MS is not reachable or has no available storage space, the SC will re-send the short messages of higher priority. 2. Timed resend This will save the failing short messages into the scheduled sending queue, and the SC will resend the messages when the scheduled resend time arrives. 3. Prompted resend When the SC is prompted that the MS is reachable or has free space, it will attempt to resend the short message to that MS. When the HLRe detects that the CDMA MSs ability to receive short messages has changed, it will notify the home SC of this MS of such a change. The signaling procedure is shown in Figure 38:
97
FIGURE 38 SIGNALING PROCEDURE OF SM NOTIFICATION
HLRe
SC
SMSNotification Invoke
SMSNotification Response
Implementation procedure: a. When the MS registers with the system, the HLRe can send the SMS notification message (SMSNotification) to the home SC of the MS according to the REGNOT message content and the SM delivery result. b. The SC returns a response, acknowledging the receiving of the SMS notification message.
Implementation Procedure of the SM Address Request

Below is the implementation procedure of the SM address request: 1. If the subscriber is not authorized with the SMS service or the mobile phone is illegal, a response message will be sent to the SC with the SMS_AccessDeniedReason = Denied. 2. If the current location information of the mobile station exists in the HLRe but is inactive, the HLRe initiates the SMSRequest message request SMS_ADDR to the VLR. 3. If the MS is not registered and the SC does not require a notification, Unavailable will be returned; otherwise, the SC SMS_AccessDeniedReason Postponed will be returned and the HLRe will be assigned the SMDPF flag. 4. If the SMS is authorized, the MS will be valid, the location information and the SMS_ADDR exist, and the mobile phone is activated, and the SMS_ADDR is returned.
Mobile Data Service Functions

The ZXC10 HLRe supports the packet data service and the circuit-type data service. The circuit-type data service is implemented through using
98
IWF at the BSC; while the packet data service is implemented through cooperation with the PDSN.
Functions of IN Services
Pre-Paid Charging (PPC) Service
The PPS (Pre-Paid Service) is a typical service featured in paying in advance and enjoying service afterwards When a subscriber subscribes to the PPC service, the network operator assigns a unique account corresponding to the subscriber number. All call costs of the PPC service will be deducted from this account. Once the balance in the account is insufficient or overdue, the network will deny the service for the subscriber until the subscriber recharges this account. In addition, the service sets the maximum monthly or daily limit for the subscriber, to ensure the economic benefits of this subscriber. Taking advantages of the real-time call control and quick charging functions of the mobile IN network, the PPC service can effectively control the economic loss of the network operator caused by defaulting subscribers and malicious overdraft, reduce the business risks while enhancing the normal business benefits, and reap considerable call profits for the network operator. With reasonable charging policies, more and more subscribers will be attracted and the network utilization rate will be improved, thus bringing more benefits to the network operator.
Wireless Virtual Private Network (WVPN) Service

Wireless virtual private network (WVPN) is a dedicated network provided by the service provider for the customers using the public network resources. It has two meanings: 1. It is a virtual network without fixed physical connections, and it is established only when required by subscribers. 2. It is a private network constructed with public network facilities. Such a network has many advantages of both public networks and private networks, integrating the performance reliability and abundant functions of public networks with the flexibility and high efficiency of private networks. The WVPN enables customers to link dynamically their organizations scattered in different regions by utilizing the public network resources, as shown in Figure 39. The implementation of the WVPN can bring benefits to mobile network operators, mobile telecommunication customers and the utlitmate users.
99
FIGURE 39 SCHEM ATIC DIAGRAM OF WVPN NETWORK
Sales Dept.
ZTE headquarters database
On-line customer
ZTE's subsidiaries
WVPN
Business partner Mobile working staff
i.
For mobile network operators: By making full use of the WVPN, they can enhance their own competitiveness, improve the network utilization, and implement operation, administration and maintenance in the whole network.
ii. For mobile telecommunication customers: On one hand, they can share new telecommunication technologies and services with the mobile telecommunication department by utilizing the public network resources without needing network management and maintenance; on the other hand, they have their own private numbering plans, dialing modes, route control and accounting lists, and can seamlessly integrate their existing private network and the WVPN. iii. For end users: On one hand, they can take advantages of the public network and private network resources; on the other hand, they can enjoy the tariff discount when using the WVPN. The WVPN has powerful service functions, such as the on-net calls, off-net calls, remote mobile telecommunication, authentication code, override restriction, CUG service, call forwarding, account code call, off-net call barring, on-net call barring, abbreviated dialing, routing by time and attendant functions.
FreePhone Service (FPS)

