Prepared by : Rady AbdElWahed

Content
Chapter 1: Architecture
Chapter 2 : Nodes
Chapter 3: IDENTITIES
Chapter 4: GSM GEOGRAPHICAL Network
Chapter 5 :Location Update
Chapter 6 : Scenario
Chapter 7 :Interfaces
Chapter 8 :Protocols
Chapter 9: SS7
Chapter 10 :SS7 Over IP
Chapter 11: Signaling Messages

ARCHITECTURE

NETWORK ARCHITECTURE
MODELS

VERTICALLY INTEGRATED
NETWORKS
Many older networks in existence today can

be described as vertically integrated.

Vertically integrated networks are optimized

for a particular service category and typically

offer a single service or set of closely related
services.
The PSTN and PLMN are examples of

vertically integrated networks.

HORIZONTALLY INTEGRATED
NETWORKS
The rapid convergence of telecom and data

com technologies has lead to the integration of

vertical networks into multi-service (or next
generation) networks that provide reliable and
real-time communications for all service types.
All network functionality is split between:
the connectivity layer,
the control layer
the application layer

LAYERS AND NODES

THE CONNECTIVITY
LAYER
The Connectivity Layer consists of the transport

nodes (MMGW,SGSN and GGSN) and connects to

the various access networks.
The Access Network consists of the base stations

and controllers in the mobile networks (GSM,

UMTS, CDMA) or fixed access , transport and
connectivity network that are able to handle
different types of traffic (e.g. Circuit Switched and
Packet Switched data).

THE CONTROL LAYER

The Control Layer contains nodes that

control and direct traffic (both Circuit and

Packet Switched).
The WCDMA Core Network will contain, for

example, MSCs, HLR/HSS, GMSC/TSC, SGW

and possibly IMS.

THE APPLICATION LAYER

The Application Layer is responsible for

providing services to users via applications

regardless of the device and method in which the
user accesses the network.

MONOLITHIC
ARCHITECTURE

THE SPLIT
ARCHITECTURE
THE SPLIT ARCHITECTURE : The split architecture is where the MSC server
and the M-MGWs are separated.

Nodes

MSC
Mobile services Switching Center :
The primary node in a GSM network is the MSC.
It is the node, which controls calls both to MSs and from MSs.
The primary functions of an MSC include the following:

Switching and call routing

Charging
Service provisioning
Communication with:( HLR-VLR-MSCs)
Control of connected BSCs

MSCS
Mobile services Switching Center
server:
The MSC Server is an MSC with signaling only connections to

other network nodes.

It does not process the payload and has no Hardware ( such as

conference devices, announcement machines , code receivers and
senders, transcoders or data inter-working units for manipulating
the user plane data).

The MSC Server contains all call and service control logic such as

B-Number Analysis, Charging Analysis, Bearer Selection, Route

Analysis, Media gateway Selection and other analysis functions to
complete call handling requests.

MGW

Media Gate Way :

A MGW( handles traffic -Signaling Gateway Handler-Media

Streaming Functions).
The MGW connects the Mobile Core Network with external

networks .
The MGW makes IP, ATM and TDM transport possible in the

backbone network .
The following items are functions of the MGW:
Echo Canceller- Multiparty Call-Announcement Machine
Tone Sender/Receiver: Different tones (such as alerting,

busy, and so on) are played and sent.

VLR

Visitor Location Register:

The role of a VLR in a GSM network is to act as a temporary

storage location for subscription information for MSs which are

within a particular MSC service area.
Thus, there is one VLR for each MSC service area.
This means that the MSC does not have to contact the HLR

every time the subscriber uses a service or changes its status.

including the following information:
Identity numbers for the subscriber.
Supplementary service information .
Activity of MS (e.g. idle).
Current LA of MS.

HLR
Home Location Register :
The HLR is a centralized network database that stores
and manages all mobile subscriptions.
It acts as a permanent store for a persons

subscription information.

The information stored includes:

Subscriber
Subscriber
Subscriber
Subscriber

identity
supplementary services
location information
authentication information

AUC
Authentication Center:
The primary function of an AUC is to provide
information, which is then used by an
MSC/VLR to perform subscriber
authentication and to, establish ciphering
procedures on the radio link between the
network and MSs.

EIR
Equipment Identity Register:
The equipment identification procedure uses the identity of

the equipment itself (IMEI) to ensure that the MS terminal

equipment is valid .
The EIR examines three lists:
white list : containing all number series of all equipment identities
that have been allocated in the different participating GSM countries.
black list : containing all equipment identities that has been barred.
gray list : (on operator level) containing faulty or non - approved

mobile equipment.

FNR
FLEXIBALE NUMBER REGISTER:
keep CST MSISDN identity when changing
service provider or moving subscription
between two service domains within the
same country.

SSF
Service Switching Function :
The Service Switching Function (SSF) acts as an interface

between the normal mobile call control functions of an

MSC/VLR and the functions that control a MIN service.
The SSP performs the necessary switching, signaling and

charging to implement a MIN service, in response to the

instructions it receives from the Service Control Function (SCF).
An SSF includes functions for:
Initiating a MIN service (triggering).
Call handling and switching.
Activation of resources such as announcement machines.
Charging.
Communication with the MSC/VLR and with the SCF.

