Downloaded 306 times
Uploaded byWijaya Kusuma
Modul 7 gprs operation
The document discusses GPRS operations and procedures. It provides an overview of GPRS architecture, protocols used in GPRS, mobility management procedures like GPRS attach and routing area update, and location management in GPRS. Diagrams are included to illustrate logical architecture, data transfer between network elements, and mobility states of a GPRS mobile station.
More Related Content
Similar to Modul 7 gprs operation
Modul 7 gprs operation
- 1. GSM-GPRS Operation GPRS ProceduresAnd Operations Modul 7
- 2. 2 Agenda 1. Introduction toGPRS • Apakah itu GPRS ? • Pengkodean di GPRS • Kelas-kelas MS pada GPRS • Aplikasi-aplikasi GPRS 2. Bagaimana GPRS bekerja? 3. Karakteristik GPRS 4. Aplikasi-Aplikasi GPRS 5. Keterbatasan GPRS 6. Arsitektur GPRS 7. Fungsi Elemen kris.sujatmoko@gmail.com
- 3. 3 MSC Local Area Network Server Route r Corporate 1 Local Area Network Server Route r Corporate 2 GPRS INFRASTRUCTURE Border Gateway (BG) Serving GPRS Support Node (SGSN) HLR/Au C EIR BS C BT S U m SMSC Firewall Firewal l Gateway GPRS SupportNode (GGSN) GPRS Logical Architecture Legal Interception Gateway (LIG) Firewall Inter- PLMN network Data network (Internet) Data network (Internet ) PSTN Network SS7 Network GPRS backbone network (IP based) Billing System Charging Gateway (CG) Domain Name Server (DNS) kris.sujatmoko@gmail.com
- 4. 4 Logical architecture: Interfaces otherPLMN MSC/VLR HLR EIR SGSN GGSN GGSN SGSN PDN TE SMS-GMSC SMS-IWMSC MS BSS GiGn Gn Gp Gb Gd Um GcGr Gs Gf CE D A Signalling & Data Transfer Signalling GPRS Interfaces kris.sujatmoko@gmail.com
- 5. 5 Functional view ofGPRS Local area network Server Router Local area network Server Router Corporate 2 Corporate 1 Intra-PLMN backbone network (IP based) Serving GPRS Support Node (SGSN) Point-To- Multipoint Service Center (PTM SC) Gateway GPRS Support Node (GGSN) GPRS INFRASTRUCTURE HLR/AuC MSC BSCBTS Packet networkPSTN Packet networkSS7 Network Packet network Data network (Internet) Packet network Data network (X.25) Packet network Inter-PLMN Backbone network Border Gateway (BG) Gb Gr Gd Gi.IP Gi.X.25 Firewall Firewall Firewall Um R/S SMS-GMSC Gr Gd Gs Gs Gp Gn Gn EIR MAP-F SGSN = Serving GPRS Support Node GGSN = Gateway GPRS Support Node NMS = Network Management System BG = Border Gateway CG = Charging Gateway FW = Firewall LIG = Legal Interception Gateway kris.sujatmoko@gmail.com
- 6. 6 GPRS network seenby an other data network L o c a l a r e a n e tw o r k R o u t e r C o r p o r a t e 2 L o c a l a r e a n e tw o r k R o u te r C o r p o r a t e 1 P a c k e t n e tw o r k D a ta n e tw o r k (In te r n e t) G P R S S U B N E T W O R K S U B N E T W O R K 1 5 5 .2 2 2 .3 3 .X X X S U B N E T W O R K 1 3 1 . 4 4 .1 5 . X X X S U B N E T W O R K 1 9 1 . 2 0 0 . 4 4 . X X X H O S T 1 9 1 .2 0 0 .4 4 .2 1 H O S T 1 3 1 .4 4 .1 5 .3 H O S T 1 5 5 .2 2 2 .3 3 .5 5 " R o u te r " kris.sujatmoko@gmail.com
- 7. 7 Data transfer Local area network Server Router SGSN GGSN IP ROUTER BSCBTS GPRS backbone network (IP based) SGSN GGSN IP ROUTER BSCBTS GPRS backbone network (IP based) Packet network Inter-operator backbone network Packet network Data network (Internet) Corporate HOME GPRS NETWORK VISITED GPRS NETWORK case 1 case 2 case 3 kris.sujatmoko@gmail.com
- 8. 8 Data Transfer BetweenGSNs User packet User packet Userpacket Userpacket SGSN GGSN The stream of containers forming a tunnel. User packet kris.sujatmoko@gmail.com
- 9. 9 GTP Container User packet TunnelID: IMSI… THE GTP PACKET IP (+TCP/UDP) Who is the user? To which GSN? GSN IP- address E.g. a TCP/IP packet carrying e-mail kris.sujatmoko@gmail.com
- 10. 10 Protokol Di GPRS Pada Jaringan GPRS, data harus dilewatkan ke stack protokol yg berbeda sebelum diterima oleh alamat tujuan Protokol ini sudah integrated dielemen GPRS yg sifatnya sudah terproteksi dan pengirimannya terjamin kris.sujatmoko@gmail.com
- 11. 11 Protokol Pada MS Internet Protocol dan X.25 monitor routing informasi pelanggan di jar backbone GPRS Subnetwork Dependent Convergence Protocol (SNDCP) bertanggung jawab dlm kompresi dan segmentasi data ke unit2 kecil Logical Link Control Protocol (LLC) menjamin koneksi aman (reliable and ciphered connection) ke SGSN Radio Link Control Protocol (RLC) memberikoneksi air interface utk transmisi data. Jika ada error transmisi dpt diketahui pd saat data sampai direceiver Medium Access Control Protocol (MAC) mengontrol terjadinya koneksi di air interface mulai dari assignment dan acknowledgment GSM Radio Frequency protocol layer bertanggung jawab utk memberikan saluran fisik berupa air interface kris.sujatmoko@gmail.com
