S.no.

Topics
1.
2.
3.
4.

5.

6.

7.
8.
9.
10.

11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.

PSTN network
GSM introduction
GSM concept
GSM Architecture
Base Station Subsystem(BSS)
-BTS
-BSC
-TRC
MSC
HLR
VLR
EIR
AUC
OSS
GSM Identities
IMEI
CGI
LAI
MSISDN
MSRN
IMSI
TMSI
Mobile LU
-IMSI Attach
-IMSI Detach
Handovers in HPLMN
Types of Handovers in VPLMN
General Roaming Concept
Call flow
Mobile Originating Call
Mobile Terminating Call
Mobile Terminating Calls in Roaming
Introduction to Intelligent Network(IN)
Basics of SS7 Architecture used in IN
IN services
Differentiate between Prepaid and Post-paid
Prepaid and Post-Paid Call flow
Understanding of IN components
Types of Recharges
IVR Voucher Refill & Enquiry
USSD Voucher Refill & Enquiry
VAS Services
SMS Call Flow
GPRS Call Flow
Circuit switching and Packet Switching
MNP

Public switched telephone network

The public switched telephone network (PSTN) is the aggregate of the world's circuitswitched telephone networks that are operated by national, regional, or local telephony operators,
providing infrastructure and services for public telecommunication. The PSTN consists of telephone
lines, fibre optic cables, microwave transmission links, cellular networks, communications satellites,
and undersea telephone cables, all interconnected by switching centres, thus allowing any
telephone in the world to communicate with any other. Originally a network of fixedline analog telephone systems, the PSTN is now almost entirely digital in its core network and
includes mobile and other networks, as well as fixed telephones.
Most automated telephone exchanges now use digital switching rather than mechanical or analog
switching. The trunks connecting the exchanges are also digital, called circuits or channels. However
analog two-wire circuits are still used to connect the last mile from the exchange to the telephone in
the home (also called the local loop). To carry a typical phone call from a calling party to a called
party, the analog audio signal is digitized at an 8 kHz sample rate with 8-bit resolution using a special
type of nonlinear pulse code modulation known as G.711. The call is then transmitted from one end
to another via telephone exchanges. The call is switched using a call set up protocol (usually ISUP)
between the telephone exchanges under an overall routing strategy.
The call is carried over the PSTN using a 64 kbit/s channel.

GSM - Global Systems for Mobile Communication

A GSM system is basically designed as a combination of three major sub subsystems: The
Network Subsystem, the radio subsystem and the operational support subsystem. In order
to ensure that network operators will have several sources of cellular infrastructure
equipment, GSM decided to specify not only the air interface, but also the main interfaces
that identify three dominant interfaces, namely, an interface between MSC and BSC(A
interface) , one between BSC and BTS( A bis-interface) and one between BTS and MS( air
interface).

The GSM standard was developed as a replacement for first generation (1G) analog cellular
networks, and originally described a digital, circuit-switched network optimized for full
duplex voice telephony. This was expanded over time to include data communications, first
by circuit-switched transport, then packet data transport via GPRS (General Packet Radio
Services) and EDGE (Enhanced Data rates for GSM Evolution or EGPRS).Subsequently,
the 3GPP developed third generation (3G) UMTS standards followed by fourth generation
(4G) LTE Advanced standards, which are not part of the ETSI GSM standard.

GSM networks operate in a number of different carrier frequency ranges (separated

into GSM frequency ranges for 2G and UMTS frequency bands for 3G), with most 2G GSM
networks operating in the 900 MHz or 1800 MHz bands. Where these bands were already
allocated, the 850 MHz and 1900 MHz bands were used instead (for example in Canada and
the United States). In rare cases the 400 and 450 MHz frequency bands are assigned in some
countries because they were previously used for first-generation systems.

There are fourteen bands defined in 3GPP TS 45.005, which succeeded 3GPP TS 05.05:

System

T-GSM380

T-GSM410

GSM-450

Band Uplink (MHz)

Downlink

Channel

Equivalent UMTS/LTE

(MHz)

number

band

380

380.2389.8

390.2399.8

dynamic

410

410.2419.8

420.2429.8

dynamic

450

450.6457.6

460.6467.6

259293

31

GSM-480

480

479.0486.0

489.0496.0

306340

GSM-710

710

698.2716.2

728.2746.2

dynamic

GSM-750

750

747.2762.2

777.2792.2

438511

810

806.2821.2

851.2866.2

dynamic

27

850

824.2849.2

869.2894.2

128251

900

890.0915.0

935.0960.0

1124

900

880.0915.0

925.0960.0

900

876.0915.0

921.0960.0

900

870.4876.0

915.4921.0

1,710.2

1,805.2

1,784.8

1,879.8

1,850.2

1,930.2

1,909.8

1,989.8

T-GSM810

GSM-850

P-GSM900

E-GSM900

R-GSM900

T-GSM900

DCS-1800 1800

PCS-1900 1900

9751023, 0124

12

9551023, 0124

dynamic^

512885

512810

Bands 2 and 5 (shaded in blue) have been deployed in NAR and CALA
Bands 3 and 8 (shaded in yellow) have been deployed in EMEA and APAC
All other bands have not seen any commercial deployments
P-GSM, Standard or Primary GSM-900 Band
E-GSM, Extended GSM-900 Band (includes Standard GSM-900 band)

R-GSM, Railways GSM-900 Band (includes Standard and Extended GSM-900 band)
T-GSM, Trunking-GSM

GSM Architecture

Base Station System (BSS)

The BSS is divided into these functional units:

Base Transceiver Station (BTS)/RBS

The BTS is the radio equipment needed to serve one cell. It contains the antenna system,
transmitters, receivers, and digital signalling equipment. The primary responsibility of the
BTS is to transmit and receive radio signals from a mobile unit over an air interface. To
perform this function completely, the signals are encoded, encrypted, multiplexed,
modulated, and then fed to the antenna system at the cell site. In order to keep the mobile
synchronized, BTS transmits frequency and time synchronization signals over frequency
correction channels.The BTS separates the MS-originated circuit-switched calls from packet
data communication, before the BSC forwards CS calls to the MSC/VLR, and PS data to the
SGSN.

Base Station Controller (BSC)

The BSC controls and supervises a number of BTSs and radio connections in the system. The
BSC has the functionality to set up, supervise and disconnect circuit-switched and packetswitched calls. It is a high capacity switch that provides functions including handover, cell
configuration data, and channel assignment. The BSC must be equipped with GPRS
hardware and software when used for GPRS. One or several BSCs are served by an MSC.

Transcoder Controller (TRC)

The TRC controls and supervises the transcoder resources used by the BSC. The transcoder
is the device that takes the 13 Kbps or 3/6/12 Kbps data and multiplexes four of them, into
standard 64 Kbps data. First the 13 Kbps data is brought up to the level of 16 Kbps by
inserting additional synchronizing data to make up the difference and then four are
combined.

The Network Switching Subsystem (NSS)

The Network switching system (NSS), the main part of which is the Mobile Switching Center
(MSC), performs the switching of calls between the mobile and other fixed or mobile
network users, as well as the management of mobile services such as authentication.
The Switching System (SS) contains the functional units described in the following sections.

Mobile Services Switching Centre (MSC)

The MSC is responsible for setting up, routing, and supervising calls to and from the mobile
subscriber. Short messages, routed from the SMS-GMSC or sent from the Mobile Station
(MS), are relayed in the MSC.

The MSC is a telephony switch that performs all the switching functions for MSs located in a
geographical area as the MSC area. The MSC must also handle different type of numbers
and identities related to the same MS contained in different registers: IMSI, TMSI, ISDN
number, and MSRN. The MSC performs billing on calls for all subscribers based in its areas.
When the subscriber is roaming elsewhere, the MSC obtains data for the call billing from the
visited MSC.

Gateway MSC (GMSC)

The GMSC is an MSC serving as an interface between the mobile network and other
networks, such as the Public Switched Telephony Network (PSTN) and Integrated Services
Digital Network (ISDN) for mobile terminating calls. It contains an interrogation function for
retrieving location information from the subscribers HLR. The GMSC contains functions for
rerouting a call to the MS according to the location information provided by the HLR.

Home Location Register (HLR)

The HLR is a database for storing subscriber information specific to that PLMN. Subscriber
information includes location information and information on services assigned to the
subscriber.
The HLR provides data needed to route calls to all MS-SIMs homes based in its MSC area,
even when they are roaming out of area or in other GSM networks.
The HLR can be implemented in a stand-alone or integrated in the MSC.

Visitor Location Register (VLR)

The VLR temporarily stores information about the MS currently visiting its service area.
In the system, the VLR is integrated with MSC.
When a MS appears in a LA, it starts a registration procedure. The MSC for that area notices
this registration and transfers to the VLR the identity of the LA where the MS is situated.
The information necessary to manage the MS is contained in the HLR and is transferred to
the VLR so that they can be easily retrieved if so required.

Authentication Centre (AUC)

The AUC stores information that is necessary to protect communication through the air
interface against intrusions, to which the mobile is vulnerable. The legitimacy of the user
information is established through authentication and ciphering which protects the user
information against disclosure
The AUC generates triplets used in the authentication of a Subscriber Identity Module (SIM)
card and is used in the ciphering of speech, data, and signalling over the air interface.

