Sjzl20060120-ZXWN SGSN (V3.0) Technical Manual

ZXW10 3G Mobile Communication WCDMA System
ZXWN SGSN
Serving GPRS Support Node
Technical Manual
Version 3.0
ZTE CORPORATION ZTE Plaza, Keji Road South, Hi-Tech Industrial Park, Nanshan District, Shenzhen, P. R. China 518057 Tel: (86) 755 26771900 800-9830-9830 Fax: (86) 755 26772236 URL: http://support.zte.com.cn E-mail: doc@zte.com.cn
LEGAL INFORMATION Copyright 2005 ZTE CORPORATION. The contents of this document are protected by copyright laws and international treaties. Any reproduction or distribution of this document or any portion of this document, in any form by any means, without the prior written consent of ZTE CORPORATION is prohibited. Additionally, the contents of this document are protected by contractual confidentiality obligations. All company, brand and product names are trade or service marks, or registered trade or service marks, of ZTE CORPORATION or of their respective owners. This document is provided as is, and all express, implied, or statutory warranties, representations or conditions are disclaimed, including without limitation any implied warranty of merchantability, fitness for a particular purpose, title or noninfringement. ZTE CORPORATION and its licensors shall not be liable for damages resulting from the use of or reliance on the information contained herein. ZTE CORPORATION or its licensors may have current or pending intellectual property rights or applications covering the subject matter of this document. Except as expressly provided in any written license between ZTE CORPORATION and its licensee, the user of this document shall not acquire any license to the subject matter herein. The contents of this document and all policies of ZTE CORPORATION, including without limitation policies related to support or training are subject to change without notice.
Revision History Date 28/02/2006 Revision No. R1.0 Serial No. sjzl20060120 Description
ZTE CORPORATION Values Your Comments & Suggestions!

Your opinion is of great value and will help us improve the quality of our product documentation and offer better services to our customers. Please fax to: (86) 755-26772236; or mail to Publications R&D Department, ZTE CORPORATION, ZTE Plaza, A Wing, Keji Road South, Hi-Tech Industrial Park, Shenzhen, P. R. China 518057. Thank you for your cooperation!
Document Name Product Version ZXWN SGSN Serving GPRS Support Node Technical Manual V3.0 Document Revision Number R1.0
Equipment Installation Date Presentation: (Introductions, Procedures, Illustrations, Completeness, Level of Detail, Organization, Appearance) Good Your evaluation of this documentation Fair Average Poor Bad N/A
Accessibility: (Contents, Index, Headings, Numbering, Glossary) Good Fair Average Poor Bad N/A
Intelligibility: (Language, Vocabulary, Readability & Clarity, Technical Accuracy, Content) Good Fair Average Poor Bad N/A Please check the suggestions which you feel can improve this documentation: Improve the overview/introduction Improve the Contents Improve the organization Your suggestions for improvement of this documentation Include more figures Other suggestions ___________________________________________________________________________ ___________________________________________________________________________ ___________________________________________________________________________ ___________________________________________________________________________ ___________________________________________________________________________ # Please feel free to write any comments on an attached sheet. If you wish to be contacted regarding your comments, please complete the following: Name Postcode Telephone Company Address E-mail Make it more concise/brief Add more step-by-step procedures/tutorials Add more troubleshooting information Make it less technical Add more examples Improve the index
Add more/better quick reference aids Add more detail
Contents
About this Technical Manual....................................................................vii
Purpose of this Technical Manual.............................................................................vii Typographical Conventions.....................................................................................vii Mouse Operation Conventions................................................................................viii Safety Signs.......................................................................................................... ix How to Get in Touch ............................................................................................... x
Customer Support...................................................................................................................x Documentation Support...........................................................................................................x
Chapter
1................................................................................... 11
Fundamentals.......................................................................................... 11
Overview of WCDMA............................................................................................. 12 DNA Distributed Network Architecture .................................................................... 12 Position of SGSN in WCDMA .................................................................................. 14
Chapter
2................................................................................... 17
System Architecture................................................................................ 17
Overview ............................................................................................................. 18
Background ..........................................................................................................................18 Standards Compliance...........................................................................................................18 Main Functions ......................................................................................................................21
Hardware Structure .............................................................................................. 22

Hardware Architecture Diagram .............................................................................................22 Signalling Processing Procedures............................................................................................24
Software Architecture............................................................................................ 26
BSP driving subsystem ..........................................................................................................27 Operating system subsystem.................................................................................................28 System control subsystem.....................................................................................................29 Database subsystem .............................................................................................................30 Bearing subsystem................................................................................................................32 Micro-code subsystem ...........................................................................................................32
PP Board Subsystem .............................................................................................................33 Signaling Subsystem .............................................................................................................33 Service subsystem ................................................................................................................33 Network Management Subsystem..........................................................................................34
System Features .................................................................................................. 36
Chapter
3................................................................................... 37
Technical Indices..................................................................................... 37
System Indices..................................................................................................... 38
Physical Performance.............................................................................................................38 Equipment Power ..................................................................................................................40 Environment Conditions.........................................................................................................41 Interface Indices ...................................................................................................................42 Capacity Indices....................................................................................................................42 Clock Indices.........................................................................................................................43 Reliability Indices...................................................................................................................44
Component Indices............................................................................................... 44
Signaling Processing Module Indices.......................................................................................44 Power Module Indices............................................................................................................45 Internal Communications Module Indices................................................................................45 Charging Module Performance Indices....................................................................................45 Monitoring Module Indices .....................................................................................................46 Fan Unit Indices ....................................................................................................................46 Board Power Consumption Indices .........................................................................................47
Chapter
4................................................................................... 49
Interface and Communication ................................................................ 49

Overview ............................................................................................................. 50 Interfaces ............................................................................................................ 50
Gn/Gp Interface ....................................................................................................................50 Iu-PS Interface......................................................................................................................50 Gb interface ..........................................................................................................................53 Gr Interface ..........................................................................................................................54 Ga Interface..........................................................................................................................54 Gd Interface..........................................................................................................................55 Gs Interface ..........................................................................................................................56 NM Interface .........................................................................................................................56
Signaling System.................................................................................................. 57
ATM Interface Protocol...........................................................................................................57 Narrowband SS7...................................................................................................................59
ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual
Broadband SS7 .....................................................................................................................78 MAP Interface (Mobile Application Part) ..................................................................................84 GTP Protocol .........................................................................................................................91 GTP Protocol.........................................................................................................................95
Chapter
5................................................................................... 97
Service Functions .................................................................................... 97

Overview ............................................................................................................. 98 Introduction to Service Functions ........................................................................... 98
Mobility Management ............................................................................................................98 Session Management Function.............................................................................................114 Packet Route Transmission Function.....................................................................................125 SMS Function......................................................................................................................125 Service Procedure ...............................................................................................................125
Chapter
6................................................................................. 129
Networking Mode and System Configuration ...................................... 129

Networking Mode................................................................................................ 130 System Configuration.......................................................................................... 131 Cases ................................................................................................................ 134
Appendix
A .............................................................................. 137 B .............................................................................. 139
Traffic Model.......................................................................................... 137
Appendix
Glossary ................................................................................................. 139
Figures........................................................................................ 145 Tables ......................................................................................... 147
Confidential and Proprietary Information of ZTE CORPORATION
About this Technical Manual

The ZXW10 system is a 3G mobile communication system developed based on the WCDMA technology. The ZXW10 system features a more powerful capability of service processing in both the Circuit Switched (CS) domain and Packet Switched (PS) domain, and provides a wider variety of services. Compared with GSM, the ZXW10 provides a larger range of telecom services, capable of providing such multimedia services as the transmission of voice, data and images, and featuring a higher rate and higher resource utilization. The ZXW10 Core Network (ZXWN) supports access of both 2G and 3G end users, and provides all kinds of services related to the 3G core network. The ZXWN SGSN (V3.0) supports mobility management, packet routing and transmission, access control, SMS and CAMEL. It is fully compatible with the 3GPP R4 (June 2003) and downward with the 3GPP R99 (June 2002). The ZXWN SGSN has a powerful processing capacity, and provides various communication interfaces. It offers a full range of service functions, features flexible networking modes, and supports the networking mode of the 3GPP R99. In addition, it supports the input function of the Gb interface. Apart from the applications in building common mobile packetbased networks, the ZXWN SGSN meets the needs in building SS7 networks and mobile intelligent networks. Therefore, the ZXWN SGSN can be used in various complex networking conditions for mobile switching networks, for enhanced sustainable development of the networks.
Purpose of this Technical Manual

The purpose of this manual is to help operators fully understand the principles, service functions and networking of the ZXMN SGSN products. The manual is applicable to the ZXMN SGSN products, and to the technical and maintenance personnel that have familiarize themselves with the principles of mobile network communications.
Typographical Conventions
ZTE documents employ with the following typographical conventions.
vii
TABLE 1 TYPOGRAPHICAL CONVENTIONS
Typeface
Meaning References to other guides and documents. Links on screens. Menus, menu options, function names, input fields, radio button names, check boxes, drop-down lists, dialog box names, window names. Keys on the keyboard and buttons on screens and company name. Text that you type, program code, files and directory names, and function names. Optional parameters Mandatory parameters Select one of the parameters that are delimited by it Note: Provides additional information about a certain topic. Checkpoint: Indicates that a particular step needs to be checked before proceeding further. Tip: Indicates a suggestion or hint to make things easier or more productive for the reader.
Italics
Quotes Bold
CAPS Constant width [] {} |
Mouse Operation Conventions

TABLE 2 MOUSE OPERATION CONVENTIONS
Typeface Click Double-click Right-click Drag
Meaning Refers to clicking the primary mouse button (usually the left mouse button) once. Refers to quickly clicking the primary mouse button (usually the left mouse button) twice. Refers to clicking the secondary mouse button (usually the right mouse button) once. Refers to pressing and holding a mouse button and moving the mouse.
viii
About this Technical Manual
Safety Signs
TABLE 3 SAFETY SIGNS
Safety Signs
Meaning Danger: Indicates an imminently hazardous situation, which if not avoided, will result in death or serious injury. This signal word should be limited to only extreme situations. Warning: Indicates a potentially hazardous situation, which if not avoided, could result in death or serious injury. Caution: Indicates a potentially hazardous situation, which if not avoided, could result in minor or moderate injury. It may also be used to alert against unsafe practices.
Erosion: Beware of erosion.
Electric shock: There is a risk of electric shock. Electrostatic: The device may be sensitive to static electricity.
Microwave: Beware of strong electromagnetic field. Laser: Beware of strong laser beam.
No flammables: No flammables can be stored.
No touching: Do not touch.
No smoking: Smoking is forbidden.
ix
How to Get in Touch

The following sections provide information on how to obtain support for the documentation and the software.
Customer Support
If you have problems, questions, comments, or suggestions regarding your product, contact us by e-mail at support@zte.com.cn. You can also call our customer support center at (86) 755 26771900 and (86) 8009830-9830.
Documentation Support
ZTE welcomes your comments and suggestions on the quality and usefulness of this document. For further questions, comments, or suggestions on the documentation, you can contact us by e-mail at doc@zte.com.cn; or you can fax your comments and suggestions to (86) 755 26772236. You can also explore our website at http://support.zte.com.cn, which contains various interesting subjects like documentation, knowledge base, forum and service request.
Chapter
Fundamentals
In this chapter, you will learn about:
Overview of WCDMA development process of WCDMA Distinctive features of WCDMA
11
Overview of WCDMA
With the speedy development of wireless communication application and the wide application of data services, the current GSM system cannot fully satisfy the needs of customers for wireless multi-media communication. In this background, the third-generation mobile communication technology occurs, and WCDMA is its representative. Compared wit the current GSM, WCDMA has a most distinctive new feature higher data transmission bit rate: 384kbps for circuit switching and 2Mbps for packet switching. In particular, the 2M transmission rate is far higher than the 114kbps of GSM for the transmission of GPRS. Some new services, for example, videophone, video on demand (VOD), and rapid data download, that cannot be applied previously on GSM can now be widely applied. Compared with the current GSM and other mobile networks, UMTS has the following new features: 1. It allows negotiation for the features of wireless bearer and defines the attributes of transmission, such as the possible throughput, delay, and data error ratio. 2. It supports different application types with different QoS requirements. 3. UMTS bearer has a universal feature, and can provide good support for the existing applications and the future new applications. 4. The network resources of UMTS can be reserved for each terminal user, which makes the long awaiting requirement of always online of the terminal users come true.
DNA Distributed Network Architecture

The WCDMA network structure is shown in Figure 1:
12
Chapter 1 - Fundamentals
FIGURE 1 WCDMA NETWORKING STRUCTURE

PSTN PSTN PSTN Gi Gp
CSMGW
Mc
GMSC server
C
GGSN
Gc
Nc PSTN Nb
HLR
AuC
Gr
Gn
D G F
EIR
Gf Gs
VLR
B
E Nc
VLR
B
SGSN
MSC server
Mc
MSC server
Mc
CN CS-MGW
Nb A Gb IuCS IuPS
CS-MGW
BSS BSC
Abis
RNS
Iur
RNC
Iub
RNC
BTS Um
BTS
Node B
cell
Node B
Uu ME
SIM-ME i/f or Cu
SIM
USIM
MS
The WCDMA packet network structure consists of two independent NEs: SGSN and GGSN. SGSN implements the following functions: 1. Network access control 2. Packet route and transmission 3. Mobility management 4. Logic link management (in the case that Gb access is provided) 5. Radio resources management 6. Network management
13
GGSN is gateway of mobile network and the Internet, implementing the following functions: 1. Routing: Implement route searching between the mobile station and the network. 2. Security control: Protect the security of the mobile network. 3. Interface: Provide various interfaces for the interworking with the packet network. 4. Network access control 5. Network management
Position of SGSN in WCDMA

Interfaces between the ZXWN SGSN and other functional entities are as shown in Figure 2:
FIGURE 2 NETWORKING STRUCTURE OF THE WCDMA PACKET DOMAIN
Other
The description of the interfaces is as follows:
14
Chapter 1 - Fundamentals
1. Iu interface: Connecting to the RNC, implementing the communication function with RNC. 2. Gn/Gp interface: Connecting to the GSN node, including SGSN and SGSN, SGSN and GGSN, adopting the GTP protocol. Gn interface is between the GSN nodes within PLMN, and Gp interface is between the GSN node of one PLMN and the GSN node of other PLMN. 3. Gr interface: Connecting to the HLR, adopting SS7 for communication. 4. Gs interface: Connecting to MSC Server and VLR, a standard SS7 interface. 5. Ga interface: Connecting to the charging gateways (CGs), adopting the GTP protocol. 6. Gd interface: Connecting the SMSs, implementing the processing function of GPRS SMS. 7. Ge interface: Connecting CAMEL SCFs, adopting SS7. 8. Gf interface: Connecting EIRs.
9. Gb interface: Connecting BSCs, implementing the GPRS access function.
15
Chapter
System Architecture
In this chapter, you will learn about: The system architecture of ZXWN SGSN The system architecture of the ZXWN SGSN adopts the same hardware and software platforms as other NEs, such as MSC Server, MGW, and GGSN, featuring large system capacity, flexible networking, and convenient upgrade.
17
Overview
The main functions of the SGSN are as follows: 1. Implement the mobile station mobility management function. 2. Form a packet NE with GGSN to implement the packet services on WCDMA.
Background
Compared with GSM network, WCDMA network has an important feature, which is the provisioning of high-speed data services. This feature develops through adopting the packet data communication technology and taking the advantage of IP network. The objective of sharing the Internet network resources any time anywhere is achieved. Though the GPRS technology on GSM network can provide packet data services, GSM is a second-generation technology with a lot of constraints (for example, low radio utilization ratio, slow speed, and sharing conflict with circuit domain resources). The max. speed it can reach in theory is 171.2Kbps. In practical application, the downlink speed is only 40.2kbps. Its inability to satisfy the needs of customers leads to the adoption of new technologies to provide faster speed. The PS domain of WCDMA network can reach currently 2Mbps for data services when the mobile station is static. When it is in motion, the data service speed can reach 384kbps. The increase of data service speed is attributed to the use of more advanced radio technology. In addition, the core network side protocol is optimized to raise the core network speed. SGSN is one of the major nodes to implement the PS domain functions of the core network. The ZXWN system adopts the all IP uniform platform of ZTE. The platform is a uniform next generation core network platform adopted by ZTE to fully raise the market competitiveness. On the all IP uniform platform, NEs of different functions are formed with different combination of boards and functional software programs. The upgrade of NEs requires the hardware change of boards and the upgrade of software. The platform can be applied to all 3G WCDMA, CDMA2000, and TD-CDMA core network equipment and RNC/BSC equipment, and at the same time, can be applied to NGN SS/TG/AG equipment and the upgrade of 2G equipment.
Standards Compliance
The ZXWN SGSN complies with the following standards: 1. GSM01.04: Digits cellular telecommunications system (Phase 2+); Abbreviations and acronyms 2. GSM 01.61: Digital cellular telecommunications system (Phase 2+); GPRS ciphering algorithm requirements
18
Chapter 2 - System Architecture
3. 3G TS22.060: General description; Stage 1
Packet
Radio
Service
(GPRS);
Service
4. 3G TS23.003: Numbering, addressing and identification 5. 3G TS23.007: Restoration procedures 6. 3G TS23.015 Technical Barring realization of Operator Determined
7. 3G TS23.016: Subscriber Data Management; Stage 2 8. GSM 03.20: Digital cellular telecommunications system (Phase 2+); Security related network functions 9. GSM 03.22: Functions related to Mobile Station (MS) in idle mode and group receive mode 10. 3G TS23.122: Non Access Stratum functions related to Mobile Station (MS) in idle mode 11. 3G TS23.040: Technical realization of the Short Message Service (SMS); Point-to-Point (PP) 12. GPPTS 23.060: General Packet Radio Service (GPRS); Service Description; Stage2 13. 3G TS23.078: Customized Applications for Mobile Network Enhanced Logic (CAMEL) Phase 3 Stage 2 14. GSM 03.64: Digital cellular telecommunications system (Phase 2+); Overall description of the General Packet Radio Service (GPRS) Radio interface; Stage 2 15. 3G TS24.007: Mobile radio interface signalling layer 3; General aspects 16. 3G TS24.008: Mobile radio interface layer 3 specification; Core Network Protocols Stage 3 17. GSM 04.60: Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Mobile Station (MS) Base Station System (BSS) interface; Radio Link Control / Medium Access Control (RLC/MAC) protocol 18. GSM 04.64: Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Mobile Station Serving GPRS Support Node (MS SGSN) Logical Link Control (LLC) layer specification 19. GSM 04.65: Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Mobile Station (MS) Serving GPRS Support Node (SGSN); Subnetwork Dependent Convergence Protocol (SNDCP)
19
20. GSM 05.08: Digital cellular telecommunications system (Phase 2+); Radio subsystem link control 21. 3G TS27.060: General Packet Radio Service (GPRS); Mobile Station (MS) supporting GPRS 22. GSM 08.08: "Digital cellular telecommunications system (Phase 2+); Mobile Switching Centre Base Station System (MSC BSS) interface: Layer 3 specification 23. GSM 08.14: Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN) interface; Gb interface layer 1 24. GSM 08.16: "Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN) interface; Network Service". 25. GSM 08.18: Digital cellular telecommunications system (Phase 2+); General Packet Radio Service (GPRS); Base Station System (BSS) Serving GPRS Support Node (SGSN); BSS GPRS Protocol (BSSGP) 26. GSM 08.60: Digital cellular telecommunications system (Phase 2+); Inband control of remote transcoders and rate adaptors for Enhanced Full Rate (EFR) and full rate traffic channels 27. 3G TS29.002: Mobile Application Part (MAP) specification 28. 3G TS 29.016: General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) Visitors Location Register (VLR); Gs interface network service specification 29. 3G TS29.018: General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) Visitors Location Register (VLR); Gs interface layer 3 specification 30. 3G TS29.060: General Packet Radio Service (GPRS); GPRS Tunneling Protocol (GTP) across the Gn and Gp Interface 31. 3G TS29.061: General Packet Radio Service (GPRS); Interworking between the Public Land Mobile Network (PLMN) supporting GPRS and Packet Data Networks (PDN) 32. 3G TS29.078: 3rd Generation Partnership Project; Customized Applications for Mobile Network Enhanced Logic (CAMEL) Phase 3; CAMEL Application Part (CAP) Specification 33. GSM 11.11: Digital cellular telecommunications system 2+);Specification of the Subscriber Identity Module Equipment (SIM ME) interface 34. 3G TS 23.121: Architectural Requirements for Release 1999 35. 3G TS 23.107: Quality of Service, Concept and Architecture (Phase Mobile
20
36. ITU-T Recommendation I.361: B ISDN ATM Layer Specification 37. 3G TS33.102: Security Architecture 38. 3G TS23.171: Functional stage 2 description of location services in UMTS 39. ITU-T Recommendation I.363.5: B-ISDN ATM Adaptation Layer Specification: Type 5 AAL 40. 3G TS 32.015: GSM call and event data for the packet switched domain 41. CCITT Recommendations I.130 General modelling methods Method for the characterisation of telecommunication services supported by an ISDN and network capabilities of an ISDN
Main Functions
The ZXWN SGSN provides the following functions: 1. Network access control: SGSN acquires the user subscription information through the interaction with HLR, and controls the access of the user into the packet network though authentication. 2. Packet routing and transmission: SGSN provides route searching function to search for the IP address information of GGSN, RNC, and others, and provides routing function for the uplink and downlink datagram. 3. Mobility management: Implements location-related functions of the mobile station such as Attach, route update, paging, and relocating. This is one of the principal functions of SGSN. 4. Logic link management (Gb access available): This function is available when SGSN provides the Gb interface. It implements the management, backup, and load sharing of the link between PCUs on BSC. 5. Radio resource management: Implements with RNC and BSC the management of radio resources, such as flow control. 6. Network management: Implements such management functions as configuration of SGSN, performance analysis, and control of radio network. With the consideration of the application prospect of the current UMTS services, the ZXWN SGSN adopts on the SGSN core network side the 3GPP R4 protocol for implementation. In this way, the standard requirement of the 3GPP is achieved, and in the downward direction, the 3GPP R99 version and the GSM GPRS protocol version are compatible.
21
Hardware Structure
ZXWN SGSN hardware design is based on the ZTE whole-IP hardware platform. Its characteristics are as follows: 1. Interior whole-IP switch technology. 2. Adopts standard interior interfaces and is convenient for upgradation. 3. Adopts modular and standard design, taking into consideration repeatability and compatibility. Multiple boards can use same board to reduce the complication of maintenance. 4. Takes into consideration technological advancement, adaptability and expansion. 5. Backward compatible with traditional wireless networks.
Hardware Architecture Diagram

The SGSN hardware architecture is shown in Figure 3.
FIGURE 3 SGSN STRUCTURE
BSC
SGBP
SGLP SIUP UIMP
to IP network GSN node STM-1 ATM(RNC) L1 Switching Frame GLI
SGSP
SGUP GE Resource Frame GLI PSN GLI
UIMC
SMP SS7 CHUB SPB RPU CG UIMC OMP USI User Service Flux Control and Signal Flux
Control Frame
SGSN combines control, L1 switching and resource frames. Each frame adopts respective backplane and combination of different function boards in frames is used to support the smooth capacity expansion and 2.5G and 3G access. Therefore it is suitable for large capacity networking.
22
Control frame adopts BCTC. As the system capacity and performance requires, multiple frame hierarchy can be grouped into distributed processing platform. One frame is main that connects with UIMC in other control frame with CHUB to realize the control plane data flux convergence and processing. Function boards configured in control frame are as follows: OMP: mainly completes system control, maintenance and NM protocol processing. RPU: mainly processes route protocols (RIPv2OSPFv2 and BGP4) and route table distribution. SMP: it processes MTP3 and above layers of narrow and broad bands, and GMM/SM/GTP-C packet signal protocols. As for Gb access, it completes BSSGP and LLC signal-related parts. SPB: processes MTP2 and below layers in No7. USI: provides interface between SGSN and CG. CHUB: completes control plane flux convergence of control, resource and first grade switch frames as the convergence center. UIMC: provides Ethernet channel and realizes the hierarchy connection with CHUB. L1 switching frame adopts BPSN and serves as the SGSN core switch subsystem. It realizes the user plane data flux convergence and switching of all resource frame. The function boards are as follows: GLI: provides GE packet data interface between first grade switch and resource frame. PSN: completes packet data switch among GLIs. UIMC: provides Ethernet channel, realizes the Ethernet connection between user and control plane and provides Ethernet control plane data interface with distributed processing platform. Resource frame adopts BUSN and provides exterior SGSN interfaces. It completes multiple access processing bottom-layer related and user plane protocol processing. The function boards are as follows: SIUP: realizes the adaptation of ATM STM-1 access and AAL5, provides broadband SSCOP and SSCF processing. SGUP: completes Iu-PS interface GTP-U protocol processing and is responsible for establishment, modification and deletion of user plane GTP channels. After the establishment of user plane channels, SGSN GTP-U is in charge of RNC and GGSN two-way data transference. SGBP: realizes Gb interface FR access, completes FR and NS layer processing. SGSP:completes Gb interface BSSGP, LLC, SNDCP, GTP-U protocols processing of user plane. SGLP: provides IP interfaces to outside, completes Gn/Gp interface signaling and data access, message classification and data forward function to interior user plane processing boards.
23
UIMP: completes Ethernet second grade switch interior source frame and resource frame management, provides packet data interface GE which connects with first grade switch and control plane data Ethernet interface which connects with the distributed processing platform. Single resource frame is enough for small capacity networking as shown in Figure 4.
FIGURE 4 SGSN NETWORKING (SMALL CAPACITY CONFIGURATION)
BSC RNC
SGBP
SGLP
To IP Network GSN node
SIUP SS7 SPB
SGSP UIMP SGUP
OMP RPU Resource Frame user service flux control and signal flux
OMP and SMP are incorporated in one. OMP provides interface for CG, realizes 2.5G and 3G access at the same time.
Signalling Processing Procedures