- 12. 12 Protokol di BSS Base Station Subsystem GPRS Protocol (BSSGP) bertanggung jawab utk routing ke SGSN SGSN mempunyai kemampuan utk memilih rute data alternatif Network Service Protocol (NS) BSSGP Packet Data Units dibawa ke Service Access Point pada layer jaringan Protokol ketiga dan terakhir di BSS : L1 bis Protocol kris.sujatmoko@gmail.com
- 13. 13 Protocol Di SGSN GPRS Tunneling Protocol (GTP) IP address GPRS backbone network, bertanggung jawab thd semua pesan GPRS, signaling dan data pelanggan melalui tunneled transmission antar GPRS Support Nodes. Transmisinya tdk bisa diinterferensi oleh user lain User Datagram Protocol (UDP) digunakan dlm transmisi tunneled PDU ketika aplikasi tdk aktif di sisi receiver Transmission Control Protocol (TCP) reliable transmission. kris.sujatmoko@gmail.com
- 14. 14 BTS BSC SGSN GGSN Intranet GGSN Internet CG Billing System Router Server Local Area NW Corporate GPRS Core Network BG InterPLMN NetworkLIG GPRS Core Network Logical Network Elements SGSN = Serving GPRS Support Node GGSN = Gateway GPRS Support Node NMS = Network Management System BG = Border Gateway CG = Charging Gateway FW = Firewall LIG = Lawful Interception Gateway FW FW NMS DNS kris.sujatmoko@gmail.com
- 15. 15 GPRS Mobility Management(GMM) Procedures that take care of the mobility of the user are called GPRS Mobility Management (GMM). The GMM procedures are similar to the mobility management for circuit switched users. One of a GMM procedure is the GPRS attach procedure. When a GPRS terminal is powered on, it sends an 'attach' message to the network. The SGSN authenticates the user before attaching the terminal to the GPRS network. Once a subscriber has attached to the network, logical connection is established between the MS, the SGSN, and the HLR. kris.sujatmoko@gmail.com
- 16. 16 Session Management (SM) Procedures that handle the user connection to the external data networks are called Session Management (SM) The procedure to establish a connection to an external data network is called “PDP context activation” procedure. Hereby, a connection is established between the MS and GGSN via the SGSN. The GPRS MS has to register with the PLMN for the first time, much in the same way as a normal GSM MS. The difference between the GPRS and GSM MS phone is that it has to update location information in the SGSN as well. kris.sujatmoko@gmail.com
- 17. 17 Subcriber information, Information Elementsand Location Type of info What info Where Identity IMSI TMSI IP address SIM, HLR, VLR, SGSN SGSN, MS MS, SGSN, GGSN Location VLR address Location area Serving SGSN Routing area HLR SGSN, VLR HLR, VLR SGSN Services Basic services, supplementary services, circuit switched bearer services, GPRS service information Basic services, supplementary services, CS bearer services GPRS service information HLR VLR SGSN Authentication data Ki, algorithms Triplets SIM, AC VLR, SGSN kris.sujatmoko@gmail.com
- 18. 18 Routing Area Arouting area is defined as one or more cells with a maximum size of number of cells in one location area that is used for paging GPRS subscribers. SGSN-1 BSC-1 RA-1 RA-3 SGSN-2 BSC-2 RA-2 LA-1 LA-3 Cell ⊂ Routing area ⊂ Location area ⊂ MSC coverage area Cell ⊂ Routing area ⊂ SGSN coverage area kris.sujatmoko@gmail.com
- 19. 19 Routing Area Identity(RAI) The RAI is defined by the operator and is broadcast by the system. The GPRS MS monitors the RAI when changing cells to see if a RA border has been crossed. If the RA changes, it is the responsibility of the MS to initiate the RA update procedure. The structure of the RAI is: Where RAC is Routing Area Code The RAI is LAI + RAC. The RAI is of fixed length - 15 digits. RAI = MCC + MNC + LAC + RAC kris.sujatmoko@gmail.com
- 20. 20 Mobility Management States A GPRS MS has one of three mobility management states: The Idle state is used when the MS is passive (not GPRS attached). A MS is in Ready state and in the active phase when it is transmitting or has just been transmitting data. The Standby state is entered when the subscriber has ended an active phase but is still attached to the network. kris.sujatmoko@gmail.com
- 21. 21 MS In IdleState RA-1 VLR-1 HLR SGSN-1BSC IMSI 244... VLR SGSN IMSI LAI SGSN ? IMSI ? RA ? Cell ? LA-1 kris.sujatmoko@gmail.com