Equipment Identity Register (EIR)

In GSM, there is a distinction between subscription and equipment. The EIR is a database
responsible for the validation of the mobile equipment. EIR is a database that stores the

IMEI numbers for all registered ME units. The IMEI uniquely identifies all registered ME.
There is generally one EIR per PLMN. It interfaces to the various HLR in the PLMN.
White List: Assigned to valid MSs. Category of genuine equipment.
Black List: Reported Stolen
Grey List: Contains all MEs with faults (like wrong make, software issues) not important
enough for barring.

Data Transmission Interworking Unit (DTI)/GSM InterWorking Unit (GIWU)

The DTI/GIWU provides the interface necessary for fax and data communication.
DTI consists of hardware and software that provides an interface to various networks for
data communications. Through the DTI, customers can use alternate between speech and
data channels in a single call the same. DTI among other important functions: as a modem
and fax adjustment and ability to adjust speed. Before the DTI, this function is run by the
GSM interworking unit (GIWU).

Operation and Support System (OSS)

For GSM system administration, OSS supports the operator with functions such as mobile
GSM BSC Operation subscriber and cellular network administration, and alarm handling.

Operation and Maintenance Centre (OMC)

The maintenance personnel at the OMC can define the criticality of the alarm. Maintenance
covers both technical and administrative actions to maintain and cover the system
operation, or to restore normal operations after a breakdown, in the shortest possible time.
The fault management functions of the OMC allow network devices to be manually or
automatically removed from or restored to service.
The OMC provides system change control for the software revisions and configuration data
bases in the network entities or uploaded to the OMC.
OSS can be monitored via 2-level adjustment function. Network control centre through the
installation of the Network Management Centre (NMC), with subordinate Operation and
Maintenance Centre (OMC) is very profitable. NMC staff can concentrate on system-wide
issues; where each OMC can concentrate in the short term (short term), regional issues.
OMC and NMC are functionally can be combined in the same physical installation or
implemented in different locations.

Billing Gateway (BGW)

The BGW collects billing information, Call Data Records (CDRs) in files from the network
elements and immediately forwards the information to post-processing systems that use
CDR files as input. The flexible interface of the BGW easily adapts to new types of network
elements, as well.

Service Order Gateway (SOG)

The SOG connects a Customer Administrative System (CAS) and a set of Network Elements
(NEs) to allow the CAS to exchange service data with the NEs. It provides a safe and reliable
connection for updating the GSM network database and eliminates the operators need to
create his own interface to each of the NEs.
The SOG provides a remote interface to the HLR, the AUC, and the EIR. This combines the
subscription management functionality of the HLR/AUC and the equipment management
functionality of the EIR.

Mobile Station (MS)

The MS allows the subscriber to access the network through the radio interface.
MS can be installed in vehicles or can be portable or handheld stations.
The MS consists of:
Mobile Equipment (ME)
The ME consists of radio processing functions and an interface to the user and other
terminal equipment.
Subscriber Identity Module (SIM)
The SIM contains information regarding user subscription and can be used with any mobile
equipment.
The primary functions of the MS are to transmit and receive voice and data over the air
interface of the GSM system. MS performs the signal processing function of digitizing,
encoding, encrypting and modulating of transmitted signals. It also performs the inverse
functions on the received signals from the BS.
In order to transmit voice and data signals, the mobile must be in synchronization with the
system so that the messages are transmitted and received by the mobile at the correct
instant. To achieve this, the MS automatically tunes and synchronizes to the frequency and
TDMA timeslot specified by the BSC.
MS keeps the GSM network informed of its location during both national and international
roaming, even when it is inactive. This enables the system to page in its present LA.

GSM IDENTITIES
GSM must use more than one address and numbering plan to identify the different networks to
which it can be connected. A mobile subscriber can make or receive calls from any location within
the GSM service area. In addition, the subscriber can forward calls and has a high security level
within the system.
INTERNATIONAL MOBILE EQUIPMENT IDENTITY (IMEI)
The IMEI uniquely identifies a Mobile Station (MS) as a piece or assembly of equipment. Using the
IMEI stolen or not type approved, mobiles causing severe malfunctions can be barred.
IMEI = TAC + FAC + SNR + sp
TAC = Type Approval Code
Determined by a central GSM body and identifies the type of equipment.
FAC = Final Assembly Code
The FAC identifies the manufacturer of the equipment
SNR = Serial Number,The SNR is an individual serial number of six digits which uniquely identifies all
equipment within each TAC and FAC.
sp = spare part for future use; this digit should always be zero when it is transmitted by the MS
The IMEI has a total length of 15 digits.
MOBILE STATION ISDN NUMBER (MSISDN)
The MSISDN is a number, which uniquely identifies a mobile telephone subscription in the PSTN
numbering plan.
In GSM 900/1800, the MSISDN consists of the following:
MSISDN = CC + NDC + SN
CC =Country Code
NDC=National Destination Code
SN =Subscriber Number
MOBILE STATION ROAMING NUMBER (MSRN)
The HLR knows which MSC/VLR Service Area a subscriber is located in. When a call is made to a
mobile subscriber, the HLR requests the current MSC/VLR to provide an MSRN as a temporary
routing number for the subscriber that gets the call upon reception of the MSRN, the HLR sends it to
the GMSC that is now able to use this number to route the call to the MSC/VLR exchange where the
subscriber that got the call is registered.
MSRN = CC + NDC or NPA + SN
CC Country Code
NDC= National Destination Code
NPA=Number Planning Area
SN= Subscriber Number
Note: In this case, SN is the address of the MSC exchange.

TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI)

The TMSI is used to protect the subscriber's privacy on the air interface. The TMSI has merely local
significance (that is, within the MSC/VLR area) and hence its structure can be determined by each
operator.
LOCATION AREA IDENTITY (LAI)
The LAI, used for paging, indicates to the MSC in which location area the MS is operating. It is also
used for location updating of mobile subscribers.
The LAI contains the following:
LAI = MCC + MNC + LAC
MCC = Mobile Country Code
MNC = Mobile Network Code
LAC = Location Area Code
The maximum length of LAC is 16 bits, enabling 65,536 different location areas to be defined in one
PLMN.
CELL GLOBAL IDENTITY (CGI)
The CGI is used for cell identification within a location area. The CGI contains the same information
as the LAI and also includes a Cell Identity (CI). The CI has a maximum length of 16 bits.CGI consists
of:
CGI = MCC + MNC + LAC + CI
MOBILE STATION ISDN NUMBER (MSISDN)
The MSISDN is a number which uniquely identifies a mobile telephone subscription within the Public
Switched Telephony Network (PSTN) numbering plan.
In GSM 900 the MSISDN is composed of:
MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number
General Packet Radio Service (GPRS)
Serving GPRS Support Node - SGSN
The Serving GPRS Support Node is a primary component in the GSM network using GPRS. It forwards
incoming and outgoing IP packets addressed to/from a MS that is attached within the SGSN service
area. The SGSN handles packet routing and serves all GPRS subscribers that are physically located
within the geographical SGSN service area. The (packet-switched) traffic is routed from the SGSN to
the BSC, via the BTS to the mobile station.
Gateway GPRS Support Node GGSN
The Gateway GPRS Support Node is the second new node type, introduced to handle GPRS
connections. The GGSN handles the interface to the external IP packet networks and acts like a
router for the IP addresses of all GPRS subscribers in the network.

IMSI Attach
In a GSM network, when a Mobile Station (MS) is switched ON, the International Mobile Subscriber
Identity (IMSI) attach procedure is executed. This procedure is required for the Mobile (MSC)
and Visitor Location Register (VLR) to register the MS in the network. If the MS has changed Location
area (LA) while it was powered off the IMSI attach procedure will lead to an update. When the MS is
switched on, it searches for a mobile network to connect to. Once the MS identifies its desired
network, it sends a message to the network to indicate that it has entered into an idle state.
The Visitor Location Register (VLR) checks its database to determine whether there is an existing
record of the particular subscriber.
If no record is found, the VLR communicates with the subscriber's Home Location Register (HLR) and
obtains a copy of the subscription information. The obtained information is stored in the database of
the VLR. Then an acknowledge message is sent to the MS. Steps for IMSI attach procedure are as
follows:
1. The MS will send a Channel Request message to the BSS on the RACH.
2. The BSS responds on the AGCH with an Immediate Assignment message and assigns an SDCCH to
the MS.
3. The MS immediately switches to the assigned SDCCH and sends a Location Update Request to the
BSS. The MS will send either an IMSI or a TMSI to the BSS.
4. The BSS will acknowledge the message. This acknowledgement only tells the MS that the BTS has
received the message; it does not indicate the location update has been processed.
5. The BSS forwards the Location Update Request to the MSC/VLR.
6. The MSC/VLR forwards the IMSI to the HLR and requests verification of the IMSI as well as
Authentication Triplets.
7. The HLR will forward the IMSI to the Authentication Centre (AuC) and request authentication
triplets.
8. The AuC generates the triplets and sends them along with the IMSI, back to the HLR.
9. The HLR validates the IMSI by ensuring it is allowed on the network and is allowed subscriber
services. It then forwards the IMSI and Triplets to the MSC/VLR.
10. The MSC/VLR stores the SRES and the Kc and forwards the RAND to the BSS and orders the BSS
to authenticate the MS.
11. The BSS sends the MS an Authentication Request message. The only parameter sent in the
message is the RAND.
12. The MS uses the RAND to calculate the SRES and sends the SRES back to the BSS on the SDCCH in
an Authentication Response. The BSS forwards the SRES up to the MSC/VLR.
13. The MSC/VLR compares the SRES generated by the AuC with the SRES generated by the MS. If
they match, then authentication is completed successfully.