SCF
Service Control Function :
The logic and data required to execute a MIN
service is located in a SCP.
The SCP is the platform for the execution of
MIN services.
An SCF contains functions for:
Service script interpretation
Service script storage
Error handling
Communication with the SSF and SDF

SDP
Service Data Point :
SDP manages the data which is used by a MIN
service.

BSC
Base Station Controller :
The BSC manages all the radio-related
functions of a GSM network.
It is a high capacity switch that provides

functions such as MS handover, radio channel

assignment and the collection of cell
configuration data.

RNC
Radio Network Controller:
The RNC controls the RBS and the radio
resources.
The RNC is the service access point for all

WCDMA RAN providing services to the Core

Network.

TRC
Transcoder Controller :
The TRC provides the BSS with rate adaptation
capabilities.
This is necessary because the rate used over

the air interface and that used by MSC/VLR are

different 16kbits/s and 64 Kbits/s respectively.

BTS
Base Transceiver Station :
The BTS controls the radio interface to the MS.
The BTS comprises the radio equipment such

as transceivers and antennas which are needed

to serve each cell in the network. A group of
BTSs are controlled by a BSC.

Node B
provides the physical radio resources and
converts the
data flow between the Iub and Uu interface.

IDENTITIES

MSISDN
MOBILE STATION ISDN NUMBER :
The MSISDN is a number that uniquely
identifies a mobile telephone subscription.
MSISDN is composed of:
MSISDN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number

IMSI
INTERNATIONAL MOBILE SUBSCRIBER IDENTITY

The IMSI is a unique identifying code

allocated to each subscriber allowing correct
identification over the radio path and through
the GSM and WCDMA PLMN network.
IMSI = MCC + MNC + MSIN
MCC = Mobile Country Code
MNC = Mobile Network Code
MSIN = Mobile Subscriber Identification
Number

TMSI
TEMPORARY MOBILE SUBSCRIBER
IDENTITY

The TMSI can be used to keep

subscriber information confidential on
the air interface. It also increases
paging capacity, as the length of the
TMSI is shorter than the length of the
IMSI.

MSRN
MOBILE STATION ROAMING NUMBER:
When a mobile terminating call is to be set
up, the HLR of the called subscriber requests
the current MSC/VLR to allocate a MSRN to
the called subscriber.
MSRN = CC + NDC + SN
CC = Country Code
NDC = National Destination Code
SN = Subscriber Number

IMEI
INTERNATIONAL MOBILE EQUIPMENT IDENTITY

The IMEI uniquely identifies User Equipment

(UE) as a piece or assembly of equipment.

Using the IMEI, stolen mobiles or mobile not

type-approved, can be barred.

IMEISV
International Mobile Equipment Identity and
Software Version number:
The International Mobile Equipment Identity and
Software Version number (IMEISV) provides a
unique identity for every MS and also refers to the
version of software which is installed in the MS.
The version of software is important as it may

affect the services offered by the MS or its speech

coding capabilities.

GT
GLOBAL TITLE:
A Global Title (GT) is an identifying code, such
as dialed digits, which does not explicitly
contain information that allows routing in the
signaling network.
This requires the Signaling Connection Control

Part (SCCP) translation function,

MGT
Mobile GLOBAL TITLE:
When a UE is powered on in a PLMN, the VLR must

communicate with the UEs HLR to perform location updating.

The only data available in the MSC/VLR for the SCCP

addressing of the HLR is the IMSI number , However, for

signaling in the international PSTN/ISDN network IMSI cannot be
used.
Thus, it is necessary to convert the IMSI number in the

MSC/VLR into a Global Title (GT), which enables routing of the

S7 signaling to the proper HLR .
This converted number is called the Mobile Global Title (MGT).

GSM GEOGRAPHICAL
NETWORK

GSM GEOGRAPHICAL
NETWORK

CELL
A cell is the basic unit of a cellular

system and is defined as the area of

radio coverage given by one BS
antenna system.
Each cell is assigned a unique

number called Cell Global

Identity(CGI).

LOCATION AREA (LA)

A Location Area (LA) is defined as a group of cells.
Within the network, a subscribers location is known by the LA

which they are in.

The identity of the LA in which an MS is currently located is

stored in the VLR.

When an MS crosses a boundary from a cell belonging to one

LA into a cell belonging to another LA, it must report its new

location to the network1.
When an MS crosses a cell boundary within an LA, it does need
to report its new location to the network.

When there is call for an MS, a paging message is broadcast

within all cells belonging to an LA.

MSC SERVICE AREA

An MSC service area is made up of a number of

LAs and represents the geographical part of the

network controlled by one MSC.
In order to be able to route a call to an MS, the

subscribers MSC service area is also recorded and

monitored.
The subscribers MSC service area is stored in the

HLR.