- 22. 22 MS In ReadyState RA-1 VLR-1 HLR SGSN-1BSC IMSI 244... VLR VLR-1 SGSN SGSN-1 IMSI 244... LAI LA-1 SGSN SGSN-1 IMSI 244... RAI RA-1 CellCell cellcell--11 LA-1 kris.sujatmoko@gmail.com
- 23. 23 MS In StandbyState RA-1 VLR-1 HLR SGSN-1BSC IMSI 244... VLR VLR-1 SGSN SGSN-1 IMSI 244... LAI LA-1 SGSN SGSN-1 IMSI 244... RAI RA-1 CellCell ?????????? LA-1 kris.sujatmoko@gmail.com
- 24. 24 GMM Procedure :GPRS Attach RA-1 HLR SGSN-1 BSC LA-1 1 2a 2b kris.sujatmoko@gmail.com
- 25.
- 26. 26 GPRS Attach…With IMEIChecking (optional) RA-1 EIR SGSN-1 BSC LA-1 4c 4d 4a 4b kris.sujatmoko@gmail.com
- 27.
- 28. 28 Location Management Thelocation management procedures are a group of mobility management procedures that we use to handle the changing of a cell or a routing area or a SGSN coverage area. Information in the databases has to be modified during these procedures. Periodic routing area update is used for checking that a MS that has not done any routing area updates for some period of time is still reachable. kris.sujatmoko@gmail.com
- 29. 29 Routing Area Update Twotypes of routing area updates: Inter-SGSN routing area update: If the old and new routing areas are managed by different SGSNs, an inter-SGSN routing area update is performed. The old SGSN forwards user packets to the new SGSN. Intra-SGSN routing area update: If the old and the new routing area belong to the same SGSN, an intra-SGSN routing area update is performed kris.sujatmoko@gmail.com
- 30. 30 Intra SGSN RoutingArea Update SGSN-1 BSC-1 RA-1 Old cell New cell RA-2 kris.sujatmoko@gmail.com
- 31. 31 Intra SGSN RAUpdate Procedure HLR SGSN BSC LA-1 GGSN 1 New RA (1)The MS requests a routing area update kris.sujatmoko@gmail.com
- 32. 32 HLR SGSN BSC LA-1 GGSN 2b 22a New RA Step 2authentication kris.sujatmoko@gmail.com
- 33.
- 34. 34 Session Management Sessionmanagement collectively refers to a set of procedures for the activation, deactivation, and modification of a data session between a MS and an external network In order to set up data sessions, the GPRS system provides a group of functions for associating a MS with an address (typically the IP address) and for releasing this association. These are called PDP context functions. The resulting PDP context can also be modified. The MS can use the PDP context functions only when in Standby or Ready state. The MS can use various kinds of IP addresses. The home network operator may assign a static IP address to a MS permanently. Another option for the operators is to assign a dynamic IP address to a MS during PDP context activation kris.sujatmoko@gmail.com
- 35. 35 PDP Context Activation MSSGSN GGSN 2. Security Functions 1. Activate PDP Context Request DNS Server DNS inquiry 3. Create PDP Context Request 4. Create PDP Context Response Connection establishment with PDN 5. Activate PDP Context Accept kris.sujatmoko@gmail.com
- 36. 36 PDP ContextInclude : PDP type, that is, IP connection or X25 connection. Access point name (APN): a symbolic name for a network interface to an external network in the GGSN. One GGSN could have several different access points to access different networks. IP address (empty = dynamic), which is also referred to as PDP address. QoS parameters kris.sujatmoko@gmail.com
- 37. 37 Charging In GPRS Chargingdata is collected from SGSN and GGSN Collected charging information: - Mobility management data - Duration of PDP context - Data volume uplink/downlink - Usage of external networks (= Access Point) - SGSN & GGSN address BTS BSC SGSN GPRS Backbone IP Network GGSN Internet Service CG Charging Gateway BC Billing Center Specific GTP' protocol used to carry CDRs from SGSN/GGSN to Charging Gateway kris.sujatmoko@gmail.com
- 38. 38 Charging…. CDRs producedby GGSN CDRs produced by SGSN CG S-CDRs M-CDRs SMS-CDRs Internet GGSN Operator IP backbone SGSN CG Internet GGSN Operator IP backbone SGSN G-CDRs kris.sujatmoko@gmail.com
- 39. 39 Security In GPRS The GPRS system has inherited the GSM Phase 2 security functions: Authentication of the subscribers IMEI checking User identity confidentiality (TMSI, now P-TMSI in GPRS) Ciphering of the data traffic between the MS and the SGSN. The additional GPRS security features are: Private IP addressing in the GPRS backbone Ciphered links and authentication between nodes in the GPRS backbone Screening of packets coming from the external networks. kris.sujatmoko@gmail.com
- 40. 40 Authentication… MS isauthenticated Ciphering key selected Equipment identity is optionally checked Location updated to HLR and VLR SGSN interfaces HLR for GPRS attachBTS BSC SGSN GGSN GPRS Backbone IP Network SS7 HLR MSC/ VLR Intranet Internet kris.sujatmoko@gmail.com