14. The MSC/VLR sends the IMEI to HLR which sends it to the EIR for EIR authentication to check if
IMEI is blacklisted or no.
15. The MSC/VLR forwards the Kc for the MS to the BSS. The Kc is NOT sent across the Air Interface
to the MS. The BSS stores the Kc and forwards the Set Cipher Mode command to the MS. The
CIPH_MOD_CMD only tells the MS which encryption to use (A5/X), no other information is included.
16. The MS immediately switches to cipher mode using the A5 encryption algorithm. All
transmissions are now enciphered. It sends a Ciphering Mode Complete message to the BSS.
17. The MSC/VLR sends a Location Updating Accept message to the BSS. It also generates a new
TMSI for the MS. TMSI assignment is a function of the VLR. The BSS will either send the TMSI in the
LOC_UPD_ACC message or it will send a separate TMSI Reallocation Command message. In both
cases, since the Air Interface is now in cipher mode, the TMSI is not compromised.
18. The MS sends a TMSI Reallocation Complete message up to the MSC/VLR.
19. The BSS instructs the MS to go into idle mode by sending it a Channel Release message. The BSS
then deassigns the SDCCH.
20. The MSC/VLR sends an Update Location message to the HLR. The HLR records which MSC/VLR
the MS is currently in, so it knows which MSC to point to when it is queried for the location of the
MS.

IMSI detach is the process of detaching a MS from the mobile network to which it was
connected. The IMSI detach procedure informs the network that the Mobile Station is switched off
or is unreachable.
At power-down the MS requests a signalling channel. Once assigned, the MS sends an IMSI detach
message to the VLR. When the VLR receives the IMSI detach-message, the corresponding IMSI is
marked as detached by setting the IMSI detach flag. The HLR is not informed of this and the VLR
does not acknowledge the MS about the IMSI detach.
If the radio link quality is poor when IMSI detach occurs, the VLR may not properly receive the IMSIdetach request. Since an acknowledgment message is not sent to the MS, it does not make further
attempts to send IMSI detach messages. Therefore the GSM network considers the MS to be still
attached.
Implicit IMSI detach
The GSM air-interface, designated Um, transmits network-specific information on specific broadcast
channels. This information includes whether the periodic location update is enabled. If enabled, then
the MS must send location update requests at time intervals specified by the network. If the MS is
switched off, having not properly completed the IMSI detach procedure, the network will consider
the MS as switched off or unreachable if no location update is made. In this situation the VLR
performs an implicit IMSI detach.

Location Update & Handovers

Let the geographical area be divided in to multiple cells. Where A Cell and B Cell are
served by M BSC and C Cell is served by N BSC.
Lets take Mobile station Present Location is the A Cell. When the Mobile station is in IDLE
state, then it keeps monitoring the BCCH frequency of the Primary (A) Cell and
the Neighbouring (B etc.) Cells. So that cell with the best BCCH signal strength could
be chosen as the primary cell. In this scenario best Signal strength is received from Same (A)
cell, so no location update is needed.
Now lets say, the mobile station was moving and it reached the boundary of A and B cell,
then its sensing the signal strength of the B cell is better than the A Cell. It will mark B cell as
a Primary Cell. Now the mobile BCCH information and compare the Location Area Code (LA)
received in the B Cell with the Previous LA Code of the A cell.
Since both the A and B are come in the same LA, so no location update is needed.
Now the Mobile is continuously travelling, the moment it starts entering in to the C Cell, It
will sense the better BCCH signal strength from C Cell and declare it as a Primary Cell. At this
Point the Mobile found the LA of the previous (B) cell and new (C) cell are different,
so Location Update is needed.
Mobile Station (MS) send a channel request on Random Access Channel (RACH) for location
update to the C BTS. C BTS forward this channel request to N BSC. N BSC allocates a Radio
channels to MS through C BTS for further communication to takes place.
Now mobile station is set on the assigned radio channel and it sends a Location Update
Request along with the old (M TMSI + M LAI) information to the C BTS forward this message
to the N BSC and N BSC forwards this information to the N MSC.
To complete the procedure, BSC sends and an ACK to BTS and BTS sends an ACK to MS.
Now the N MSC checks the LA and found that it does belong to some other MSC. Now it
starts searching the TMSI in its own Database. After completing the search it finds out that
this is a new visitor and has not been registered before to him.
Now the New (N) MSC sends a request (TMSI) to the Old (M) MSC to get IMSI of the MS. As
the MS was previously registered with M MSC, So M MSC found a valid entry for the
corresponding TMSI.
Now the M MSC provides the IMSI to the N MSC for further actions. Now the N MSC has the
IMSI of the MS but doesn't have the subscriber information, which is stored in Home
Location Register (HLR).
HLR is the GSM database, which keeps the following information corresponding to each
IMSI.
1. MSC Pointer, which is presently serving the MS
2. Subscriber Information

N MSC sends the request to HLR, so that HLR can update the MSC pointer (From M to N) and
can provide the subscriber information.
After receiving the request, HLR first update the MSC information and provide the subscriber
information to the N MSC.

Subscriber Information consist of the following :

1. Session Key (Kc) , 64 Bit Ciphering Key
2. RAND , 128 Bit Random Challenge Number
3. SRES, 32 Bit Signed response
This is also called security triplet and used for Authentication Process. Now the new MSC
creates an entry in the MSC VLR and store this security triplet.

At this point the New MSC tells the HLR that it has created a new entry and starts waiting for
HLR response.
The IMSI exists in two MSCs, so one has to be deleted. HLR sends a request to M MSC to
clean the Record for the corresponding IMSI. After deleting the entry, the Old MSC confirm it
to HLR, And HLR send the message back to the new MSC that all the required database now
has been updated.
At this Point new MSC look forward to authenticate the MS. In the authentication
procedure, MSC throws a RAND challenge to MS.
In MS SIM card, a secret Key (Ki) is stored, which is used to compute the SRES and Kc value.
After receiving RAND, Mobile station runs an internal Algorithm to generate the SRES and
Kc. The generated SRES is sent back to MSC. If MSC found that received SRES matches with
its database, then authentication procedure is considered to be completed.
After authentication, N MSC asks N BSC to enable a Ciphering for further communication. N
BSC sends the Ciphering Mode Command to MS to enable the Ciphering. Note that Ciphering
is not yet enabled, so Ciphering Mode Command is not ciphered. At the reception of
Ciphering Mode Command, MS sends the Ciphering Mode Complete message. Note that this
point onwards ciphering is enabled, and Ciphering Mode Complete message is also ciphered.
At the reception N BSC informs N MSC that Ciphering is successfully enabled.
Now MSC assigns a new TMSI to MS through BSC-BTS. Point to be noted here, TMSI
assignment is made only after enabling the ciphering, So that other users wouldn't smell the
TMSI information.
At the reception of the TMSI, MS replies back to MSC that TMSI is allocated successfully. This
point onwards MS use the New TSMI for further communication with the network.
Location update procedure is completed. Now its time to close the channels already open.
At MSC, work is over, so it asks BSC to release the RR channel. BSC send this message to MS
to channel release. In the meantime BSC replies back to the MSC that RR channel is released.
At the reception of channel Release Request, MS send a DISC (disconnect) message to BSC,
and BSC acknowledge this message.

Terminologies used:
1. A control channel is a central channel that controls other constituent radios by
handling data streams. In GSM networks, Control Channels can be broadly divided into 3
categories; Broadcast Control Channel (BCCH), Common Control Channel (CCCH), and
Dedicated Control Channels (DCCH).

2. The Broadcast Control Channel is transmitted by the BTS at all times. The RF carrier
used to transmit the BCCH is referred to as the BCCH carrier. The MS monitors the
information carried on the BCCH periodically (at least every 30 sec), when it is switched
on and not in a call.
3. The Temporary Mobile Subscriber Identity (TMSI) is the identity that is most commonly
sent between the mobile and the network. TMSI is randomly assigned by the VLR to
every mobile in the area, the moment it is switched on. The number is local to a location
area, and so it has to be updated each time the mobile moves to a new geographical
area. A key use of the TMSI is in paging a mobile. "Paging" is the one-to-one
communication between the mobile and the base station. The most important use of
broadcast information is to set up channels for "paging".
4. RR channel-Radio Resource Channel.

ROAMING

A prerequisite for international roaming is connectivity between a Home Public Land

Mobile Network (HPLMN) and a Visited Public Mobile Network (VPLMN) for signalling and
bearer services, e.g., voice and data.
The HPLMN is connected with the VPLMN via the international public switched telephone
network (PSTN) for bearer services. This consists of 64-Kbps circuit-switched voice or data
links. The signalling required for ISUP calls and also to enable roaming is carried over a
logically separate network.
The signalling network carries MAP messages, using SCCP and MTP. An HPLMN and a
VPLMN are connected either directly or via an international signalling network. GSM
operators normally use an international hub to avoid more expensive point-to-point CCS7
links. However, GSM operators also connect directly to the partner networks that carry
heavy roaming traffic, e.g., neighbouring countries. GSM operators usually partner with
more than one operator in a foreign country to ensure reliability.