SGSN realizes the user plane data and control plane signal separation of Iu-PS, Gb and Gn/Gp interfaces. 3G signalling processing procedures are shown in Figure 5.
24
FIGURE 5 3G SIGNALLING PROCESSING PROCEDURES
SGUP
RNC SIUP SGLP
GSN
SMP
User Plane Data Control Plane Signal
Upwardly, SIUP provides access for Iu-PS interface user plane data and control plane signal, terminates ATM cell, realizes mixture SAR for AAL2 and AAL5 and separates data and signal packet. As for control plane signal, SIUP processes broadband SSCOP and SSCF sublayer and gets MTP3 messages. The MTP3 messages are sent to SMP for further processing which includes MTP3B, SSCP, RANAP, SMP and RANAP-above servicerelated control signals such as GMM, SM and SMS. Thereafter, the messages are packed in to GTP-C cells which are sent to SGLP. SGLP send GTP-C cells to exterior GSN. While user plane GTP-U data are forwarded to user plane processing board SGUP according to user plane IP. After SGUP performs flux measurement and charging, it looks for route table and sends the data to SGLP. SGLP sends the data to exterior GSN. Downwardly, SGLP sends GTP-C signal cells to SMP for processing. After further processing and encapsulation by SIUP, GTP-C cells was sent to RNC. While SGLP sends GTP-C data cells to SGUP according to Gn user plane address for processing. After further processing, encapsulation and route-searching by SGUP, proper SIUP board is selected. SIUP sends GTPU cells to RNC after processing. 2.5G signalling processing procedure is shown in Figure 6.
25
FIGURE 6 2.5G SIGNALLING PROCESSING PROCEDURE
SGSP
BSC SGBP SGLP
GSN
SMP
User Plane Data Control Plane Signal
Upwardly, SGBP provides access for Gb interface, processes FR and NS layer, pre-processes BSSGP and LLC layer, separates control plane signal and user plane data. For control plane signal, SGBP sends them to SMP for BSSGP and LLC processing. LLC above service-related control plane ,such as GMM, SM and SMS are also processed by SMP. After that the signals are sent to SGLP after GTP-C encapsulation, then SGLP send GTP-C cell to exterior GSN. For user plane data, SGBP sends them to SGSP for BSSGP, LLC, SNDCP protocol processing. After getting the data packet and GTP-U encapsulation, SGSP will search route table and send them to SGLP. Then SGLP sends the data packet to exterior GSN. Downwardly, SGLP sends GTP-C signal packets to SMP for encapsulation and processing. After NS and FR processing by SGBP, the processed packets are sent to BSC. As for GTP-U data packets, SGLP will send them to SGSP according to user plane address for de-encapsulation, processing, and re-encapsulation. Thereafter, the processed packets will be sent to corresponding SGBP for NS and FR processing. At last the processed packets will be sent to BSC.
Software Architecture
SGSN software design principles conform to the idea of modularization and layerization. Inter-layer communicates through primitives while intra-layer communicates through messages or function. Inter-layer and inter-module interfaces are clearly defined for further maintenance and upgrade. ZXWN SGSN software structure is shown in Figure 7.
26
FIGURE 7 SOFTWARE STRUCTURE
Network Management Subsystem

System Control subsystem Database Subsystem
Service Subsystem Signaling Subsystem

Bearer Subsystem Microcode Subsystem PP Board Subsystem
Operating System Subsystem BSP Driving Subsystem Hardware Platform

ZXWN SGSN software includes BSP driving, operation, system control, database, bearing, micro-code, PP board, signaling, service and NM subsystems. BSP driving subsystem completes hardware driving function of the whole system. Operation subsystem provides a virtual operation environment for all of other modules. System control subsystem is in charge of monitoring, start and version download of the whole subsystem. Database subsystem manages all resources, signal, service, protocol configuration and provides database interfaces for other subsystems. Bearing subsystem supports the service layer function and system interior communication. Micro-code subsystem completes media channel user plane data classification, processing and forward. PP board provides communication, clock management, environment monitor and power management functions. Signalling subsystem completes protocol processing, message realtime transference and signalling network management. Service management processes protocol basing on the call to service of other modules and completes all service processing. NM subsystem provides configuration, fault, performance, topology, security and log management.
BSP driving subsystem

BSP driving subsystem is based on SGSN hardware platform. It realizes hardware driving for the whole system, abstracts hardware function, provides function call interfaces for upper layer software modules which realizes such functions by call. Thereafter, BSP provides only hardware
27
logical function for software module and masks the detailed procedures on hardware from the upper software modules.
Operating system subsystem

Operating system subsystem is based on BSP drive subsystem. It provides application platform for upper layer and stable efficient reliable service. Operating system subsystem divides into schedule and memory management, process communication, file system, abnormal processing, device and timing management, virtual operation system according to functions. Operating system subsystem structure is shown in Figure 8.
FIGURE 8 OPERATING SYSTEM SUBSYSTEM STRUCTURE
System Control
Upper Layer Application
Schedule Manageme nt
Memory Manageme nt
Process Commucin ation
File System
Abnormal Processing
Device Manageme nt
Timing Manageme nt
Virtual Operation System Business Operation System( VxWorks)

1. Schedule Management Schedule management module is based on VxWorks to realize second schedule on process. It supports establishing, finishing, and delaying process, provides program debugging, query in current process ID, type, information and related data types, realizes the real time monitor. 2. Memory Management Memory management completes memory protection mechanism to prevent memory fragments, monitors and prevents memory-related problems, such as out-of border visit, repeat release and memory leakage, provides interfaces for dynamic application and memory space releasing. 3. Process Communication Process communication module is based on multi-processor interior communication mechanism. It supports intra-processor message broadcasting, inter-processor messages group broadcasting and provides different processes for similar and different tasks in same CPU. It slso provides inter-processor communication function in different
28
CPU and provides message reserve, dispatch, query, supports active and standby communication, and switchover. 4. File System File system provides I/O interfaces for upper-layer application and is used for file copy, rename, directory management (including display, create, delete, directory changing) and other typical file management interface. According to different operation characteristic, file system allows diversified numbers for file operation, and provides statistics and measurement for fault location. It provides operation-systemindependent and configurable memory. When the operation system restarts, the memory data is not overwritten and then the vital data will be protected when system is down. It also serves as FTP servers for direct operation for background on foreground and hard disc files. 5. Abnormal Processing When system needs abnormal ,this function preserves detailed information of the spot through the abnormal information what bottom operation system intercepts, locates abnormal points in function-level, analyzes retrospectively on the process stacks and abnormal tasks. After getting the function prior to the abnormality, it provides interface for automatic recovery. 6. Device Management Device management provides device (such as serial port, and network port) interfaces for upper application program. If the upper application needs to operate peripherals supported by BSP, calling interface function supported by BSP is not requested. Uniform interface of operation system provides a uniform operation on peripheral. 7. Timing Management Timing management completes software clock and timer, supports relative, absolute, cycle and parametered timer. Therefore, it provides time and zone view, sets interfaces and synchronizes according to system clock of BSP. 8. Virtual Operation System(VOS) VOS encapsulates VxWorks, which mainly includes task control, message queuing , signal volume operation, virtual memory ,clock and socket management and providing business real time operationindependent system calling for operation system.
System control subsystem

System control subsystem controls system loading process, monitors running status, reflects real time state, completes resource management according to the system status ,and guarantees that the system runs smoothly. System control subsystem includes modules as follows: 1. Boot Module Boot module completes board starting, version downloading and checking, and supports board test and function debugging.
29
2. Main Control Module Main control module completes active/standby board competition, system initiation, board basic information requirement, processing power-on control, switchover control, indicator lights control and active/standby ports management. 3. Real Time Status Checking Module Real time status checking modules monitors intra-board process and peripheral running status, such as GE/FE, E1 and DSP status. The checking results are reported to status management module to process and carry out operation of obstruction and de-obstruction when needed. 4. Status Management Module Status management module includes management center and agent. During system power-on, management center initiates the status table according to board configuration data in database. When system runs smoothly, management center updates the configuration data according to database. It also collects online board information , obstructs and de-obstructs relative resource when needed to protect the resource correctness in database. When board or resource status changes, relative alarm/recovery messages will be send to OMC so that background can get the board running status in foreground. It also serves as agent between status management and database to query and send board configuration data. 5. Version Management Module Version management module completes version management including version query, loading, deleting, changing commands sending from background to foreground. In addition, it also performs micro-code version, FPGA and board testing program download.
Database subsystem
Database subsystem manages physical resources of the whole system and the configuration information of service , signaling and protocol. At the same time it provides access interface for other subsystems. Database subsystem divides into database management system and database application system according to functions. Database management system includes database core and database maintenance. Database core completes data definition, description and operation functions. Database maintenance takes charge of data security, distributed data synchronization and data maintenance. Database application system includes database and database application interface. A database is a structured set of relevant data, covering the data themselves and the relations between the data. It is independent of the application programs, and functions as the core and management object of the database system. The datebase application interface takes charge of accepting and completing different request sended by all kinds of application procedure and forming subscriber view of application.
30
The relation data model is used for the ZXWN SGSN system. For the management of the data, the object-oriented management mode is adopted. Figure 9 shows the data management of the ZXWN SGSN system.
FIGURE 9 DATA MANAGEMENT STRUCTURE OF THE DATABASE
A pplication m anagem ent
V iew1
V iew2
V iew3
O bject instance
Table instance1
Tableinstance2
Tableinstance3
M ethod1 Index1 Q ueue1
O bject baseclass
Tabletarget
Indexobject
Q ueueobjec
T ablem ethod
Indexm ethod
Q ueuem ethod
As is show in Figure 9, the data management falls into three layers. 1. Object base class The object base class is the basis for data management. All the object instances are based on the corresponding object base classes. 2. Object instance Each type of data objects defines its data and data manipulation method, which can be directly quoted by the instances of this type of data objects. At the same time, the instance of each data object has its unique data and data manipulation method, and these data and methods are the special data and methods of this type of data instance. 3. Application management The ultimate purpose of the database subsystem of the ZXWN SGSN system is to provide a data access interface for each application of the SGSN software. The system specially provides different types of dedicated access interfaces. The management procedures of these interfaces belong to the application management layer.
31
Bearing subsystem
Bearing subsystem mainly realizes service, signal subsystem and communication which includes link layer, network transport layer, basic upper layer, dynamic routing, group broadcasting, route table management, ATM processing, and flux control. 1. Link layer Link layer provides Ethernet, PPP protocol and two layer encapsulation for upper layers according to physical transport channels. 2. Network transport layer Network transport layer Supports IP, ARP, TCP, UDP, ICMP, IGMP, SCTP protocols. 3. Basis upper layer Basis upper layer supports four-above level protocols including TELNET, TFTP, RTP/RTCP. 4. Dynamic routing Dynamic routing provides RIP, OSPF, BGP protocols and their interaction. 5. Group broadcast Group broadcast provides DVMRP, PIM protocols. 6. Route table management Route table management generates and maintenance protocol route, part route, micro-code forward, group broadcast, micro-code group broadcast tables and their synchronization. 7. ATM processing ATM processing manages ATM layers, performs IMA conversion for E1/T1 to ATM interface and APS automatic switchover of ATM interface. 8. Flux control Flux control completes packet classification, queue organization, congestion control, acceptance control function, and provides QoS.
Micro-code subsystem
Micro-code is based on specific network process chips and completes user plane data service classification, processing and forward in media flux channel, and separates control and data planes. It also provides exterior interface, IP route forward, protocol and basic service processing, internal channel and QoS. 1. Exterior interface Exterior interface supports 100/1000M Ethernet, ATM, POS, IMA, and self-defined interfaces, and completes message link and network layer in corresponding interfaces.
32
2. IP route forward IP route forward provides standard route forward module, completes IP outerior routing. 3. Protocol service processing Protocol service processing provides GTP_U protocol processing, or packet allocation based on GTP_U. 4. Basic service processing Basic service processing provides ACL, NAT processing. 5. Interior channel Interior channel provides universal interior communication mechanism for user board, adopts self-defined interior coding address and interior route forward, completes user data forward function among interior boards, supports 1+1 or N+1 switchover. 6. QoS QoS supports QoS hierarchy user message forward, provides hardware guarantee queue management and band reservation in first grade switch, and supports four priorities queue management in second grade switch frame.
PP Board Subsystem
PP Board subsystem mainly provides control and media plane packet switch function, system clock and corresponding management, simple environment monitor and power management in system resource frame level.
Signaling Subsystem
Signaling Subsystem completes diversified signaling protocol processing, reliable real time transference, and network management. It includes narrow and broad band No.7 signaling, Sigtran transmission protocol. 1. Narrow and Broad Band No.7 Signaling Narrow and Broad Band No.7 Signaling provides service signaling channel for upper layer subscriber, and supports MTP2, MTP3, SCCP, TCAP, SSCOP, SSCF, LM. 2. Sigtran Signaling Transmission protocol Sigtran Signaling Transmission protocol completes No.7 transmission in IP network through IP bearing and No.7 adaptation protocol, supports IP, SCTP, M3UA.
Service subsystem
Service subsystem includes control and user plane processing parts which completes all of SGSN services. Control plane includes mainly GMM, SM, SMS, GTP-C, CAMEL processing sub-modules which are mainly performed by SMP board.
33
User plane includes two parts as follows: 1. Iu interface access part mainly indicates GTP-U processing sub-module which completes SGSN user plane data encapsulation, de-capsulation and transmission. The sub-module is in SGUP board. 2. Gb interface processing part which is in SGBP and SGSP boards performs such functions as follows: Frame Relay processing Network layer processing BSSGP, LLC, SNDCP and GTP user plane data capsulation, decapsulation and transmission.
Network Management Subsystem

Network Management Subsystem maintains SGSN devices, provides manmachine interface, configures devices, performs checking, controlling ,diagnosis authority, traces device running status, collects and analyzes running data. Network management subsystem architecture includes three layers horizontally: PSL (Platform Support Layer), PFL (Platform Frame Layer) and PAL (Platform Appliance Layer). PSL: provides diversified bottom support functions for large scale distribution system. Those functions apply to network management and large scale distribution system as well theoretically. PSL functions includes J2EE application server and its extending functions, standardized network management protocol stacks and others universal kits. PFL: abstracts common software frames which are defined frame layer for NM application. All of specific management application are based on this platform fully or partly. PAL: provides specific management application based on PFL. Those functions are Knock-down. When being applied to uniform NM platform, those functions are optional for loading. Network management subsystem includes OSF (Operation System Function), WSF (Workstation System Function) , NAF (Northbound Access Function), EMF (Element Media Function), and MIF (Management Information Function) vertically. The structure is shown as follows in Figure 10.
34
FIGURE 10 NETWORK MANAGEMENT STRUCTURE
NMF
NAF
WSF
OSF
EMF
NEF
MIF
OSF processes telecom-management-related information, supports and controls device management functions. WSF provides the conversion NM information conforming to interior NM platform to understandable description for users, such as JAVA GUI and WEB. NAF supports conversion from providing NM information to NMF description. EMF transmits and adapts messages and bridges OSF and NEF. MIF operates and maintains information model acting as NM agent. NM subsystem functions includes configuration, topology, security, log and system managements. fault, performance,
Configuration management performs data configuration creation, deletion, modification, browsing, synchronizes background and foreground data, completes dynamic management, and imports/exports sub-tree, solidifies configuration, creates and deletes in batch, creates and deletes multiple data configuration automatically. Fault management performs alarm monitor, query, operation (including synchronization, acknowledgement, forward, deletion), manages alarm suggestion database, customizes sound and lights alarm and alarm rules. Performance management performs measurement task, QoS task, performance data and table management. Topology management performs topological navigation and display, provides topological query, filter and group.
35
Security management performs user, role, role set management, and manages authentication to resource and operation tree. Log management records log information corresponding to diversified operations and provides query, deletion, backup and filter operation. System management monitors application server and database and provides database backup and recovery.
System Features
The ZXWN SGSN has the following features: 1. Layered and modular structure, and system structure of decentralized control and distributed processing. It provides very powerful processing capability and stable and reliable system performance. 2. The system has large capacity and can be scaled easily. Based on the carriers requirement, a small-capacity configuration is recommended at the initial stage of network construction, and the equipment capacity can be expanded gradually as the number of users grows. 3. The switching unit, control unit and other important modules adopt the 1+1 backup. The interface unit and the service unit adopt the N+1 backup, and support hot swappable operation to ensure the reliable and stable running of the equipment. 4. The interfaces provided are standard interfaces, such as Iu, Gb, Gn, Gp, Gr, Gs, Ga, and Gc. They provide good compatibility and interworking with the equipment of other vendors. 5. Excellent and reliable charging performance and flexible charging policies. It provides a standard Ga interface. 6. The equipment implements centralized maintenance and remote management functions. Users can operate on the network using the general SNMP-based network management tools. 7. The hardware structure adopts the modular design technology that the system often use, to satisfy the requirements of network capacity expansion and structural evolution. Through the change of some interface boards and the upgrade of software, the upgrade from R4 to R5 can be implemented, and at the same time, the functions of the R99 version are compatible. 8. The Gb interface is provided to implement the full compatibility of the GPRS system by the WCDMA, and the cross-system switching function is supported.
36
Chapter
Technical Indices
In this chapter, you will learn about: The system technical indices of ZXWN SGSN
The system technical indices of the ZXWN SGSNare of a large number, including physical performance index, power supply index, environment index, interface, capacity, clock, and reliability. In addition, the indices of different components are also included.
37
System Indices
System indices include physical performance, equipment power, environment condition, interface indices, capacity indices, clock indices and reliability indices.
Physical Performance
1. Structure The overall system structure adopts the standard 19-inch cabinet, with the max. internal space of 42U. A single cabinet can be configured with a maximum of a 4-layer 8Uhigh service frame, 1-layer 2U-high power frame, 4-layer 1U-high wiring frame, 3-layer 1U fan frame, and 1-layer 1U dummy panel. The cabinet is 42U high. In the cabinet the corresponding modules are configured: cabinet power supply leading-in filter, busbar, and rear horizontal cabling management rack. Other configuration can be achieved by reducing the number of module frames combined. The overall system structure is shown in Figure 11.
38
Chapter 3 - Technical Indices
FIGURE 11 ZXWN SGSN SYSTEM STRUCTURE
Blank panel (1U) Power distribution subrack (2U) Fan subrack (1U)
Service subrack (8U)
Cable subrack (1U)
2000
Cable subrack (1U) Fan subrack (1U)
Cable subrack (1U)
Cable subrack (1U) Fan subrack (1U) Dust filter
500
2. Color The cabinet is blue (ZX-01*02), whereas the frames and the panel are gray (ZX-02*02). 3. Size The dimensions of the components are as follows:
39
The dimensions of the cabinet: 2,000mm 600mm 800mm (Height Width Depth) The dimensions of service frames: (Height Width Depth) = 354.8 mm (8U) 482.6 mm (19) 479.2 mm The dimensions of the power supply frame: (Height Width Depth) = 88.1 mm (2U) 482.6 mm (19) 374mm The dimensions of the cabling frame: (Height Width Depth) = 43.6mm (1U) 482.6mm (19) 394.35mm The dimensions of the fan frame: (Height Width Depth) = 43.6mm (1U) 482.6mm (19) 402.7mm The dimensions of the front-inserted board PCB: (Height Width Depth) = 322.25mm (8UPCB) 2.0mm (or 2.4) 340mm The dimensions of rear-inserted board PCB: (Height Width Depth) = 233.35mm (6UPCB) 2.0mm 100mm 4. Weight of integrated system Cabinet weight (kg) 350kg (full configuration of a single cabinet) 5. Weight bearing requirements of equipment room floor Floor weight bearing: Larger than 450kg/m2
Equipment Power
1. Power Supply Range The system power supply is fully distributed. The power modules on the functional boards convert and isolate -48V power supply into/from the power supply needed by this board (such as +5VDC/+3.3VDC/+2.5VDC /+1.8 VDC).In board power design, the following factors must be considered: EMC filtering, isolation, hot swappable, power-on slow start, input overcurrent protection, output over-voltage protection and power-on sequence. Normal working voltage of the system: -57V to -40V. For equipment with AC power as its primary power, such as a server, the nominal input power is single-phase 220V AC power, the permitted input voltage ranges from 176V to 264V, and the frequency change ranges from 45Hz to 65Hz. At the -48V power inlet of the rack is the power distribution module (PDM) mounted at the top of the rack, and also an EMC filter, the general power circuit breaker and the circuit-breakers for the shelves are installed at the inlet. The PDM module supplies -48V power for four board shelves and two fan shelves individually through independent 48V busbars. 2. Power Consumption Indices The power consumption parameters of the ZXWN SGSN are as listed in Table 4.
40
TABLE 4 POWER CONSUMPTION PARAMETERS OF THE ZXWN SGSN
Office Capacity (10,000) 10 50 100 240 600
Power Consumption (W)
1800 3100 5000
Environment Conditions
1. Grounding Requirements The system ground includes -48V ground, work ground and protection ground that are connected to each shelf through their own busbars. The 48 V ground and work ground should be separate to reduce interference. In a single-rack system, the three types of ground wires join outside the rack and enter the earth together. In a multi-rack system, the three types of ground wires of each rack are connected separately, join at the remote end and then enter the earth together. If conditions permit, the protection ground wire can be grounded through an independent grounding post. The rack provides top grounding and bottom grounding. If conditions permit, the protection ground wire can be grounded through an independent grounding post. The rack lap resistance is 0.1ohm~0.3ohm; the equipment room grounding resistance should be less than 1ohm; if permitted, the protection ground can be accessed to the earth via the independent grounding stand. Sufficient space should be reserved between the PGND and surrounding signals and the power and the ground, to prevent any damage to boards due to high voltage. The system does not provide any analog ground, and the analog ground on a board converges with the digital ground at the board power. For boards with high power consumption and high working frequency, a mesh ground plane should be used. Normally, signal connections among shelves are made via optical interfaces and isolating electrical interfaces and LVDS current loops to prevent any influence upon the ground signals 2. Temperature and Humidity Requirements The temperature and humidity requirements of the ZXWN SGSN are shown in Table 5.
TABLE 5 ENVIRONMENT TEMPERATURE AND HUMIDITY REQUIREMENTS
Equipment Type
Temperature Long-term working condition Short-term working condition -5 C~45 C