PLMN SERVICE AREA

A Public Land Mobile Network (PLMN) service area

is the entire set of cells served by one network

operator and is defined as the area in which an
operator offers radio coverage and access to its
network.
In any one country there may be several PLMN

service areas, one for each mobile operators

network

GSM SERVICE AREA

The GSM service area is the entire

geographical area in which a subscriber

can gain access to a GSM network.

LN
Location Number :
The Location Number (LN) is a number related to a certain

geographical area, which the network operator specifies by

tying the location numbers to cells, location areas, or
MSC/VLR service areas.
The LN is used to implement features like regional/local

subscription and geographical differentiated charging.

The LN consists of the following:

Location Update

Location Update
Location Update Types:
1.IMSI attach
2.Location Updating Same MSC/VLR
3.Location Updating New MSC/VLR
4.Location updating type periodic registration
5.IMSI detach

IMSI attach
When an MS is switched on, the IMSI attach procedure is
executed , This involves the following steps:
The MS sends an IMSI attach message to the network indicating

that it has changed state to idle.

The VLR determines whether there is a record for the subscriber

already present, If not the VLR contacts the subscribers HLR for
a copy of the subscription information.
The VLR updates the MS status to idle.
Acknowledgement is sent to the MS.

Location Updating Same

MSC/VLR
If an MS detects a change in LAI on the BCCH, it informs the
network. When the MS sends the Location Updating message, the
MSC/VLR determines whether it is an MS which is already
registered, or if it is an MS visiting from another MSC/VLR.
The MS listens to BCCH in the new cell to determine the LAI.
The received LAI information is compared to the old one , If they

differ a location update is necessary.

The MS establishes a connection with the network via SDCCH

Authentication is performed.

If authentication is successful, the MS sends a Location

Updating Request to the system.
The system acknowledges Location Updating and requests
RBS and MS to release the signaling channel.

Location Updating New

MSC/VLR
When an MS roams into a new LA, location updating is
performed. The LA may belong to a new MSC/VLR.
When the Location Update Request is received by the
new VLR, it executes the procedure below.
Authentication is performed. If authentication is

successful , the VLR checks its database to determine

whether or not it has a record for this MS-subscription.
When the VLR finds no record for the MS, it sends a

request to the subscribers HLR for a copy of the MSsubscription.

The HLR passes the information to the VLR and updates its
location information for the subscriber.
The HLR instructs the old VLR to delete the information it
has about the MS subscription.
The VLR stores its subscription information for the MS
including the latest location and status (idle).
The VLR sends acknowledgement to the MS.

Location updating type periodic

registration
Periodic registration is a feature which forces

MSs to send a registration message to the

network at predefined intervals.
If an MS should miss such a registration, the

network will mark the MS as detached.

This may occur if an MS is out of the area of

coverage and ensures that needless paging is

not performed.

IMSI detach
IMSI detach enables the MS to indicate to the

network that it is switched off.

At power off, the MS sends an IMSI detach

message to the network.

On reception, the VLR marks the corresponding
IMSI as detached.
The HLR is not informed. No acknowledgement

is sent to the MS.

Traffic Cases

Traffic Cases
1. CALL FROM AN MS
2. Call To MS
3. MOBILE ORIGINATED SMS
4. MOBILE TERMINATED SMS

CALL FROM AN MS
This example describes what happens when a mobile subscriber
wants to set up a voice call to a subscriber in the PSTN.

The MS uses RACH to ask for a signaling channel.

The BSC/TRC allocates a signaling channel, using AGCH.

The MS sends a call set-up request via SDCCH to the MSC/VLR.

Over SDCCH all signaling preceding a call takes place. This

includes:
Marking the MS as active in the VLR.
The authentication procedure.
Start ciphering.
Equipment identification.
Sending the B-subscribers number to the network.
Checking if the subscriber has the service Barring of outgoing

calls activated.

The MSC/VLR instructs the BSC/TRC to allocate an idle TCH.

The RBS and MS are told to tune to the TCH.
The MSC/VLR forwards the Bnumber to an exchange in the PSTN, which
establishes a connection to the subscriber.
If the B-subscriber answers, the connection is established.

Call To MSC
The major difference between a call to an MS and a call from
an MS is that in a call to an MS the exact location of the
mobile subscriber is unknown.

1. The MSISDN is analyzed in the PSTN, which identifies that this

is a call to a mobile network subscriber. A connection is
established to the MSs home GMSC.
2. The GMSC analyzes the MSISDN to find out which HLR the MS
is registered in, and queries the HLR for information about how to
route the call to the serving MSC/VLR.
3. The HLR translates MSISDN into IMSI, and determines which
MSC/VLR is currently serving the MS. The HLR also checks if the
service, Call forwarding to Cnumber is activated, if so, the call
is rerouted by the GMSC to that number.