For international roaming, network nodes in a VPLMN need to communicate with those of a
subscribers HPLMN. For example, the visited network needs to verify if a foreign subscriber
trying to register in its network is authorized and has subscribed to the roaming services.

Communication between a VPLMN VLR and an HPLMN HLR

When a roamer switches ON a mobile station (MS) for the first time in a VPLMN, the VLR
initiates the update location procedure with the roamers HLR. The only information
available to the VPLMN VLR at this time is the IMSI of the roamer. The VPLMN VLR uses this
to derive routing information (SCCP addressing) for communicating with the HPLMN HLR.
The derived address is known as the mobile global title (MGT) or E.214 address.

When responding to the VPLMN VLR, the HPLMN HLR inserts its own E.164 address in the
SCCP message. The E.164 part is used to identify the country and PLMN or PLMN and HLR,
where the roamer is registered.
On receiving an initial response from the HPLMN HLR, a VPLMN VLR then derives the
routing information for subsequent communication with the HPLMN HLR from the calling
party address in the received response.
Each PLMN consists of one logical HLR. In practical implementations, one physical HLR
covering an entire network may not be feasible. In most of the implementations, more than
one HLR may exist, grouped under one logical HLR. The SCCP gateway/GMSC at the edge of
a network decides to route the message received by a VPLMN to the right HLR on the basis
of the MGT in the SCCP called party address.

The Signalling Connection Control Part (SCCP) is a network layer protocol that provides
extended routing, flow control, segmentation, connection-orientation, and error correction facilities
in Signalling System 7 telecommunications networks. SCCP relies on the services of MTP for basic
routing and error detection.
The Message Transfer Part (MTP) is part of the signalling System 7 (SS7) used for communication
in Public Switched Telephone Networks. MTP is responsible for reliable, unduplicated and insequence transport of SS7 messages between communication partners.

Mobile Originating Call flow

Request Access
1. The MS sends a Channel Request (CHAN_REQ) message on the RACH.
2. The BSS responds with a radio resource assignment (IMM_ASS_CMD) on the AGCH.
3. The MS sends a Service Request (CM_SERV_REQ) message to the BSS on the SDCCH.
//(A random-access channel (RACH) is a communication mechanism used by mobile
phones and other wireless devices on a TDMA-based network. The RACH is used to get the
attention of a base station in order to initially synchronize the device's transmission with the
base station.)
Access Grant Control Channel (AGCH) is used by the BTS to assign a dedicated control
channel to a MS.
SDCCH: Stand-alone Dedicated Control Channel. It is used in order to transmit signals as well
as text messages. This makes it possible for short messages to be sent in the form of text.

Authentication
4. Before the network will provide any services to the MS, the network will require the MS to
authenticate itself. The BSS sends an Authentication Request (AUTH_REQ) message to the
MS. The RAND serves as the "challenge" for authentication.
5. The MS calculates the proper SRES based on the RAND that was given and sends the SRES to
the BSS in an Authentication Response (AUTH_RESP) message.
6. The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed
access to the network. The BSS will send a Service Accept (CM_SERV_ACC) message letting
the MS know that the service request was received and processed.
7. Once authenticated, the BSS orders the MS to switch to cipher mode with the
CIPH_MOD_CMD message.
//(Ki is the 128-bit Individual Subscriber Authentication Key utilized as a secret key shared between
the Mobile Station and the Home Location Register of the subscribers home network.
RAND is 128-bit random challenge generated by the Home Location Register.
SRES is the 32-bit Signed Response generated by the Mobile Station and the Mobile Services
Switching Center.
Kc is the 64-bit ciphering key used as a Session Key for encryption of the over-the-air channel. Kc is
generated by the Mobile Station from the random challenge presented by the GSM network and the
Ki from the SIM utilizing the A8 algorithm.)
Initial Call Setup
8. The MS will immediately switch to cipher mode and send a Cipher Mode Complete
(CIPH_MOD_COM) message.
9. The MS then sends a Call Setup (SETUP) message to the BSS. The message includes the
address information (MSISDN) of the called party.
10. The BSS assigns a TCH to the MS by sending an Assignment Command (ASS_CMD) message.
This message includes which Transceiver (TRX) and which Time Slot (TS) to use.

11. The BSS does not actually assign a TCH to the MS until the MSC sends a Call Proceeding
(CALL_PROC) message to the BSS indicating that the IAM has been sent.
12. The MS immediately switches to the assigned TCH. The MS sends an Assignment Complete
(ASS_COM) message back to the BTS on the FACCH.
Remember that a FACCH is not a separate channel; it is simply a stolen time slot from the TCH that is
used for signalling data instead of voice traffic.
(Traffic channels - TCH - are the combination of voice and data signals (time slot assignments) that
exist within a communication channel.)
IAM or Initial Address Message is the first message sent in a call set-up by a Switch or Exchange to
other partner exchange. IAM seizes / reserves a circuit between the exchanges for the call and
contains the information of numbers dialled by the calling party.
Fast associated control channel - FACCH is a logical channel on a digital traffic channel that is
typically used to send urgent signalling control messages The FACCH channel sends messages by
replacing speech data with signalling data for short periods of time.
Call Setup
13. The MSC sends an Initial Address Message (IAM) to the GMSC. The IAM contains the MSISDN
of the called party as the MS dialled it.
14. The MSC will also send a Call Proceeding (CALL_PROC) message down to the BSS and this is
when the BSS would assign a TCH to the MS, as described in step 10 above.
15. Based on the dialled number, the GMSC decides where to route the IAM within the PSTN.
16. The PSTN will continue to route the IAM until it reaches the correct Switching Centre and the
call routing is complete. The PSTN will then establish the call circuit and send an Address
Complete Message (ACM) back to the GMSC.
17. The GMSC then forwards the ACM back to the responsible MSC indicating that the call circuit
has been established

Call Establishment
18. Once the MSC receives the ACM, it sends an ALERT message to the MS indicating that the
call is going through. The BSS sends the ALERT message on the FACCH. Once the MS receives
the ALERT, it will generate the ringing sound in the earpiece. The BSS sends an alerting
message the subscriber will hear the line ringing.
19. Once the called party answers the phone, the PSTN will send an Answer message to the
MSC. The MSC forwards this to the MS in a Connection (CON) message.
20. Once the MS receives the CON message, it switches over to voice and begins the call. All
voice traffic occurs on the assigned TCH.
Call Termination
21. When either the caller or the called party hangs up, the call will be disconnected. Either
party can initiate the disconnect. In this example, the MS initiates the disconnect. The MS
sends a Disconnect (DISC) message to the BTS on the FACCH.
22. The BSS forwards the DISC to the MSC. Once the MSC receives the DISC message, it sends a
Release (REL) message through the GMSC to the PSTN as well as down through the BSS to
the MS.

23. The MS responds by sending a Release Complete (REL_COM) message to the BSS on the
FACCH. The BSS forwards the REL_COM message up to the MSC. Once the MSC receives the
REL_COM message the call is considered ended from the call control perspective.
24. Although the call has ended, the BSS still has a TCH allocated to the MS. The MSC sends a
Channel Release (CHAN_REL) message to the BSS. The BSS forwards the CHAN_REL message
to the MS.
25. The MS responds with a DISC (LAPDm) message and returns to an idle mode. The BSS
reallocates the channel for other call or releases the TRX.

Mobile Terminated Call

In this example, the call is originating from outside the PLMN.
Route Establishment to find the MSC/VLR

1. The calling party dials the MSISDN for the mobile subscriber. The PSTN identifies the
network (PLMN) that the dialled MSISDN belongs to and will locate a GMSC for that
network. The PSTN sends an Initial Address message to the GMSC.
2. The GMSC forwards the MSISDN to the HLR and requests routing information for it. The HLR
looks up the MSISDN and determines the IMSI and the SS7 address for the MSC/VLR that is
servicing the MS.

3. The HLR then contacts the servicing MSC/VLR and asks it to assign a Mobile Station Routing
Number (MSRN) to the call.
The MSC/VLR allocates the MSRN and forwards it to the HLR.
Note: It is important to remember that the MSC/VLR assigns a MSRN to the call not to the MS itself.
4. The HLR forwards the MSRN as well as routing information for the servicing MSC/VLR to the
GMSC.
5. The GMSC sends an Initial Addressing message to the servicing MSC/VLR and uses the MSRN
to route the call to the MSC/VLR. Once the servicing MSC/VLR receives the call, the MSRN
can be released and may be made available for reassignment.
Paging the Mobile Station
6. The MSC/VLR then orders all of its BSCs and BTSs to page the MS. Since the MSC/VLR does
not know exactly which BSC and BTS the MS is monitoring, the page will be sent out across
the entire Location Area.
Initial Setup
7. The MS receives the Page Request (PAG_REQ) on the PCH. The MS recognizes that the page
is intended for it, based on a TMSI or an IMSI.
8. The MS sends a Channel Request (CHAN_REQ) message on the RACH.
9. The BSS responds on the AGCH by sending an Immediate Assignment (IMM ASS) message
which assigns an SDCCH to the MS. At this point, the network does not know that the MS is
the one that it is paging, it only knows that this MS wants access to the network.
10. The MS immediately switches to the assigned SDCCH and sends a Paging
Response (PAG_RES) message on the SDCCH. This lets the network know that the MS is
responding to its page.
Authentication
11. Before the network will provide any services to the MS, the network will require the MS to
authenticate itself. The BSS sends an Authentication Request (AUTH_REQ) message to the
MS. The RAND serves as the "challenge" for authentication.
12. The MS calculates the proper SRES based on the RAND that was given and sends the SRES to
the BSS in an Authentication Response (AUTH_RESP) message.
13. The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed
access to the network.
14. Once the MSC/VLR has authenticated the MS, it will order the BSS and MS to switch to
cipher mode using the CIPH_MOD_CMD message. Once the MS is in encryption mode, the
VLR will normally assign a new TMSI to the MS.
Establishing a Channel
15. Once the MS is authenticated and in encryption mode, The MSC sends a Setup Message to
the BSS, the BSS forwards the SETUP message to the MS on the assigned SDCCH. The SETUP
message may include the Calling Line Identification Presentation (CLIP), which is essentially
caller ID.
16. The MS responds by sending a Call Confirmed (CALL_CON) message; which indicates that the
MS is able to establish the requested connection. The BSS relays the message up to the MSC.