0 0
Relative Humidity Long-term working condition 20%~90% Short-term working condition %
ZXWN SGSN
0 C~40 C
41
Note 1. The temperature and humidity of the operating environment inside the equipment room are measured at the spot that is 1.5m above the floor and 0.4m before the equipment when there is no protective plate in front or back of the equipment rack. Note 2: The short-term working condition means that the continuous operation period is no more than 48 hours and the accumulated operation period in a year is no more than 5 days.
Interface Indices
The standards complied with by the interfaces of the ZXWN SGSN and the cables supported are shown in Table 6.
TABLE 6 ZXWN SGSN INTERFACE INDICES
Interface Type Gn Gb IuPS Ga Gr Network management
Physical Standard 100Mbps/1000Mbps Ethernet E1 155Mbps ATM optical interface 100Mbps/1000Mbps Ethernet E1 100Mbps Ethernet
Cable Types Category-5 twisted pair Category-5 twisted pair Fiber jumper LC/PC-LC/PC Coaxial cable Coaxial cable Category-5 twisted pair
Capacity Indices
The capacity indices of the ZXWN SGSN are shown in Table 7.
TABLE 7 ZXWN SGSN TYPICAL CAPACITY INDICES
Technical Features
Parameter Max. number of attached users Max. number of activated users Number of activated PDP Contexts
Specific Indices 2,400,000 2,400,000 4,800,000 5,000,000 2Gbps 40Gbps 256 32
Capacity indices
Number of max. storable PDP Contexts Data throughput Switching capacity: Number of narrowband 64Kbps links Number of narrowband 2Mbps links
Signaling indices
42
Number of max. configurable Office capacity signaling points Number of RNC supported 155M ATM interface Interface indices FE interface GE interface E1/T1 interface
256 128 48 60 30 128
The reference traffic model of the ZXWN SGSN is shown in Table 8.
TABLE 8 ZXWN SGSN REFERENCE TRAFFIC MODEL
Parameter Service amount when 3G mobile subscriber average busy (overhead excluded, and uplink/downlink data included) Average IP packet length Uplink/downlink data amount ratio attached subscriber number when 3G mobile subscriber busy Number of activated subscribers when 3G mobile subscribers busy Number of activated PDP contexts when 3G mobile subscriber busy Number of deactivated PDP contexts when 3G mobile subscriber busy Percentage of roaming subscribers in total subscribers 10% 20% 480Byte 1:3 100%
Specific Indices
1.8kb/s/PDP activated subscriber
3 times/activated subscriber 3 times/activated subscriber
Clock Indices
The clock indices of the ZXWN SGSN are shown in Table 9.
TABLE 9 ZXWN SGSN CLOCK INDICES
Parameter Clock Level Lowest clock accuracy Pull-in range Max. frequency deviation Initial max. frequency deviation Clock working mode: 410-7 410-7 10-9/day 510-10
Specific Indices Level-2 clock class A
Fast capture, locked, hold-over and free-run
43
Reliability Indices
TABLE 10 ZXWN SGSN RELIABILITY INDICES
Parameter Basic failure ratio (min) Mean Time Between Failures (MTBF) System Mean Time To Repair (MTTR) System availability (A) System annual average interruption time
Specific Indices 0.0000068 hours 148000 hours <30 minutes >99.9997% <3 minutes
Component Indices
Component indices include signaling processing module indices, power module indices, internal communications module indices, charging module performance indices, monitoring module indices, fan unit indices and board power consumption indices.
Signaling Processing Module Indices

1. The QoS that MTP3 provides for the upper-layer signaling is as follows: i. Message error rate index Message loss: Less than 10-7 Message sequence error: Less than 10-10 Message error: Less than 10-10 ii. Transfer delay index In normal load conditions, the message transfer delay is less than 20 ms in average (50%), and less than 40 ms in rigorous (95%) conditions. In the case that the load exceeds the normal load by 15%, the message transfer delay is less than 40 ms in average (50%), and less than 80 ms in adverse conditions (95%). In the case that the load exceeds the normal load by 30%, the message transfer delay is less than 100 ms in average (50%), and less than 200 ms in adverse conditions (95%). 2. Max. capacity of narrowband signaling links: 512 64kbps signaling links or 32 2M signaling links 3. Broadband signaling processing bandwidth: 30Mbps 4. Number of processed messages: 32, 768MSU/s 5. GTT capacity: 32, 000GTT/s
44
Power Module Indices

The indices of the power module are shown in Table 11.
TABLE 11 POWER MODULE INDICES
Power Type Item Nominal Value (V) Voltage range (V) Noise voltage 0Hz~300Hz 300Hz~3400Hz 3.4kHz~150kHz 150kHz~200kHz -48 -57~-40 100 mV (peak-peak value) 2 mV (weighting noise of noise meter) Single frequency 5mV (valid value); broadband 100mV (valid value) Single frequency 5mV (valid value); broadband 100mV (valid value) 200kHz~500kHz 500kHz~30MHz Single frequency 3mV (valid value) Single frequency 1mV (valid value) Single frequency 5mV (valid value); broadband 100mV (valid value) Single frequency 3mV (valid value) Broadband 30mV (valid value) SGSN DC Voltage
Internal Communications Module Indices

The internal communication adopts 100M Ethernet and 1000M Ethernet. The communication nodes adopt the active/standby mode in design to ensure the reliability.
Charging Module Performance Indices

The performance of the charging module is closely related to the charging system in place. CDR processing capability3000CDR/S CDR storage capability: Take one million subscribers for example, the CDR storage capability of CG is > 60 days (about 540G or above). According to the actual requirements, the hard disk can be expanded to improve the storage capability. A tape backup capacity of 20G CDR per day is provided. The CDR storage capability of NE board: >72 hours.
45
Monitoring Module Indices

Technical indices of the environmental monitoring board (EMON) are as follows: 1. Protection range of the smoke sensor alarm: 60m2 number of sensors 2. Protection range of the infrared alarm: 15m radius 90 degrees sector number of sensors 3. Check range of flooding alarm: 10mm~1000mm 4. Check range of temperature: 00C ~+500C 1kHz~1.5kHz); measure precision: 0.50C (frequency output:
5. Check range of humidity: 20%~100% (frequency output: 1kHz~2kHz corresponding to 0%~100%); measure precision: 3% 6. Check range of fan rotation: 0 resolution/min.~5000resolution/min.; precision: 1% 7. Temperature upper limit alarm: Setting through program allowed (default value: 300C) 8. Temperature lower limit alarm: Setting through program allowed (default value: 150C) 9. Humidity upper limit alarm: Setting through program allowed (default value: 650C) 10. Humidity lower limit alarm: Setting through program allowed (default value: 400C) 11. -48V power upper limit alarm: Setting through program allowed (-57V); precision: 20C 12. -48V power lower limit alarm: Setting through program allowed (-40V); precision: 20C 13. Fan rotation alarm: Setting through program allowed (default value: 80% rated resolution)
Fan Unit Indices

Voltage: -48 (V); current: 0.78 (A); power: MAX37.44 (W); wind strength: 600.6 (CFM); wind pressure: 6.0 (mmH20); resolution: 2,800 (RPM); noise: 45 (dBA); life cycle: 62,500 (hour); environment: -10C~+75C
46
Board Power Consumption Indices

The board power consumption indices are shown in Table 12.
TABLE 12 BOARD POWER CONSUMPTION INDICES
Board Name
Power Consumption (Constant Temperature, All Component Operating Test Program) (W)
SGLP/SGUP UIM CHUB PSN GLIQV SPB OMP/SMP/USI/SGBP/SGSP Fan CLKG SIUP
<30 <35 <26 <55 <80 <39 <68 <145 <14 <50
47
Chapter
Interface and Communication

In this chapter, you will learn about: The key interfaces of ZXWN SGSN The key interfaces of the ZXWN SGSN are Iu, Gn, Gr, Gd, Gs, Gb , Ga interfaces and network management (NM) interface.
49
Overview
The key interfaces of the ZXWN SGSN are Gn/Gp, Iu-PS, Gb, Ga, NM, Gs, Gr, and Gd interfaces. Except the NM interface, all the other interfaces are standard interfaces. The data on these interfaces are standard code streams. Therefore, the system can implement interworking with devices of other manufacturers.
Interfaces
Gn/Gp Interface
Overview
The Gn/Gp interface is the interface between the GSN nodes. In particular, the Gn interface is the interface between the GSN nodes within the same PLMN, whereas the Gp interface is the interface between the GSN nodes in two different PLMNs. The two interfaces adopt GTP for communication. The protocol layers of the Gn/Gp interface are shown in Figure 12.
FIGURE 12 GN INTERFACE GTP UDP IP L2 L1 Gn or Gp GTP UDP IP L2 L1
GSN
GSN
Introduction to Interface Layers

As shown in Figure 12, the Gn interface signaling is GTP, which is borne on the basis of UDP borne on the IP layer. The key functions of GTP are path management, location management, tunnel management, and mobility management.
Iu-PS Interface
The lu interface is between the MSCS/MGW/SGSN and the RNC. In particular, the interface between the MSCS/MGW and the RNC is the Iu-CS interface, and the interface between the SGSN and the RNC is the Iu-PS interface.
50
Chapter 4 - Interface and Communication
Overview
The lu interface has the following functions: 1. The creation, maintenance and release management of RAB. 2. Implementing the switching between systems and within a system and the relocation of the SRNS. 3. Support of cell broadcast service. 4. The general management process without relationship with the subscribers. 5. User signaling management. 6. Transferring of NAS signaling messages between the subscriber and the CN. 7. Support of location services. 8. Support of the simultaneous access into different domains of the CN by the subscribers. 9. Security function. The lu-PS interface utilizes the SCCP to transfer signaling data, and AAL5 is used to carry the control plane data and the user plane packet data. Fig. 4.2-1 shows the structure of the Iu-PS interface. In the figure, the layer 2 and layer 3 protocol stack of the signaling part adopt SSCOPSSCFNNIMTP3-B, rather than IPSCTPM3UA. The protocol stack of the IuPS interface is shown in Figure 13.
51
FIGURE 13 STRUCTURE OF IU-PS INTERFACE
Radio Network Layer
Control Plane RANAP
User Plane Iu UP Protocol Layer
Transport Network Layer
Transport Network User Plane

SCCP M3UA MTP3-B SCTP SSCF-NNI SSCF-NNI SSCOP AAL5 IP
Transport Network Control Plane
Transport Network User Plane
GTP-U UDP IP AAL5
ATM Physical Layer
ATM Physical Layer

RANAP is located at the lowest part of the network layer. It is a user of the transport layer SCCP. RANAP provides signaling transfer function for the Iu_PS and provides resource management function for the Iu interface. SCCP runs on MTP3 (B) or on the M3UA protocol stack, providing connection-oriented, connectionless data transfer service. SSCF-NNI assists SSCOP to implement the link-level function, the link creation, the data transmission, and the signaling link error monitoring. SSCF-UNI executes the coordination function for the services requested by the third layer signaling user and the services provided by the SSCOP. It provides primitive mapping between the upper and the lower protocol modules, making the specific service users of the third layer and the SSCOP module maintain mutually independent. SSCOP implements the connection establishment on one single PVC to reliably transmit signaling messages. With SSCF and LM, it implements the link-level function.
52
Gb interface
Overview
The Gb interface is between the SGSN and the BSC. SGSN connects to the base station BSS via the Gb interface, working for the MS. The connection between the SGSN and the MS is established through the logic control protocol LLC to provide mobility management (location tracking) and security management. SGSN implements the protocol conversion between the MS and the SGSN. That is, the IP protocol used by the backbone network is converted into the SNDCP and the LLC protocols, and the MS authentication and registration functions are provided. The key functions are data encapsulation/decapsulation function, packet data service processing and packet data transfer, MS-SGSM data link creation/deletion/modification process, user signaling management, GSN tunnel management between GSN nodes, packet segmentation/encapsulation, and compression/decompression, encryption/decryption process. The structure of the Gb interface is shown in Figure 14.
FIGURE 14 STRUCTURE OF V5.2 INTERFACEPROTOCOL
Relay SNDCP LLC Relay RLC MAC GSM RF BSS BSSGP Network Service L1 bis Gb BSSGP Network Service L1 bis SGSN GTP UDP/ TCP IP L2 L1

The functions of the BSSGP protocol are BSSGP packet pre-decoding and the transmission of LLC frames between the SGSN and the MS. The functions of the LLC protocol: LLC packet pre-decoding and the transmission of GMM messages between the SGSN and the BSS. The NS layer functions: NS SDU transfer, NSVC load sharing, NS-VC management, and congestion monitoring and restoring. The FR layer functions: delineation of frames, frame multiplexing/demultiplexing through the address field of the header (DLCI), frame error detection (without error correction), fault performance management entity, flow control, FR PVC management entity, and monitoring PVC status.
53
Gr Interface
Overview
The interface between the SGSN and the HLR is the Gr interface. It is used to switch the location information of the mobile subscribers to facilitate the management of the subscribers. SGSN reports to the HLR the current location of the mobile subscribers, and the HLR transfers all the subscribed data of the subscribers to the SGSN. When the subscribers need a special service, and hope to change their subscribed data or the subscribed data of the subscribers is changed, this switching happens. The signaling of this interface is MAP, and the transmission adopts E1 2Mbps trunk.

The structure of the Gr interface is shown in Figure 15:
FIGURE 15 STRUCTURE OF THE GR INTERFACE SIGNALING MAP TCAP SCCP MTP3 MTP2 MAP TCAP SCCP MTP3 MTP2
L1 SGSN
Gr
L1 HLR
Ga Interface
Overview
The Ga interface is the interface between the SGSN/GGSN and the CGF to provide charging records to the CGF. This interface adopts the GTP interface. The protocol layers of the Ga interface are as shown in Figure 16
54
FIGURE 16 GA INTERFACE
GTP' UDP/ TCP IP L2 L1 GSN Ga
GTP' UDP/ TCP IP L2 L1 CGF

The signaling of the Ga interface is the GTP protocol. GTP is a protocol based on UDP. It has no error correction function.
Gd Interface
Overview
The Gd interface is an interface between SGSN and SMS-IWMSC/GMSC. It provides the interface to implement the SMS function through SGSN, adopting the E1 physical interface. The functions of SGSN consist of SMS termination, SMS initiation, MS storage effective prompt, and MS reachability prompt. The protocol layers of the Gd interface are as shown in Figure 17.
FIGURE 17 GD INTERFACE
MAP TCAP SCCP MTP3 MTP2
MAP TCAP SCCP MTP3 MTP2 Gd
L1 SGSN
L1 SC

The Gd interface is based on the MAP signaling.
55
Gs Interface
Overview
In the system, the Gs interface is between the MSCS/VLR and the SGSN. It is an optional interface. The Gs interface coordinates the interaction between the MSCS/VLR and the SGSN. SGSN implements the joint attachment, joint location update and joint deactivation via the Gs interface. The MSCS/VLR uses the UMTS-PS connection via the Gs interface to send paging, MM message, and other operations. The Gs interface implements a series of functions through bearing the BSSAP+ message. Its key functions are: paging for non-UMTS-PS services, location update process processing of the non-UMTS-PS, alert service processing of the non-UMTS-PS, the separation process processing of the UMTS-PS/IMSI, reset processing, MM/MS message processing, and error processing.

The layers of the Gs interface are shown in Figure 18 All messages that pass through the Gs interface are borne by the BSSAP+ signaling. The BSSAP+ signaling is borne on the SCCP protocol. The protocol layers of the Gs interface are as shown in Figure 18.
FIGURE 18 GS INTERFACE
BSSAP+ SCCP MTP3 MTP2 L1 Gs
BSSAP+ SCCP MTP3 MTP2 L1
SGSN
MSC/VLR
NM Interface
Overview
SGSN connects via the operation and maintenance interface to the maintenance center OMC, and the OMC implements the following functions: 1. Signaling tracking, service observation, performance statistics, and alarm management. 2. Query the PDP contexts in real time. 3. Count the number of the PDP on the boards and the number of the terminal subscribers. 4. The flow of each port.
56
5. The statistics of the route table status. 6. Configuring all data. 7. Version setting and function loading. 8. Statistics of the uplink/downlink data flow. 9. Count the number of the terminal subscribers accessed in different modes. 10. The number of the PDPs of the APNs and the flow. 11. Internal data flow. 12. Real-time data throughput of the system.
Features
The operation and maintenance subsystem has powerful management capability, controls WCDMA NEs in centralized mode, has powerful networking capability, supports cascade control and reverse operation and implements remote access by accessing to the WAN through a router. The Qx network management interface standard provides powerful interface control function for the network management center. Two processing modes are integrated: GUI and command line.
Signaling System
The ZXWN SGSN signaling includes narrowband signaling, broadband SS7, MAP signaling, and the GTP protocol on the Gn interface. The narrowband signaling provides the communication with the HLR, the SMC, and the MSCS/VLR. The broadband signaling provides the communication between the lu interface and the RNC. The MAP is the high layer signaling that is borne on SS7. The GTP protocol is used to transfer the signaling messages between the SGSN and the GGSN, and between the SGSN and the SGSN. We will discuss them separately in the following.
ATM Interface Protocol

ATM (Asynchronous Transfer Mode) is a transmission mode. In this mode, information is organized into cells. Since the cells from the information about a subscriber do not need to appear periodically, this transfer mode is an asynchronous mode. An ATM cell is a packet with fixed length, containing 53 bytes falling into two parts. The first five bytes form a header to complete addressing function, and the last 48 bytes form an information field used to load information form different subscribers and services. All digital information such as voices, data and images must be fragmented, encapsulated into cells in unified format and sent on the network, and finally will be recovered in the necessary format at the receiving end. The ATM
57
technology simplifies the switching process and removes the unnecessary data check, and also the fixed cell format easy to process is used, so the ATM switching rate is greatly higher than that of traditional data networks (such as x.25, DDN and FR). In addition, for a data network with such a high speed, the ATM network has some efficient traffic policing mechanism to monitor the subscriber data on the network in real-time and to minimize the network congestion possibility. Different services are granted with different privileges, for example, the voice service has the highest realtime privilege and common data file transmission has the highest correctness privilege. The network assigns different network resources for different services, so that different services can coexist in peace on the network. ATM uses multiple adaptation layers: AAL1, AAL2, AAL3/4 and AAL5, to suit for four different classes of services: Class A, class B, class C and class D. The service description is as follows: 1. Class A: Constant Bit Rate (CBR) service, ATM Adaptation Layer 1 (AAL1), supporting connection-oriented services, with fixed bit rate. Common services: 64Kbit/s voice service, uncompressed video communications with fixed code rate and leased circuits of dedicated data networks. 2. Class B (Variable Bit Rate): ATM adaptation layer 2 (AAL2) It supports connection-oriented services with variable bit rate. The common services involve compressed packet voice communications and compressed video transmission. This type of service features transmission interface delay, since the receiver needs to reassembly the original uncompressed voice information and video information. 3. Class C (Connection-oriented data service): AAL3/4. This service is a connection-oriented service, applicable to file transfer and data network services. The connection of such a service is set up before data transfer. 4. Class D (connectionless data service): Non-connection service. Common service types are datagram service and data network service. The connection will not be set up before data transfer. AAL3/4 and AAL5 support this service. The SGSN adopts the AAL5 adaptation of the ATM adaptation layer, with the functions listed below: AAL5 (ATM Adaptation Layer 5): AAL5 supports connection-oriented VBR service, which is used for transmitting standard IP service over ATM networks and LANE. The SEAL (Simple and Efficient Adaptation Layer) technology is used for AAL5, which is the simplest technology recommended for AAL. AAL5 provides low bandwidth overhead and simpler processing requirements to obtain simplified bandwidth performance and error recovery capability. AAL5 provides its applications with the following services: One is reliable service (that is, a flow control system is used to guarantee transmission to avoid overload); the other is unreliable service (that is, data transmission guarantee measure will not be taken), and options are used to drop error
58
cells (found by parity check) or send them to the applications (but will be marked as bad cells). AAL5 supports the point-to-point transmission mode and the multi-point transmission mode. However, the multi-point transmission mode does not provide any data transmission guarantee measures. Like AAL3/4, AAL5 supports packet mode and flow mode. In the packet mode, the applications can send datagrams with a length of 1 byte to 65535 bytes to the AAL layer. When a packet reaches the convergence sub-layer, the packets will be filled into the payload field and added with trailer information, and also the filling data will be selected (0 byte t0 47 bytes), so that the entire packet (containing the filled data and trailer information) is an internal multiple 48bytes. AAL5 does not have a convergence sub-layer header and only has an eight-byte trailer. The UU field from user to user is not used in the AAL layer itself. It is used for a higher layer for its own purpose (probably the special service subpart of the convergence sublayer), for example, sorting or multi-channel multiplexing. The length field points out the real length of the payload, in the unit of byte, excluding the stuffed bytes. 0 is used to terminate the datagrams that have not been transferred. The CRC field is based on the standard 32 checksum based on the whole datagram, including the stuffed data and the trailer information (CRC field set to be 0). A 8-bit field at the trailer is reserved for the future use. The datagram is transferred to the SAR layer, and then is transmitted off. The SAR sublayer is not added with any header or trailer information. Instead, the datagram is divided into units of 48 bytes, each transferred to the ATM layer for future transmission. It will also notice the ATM layer to set the PTI field of the last cell to 1 to reserve the datagram delineation. Compared with AAL3/4, the AAL5 is more efficient. AAL3/4 only adds the four-byte header information to each packet, but it will add a piece of four-byte header information to each cell, so that the payload capacity is reduced to bytes. For a long packet, the invalid data occupies 8%. Each packet in AAL5 has a larger trailer (eight bytes), but each cell does not have additional overhead. A cell does not have a sequence number, but a long checksum can be used for compensation to detect a lost, mis-inserted or wring cell, without the use of a the sequence number. On the Internet, a common method for interface with an ATM network is to use the payload field of AAL5 to transmit IP packets.
Narrowband SS7
According to the basic structure of ITU-T SS7, the entire system is divided into the Message Transfer Part (MTP), Signaling Connection Control Part (SCCP), Telephone User Part (TUP), ISDN User Part (ISUP) and the Transaction Capability Application Part (TCAP), as shown in Figure 19.
59
FIGURE 19 STRUCTURE OF NARROWBAND SS7
At present, the SS7 is divided into 4 levels. MTP1 is the first level, MTP2 is the second level. MTP3 and SCCP belong to the third level, individually corresponding to the physical layer, data link layer and the network layer in the OSI model. The application entities are parallel functional units of level 4, corresponding to the application layer in the OSI model. The ISP (Intermediate service part) shown in Fig. 4.3-1, correspond to Layers 4~6 in the OSI model, which are currently not defined yet.
SS7 Message Format