- 41. 41 Security…. Addressing inthe backbone, external networks (access point), and the MS SGSN GGSN DNS Internet BTS BSC 10.1.1.1 10.1.1.2 10.1.1.3 10.1.1.4 GPRS BackboneGPRS Backbone FW 123.45.67.88 123.45.0.0/16 kris.sujatmoko@gmail.com
- 42. 42 Security…. Interconnecting GPRSnetworks of different PLMNs with link physically secure SGSN SGSN GGSN Internet Toward other sites site 1 Security Router SGSN SGSN SGSN site 2 Operator Private IP network Secure Links Security Router Link physically secure GGSN site Router kris.sujatmoko@gmail.com
- 43. 43 Security…. Subscription- andnetwork-controlled screening Internet Operator screening Subscription controlled screening Address: From 172.60.10 to 172.60.20 Address: From 172.60.21 to 172.60.50 Address: From 172.60.10 to 172.60.50 FirewallFirewall Firewall Business screening basic screening GGSN GGSN APN=Business APN=Basic kris.sujatmoko@gmail.com
- 44. 44 GPRS Quality OfService kris.sujatmoko@gmail.com
- 45. 45 Precedence class(priority) The service precedence indicates the priority of maintaining a service under abnormal conditions such as network congestion. Packets may be discarded according to precedence level. The following precedence levels are : Precedence Class 1 (High precedence): Service commitments will be maintained ahead of all other precedence levels. Precedence Class 2 (Normal precedence): Service commitments will be maintained ahead of low priority users. Precedence Class 3 (Low precedence): Service commitments will be maintained after the high and normal priority commitments have been fulfilled. kris.sujatmoko@gmail.com
- 46. 46 Delay Class The delay parameter defines the maximum values for the mean delay and 95% delay to be incurred by data passing through the GPRS network. The delay parameter defines the delay incurred by data packets within the GPRS network. Size 120 octets 1024 octets Class Mean Delay 95% Mean Delay 95% 1 (Predictive) 0.5 s 1.5 s 2 s 7 s 2 (Predictive) 5 s 25 s 15 s 75 s 3 (Predictive) 50 s 250 s 75 s 375 s 4 (Best Effort) Not specified kris.sujatmoko@gmail.com
- 47. 47 Reliability Classdefine the probability of: Lost data Duplication of data Data arriving out of sequence Corruption of data. The reliability class specifies the requirements of the various network protocol layers. The combinations of the GTP, LLC, and RLC transmission modes support the reliability class performance requirements. kris.sujatmoko@gmail.com
- 48. 48 The throughputclass indicates the data throughput requested by the user. Throughput is defined by two negotiable parameters: Maximum bit rate Mean bit rate. This includes, for example for "bursty" transmissions, the periods in which no data is transmitted. The maximum and mean bit rates can be represented by a parameter known as the Information Transfer Rate. kris.sujatmoko@gmail.com
- 49. 49 The maximumbit rate is measured in octets per second at the Gi and R reference points. It specifies the maximum rate at which data is expected to be transferred across the network for an individual PDP context. There is no guarantee that this maximum rate will be achieved or sustained for any time period as this depends upon the MS capability and available radio resources. kris.sujatmoko@gmail.com
- 50. 50 The meanbit rate (throughput) is measured at the Gi and R reference points in units of octets per hour. It specifies the average rate at which data is expected to be transferred across the GPRS network during the remaining lifetime of an activated PDP context. The network may limit the subscriber to the negotiated mean bit rate (for example, for flat rate charging), even if additional transmission capacity is available. kris.sujatmoko@gmail.com
- 51. 51 Conclusion 1. The messagesthat are sent between various components of the GPRS network are collectively referred to as GPRS traffic. To manage this traffic in an orderly manner, one needs a set of traffic management procedures. 2. Procedures that handle mobility of user are called GPRS Mobility Management (GMM). Procedures that handle the user connection to the external networks are called Session Management (SM). 3. There are two phases in connecting a GPRS terminal to the network: Connection to the GPRS(SGSN) network or GPRS attach Connection to the external network: PDP context activation kris.sujatmoko@gmail.com