Call Setup
17. The BSS then sends an Assignment Command (ASS_CMD) message to the MS on the
assigned SDCCH. The ASS_CMD message assigns a Traffic Channel (TCH) to the MS.
18. The MS immediately switches to the TCH and responds with an Assignment
Complete (ASS_COM) message on the FACCH. The MS begins ringing once it has established
the TCH.
Remember that all signalling that occurs on the traffic channel actually occurs on a FACCH,
which is a time slot that is stolen from the TCH and used for signalling.
19. The MS sends an ALERT message to the MSC on the FACCH. The BSS forwards the ALERT
message through the PSTN to the calling party and the caller hears the line ringing.
Call Establishment
20. Once the user answers the call (by pressing the send button), the MS will send
a Connect CON message to the MSC. The Connect message is forwarded back to the caller's
switch to activate the call.
21. The MSC sends a Connect Acknowledge CON_ACK message to the MS and the call is
established.
Call Disconnect
22. Disconnect happens the same way as for any other call. In this example, the calling party
initiates the disconnect.
23. When the calling party hangs up, the calling party's switch initiates a Release (REL) message.
The message is forwarded to the serving MSC, which is then forwarded to the BSS.
24. The BSS will send a Disconnect (DISC) message to the MS on the FACCH.
25. The MS confirms release of the call by sending a Release (REL) message on the FACCH, which
is forwarded to the MSC.
26. The MSC sends e Release Complete (REL_COM) message through the BSS to the MS. As far as
call control (CC) is concerned, the connection has been terminated.
27. The MS still has a TCH assigned to it, so the BSS sends a Channel Release (CHAN_REL)
message to the MS. This releases the radio resource on the Air Interface.
28. The MS responds be sending a final Disconnect message and returns to idle.

Mobile Terminating Call in Roaming

Signalling process:
1. The calling subscriber (from within the public telephone network) dials the mobile
subscriber's MSISDN (the telephone number) of the roaming cell phone.
2. Based on the information contained in the MSISDN (national destination code and the
country code), the call is routed to the mobile network gateway MSC (GMSC). It's done with
an ISUP IAM message.
3. To locate the MS, the GMSC sends to the HLR a MAP SRI (Send Routing Information)
message. The MAP SRI message contains the MSISDN number and with this MSISDN the HLR
will obtain the IMSI.

4. Because of past location updates, the HLR already knows the VLR that currently serves the
subscriber. The HLR will send to the VLR a MAP PRN (Provide Roaming Number) message to
obtain the MSRN of the roaming cell phone. Like that the HLR will be able to route the call to
the correct MSC.
5. With the IMSI contained in the MAP PRN message, the VLR assigns a temporary number
known as the mobile station roaming number (MSRN) to the roaming cell phone. This MSRN
number is sent back to the HLR in a MAP RIA (Routing Information Acknowledgement)
message.
6. Now with the MSRN number, the GMSC knows how to route the call to reach the roaming
cell phone. Then, the call is made using ISUP (or TUP) signaling between the GMSC and the
visited MSC. The GMSC will generate an ISUP IAM message with the MSRN as the called
party number (and NOT the MSISDN as the called party number).
7. When the MSC of the visitor network receives the IAM, it recognizes the MSRN and knows
the IMSI for which the MSRN was allocated. The MSC then returns the MSRN to the pool for
future use on another call. Afterwards, the MSC sends to the VLR a MAP SI (Send
Information) message to request information like the called MS's capabilities, services
subscribed to, and so on. If the called MS is authorized and capable of taking the call, the
VLR sends a MAP CC (Complete Call) message back to the MSC.

A signal as referred to in communication systems, signal processing, and electrical engineering "is a
function that conveys information about the behaviour or attributes of some phenomenon. In the
physical world, any quantity exhibiting variation in time or variation in space (such as an image) is
potentially a signal that might provide information on the status of a physical system, or convey
a message between observers, among other possibilities.
Signalling-the information exchange concerning the establishment and control of
a telecommunication circuit and the management of the network, in contrast to user information
transfer. The sending of a signal from the transmitting end of a telecommunication circuit to inform a
user at the receiving end that a message is to be sent.

Types of handover
The most basic form of handover is when a phone call in progress is redirected from its
current cell (called source) to a new cell (called target). In terrestrial networks the source and the
target cells may be served from two different cell sites or from one and the same cell site (in the
latter case the two cells are usually referred to as two sectors on that cell site). Such a handover, in
which the source and the target are different cells (even if they are on the same cell site) is
called inter-cell handover. The purpose of inter-cell handover is to maintain the call as the subscriber
is moving out of the area covered by the source cell and entering the area of the target cell.
A special case is possible, in which the source and the target are one and the same cell and only the
used channel is changed during the handover. Such a handover, in which the cell is not changed, is
called intra-cell handover. The purpose of intra-cell handover is to change one channel, which may
be interfered, or fading with a new clearer or less fading channel.

In addition to the above classification of inter-cell and intra-cell classification of handovers, they also
can be divided into hard and soft handovers:

A hard handover is one in which the channel in the source cell is released and only then the
channel in the target cell is engaged. Thus the connection to the source is broken before or 'as'
the connection to the target is madefor this reason such handovers are also known as breakbefore-make. Hard handovers are intended to be instantaneous in order to minimize the
disruption to the call. A hard handover is perceived by network engineers as an event during the
call. It requires the least processing by the network providing service. When the mobile is
between base stations, then the mobile can switch with any of the base stations, so the base
stations bounce the link with the mobile back and forth. This is called ping-ponging.

A soft handover is one in which the channel in the source cell is retained and used for a while in
parallel with the channel in the target cell. In this case the connection to the target is
established before the connection to the source is broken, hence this handover is called makebefore-break. The interval, during which the two connections are used in parallel, may be brief
or substantial. For this reason the soft handover is perceived by network engineers as a state of
the call, rather than a brief event. Soft handovers may involve using connections to more than
two cells: connections to three, four or more cells can be maintained by one phone at the same
time. When a call is in a state of soft handover, the signal of the best of all used channels can be
used for the call at a given moment or all the signals can be combined to produce a clearer copy
of the signal. The latter is more advantageous, and when such combining is performed both in
the downlink (forward link) and the uplink (reverse link) the handover is termed as softer. Softer
handovers are possible when the cells involved in the handovers have a single cell site.

The Intelligent Network (IN) is the standard network architecture specified in the ITU-T Q.1200
series recommendations. It is intended for fixed as well as mobile telecom networks. It allows
operators to differentiate themselves by providing value-added services in addition to the standard
telecom services such as PSTN, ISDN and GSM services on mobile phones.
The intelligence is provided by network nodes on the service layer, distinct from the switching layer
of the core network, as opposed to solutions based on intelligence in the core switches or telephone
equipment. The IN nodes are typically owned by telecommunications operators
IN is supported by the Signalling System #7 (SS7) protocol between telephone network switching
centres and other network nodes owned by network operators.

IN concepts, architecture and protocols were originally developed as standards by the ITUT which is the standardization committee of the International Telecommunication Union.
The primary aim of the IN was to enhance the core telephony services offered by traditional
telecommunications networks, which usually amounted to making and receiving voice calls,
sometimes with call divert. This core would then provide a basis upon which operators could
build services in addition to those already present on a standard telephone exchange.
The major driver behind the development of the IN system was the need for a more flexible
way of adding sophisticated services to the existing network. Before IN was developed, all
new feature and/or services that were to be added had to be implemented directly in the
core switch systems. This made for very long release cycles as the bug hunting and testing
had to be extensive and thorough to prevent the network from failing. With the advent of
IN, most of these services (such as toll free numbers and geographical number portability)
were moved out of the core switch systems and into self-serving nodes (IN), thus creating a
modular and more secure network that allowed the services providers themselves to
develop variations and value-added services to their network without submitting a request
to the core switch manufacturer and wait for the long development process.

Some IN services:

Televoting- Televoting, telephone voting or phone voting is a method of decision

making and opinion polling conducted by telephone. Televoting can also extend to voting
by SMS text message via a mobile cell phone. Televoting involves broadcasters providing an
audience with different telephone numbers associated with contestants participating; the
outcome is decided by the number of calls to each line.

Call screening- Call screening is the process of evaluating the characteristics of a

telephone call before deciding how or whether to answer it. Some methods may include:
listening to the message being recorded on an answering machine or voice mail checking a
caller ID display to see who or where the call is from.