FPS refers to the service in which the call charge is paid by the called subscriber instead of the caller. In general, the freephone service has the following three functions: 1. Password access function: After dialing the free-phone user number, the caller must dial the correct password before the call can be put through. The password is composed of 4 to 6 digits, which can be modified according to the subscribers requirement. 2. Time-based number selection: The subscriber who has subscribed to the freephone service can receive incoming calls based on different
100
dates and time. If the called subscriber does not provide the service within a specific period or on certain days, the system will play an announcement to the calling subscribers using the FPH service. 3. CFB or CFNA function: The subscriber who has subscribed to the freephone service can preset several telephone numbers as required. When one of the numbers is busy or does not reply after a long time, the system will forward the call to another preset telephone number. Figure 40 illustrates the simple flow chart of the FPH service.
FIGURE 40 SIMPLE PROCEDURE OF THE FPH SERVICE
Number check
Not matched Play announcement
Number translation
Connect principal called
Customer number in a free phone
Real called number Return point 2
Start point
Return point 1 Basic call processing
101
102
Chapter
Networking Modes and System Configuration

ZXC10 HLRe networking modes ZXC10 HLRe system configuration
Networking Modes
HLRe networking falls into two types: external SGW and built-in SGW. 1. External SGW In case of external SGW, the HLRe provides IP interfaces. The networking is shown in Figure 41.
FIGURE 41 HLRE NETWORKING-EXTERNAL SGW
MGW 14 over IP MC 14 HLRe
SCPe 14 over IP 14 MAP TIA/EIA41 14 over IP MSCe
Legend: Signaling stream
103
2. Built-in SGW In case of built-in SGW, the HLRe provides E1 and IP interfaces. The networking is shown in Figure 42.
FIGURE 42 HLRE NETWORKING-BUILT-IN SGW
MGW 14 over IP MC 14
E1
SCPe 14 over IP 14 HLRe 14 over IP MAP TIA/EIA41
E1 E1
MSCe
Legend: Signaling stream
System Configuration
Only the BCTC frame in the HLRe is used. The configuration principle is: A single BCTC frame works as an exchange, while multiple BCTC frames make a large-capacity HLRe. Table 30 lists the processing capability and configuration principle of each board.
TABLE 30 PROCESSING CAPABILITY OF BOARDS
Logic Board OMP SMP CLKG
Configuration Description One pair of active/standby OMP and RPU modules for one system Configuration in pairs according to the capacity One pair for one system
Processing Capability Description Fixed in slot 11/12 400,000 subscribers/pair, limit slot 17 Fixed in slot 13/14
104
Chapter 6 - Networking Modes and System Configuration
Logic Board
Configuration Description
Processing Capability Description 6464K Link/board, 0.4erl/Link, 8000 subscribers/Link;
SPB
According to the capacity
42M Link/board, 0.2erl/Link, 128000 subscribers/Link Cannot be inserted into slot 9/10 and slot 13 ~ 17
USI
One pair for one system Used for IP signaling network connection, one pair for 1 ~ 3 000 000 subscribers, and two pairs for 3 000 000 ~ 6 000 000 subscribers. One pair for one subsystem Optional, used for connection of control plane with more than three frames
Cannot be inserted into slot 9/10 and slot 13 ~ 17 Cannot be inserted into slot 9/10 and slot 13 ~ 17 Fixed in slot 9/10 Connected to 24 frames at most, fixed in slot 15/16
SIPI
UIMC CHUB
Note: Configuration of the front PC is simple: except the optional CHUB and the SMP and SPB configured according to the capacity, other boards are in fixed configuration and can be put into one frame.
The following are configuration principles of the HLRe with built-in SGW, a capacity of less than 6 million subscribers, and one HLRe network element: 1. Configure one pair of OMP, one pair of SIPI, one pair of USI, and one pair of CLKG for one system. 2. Configure quantity of SMPs and SPBs according to the subscriber capacity and traffic model. 3. A single BCTC frame can work as an exchange. As the number of subscribers increases, add BCTC frames when boards SMP and SPB are added. Configure one pair of UIMC for each BCTC. 4. When at least four BCTC frames work as an exchange, another pair of CHUB boards should be added to the same frame where the OMP is placed in the system. The following are four types of typical configuration: 800,000 subscribers (basic configuration), 2.4 million subscribers, 4 million subscribers, and 6 million subscribers.
Configuration for Capacity of 800,000 Subscribers