4. The HLR requests an MSRN from the serving MSC/VLR.

5. The MSC/VLR returns an MSRN via HLR to the GMSC.
6. The GMSC analyses the MSRN and routes the call to the MSC/VLR.
7. The MSC/VLR knows which LA the MS is located in , A paging message
is sent to the BSCs controlling the LA.
8. The BSCs distribute the paging message to the RBS's in the desired LA.
9.The RBSs transmit the message over the air interface using PCH. To
page the MS, the network uses an IMSI or TMSI valid only in the current
MSC/VLR service area.
10. When the MS detects the paging message, it sends a request on RACH
for a SDCCH.

11. The BSC provides a SDCCH, using AGCH.

12. SDCCH is used for the call set-up procedures , Over SDCCH all
signaling preceding a call takes place. This includes:
Marking the MS as active in the VLR
The authentication procedure
Start ciphering
Equipment identification

13. The MSC/VLR instructs the BSC/TRC to allocate an idle TCH.

14.The RBS and MS are told to tune to the TCH.
15. The mobile phone rings , If the subscriber answers, the

connection is established.

MOBILE ORIGINATED SMS

Mobile originated SMS transfers a short
message submitted by the MS to an SMS-C. It
also provides information about the delivery of
the short message, either by a delivery report
or failure report.

1. An MS establishes a connection to the network as in the case of a

normal call set-up , This step is not performed if the MS is in active
mode since the connection already exists.
2. If authentication is successful, the MS sends the short message using
SDCCH to the SMSC via the MSC/VLR.
3. The SMSC in turn forwards the short message to its destination.

MOBILE TERMINATED
SMS
Mobile terminated SMS has the capability to
transfer a short message from the SMSC to an
MS.

1. A user sends a message to a SMSC.

2. The SMSC sends the message to the SMSGMSC.
3. The SMSGMSC queries the HLR for routing information.
4. The HLR returns routing information to the SMS-GMSC.
5. The SMS-GMSC re-routes the message to the MSC/VLR.
6. The MS is paged and a connection is set up between the MS
and the network, as in the normal call set-up case.
7. If authentication is successful, the MSC/VLR delivers the
message to the MS. Short messages are transmitted on the
allocated signaling channel, SDCCH.

8. If the delivery was successful, a report is sent from the MSC/VLR to the SMSC, if
not, the HLR is informed by the MSC/VLR, and a failure report is sent to SMSC.
In the case of an unsuccessful delivery, the SMS-C informs the HLR and VLR that
there is a message waiting to be delivered to the MS. The HLR then informs the
SMSC when the MS becomes available.

Interfaces

Interfaces

D interface
The MSC HLR interface is a MAP interface

used to exchange data related to the location

of the mobile station and to the service
management of the subscriber.
The MSC FNR (Flexible Numbering Register)

interface is a MAP interface used for the

routing information of messages to the
specific node in the network when Mobile
Number Portability is used.

C interface
MSC HLR is a MAP interface for interrogation

of home HLR of visiting mobiles.

F interface
The MSC EIR interface is a MAP interfaces

and is used for exchange of information

needed for the validation of the mobile
terminal equipment.

L interface
The MSC SCF interface includes an Intelligent
Network Application Part ( INAP) based interface
between the SCF and a SSF co-located with the
MSC Server.
This interface is used for the SCF to provide IN

services.
It also includes the L interface, which is MAP

based and used for supplementary service

invocation notifications.

G Control Part (CP)

Interface:
The MSC MSC interface is a Mobile Application

Part MAP, interface for retrieval of identity and

authentication parameters from the old MSC
Server when the mobile subscriber makes a
location registration in a new MSC Server.

Iu Interface
The MSC RNC interface is a RANAP (Radio

Access Network Application Part) signaling

interface to provide signaling means to
establish, maintain, and release connections
in the Iu-user plane (WCDMA RAN MSC
Server/Media Gateway).

A interface
The MSC BSC interface is a BSSMAP signaling

interface used only in GSM networks to provide

signaling means to establish , maintain, and
release connections and the handling of handover(Access Network (AN) MSC Server/Media
Gateway).

Gs Interface
The Gs interface links the databases in the MSC

Server and the SGSN.

The interface is used to co-ordinate the location

update of Mobile Subscribers that are attached

both to the packet based and the circuit based
network.
The Gs interface is also used to convey some

circuit-based procedures such as Short Message

Services (SMS)via the SGSN.

Protocols

Protocols

MAP
MOBILE APPLICATION PART:
The Mobile Application Part (MAP) is an SS7 protocol which provides
services to mobile phone users using the various nodes in GSM,
UMTS, and GPRS networks. Specifically, its the application-layer
protocol used to share subscribers information among different
networks.
The Mobile Application Part (MAP) provides the necessary signaling

procedures required for information exchange between the MSC and

the Location Registers (HLR, FNR and EIR), and between the MSCs.
When a mobile subscriber roams into a new mobile switching center

(MSC) area, the integrated visited location register (VLR) requests

service profile information from the subscriber's home location
register (HLR) using MAP information carried within TCAP messages.

The primary facilities provided by MAP are:

Mobility Services: location management (roaming),

authentication, and fault recovery.

O&M (Operation and Maintenance): subscriber tracing,

retrieving a subscriber's IMSI.

Call Handling: routing, managing calls whilst roaming,

checking that a subscriber is available to receive calls.