Reverse charging call- is a telephone call in which the calling party wants to place a call at
the called party's expense. Mobile collect call solutions allow prepaid and post-paid endusers to easily make mobile collect calls on their home network or while roaming, even
when they have run out of credit.

Premium-rate telephone numbers are telephone numbers for telephone calls during which
certain services are provided, and for which prices higher than normal are charged. Unlike a
normal call, part of the call charge is paid to the service provider, thus enabling businesses to

be funded via the calls. While the billing is different, calls are usually routed the same way
they are for a toll-free telephone number, being anywhere despite the area code used.
These telephone numbers are usually allocated from a national telephone numbering plan in
such a way that they are easily distinguished from other numbers. Telephone
companies typically offer blocking services to allow telephone customers to prevent access
to these number ranges from their telephones. In some jurisdictions, telephone companies
are required by law to offer such blocking.

Call queuing-Call Queuing is a sophisticated queuing system that allows you to accept more
calls into your telephone system than you have extensions or employees capable of
answering them. It allows you to deal efficiently with calling peaks without losing valued
customers calls and projects a professional image of your business. With Call Queuing,
instead of getting an engaged tone your customers are answered automatically and held in a
queue. While they are waiting for a representative they receive personal messages about
how many calls are in front of them followed by music while they are waiting.

The main concepts (functional view) surrounding IN services or architecture are connected
with SS7 architecture:

Service Switching Function (SSF) or Service Switching Point (SSP): This is co-located with the
telephone exchange itself, and acts as the trigger point for further services to be invoked
during a call. The SSP implements the Basic Call State Machine (BCSM) which is a Finite state
machine that represents an abstract view of a call from beginning to end (off hook, dialling,
answer, no answer, busy, hang up, etc.). As each state is traversed, the exchange
encounters Detection Points (DPs) at which the SSP may invoke a query to the SCP to wait
for further instructions on how to proceed. This query is usually called a trigger. Trigger
criteria are defined by the operator and might include the subscriber calling number or the
dialled number. The SSF is responsible for entertaining calls requiring value added services.
Service Control Function (SCF) or Service Control Point (SCP): This is a separate set of
platforms that receive queries from the SSP. The SCP contains service logic which
implements the behaviour desired by the operator, i.e., the services. During service logic
processing, additional data required to process the call may be obtained from the SDF. The
logic on the SCP is created using the SCE.
Service Data Function (SDF) or Service Data Point (SDP): This is a database that contains
additional subscriber data, or other data required to process a call. For example, the
subscribers prepaid credit which is remaining may be an item stored in the SDF to be
queried in real time during the call. The SDF may be a separate platform, or is sometimes colocated with the SCP.
Service Management Function (SMF) or Service Management Point (SMP): This is a
platform or cluster of platforms that operators use to monitor and manage the IN services. It
contains the management database which stores the services configuration, collects the
statistics and alarms, and stores the Call Data Reports and Event Data Reports.
Service Creation Environment (SCE): This is the development environment used to create
the services present on the SCP. Although the standards permit any type of environment, it
is fairly rare to see low level languages like C used. Instead, proprietary graphical languages
have been used to enable telecom engineers to create services directly. The languages
usually belong to 4G languages, the user can use Graphical Interface to manipulate between
different functions to formulate a service.

Specialized Resource Function (SRF) or Intelligent Peripheral (IP): This is a node which can
connect to both the SSP and the SCP and delivers additional special resources into the call,
mostly related to voice data, for example play voice announcements or collect DTMF tones
from the user.

IN COMPONENTS:
1. CCN (Charging Control Node): CCN service logic is responsible for maintaining charging
sessions to the application network element, as well as charging interrogation sessions to
SDP.
CCN logic is able to handle circuit switched calls and data for CS1+, as well as CAPv1, CAPv2,
and ERTC access. Handling of SMS over CS1+, CAPv3 (originating SMS), and ERTC is
supported. CCN also handles GPRS over CAPv3. CCN also terminates the Diameter Credit
Control Application (DCCA) for Charging System. CCN contains service logic for the Diameter
service charging application to support content-based services. A charging control node is a
signalling control point used in a communication network (such as a 3G mobile
communication system) that can receive and process, track, and rate (assign a value to)
packet data service and content usage requests. A CCN can find and communicate with an
SDP, perform session control, identifies the correct device and account numbers (number
portability), and creates call detail records.

2. SDP: The SDP network element contains the database with subscribers and account
information. It also provides rating of calls and events as well as post processing of Charging
Data Records (CDRs) and initiation of Unstructured Supplementary Service Data (USSD)
notifications and SMS notifications.
SDP is also used to trigger the setup of a USSD call back call.
3. AIR: AIR handles messages from trafficable and administrative network elements. AIR has
three function groups; refill function, adjustment function, and the enquiry and update
function. AIR handles account information in the form of enquiries and account
administration. It supports a number of file-based batch jobs for making bulk adjustments,
promotions, and refills.
AIR can handle multiple Voucher Servers (VSs).
Account Activation
Account activation is the enabling of services for an account. Accounts may be activated
through various actions or processes, which may include user account configuration, first
payment, first service use, or through the actions of a customer service representative.
Account Adjustments
Account adjustments are changes to item charges, invoices or account balances.
Account Refill
Account refill is a process of adding value to an account.

AF (Account Finder): AF is a network element that provides location information for

subscriber accounts in the system. AF enables centralized management of multiple SDPs. AF
is always collocated with AIR.
4. Mobile IN Service Administration Tool (MINSAT): MINSAT handles subscriber administration
for Charging System. No traffic is handled, but interaction in real time with other systems for
provisioning and updates, is possible through the external interfaces provided.
At subscriber provisioning and removal, MINSAT may interact with both the Account Finder
(AF) and SDP, as well as optionally connect with external systems. For example, the Home
Location Register (HLR) can be provisioned through the Ericsson Multi Activation (EMA) from
MINSAT. MINSAT is used to display the call and account history.
5. VS (Voucher Server): A voucher server is a computer processing device that can receive,
process and respond to commands that can initialize, use, or terminate the authorization of
a document (e.g. coupon) or a code that is associated with a value. The VS may be colocated with the account information and refill system. VS is responsible for the
administration and storage of vouchers
6. Charging data Reporting System (CRS) : CRS is a system for correlating information from
many different sources to reconcile provisioning and usage information, answer customer
enquiries in near real time, and manage the complex tasks of a Charging System business.
CRS collects data from various network sources, then filters, correlates, and transforms this
information to provide business critical reports for customer care, financial and audit
departments.
CRS is used for the storage of call and account history.
7. V-Topup Server: This server has information of the different V- TopUps available. When a
customer via a retailer opts for a particular value, the V-Topup server checks whether the
retailer has been assigned that amount, after which its checks its database and then informs
the IN system to do the needful by sending the amount and the MSISDN.

The Charging System is a real time charging which can supervise the charged session in the real-time.
It also facilitates integration with business-support system to do the following:

Charging for multiple units such as time, volume, and events in real time in the mobile
network.
Connecting subscribers to an account that can be refilled using a voucher.
Market segmentation with features such as subscriber segmentation service offerings,
subscriber segmentation account group identity, community charging, and enhanced End of
Call (EoC) notification

Voice Extensible Markup Language Interactive Voice Response System (VXML-IVR) The subscriber
can use IVR to change and inquire about account information, for example, refills and account
balance enquiries. IVR interacts with Account Information and Refill System (AIR) to implement the
services it provides to subscribers. IVR can also be used for contacting customer care. VXML-IVR is a
standalone IVR. For VXML-IVR, the Mobile Service Switching Centre (MSC) forwards an IVR call to
VXML-IVR. VXML-IVR then handles the call over an ISUP, or SIGTRAN, channel. Call flow logic and
announcements initiated by VXML-IVR are stored in VXML-IVR itself.

PREPAID AND POSTPAID:

Let me list down few major differences between the two:

Service Payments: This is the most important factor, which differentiates between two
customer bases. Pre-paid customers make payment in advance before using the service
whereas post-paid customers use offered services throughout of the month, and at the end
of the month, customer receives the bill to pay within the given time frame.

Charging & Billing: For pre-paid customer, it is required to charge the customer in real time
for all the usage whereas post-paid customers can be charged at the end of the month.

Service Offerings: Post-paid billing systems provide more flexibility in comparison of real
time charging systems. For example, real time charging system is not flexible to maintain a
complex business customers' hierarchy where as a post-paid billing system can handle a
customer hierarchy up to N level.

Support & Maintenance: An operator needs to give same attention to both the businesses.
If for a pre-paid business, operator needs to have skilled manpower to control the operation,
same time operator needs a great staff to handle post-paid customer's queries related to
their charging, bills and fixing operational issues.

Supported Network: A long time ago, the network of the prepaid and the postpaid
connections were different. This used to invoke complaints that the prepaid connection
would offer better connectivity than the postpaid or vice versa. This is the age of convergent
billing and operators are running their business with the same network without
compromising communication quality.

Post-paid Scenario:
Network elements (like switches, SMSC) produce raw usage called Usage Detail Records (UDRs) or
Call Detail Records (CDRs), which contain information required by the billing system:

Calling number (A number)

Called number (the number receiving the call) (B number)

when the call started (date and time)

Call duration

Call Type (MOC, MTC, etc., MOC stands for Mobile Originated Call and MTC stands for Mobile
Terminated Call)
The above raw UDRs from network elements and also from other service providers are received by
the billing system and the billing system converts these into a format understandable by the system.
The above formatted/converted UDR is then guided to find the customer/account to which the call
should be charged and then rate the event accordingly.