The SS7 uses variable-length messages to transmit signaling. In the narrowband SS7, there are three kinds of signal units: Message Signal Unit (MSU), Link Status Signal Unit (LSSU) and Fill-in Signal Unit (FISU). Among them, the MSU is the signal unit that practically carries messages, and the LSSU is the signal unit that transmits network link status. The FISU contains no message, serving as a null signal sent to the opposite end when the network node has no message to send. Its function is to maintain the signaling link at communicating status and at the same time to acknowledge that the message sent from the opposite side is received. The formats of the three signal units (MSU, LSSU and FISU) are shown separately in Figure 20, Figure 21 and Figure 22.
60
FIGURE 20 MESSAGE FORMAT OF MSU
8
F
16
CK
nx8(16>n
SIF
2)
2 NI
2 4 SI
6 LI
1 F I B
7 FSN B I B
1 BSN
7 F
Transport direction
M essage
M essage transfer part L2 L3
8 L2
FIGURE 21 MESSAGE FORMAT OF LSSU
Transport direction Control part
FIGURE 22 MESSAGE FORMAT OF FISU
Transport direction
Where: BIB: Back Unit Indicating Bit BSN: Back Unit Sequence Number CK: Parity Bit F: Flag FIB: Forward Indicator Bit
61
FSN: Forward Unit Sequence Number LI: Length Indication NI: Network Indication SF: State Field SI: Service Identifier SIF: Signaling Information Field
MTP
The main function of the MTP (Message Transfer Part) is to complete correct upper-level message transmission, which can be divided into three parts: MTP1, MTP2 and MTP3. MTP1 refers to the data link level, which is equivalent to the L1 physical layer of OSI and serves as a bi-directional data transmission channel, covering digital transmission channel and signal terminal equipment. The primary rates of the digital transmission channel are 64kbps and 2048kbps/s. This section will describe MTP2 and MTP3. 1. MTP2 MTP2 is the link functional level. The database configures the one-toone corresponding relationship between the links and the signaling processing modules. The link management and message transmission is only directly related to the configured MTP3 module. The detailed functions are as follows: i. Signal unit delimitation and location: An eight-bit identity code (01111110) with a special code pattern is available on the start and end of each signal unit, and also the "zero insertion" method is used to guarantee that the code pattern of the identity code (that is, a flag) will not appear in other part of the signal unit. If the receiving part receives non-allowed bit code pattern (more than six consecutive "ones") or the signal unit exceeds the permitted max. length, it will regard that the signal unit location has been lost.
ii. Error detection: The error detection is completed by the 16-bit parity bit at the end of each signal unit. At the signaling terminal of the sender, the bit streams before parity bit of the signal unit will be calculated according to a special algorithm to generate the parity bit. While at the signaling terminal of the receiver, the algorithm rule corresponding to that of the sender is used to calculate the received check bits. After the calculation, if the received check bits are inconsistent with the bits before the signal unit parity bit, it indicates that some error has occurred. iii. Error correction: There are two methods of error correction, basic method and preventive cyclic method. Basic method: This is an error correction method by use of noncompelling, affirmative/negative acknowledgement and retransmission. Before receiving an affirmative acknowledgement, the sent signal unit is still saved in the signaling sending terminal.
62
If the terminal receives the negative acknowledgement signaling, it will stop the sending of any new signal unit and retransmit the sent signal unit that is not acknowledged in affirmative manner, starting with the signal unit indicated by the negative acknowledgement. The retransmission sequence is the same as the sending sequence for the first time. Preventive cyclic retransmission method: This is an error correction method by use of non-compelling, affirmative acknowledgement, cyclic retransmission and forward correction. Before receiving the affirmative acknowledgement, the sent signal unit is still saved in the signaling sending terminal. If no new signaling needs to be sent, the terminal will cyclically retransmit all the sent signal units that are not acknowledged in affirmative manner. For 2M links, the PCR method is not used in principle. iv. Start location: The start location procedure is used for location in recovery upon initial link start or link fault, covering normal location and emergency location procedures. The compelling and exchanging of the link state information at both ends of a link to be located and the configuration of a verification period are used to determine whether a link has completed the initial link location successfully. v. Signaling link error monitoring: The signaling link error monitor involves signal unit error rate monitoring of 64K links after service deployment, error time segment monitoring of 2M links after service deployment and link location error rate monitoring of link in verification status of the initial location procedure. vi. Traffic control: If the receiving end of a signaling link detects the congestion condition, it will activate the traffic control procedure. The receiving end under link congestion will use an appropriate link state signal unit (SIB) to inform the transmit end of the remote signaling terminal of the condition and at the same time will stop the acknowledgement of all input message signal units. After the congestion is released, it will restart the acknowledgement of all input message signaling units. If only the continuous congestion time is too long (exceeding T6), the transmitting end of the remote signaling terminal will indicate a link fault and exit the service. vii. Processor fault: Processor fault means that a signaling message cannot be transferred to the third and (or) fourth functional level. If the second level identifies a local processor fault, it will send a link state signal unit (SIPO) indicating a processor fault and discard the received Message Signal Unit (MSU). If the second functional level at the remote end is in normal operational status, it will notify the third level to start the continuous sending of the Fill in Signal Unit (FSU) after receiving the link state signal unit indicating a processor fault. If the local processor fault is cleared, the normal transfer of the MSU and FISU will be recovered. The second functional level at the remote end will notify the third level to put into normal operation as soon as it receives the correct MST or FISU. 2. MTP3 The system architecture of MTP3 is shown in Figure 23.
63
FI G U R E 2 3 M T P 3 S Y S T E M AR C H I T E C T U R E
3rd layer message transfer part
Signaling network function Signaling message processing Message distribution
Message discrimination
Signaling network management Signaling service management
Signaling route management
Signaling link management
As shown in Figure 23., the MTP3 third level is equivalent to the third layer network management layer, divided into two modules: signaling message processing SMH and the signaling network management. The signaling network management changes the connection structure between the local signaling point and the network by changing the message handling route. At the same time, message processing is also the sender of network management messages. i. Signaling message handling The signaling message processing part is distributed into all signaling processing MPs, which manages and monitors the link state in L2 and reports to the signaling link management part according to the number of links configured for the local module MP. With respect to all the uplink and downlink messages on the links configured in the module, the module completes the link management. However, all the functions of the signaling network management part are completed in the management module. If necessary, the interaction with the L2 is completed by the message management part of the module to which the link belongs.
64
2nd layer link control part
Message route 4th layer User part
The main function of SMH is to make sure that a signaling message occurring in the user part of a signaling point is transferred to the same user part at the destination specified by the user part. For the signaling network to complete the above transfer, the signaling point should be further functionally divided into message routing, message identification and message allocation. ii. Signaling network management The signaling network management is divided into three parts: signaling service management, signaling link management and signaling route management. The network management has its own message format and coding scheme. If a signaling link or a signaling point fails on the signaling network, the signaling management can take actions and process necessary to maintain the signaling service and recover normal signaling conditions. Signaling service management The signaling service management function is used to forward the signaling service from one link or route to one or multiple different links or routes, enable a new signaling point or temporarily slow down the signaling service upon signaling point congestion. The signaling service management supports the following functions: Changeover: If a signaling link is unavailable due to fault or blocking, to guarantee the correct transmission of the signaling service on the link, the signaling service management part will try to transfer the service to one or multiple other signaling links. Changeback: If a signaling link becomes available due to recovery, to avoid message loss, repetition or error sequence, the signaling service management part will try to make sure that the signaling service can be changed back to the original link from the replacing signaling link. Forced re-routing: If a signaling route to a given destination is unavailable, the signaling service management part will try to transfer the signaling service to the given destination to a new signaling route replacing the original one. Controlled re-routing: If a signaling route to a given destination becomes available, the signaling service management part will change the signaling back to the normal route from the signaling route replacing the original one. Signaling point restart: If a singling point recovers after it is disconnected to the signaling network for a certain period of time due to certain reasons, it cannot be determined whether the stored status information is valid or not, so it needs the interaction of routing data with a neighboring node so that its routing data can be synchronized with the real-time status of the signaling network. Management blocking: Block the link for maintenance and test purposes. Signaling service flow control: If congestion occurs to the signaling network, it is impossible to transmit all signaling services provided by a user, so traffic control is used to restrict the services originated by the source signaling point.
65
Signaling link management The SS7 link management process of the ZXWN SGSN belongs to the basic signaling link management process. This process is used at the management local signaling links to create and maintain the link group. Manual intervention is needed for the replacement of a signaling terminal and signaling data link. The signaling data link route corresponding to a signaling link is negotiated by both parties. Signaling route management Signaling route management is used to guarantee the reliability of signaling routing information exchange between signaling points. The exchange of information such as route availability or unavailability is completed by "forbidden transfer process", "permitted transfer process" and "limited transfer process". The controlled transfer process mutually notifies the congestion of a route group. The signaling route management process consists of the following four processes: prohibited transfer, allowed transfer, conditioned transfer, and controlled transfer.
Signaling Connection Control Part (SCCP)

In the hierarchy of the SS7, as one of the MTP user parts, the SCCP provides the MTP with GT-based routes and routing function, to transmit through the SS7 network circuit-independent messages and other types of messages between the office and dedicated centers on a telecom network, thus to set up connectionless or connection-oriented services. If the data that the user intends to transfer exceeds the MTP limit, SCCP will need to provide such necessary functions as segmentation and reassembly. The function of SCCP is as follows: Create logic signaling relationships in the SS7 network; able to transfer signaling data unit with or without the creation of logic signaling connection; provide route selection function based on global title; provide basic connectionless service and in-sequence delivery connectionless service, basic connection-oriented service and flow control connection-oriented service. 1. Structure and Functions of the SCCP Module The structure of SCCP is shown in Figure 24.
66
FIGURE 24 FUNCTIONAL MODULE STRUCTURE OF SCCP

SCCPUser
Connection-oriented message N_Transport primitive SCCPConnection-oriented transport control (SCOC) Route error SCCP Route control module (SCRC) MTP
MTP_trasport primitive
Connectionless message SCCP Connectionless transport control (SCLC)
N_trasport primitive
Route error
S O R
S O G
S S A
S S P
S S T
Receiving message from unavailable subsystem sent to the local node
N_Management primitive
SCCPmanagement control module (SCMG)
MTP_management primitive
The SCCP module provides the following services: i. Connectionless services The connectionless service is practically the datagram mode in the packet switching, that is, signaling messages can be transmitted without a connection set up beforehand. In this service, the transferred data information is regarded as an independent message and sent to the destination signaling point (DPC, that is, Destination Point Code) in routing flag. In the basic connectionless service, each message is transmitted separately (that is, without any relationship between each other). Therefore, the sequence of the messages transmitted to the destination signaling point cannot be guaranteed. In the in-sequence delivery connectionless service, the data message from the same information is attached with the same signaling link selection field, so as to guarantee that these data messages will be transmitted along the same signaling link. Therefore, they can arrive at the destination signaling point according in the transmitting sequence. Each time when the data is sent in the connectionless service, a re-routing is required. The specific process is as follows: An SCCP subscriber at the originating node sends out a N_unit data request primitive to request the connectionless data transfer service. Then, it makes use of the SCCP route control and MTP to send the unit data message to the connected line address in the unit data request primitive. When the unit data message cannot be transmitted to the destination point, the Unit Data Service (UDTS) message will be transmitted to the originating point. When the destination node receives the UDTS message, it will transmit the N_unit data indicator primitive. When SCCP cannot transmit the unit data or
67
UDTS message, it will transmit one UDTS message to the caller address or call the N_notice indicator primitive. If the length of the data in the N_unit data request primitive is greater than 255, the UDT message cannot transfer so many data, so the data should be fragmented into several shorter segments. Each segment is transferred with an XUDT message. When the SCCP receives the XUDT messages, the segmented data have to be reassembled into one N_unit data indication primitive and resent to SCCP user. This process is called segmentation/reassembly. The transmission process of the connectionless service is shown in Figure 25.
FIGURE 25 SCCP CONNECTIONLESS SERVICE TRANSMISSION PROCESS

Node 1 SCCP1 Node 2
SCCP2
UDT
ii. Connection-oriented service The connection-oriented service is practically the virtual circuit mode in the packet circuit, that is, it is necessary to set up logic connections before data transmission. In the basic connectionoriented service, no data message carries the sequence number, so neither sequence control nor flow control can be implemented. The sequence control and flow control can be implemented in the control flow connection-oriented service. The connection-oriented service is subdivided into temporary signaling connection and permanent connection. The establishment of the temporary signaling connection, similar to the dial-up telephone connection, should be initiated and controlled by the SCCP subscriber. The permanent signaling is a local (or remote) O & M function set up and released by the management function of a node, which provide SCCP users with semi-permanent connections, similar to leased telephone line. The process of the connection-oriented transmission is shown in Figure 26
68
FIGURE 26 CONNECTION-ORIENTED TRANSMISSION PROCESS

Node 1 SCCP1 Node 2 SCCP2
CR CC Data Data RLSD RLC
The process of the connection-oriented transmission consists of the following parts: Process of establishing a connection When the SCCP of the originating node receives a signaling connection request N_ConnectReq, it will analyze the connected line address to identify the node where the established signaling connection should arrive. If the destination node is not local, the SCCP will perform the MTP function to transmit a Connection Request (CR) message to the destination signaling point. When the SCCP of the destination node receives a CR message, it will transmits a N_ConnectInd primitive to the user. If the subscriber agrees to establish the connection, he will invoke the N_ConnectRes primitive, and the SCCP sends a connection confirmation (CC) message to the originating node. If he refuses to establish the connection, he will invoke the N_DisconnectReq primitive, and the SCCP sends a connection refused (CREF) message. During this process, the protocol types and the flow control credit will be negotiated and the SCCPs at the originating, destination and intermediate nodes should record the necessary information on this signaling connection to establish the logical signaling connection link. The signaling connection establishment and rejection process is shown in Figure 27.
69
FIGURE 27 SIGNALING CONNECTION ESTABLISHMENT AND REJECTION PROCESSES

SCCP user SCCP user
N_ConnectReq
N_ConnectCon CC SCCP CR SCCP
N_ConnectRes CC SCCP CR
N_ConnectInd
Signaling connection establishment procedure SCCP user N_DisConnectRe q CREF SCCP CR Signaling connection rejection procedure CR SCCP SCCP user N_DisConnectCon CREF SCCP N_ConnectInd
N_ConnectReq
Data transfer process The data transmission provides all kinds of functions to guarantee correct transmission of the subscriber data in the signaling connection. The functions provided contain segmentation/reassembly, flow control, inactivity control and accelerated data transmission. The segmentation/reassembly is employed when the subscriber data is longer than 255 octets. In this case, the data is segmented and inserted into the data of DT1 or DT2, while the multi-data indicator (M bit) is employed at the receiving end for reassembling. Flow control refers to controlling the message flow with a sliding window when the protocol is a flow control connection-oriented service. The purpose of non-active control is to prevent: the loss of connection acknowledgment during the process of connection establishment; during the transmission of data, the termination that is not noticed by the connection segment; the inconsistency of the connection data kept at both ends of one connection. When the connection segment sends out any message, it will reset the non-active controller. When the receiving non-active controller timer expires, the connection releasing process should be started. The accelerated data transmission is to transmit data with a max. of 32 eight-bit octets with high-speed (not restricted by the flow control and no segmentation or reassembly function is provided), when the protocol type is the flow-control connection-oriented connection service. Connection release process To start and end the connection release, released message (RLSD) and release completion message (RLC) are required. The release
70
process can be initiated by a SCCP user or by SCCP. In the release process, apart from releasing the logical links and local references, the function of freezing local references must be available in order to prevent starting the process not suitable for the present connection segment caused by receiving messages related to the previously established connection segments. Reset process The reset process aims to re-initialize the connection segment, discard the data messages, data confirmation messages, expedited data messages and expedited data confirmation messages, then set the sending sequence number P (S) to 0 and reset the window value to the original one. 2. SCCP management function The SCCP management function (SCMG) is to re-select the signaling route or restrict the signaling traffic when failure or congestion occurs to the signaling point or the signaling point subsystem, in an effort to ensure normal signaling network performance. The subsystem here actually refers to an SCCP user. The SCCP management process sets the dual-port or the subsystem as a dual-configured active/standby system and assumes that they work in the active-dominated mode. That is, only when the active system fails can the standby system be started, and once the failure is eliminated, the active system will take over immediately. The SCMG applies to both connectionless services and connectionoriented services. It can be divided into two sub-functions according to its management objects: i. Signaling point state management: It mainly functions to modify SCCP address translation table and the state of node or subsystem based on the signaling point code provided by MTP, so that subscribers can take measures to resend or reduce the signaling messages sent by some signaling points.
ii. Subsystem state management: It mainly functions to modify SCCP translation table, update state identification, and change over/back the signaling messages between the active/standby subsystems, based on the subsystem fault, exit from service and recovery messages received. The SCMG is implemented depending on acquiring information on the signaling point and the subsystem status. However, the signaling point status is managed by MTP3, therefore, the information related to the signaling point fault, recovery and congestion is sent from the MTP to the SCCP, while the information related to the subsystem fault and recovery is sent from the SCCP to related nodes in SCMG messages.
TCAP
Transaction Capability Application Part (TCAP) belongs to the upper-level part of the SCCP in the hierarchy of SS7.Its mainly aims to provide a uniform support for the information interaction of various application services in the network environment and to transmit such circuit-irrelevant information as address translation information, user data information,
71
charging or management information between switching nodes and control nodes. The TCAP signaling process is the procedure of processing and controlling the operations and dialogs. Currently in the ZXWN SGSN system, the TCAP supports two TCAP users: CAP and MAP. 1. Layered structure and functions of TCAP The TCAP layered structure is shown in Figure 28:
F I G U R E 2 8 T C AP L A Y E R E D S T R U C T U R E
TC-user TC- Primitive
CSL TR-Primitive TSL TCAP
N-Primitive
SCCP
MTP
Where: CSL-- operation management TSL -- session management CSL and TC - user interface through TC - primitives CSL and TSL interface through TR - primitives To control the operations and dialogs, TCAP itself is sub-divided into the following two layers: i. TCAPTSL The function of TCAPTSL is to manage the signaling communication process between the local TCAPTSL users and remote TCAPTSL users, that is, to manage transactions. The TSL subscriber refers to the TR- subscriber. At present, the sole known TR-user is the CSL. The communication between peer-to-peer CLSs is that between peer-to-peer TC-users, which is called a dialog. Consequently, in the currently defined TCAP protocol, the transaction and dialog are completely the same, with a one-to-one correspondence between them. To complete the signaling process of one application service, two TC-users have to conduct bi-directional switching for a series of
72
TCAP messages. The start, end, sequence and message contents of the message switching are all controlled and explained by TC-users, while the starting, holding and termination of dialogs, including detection and handling of abnormal dialogs, are all managed by TSL. The protocol process is applicable to the session of any application service. ii. TCAPCSL Transaction Capacity Application Part Component Sub-layer (TCAPCSL) is mainly used for operation management, component error detection and dialog component allocation. Under normal conditions, when a TC-user initiates an invocation request for one operation, TCAPCSL will establish a status diagram for each operation to implement operation management. Component error includes protocol error and response timeout. Protocol error means that the component type received by TCAPCSL is not in conformity with the expected input of the operation status diagram, or the component format has syntax errors or it is unidentifiable. Response timeout refers to the timeout of various operation timers. TCAPCSL can allocate dialog components by managing dialog IDs. 2. Function classification The function of the layered TCAP module is shown in Figure 29.
F I G U R E 2 9 F U N C T I O N S O F T C AP L A Y E R E D M O D U L E
TC-user TC-Primitive
CHA DHA CCO ISM
CSL TR-Primitive TSL TCAP NPrimitive SCCP
Where: The function of the CHA module of TCAPCSL is to conduct component processing. It mainly achieves the interaction of TC component processing primitives between TCAP and TC-user, and manages each operation invocation.
73
The function of the DHA module of TCAPCSL is to conduct dialog handling. It mainly achieves the interaction of TC dialog handling primitives between TCAP and the TC-user, as well as the distribution of dialog components. When the CSL receives the normal TC request primitive from the TCuser, the DHA module will send a request to the CHA module for the component part contained in this dialog. When CSL receives an abnormal TC request primitive, the DHA module will send a dialog termination indication to the CHA module to terminate all unfinished operations contained in this dialog. When CSL receives the TR indication primitive, the DHA module will send all components contained in the received dialog to the CHA module to check the component syntax and operation status. The ISM module in the CHA module is the finite state machine of operation invoke. The TCAPCSL of the node initiating the operation request manages various operations via the ISM module. The CCO module in the CHA module is a component coordination module. Each dialog corresponds to one CCO module to generate the components sent by the TC-user and to allocate the components contained in the received dialog to the ISM module for checking. When detecting the component error, the ISM module initiates the rejection mechanism. 3. Operation processing procedure of TCAP components i. Basic handling process Figure 30 illustrates a successful operation processing procedure. In the figure, I in the brackets indicates the operation invoke ID. If the operation fails, TC-user 2 will send a reply error component (RE), and the corresponding TC primitive shall be TC-U-ERROR.
FIGURE 30 A SUCCESSFUL OPERATION PROCESSING PROCEDURE

CSL1 CSL2
Tc user 1
Tc user 2
TC-INVOKErequest
INVIcomponent
TC-INVOKEindication
TC-R-NLindication
RRNLIcomponent
TC-R-NLrequest
TC-R-Lindication
RRLIcomponent
TC-R-Lrequest
The operation invoke IDs in the components are dynamically allocated when a TC-user initiates an operation request. At any moment, multiple operations can be simultaneously executed at the remote end Each operation invoke ID corresponds to a component status map. The peer nodes only respond to this operation, and do not participate in the status management of the operation. The component status map is managed by the TCAPISM. After the
74
operation is completed, the component status map returns to the idle state, at this time, the operation ID is released. The released operation ID must be frozen for a period of time before reuse. The freezing method is specified by the TC-user. TCAP allows two nodes to send operation requests to each other during the implementation of an application service dialog. At this time, the destination will send to the peer end an operation request for information. The second invoking component has its own operation invoking identification number, which is assigned by the destination TC-user. However, this component must return an operation ID to the peer end, which is called associated operation ID, indicating the second operation is requested for the purpose of executing the first operation. The processing procedure of associated operations is shown in Figure 31.User 1 initiates a test request to user 2 in the first place, and the test operation ID is 1.This test has several optional test conditions, which are preset at user 1.After receiving the request, user 2 returns a request for choosing test conditions. The invoking component operation ID is 2 and the associated operation ID is 1.After receiving this request, user 1 sends the selected test conditions, and this test is finally completed by user 2.
FI G U R E 3 1 H AN D L I N G P R O C E S S O F AS S O C I AT E D OP E R AT I O N S
TC user 1 CSL INV1test CSL TC user 2
TC-INVOKE request (1, test) TC-INVOKE indication 2,1,condition selection TC-R-L request 2,test condition TC-R-L indication 1, test result
TC-INVOKE indication 1test
INV2,1,condition selection
TC-INVOKE request
RRL2,test condition
TC-R-L indication 2,test condition
RRL1, test result
TC-R-L request 1, test result
ii. Abnormality handling process Described below are handling processes of several abnormal cases. Timeout handling After each operation invoking component is sent out, the component sublayer (process TCAPISM) will start a related timer. If no response from the peer end is received within a set period of time, this component sublayer will cancel the operation (component status diagram returns idle). At the same time, it will notify the TCuser by using the TC-L-CANCEL indicating primitive. At any time, if the TC-user wishes to cancel an operation under execution, it can notify the component sublayer by using the TC-U-CANCEL request primitive. What is cancelled is only a regional process inside the
75
node, without sending any component notice to the peer end. If a response is received from the peer end after the cancellation, it will be regarded as an illegal message by the component sublayer and rejected. Invalid component handling An illegal component is one that has format errors or inconsistent or unrecognizable type and status diagram. After receiving such kind of components, CSL will execute the rejection process and generate the rejection component (RJ), store it for waiting to be sent, and then notify the TC-user of the reason via the TC-LREJECT indication primitive. The handling of this process is completed in the process TCAPCSL. If a subscriber finds the component semantically wrong or not congruent with the application service specifications, it can also use the TC-U-REJECT primitive to send the rejecting component. After the peer end gets this component, it will use the TC-U-REJECT indicating primitive to notify its user. The TCAP of the receiver determines whether this rejection is from the peer user or from the peer TCAP, according to the problem code found in the component. If a TCAP message contains multiple components and if one component is rejected, then all the subsequent components will be discarded. Of the segmented and transferred return result, if any component is rejected, it means that whole return result is rejected. Even if the operation invoking ID in an illegal component is unrecognizable or an illegal number that is not assigned, the above rejection process should be executed. The only exception is that the received illegal component itself is a rejecting component. Here, the component sublayer needs only to notify its own user, with no need to send any new rejecting component to the peer end. Other abnormalities Other faults refer to component loss, repetition and wrong sequence. For TCAP, the probability for these cases to occur is very small, so they are not taken into consideration by the protocols. Otherwise, it will result in an unnecessary increase of the overhead and reduction of the real time performance. If these cases occur too frequently in a certain application, the connection-oriented network layer service should be employed. If a piece of protocol information (e.g. the charging information) is extremely important, the application protocol should take measures to ensure high reliability of this information. From the operation process we can see that for TCAP, component loss is usually presented as operation response timeout. Component repetition and wrong sequence are normally impossible to detect, unless it is the last returned result component (RRL). In this case, the component sublayer will refuse to process it. 4. Dialog Processing of TCAP i. Basic handling process During a signaling process, session interaction is performed between two peer entities. Dialogs fall into two types: unstructured
76
dialog and structured dialog. in which the unstructured dialog only contains a message without being managed, while the structured dialog message must be provided with a transaction ID to distinguish different dialogs. The allocation and management of transaction IDs are implemented in process TCAPTSL. A basic structured session process includes three stages: start, holding and end. Described below is the END mode of a dialog, covering basic mode and preset mode. Basic mode If a user sends a TR-END request primitive to the transaction sublayer and the end type parameter of the primitive indicates that the transmission is in the basic end mode, The transaction sub-layer will send the END message to the peer after receiving this request. All the previously-stored components belonging to this dialog will also be sent together with this message. After the receiving end receives the END" message and transmits it to the user, it will discard all the not-yet-transmitted components of this dialog. Preset mode This mode indicates that the application entity itself knows when to end the dialog. When the application signaling protocol executes to the specified point, the user will transmit the TR-END request primitive to the transaction sub-layer, and the end type parameter in the primitive indicates that the transmission is in the preset end mode. At this time, the transaction sub-layer will not transmit the END" message to the peer, and the component sub-layer will discard all the not-yet-transmitted components of this dialog. Correspondingly, the peer subscriber also knows when to end the session, and ends this session in the preset mode in the same way. Regardless of the mode to end the dialog, after receiving the request or indication of the corresponding primitive, TCAP will return the transaction status diagram and all status diagrams containing the dialog to the idle status, without checking whether the operation request has received the last return result. ii. Troubleshooting The abnormalities include: Receiving a message, whose destination transaction ID is unobtainable (unidentifiable or unavailable) or an invalid number that has not been allocated; Receiving one message with a legal destination, but the message type is not consistent with the transaction status diagram. In this case, the receiving end (process: TCAPCSL) performs processing as follows according to the source end transaction ID: If the source end transaction ID can not be obtained, then this message is discarded without any handling. This is, neither the aborted message (ABORT) is sent, nor the transaction is ended. If the originating end transaction ID is available, the receiving end will generate an ABORT message marked with the protocol abort
77
cause (P-ABORT) to send to the originating end. After the originating end receives this message and this transaction ID is confirmed to have been allocated, this transaction will be terminated. In a word, the whole wrong TCAP message should be discarded. After the peer end receives the ABORT message, its transaction sublayer will perform the processing as follows: If the subscriber discard message is included in the discard message, the TR-U-ABORT primitive is used to notify the subscriber. If the protocol abortion reason is included in the abortion message the TR-P-ABORT primitive is employed to inform the subscriber. In the above two cases, all of the messages for the transaction that have not been sent are discarded and the transaction status diagram returns to idle.
Broadband SS7
The entire broadband system is divided into the following parts: Physical layer, ATM, Service-Specific Connection-Oriented Protocol (SSCOP), Service-Specific Coordination Function (SSCF), broadband message transfer part of level 3 (MTP3b) and broadband signaling connection control part (B-SCCP). The signaling structure is shown in Figure 32
FIGURE 32 STRUCTURE OF THE BROADBAND SIGNALING SYSTEM