Supplementary Services.

SMS (Short Message Service).

Location Management Services: obtaining the location of

subscribers

INAP
INTELLIGENT NETWORK APPLICATION
PROTOCOL:
The INAP protocol enables the Service Control

Function (SCF) to remotely control circuit based

call processes in real time through the Service
Switching Function (SSF).
The INAP is a SS#7 protocol and uses

TCAP/SCCP signaling.

N-ISUP
NARROW BAND ISDN USER PART :
The signaling system used between the MSC Server

and the PSTN or ISDN is based on ITU-T SS #7

signaling.
The transport of N-ISUP signaling to external nodes is

done via the M-MGW where a transparent mapping of

the lower layer protocols is performed.
ISDN User Part (ISUP) supports basic telephone call

connect/disconnect between end offices.

ISUP defines the protocol and procedures used to

setup, manage and release circuits that carry voice

and data calls over the public switched telephone
network.
Calls that originate and terminate at the same switch

do not use ISUP signaling.

ISDN User Part messages are carried on the signaling

link by means of signal units.

BICC
BEARER INDEPENDENT CALL CONTROL:
BICC is similar in function to the N-ISUP protocol and based on the
ITU-T standard which provides the means for supporting narrowband
ISDN services across an ATM or IP network.

BICC is a network-network interface (NNI) call control protocol

that supports the defined ISDN services and transport

technologies other than Synchronous Transfer Mode, STM, that is
ATM and IP.
The BICC protocol has two main functions:
To pass Call Control information between servers, including B

number and service requirements of the connection.

To transfer information related to bearer set up and M-MGW
identity, which is used to establish a bearer at the connectivity
(M-MGW) layer.

GATEWAY CONTROL
PROTOCOL
This protocol describes the remote control

services that are implemented via GCP to

control Call setup for circuit switched speech
and circuit switched data calls too.
This external control interface is used by the

MSC Server/ MSC Media Gateway to add and

remove media stream functions into a speech
and data connection.

BSSAP
BSS MOBILE APPLICATION PART:
The MSC Server handles Radio Access Bearers

in the GSM Access Network utilizing the BSSMAP

protocol.

BSSGP
BSS GPRS PROTOCOL :
The primary function of Base Station System

GPRS Protocol (BSSGP) is to provide the radiorelated, QoS , and routing information required
to transmit user data between a base Station
Controller (BSC) and an SGSN in a GSM network.
A secondary function is to enable two

physically distinct nodes, the SGSN and the BSC,

to operate node management control functions.

RANAP
RADIO ACCESS NETWORK APPLICATION
PART:
The MSC Server handles Radio Access Bearers

in WCDMA RAN utilizing the RANAP protocol.

TCAP
TRANSACTION CAPABILITIES APPLICATION PART:
Transactional Capabilities Application Part (TCAP)
connection to an external database.

facilitates

TCAP is designed for non-circuit related messages.

TCAP provides a means for SCP-to-SCP communication via STPs.
TCAP messages are used by SSPs to query an SCP (via an STP) to

determine the routing numbers associated with a global title.

The SCP uses TCAP to return a response containing the routing

numbers back to the SSP via STP.

TCAP messages are transferred end-to-end using the services of

SCCP.

CAP
CAMEL Application Part :
is a real time protocol used to support the
information flows between CAMEL (Customized
Application for Mobile network Enhanced Logic)
functional elements such as the SCF (Service
Control Function) and SSF (Service Switching
Function).

TUP
Telephone User Part :
is an analog protocol that performs the basic
telephone call connect and disconnect. It has been
replaced by ISUP, but is still used in some parts of
the world (China).

SS7

SS7 Signaling
Signaling means the transfer of information

and the instructions relevant to control and

monitor telephony connections.
external signaling has been divided into two
basic types:
Access signaling : This means signaling

between a subscriber terminal (telephone)

and the local exchange.
Trunk signaling : This is used for signaling
between exchanges.

ACCESS SIGNALING
There are many types of access signaling, for

example, PSTN analog subscriber line signaling, ISDN

Digital Subscriber Signaling System (DSS1), and
signaling between the MS and the network in the GSM
system.
Digital Subscriber Signaling System No. 1 (DSS1) is

the standard access signaling system used in ISDN. It

is also called a D-channel signaling system.
D-channel signaling is defined for digital access lines

only. The signaling protocols are based on the OSI

(Open System Interconnection) reference model,
layers 1 to 3.

TRUNK SIGNALING
The Inter-exchange Signaling information is

usually transported on one of the time slots in a

PCM link, either in association with the speech
channel or independently.
There are two commonly used methods for Inter

Exchange Signaling:

CAS
Channel Associated Signaling:
means that the signaling is always sent on the same connection (PCM

link) as the traffic.

The signaling is associated with the traffic channel In a 2 Mbps PCM link,
30 time slots are used for speech, whereas TS 0 is used for
synchronization and TS 16 is used for the line signaling .
All 30 traffic connections share TS 16 in a multi frame consisting of 16
consecutive frames.
Line Signals:
Line Signals are used during the whole duration of a call to monitor the
status of the connection and traffic circuit. Example: Seizure, Answer
signals.
Register Signals:

The Register Signals are used during the set-up phase of a call to transfer
address and category information.