- 52. 52 4. A routingarea is defined as one or more cells with a maximum size of one location area that is used for paging GPRS subscribers. An SGSN can have a number of RA associated with it. 5. An MS can have: Static IP address: the user always has the same IP address, or Dynamic IP address: the network allocates the user a different IP address for each session. kris.sujatmoko@gmail.com
- 53. 53 6. In Idlestate the MS is not attached to the GPRS. No information about the subscriber is known. 7. A MS is in Ready state and in the active phase when it is transmitting or has just been transmitting. 8. The MS enters Standby state when it has ended an active phase. MS is not transmitting anything. 9. The MS performs a cell update when it changes cell within a routing area in Ready mode. kris.sujatmoko@gmail.com
- 54. 54 10. When theMS changes cell between the different routing areas, it performs a routing area update. 11. The GPRS core network uses private, unregistered IP addresses. The GGSN maps (or translates) the private addresses into one (or more) registered public IP addresses and port pairs. The MS uses one of the public IP addresses. 12. GGSN and SGSN generate CDRs. The CDRs are transferred to the charging gateway. The charging gateway interfaces to the Billing Centre. 13. GPRS has inherited the GSM Phase 2 security features. Additional GPRS specific security features are implemented: private IP addressing in the GPRS backbone, ciphered links and authentication between nodes in the GPRS backbone, screening of packets coming, etc. kris.sujatmoko@gmail.com
- 55. GSM-GPRS Operation End ofSection 7 GPRS Procedures And Operations
Editor's Notes
- #4 Go through
- #18 When GPRS messages are sent, there is a need to give information about the GPRS user and other parameters within the message. Information about a GPRS user in the different network elements falls into four categories: Identity : How do we identify subscribers? For example, IMSI, TMSI, P-TMSI, TLLI, and IP address. Location : How do we identify the location of a subscriber? For example, location area, routing area, SGSN serving subscriber, and serving MSC. Services : What sort of services is the subscriber allowed to access and where will this information be maintained in the network? Authentication data : What algorithms and keys are used to authenticate the subscriber? What encryption techniques are used for data transfer between SGSN and MS? Where is this information held?
- #19 There are some important rules to follow in the allocation of routing areas. A routing area is always served by one SGSN only, that is, a routing area cannot be served by two different SGSNs . The limitation is similar to GSM mobility management, where a location area has to be under just one MSC/VLR. This is required for the circuit switched calls to the MS to be correctly set up, that is, which one of the MSCs would page for the subscriber and where would the calls be routed? The problem is similar in GPRS: To which SGSN would the packets (going from GGSN towards the MS) be routed? A routing area cannot belong to more than one location area . One reason for this is that we want to be able to do combined location updates and routing area updates through the GPRS service in case there is no connection through the circuit switched service. The relationship between Cell, RA, LA, and SGSN coverage area is given below: Cell Routing area Location area MSC coverage area Cell Routing area SGSN coverage area
- #21 In order to manage the mobility of a number of GPRS mobile stations within a SGSN coverage area, a set of mobility management states are defined. The tracking of the location of a MS depends on the current mobility management state of a MS. A GPRS MS has one of three mobility management states: The Idle state is used when the MS is passive (not GPRS attached). A MS is in Ready state and in the active phase when it is transmitting or has just been transmitting data. The Standby state is entered when the subscriber has ended an active phase but is still attached to the network. The change between the states happens upon activity or when a timer expires. When a MS is in the Standby state, the location of the MS in the SGSN is known down to routing area level. When the MS is in Ready State, the location of the MS is known down to cell level.
- #22 The MS is not attached to the GPRS network. The network does not know the cell or the routing area of the MS (see Figure 3). The only piece of information known by the network is the IMSI information in the HLR.