One BCTC frame works as an exchange, supporting 800,000 mobile subscribers. The card layout is shown in Figure 43.
105
FIGURE 43 CARD LAYOUT (800,000 SUBSCRIBERS)
1 Front plug-in card Rear plug-in card
10
11
12
13
14
15
16
17
S I P S
S I P S
U S I
U S I
S P B
S S P M B P
S M P
U I M C
U I M C
O M P
O M P
C L K G
C L K G
S M P
S M P
R M N I C
R M N I C
R M N I C
R M N I C
R S P B
R S P B
R U I M 2
R U I M 3
R M P B
R M P B
R C K G 1
R C K G 2
Configuration description: 1. Use the fixed configuration of the OMP, UIMC, CLKG, SIPI, and USI; one pair each for one system. 2. The exchange has both E1 and IP interfaces. According to the processing capability of the SPB board shown in Table 30, one pair of SPB boards is required for 800,000 subscribers. 3. If the exchange has IP interfaces only, the SMP may be inserted into slot 5/6. A frame supports 1.2 million IP subscribers at most. 4. According to the processing capability of the SMP board shown in Table 30, two pairs of SMP boards are required for 800,000 subscribers. 5. When the BCTC frame is fully configured, it supports 800,000 subscribers when having both E1 and IP interfaces, and supports 1.2 million subscribers when having IP interfaces only (slot 5 and 6 are not configured with SPB, but SMP).
Configuration for Capacity of 2 Million Subscribers

To support two million mobile subscribers, two BCTC frames work as an exchange. Card layout is shown in Figure 44.
106
FIGURE 44 CARD LAYOUT (2 MILLION SUBSCRIBERS)
BCTC frame 1 1 Front plug-in card Rear plug-in card Front plug-in card Rear plug-in card 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S I P S
S I P S
U S I
U S I
S P B
S S P M B P
S M P
U I M C
U I M C
O M P
O M P
C L K G
C L K G
S M P
S M P
R M N I C
R M N I C
R M N I C
R M N I C
R S P B
R S P B
R U I M 2
R U I M 3
R M P B
R M P B
R C K G 1
R C K G 2
BCTC frame 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S M P
S M P
S P B
S S P M B P
S M P
U I M C
U I M C
S P B
S M P
S M P
R S P B
R S P B
R U I M 2
R U I M 3
R S P B
Configuration description: 1. Use the fixed configuration of the OMP, UIMC, CLKG, SIPI, and USI; one pair each for one system, fixed in the BCTC1 frame. 2. The exchange has both E1 and IP interfaces. According to the processing capability of the SPB board shown in Table 30, five SPB boards are required for 2 million subscribers, inserted respectively into slot 5/6 in the BCTC1 frame and slot 5/6 and 11 in the BCTC2 frame. 3. According to the processing capability of the SMP board shown in Table 30, five pairs of SMP boards are required for 2 million subscribers, inserted respectively into slot 7/8, 15/16 in the BCTC1 frame and slot 1/2, 7/8, 15/16 in the BCTC2 frame.
107
4. The BCTC1 frame supports 800,000 subscribers, and the BCTC2 frame supports 1.2 million subscribers. 5. If one pair of SMP boards is added to slot 3/4 in the BCTC2 frame and one SPB board is added to slot 12, the BCTC2 frame reaches full capacity, supporting 1.6 million subscribers. The BCTC2 and BCTC1 frames together support 2.4 million subscribers.