CCS
Common Channel Signaling :
In this case a dedicated channel, completely separate from the

speech channel, is used for signaling.

Due to the high capacity, one signaling channel in CCS can

serve a large number of speech channels.

In a GSM network, CCITT Signaling System No. 7 is used ,

Signaling System No. 7 is a Common Channel Signaling system.

In CCS, signaling messages are transmitted over time slots in a

PCM link reserved for the purpose of signaling, instead of Line

Signals and Register Signals (which do not exist in CCS).

SIGNALING SYSTEM
NO. 7

CHARACTERISTICS
High flexibility:

Many different types of telecommunication services can use SS7.

It is used to set up and release connections in traditional telephony
and data communication, in mobile telephony and data
communication, for the provision of ISDN services, and many other
applications.
High capacity:

A single signaling link can support several thousand traffic circuits.

High speed :

Setting up a call through a number of exchanges takes less than a

second.

OSI MODEL AND SS

NO.7

OSI REFERENCE
MODEL
The Signaling System No. 7, is structured in a modular and layered way.
Such a design of SS7 is similar to the Open System Interconnection

model.
The Signaling Connection Control Part (SCCP) together with the

Message Transfer Part (MTP) provide OSI layers 1-3 services.

For each layer in the Reference Model the standardization is split into

two main parts:

Service definition defines the functions that each layer
should contain and with which services the layer should
provide the user or the layer closest above.
Protocol definition specifies how the functions within a layer
in one system co-operate with the corresponding functions in
another system.

Signaling Network
Elements

SP
Signaling Point :
A Signaling point can be described as, the

switching or
processing node in a signaling network .
Every SP is identified by a number determined by the

Network Indicator (NI) and Signaling Point Code (SPC).

The Signaling Point Code (SPC) uniquely

identifies an SP within the signaling network.

OP&DP
Originating Point:
The Signaling Point (SP) at which the signaling
message is generated. It is identified by an
Originating Point Code (OPC).
Destination Point:
The Signaling Point (SP) to which the signaling
message is destined. It is identified by a
Destination Point Code (DPC).

STP
Signaling Transfer Point:
This is a Signaling Point (SP) that is able to
route/reroute the signaling messages. In GSM,
every SP is an STP as soon as it routes the
signaling message that must be delivered to a
different destination point.

SL&LS
Signaling Link:
The packet data link that connects two SPs is a
Signaling Link (SL).
Link Set:
A number of parallel Signaling Links (SLs), to a
maximum of 16, connecting the same Signaling
Points (SPs) is referred to as a signaling Link Set
(LS).

SR&SRS
Signaling Route :
The predetermined path a message takes through the
signaling network between the Origination Point (OP) and the
Destination Point (DP) is called a Signaling Route (SR).
A Signaling Route is defined as a link set which is assigned to

carry traffic to a particular destination.

Signaling Route Set:
The signaling network groups all Signaling Routes (SRs) that
may be used for message traversing between an Origination
Point (OP) and a Destination Point (DP), and refers to them as
a Signaling Route Set (SRS) for that signaling relation.

The general structure of CCITT

Signaling System No. 7

FUNCTIONAL LEVELS

Level 1
Signaling Data link:
Defines the functions of the physical interface of the signaling link to

the exchange and to the trunk network.

A signaling data link is a bi-directional transmission path for signaling,

that is, two data channels working together in opposite directions at

the same bit rate. This path can be either digital or analog.
DIGITAL SIGNALING DATA LINK: Usually, one channel of a

first-order PCM system is used as a signaling data link.

CCITT recommends channel (that is, time slot)16, but
states that if channel 16 is unavailable, any of the
channels 1-31 may be used. The bit rate of the
transmission is thus 64 kbps.
ANALOG SIGNALING DATA LINK : In exceptional cases an
analog signaling data link may be used.

Level 2
Signaling Link functions:
Includes all functions required to ensure
reliable transfer of signaling messages on each
individual signaling link.
The signaling data link and the signaling link

functions together constitute the whole

Signaling Link (SL) that is used for reliable
transmission of signaling messages between
two signaling points.

Level 3
Signaling Network functions:
The main purpose of the Signaling Network
functions on level 3 is to ensure reliable handling of
incoming or outgoing signaling messages sent from
one signaling point via interconnected signaling
links to other signaling points.

SCCP
The Signaling Connection Control Part:
Is added as a functional layer above the
Message Transfer Part in order to meet a
number of new requirements ..
The combination of the MTP and the SCCP is

called the Network Service Part (NSP).