- #23 When the diplomat switches the new MS on, the first thing the MS does is the GPRS attach . After successfully completing GPRS attach, the MS is in Ready state. At this point, the diplomat can receive short messages to the MS, but she cannot begin surfing the web yet. If the optional interface between the VLR and the SGSN exists in the network, a user can also receive paging for circuit switched services through the GPRS service. The reason we cannot send/receive packets to/from external networks is that there is no valid PDP context yet. There is no connection to the external IP network yet. In the Ready state (see Figure 4): The MS is attached to the SGSN (GPRS attach has been done). The location of the MS is known down to cell level. The network (SGSN) and the MS hold a valid mobility management context for the subscriber. The MS is capable of receiving and sending data. To be able to send data to an external IP network, the MS must also have an active PDP context . The SGSN can send data to the MS without paging at any time and the MS can send data to the SGSN at any time. The MS may activate and deactivate PDP contexts. In Ready state, the MS does not necessarily have radio resources reserved all the time. The MS can use the Discontinuous Reception (DRX) feature to save battery power. A timer supervises the Ready state: the Ready timer. If the timer expires, the mobility management context is changed to Standby .
- #24 In the Standby state (see Figure 5): The MS is attached to the SGSN and the location of the MS is known down to routing area level. If the MS sends data (PDU transmission), MS moves to Ready state. There is a valid mobility management context for the MS in the SGSN and the MS. The MS can receive paging for circuit switched services via the SGSN. Packet data transmission is not possible in this state. If the MS sends data it moves to the Ready state. There is another timer called the MS reachable timer . The MS reachable timer starts ticking when the MS moves to the Standby state. If the timer expires, the network may detach the MS. The MS would then go to Idle state and the mobility management context could be removed.
- #25 With the GPRS attach and GPRS detach procedures, connections to the SGSN can be established and terminated. The MS sends a request to attach or detach from the GPRS network. A SGSN receives the requests and processes them. The result of a successful GPRS attach is that the mobile moves to the Ready state and a mobility management context is established in the SGSN for that MS. Let us look at GPRS attach step by step. (1) The MS requests GPRS attach. The MS is not known in the PLMN (for example first time registration), so: (2a) The SGSN requests subscriber identity. (2b) The MS sends its IMSI.
- #26 There are no valid authentication triplets for the new subscriber in the SGSN; so (Figure 7) the following steps occur next: (3a) SGSN requests triplets from AC. (3b) The HLR/AC generates the triplets (RAND, SRES, and Kc), which is very similar to the GSM network and hands them to the SGSN. (3c) The SGSN sends an authentication request to the MS (along with RAND). (3f) The SIM calculates a SRES, and sends this to the SGSN. The SGSN verifies the authentication (SRES=SRES’) since it is only the subscriber SIM and the HLR that are aware of the security key Kc and the algorithm that generates SRES. Note that some network operators may choose to not authenticate every subscriber who connects to their network as this generates quite a lot of load on the network.
- #27 The GPRS attach continues in Figure 8 with IMEI checking. (4a) SGSN asks for the MS IMEI. (4b) MS sends the IMEI. (4c) SGSN sends a Check IMEI message to the EIR. (4d) EIR replies with a Check IMEI Ack that will include the list type where the IMEI was found (unknown, white, grey, or black). Again some network operators may choose to ignore this functionality.
- #28 We continue the GPRS attach (Figure 9). (5a) The SGSN sends an Update location message to the HLR with the subscriber IMSI. (5b) The HLR responds by giving subscriber data to the SGSN. (5c) The SGSN acknowledges that it has received the subscriber data ok. (5d) The HLR ends the transaction with an Update Location Ack. (6a) The SGSN accepts the GPRS attach and sends the MS a new P-TMSI. P-TMSI is an alias for the GPRS MS just like the TMSI. (6b) The MS acknowledges that it has received the new P-TMSI. The TLLI (Temporary Logical Link Identity) is derived from the P-TMSI. The TLLI is used as an identifier for the connection between the MS and the SGSN. After a GPRS attach , the SGSN starts tracking the location of the MS. The MS can send and receive SMS, but no other data. To transfer other data it first has to activate a PDP context. When the subscriber wants to end a connection to the GPRS network, the GPRS detach is used. GPRS detach changes the state of the MS to Idle and the mobility management context in the SGSN (and in the MS) is removed. The MS can also be implicitly detached from GPRS if also the mobile reachable timer expires. The MS normally initiates GPRS detach , but it can also be initiated by the network.