The above rated UDRs are then stored in the billing data store, and on the billing cycle date, the
billing process picks up these rated UDRs and processes these and renders bill/invoice, taking into
account, the payments, taxes, discounts, etc.
The customer then pays the bill and the billing system is updated with the payment details.
Following is the diagram showing the above standard billing process:

Pre-paid Scenario:
Steps involved in prepaid billing in brief are as follows:

When customer makes a call, prepaid switching gateway captures the calling number and sends the
account information to the real time billing system.

Real time billing systems using the above information, authenticates the identity of the user,
calculates the customer account's remaining balance using the rating tariff table and maximum
allowable duration of the call and sends this information to the prepaid gateway.

The gateway establishes the call.

During the call, gateway monitors the call so that the user do not exceed the maximum allowable
call duration.

When the call is over, the gateway sends the actual call duration to the prepaid billing system, which
then calculates the actual call cost and updates the account balance, decreasing the remaining
balance.

Following figure shows the general prepaid billing scenario:

Detailed Prepaid Call-Flow

TYPES OF RECHAREGES:

Paper Recharge- Recharge vouchers are the enclosed paper postcards which carry
secret/confidential PIN/Code number that is used to recharge a mobile or any other services
like Internet etc. These recharger vouchers can be made according to the client's needs.
SIVR-Stand Alone Interactive Voice Response. We can recharge via the IVR using a step by
step procedure laid down and a voucher activation code.
Online Web Recharge- This is done through many servers available on the internet. There is
an agreement between the banks and the operators.
V-TopUp- A customer can also acquire a recharge of a designated value through a retailer
who has a commission based agreement with the operator. The customer gets confirmation
through SMS services of the operator.
VOUCHER REFILL & ENQUIRY: A voucher is considered as cash and the value lies with the
hidden information. A refill does not only add money to the account, but can also adjust the
account expiry dates. This can be done in a number of different ways.
IVR VOUCHER REFILL & ENQUIRY: The subscriber calls a service number (e.g. 123) and gets
routed to the IVR. Through announcements and voice prompts the IVR helps the caller to
interact with the Charging System for refill procedures.

1. A refill call is
initiated by the
Charging System
subscriber.
2. The call is
routed to the IVR.
The IVR checks if
the calling party
number is
complete.
3. The IVR
requests account
information from
AIR.
4. AIR
interrogates AF to
get the SDP IP address.
5. AF returns the SDP IP-address.
6. AIR uses the returned SDP IP address to request account and subscriber data
information from SDP.
7. SDP checks if any account updates are necessary and sends the result of the
account information requests back to AIR.
8. AIR sends the requested information to the IVR, for example preferred language.
The IVR plays a standard welcome announcement and a menu announcement.
The subscriber selects the menu option Voucher Refill and enters the voucher
activation number.
9. The entered activation code and the mobile number of the subscriber is sent to
AIR for verification.
10. AIR requests account information from SDP.
11. SDP sends the result of the account information request back to AIR. AIR verifies
that the subscriber exists and is not barred from refill.
12. AIR sends the entered voucher activation code to the Voucher Server (VS) for
verification.
13. When the VS has verified the voucher activation code and reserved the voucher,
it returns a response to AIR.
14. AIR receives a response from the VS indicating if the verification was successful
or not. It was successful, so AIR sends a refill request to SDP.
15. The account balance is increased in SDP database for the account.
16. CDR processing is used and has caused an SMS/GPRS barring. Unbarring of SMS
and GPRS in the HLR is supported when a certain account threshold has been
reached. In this case through a refill.
17. SDP sends the result of the refill back to AIR.
18. The refill was successful, so AIR requests the VS to set the voucher in used state.
19. The VS responds with the result back to AIR.
20. AIR sends a response to the IVR including the account balance and an indication
if the refill was successful or not. A CDR including the refill data is generated.
21. The IVR uses the voice prompt to notify the subscriber of the result.
22. The subscriber releases the call.
23. A CDR is sent to the Multi Mediation Solution as a receipt (optional).

USSD Voucher refill & enquiry: The subscriber enters a USSD service code (e.g. *123# for
balance enquiry & *101*XXX# for refill) and a voucher activation code using the mobile
handset. AIR interacts with SDP for refill of the subscriber's account. The subscriber receives
an USSD text message with a notification if the voucher refill was successful or not.

1.

Charging System subscriber originates an USSD message with the USSD service
code corresponding to voucher refill and the voucher activation code.
2. The MSC forwards the message to the HLR.
3. The HLR analyses the USSD service code and forwards the message to AIR.
4. AIR interrogates AF to get the SDP IP address.
5. AF returns the SDP IP address.
6. AIR uses the returned SDP IP address to requests account and subscriber data
information from SDP.
7. SDP checks if any account updates are necessary and sends the result of the
account information request back to AIR. AIR verifies that the subscriber exists
and is not barred from refill.
8. AIR sends the activation code to the VS for verification.
9. When the VS has verified the activation code and reserved the voucher, it returns
a response to AIR.
10. AIR receives a response from the VS indicating if the verification was successful
or not. It was successful, so AIR sends a refill request to SDP.
11. The account balance is increased in the SDP database. CDR processing is used and

has caused an SMS/GPRS barring. Unbarring of SMS and GPRS in the HLR is supported when
a certain account threshold has been reached. In this case through a refill.
12. SDP sends the result of the refill back to AIR.
13. The refill was successful, so AIR requests the VS to set the voucher in used state.
14. The VS responds with the result back to AIR.
15. AIR reformats the response into a USSD text string and sends it to the HLR. The
response is successful, so the appropriate successful message is sent, otherwise a
failure response with the reason for failure would have been sent. A CDR
including the refill data is generated.
16. The HLR forwards the response to the MSC and the response is displayed on the
subscribers handset.
17. A CDR is sent to the Multi Mediation Solution as a receipt (optional).

Terminologies used:
Network architecture is the design of a communications network. It is a framework for the
specification of a network's physical components and their functional organization and configuration,
its operational principles and procedures, as well as data formats used in its operation.
Initial Detection Point (telephony)
The Service Switching Point |SSP receives a message (ISUP Message) initiated by the Calling Party,
this could be an IAM (Initial Address Message). The SSP evaluates the nature of the message, in the
case of the IAM the called and calling party numbers. From this is determines whether it can route
the call or whether it needs further instructions. In this case if the SSP does require further
instructions it sends an IDP to a service control point SCP via an IN protocol.

//Unstructured Supplementary Service Data (USSD) is a protocol used by GSM cellular telephones to
communicate with the service provider's computers. USSD can be used for WAP browsing, prepaid
call-back service, mobile-money services, location-based content services, menu-based information
services, and as part of configuring the phone on the network.
INAP stands for Intelligent Network Application Protocol or Intelligent Network Application Part. It
is the signalling protocol used in Intelligent Networking. It can also be termed as logic for controlling
telecommunication services migrated from traditional switching points to computer based service
independent platform. The International Telecommunication Union (ITU) defines several "capability
levels" for this protocol, starting with Capability Set 1 (CS-1).[2] A typical application for the IN is a
Number Translation service. For example, in the United Kingdom, 0800 numbers are freephone
numbers and are translated to a geographic number using an IN platform. The Telephone exchanges
decode the 0800 numbers to an IN trigger and the exchange connects to the IN.
The ISDN User Part or ISUP is part of the Signalling System No. 7 (SS7) which is used to set
up telephone calls in the public switched telephone network (PSTN). When a telephone call is set up
from one subscriber to another, several telephone exchanges could be involved, possibly across
international boundaries. To allow a call to be set up correctly, where ISUP is supported, a switch will
signal call-related information like called party number to the next switch in the network using ISUP
messages.

Value-added service
A value-added service (VAS) is a popular telecommunications industry term for non-core services, or
in short, all services beyond standard voice calls and fax transmissions. However, it can be used in
any service industry, for services available at little or no cost, to promote their primary business. In
the telecommunication industry, on a conceptual level, value-added services add value to
the standard service offering, spurring the subscriber to use their phone more and allowing the
operator to drive up their ARPU. For mobile phones, technologies like SMS, MMS and data
access were historically usually considered value-added services, but in recent years SMS, MMS and
data access have more and more become core services, and VAS therefore has begun to exclude
those services.

Mobile VAS services can be mainly categorized into 3.

Consumer VAS
Network VAS
Enterprise VAS
A distinction may also be made between standard (peer-to-peer) content and premium-charged
content. These are called mobile value-added services (MVAS) which are often simply referred as
VAS.
Value-added services are supplied either in-house by the mobile network operator themselves or by
a third-party value-added service provider (VASP), also known as a content provider (CP) such as All
Headline News or Reuters.
VASPs typically connect to the operator using protocols like Short message peer-to-peer
protocol (SMPP), connecting either directly to the short message service centre (SMSC) or,
increasingly, to a messaging gateway that gives the operator better control of the content.