SCCP Addressing

 The SCCP uses the following addresses:

Calling address identifies call origination.
Called address identifies call destination.
SCCP addressing is very flexible and makes use of three
separate Elements:
Destination Point Code (DPC)
Global Title (GT)
SCCP Sub System Numbers (SSN)

GT
GLOBAL TITLE:
The GT contain specified combinations of:
ADDRESS INFORMATION (AI)
NATURE OF ADDRESS (NA)
NUMBERING PLAN (NP)
TRANSLATION TYPE (TT)

SCCP Subsystem
Number

HIGH-SPEED
SIGNALING LINK
The limit for the link sets is 16 signaling links per LS.
This limits the LS capacity to 1 Mbps (that is, 16 *

64 kbps).This can be greatly enhanced by Highspeed Signaling Links (HSL), which have almost 2
Mbps capacity per SL.
High-speed Signaling Links use :
MTP level 3 (the signaling network level) of the
SS7 .
ATM (Asynchronous Transfer Mode) .
SAAL (Signaling ATM Adaptation Layer for BISDN , that is, Broadband ISDN) protocols.

Traditional MTP versus ATMbased MTP

SAAL : Signaling ATM Adaptation

Layer
NNI : Network Node Interface
SSCS : Service Specific
Convergence Sub layer
SSCF : Service Specific
Coordination Function
SSCOP : Service Specific
Connection-Oriented Protocol
AAL5 : ATM Adaptation Layer type
5
CPCS : Common Part Convergence
Sub layer
SAR : Segmentation and
Reassembly
ATM : Asynchronous Transfer Mode

SIGTRAN

SS7 OVER IP
In telecommunication today there is a greater drive to migrate all

traffic generated in a network to packet switched transport protocols.

The horizontal integrated network was defined into three different

areas. The Application Layer the Control layer and the connectivity
layer. The whole concept of the connectivity layer was to provide the
network with a common transmission platform from which to switch all
call scenario types.
As IP is considered to be a more efficient way of transporting

information around a network, there is a push to have it as the

primary transport mechanism. This signaling transport mechanism is
referred to as SS7 over IP, or more commonly known as SIGTRAN.
In the beginning the TDM network provided a 64Kb/s-signaling link

between two places, This is traditionally known as Narrowband SS7.

 Then when the CN model was introduced, ATM was considered to be the
common transport mechanism given the role it plays in the connectivity
layer. This allowed our signaling links to increase through put to deliver
larger amounts of data with a little less effort.
ATM allowed links to be established as needed instead of allocating
permanent resources. The use of ATM to transfer SS7 messages is
known as Broadband SS7. This increased the link from 64K b/s to 2M b/s.

NETWORK STRUCTURE
TRADITIONAL SS7

SIGTRAN SS7

SIGTRAN PROTOCOL
STACKS

M3UA Protocol Layer

Its main function is to provide MTP routing for SS7

messages, also provides a supervisory function,

maintaining communication towards other nodes
in the network.
The function and features provided by M3UA are

to maintain routes and association states between

peer M3UA layers of other nodes.

M3UA Association
The M3UA association is the representation of

the SCTP association in M3UA layer.

M3UA maintains variables relating to

established associations , For flow and

congestion control M3UA assigns states to
each of the established associations.

M3UA Route
A signaling route in M3UA is the same as the

MTP routing for both narrowband and

broadband SS7.
A route identifies an outgoing association that

can be used to send data towards a specific

signaling destination.
The route information is combined between an

association and a signaling destination.

M3UA Route Set

A M3UA route set is a collecting of all

alternative routes toward a specific signaling

destination.
If the route set is not available then a

destination is considered to be unreachable.

M3UA Signaling
destination
The M3UA signaling destination is a node that

can be signaled to.

The use of a SPC is used to identify a Signaling

Destination (it is referred to as the DPC of an

outgoing message).
The sending node doesnt know if the receiving

node is an SS7 (traditional narrowband or

broadband) or an IP-SEP (IP Signaling end point).

M3UA Signaling
Procedures

M3UA Signaling
Procedures
1. M3UA sends an Associate primitive to the SCTP instance. This

primitive contains the Association Id, the destination IP

address and outbound stream count.
2. The SCTP protocol then uses the INIT chunk to establish an

SCTP association between two SCTP endpoints.

3.

The receiving SCTP entity then responds with an INIT Ack

chunk.

4.

The initiating SCTP entity then forwards a COOKIE EHCO

chunk.

5.

Then the receiving SCTP entity responds with a COOKIE Ack

chunk. This chunk is always used to acknowledge a COOKIE
ECHO once it is received.

6.

Once the SCTP entities have established their associations then SCTP at both ends send
the Communication UP primitive to the M3UA layers. This indicates that the M3UA layers
can communicate Peer to Peer now. The Communication UP primitive is used by the SCTP
protocol to indicate that it is ready to send or receive information between to two SCTP
endpoints.

7.

The M3UA layer sends an ASP UP protocol message towards its peer M3UA layer to
indicate that it is ready to receive any messages from the peer. This message is a State
Maintenance message.

8. The receiving M3UA layer responds with an ASP UP Ack protocol message. It is used to
acknowledge the receipt of the ASP UP protocol message. This message is a State
Maintenance message.
9.

From here the originating M3UA layer will send an ASP activate protocol message. The
M3UA layer to indicate to its peer M3UA layer it is ready to receive signaling messages uses
this message. This message is a Traffic Maintenance message.

