Idle Mode Behavior

Prepared by- Md. Rabiul Hasan RF Design, Access Network 20th May, 2012

Presentation on-

Introduction To get an idea about idle mode behavior (GSM procedures/events) those are IMSI Attach IMSI Detach Location Area Update

Confidential
2

What is Idle Mode/Idle Mode Behavior?

A powered on Circuit Switched (CS) mobile station (MS) that does not have a dedicated channel allocated is defined as being in idle mode. When a MS is powered on It immediately attempts to make contact with a GSM Public Land Mobile Network. It will look for and select a suitable cell of the chosen PLMN. This selection is known as camping on a cell. The idle mode behavior is managed by the MS. It can be controlled by parameters which the MS receives from the base station on the Broadcast Control Channel (BCCH). All of the main controlling parameters for idle mode behavior are transmitted on the BCCH carrier in each cell.

Confidential
3

What is IMSI?
IMSI means International Mobile Subscriber Identity. The IMSI is how the subscriber is identified to the network. The IMSI is composed of three parts: Mobile Country Code (MCC) Mobile Network Code (MNC) Mobile Subscriber Identification Number (MSIN) For BangladeshMCC 470 470 470 470 470 470 MNC 01 02 03 04 05 06 Brand Grameenphone Robi Banglalink TeleTalk Citycell Airtel MSIN 017XXXXXXXX 018XXXXXXXX 019XXXXXXXX 015XXXXXXXX 011XXXXXXXX 016XXXXXXXX

Confidential
4

IMSI Attach
A MS performs an IMSI Attach when it comes onto a network. If a phone is just powering up, it will contact the network and perform an IMSI Attach, letting the network know where the MS is. IMSI attach processes are1. 2. 3. 4. 5. Channel Request IMSI Verification / Request Triplets Authentication Encryption Location Update

Confidential
5

IMSI Attach Processes

1. Channel Request
a. b. c. The MS will send a Channel Request (CHAN_REQ) message to the BSS on the RACH. The BSS responds on the AGCH with an Immediate Assignment (IMM_ASS_CMD) message and assigns an SDCCH to the MS. The MS immediately switches to the assigned SDCCH and sends a Location Update Request (LOC_UPD_REQ) to the BSS. The MS will send either an IMSI or a TMSI to the BSS. The BSS will acknowledge the message. This acknowledgement only tells the MS that the BTS has received the message, it does not indicate the location update has been processed.

d.

Confidential
6

IMSI Attach Processes

2. IMSI Verification / Request Triplets
a. b. The BSS forwards the Location Update Request to the MSC/VLR. The MSC/VLR forwards the IMSI to the HLR and requests verification of the IMSI as well as Authentication Triplets (RAND-Random Number, SRES- Authentication Response, Kc-Session Key). The HLR will forward the IMSI to the Authentication Center (AuC) and request authentication triplets. The AuC generates the triplets and sends them along with the IMSI, back to the HLR. The HLR validates the IMSI by ensuring it is allowed on the network and is allowed subscriber services. It then forwards the IMSI and Triplets to the MSC/VLR.

c. d. e.

Confidential
7

IMSI Attach Processes

3. Authentication
a. b. c. The MSC/VLR stores the SRES and the Kc and forwards the RAND to the BSS and orders the BSS to authenticate the MS. The BSS sends the MS an Authentication Request (AUTH_REQ) message to the MS. The only parameter sent in the message is the RAND. The MS uses the RAND to calculate the SRES and sends the SRES back to the BSS on the SDCCH in an Authentication Response (AUTH_RSP). The BSS forwards the SRES up to the MSC/VLR. The MSC/VLR compares the SRES generated by the AuC with the SRES generated by the MS. If they match, then authentication is completed successfully.

d.

Confidential
8

IMSI Attach Processes

4. Encryption
a. The MSC/VLR forwards the Kc for the MS to the BSS. The Kc is NOT sent across the Air Interface to the MS. The BSS stores the Kc and forwards the Set Cipher Mode (CIPH_MOD_CMD) command to the MS. The CIPH_MOD_CMD only tells the MS which encryption to use (A5/X), no other information is included. The MS immediately switches to cipher mode using the A5 encryption algorithm. All transmissions are now enciphered. It sends a Ciphering Mode Complete (CIPH_MOD_COM) message to the BSS. The MSC/VLR sends a Location Updating Accept (LOC_UPD_ACC) message to the BSS. It also generates a new TMSI for the MS. TMSI assignment is a function of the VLR. The BSS will either send the TMSI in the LOC_UPD_ACC message or it will send a separate TMSI Reallocation Command message (TMSI_REAL_CMD). In both cases, since the Air Interface is now in cipher mode, the TMSI is not compromised. The MS sends a TMSI Reallocation Complete message (TMSI_REAL_COM) up to the MSC/VLR. The BSS instructs the MS to go into idle mode by sending it a Channel Release (CHAN_REL) message. The BSS then de-assigns the SDCCH. The MSC/VLR sends an Update Location message to the HLR. The HLR records which MSC/VLR the MS is currently in, so it knows which MSC to point to when it is queried for the location of the MS.

b. c.

d. e. f.