Three BCTC frames work as an exchange to support four million mobile subscribers. Card layout is shown in the following figure.
BCTC frame 1 1 Front plug-in card Rear plug-in card Front plug-in card Rear plug-in card 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S I P S
S I P S
U S I
U S I
S P B
S S P M B P
S M P
U I M C
U I M C
O M P
O M P
C L K G
C L K G
S M P
S M P
R M N I C
R M N I C
R M N I C
R M N I C
R S P B
R S P B
R U I M 2
R U I M 3
R M P B
R M P B
R C K G 1
R C K G 2
BCTC frame 2/3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S M P
S M P
S M P
S M P
S P B
S S P M B P
S M P
U I M C
U I M C
S P B
S P B
S M P
S M P
R S P B
R S P B
R U I M 2
R U I M 3
R S P B
R S P B
108
Configuration description: 1. Fixed configuration of the OMP, UIMC, CLKG, SIPI, and USI; one pair each for one system, fixed in the BCTC1 frame. 2. The exchange has both E1 and IP interfaces. According to the processing capability of the SPB board shown in Table 30, five pairs of SPB boards are required for 4 million subscribers, inserted respectively into slot 5/6 in BCTC1 frame, slot 5/6 and 11/12 in BCTC2 frame, and slot 5/6 and 11/12 in BCTC3 frame. 3. According to the processing capability of the SMP board shown in Table 30, ten pairs of SMP boards are required for 4 million subscribers, inserted respectively into slot 7/8 and 15/16 in BCTC1 frame; slot 1/2, 3/4, 7/8, and 15/16 in BCTC2 frame; slot 1/2, 3/4, 7/8, and 15/16 in BCTC3 frame. 4. The single BCTC1 frame supports 800,000 subscribers. Configuration of the BCTC2 frame is completely the same as that of the BCTC3 frame, single BCTC2/3 supporting 1.6 million subscribers.

Five BCTC frames work as an exchange to support 6 million mobile subscribers. They occupies two racks. Card layout is shown in Figure 46.
109
BCTC frame 1 1 Front plug-in card Rear plug-in card Front plug-in card Rear plug-in card 1 Front plug-in card Rear plug-in card 2 3 4 S M P S M P 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S I P S
S I P S
U S I
U S I
S P B
S M P
S M P
U I M C
U I M C
O M P
O M P
C L K G
C L K G
C H U B
C H U B
R M N I C
R M N I C
R M N I C
R M N I C
R S P B
R U I M 2
R U I M 3
R M P B
R M P B
R C K G 1
R C K G 2
R C H B 1
R C H B 2
BCTC frame 2/3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
S M P
S S M M P P
S M P
S P B
S S P M B P
S M P
U I M C
U I M C
S P B
S P B
S M P
S M P
R S P B
R S P B
R U I M 2
R U I M 3
R S P B
R S P B
BCTC frame 4/5 5 6 7 8 9 10 11 12 13 14 15 16 17
S P B
S S P M B P
S M P
U I M C
U I M C
S P B
S M P
S M P
R S P B
R S P B
R U I M 2
R U I M 3
R S P B
110
Configuration description: 1. Fixed configuration of the OMP, UIMC, CLKG, SIPI, and USI; one pair each for one system, fixed in the BCTC1 frame. As five BCTC frames work together, one pair of CHUB boards should be configured and fixed in slot 15/16 in BCTC1 frame. 2. The exchange has both E1 and IP interfaces. According to the processing capability of the SPB board shown in Table 30, 15 SPB boards are required for 6 million subscribers, inserted respectively into slot 5 in BCTC1 frame, slot 5/6 and 11/12 in BCTC2/3 frame, and slot 5/6 and 11/12 in BCTC4/5 frame. 3. According to the processing capability of the SMP board shown in Table 30, 15 pairs of SMP boards are required for 6 million subscribers, inserted respectively into slot 7/8 in BCTC1 frame; slot 1/2, 3/4, 7/8, and 15/16 in BCTC2/3 frame; and slot 1/2, 3/4, 7/8, and 15/16 in BCTC4/5 frame. 4. The BCTC1 frame supports 400,000 subscribers. Configuration of BCTC2 frame is the same as that of BCTC3 frame. The BCTC2 or BCTC3 supports 1.6 million subscribers. Configuration of BCTC4 frame is the same as that of BCTC5 frame. The BCTC4 or BCTC5 frame supports 1.2 million subscribers.
111
112
Index
Application server ............25, 72, 73 Cable ........................................51 Clock Performance
Clock running mode................42

Data
Performance management ......28 Performance statistics .............39

Power supply...................42, 43, 47 Probe ........................................67 Server
Data synchronization ........85, 86