- #29 How do we cope with a situation where the MS receives packet data while moving from one cell to another? Or how do we cope with a situation where the MS moves from a routing area to another in Standby state? These problems are solved with location management. Let us first take an example. Before boarding the train for Helsinki, our diplomat is driving in and around the downtown of Tampere. Her MS is in Ready mode downloading large-sized e-mail. The cell changes several times, and the MS has to update cell information in the SGSN. The location management procedures are a group of mobility management procedures that we use to handle the changing of a cell or a routing area or a SGSN coverage area. Information in the databases has to be modified during these procedures. Periodic routing area update is used for checking that a MS that has not done any routing area updates for some period of time is still reachable. The MS performs a cell update when it changes cell within a routing area in Ready mode. This could be compared to a handover in GSM for circuit switched connections. Cell update halts possible reception or sending of data. If the MS or the SGSN send data during cell update, the data most likely will be buffered in SGSN or lost and has to be resent. We can also call the cell update cell reselection . When the MS changes cells between different routing areas, it performs a routing area update . Since a SGSN can manage many routing areas, there are two types of routing area updates: Inter-SGSN routing area update : If the old and new routing areas are managed by different SGSNs, an inter-SGSN routing area update is performed. The old SGSN forwards user packets to the new SGSN. Intra-SGSN routing area update : If the old and the new routing area belong to the same SGSN, an intra-SGSN routing area update is performed as shown in Figure 10.
- #32 The first step of an intra-SGSN routing area update message exchange is shown in Figure 11. The MS is moving in the network and it is listening to the information broadcast by the cells. The MS decides to select a new cell that is in another routing area. The MS requests from the SGSN an update of the mobility management context by (1) sending the message ' Routing Area Update Request '.
- #33 (2a) The SGSN decides to authenticate the subscriber and sends the RAND as a challenge to the MS. (2b) The SIM calculates a SRES and the ME sends it to the SGSN as a response. The SGSN may now allocate a new P-TMSI (packet TMSI) for the MS and a new ciphering key Kc is calculated by the SIM.
- #34 Steps 3 and 4 of intra-SGSN routing area update are shown in Figure 13. (3) The SGSN checks that the MS is allowed to attach to the RA, and if the check is successful, sends a Routing Area Update Accept message (that may include a new P-TMSI). (4) If the P-TMSI was reallocated, the MS acknowledges the new P-TMSI with a ' Routing Area Update Complete ' message.
- #35 Session management collectively refers to a set of procedures for the activation, deactivation, and modification of a data session between a MS and an external network. In order to set up data sessions, the GPRS system provides a group of functions for associating a MS with an address (typically the IP address) and for releasing this association. These are called PDP context functions . The resulting PDP context can also be modified. The MS can use the PDP context functions only when in Standby or Ready state. The MS can use various kinds of IP addresses. The home network operator may assign a static IP address to a MS permanently. Another option for the operators is to assign a dynamic IP address to a MS during PDP context activation. If the dynamic address is issued by the home operator, then the address is called HPLMN dynamic IP address . If the address is issued by the visited network operator, then it is called a VPLMN dynamic IP address . Whether or not the MS can have a dynamic address is defined in the subscriber's subscription parameters.
- #36 PDP context activation is sent from the MS to the SGSN, to which a GPRS is attached at present. Network-initiated PDP context activations are not currently supported even though they are defined in ETSI standards. An overview of the PDP context activation is shown in Figure 14. The steps of PDP context activation are the following: (1) MS sends an Activate PDP Context Request . (2) The MS may be authenticated and the IMEI checked. (3) The SGSN checks that the request is valid and sends a Create PDP Context message to the GGSN which includes the tunnel ID (TID). (4) The GGSN returns a Create PDP Context Response . The response message includes confirmation of the TID, IP address, and charging ID. The IP address is included if the GGSN allocates an IP address. The TID is used to identify the GTP tunnel used to transfer subscriber packets between the GGSN and the SGSN. The charging ID is used as an identifier for charging the subscriber. (5) The SGSN returns Activate PDP Context Accept message to the MS. This message includes important details, for example, the IP address the MS should use.
- #38 The SGSN and the GGSN serving a MS collect charging information about the MS’s GPRS service use. The information that the operator uses to generate a bill to a subscriber is operator-specific. Every GPRS operator collects and processes it’s own charging information. SGSN generates charging information on the radio network usage. GGSN generates charging information on external data network usage. Both GSNs also generate charging information on the usage of the GPRS network resources. Charging information is generated by the SGSN and GGSN and then delivered to the Charging Gateway (CG) using a real-time transfer enhanced GTP protocol - GTP’ . The Ga interface is used between the SGSN and CG. From the CG, the information is transferred to the Billing Centre. The charging process is pictured in Figure 22. As mentioned before, both SGSN and GGSN produce charging data, known as Call Detailed Records (CDRs). The GGSN has only one type of CDR, G-CDR , which includes (see Figure 23): Start collection: PDP context activation Stop collection: PDP context deactivation Collected information such as: Traffic volumes uplink/downlink QoS negotiated Duration SGSN and GGSN address Access point name The SGSN has several types of CDRs, S-CDR, M-CDR and SMS-CDR (see Figure 24). SGSN CDR (PDP context data) S-CDR includes: Start collection: PDP context activation Stop collection: PDP context deactivation Collected information, for example: Traffic volumes uplink/downlink QoS requested/negotiated Duration SGSN and GGSN address Access point name Mobility Management CDR: M-CDR Start collection: GPRS activation / incoming SGSN RA update Stop collection: GPRS deactivation / outgoing SGSN RA update Collected information: Location change Why do we have a CG? It should be taken into account that the amount of call detail records (CDRs) increases notably with the introduction of GPRS. Traditionally with GSM one subscriber could produce maybe an average of ten CDRs per day. With GPRS, we introduce different services plus we can be 'always connected'. Thus, if we are connected to a network through GPRS and we keep track on CDRs every ten minutes, the amount of charging data in the network multiplies. The main functions of the CG are: CDR collection from GSNs (CG receives the CDRs with GTP') Intermediate storage for CDRs CDR validation CDR consolidation CDR formatting Adaptation to different CCB system interfaces Reducing the CDR processing load of the CCB system.