Confidential
9

IMSI Attach Processes

5. Location Update
a. b. c. The MS sends a TMSI Reallocation Complete message (TMSI_REAL_COM) up to the MSC/VLR. The BSS instructs the MS to go into idle mode by sending it a Channel Release (CHAN_REL) message. The BSS then deassigns the SDCCH. The MSC/VLR sends an Update Location message to the HLR. The HLR records which MSC/VLR the MS is currently in, so it knows which MSC to point to when it is queried for the location of the MS.

Confidential
10

IMSI Detach
A MS will perform an IMSI Detach when it powers off. An IMSI Detach message informs the network that the MS is no longer on the network and should not be paged. In most networks, the MSC/VLR will initiate an IMSI Detach if the MS has not been active on the network for a specified period of time. IMSI detach processes are-

1. Channel Request 2. IMSI Detach Request

Confidential
11

IMSI Detach Processes

1. Channel Request
a. 1. The MS requests a channel in the same manner it does in the Location Update and IMSI Attach. The MS sends a Channel Request message on the RACH. The BSS replies on the AGCH and assigns the MS a SDCCH. The MS sends an IMSI Detach Indication (IMSI_DET_IND) message to the BSS on the SDCCH. The BSS forwards the message to the MSC/VLR

b. c.

Confidential
12

IMSI Detach Processes

2. IMSI Detach Request
a. b. The MSC/VLR sends a Location Cancel Request to the HLR. The HLR marks the IMSI as detached and removes any pointers for the IMSI from its registry. It then sends a Location Cancel Acknowledgment message to the MSC/VLR.

Confidential
13

Location Area Update

A MS will need to update its location whenever it moves to a tower that is serviced by a different VLR then the one it is currently on. An MS c an move from BTS to BTS without ever telling the network, as long as it is within the same location area. Once it moves to a new location area, it is required to inform the network. If the MS moves to another Location Area then the processes are-

1. 2. 3. 4.

Channel Request Gaining VLR requests data from Losing VLR Location Update Updating the Registers

Confidential
14

Location Area Update Processes

1. Channel Request
a. b. c. The MS requests a channel by sending a Channel Request (CHAN_REQ) message on the RACH. The BTS responds by sending an Immediate Assignment Command (IMM_ASS_CMD) message on the AGCH. The MS switches to the assigned SDCCH and replies with a Location Update Request (LOC_UPD_REQ). Included in the LOC_UPD_REQ is the TMSI the MS is currently using as well as the Location Area Identifier (LAI) of the VLR it is leaving. The BTS acknowledges receipt of the message.

d.

Confidential
15

Location Area Update Processes

2. Gaining VLR requests data from Losing VLR
a. b. The BSS forwards the Location Update Request to the gaining MSC/VLR. The gaining MSC/VLR does not recognize the TMSI/IMSI of the MS, so it contacts the losing MSC/VLR that corresponds to the LAI that was provided by the MS. The new MSC/VLR requests the subscriber data for the given TMSI. The gaining MSC/VLR will then authenticate the MS. There are two ways this could occur. First, the losing MSC/VLR may have forwarded any sets of triplets that it was retaining for the MS. The gaining MSC/VLR would then just use the next set of triplets. Second, the gaining MSC/VLR could contact the HLR and request authentication triplets from the AuC and proceed with authentication that way.

c.

Confidential
16

Location Area Update Processes

3. Location Update
a. Once the MS has been authenticated and is in Cipher Mode, the MSC/VLR sends a Location Update Accept (LOC_UPD_ACC) message through the BSS to the MS. The LOC_UPD_ACC may have a TMSI assignment in it, otherwise the TMSI will be assigned in a TMSI_REAL_CMD message. The MS will respond with a TMSI Reallocation Complete (TMSI_REAL_COM) message indicating it has received the TMSI. The BSS then sends the MS a Channel Release (CHAN_REL) message instructing it to go into idle mode. The BSS then un-assigns the SDCCH. As far as the MS is concerned, the location update has been completed.

b. c.

Confidential
17

Location Area Update Processes

4. Updating the Registers
a. The Gaining MSC/VLR sends an Update Location message to the HLR. The HLR updates its records to point to the gaining MSC/VLR when it is asked for its location. b. It also passes on subscriber information for the MS to the gaining MSC/VLR. c. The HLR sends a Cancel Location message to the losing MSC/VLR. d. The losing MSC/VLR deletes the MS's record and also releases the TMSI for reassignment. Then it sends a Cancel Location Result message back to the HLR, confirming the cancellation.

Confidential
18

References http://gsmfordummies.com/tdma/logical.shtml

Confidential
19

Confidential
20