Dynamic data management ..........39 Heartbeat .......................68, 69, 77 IP address ........... 34, 37, 53, 65, 68 M3UA .64, 70, 71, 72, 73, 74, 75, 76, 77, 78 MAC address ........................ 34, 37 Maintenance console ...................25 MP ............................................37 MTP ....20, 38, 52, 59, 60, 62, 72, 74 MTP3...30, 56, 57, 59, 64, 71, 73, 74
Database server.......................25 OMC server ............................30

Signaling
Signaling tracing...............28, 39
Supplementary service......26, 39, 79 System architecture .............. 23, 24 Version management...................28 WVPN................................ 99, 100
113
114
Abbreviations
Abbreviation Full Name
1X EV 1X EV-DO 1X EV-DV 3G 3GPP2 AAA APGW API ATM BCSN BCTC BER BPSN BS BSC BSS BTS BUSN
CACH
1X Evolution 1X Evolution Data Only 1X Evolution Data & Voice The third generation mobile communications 3rd Generation Partnership Project 2 Access, Authorization, and Accounting Access Point Gateway Application Programming Interface Asynchronous Transfer Mode Backplane of Circuit Switch Network Backplane of ConTtrol Center Bit Error Ratio Backplane of Packet Switch Network Base Station Base Station Controller Base Station System Base Transceiver Station Backplane of Universal Switch Network
Common Assignment Channel
CAS
CBC
Channel Associated Signaling

Cell broadcast center
CCS
CDMA CF CFB CFBI CFD CFNA CFNRc CFNRy CFU CKCD CLKG CNIP
Common Channel Signaling

Code Division Multiple Access all Call Forwarding services Call Forward Busy Central Fiber Bus Interface Call Forward Default Call Forward No Answer Call Forward No Reachable Call Forward No Reply Call Forward Unconditional Central Clock and Communication Driver CLOCK Generator Call Number Identification Presentation
115
Abbreviation
Full Name
CNIR CP CPM CPSN CRC CSM DTB DTI DTU ESME FDMA FEP FN FPGA FTAM FTP GIF GMSCe GPRS GSM GT GUI HDLC HDM HLRe HTML HTTP HW I/O IMSI IPI IRM ISDN ISO ISUP ISUP IWF kbps LMSD MC MDN MGW
Call Number Identification Restriction Content Provider Common Signaling Process Module Central Power Switching Network Cyclic redundancy check Centre Switch Module Digital Trunk Board Digital Trunk Interface Digital Trunk Unit External Short Message Entity Frequency Division Multiple Access Front-End Processor Fleet Number Field Programmable Gate Array File transfer access management File Transfer Protocol Graphics Interchange Format Gateway MSCe General Packet Radio Service Global System for Mobile communications Global Title Graphical User Interface High level data link control HLR Data processing Module Home Location Register emulator Hyper Text Makeup Language Hypertext Transfer Protocol High speed data Way Input/Output International Mobile Subscriber Identity IP bearer Interface International Roaming MIN Integrated Service Digital Network International Standardization Organization ISDN User Part ISDN User Protocol InterWorking Function kilo-bits per second
Legacy Mobile Station Domain