B-SCCP
MTP3b
SSCF LM SSCOP
AAL5
ATM
physical layer
SSCOP
1. Position in System SAAL (Signaling ATM Adaptation Layer) is composed of the Common Part (CP) and the Service-Specific Convergence Sublayer (SSCS). The CP is the common part of different types of SSCSs, which consists of the Common Part Convergence Sublayer (CPCS) and the Segmentation and Reassembly sublayer (SAR). To meet the requirements for transmitting different upper-level information, the SSCS is further
78
divided into Service-Specific Coordination Function sublayer (SSCF) and Service-Specific Connection-Oriented Protocol sublayer (SSCOP), as shown in Figure 33.
F I G U R E 3 3 S AAL S T R U C T U R E
ATM primitive SSCS SSCF service access point
SSCOP SAAL signal CPCS
AAL5 SAR
ATM
service access point
2. Function SSCOP uses unacknowledged data transmission service provided by CPCS and SAR, and at the same time it provides Users (that is, SSCF) with the reliable variable-length Service Data Units (SDUs) transmission service. Functions of SSCOP: i. SD PDU sequence control: Ensures the continuity and completeness of the SD PDU sequence.
ii. Error correction and retransmission: The SSCOP uses the SD PDU sequence number to judge whether the information is lost and then retransmit the lost data. iii. Controlling flows. The sliding window mechanism is used so that the receiver can control the data transmission rate of the sender. iv. Errors will be reported to the layer management part. v. Link hold: If no data is transmitted between two SSCOP users in a longer period of time, the SSCOP can periodically send POLL PDU to confirm whether the link is still in connected state. vi. Local data retrieval: The user SSCF of the SSCOP can use this function to retrieve the data in a sending queue or in the sending buffer. vii. Connection control: Used for connection setup and release and performs re-synchronization upon connection fault. viii.User information transfer: This function allows the transmission of the SSCOP user data through the SSCOP. Here, there are three
79
options: acknowledged data transmission, unacknowledged data transmission, and management data transmission. ix. Detecting and recovering errors in the implementation of the SSCOP. x. Exchanging status information between the receiver and sender.
SSCF
SSCF is an interface layer between SAAL and MTP3b, which cooperates with SSCOP and the Layer Management (LM) to complete the functions of SAAL. 1. Data link setup: Covers link initial location, link detection and entering into service state after successful detection. 2. Data link release: One party originates a release request, and the other party returns a release response message. 3. Providing the upper layer with transparent data transmission service after entering service 4. Allowing the upper layer to take back the unsuccessfully sent data from the SAAL upon link changeover 5. SSCF provides an interface with LM, monitors link transmission quality in real time and interrupt the link if the link quality does not meet the requirements. 6. eporting the congestion of a link to the upper layer so that proper measures can be taken for flow control.
LM
LM is the layer management of the Signaling ATM Adaptation Layer (SAAL). SAAL consists of SSCOP and SSCF. LM corresponds to the logical link layer in the seven-layer OSI model and provides point-to-point link connection, so the main function of the LM is to monitor and manage the link performance and state of connections and handle link fault. The specific functions are as follows: 1. Link state management: LM interacts with SSCF and SSCOP, traces link state and at the same time processes and records errors from SSCF and SSCOP. 2. Managing the test of signaling link: After the SSCOP connection at both ends of a link is completed, the LM enters the data transfer stage to notify the SSCF, and the SSCF will send a test message to the peer end to test whether the link error rate meets the requirements. The LM judges whether the link meets the quality requirements according to MAA_ERROR_IND of the SSCOP and the MAAL_REPORT_IND of the SCCF. 3. Monitoring errors of the in-service links: The LM monitors the error rate of an in-service link, and it will release link if necessary. 4. Monitoring NO CREDIT timeout: The flow control function in SSCOP will disable the receiving if the traffic is too large, so the LM should be able
80
to monitor the duration of such a case. If the duration is too long, the LM should be able to release this link in time. 5. Monitoring the interval between latest two SSCOP recovery events: The LM monitors the SSCOP recovery frequency and should release this link if the interval between two recovery events is less than a threshold.
MTP3b
In addition to the narrowband MTP3 function, MTP3b modifies the following contents: 1. Max. transmission message length 2. Upon changeover, the changeover message changes to extended changeover message (XCO and XCA) 3. The message sequence is different, with three bytes. In the ZXWN SGSN system, the narrowband MTP3 and broadband MTP3b are integrated, which shields the bottom-layer details, provides upper and lower layers with unified interfaces and simplifies the processing, for the convenience of maintenance.
B-SCCP
The broadband signaling connection control part (B-SCCP) is added with the following two parts: Long Unit Data message (LUDT) and Long Unit Data Service message (LUDTS). LUDT is used to transmit data at SCCP nodes in connectionless mode. Without segmentation, LUDT can transfer Network Service Data Unit (NSDU) with up to 3949 octets. LUDT is used for connectionless protocol types 0 and 1. LUDTS is used to notify the source SCCP that: The LUDT cannot be transferred to the destination. LUDTS will be sent only when the return message upon error is configured in LUDT.
RANAP
As shown in Figure 34, RANAP is located at the lowest part of the network layer, and is the user of the transmission layer SCCP. RANAP provides signaling transfer function for the Iu_PS and Iu_CS services and provides resource management function for the Iu interface.
81
F I G U R E 3 4 P O S I T I O N O F R AN AP I N T H E S Y S T E M
GMM/SM/SMS
RANAP
SCCP
MTP3b
The RANAP signaling function is divided into management module and service processing module. The RANAP management module is responsible for the management between CN and RNS, while the service processing module is responsible for the seizure and release of resources between layers. In addition, to implement multi-module management and background management, the RANAP module supports service processing and active/standby changeover. 1. Functions of RANAP management module i. Office maintenance: Responsible for processing status such as signaling point reachability, unreachability and flash and responsible for the real-time synchronization between individual RANAP modules.
ii. Processing overload between offices: The RANAP management module reports to the neighbor office if it detects overload of the local office, and performs load indication and traffic control processing if it receives the overload signal of the neighbor office. iii. Global reset between offices: The RANAP management module will initiate global reset to reset the RANAP resources on both sides of the office, due to reasons such as too long signaling point disconnection time, initial start or synchronization failure of resources of both parties. iv. Resetting resources: The RANAP management module performs such operation if the local office or the peer office needs to reset some resources of the Iu interface. v. Error indication: If an error occurs to the RANAP signal during decoding, the RANAP management module can send an error
82
indication signal to the peer office to notify the peer office according to the actual needs. 2. Functions of RANAP service processing module i. RAB provisioning: During call and PDP context activation, it is necessary to provision service data bearer, and the RANAP initializes the user plane. For the CS domain, the BindingId needs to contain the information about the RANAP module, used for the association between the ALCAP and the signaling connection of the Iu interface of the RANAP module.
ii. Relocation: If the RNS or UE detects that the service quality deteriorates and determines to initiate relocation after measurement of the neighbor RNS, the RNS initiates this relocation process and the CN controls the relocation process to hand over the voice channel to the RNS with high service quality. Relocation involves intra-system relocation and inter-system relocation. iii. Iu interface release: If the RNS detects some errors and needs to release the signaling association of the Iu interface, or the CN does not need the IU signaling association any more, the RNS or CN can initiate the Iu interface release to release the signaling association of the Iu interface and the related resources. iv. SRNS context transfer: The SRNS data forwarding indication process is only used for CN query. In the routing area update from UMTS to GSM, if the SGSN queries the RNS for the context information of the related Rab, after GMM operations such as GSM authentication and encryption, the SGSN will send a SGSN DATA FORWARD COMMAND message to the RNS to ask the RNS to forward the data to the new SGSN. After data transfer, the IuRelease will be initiated. v. SRNS context forwarding: If no Iur interface is available between RNSs in relocation, the original RNS will send the context information to the destination RNS through the SGSN and ask the original RNS to forward the data to the destination RNS. vi. Paging: If a CN service needs communications with a UE, the RANAP initiates the paging process, and the RNS advertises to trigger the service process of the UE (User Equipment). vii. COMMON ID: If the signaling connection of the Iu interface is available and also the IMSI is known, this message (that is, COMMON ID) will be sent to the RNS. The RNS will associate this user ID with the RRC connection. The association will last till the release of the signaling connection of the Iu interface. Based on this association, the RNS will send the paging of the user over this RRC. viii.Invoke Trace: Covers CN invoke trace and RNS invoke trace. It is expected that the peer end will generate the trace record according to its own format. ix. Security mode control: The CN sends the encryption and integrity information to the RNS, and the RNS selects and loads the encryption algorithm to encrypt the signaling and subscriber data.
83
x. Location report: The CN sends a location report request message to the RNS, and the RNS adds the subscriber location message to the location report. The location information interaction between the CN and an MS is implemented in the LCS service operation in L3. xi. Data volume report: Used for the CN to query the RNS for the unsuccessful downlink data volume on the specified Rab. xii. InitialUE message: Used to initiate L3 service processing, such as, paging response, location update request and CM service request. xiii.Fax: Used for the RANAP to provide upper-level services with a service control information transmission mechanism. 3. Functions of RANAP service software i. The service report function involves normal service report and abnormal service report. In normal service, the connection setup and release of the Iu interface will be reported to the background, and at the same time, connection and release faults of the Iu interface and the release fault of the RAB will be reported to the background.
ii. Office reset and reset resource initiation flow: If an office fails, the background can initiate an inter-office reset flow. The RANAP reports the activity test results to the background, and the background judge whether the voice channel is suspended according to related conditions and reset the resources of the suspended connection.
MAP Interface (Mobile Application Part)

The Mobile Application Part, or MAP, is located in the upper layer of the TCAP in the OSI reference model, and only the connectionless mode of the SCCP is used. MAP is a protocol designed for GSM only, located in the upper layer of the TCAP in the OSI reference module and employing the SCCP connectionless mode only. MAP is adopted between SGSN and HLR, and between SGSN and SMS, while standard the BSSAP+ protocol is adopted between SGSN and MSCS/VLR, to establish dialogs and transfer information between different entities.
Position of MAP Signaling in the System

The position of the MAP in the ZXWN SGSN is shown in Figure 35.
84
F I G U R E 3 5 P O S I T I O N O F M AP I N T H E S Y S T E M
SGSN Access component M A P M A P SGSN Database component
HLR/IW MSC TCAP SCCP MTP
Functions of MAP Signaling in ZXWN SGSN

1. Establishment of the dialogs between SGSN and HLR, and between SGSN and IW/GMSC by invoking TC primitives. 2. Cooperating with the access processing module to complete UMTS services by transferring internal messages 3. Querying the database to acquire related information about a subscriber, and informing the database of the latest data of the subscriber to for proper modification.
MAP Signaling Process

The MAP signaling related to the SGSN consists of the following: 1. Location registration and deletion. 2. Relocation: Supporting basic relocation and subsequent relocation. 3. Subscriber management: Covers subscriber location information management and subscriber parameter management. This function is used for SGSN to verify information to the HLR or for the HLR to retrieve information from the SGSN. The function applies to data recovery after SGSN or HLR reset or can be used for normal database updating. 4. After the SGSN is restarted, all of the MS records are marked with Recovery tags, which mean they are subject to verification. When the message from HLR is received, it indicates that the subscriber is still within the control area of the SGSN. At this time, the Recovery tag can be removed. If a location deletion message is received, it will delete the records of this MS. 5. IMEI management: Defines the signaling process when the SGSN queries the EIR for the MS equipment validity. 6. Subscriber authentication, which includes the following steps: i. The SGSN requests the HLR for authentication triplet. This is performed when the authentication triplet kept by the SGSN is lower than the threshold.
85
ii. Requesting the subscriber information from the previous SGSN during the location update, covering authentication parameter group and IMSI.
TM Layer
In the SGSN system, TM (Translate Module) is a part of the MAP. The TM completes relatively independent functions, so it is detached from the software module. The TM manages dialogs between application layers, which can be divided into three parts: Dialog handling unit, service request unit and service execution unit The transformation layer receives the messages sent by MAP, including the dialog handling message and service message. The dialog message is handled and converted into the TC dialog handling primitive, and then sent to TCAP to manage the dialogs between the entities on the same layer. The service messages are converted into the TC component primitives after being encoded through ASN.1 and the component messages are sent to TCAP. In the same way, the transformation layer receives the TCAP message. The dialog message is converted into the MAP dialog message for forwarding. The component message receiving TCAP, after being decoded via ASN.1, sends the service message to the application layer. 1. Dialog handling unit The dialog handling unit receives messages from MAP and TCAP and processes dialog primitives in the messages. The corresponding relationship between the MAP primitive and the TCAP primitive is as follows: i. Correspondence between dialog primitives The corresponding relationship between the MAP dialog primitives and the TCAP dialog primitives is shown in Table 13 and Table 14.
T A B L E 1 3 C O R R E S P O N D E N C E B E T W E E N M AP A N D T C AP D I A L O G P R I M I T I V E S ( 1 )
MAP service-primitive MAP_OPEN request (+ any user specific service primitives) + MAP_DELIMITER request MAP_OPEN response (+ any user specific service primitives) + MAP_DELIMITER request (any user specific service primitives) + MAP_DELIMITER request (any user specific service primitives) + MAP_CLOSE request
TC service-primitive
TC_BEGIN request (+ component handling primitives)
TC_CONTINUE request (Note) (+ component handling primitives) TC_CONTINUE request (+ component handling primitives) TC_END request (+ component handling primitives)
86
MAP_U_ABORT request
TC_U_ABORT request
Note: The TC_END primitive is sent if the MAP_CLOSE primitive is received before the MAP_DELIMITER_REQ primitive.
T A B L E 1 4 C O R R E S P O N D E N C E B E T W E E N M AP A N D T C AP D I A L O G P R I M I T I V E S ( 2 )
MAP service-primitive
TC service-primitive MAP_OPEN indication
TC_BEGIN indication (+ component handling primitives)
(+ user specific service primitives) + MAP_DELIMITER indication (Note 1) First time: MAP_OPEN confirm (+ user specific service primitives) + MAP_DELIMITER indication (Note 1) Subsequent times: (user specific service primitives) + MAP_DELIMITER indication (Note 1) MAP_OPEN confirmation (Note 2) (user specific service primitives) + MAP_CLOSE indication MAP_U_ABORT indication or MAP_P_ABORT indication (Note 3) MAP_OPEN confirmation (Note 4) MAP_P_ABORT indication (Note 5) MAP_OPEN confirmation (Note 6)
TC_CONTINUE indication (+ component handling primitives)
TC_END indication (+ component handling primitives)
TC_U_ABORT indication
TC_P_ABORT indication
Note 1: In version 2, it is allowed not to send this primitive. Note 2: Only when the dialog has not been set up. Note 3: It can be mapped only when the primitive has a MAP_ABORT_PDU (from the opposite provider) or MAP_USER_ABORT_PDU (from the opposite user). Note 4: Only when the dialog has not been established or the Abort Reason" parameter is not supported by the application context. Note 5: When the P Abort value in the TC_P_ABORT indication primitive is not Incorrect Transaction Portion. Note 6: Only when the dialog has not been completely set up and the P Abort parameter value in TC_P_ABORT indication primitive is Incorrect Transaction Portion. ii. Correspondence of the component primitives The corresponding relationship between the MAP component primitives and the TCAP component primitives is shown in Table 15 and Table 16.
87
T A B L E 1 5 C O R R E S P O N D E N C E B E T W E E N M AP C O M P O N E N T P R I M I T I V E S A N D T C AP COMPONENT PRIMITIVE
MAP service-primitive MAP_xx request MAP_xx response (Note 1) MAP_OPEN confirmation (Note 3) (user specific service primitives) + MAP_CLOSE indication
TC-service-primitive TC_INVOKE request TC_RESULT_L request TC_U_ERROR request TC_U_REJECT request TC_INVOKE request (Note 2) TC_END indication (+ component handling primitives)
Note 1: This mapping is determined by the parameters in MAP_XX_RSP primitives. Note 2: Only applicable to the TC 4 operation which transfers the operation results of other TC2 or TC4. Note 3: Only when the dialog has not been set up.
T A B L E 1 6 C O R R E S P O N D E N C E B E T W E E N M AP C O M P O N E N T P R I M I T I V E S A N D T C AP COMPONENT PRIMITIVE
TC-service-primitive TC_INVOKE indication TC_RESULT_L indication (Note 1) TC_U_ERROR indication TC_INVOKE indication (Note 2) TC_L_CANCEL indication TC_U_REJECT indication TC_L_REJECT indication TC_R_REJECT indication
MAP service-primitive MAP_xx indication
MAP_xx confirm
MAP_xx confirm or MAP_NOTICE indication (Note 3)
Note 1: If any component appears, this primitive is used to notify the application upper layer. Note 2: Only applicable to the TC 4 operation which transfers the operation results of other TC2 or TC4. Note 3: When RESULT-NL primitive components exist, they will all be mapped to the same MPA_XX_Confirm primitive. 2. Service request unit If the RSM status of the invocation processor is idle (RSM_IDLE), when the operation request (MAP_XX_REQ) is initiated between the applications in order to perform a service, this unit will encode the parameters belonging to this service, and then it will send TC_INVOKE_REQ to TCAP and shift the RSM status of the call processor to RSM_WAIT_FOR_CONFIRM, as shown in Figure 36. In the same way, when the operation response message (TC_RESULT_L_IND or TC_RESULT_NL _IND) is sent from the peer
88
entity, this unit will first decode this response, and then send the operation confirmation message (MAP_XX_CNF) to MAP.
FIGURE 36 SERVICE REQUEST UNIT
RSM map_req RSM_IDLE tc_invoke_req
tc_result_ind RSM_WAIT _FOR_CON FIRM
map_cnf
Such primitives as map_req and tc_result_ind are received by MAP_DSM, and then such events as service_invoked and result_received are triggered to invoke MAP_RSM handling. 3. Service execution unit If the PSM status of the execution processor is idle (PSM_IDLE), when an operation request from other entity comes, the TCAP will report with TC_INVOKE_IND. After decoding the parameters, this unit will send MAP_XX_IND to the MAP and change the PSM status of the invocation processor to PSM_WAIT_FOR_RESPONSE status, as shown in Figure 37. Similarly, when an execution response (MAP_XX_RSP) is received from the application, this unit will encode the response parameters and then send to TCAP the operation response message (e.g. TC_U_ERROR_REQ, TC_RESULT_NL_REQ and TC_RESULT_LREQ).
FIGURE 37 SERVICE EXECUTION UNIT
RSM map_req RSM_IDLE tc_invoke_req
tc_result_ind RSM_WAIT _FOR_CON FIRM
map_cnf
89
CAP Operations
The CAP operations are similar to the INAP operations, and the only difference lies in parameter contents, since parameters specific to mobile networks are supplemented. At present, CAMEL3 uses CAMEL to control the CS service, as well as the SMS and GPRS services. Therefore, compared with CAMEL2, many new CAMEL operations are added. Table 17 and Table 18 describe separately the operation of PS.
T A B L E 1 7 O P E R A T I O N S F O R A S S O C I A T I O N O F C AP W I T H S M S
CAP Operation Name ActivityTestGprs Gprs
Operation Explanation Activity test operation of CAP dialog of Gprs charging request operation. SCF
ApplyChargingGprs
indicates SSF to charge a certain Camel entity. Gprs cancellation operation. SCF indicates SSF to cancel the monitoring of the entity. Gprs connection operation. SCF indicates SSF to use designated creation of PDP context. Gprs continuing operation. SCF indicates SSF to continue the subsequent procedure. Gprs entity release operation. SSF notifies SCF to release a certain entity. Gprs charging information operation. SCF provides SSF charging additional information. Gprs initial operation. SSF reports to SCF to open CAP dialog. Gprs release operation. SCF indicates SSF to relese a certain Camel entity. Gprs event report operation. SSF reports a certain event to SCF. Gprs request event report operation. SCF requests SSF to report the designated event. Gprs restart timer operation. SCF notifies SSF to restart the timer. Gprs sending charging information operation. SCF notifies SSF to send charging information.
CancelGprs
ConnectGprs
ContinueGprs EntityReleaseGprs
FurnishChargingInfomationGprs
InitialDPGprs ReleaseGprs EventReportGprs
RequestEventReportGprs
ResetTimerGprs
SendChargingInfoGprs
90
T A B L E 1 8 O P E R A T I O N S F O R A S S O C I A T I O N O F C AP W I T H S M S
CAP Operation Name ConnectSMS ContinueSMS
Operation Explanation Connect SMS: Used to set up a SMS connection with party B Continue SMS: Used for SMS connection without changing information Report SMS Event: When the SMS transaction meets a DP point, if the DP point is monitored, the event will be reported to the SCP. Provide charging information: Used for SCP to provide charging information to SSP. Starting DP SMS: Used for the dialog between SSP and SCP Release SMS: Used to release SMS transaction Request the report of SMS event: Used to monitor or cancel SMS DP point. Reset Timer: Used for the SCP to request the SSP to reset the hold timer, to prevent SSP timer timeout
EventReportSMS
FurnishChargingInformationSMS InitialDPSMS ReleaseSMS RequestReportSMSEvent
ResetTimerSMS
GTP Protocol
In the WCDMA backbone network, user data and signaling between GSNs adopt the GTP for tunnel transmission. All point-to-point PDP protocol data units (PDU) are encapsulated via the GTP protocol. The GTP is the interworking protocol between GSNs in the WCDMA backbone network; it is defined for the Gn interface and the Gp interface. The GTP protocol is to implement GTP encapsulation outside the network layer packets (such as IP packets and X.25 packets) to be transmitted so as to add the information of the current mobile subscriber (such as IMSI and TEID); outside the GTP packet, the UDP/IP is adopted to encapsulate the IP addresses of the source and destination GSNs; in this way, packets can be transmitted from the source GSN to the destination GSN in the tunnel mode. The position of GTP in the Gn/Gp interface is shown in Fig. 4.2-2. The GTP protocol comprises path management, tunnel management, location management and mobility management. Introductions are as follows.
Path Management
Path management is to manage the path information between GSNs. The path management message is as follows:
91
1. Echo Request: On a path, one GSN sends the message to another GSN to check whether the peer node exists. This message can be sent on any path in use. That is, there is at least one PDP context towards the other GSN via the path. The time and frequency of sending the echo request message is related with actual implementation. However, the interval between two echo requests sent on each path should not be less than 60s. 2. Echo response: This signaling is response to reply the request message. It contains the recovery information unit, including the local restarting counter value of the GSN that sends the echo response. The GTP-U does not use the restarting counter value; at the transmit terminal, the restarting meter value is 0; at the receive terminal, the value should be omitted. The GSN that receives the peer GSN response compares the restarting meter value with the previously saved peer GSN restarting meter value. If the previous peer GSN restarting meter value is not saved, the restarting meter value should be saved. If the previous GSN restarting meter value is different from the one in the GSN echo response, the GSN receiving the echo response will determine that the GSN sending the echo response has been restarted. 3. Version Not Support: This message only includes the GTP header, indicating the latest GTP version that can be supported by the GTP entity of the UDP/IP address. 4. Supported Extension Headers Notification: This message indicates the extension header supported by the GTP entity identified by the IP address; it is only used when the GTP entity is to understand an obligatory extension header. However, the GSN is not upgraded to support the extension header. By sending this message, the GTP entity in the GSN shows that it does not support some extension headers (to be judged according to the supported extension header list).
Tunnel Management
It is used to manage the tunnels between GSNs. The tunnel management message is as follows: 1. Create PDP Context Request: Create the PDP context request as part of the GPRS PDP context activation procedure, which is sent by the SGSN node to the GGSN node. A valid request will create a tunnel between the SGSN PDP context and the GGSN PDP context. Even if the PDP context is already activated, the SGSN can send a create PDP context request. The GGSN will check whether the PDP context of the MS exists. Parameters of the PDP context will be replaced by parameters in this message. In the case that a dynamic PDP address is allocated for the existing context, the address will be used and duplicated to the create PDP context response message. 2. Create PDP Context Response: This message works as the response to the request to create PDP context, which is sent from the GGSN node to the SGSN node. In the case that the SGSN receives the create PDP context response and the cause value is "accept request" the SGSN will activate the PDP context and start sending the T-PDU from the MS to the external data network, or from the external data network to the MS.
92
3. Update PDP Context Request: This message is sent from SGSN to GGSN as the route update procedure between SGSN and GGSN, or as part of the PDP context modification procedure, or re-allocation of context for load sharing. The message is used to change the QoS and path or to change the tunnel GTP version between the SGSN and the GGSN (from version 0 to version 1). 4. Update PDP Context Response: This message is response to the request to update PDP context, which is sent from the GGSN node to the SGSN node. In the case that the SGSN receives the update PDP context response while the cause value is not "accept request" the SGSN will stop updating PDP context. 5. Delete PDP Context Request: The request to delete the PDP context sent by SGSN to the GGSN node is part of the GPRS separation procedure or the GPRS PDP context deactivation procedure. The request to delete the PDP context request by GGSN to the SGSN node is part of the PDP context deactivation initiated by GGSN. If sent from the GGSN to the SGSN node, the message is a part of the PDP context deactivation originated by the GGSN. It is used to deactivate one or a group of activated PDP contexts on the PDP address allocated to the MS. In the case that it is in conflict with other tunnel messages, the delete PDP context request message enjoys high priority. 6. Delete PDP Context Response: This message is sent as the response to the request to delete the PDP context. In the case that the PDP context does not exist in the message, the GSN node will omit the response of this message. 7. Error Indication: If the GSN has no message to correspond to the PDP context received from the G-PDU, the GSN will send the error indication to the peer end. Upon receiving the error indication, the GSN will delete the PDP context and might inform the operation and maintenance network unit. To receive error indication from the GGSN and delete PDP context, the SGSN will send indications to the MS. 8. PDU Notification Request: As a part of the PDP context activation procedure at the network side, the GGSN sends the PDU notification request to the SGSN in the current location of the MS indicated by the HLR. 9. PDU Notification Response: This message is sent as the response to the request to notify the PDU by SGSN to GGSN. In the case that the cause value of the response is accept request, it indicates that the PDP context activation procedure continues. If the cause value is other value, the PDP context activation procedure will not continue. 10. PDU Notification Reject Request: In the case that the PDU notification response is sent, SGSN performs the PDP context activation process, but the PDP context is not established, SGSN sends the PDU Notification Reject Request message to GGSN. The cause value indicates the reason for not creating the PDP context. 11. PDU Notification Reject Response: This message is sent as the response to the PDU Notification Reject Request message by GGSN to SGSN.
93
Location Management
Location management is used to support the request for PDP context activation originated by the network. If the GGSN does not provide the Gc interface, the GTP protocol is used to transmit control plane messages between the GGSN and the GTP-MAP protocol conversion GSN node. Location management messages include: 1. Send Routing Information for GPRS Request: In the case that the PDP context is not established, GGSN sends the request message to GSN which completes the GTP-MAP protocol conversion, to acquire the IP address of SGSN where MS resides. 2. Send Routing Information for GPRS Response: During the GTP-MAP protocol conversion, GSN sends this message as a response to the GPRS route information request. 3. Failure Report Request: GGSN sends this message to GSN that converts the GTP-MAP protocol, setting the MNRG identification in the HLR. 4. Failure Report Response: The GSN that converts the GTP-MAP protocol sends this message to GGSN as a response to the failure report request. 5. Note MS GPRS Present Request: GSN that converts the GTP-MAP protocol sends this message to GGSN to notify that MS is reachable in GPRS. The GGSN will use the IMSI in the request to find all PDP contexts in the IMSI. The MNRG will be cleared. The IP address of the SGSN in the request will be saved in each detected PDP context. 6. Note MS GPRS Present Response: GGSN sends this message to GSN that converts the GTP-MAP protocol as the response to the "Note MS GPRS Present Request message.
Mobility Management
Mobility management messages belong to control plane messages. They are transmitted between SGSNs of the route upgrade procedure between the GPRS attach and the SGSN. The new SGSN obtains the old SGSN address from the original RAI (Route Area Identifier). Mobility management messages include: 1. Identification Request: The MS changes the SGSN during the GPRS isolation period. When the GPRS attach is performed, the MS sends the P-TMSI to the new SGSN to identify itself; the new SGSN sends the identification request to the old SGSN, requesting for the IMSI. 2. Identification Response: The old SGSN sends the identification response to the new SGSN as the response to the identification request. 3. SGSN Context Request: The new SGSN sends the SGSN context request to the old SGSN to acquire the MM and the PDP context of the MS. 4. SGSN Context Response: The old SGSN sends this message to the new SGSN as the response to the SGSN context request.
94
5. SGSN Context Acknowledge: The new SGSN sends this message to the old SGSN as the response to the SGSN context response message. Upon receiving the SGSN context acknowledge message, the old SGSN starts sending the user packets. The SGSN context acknowledge notifies the SGSN that the new SGSN has correctly received the PDP context information and prepared to receive the user packets indicated by the corresponding tunnel identifier. If the SGSN context request is rejected, this message will not be sent. 6. Forward Relocation Request: The old SGSN sends this message to the new SGSN, to transfer the necessary information for the SRNS relocation procedure between the new SGSN and the destination RNC. 7. Forward Relocation Response: The new SGSN sends this message to the old SGSN as the response to the forward relocation request. 8. Forward Relocation Complete: The new SGSN indicates the successful completion of the SRNS relocation procedure by sending this message. 9. Relocation Cancel Request: When the old SGSN receives the RANAP message that requests the cancellation of relocation by the original RNC, the old SGSN sends this message to the new SGSN. 10. Relocation Cancel Response: When the relocation procedure is canceled in the old SGSN, the new SGSN sends this message to the old SGSN. This message works as the response to the request to cancel the relocation. 11. Forward Relocation Complete Acknowledge: The old SGSN sends this message to the new SGSN as the response to the Forward Relocation Complete message. 12. Forward SRNS Context: This message is used on the core network to perform hardware switching. When the old SGSN receives the RANAP message "forward SRNS context" the old SGSN will send the forward SRNS context message to the new SGSN. The new SGSN will use the corresponding RANAP message to forward the SRNS context message to the destination RNC. 13. Forward SRNS Context Acknowledge: The new SGSN sends this message to the old SGSN as the response to the Forward SRNS Context message.
GTP Protocol
The GTP protocol is the Ga interface protocol between the GSN node and the CG. It is used to send the CDRs from the GSN node to the CG. It comprises two parts: path management and CDR transmission. 1. Path management is to manage the path information between GSN and the CG. Path management provides three signaling to check the availability of the path between the GSN and the CG. It provides a pair of redirection signaling to set up the redundant charging channel. In the case that the CG system is down, the signaling can be used to set up connection with another CG, and CDRs can be transmitted via the new path.
95
2. CDR transmission: The CDR is transmitted by GSN node to the CG. It provides a pair of signaling for the normal CDR transmission (request and response).
96
Chapter
Service Functions
In this chapter, you will learn about: The basic service functions of SGSN The basic service functions of SGSN are: mobility management function, such as access control and rou update; packet route transmission function, such as activation, deactivation, and PDP modification; SMS function, which includes the receiving and sending of SMS via the packet domain.
97
Overview
SGSN provides on the UMTS-PS network the mobility management and the security management of MS (authentication and encryption). SGSN has the session management function, implementing the activation of PDP context initiated on the PDN network side or the MS side, the modification of PDP context, and the deletion of the PDP context. Through the connection of the Gn interface with the GGSN, the SGSN and the external data network (X.25 or IP) are created through the tunnel protocol GTP, and the interconnection between the MS and the external data network is implemented. SGSN can request HLR to insert the MS subscription information, such as packet data protocol PDP information (PDP type, PDP address, and QoS level) and route information, into SGSN, via the Gr interface at the first attaching process of the MS, by connecting the Gr interface and the HLR. SGSN provides the bearer function for SMS, and supports call initiation and SMS receiving on SGSN by the MS. SGSN provides two modes: static/dynamic route. SGSN has the function of CDR collection, and provides the standard Ga interface connecting to the CG and transferring charging information to the CG.
Introduction to Service Functions