- #40 GSM has taken pride in its strong security features that have been implemented since the introduction of the first GSM systems. The Internet (and TCP/IP networks in general) has, until recently, been notorious for offering weak security features. The explosive growth of the Internet has offered an attractive target for hackers trying to exploit security weaknesses in the TCP/IP protocol. The first question that comes to a GSM engineer's mind concerning GPRS might be: 'Is GPRS weak in security and a potential security risk to both GSM operators and/or customers?' There are some standard GSM security functions used in GPRS, but clearly additional security features are needed. The GPRS system has inherited the GSM Phase 2 security functions: Authentication of the subscribers IMEI checking User identity confidentiality (TMSI, now P-TMSI in GPRS) Ciphering of the data traffic between the MS and the SGSN. The authentication of the subscriber is done the same way by the SGSN in the GPRS system as by the MSC/VLR in the Phase 2 GSM network. IMEI checking can be done in the same way as for circuit switched GSM, with SGSN again playing the role of MSC/VLR. The user identity confidentiality works by assigning the MS an alias, much like the TMSI, called the packet TMSI (P-TMSI). The P-TMSI is only valid in a certain routing area. The P-TMSI is used to derive the Temporary Logical Link Identity (TLLI), which is used together with the Routing Area Identity. The TLLI is used as the MS’s address for transmission between SGSN and MS. Only the SGSN and the MS know the relation between a TLLI and an IMSI. The ciphering function used between the MS and the SGSN is not the same as that used in GSM Phase 2, but an optimised one for packet switched traffic. The additional GPRS security features are: Private IP addressing in the GPRS backbone Ciphered links and authentication between nodes in the GPRS backbone Screening of packets coming from the external networks.
- #42 The use of a private network with private IP-addresses is shown in Figure 25. The use of a private address space ensures that external hackers cannot address nodes in the private GPRS backbone network. It does not avoid attacks coming through the GPRS backbone itself. However, using private addresses in the backbone implies the use of Network Address Translation (NAT).
- #44 The GPRS firewall screens packets coming from external networks and discards unwanted packets. There are two primary reasons for the screening. The first reason is based on the fact that a subscriber pays for mobile originated (MO) and mobile terminated (MT) data packets. An Internet hacker could send unwanted packets to a user who may end up paying for it. A second reason is that unwanted packets also drain mobile’s battery and delay important packets. There are two types of screening available in the GGSN: network-controlled screening and subscription-controlled screening (see Figure 27). Network-controlled screening is used to protect the GPRS network from known security problems. The same screening applies for all users. Subscription-controlled screening is based on the subscription and is subject to an agreement between the subscriber and the operator.
- #45 Quality of Service (QoS) information for a user is contained in the HLR (subscribed QoS). The user may also request a specific QoS profile (requested QoS) which is associated with a PDP context. During the establishment of a PDP context, the GPRS network and the MS must negotiate a QoS profile (negotiated QoS profile). The operator may define a default QoS for all PDP contexts or define several QoS profiles that can be subscribed to by the user. If the MS asks a better QoS profile than contained in HLR subscription data, then the SGSN downgrades the parameters to the subscribed profile. The QoS profile is based in terms of the following attributes: Precedence class: Priority to be given to user packets Delay class: Delay associated with packets Reliability class: Amount of error control to be provided Peak throughput class Mean throughput class
- #51 Mean bit rate The mean bit rate (throughput) is measured at the Gi and R reference points in units of octets per hour . It specifies the average rate at which data is expected to be transferred across the GPRS network during the remaining lifetime of an activated PDP context. The network may limit the subscriber to the negotiated mean bit rate (for example, for flat rate charging), even if additional transmission capacity is available. A 'best effort' means bit rate class may be negotiated. This means that bandwidth will be made available to the MS on a need and availability basis. The mean throughput classes are defined in Table 6.