Message Center Mobile Data Number
Media Gateway
116
Abbreviations
Abbreviation
Full Name
MIN MNC MNIC MPB MS MSCe MSID MSS MTP MTP1 MTP2 MTP3 NGN NMC NMS OMC OMM OTA PDA PDN PDSN PDSS PN PPP PPPoE PSN PSPDN PSTN PTT PWRD RADIUS RAID SC SCCP SCP SCPe SDH SDTB SGW SID SIPI SME
Mobile Station Identify Number Mobile Network Code Multi-service Network Interface Card Main Processing Board Mobile Station Mobile Switching Center emulator Mobile Station Identifier Mobile Switching System Message Transfer Part Message Transfer Part-layer 1 Message Transfer Part-layer 2 Message Transfer Part-layer 3 Next Generation Network Network Management Center Network Management Subsystem Operations & Maintenance Center Operation Maintenance Module Over The Air Personal Digital Assistant Packet Data Network Packet Data Serving Node Packet Data Switching System Personal Number Point to Point Protocol Point to Point Protocol over Ethernet Packet Switch Network Packet Switched Public Data Network Public Switched Telephone Network Push-To-Talk POWER Distributor Remote Authentication Dial In User Service Redundant Array of Independent Disks Short message Center Signaling connection control part Service control point Service Control Point emulator Synchronous Digital Hierarchy SONET Digital Trunk Board
Signaling Gateway
system Identify Signaling IP bearer Interface Short Message Entity
117
Abbreviation
Full Name
SMG SMPP SMS SMTP SNM SNMP SOAP SP SPB STM TDMA TLDN UBC UIM VMSCe VPN WAP WDP WDSS WIN WVPN
Short Message Gateway Short Message Peer-to-Peer protocol Short Message Service Simple Message Transfer Protocol Service Network Module Simple Network Management Protocol Simple Object Access Protocol Service Provider Signaling Processing Board Synchronous Transfer Mode Time Division Multiple Access Temporary Location Digital Number all-User BroadCast User Identity Module Visited MSCe Virtual Private Network Wireless Application Protocol Wireless Datagram Protocol Wireless Data Services System Wireless Intelligent Network Wireless Virtual Private Network
118
Figures
Figure 1 Diagram of CDMA Network Evolution ................................................16 Figure 2 Basic Network Architecture of LMSD of STEP2 ....................................19 Figure 3 Overall System Architecture of ZXC10 HLRe......................................24 Figure 4 Hardware Structure of ZXC10 HLRe .................................................29 Figure 5 Global Clock Topology ....................................................................31 Figure 6 Overall Software Architecture of ZXC10 HLRe....................................32 Figure 7 Service Objects of Database Subsystem ............................................35 Figure 8 Accounting Interface ......................................................................53 Figure 9 Network Management Interface Protocol ...........................................55 Figure 10 SS7 Signaling Hierarchy ................................................................55 Figure 11 MTP3 Structure ............................................................................57 Figure 12 SCCP Structure Model ...................................................................59 Figure 13 SIGTRAN Structure.......................................................................64 Figure 14 SIGTRAN Stack Protocol ................................................................65 Figure 15 Hierarchical Model of SCTP Application ............................................66 Figure 16 Functional Structure of SCTP..........................................................66 Figure 17 SCTP Packet Format .....................................................................68 Figure 18 SCTP Flow Sample........................................................................70 Figure 19 Structure of M3UA Protocol System.................................................71 Figure 20 M3UA Application in SGW ..............................................................72 Figure 21 M3UA Application Between IPSPs....................................................72 Figure 22 M3UA Function Structure...............................................................74 Figure 23 M3UA Message Format..................................................................75 Figure 24 Location Registration Process.........................................................81 Figure 25 Implementation Procedure of HLRe Registration Message...................82 Figure 26 Call Processing Flow .....................................................................83 Figure 27 VLR Restart Flow..........................................................................84 Figure 28 HLRe Implementation Procedure during VLR Restart..........................85 Figure 29 Data Synchronization Process ........................................................85 Figure 30 Implementation Procedure of Data Synchronization Between HLRe and VLR ..................................................................................................86 Figure 31 Procedure of HLRe-Initiated Data Deletion .......................................87 Figure 32 Procedure of VLR-Initiated Data Deletion .........................................87 Figure 33 MSInactive Operation Implementation at HLRe .................................88 Figure 34 SSD Generation Algorithm.............................................................90 Figure 35 Authentication Algorithm ...............................................................90 Figure 36 VLR Request Flow for Authentication ...............................................91 Figure 37 Signaling Procedure of MO SM........................................................97 Figure 38 Signaling Procedure of SM Notification.............................................98 Figure 39 Schematic Diagram of WVPN Network ........................................... 100 Figure 40 Simple Procedure of the FPH Service............................................. 101 Figure 41 HLRe Networking-External SGW ...................................................103 Figure 42 HLRe Networking-Built-in SGW..................................................... 104 Figure 43 Card Layout (800,000 Subscribers)............................................... 106 Figure 44 Card Layout (2 Million Subscribers)...............................................107 Figure 45 Card Layout (4 Million Subscribers)...............................................108 Figure 46 Card Layout (6 Million Subscribers)...............................................110
119
120
Tables
Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table Table 1 Typographical Conventions ................................................................xi 2 Mouse Operation Conventions ............................................................xi 3 Safety Signs................................................................................... xii 4 Subscriber Database Contents ..........................................................36 5 ZXC10 HLRe Capacity Indices ..........................................................41 6 Synchronous Clock Indices of ZXC10 HLRe ........................................42 7 Reliability Indices of ZXC10 HLRe .....................................................42 8 Service Cabinet Indices....................................................................42 9 Server Cabinet Indices.....................................................................43 10 Alarm Box Indices .........................................................................43 11 Plug-in Box and Board Indices.........................................................43 12 Indices of Each Cooling Fan in Service Cabinet ..................................44 13 ZXC10 HLRe Temperature and Humidity Requirements ......................44 14 DC Power Indices ..........................................................................47 15 Internal Communication Unit Indices................................................48 16 SS7 Signaling Processing Unit Indices ..............................................48 17 IP Signaling Processing Unit Indices .................................................49 18 Signaling Processing Module Indices.................................................49 19 Service Processing Module Indices ...................................................49 20 Monitoring Indices .........................................................................50 21 Standard and Type of Cable Suitable for Each Interface of HLRe...........51 22 Chunk Type Code ..........................................................................68 23 M3UA Message Class .....................................................................76 24 M3UA Management (MGMT) Message Type .......................................76 25 M3UA Transmission Message Type ...................................................76 26 M3UA Signaling Network Management (SSNM) Message Type ..............77 27 M3UA Status Maintenance (ASPSM) Message Type .............................77 28 M3UA Service Maintenance (ASPTM) Message Type ............................77 29 M3UA Routing Key Management (RKM) Message Type ........................78 30 Processing Capability of Boards .....................................................104
121