The key service functions of SGSN are mobility management function, session management function, packet route transmission function, and SMS function.
Mobility Management
In the packet system, location management is done according to the route area (RA). RA is the subset of location area, that is, one location area can work as one RA, and can also be further divided into a few RAs. Each RA has only one SGSN to provide services. On the Uu interface, the GMM/SM (UMTS PS Mobility Management/Session Management) protocol is adopted to implement the mobility management procedure. The message transmission is supported by utilizing the RRC and the RANAP protocols of the Uu and the lu interfaces. On the network side, the MAP protocol will be adopted between SGSN and HLR (Gr interface) and between SGSN and EIR (Gf interface) to support the mobility management procedure. The Gs interface can be selected between SGSN and MSCS/VLR. The BSSAP+ protocol is adopted to support the mobility management. The packet domain mobility management function is implemented the combination of related users MM contexts by the MS, SGSN, and HLR. The status model of mobility management consists of the following three status:
98
Chapter 5 - Service Functions
PMM-DETACHED: There is no valid MS location or route information in the MS and the SGSN contexts, and the MS is unreachable. PMM-IDLE: The MM contexts of the MS and the SGSN have been created, and the MS can be managed at the RA level, for example, paging the MS. PMM-CONNECTED: The location of MS can be tracked by SRNC, and the MS can go through mobility management at the cell level. MS and SGSN are triggered with different events and change from one status to another among the three. As mentioned above, each status corresponds to a fixed functional level and a series of related information. The status and the related information form the MM context, and maintenance and control are performed in MS and SGSN. One user (or IMSI) corresponds to a unique MM context The PMM status model is shown in Figure 38.
FIGURE 38 MOBILITY MANAGEMENT STATUS MODEL

PMMDETACHED PMMDETACHED
PS Detach PS Attach PS Signalling Connection Release PMM-IDLE SM-ACTIVE or INACTIVE PS Signalling Connection Establish
Detach, PS Attach Reject, RAU Reject
PS Detach PS Attach PS Signalling Connection Release PMM-IDLE
Detach, PS Attach Reject, RAU Reject
PMMCONNECTED SM-ACTIVE or INACTIVE
PMMCONNECTED
SM-ACTIVE or SM-ACTIVE or PS Signalling INACTIVE INACTIVE Connection Establish
Serving RNC relocation
MS MM States
3G-SGSN MM States
Access Control and Security

The security of the PS domain is usually executed with registration, user authentication, identification check, encryption, and other access control management. 1. Network registration security When the MS needs to access the PS domain, it is necessary to first to register. In this way, the IMSI of the user is associated with the route information, related SGSN number, subscription information, and other information of the user. The PS domain registration procedure is coordinated with the MS, SGSN and HLR. The following is an example of a registration. i. MS: Send an Attach request to the SGSN.
ii. SGSN: Notify HLR to update the location.
99
iii. HLR: Insert user data to the SGSN, update the location, and return an acknowledgment to the SGSN. iv. SGSN: Return an Attach receiving message to the MS, and complete the registration procedure. 2. User authentication The PS domain authentication procedure is executed by the MS, SGSN, and HLR, as shown in Figure 39: i. SGSN: Send the authentication message to the HLR. ii. HLR: Return the authentication information acknowledgement to the SGSN (In the case of GPRS, it is triplet and in the case of UMTS, quintuple). iii. SGSN: Send an authentication request to the MS. iv. MS: Return the authentication authentication procedure. response and complete the
FI G U R E 3 9 AU T H E N T I C AT I O N P R O C E D U R E
MS
RNS
SGSN
HLR
Send Authentication Info Send Authentication Info Ack Authentication Request Authentication Response
3. P-TMSI allocation P-TMSI is allocated by SGSN, as shown in Figure 40: i. SGSN: Send to the MS the P-TMSI re-allocation command message. ii. MS: Return to the SGSN the P-TMSI re-allocation complete message P-TMSI signature is an option parameter related to P-TMSI, used for Attach, location update, and other new procedure.
FIGURE 40 P-TMSI REALLOCATION
MS
RNS
SGSN
P-TMSI Reallocation Command P-TMSI Reallocation Complete
100
4. Identification check The identification check procedure is shown in Figure 41: i. SGSN: Send to the MS an identification request. ii. MS: Return to the SGSN an identification response. iii. SGSN: If the IMEI needs to be checked, a check IMEI message is sent to the EIR. iv. EIR: Return to the SGSN a check IMEI acknowledgement.
FIGURE 41 IDENTIFICATION CHECK
MS
RNS
SGSN
EIR
Identity Request Identity Response Check IMEI Check IMEI Ack
5. Encryption The encryption of 2.5G GPRS is implemented between SGSN and MS, whereas the encryption of 3G is done between RNS and MS. The encryption algorithm is notified to RNC by SGSN.
Attach
Before MS accesses the packet data service, it must be attached to GPRS, as shown in Figure 42.
101
FI G U R E 4 2 AT T AC H P R O C E D U R E
MS
UTRAN new SGSN
old SGSN
GGSN
EIR
HLR
1. Attach Request 2. Identification Request 2. Identification Response 3. Identity Request 3. Identity Response 4. Authentication 5a. Update Location 5b. Cancel Location 5c. Cancel Location Ack 5d. Insert Subscriber Data 5e. Insert Subscriber Data Ack 5f. Update Location Ack 6. Attach Accept
7. Attach Complete
i.
MS sends an Attach request to the new SGSN.
ii. The new SGSN sends an identification request to the old SGSN. If the MS is known in the old SGSN, the identification response is returned. If the MS is unknown in the old SGSN, the error cause is returned. iii. If the MS identification is not acquired from the SGSN, the new SGSN will send an identification request to the MS (identification type = IMSI). The MS returns an identification response. iv. Execute authentication, as described in the previous section. v. Execute the location update of the SGSN. vi. The new SGSN: Notifies the MS that its Attach request is accepted, and when necessary, allocates a new P-TMSI to the MS. vii. MS: Returns the Attach complete message to complete the Attach procedure.
Detach
1. MS-initiated isolation is shown in Figure 43
102
FIGURE 43 MS-INITIATED ISOLATION
MS
UTRAN
SGSN
GGSN
MSCS/VLR
1. Detach Request 2. Delete PDP Context Request 2. Delete PDP Context Response 3. GPRS Detach Indication 4. Detach Accept 5. PS Signalling Connection Release
i.
MS initiates an isolation request to the SGSN.
ii. After the SGSN receives the request, it sends to the GGSN a Delete PDP context request. GGSN: Return a response to the Delete PDP context request. iii. SGSN sends to the MSCS/VLR a GPRS isolation indication. iv. SGSN sends to the MS isolation acknowledgment. v. If the MS receives the isolation acceptance message, the SGSN releases the PS signaling connection. 2. The SGSN-initiated isolation is shown in Figure 44.
FIGURE 44 SGSN-INITIATED ISOLATION
MS
UTRAN
SGSN
GGSN
MSCS/VLR
1. Detach Request
2. Delete PDP Context Request 2. Delete PDP Context Response 3. GPRS Detach Indication
4. Detach Accept 5. PS Signalling Connection Release
i.
The SGSN sends an isolation request to the MS.
ii. The SGSN sends to the GGSN a Delete PDP context request. After the GGSN receives the request, it returns a response to the Delete PDP context request. iii. SGSN sends to the MSCS/VLR a GPRS isolation indication.
103
iv. The MS returns the isolation acknowledge message. The isolation request initiated by the SGSN can also request that the MS re-initiates the Attach procedure after the isolation, and activates the PDP context. If the initiation is not done, the release of the PS signaling will be executed after the isolation acceptance message is received. 3. The HLR-initiated isolation is shown in Figure 45
FIGURE 45 HLR-INITIATED ISOLATION
MS
UTRAN
SGSN
GGSN
HLR
MSCS
1. Cancel Location 2. Detach Request 3. Delete PDP Context Request 3. Delete PDP Context Response 4. GPRS Detach Indication 5. Detach Accept 6. Cancel Location Ack 7. PS Signalling Connection Release
i.
If the HLR hopes to delete the MM and the PDP contexts of one user in the SGSN, it can send a location cancellation message to the SGSN.
ii. The SGSN sends a isolation request to the MS after it receives the message. iii. The SGSN sends to the GGSN a Delete PDP context request. GGSN returns a response to the Delete PDP context request. iv. The SGSN sends to the MSCS/VLR a GPRS isolation indication. v. The MS returns the isolation acknowledgment message. vi. The SGSN returns acknowledgment. to the HLR a location cancellation
The SGSN can also request that the MS re-initiates the Attach procedure after the isolation, and activates the PDP context. If it is not necessary to initiate a new request, the release of the PS signaling will be executed after the isolation acceptance message is received.
Purge
After the SGSN purges the MM context and the PDP context, it sends a purge message to the HLR. The HLR will purge the PS domain identification of the MS, and returns an acknowledgment message, as shown in Figure 46
104
FIGURE 46 PURGE
SGSN 1. Purge MS 2. Purge MS Ack
HLR
Route Area Update in SGSN

The route area update in the SGSN (the same with 2.5G and 3G) is shown in Figure 47.
FI G U R E 4 7 R O U T E AR E A U P D AT E I N S GS N
MS
RNS
SGSN
1. Routing Area Update Request 2. Security Functions 3. Routing Area Update Accept
4. Routing Area Update Complete
i.
The MS sends to the SGSN a route area update request. The RNS adds in the request the cell global identification that contains RAC and LAC.
ii. The encryption is activated between the MS and the SGSN. iii. The SGSN updates the MM context of the MS, and when necessary, allocates a new P-TMSI to it. After that, it returns to the MS a route area update acceptance message. iv. If a new P-TMSI is allocated, the MS returns the route area update complete message.
Route Area Update between SGSNs (GSM)

If the MS detects that the route area identification has changed, the route area update is to be performed. The procedure is shown in Figure 48. i. The MS sends to the SGSN a route area update request. The BSC adds in the request the cell global identification that contains RAC and LAC.
ii. The new SGSN authenticates the MS, and sends to the old SGSN an SGSN context request to acquire the MM and the PDP contexts of
105
the MS. The old SGSN receives the message, it returns an SGSN context response. iii. Execute the encryption function. iv. The SGSN returns an SGSN context acknowledgment to the old SGSN. The old SGSn transfers to the new SGSN within a certain period the associated N-PDU. v. The old SGSN transfers data to the new SGSN. vi. The SGSN sends to the GGSN an Update PDP context request. After the GGSN receives the request, it returns a response to the Update PDP context request. vii. The new SGSN sends to the HLR the location update message. viii.The HLR sends to the old SGSN the location cancellation message, and the old SGSN deletes the related MM and the PDP contexts before it returns the location cancellation acknowledgment. ix. Notify the new SGSN to insert user data. The new SGSN creates related MM context before it returns the user data insertion acknowledgment. x. The HLR returns to the new SGSN a location cancellation acknowledgment. xi. The new SGSN re-creates the MM and the PDP contexts of the MM, and allocates to the MS the new P-TMSI. It returns to the MS route area update acceptance message. xii. MS: Returns the route update complete message.
106
FI G U R E 4 8 R O U T E AR E A U P D AT E B E T W E E N S GS N S (GSM)
MS
BSS
new SGSN
old SGSN
GGS N
HLR
1. Routing Area Update Request 2. SGSN Context Request 2. SGSN Context Response C 1 3. Security Functions 4. SGSN Context Acknowledge C2 5. Forward Packets 6. Update PDP Context Request 6. Update PDP Context Response 7. Update Location 8. Cancel Location 8. Cancel Location Ack 9. Insert Subscriber Data 9. Insert Subscriber Data Ack 10. Update Location Ack C3 11. Routing Area Update Accept C4 12. Routing Area Update Complete
Route Area Update between SGSNs (UMTS)

If the MS detects that the route area identification has changed, the route area update is to be performed. The procedure is shown in Figure 49. i. The MS sends to the new SGSN a route area update request. The RNC adds in the request the cell global identification that contains RAC and LAC.
ii. The new SGSN authenticates the MS, and sends to the old SGSN an SGSN context request to acquire the MM and the PDP contexts of the MS. The old SGSN receives the message, it returns an SGSN context response. If the MS is in the PMM-CONNECTED status, the old SGSN needs to send an SRNS context request to the old SRNS to acquire the
107
related sequence No. of the PDP context (including the sequence No. sent to the MS and that needed to be sent to the GGSN via tunnel). iii. Execute the encryption function. iv. The new SGSN returns to the old SGSN an SGSN context acknowledgment. v. The old SGSN transfers to the new SGSN the related N-PDU in a certain period. vi. The SGSN sends to the GGSN an Update PDP context request. After the GGSN receives the request, it returns a response to the Update PDP context request. vii. The new SGSN sends to the HLR the location update message. viii.The HLR sends to the old SGSN the location cancellation message, and the old SGSN sends to the UTRAN a lu release command after it receives the message. After the lu release complete message is received, the old SGSN deletes the related MM and the PDP contexts before it returns the location cancellation acknowledgment. If the MS is in the PMM-CONNECTED status, it needs to release the lu connection. ix. Notify the new SGSN to insert user data. The new SGSN creates related MM context before it returns the user data insertion acknowledgment. x. Return to the new SGSN a location update acknowledgment. xi. The new SGSN re-creates the MM and the PDP contexts of the MM, and allocates to the MS the new P-TMSI. It returns to the MS route area update acceptance message. xii. MS: Returns the route update complete message.
108
FIGURE 49 RA UPDATE BETWEEN SGSNS (UMTS)
MS
BSS
new SGSN
old SGSN
GGSN
HLR
1. Routing Area Update Request 2. SGSN Context Request 2. SGSN Context Response 3. Security Functions 4. SGSN Context Acknowledge C 1 5. Forward Packets 6. Update PDP Context Request 6. Update PDP Context Response 7. Update Location 8. Cancel Location 8. Cancel Location Ack 9. Insert Subscriber Data 9. Insert Subscriber Data Ack 10. Update Location Ack C 2 11. Routing Area Update Accept C 3 12. Routing Area Update Complete
Service RNC Relocation

The service RNC relocation procedure is executed in the PMM-CONNECTED status. The procedure is divided into two steps: 1. Resource reservation: The data service traffic path is not changed. 2. Service RNC switching: The UTRAN connection point is transferred to the destination RNC, and the downlink service traffic is transferred from the old serve RNC to the destination RNC. After the relocation procedure ends, if the route area where the MS resides has changes, the MS will initiate route area update in the PMMCONNECTED status. Figure 50 and Figure 51 are the data traffic diagrams before and after the service RNC relocation.
109
FIGURE 50 BEFORE SRNC RELOCATION
H LR / AuC G G SN old SG SN new SG S N
source SRNC LA1, RA1
target RNC LA2 RA2
MS
FI G U R E 5 1 AF T E R S R N C R E L O C AT I O N
HLR/ AuC GGSN o ld SGSN new SGSN
s o u rc e RNC
ta rg e t SRNC
LA1, RA1
LA2, RA2
MS
The procedure of the service RNC relocation is shown in Figure 52.
110
FIGURE 52 SRNC RELOCATION PROCEDURE