Major Services under VAS

Mobile TV & OTT Services[2]

Ring Back Tone(RBT & RRBT)[3]

Music Tracks Play, download and Ring Tones

Sports and Infotainment Services

Location Based Services

Missed Call Alerts and Voice Mail Box

Online Gaming

Live Streaming

Devotional Applications

Mobile Money & M-commerce based services

Mobile Advertisements

Contests & Voting

MO short message Service transfer

When the subscriber sends a short message, the handset sends the text message over the air
interface to the MSC/SGSN. Along with the actual text of the short message, the destination address
of the SM and the address of the Short Message Service Centre (SMSC) are included, the latter taken
from the handset's configuration stored on the SIM card.
Regardless of the air interface technology, the VMSC/SGSN invokes the MAP service package
MAP_MO_FORWARD_SHORT_MESSAGE to send the text to the Interworking MSC of the Service
Centre whose address was provided by the handset. This service sends the mo-Forward SM MAP
operation to the SMSC identified in the SM Submission from the handset, embedded within
a Transaction Capabilities Application Part (TCAP) message, and transported over the core network
using the Signalling Connection Control Part(SCCP).
The Interworking MSC of the SMSC, on receipt of the MAP mo-Forward SM message, passes the
SMS-PP Application Protocol Data Unit (APDU) containing the text message to the actual Service
Centre (SC) of the SMSC for storing, and subsequent 'forwarding' (delivery) to the destination
address and the SC returns an acknowledgement indicating success or failure. On receipt of this
submission status from the Service Centre, the Interworking MSC will send an appropriate indication
back to the VMSC/SGSN of the sending subscriber. The message submission status is then
forwarded, over the air interface, to the subscriber's handset.

MT short message service transfer

The figure depicts a call flow for Mobile Terminated short message delivery. For the sake of
simplicity, some of the interactions between the VMSC and VLR, and VMSC and Handset, have been
omitted, and only the case when SMS home routing is not in use is shown.
When the SMSC determines it needs to attempt to deliver a short message to its destination, it will
send the SMS-PP APDU containing the text message, the 'B-Party' (destination phone number) and
other details to the Gateway MSC (GMSC) logical component on the SMSC. The GMSC, on receipt of
this short message, needs to discover the location of the B-Party in order to be able to correctly
deliver the text to the recipient (the term Gateway MSC, in this context, indicating an MSC that is
obtaining routing information from the Home Location Register (HLR)). To do this, the GMSC invokes
the MAP service package MAP_SEND_ROUTING_INFO_FOR_SM, which sends a send Routing Info For
SM (SRI-for-SM) MAP message to the destination number's HLR, requesting their present location.
This SRI-for-SM message may be sent to an HLR in the same network as the SMSC, or via an interconnect to an HLR in a foreign PLMN, depending on which network the destination subscriber
belongs to.
The HLR performs a database lookup to retrieve the B-Party's current location, and returns it in an
acknowledgement message to the SMSC's GMSC entity. The current location may be the MSC
address the subscriber is currently roaming on, the SGSN address, or both. The HLR may also return
a failure, if it considers the destination to be unavailable for short messaging; see the failed short
message delivery section below.
Having obtained the routing information from the HLR, the GMSC will attempt to deliver the short
message to its recipient. This is done by invoking the MAP_MT_FORWARD_SHORT_MESSAGE
service, which sends a MAP mt-ForwardSM message to the address returned by the HLR, regardless
of whether it is an MSC (Circuit Switched SMS delivery) or an SGSN (Packet Switched SMS delivery).
The VMSC will request the information needed for it to deliver the Short Message to its recipient by
sending a Send_Info_for_MT_SMS message to the VLR. The VLR will then instigate a page request, or
subscriber search, for the destination subscriber's Mobile Subscriber ISDN Number (MSISDN), and
return the result to the VMSC. Since a typical deployment sees the VLR being co-located with the
MSC, this message flow is usually internal to the platform. Should the page or search for the
subscriber fail, the VLR will indicate the failure cause to the VMSC which will abort the Short
Message delivery procedure and return the failure to the SMSC (see the Failed short message
delivery section below). If the page of the handset was successful, the VMSC will then send to the
SMSC indicating successful delivery. The GMSC component of the SMSC passes the result of the
delivery attempt to the Service Centre. In the case of successful delivery, the delivered text message
will be removed from the Store and Forward Engine (SFE) and, if requested, a delivery report sent to
the text originator. If the delivery failed, the SMSC invokes a retry procedure to periodically make
further attempts at delivery; additionally, it may register with the HLR to receive a notification when
the B-Party becomes available for short message delivery in the future

GPRS Call Flow

GPRS (General Packet Radio Service) is a packet based communication service for mobile devices that
allows data to be sent and received across a mobile telephone network. It's a step towards 3G and is often
referred to as 2.5G.
Its an upgrade to the existing network that sits alongside the GSM network. Many of the devices such as
the BTS and BSC are still used. Often devices need to be upgraded be it software, hardware or both. When
deploying GPRS many of the software changes can be made remotely.
There are however 2 New Functional Elements which play a major role in how GPRS works - SGSN &
GGSN. In simple terms there are in practice two different networks working in parallel, GSM and GPRS.
In any GSM network there will be several BSCs. When implementing GPRS software and hardware
upgrade of this unit is required. The hardware upgrade consists of adding a PCU (Packet Control Unit). This extra
piece of hardware differentiates data destined for the standard GSM network or Circuit Switched Data and data
destined for the GPRS network or Packet Switched Data.
PCU can be a separate entity.

SGSN (Serving GPRS Support Node) - It takes care of some important tasks, including Routing, Handover
and IP address assignment. Its a logical connection to the GPRS device. One job of the SGSN is to make sure
the connection is not interrupted as you make your journey passing from cell to cell. It works out which BSC to
route your connection through. If the user moves into a segment of the network that is managed by a different
SGSN it will perform a handoff to the new SGSN, this is done extremely quickly and generally the user will not
notice this has happened. Any packets that are lost during this process are retransmitted. The SGSN converts
mobile data into IP and is connected to the GGSN via a tunneling protocol.
GGSN (Gateway GPRS support node) - It is the last port of call in the GPRS network before a connection
between an ISP (Internet Service Provider) or corporate networks router occurs. The GGSN is basically
a gateway, router and firewall. It also confirms user details with RADIUS servers for security, which are usually
situated in the IP network and outside of the GPRS network.
The connection between the two GPRS Support Nodes is made with a protocol called GPRS Tunneling
Protocol (GTP). GTP sits on top of TCP/IP and is also responsible for the collection of mediation and billing
information. GPRS is billed on per megabyte basis.

GPRS Call Scenario :

A subscriber accesses the Internet with GPRS mobile phone to set the APN (Access Point Names) & gateway IP
address defined on subscription. In fact, APN is a logical name indicating the external data network in GGSN. A
subscriber can select different GGSNs via different APNs. Currently, however, only one APN can be activated at
a time. The purpose of selecting different APNs is to access the external network via different GGSNs, because
without GGSN, a subscriber cannot access the PDN (Public Data Network). An APN consists of a fully qualified
DNS (Domain Name Server) name e.g. airtellive.com.cn., which should be parsed by DNS to get the real IP
address of GGSN.
The call reaches the SGSN of the GPRS network. The SGSN triggers the service in the corresponding SCP
(Service Control Point) according to subscriber's authentication information on the HLR interconnected to the
corresponding home SCP for processing.
The DNS parses the APN and get the IP address of the GGSN.
The call is routed to the GGSN according to the IP address.
The GGSN assigns the IP address to the subscriber.

After SCP verifies the subscriber, the subscriber begins to transmit data and log in to the external web sites via
the gateway whose IP address is set in the mobile phone.
The subscriber may select the service from the portal web site to connect the SP/CP web site that provides the
service, or enter the IP address of the SP/CP in the mobile phone to access the SP/CP web site.

Circuit Switching and Packet Switching

Mobile number portability

Mobile number portability (MNP) enables mobile telephone users to retain their mobile telephone
numbers when changing from one mobile network operator to another. Mobile number portability
is implemented in different ways across the globe. The International and European standard is for a
customer wishing to port his/her number to contact the new network (recipient), which then sends
the number portability request (NPR) to the current network (donor). This is known as "recipientled" porting. The UK and India are the only exceptions to implement the donor-led system. The
customer wishing to port his/her number is required to contact the donor to obtain a Porting
Authorisation Code (PAC), which is then showed to the recipient network to proceed. Once having
received the PAC the recipient continues the port process by contacting the donor. This form of
porting is known as "donor-led" and has been criticised by some industry analysts as being
inefficient, though prevents MNP scams. It has also been observed that it may act as a customer
deterrent as well as allowing the donor an opportunity of "winning back" the customer. This might
lead to distortion of competition, especially in the markets with new entrants that are yet to achieve
scalability of operation.
A significant technical aspect of MNP is related to the routing of calls or mobile messages
(SMS, MMS) to a number once it has been ported. There are various flavours of call routing
implementation across the globe but the International and European best practice is via the use of a
central database (CDB) of ported numbers. A network operator makes copies of the CDB and queries
it to find out to which network to send a call. This is also known as All Call Query (ACQ) and is highly

efficient and scalable. A majority of the established and upcoming MNP systems across the world are
based on this ACQ/CDB method of call routing. One of the very few countries not to use ACQ/CDB is
the UK, where once a number has been ported, calls to that number are still routed via the donor
network. This is also known as "indirect routing" and is highly inefficient as it is wasteful of
transmission and switching capacity. Because of its donor dependent nature, indirect routing also
means that if the donor network develops a fault or goes out of business, the customers who have
ported numbers out of that network will lose incoming calls to their numbers.