ZXC10 HLRe (V3 (1) .00.30) Technical Description

Încărcat de

Informații document

Descriere originală:

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

ZXC10 HLRe (V3 (1) .00.30) Technical Description

Încărcat de

Drepturi de autor:

Formate disponibile

ZXC10 HLRe

cdma2000 Home Location Register emulator

This Class A digital apparatus complies with Canadian ICES-003.

ZTE CORPORATION Values Your Comments & Suggestions!

This page is intentionally blank.

Vision of the All-IP Core Network............................................................................ 21

Hardware Structure .............................................................................................. 28

Software Structure ............................................................................................... 31

Mechanical and Electrical Indices............................................................................ 42

Unit/Module Indices .............................................................................................. 48

Authentication Service .......................................................................................... 88

Functions of Supplementary Services ..................................................................... 92

Short Message Service.......................................................................................... 96

Mobile Data Service Functions................................................................................ 98 Functions of IN Services ........................................................................................ 99

Chapter 6.................................................................................... 103

Networking Modes .............................................................................................. 103 System Configuration.......................................................................................... 104

About this Technical Description

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

Purpose of this Technical Description

Confidential and Proprietary Information of ZTE CORPORATION

About this Technical Description

CAPS Constant width [] {} |

Mouse Operation Conventions

Typeface Click Double-click Right-click Drag

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

TABLE 3 S AFETY SIGNS

Erosion: Beware of erosion.

No flammables: No flammables can be stored.

No touching: Do not touch.

No smoking: Smoking is forbidden.

Confidential and Proprietary Information of ZTE CORPORATION

About this Technical Description

How to Get in Touch

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

This page is intentionally blank.

Confidential and Proprietary Information of ZTE CORPORATION

Evolution of the CDMA Network to the All-IP Network

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

FIGURE 1 DIAGRAM OF CDM A NETWORK EVOLUTION

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 1 - Basic Knowledge

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 1 - Basic Knowledge

FIGURE 2 BASIC NETWORK ARCHITECTURE OF LMSD OF STEP2

MSCe AAA Media Gateway zz

yy cdma2000Access Network BTS BSC/RNC + PCF MM ( FA /

Media Resource Function Processor xx 41 43 Mobile IP Home Agent

Media Gateway 39 34 40 IP Network

Legacy MS Domain Support HLRe MSCe SCPe 13 PSTN

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 1 - Basic Knowledge

Vision of the All-IP Core Network

Confidential and Proprietary Information of ZTE CORPORATION

ZXC10 HLRe cdma2000 Home Location Register emulator Technical Description