MS Source RNC 1. Decision to perform SRNS relocation 2. Relocation Required 3. Forward Relocation Request 4. Relocation Request Establishment of Radio Access Bearers 4. Relocation Request Acknowledge 5. Forward Relocation Response Target RNC Old SGSN New SGSN GGSN
6. Relocation Command 7. Relocation Commit 8. Forwarding of data 9. Relocation Detect 10. UTRAN Mobility Information 10. UTRAN Mobility Information Confirm 12. Relocatio n Complete 12. Forward Relocation Complete 12. Forward Relocation Complete Acknowledge 13. Iu Release Command 13. Iu Re lease Complete 11. Update PDP Context Request 11. Update PDP Context Response
14. Routing Area Update
1. The SRNC decides to execute an SRNC relocation. 2. The SRNC initiates through sending the Relocation Required message to the old SGSN the relocation procedure, and the message contains relocation type, old ID, destination ID, and other parameters. 3. The old SGSN forwards the relocation request to the new SGSN, and the forwarded relocation request contains TEID, MM context, PDP context, and other parameters. 4. The new SGSN sends the Relocation Request message to the destination RN to perform relocation resource allocation procedure. After the resources are distributed, the destination RNC returns a relocation requestion acknowledgment Relocation Request Acknowledge message to the new SGSN. 5. The new SGSN sends to the Forward Relocation Response message to the new SGSN to notify that the resource distribution is done. 6. The old SGSN sends the Relocation Command message to the SRNC to continue the relocation procedure. 7. After the relocation request message is received. The SRNC activates the data forward timer. During the relocation, the SRNC triggers the
111
relocation message.
procedure
through
sending
the
Relocation
Commit
8. After the Relocation Commit message is sent, the SRNC activates the forward data procedure. 9. After the destination RNC receives the message, it sends the Relocation Detect message to the SGSN. 10. After the destination RNC sends the Relocation Detect message, it sends a UTRAN Mobility Information message to the MS at the same time. Upon reception of the message the MS may start sending uplink user data to the destination RNC. When the MS has reconfigured itself, it sends the UTRAN Mobility Information Confirm message to the destination RNC. This indicates that the MS is also ready to receive downlink data from the destination RNC. 11. After the new SGSN receives the relocation detect message, it initiates to the GGSN the update PDP context procedure. 12. After the destination RNC receives the UTRAN Mobility Information Confirm message, it sends the relocation complete message to the new SGSN, and the new SGSN forwards the message to the old SGSN. The old SGSN receives the forwarded message and returns the acknowledgment message to the new SGSN. 13. The old SGSN initiates the lu interface release procedure to release the lu interface. 14. After relocation procedure, the route area change will activate the route area update.
User Management
If the HLR user subscription data changes or is deleted, insertion or deletion of user data is done through the user management procedure. 1. Inserting user data The user data insertion procedure is shown in Figure 53.
FIGURE 53 USER DATA INSERTION
SGSN 1. Insert Subscriber Data 2. Insert Subscriber Data Ack
HLR
HLR sends to the SGSN the user data insertion message. If the related PDP context is new or is not yet activated, the SGSN stores the data from the HLR, and returns a user data insertion acknowledgment. If the related PDP context is activated, the SGSN will compare the new QoS with the negotiated QoS, and when there is incompliance, initiates the PDP context modification procedure. If the
112
current VPLMN is inconsistent with the new allowed VPLMN address, the PDP context de-activation procedure is initiated. 2. Deleting user data HLR sends to the SGSN the user data deletion message, as shown in Figure 54.
FIGURE 54 USER DATA DELETION
SGSN 1. Delete Subscriber Data 2. Delete Subscriber Data Ack
HLR
If the related PDP context is not yet activated, the SGSN deletes the PDP context, and returns to the HLR the user data deletion acknowledgment. If the related PDP context is activated, the SGSN initiates the De-activate PDP context procedure.
Service Request
The procedure is used as follows: The MS in the PMM-IDLE status utilizes the service request procedure to request the SGSN to establish a secure connection for the uplink sending of link signaling or user data. MS in PMM-CONNECTED status can also request resource reservation for the activated PDP context. When the SGSN is to notify the MS to complete a certain operation, such as network isolation, it discovers that the user is in the PMM-IDLE status. The SGSN will send to the UTRAN a paging request. The page request will trigger the MS service request procedure. The service procedure is shown in Figure 55. 1. MS initiates the service request.
113
FIGURE 55 MS-INITIATED SERVICE REQUEST
MS
RNC
SGSN
HLR
GGSN
1. RRC Connection Request 1. RRC Connection Setup 2. Service Request 3. Security Functions
4. Service Accept
4. Radio Access Bearer Assignment Request 5. Radio Bearer Setup 6. Radio Bearer Setup Complete 6. Radio Access Bearer Assignment Response 7. SGSN-Initiated PDP Context Modification 8. Uplink PDU
2. The network-initiated service request is shown Figure 56:
FIGURE 56 NETWORK-INITIATED SERVICE REQUEST
MS
RNC
SGSN
1. Downlink PDU 2. Paging
HLR
GGSN
2. Paging 3. RRC Connection Request 3. RRC Connection Setup
4. Service Request 5. Security Functions 6. Radio Access Bearer Assignment Request
6. Radio Bearer Setup
6. Radio Bearer Setup Complete
6. Radio Access Bearer Assignment Response
7. SGSN-Initiated PDP Context Modification Procedure 8. Downlink PDU
Session Management Function

The SGSN session function consists of the creation, deletion, and modification of the PDP context. It also consists of the reverse activation
114
function. The purpose of the session function is to maintain a user message, including QoS, route information, access mode, corresponding GGSN address information, and other information. The PDP context is dynamically maintained.
PDP Protocol Status Model

The session management SM is used to manage the user PDP context, receive the PDP session requests from the MS, and create/modify/delete the related PDP contexts in the SGSN. At the same time, according to the different requests of the MS, it initiates to the GGSN different PDP session contexts, to complete the activation/deactivation of the corresponding MS packet data transmission and the modification (such as QoS) of the transmission data. Receive and execute the PDP reverse activation request initiated on the GGSN side. Together with the MM module, create the data transmission channel for the user terminal and the external PDN data network. The session management function of the UMTS-PS network is implemented with a focus on the PDP context activation and de-activation. If the UMTS-PS service requested by a user involves one or more external PDN (such as Internet, X.25), its UMTS-PS subscription data will contain one or more PDP addresses corresponding to the PDN. Each PDP address corresponds to one PDP context. Each PDP context is described with the PDP status and related information, which are stored in the MS, SGSN, and GGSN. One user can have multiple PDP contexts, and all PDP contexts are associated with the only one MM context of the user. There are two PDP status. 1. De-activation: For the data service that the PDP address has not activated, the related PDP context has no route or mapping information. At this time, the MS location update will not cause the update of the PDP context. 2. Activation: For the data service that the PDP address has activated, the related PDP context contains route or mapping information. When the user MM status is waiting or ready, the PDP status can then enter the activated status. The two PDP status are mutually converted with the trigger of related events, with its status model shown in Figure 57.
115
FIGURE 57 PDP STATUS MODEL
INACTIVE
Deactivate PDP Context Activate PDP or Context MM state change to IDLE or PMM -DETACHED
ACTIVE
Activation (GSM)
In the case of the Gb access, the MS requests to initiate the PDP context activation, as shown in Figure 58:
FI G U R E 5 8 P D P C O N T E X T AC T I V AT I O N P R O C E D U R E
MS
BSS
2G-SGSN
2G-GGSN
1. Activate PDP Context Request C1 2. Security Functions 3. Invoke Trace 4. Create PDP Context Request 4. Create PDP Context Response 5. BSS Packet Flow Context Procedures C2 6. Activate PDP Context Accept
The specific procedure is as follows: i. MS initiates to the SGSN the PDP context activation request.
ii. Security authentication may be necessary between the MS and the SGSN.
116
iii. SGSN sends to the BSS the Invoke Trace, which contains TRACE Reference, TRACE Type, and other information. iv. According to the APN provided by the MS, the SGSN resolutes the GGSN address. If the SGSN cannot resolute the GGSN address from the APN successfully, or judge that the activation is invalid, the request will be rejected. If the SGSN can resolute the GGSN address from the APN successfully, a TEID is created for the requested PDP context, and a PDP context creation request is sent to the GGSN. GGSN utilizes the information provided by the SGSN to determine the external PDN, allocate dynamic addresses, start the charging, and constrain the QoS. If the negotiated QoS can be satisfied, a response to the PDP context creation request is returned. If the negotiated QoS cannot be satisfied, a rejection to the PDP context creation requestion is returned to the SGSN. The QoS file is configured by the GGSN operator. v. If the SGSN receives the response to the PDP context creation request by the GGSN, the NSAPI, GGSN address, and dynamic PDP address are inserted in the PDP context. According to the negotiated QoS the radio priority is selected, and the message of the PDP context activation acceptance is returned to the MS. At this time, the route between the MS and the GGSN is created. The charging starts, and the packet data can be transferred. After the SGSN receives the response from the GGSN, it may be necessary to perform management of the BSS packet stream context with the BSS.
Activation (UMTS)
1. MS requests the initiation of the PDP context activation. No matter that the PDP address is static or dynamic, the MS can request to initiate the PDP context activation procedure. The MS-initiated PDP context activation procedure is shown in Figure 59.
FI G U R E 5 9 P D P C O N T E X T AC T I V AT I O N P R O C E D U R E
MS
UTRAN
3G-SGSN
3G-GGSN
1. Activate PDP Context Request
2 Radio Access Bearer Setup 3. Invoke Trace 4. Create PDP Context Request 4. Create PDP Context Response 5. Activate PDP Context Accept
117
The specific procedure is as follows: i. MS initiates to the SGSN the PDP context activation request. ii. The RAB is created through the RAB creation procedure. iii. SGSN sends to the UTRAN the Invoke Trace, which contains TRACE Reference, TRACE Type, and other information. iv. According to the APN provided by the MS, the SGSN resolutes the GGSN address. If the SGSN cannot resolute the GGSN address from the APN successfully, or judge that the activation is invalid, the request will be rejected. If the SGSN can resolute the GGSN address from the APN successfully, a TEID is created for the requested PDP context, and a PDP context creation request is sent to the GGSN. GGSN utilizes the information provided by the SGSN to determine the external PDN, allocate dynamic addresses, start the charging, and constrain the QoS. If the negotiated QoS can be satisfied, a response to the PDP context creation request is returned. If the negotiated QoS cannot be satisfied, a rejection to the PDP context creation requestion is returned to the SGSN. The QoS file is configured by the GGSN operator. v. If the SGSN receives the response to the PDP context creation request by the GGSN, the NSAPI, GGSN address, and dynamic PDP address are inserted in the PDP context. According to the negotiated QoS the radio priority is selected, and the message of the PDP context activation acceptance is returned to the MS. At this time, the route between the MS and the GGSN is created. The charging starts, and the packet data can be transferred. The second PDP context activation procedure is shown in Figure 60.
FI G U R E 6 0 TH E S E C O N D P D P C O N T E X T AC T I V AT I O N
MS
UTRAN
3G-SGSN
3G-GGSN
1. Activate Secondary PDP Context Request
2 . Radio Access Bearer Setup 3. Create PDP Context Request 3. Create PDP Context Response
4. Activate PDP Context Accept
2. Network initiates the PDP context activation.
118
When the PDP address is static, the network can request the PDP context activation procedure. The MS initiates PDP context activation procedure on the home network, as shown in Figure 61. The GGSN receives the PDP PDU of the external PDN, which is to be stored. It sends to the HLR the send GPRS route message. If the HLR judges that the request can be provided with service, it returns the send GPRS route information acknowledgment (IMSI, SGSN address, MS unreachable reason). If the HLR judges that the request cannot be provided with service (for example, the HLR does not know its IMSI), it returns an error response. If the MS is reachable, the GGSN sends a PDU notification request message to the SGSN designated by the HLR. Otherwise the MS is set with an MNRG identification. After the SGSN receives the request message, it returns to the GGSN a response to the PDU notification. The SGSN sends to the MS the PDP context activation request message. The PDP context activation procedure as described by the MO is executed.
FI G U R E 6 1 N E T W O R K -I N I T I AT E D P D P C O N T E X T AC T I V AT I O N P R O C E D U R E (S U C C E S S F U L CASE)
MS
SGSN
HLR
GGSN 1. PDP PDU
2. Send Routeing Info for GPRS 2. Send Routeing Info for GPRS Ack 3. PDU Notification Request 3. PDU Notification Response 4. Request PDP Context Activation 5. PDP Context Activation procedure
The network-initiated PDP context activation procedure is shown in Figure 62.
119
FI G U R E 6 2 N E T W O R K -I N I T I AT E D P D P C O N T E X T AC T I V AT I O N P R O C E D U R E (FAI L E D C AS E )
SGSN
HLR
GGSN
1. PDU Notification Response 2. PDU Notification Reject Request 2. PDU Notification Reject Response 3. Send Routeing Info for GPRS 3. Send Routeing Info for GPRS Ack 4. Failure Report 4. Failure Report Ack
The SGSN sends the PDU notification rejection request to the GGSN, and GGSN will act accordingly. If the IMSI is unknown in the SGSN, GGSN requests to the HLR the route information. If the result of the requested information fails, the GGSN initiates to the HLR the failure report.
PDP Context Modification

1. SGSN initiation SGSN initiates to the GGSN the PDP context activation request. If the negotiated QoS is inconsistent with the PDP context to be modified, the GGSN rejects the update PDP context request. If it is consistent, the GGSN operator will configure the QoS file. If the negotiated QoS can be satisfied, it is stored, and a response to the update PDP context request is returned to the SGSN. Otherwise the request is rejected. The SGSN initiates to the MS the PDP context request. If it is accepted, the MS returns the acceptance message. If it is not accepted, the PDP context is de-activated. The SGSN receives the modification acceptance message, and modifies the radio access bearer through the RAB distribution procedure. After the radio access bearer modification is completed, the SGSN sends an Invoke Trace message to the UTRAN. The procedure is shown in Figure 63.
120
FIGURE 63 SGSN-INITIATED PDP CONTEXT MODIFICATION PROCEDURE
MS
UTRAN
SGSN
GGSN
1. Update PDP Context Request 2. Update PDP Context Response 3. Modify PDP Context Request 4. Modify PDP Context Accept
5. Radio Access Bearer Modification 6. Invoke Trac e
2. GGSN initiation GGSN initiates to the SGSN the PDP context activation request. The procedure is shown in Figure 64. If the negotiated QoS is inconsistent with the PDP context to be modified, the SGSN rejects the PDP context update request. If it is consistent, the SGSN operator will configure the QoS file. If the negotiated QoS can be satisfied, the SGSN will send the PDP context modification request to the MS. If it is accepted, the MS returns the acceptance message. If it is not accepted, the PDP context is de-activated. The SGSN receives the modification acceptance message, and modifies the radio access bearer through the RAB distribution procedure. After the radio access bearer modification is completed, the SGSN returns to the GGSN a response to the PDP context update.
FIGURE 64 GGSN-INITIATED PDP CONTEXT MODIFICATION PROCEDURE
MS
UTRAN
SGSN
GGSN
1. Update PDP Context Request 2. Modify PDP Context Request 3. Modify PDP Context Accept 4. Radio Access Bearer Modification 5. Update PDP Context Response
121
3. MS initiation The MS initiates to the SGSN the PDP context request. The procedure is shown in Figure 65. If the negotiated QoS is inconsistent with the PDP context to be modified, the SGSN rejects the PDP context update request. If it is consistent, the SGSN operator will configure the QoS file. If the negotiated QoS can be satisfied, the SGSN will send the PDP context modification request to the GGSN. GGSN initiates to the SGSN the PDP context update request. The SGSN receives the modification acceptance message, and modifies the radio access bearer through the RAB distribution procedure. After the radio access bearer modification is completed, the SGSN returns to the MS a response to the PDP context modification.
FIGURE 65 MS-INITIATED PDP CONTEXT MODIFICATION PROCEDURE
MS
UTRAN 1. Modify PDP Context Request
SGSN
GGSN
2. Update PDP Context Request 3. Update PDP Context Response 4. Radio Access Bearer Modification 5. Modify PDP Context Accept
De-activation
1. MS initiation The MS initiates to the SGSN the PDP context de-activation request, as shown in Figure 66. The SGSN sends to the GGSN a Delete PDP context request. GGSN returns a response to the Delete PDP context request to release the dynamic PDP address, and to return a response to the SGSN. The SGSN returns to the MS a PDP context de-activation acceptance message. The radio access bearer release is performed through the RAB distribution procedure.
122
FIGURE 66 MS-INITIATED PDP CONTEXT DE-ACTIVATION PROCEDURE
MS
UTRAN
3G -SGSN
3G -GGSN
1. Deactivate PDP Context Request
2. Delete PDP Context Request 2. Delete PDP Context Response 3. Deactivate PDP Context Accept 4. Radio Access Bearer Release
2. SGSN origination The SGSN sends to the GGSN a Delete PDP context request. GGSN returns a response to the Delete PDP context request to release the dynamic PDP address, and to return a response to the SGSN, with the procedure shown in Figure 67. The SGSN initiates to the MS a PDP context de-activation request. The MS deletes the PDP context, and returns to the SGSN a PDP context de-activation acceptance message. The radio access bearer release is performed through the RAB distribution procedure.
FIGURE 67 SGSN-INITIATED PDP CONTEXT DE-ACTIVATION PROCEDURE
MS
UTRAN
SGSN
GGSN
1. Delete PDP Context Request 1.Delete PDP Context Response 2. Deactivate PDP Context Request 2. Deactivate PDP Context Accept 3. Radio Access Bearer Release
3. GGSN initiation The GGSN initiates to the SGSN the PDP context de-activation request, with the procedure shown in Figure 68. The SGSn initiates to the MS the PDP context de-activation request. The MS deletes the PDP context, and returns to the SGSN a PDP context de-activation acceptance message. The SGSN returns to the GGSN a response to the PDP context deletion request. GGSN: Release the dynamic PDP address. The radio access bearer release is performed through the RAB distribution procedure.
123
FIGURE 68 GGSN-INITIATED PDP CONTEXT DE-ACTIVATION PROCEDURE
MS
UTRAN
SGSN
GGSN
1.Delete PDP Context Request 2. Deactivate PDP Context Request 2. Deactivate PDP Context Accept 3.Delete PDP Context Response 4. Radio Access Bearer Release
Addressing Mode
1. MS sends data to external data network MS-SGSN: In the UMTS, GTP is adopted between SGSN and RNC for encapsulation, while PDCP is adopted between RNC and users for encapsulation. In particular, the RAB identity/RAB ID are used in the addressing for the MS. In GPRS, LLC is used between SGSN and MS for encapsulation, and TLLI is used in the addressing for the MS. SGSN-GGSN: According to the GGSN IP address based on the domain name resolution by the APN, the transmission path is established between SGSN and GGSN, and based on it, the PDP PDU of the PDP context is transferred by utilizing the GTP tunnel mechanism. The SGSN maps the IMSIs of the NSAPI and the MS into the TEID, as the GTP header signaling used to encapsulate the PDP PDU into GTP PDU. The TEID is used to identify the GTP PDU and related signaling of the PDP context that is transferred in the tunnels between the SGSN and the GGSN. GGSN-external data network (for example, Internet): The GGSN removes the GTP header encapsulated in user packet data. At this time, the PDP PDU utilizes the PDP address of the external data network (the destination IP address) to discover the destination address. 2. External data network sends data to MS External data network-GGSN: The external data network node routes the PDP PDU sent to the MS to the related GGSN according to the dynamic/static IP address of the MS. GGSN-SGSN: GGSN translates the MS IP address into the TEID and encapsulates the PDP PDU into GTP PDU. According to the storage or the HLR query, it acquires the SGSN IP address and creates tunnels to transmit the GTP PDU to the SGSN. SGSN-MS: SGSN maps the TEID into NSAPI and RAB Identity/RAB ID/TLLI, which are used for radio access side addressing. The GTP PDU is decapsulated and re-encapsulated with PDCP before it is sent to the MS.
124
Packet Route Transmission Function

The packet route transmission function refers to the transmission function of the user packet by the SGSN. On the SGSN user plane, GTP is used for data encapsulation and transfer. To transfer packets of different users on the same physical links, it is necessary to create different tunnels for different users. The tunnel information is stored in the PDP context. At the same time, the SGSN needs to perform route searching before the packets are transferred, and the packets are transferred at the correct physical ports.
SMS Function
UMTS-PS MS can initiate SMS on the SGSN through the Gd interface (MAP protocol) to the SMS/IWMSC and receive the SMS from the SMS/IWMSC. The SGSN has the SMS bearer function. The UMTS-PS MS attaches to the UMTS-PS network and can receive SMS from the SMC. When the UMTS-PS MS initiates SMS or receives SMS, it will not interrupt the ongoing data service of the UMTS-PS MS.
Service Procedure
The PS domain procedure is implemented through the above mentioned basic mobility management procedure and the PDP context control procedure. The PS domain service procedure is different according to the MM status, the PDP status, and related parameters. The following is a typical service procedure example. In the case of access at the Gb interface and the lu interface, the procedure is similar. 1. The MS initiates the packet data service in a certain MM status, as shown in Figure 69: When the MM status is idle, the MS will first execute the mobility management attach procedure, to enter the MM ready status or the MM waiting status. After that the MS can execute the PDP context activation procedure to implement the packet data service. When the MM status is ready or waiting, its service procedure can directly start from step 3 of Figure 69. When the MM status is waiting, if there is no location change, the procedure can directly enter step 3 in Figure 69. If there is a location change, it is necessary to update the location before entering step 3.
125
FIGURE 69 MS INITIATES PACKET DATA SERVICE IN A CERTAIN MM STATUS

MS BSC/RNC SGSN HLR GGSN PDN
1.Create the radio link connection
2.Execute the Attach procedure MS sends the Attach request Acquire identification Encryption and authentication IMEI check (optional) When necessary, location is updated. When necessary, P-TMSI is re-allocated. Complete the Attach.
MM enters the ready or waiting status 3.Execute the PDP context activation procedure MS sends the PDP context activation request Encryption and authentication Create radio bearer link SGSN performs address resolution according to the APN to determine GGSN Create the connection between SGSN and GGSN. SGSN and GGSN create the PDP context, allocate IP addresses, and activate charging.
PDP enters the activated state 4.Transport packets
2. Network-initiated packet data service The network can initiate packet data service for the MS with static PDP address when MM is in a certain status. When MM is in the idle status, the network cannot page the MS, and therefore cannot initiate the packet data service. When the MM status is waiting (Gb access) or idle (lu access), the network needs to first initiate paging to the MS, and then execute the PDP context activation procedure, as shown in Figure 70.
126
FIGURE 70 NETWORK-INITIATED PACKET DATA SERVICE

MS BSC/RNC SGSN HLR GGSN PDN
1.GGSN receives PDP PDU GGSN stores PDU 2 . GGSN acquires from the HLR the MS route information (SGSN address and others) 3.GGSN notifies SGSN to receive the external network PDP PDU
4 . RA4.Page theMS MS within the RA The GMM status enters the ready status 5.SGSN requests to the MS to activate the PDP context 6.MS executes the PDP context activation procedure 6. -MS sends the request to activate the PDP context -SGSN performs address resolution according to the APN to determine the GGSN -Create the tunnel between the SGSN and GGSN -Encryption and authentication -Create the radio bearer link
-SGSN and GGSN create the PDP context, allocate the PDP address, and activate the charging PDP context enters the activated status
7.Transport packets
When the MM status is ready, its service procedure can skip the paging procedure in step 4 of Figure 70.
127
Chapter
Networking Mode and System Configuration