10. Once the ASP activate message is received by the M3UA layer will respond with the ASP
activate Ack message. This message is a Traffic Maintenance message.
11. Finally the Data to be sent is sent across the Active association between the two M3UA
peers.

SCTP Protocol Layer

The SCTP protocol layer is responsible for providing the

reliable connection between two IP signaling nodes. The

signaling connection is established by means of an SCTP
association.
The Stream Control Transmission Protocol (SCTP) layer

provides connection - orientated services between SCTP

peer nodes by means of SCTP associations. These SCTP
associations provide the reliable connection between two
signaling end points. It offers acknowledged, error free nonduplicated transfer of messages.
For a SCTP node to communicate with other SCTP nodes in

the network an SCTP association is defined. This association

is created so each signaling point in the network

SCTP ASSOCIATION
The SCTP association is the logical

relationship between two SCTP end points.

This association includes the protocol state

information , Verification Tags and the

currently active set of Transmission Sequence
Numbers between the two SCTP end points.
It can be said that the SCTP association is like
the logical grouping of signaling links in
traditional SS7, called a link set.

SCTP END POINT

The SCTP endpoint is the logical sender/receiver

of SCTP packets .
It comprises of a set of transport addresses (a
combination of IP addresses and port numbers)
for sending and receiving SCTP packets
between the two SCTP endpoints.
These transport addresses must be unique to
the SCTP endpoint throughout the network. This
is very similar to the signaling point code of a
node being unique within the signaling network.

SCTP Signaling
procedures

IP Protocol Layer
The IP protocol layer provides connectionless

services between IP nodes. IP routers provide

normal IP routing between sending and
receiving nodes. The routing paths are
established and maintained through the use of
routing protocols like RIP, OSPF, BGP, static
routes, etc.
It is expected that the Quality of Service of the
IP protocol layer is worse than the QoS achieved
in a SS7 network. Here, QoS means for example
network reliability, transmission time and
recovery time after path failure.

Signaling Messages

Location Update

1. The SIM card contains the unique IMSI which every

subscriber has, along with the authentication parameters to
ensure that this user authenticated to this network.
2. The SIM card sends the message called (Send
Authentication Info) SAI by IMSI number to MSC.
3. The MSC converts the IMSI to MGT (Mobile Global Title) to
direct the message to SCCP relay.
4. The MSC sends the IMSI to the SCCP relay, in order to direct
the SAI for correct HLR.
5. The HLR replies to the MSC with the TRIPLETS.

6.

* RAND = Random number used for authentication.

7.

8.

* KC = a key thats used for ciphering.

* SRES = the signed response to an authentication request.

9. The MSC compares the authentication parameters.

10. If the authentication passes, the MSC sends the UPL (Update Location) to the
HLR.
11. The HLR replies to the MSC with the ISD (Insert Subscriber Data) message.

1. When a call request is delivered to the MSC-A, the MSC-A functions

are triggered. A request named SRI (Send Routing Information) is
sent to the HLR. The message contains the requested call type and
the B#.
2. The MSC-A send the B number to FNR (Flexible Number Register)..
3. The FNR checks the number, if in same network or not, then
forwards the SRI request with the B# to the HLR-B.
4. The HLR-B checks in its database in which VLR the B# is currently
attached on (the MSC-B address was received earlier during the last
LU). Then the HLR sends a PRN (Provide Roaming Number) request
to the serving MSC-B for assigning a roaming number from the pool.
5. The MSC-B checks if the service request can be granted and returns
an allocated MSRN (Mobile Subscriber Roaming Number) to the HLRB.
6. The HLR-B sends the MSRN TO MSC-A to open an ISUP call between
MSC-A and MSC-B.

During Call

1. IAM (Initial Address Message): This is usually the first

message that is sent when setting up the connection
between two exchanges, and consequently it is always
sent in the forward direction, The IAM contains
parameters carrying information about the called
subscribers number (B-number).
2. ACM (Address Complete Message): This message is sent
in the backward direction from the terminating
exchange to the originating one. It indicates that all the
necessary address information is received and that the
called subscriber is identified and free and alerted by a
ringing signal.
3. ANM (Answer Message): ANM indicates that a call has
been answered. Typically, when this message is
received, the charging of the call starts.

4. REL (Release Message): This message initiates the release of a

circuit used for a call. The call release can be initiated by either of the
subscribers or the network.
5. RLC (Release Complete): RLC is sent in response to REL. It confirms
that the release of the circuit is completed so that the circuit can
return to idle state again and serve new call.

1. The MSC-A sends a FSM-MO (Forward Short

Message - Mobile Originating) request to SMSC.
The request contains the B#, the message
content, and the IMSI of the A#.
2. The SMSC sends a SRI-SM message to HLR-B
through GMSC-B.
3. The HLR-B sends to SMSC the IMSI and the last
update location of the B#.
4. The SMSC sends the FSM-MT (Forward Short
Message - Mobile Terminated) to the MSC-B.