In this chapter, you will learn about: Networking Modes System Configurations
The key function of the SGSN is to implement the mobility management function. In the core network, it is consistent with the position of the MSC SErver. It needs to have interfaces with the RNC, BSC, HLR, MSC SErver, and SMC. At the same time, SGSN is a packet processing node. It has interfaces connecting to GGSN and other SGSNs to perform the data encapsulation and routing functions. Generally speaking, SGSN can be placed in the same equipment room as the GGSN of the local office, or can be placed separately. When the SGSN and the GGSN are connected through the backbone network, the Gn interface of the SGSN needs a firewall device to guard against the attack from the backbone network.
129
Networking Mode
The ZXWN SGSN features flexible networking mode based on the requirements of the operators. The typical networking mode is shown in Figure 71.
FIGURE 71 SGSN NETWORKING
RNC
ZXWN-SGSN
Internet ZXWN-GGSN Firewall
Iu
Router
Gi
RNC
Gb
BSC Signal Nerwork DNS ZXWN-CG ZXWN-OMC
Router
LAN SWITCH
GPRS BACKBONE
Gn
The networking is described as follows: 1. The RNC connects via the lu interface with the ZXWN SGSn in the core network. With considerations of the actual networking requirements, the ZXWN SGSN can provide the Gb access function. When necessary, if the SGSN needs to be additionally configured with 2.5G, the Gb interface needs to be configured. 2. The SGSN and the GGSN switch data via the Gn interface, and the GGSN connects via the Gi interface to the external networks. 3. In the case of PDP activation, the SGSN searches for the GGSN IP address corresponding to the APN. If it is not found in the local SGSN, the GGSN address will be acquired by requesting the DNS. If the local SGSN provides the GGSN address, it is not necessary to query the DNS. 4. The OMC-G manages the SGSN, GGSN and CG through the operation and maintenance port. 5. The charging information of SGSN and GGSN are transmitted via the Ga interface to the CG for further processing.
130
Chapter 6 - Networking Mode and System Configuration
6. When the UMTS-PS network covers a few prefectures, a UMTS-PS backbone network can be formed. The equipment of different prefectures can be connected through the UMTS-PS.
System Configuration
The ZXWN SGSN can be flexibly configured according to the user capacity. In the case of UMTS, the traffic model is uniformly 600bps when user busy at the current time. In the case of 2.5G GPRS, the traffic model is uniformly 180bps when user busy at the current time. In large-capacity networking, the ZXWN SGSN supports up to 2.4 million subscribers, with 4.8 million PDP context activations; in this case, five fully-configured cabinets are needed. A cabinet should is configured with four frames. In the case of small-capacity networking, one cabinet with one frame might be needed; the extra space in the cabinet can be used for routers, firewall, DNS server and CG. A cabinet in full configuration is shown in Figure 72.
FIGURE 72 SGSN CABINET IN FULL CONFIGURATION
Power supply module
SGSNprocessing frame
In the case of small-capacity networking, single cabinet configuration is adopted. The extra space in the cabinet can be used for routers, firewall, DNS server and CG. The small-capacity configuration of the ZXWN SGSN is shown in Figure 73.
131
FIGURE 73 SMALL CAPACITY CONFIGURATION OF SGSN
Power supply module
SGSN processing frame
SGSN processing frame
Router/Firewall
DNS server /CG
SGSN processing frame has 17 slots, in the height of 8U. In the pure lu mode, the smallest configuration is shown in Figure 74. The control boards SMP and OMP, and the switching board UIM adopt 1+1 backup in the frame.
FIGURE 74 SGSN FRAME CONFIGURATION (PURE LU MODE, SMALLEST CAPACITY CONFIGURATION)
2 S G L P
3 S G L P
5 S I U P
6 S I U P
7 S G U P
8 S G U P
10
11
12
13
14
15 C L K G
16 C L K G
17
U S I
S P B
U I M
U I M
O M P
O M P
S M P
S M P
S P B
In the case that a single SGSN frame forms an office, the BUSN frame is adopted. SGLP/SGUP all adopt the MNIC board. The SGLP user plane flow is 60M, and the SGUP user plane flow is 60M. The SGUP ARM processes 50,000 packets of service, and the SGLP ARM processes 75,000 packets of service. SIUP adopts the APBE board, each board providing the processing capacity of 100M data stream. On the control plane, each board processes 100,000 packets of service.
132
In the case that the lu mode single frame forms an office, the fixed positions of the boards in the slots are as follows: CLKG is fixed in slots 15 and 16 of the BUSN. OMP is fixed in slots 11 and 12 of the BUSN frame. SMP is fixed in slots 13 and 14. USI interface board is fixed in slot 1 of the BUSN frame. SPB board is fixed in slot 17, using slot 4 to share the load. SGLP is fixed in slots 2 and 3. SIUP is fixed in slots 5 and 6. SGUP is fixed in slots 7 and 8. In the pure Gb interface mode, the smallest system configuration is shown in Figure 75. The control boards SMP and OMP, and the switching board UIM in the frame use 1+1 backup.
FIGURE 75 SGSN FRAME CONFIGURATION (PURE GB MODE, SMALLEST CAPACITY CONFIGURATION)
2 S G L P
3 S G L P
5 S G B P
6 S G B P
7 S G S P
8 S G S P
10
11
12
13
14
15 C L K G
16 C L K G
17
U S I
S P B
U I M
U I M
O M P
O M P
S M P
S M P
S P B
In the case that the Gb mode single frame forms an office, the fixed slots of the boards are similar to the above description in the lu interface case, with the following difference: Slots 5 and 6 are inserted with the SGBP board. Slots 7 and 8 are inserted with the SGSP board. The board insertion rules for other slots are the same as those of the lu mode. The above is the smallest capacity configuration. The control plane and the user plane are in one frame. In the case of large-capacity configuration, it is necessary to separate the control frame and the user frame. The specific configuration needs to be done according to the actual needs. The control frame is the same for the lu access and the Gb access, as shown in Figure 76. In the case of lu
133
access, the user frame is shown in Figure 77, and in the case of the Gb access, the user frame is shown in Figure 78. The insertion methods of the lu interface and the Gb interface access processing boards in one user frame are shown in Figure 79.
FIGURE 76 SGSN FRAME CONFIGURATION (INDEPENDENT CONTROL FRAME)
10
11
12
13 C L K G
14 C L K G
15 C H U B
16 C H U B
17
U S I
U S I
S M P
S M P
S M P
S M P
O M P
O M P
U I M
U I M
O M P
O M P
S P B
FI G U R E 7 7 S GS N FR AM E C O N F I G U R AT I O N (I N D E P E N D E N T I U AC C E S S U S E R FR AM E )
1 S I U P
3 S I U P
5 S G L P
6 S G L P
7 S G L P
10
11 S G U P
12 S G U P
13 S G U P
14 S G U P
15
16
17
U I M
U I M
FI G U R E 7 8 S GS N FR AM E C O N F I G U R AT I O N (I N D E P E N D E N T GB AC C E S S U S E R FR AM E )
1 S G B P
2 S G B P
3 S G B P
4 S G B P
5 S G B P
6 S G L P
7 S G L P
10
11 S G S P
12 S G S P
13 S G S P
14 S G S P
15 S G S P
16
17
U I M
U I M
FI G U R E 7 9 S GS N FR AM E C O N F I G U R AT I O N (H Y B R I D AC C E S S O F I U AN D GB I N T E R F AC E S USER FRAME)
1 S G B P
2 S G B P
3 S G B P
4 S G B P
5 S I U P
6 S I U P
7 S G L P
8 S G L P
10
11 S G U P
12 S G U P
13 S G S P
14 S G S P
15 S G S P
16
17
U I M
U I M
Cases
This section describes a typical SGSN application case, including content analysis and configuration description. This is a common application. For
134
complex cases, please plan the networking and configuration according to the actual needs.
Actual Requirements
In local company in a place intends to construct a WCDMA packet network to access the existing WCDMA packet network. The existing WCDMA network has GGSN, CG, and transmission network equipment, and now the need is to add one SGSN. The SGSN should support 100,000 subscribers (80,000 UMTS subscribers, and 20,000 GPRS subscribers). The traffic model is the basic traffic model (please refer to Appendix B). It is required to access simultaneously the Gb interface. ATM interface is adopted between the SGSN and the RNC, FR interface is adopted between the SGSN and the BSC, and Ethernet interface is adopted between the GGSNs.
Networking Analysis
The above requirements are simple relatively. It is only necessary to determine the SGSN equipment. There is no need to construct the transmission equipment and the GSN. Its network architecture is as shown in Figure 80:
FI G U R E 8 0 N E T W O R K AR C H I T E C T U R E
Signaling network constructed BSC Gn Router RNC1 SGSN Firewall Packet backbone network constructed (incl. GGSN and other SGSN) RNC2
Configuration Implementation
The data stream volume of 80,000 UMTS subscribers are 48Mbps, and that of the 20,000 GPRS subscribers (2.5G) is 3.6 Mbps. After calculation, the numbers of the major boards are as follows: 1. SIUP: 1 2. SGUP: 2 3. SGLP: 1 4. SPB: 2 (reliability considered) 5. SMP: 4 (active/standby mechanism) 6. OMP: 2 (active/standby mechanism)
135
7. SGBP: 2 (load sharing backup) 8. SGSP: 2 (1+1 backup) The above listed numbers are the numbers of the processing boards related to the capacity and the data stream volume. In addition, it is necessary to configure OMMP, clock board, monitoring board, and other types of boards.
Features of the Application

The actual application of this SGSN configuration is completed in the initial stage of the network construction. Capacity expansion is needed, with the addition of Gb interface access function, without the need to add GGSN NEs. It is only necessary to add one SGSN. The network structure is simple.
136
Appendix
Traffic Model
As stipulated in Experiment Equipment Specification of 3G Mobile Communications Technology WCDMA Core Network Subsystem by technology experiment expert group for 3G mobile communications, the circuit domain service model is as follows. 1. Number of busy-hour Attach attempts per subscriber: 0.5 2. Number of busy-hour Detach attempts per subscriber: 0.5 3. Busy-hour PDP context activation attempts per subscriber: 1 4. Busy-hour PDP context deactivation attempts per subscriber: 1 5. Busy-hour route area update attempts per subscriber: 1.5 6. Uplink and downlink data volume ratio: 1: 4 7. Average IP packet length: 150Byte 8. Number of busy-hour SMS per subscriber: 0.5 9. Prediction of the data volume of the subscribers: Busy-hour data volume per subscriber: 600bps In the case of pure Gb interface access, the busy-hour data volume per subscriber: 180bps.
137
Appendix
Glossary
Abbreviations and Acronyms A AAA AAL AAL2 AAL5 ABM AC AH ALB ALM AoC APN ASN.1 ASU ATM ATM BGP BPS BR CC CG CI CKDR CKI CLI CM CMP COLI COMM CP Ampere Authentication Authorization Accounting ATM Adaptation Layer ATM Adaptation Layer type 2 ATM Adaptation Layer type 5 ATM BUFFER MANAGE Alternating Current Authentication Header Alarm Box Alarm Advice of Charge Access Point Name Abstract Syntax Notation One ATM switch unit Asynchronous Transfer Mode Asynchronous Transfer Mode Border Gateway Protocol Bits per Second Border Router Country Code Charging Gateway Cell Identity Clock Driver Clock Input Calling Line Identity Connection Management Control Main Processor COnnected Line Identity Communication Common Part Full name
139
Abbreviations and Acronyms CPCS CRC DB DC DDN DHCP DiffServ DPC EIR EMON EPROM FE FISU FR FTAM FTP GCI GE GES GMM GPRS GRE GSM MS GSM PLMN GSN GTP GTP_C GTP_U HDLC HLR HLR HMS HOLD HPLMN HW ICMP ID IETF IKE IMEI
Full name Common Part Convergence Sublayer CycASC Redundancy Check Data Base Direct current Digital Data Network Dynamic Host Configuration Protocol Differentiated Service Destination Point Code Equipment Identity Register Environment Monitor Erasable Programmable Read Only Memory Fast Ethernet Fill-In Signaling Unit Frame Relay File Transfer Access and Management File Transfer Protocol Global Cell Identifier Gigabit Ethernet Gigabit Ethernet Switch GPRS Mobile Management General Packet Radio Service Generic Routing Encapsulation GSM Mobile Station GSM PubASC Land Mobile Network GPRS support Node GPRS Tunneling Protocol GTP Control Plane GTP User Plane High level Data Link Control Home Location Register Home Location Register Hundred MAC Switch Call hold supplementary service Home PLMN High Way line Internet Control Message Protocol IDentification/IDentity/Identifier Internet Engineering Task Force Internet Key Exchange International Mobile station Equipment Identity
140
Appendix B - Glossary
Abbreviations and Acronyms IMSI IMSI IntServ IP IPCP IPsec IPV4 IPv6 ISAKMP ISDN ISUP IW/GMSC Kc L2TP L3 LA LAC LAI LAN LAN LCP LPLMN LSSU MAP MIP MM MNC MO MP MS MS MSC MSC MSISDN MSU MTBF MTP MTP3 MTPL2
Full name International Mobile Station Identity International Mobile Subscriber Identity Integrated Service Internet Protocol IP Control Protocol IP Security Internet Protocol Version 4 IP Version 6 Internet Security Association and Key Management Protocol Integrated Services Digital Network ISDN User Part (of signalling system No.7)
InterWorking MSC/GateWay MSC

Ciphering key Layer2 Tunnel Protocol Layer 3 Location Area Location Area Code Location Area Identity Local Area Network Local Area Network Link Control Protocol Local PLMN Link State Signaling Unit Mobile AppASCation Part Mobile IP Mobility Management Mobile Network Code Mobile Originated Module Processor Mobile Station Mobile Station Mobile Switching Center Mobile Switching Centre Mobile Station International ISDN Number Message Signaling Unit Mean Time Between Failures Message Transfer Part Message Transfer Part Level 3 Message Transfer Part Level 3
141
Abbreviations and Acronyms NAPT NAT NCP NF NM NMC NS NSL NSVC NTP O&M OMC OMM OSI PAP PCM PCR PCR PCU PDCP PDM PDN PDP PDU PLMN POS PPP PPP PPS PSM PSPDN PSTN PTP PW QoS RAC RADIUS RAID RANAP
Full name Network Address Protocol Translator Network Address Translator Network Control Protocol Network Function Network Management Network Management Centre Network Service Narrow band Signal Link Network Service Virtual Connect Network Time Protocol Operations & Maintenance Operations & Maintenance Centre Operate Maintenance Module Open System Interconnection Password Authentication Protocol Pulse Code Modulate Peak Cell Rate Preventive Cyclic Retransmission Packet Control Unit Packet Data Convergence Protocol Power Distribute Module Packet Data Network Packet Data Protocol Protocol Data Unit PubASC Lands Mobile Network PPP Over SDH Point to Point Protocol Point-to-Point Protocol Packet Per Second Peripheral Switching Module Packet Switched PubASC Data Network PubASC Switched Telephone Network Peer To Peer Pass Word Quality of Service Routing Area Code Remote Authentication Dial in User Service Redundant array of independent (or inexpensive) disks Radio Access Network AppASCation Protocol
142
Appendix B - Glossary
Abbreviations and Acronyms RAND REJ REL REQ RLG RLP RNC RNS RR RSVP SAP SAR SCCP SCRC SDH SDRAM SDU SGSN SM SMP SMS SMS/PP SMSCB SMS-SC SN SNM SRES SRNS SS7 SSN STM STP TCAP TCP TCP TEID TM TMSI TOS UDP authentication) REJection RELease REQuest
Full name RANDom number (used for
ReLease Guard signal Radio Link Protocol Radio Network Controller Radio Network Subsystem Radio Resource Resource Reservation Protocol Service Access Point Segmentation and Reassembly Signalling Connection Control Part SCCP routing control Synchronous Digital Hierarchy Synchronous Dynamic Random Access Memory Service Data Unit Service GPRS Support Node Session Management Signal Master Process Short Message Service Short Message Service/Point-to-Point Short Message Service Cell Broadcast Short Message Service - Service Centre Subscriber Number Switching Network Module Signed RESponse (authentication) Serving RNS Signalling System No. 7 Sub-System Number Synchronous Transfer Mode Signalling Transfer Point Transaction Capability AppASCation Part Transfer Control Protocol Transmission Control Pro Tunnel Endpoint IDentifier Translate Module Temporary Mobile Subscriber Identity Type of Service User Datagram Protocol
143
Abbreviations and Acronyms UDP UDR VBR VC VLR VLR VPLMN VPN WAN WCDMA ZXWN
Full name User Datagram Protocol User Data Record Variable Bit Rate Virtual Connect Visit Location Register Visitor Location Register Visited PLMN Virtual Private Network Wide Area Network Wide band Code Division Multiple Access ZhongXing WCDMA Network
144
Figures
Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure Figure 1 WCDMA Networking Structure .........................................................13 2 Networking Structure of the WCDMA Packet Domain ...........................14 3 SGSN structure .............................................................................22 4 SGSN networking (small capacity configuration) ................................24 5 3G signalling processing procedures .................................................25 6 2.5G signalling processing procedure ................................................26 7 software structure..........................................................................27 8 Operating system subsystem structure .............................................28 9 Data Management Structure of the Database .....................................31 10 Network Management structure......................................................35 11 ZXWN SGSN System Structure.......................................................39 12 Gn Interface ................................................................................50 13 Structure of Iu-PS Interface...........................................................52 14 Structure of V5.2 InterfaceProtocol .................................................53 15 Structure of the Gr Interface Signaling ............................................54 16 Ga Interface ................................................................................55 17 Gd Interface ................................................................................55 18 Gs Interface ................................................................................56 19 Structure of Narrowband SS7.........................................................60 20 Message Format of MSU ................................................................61 21 Message Format of LSSU...............................................................61 22 Message Format of FISU ...............................................................61 23 MTP3 System Architecture .............................................................64 24 Functional Module Structure of SCCP...............................................67 25 SCCP Connectionless Service Transmission Process ...........................68 26 Connection-oriented Transmission Process .......................................69 27 Signaling Connection Establishment and Rejection Processes ..............70 28 TCAP Layered Structure ................................................................72 29 Functions of TCAP Layered Module..................................................73 30 A Successful Operation Processing Procedure ...................................74 31 Handling Process of Associated Operations.......................................75 32 Structure of the Broadband Signaling System...................................78 33 SAAL Structure ............................................................................79 34 Position of RANAP in the System ....................................................82 35 Position of MAP in the System ........................................................85 36 Service Request Unit ....................................................................89 37 Service Execution Unit ..................................................................89 38 Mobility Management Status Model .................................................99 39 Authentication Procedure ............................................................ 100 40 P-TMSI Reallocation.................................................................... 100 41 Identification Check.................................................................... 101 42 Attach Procedure ....................................................................... 102 43 MS-initiated Isolation.................................................................. 103 44 SGSN-initiated Isolation .............................................................. 103 45 HLR-initiated Isolation ................................................................ 104 46 Purge ....................................................................................... 105 47 Route Area Update in SGSN......................................................... 105 48 Route Area Update between SGSNs (GSM) .................................... 107 49 RA Update between SGSNs (UMTS) .............................................. 109 50 Before SRNC relocation ............................................................... 110
145
Figure 51 After SRNC Relocation ................................................................ 110 Figure 52 SRNC Relocation Procedure ......................................................... 111 Figure 53 User Data Insertion .................................................................... 112 Figure 54 User Data Deletion ..................................................................... 113 Figure 55 MS-initiated Service Request ....................................................... 114 Figure 56 Network-initiated Service Request ................................................ 114 Figure 57 PDP Status Model ....................................................................... 116 Figure 58 PDP Context Activation Procedure................................................. 116 Figure 59 PDP Context Activation Procedure................................................. 117 Figure 60 The Second PDP Context Activation .............................................. 118 Figure 61 Network-initiated PDP Context Activation Procedure (Successful Case) ...................................................................................................... 119 Figure 62 Network-initiated PDP Context Activation Procedure (Failed Case) ..... 120 Figure 63 SGSN-initiated PDP Context Modification Procedure......................... 121 Figure 64 GGSN-initiated PDP Context Modification Procedure......................... 121 Figure 65 MS-initiated PDP Context Modification Procedure............................. 122 Figure 66 MS-initiated PDP Context De-activation Procedure........................... 123 Figure 67 SGSN-initiated PDP Context De-activation Procedure ....................... 123 Figure 68 GGSN-initiated PDP Context De-activation Procedure....................... 124 Figure 69 MS Initiates Packet Data Service in a Certain MM Status .................. 126 Figure 70 Network-initiated Packet Data Service ........................................... 127 Figure 71 SGSN Networking....................................................................... 130 Figure 72 SGSN Cabinet in Full Configuration ............................................... 131 Figure 73 Small Capacity Configuration of SGSN ........................................... 132 Figure 74 SGSN Frame Configuration (Pure lu Mode, Smallest Capacity Configuration) .................................................................................. 132 Figure 75 SGSN Frame Configuration (Pure Gb Mode, Smallest Capacity Configuration) .................................................................................. 133 Figure 76 SGSN Frame Configuration (Independent Control Frame) ................. 134 Figure 77 SGSN Frame Configuration (Independent Iu Access User Frame)....... 134 Figure 78 SGSN Frame Configuration (Independent Gb Access User Frame)...... 134 Figure 79 SGSN Frame Configuration (Hybrid Access of Iu and Gb Interfaces User Frame)............................................................................................ 134 Figure 80 Network Architecture .................................................................. 135
146
Tables
Table 1 Typographical Conventions .............................................................. viii Table 2 Mouse Operation Conventions .......................................................... viii Table 3 Safety Signs....................................................................................ix Table 4 Power Consumption Parameters of the ZXWN SGSN.............................41 Table 5 Environment Temperature and Humidity Requirements.........................41 Table 6 ZXWN SGSN Interface Indices ..........................................................42 Table 7 ZXWN SGSN Typical Capacity Indices.................................................42 Table 8 ZXWN SGSN Reference Traffic Model .................................................43 Table 9 ZXWN SGSN Clock Indices ...............................................................43 Table 10 ZXWN SGSN Reliability Indices ........................................................44 Table 11 Power Module Indices ....................................................................45 Table 12 Board Power Consumption Indices ...................................................47 Table 13 Correspondence between MAP and TCAP Dialog Primitives (1) .............86 Table 14 Correspondence between MAP and TCAP Dialog Primitives (2) .............87 Table 15 Correspondence between MAP Component Primitives and TCAP Component Primitive ...........................................................................88 Table 16 Correspondence between MAP Component Primitives and TCAP Component Primitive ...........................................................................88 Table 17 Operations for Association of CAP with SMS ......................................90 Table 18 Operations for Association of CAP with SMS ......................................91
147

Sjzl20060120-ZXWN SGSN (V3.0) Technical Manual

Încărcat de

Informații document

Descriere originală:

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Sjzl20060120-ZXWN SGSN (V3.0) Technical Manual

Încărcat de

Drepturi de autor:

Formate disponibile

ZXW10 3G Mobile Communication WCDMA System

ZTE CORPORATION Values Your Comments & Suggestions!

Add more/better quick reference aids Add more detail

Hardware Structure .............................................................................................. 22

System Features .................................................................................................. 36

Interface and Communication ................................................................ 49

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

Service Functions .................................................................................... 97

Networking Mode and System Configuration ...................................... 129

A .............................................................................. 137 B .............................................................................. 139

Traffic Model.......................................................................................... 137

Glossary ................................................................................................. 139

Figures........................................................................................ 145 Tables ......................................................................................... 147

Confidential and Proprietary Information of ZTE CORPORATION

About this Technical Manual

Purpose of this Technical Manual

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

TABLE 1 TYPOGRAPHICAL CONVENTIONS

CAPS Constant width [] {} |

Mouse Operation Conventions

Typeface Click Double-click Right-click Drag

Confidential and Proprietary Information of ZTE CORPORATION

About this Technical Manual

Erosion: Beware of erosion.

No flammables: No flammables can be stored.

No touching: Do not touch.

No smoking: Smoking is forbidden.

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

How to Get in Touch

Confidential and Proprietary Information of ZTE CORPORATION

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

DNA Distributed Network Architecture

Confidential and Proprietary Information of ZTE CORPORATION

FIGURE 1 WCDMA NETWORKING STRUCTURE

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

Position of SGSN in WCDMA

The description of the interfaces is as follows:

Confidential and Proprietary Information of ZTE CORPORATION

Confidential and Proprietary Information of ZTE CORPORATION

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 2 - System Architecture

3. 3G TS22.060: General description; Stage 1

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 2 - System Architecture

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

Hardware Architecture Diagram

SGLP SIUP UIMP

to IP network GSN node STM-1 ATM(RNC) L1 Switching Frame GLI

SGUP GE Resource Frame GLI PSN GLI

Confidential and Proprietary Information of ZTE CORPORATION

Chapter 2 - System Architecture

Confidential and Proprietary Information of ZTE CORPORATION

ZXWN SGSN (3.0) Serving GPRS Support Node Technical Manual

FIGURE 4 SGSN NETWORKING (SMALL CAPACITY CONFIGURATION)