A900/1800 NSS - PLMN setting in RCP and HLR

7 Defence

7.1
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.1

 7 Defence
Session presentation

▼ Objective: to manage PLMN common data related

to BSS defence

7.2

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.2

 Defence
Session presentation

▼ Program:
z 7 Defence
z 7.1 BSS overload processing
z 7.2 Simplified security procedure
z 7.3 ‘STATUS’ message management
z 7.4 HLR supervision
z 7.5 Unsolicited messages

7.3

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.3

 7 Defence

7.1 BSS overload processing

7.4
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.4

 7.1 BSS overload processing
Introduction

▼ The BSC detects the overload and and notifies the RCP via a
"BSSMAP_OVERLOAD" message. The overload may originate :
z from a LAC or
z from the BSC (Processor overload).

▼ During the overload period, "PAGING" messages are no longer sent to

this destination (F-PA-004 active).
z To limit disruptions to traffic, timers (T5 and T6) have been
implemented.

▼ The BSC can also detect a traffic overload in a cell and send a
"BSSMAP_LOAD_INDICATION" message to the RCP.
z The purpose of this is to warn adjacent BSCs not to use this cell for
handovers (F_LD_002 active).

7.5

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.5

 7.1 BSS overload processing
Timers

BSSMAP_OVERLOAD cause :
No BSSMAP_PAGING message is sent
• CCCH congestion = LAC
overload
• Processor's congestion = BSC
overload
to the BSC marked as congested.
Or The BSSMAP_PAGING messages
sent to the BSC show restrictions BSSMAP_PAGING
affecting the cells of the congested message is sent to the
location areas in the "Cell Identifier List" BSC or BSC/LAC
parameter. previously marked as
congested.

With possibility of new

overload !

T5_BSC or T5_LAC T6_BSC or T6_LAC

T0 T5 T6

Time T
BSC or LAC overload BSSMAP_OVERLOAD Overload end
state indication Message disregarded indication
because T0<T5

7.6

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.6

 7.1 BSS overload processing
Flow Diagrams

NULL
A1
OVERLOAD
(BSC)

F_PA_004 N
active?

N N
Cause = Cause =
CCCH overload ? Processor overload ?

N Y
LAC retrieved
from Cellid?

LAC Congestion BSC Congestion

check Check

NULL NULL

7.7

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.7

 7.1 BSS overload processing
Flow Diagrams - BSC congestion

BSC congestion
check

Congestion indication set for Y

sending BSC ?

Set timer T6_BSC Y T5 indication

for the BSC set for the BSC ?

Set timer T5_BSC Reset existing

for the BSC T6_BSC for the BSC

Set Congestion indication for Set timer T6_BSC

sending BSC for the BSC

Set T5 indication Set timer T5_BSC

for sending BSC for the BSC

WR_LD-003
Set T5 indication for the BSC
PMLX 6055

7.8

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.8

 7.1 BSS overload processing
Flow Diagrams - LAC congestion

LAC congestion
check

Congestion indication set for Y

the LAC ?

Set timer T6_LAC Y T5 indication

for the concerned LAC set for the LAC ?

Set timer T5_LAC Reset existing

for the concerned LAC T6_LAC for the concerned LAC

Set Congestion indication for Set timer T6_LAC

the LAC for the concerned LAC

Set T5 indication Set timer T5_LAC

for the LAC for the concerned LAC

WR_LD-001
Set T5 indication for the LAC
PMLX 6053

7.9

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.9

 7.1 BSS overload processing
Flow Diagrams - T5 & T6 timers

A1

T6_LAC timer T6_BSC timer T5_BSC timer T5_LAC timer

expiry expiry expiry expiry

Reset congestion Reset congestion Reset T5 Reset T5

indication for the LAC indication for the BSC indication for the BSC indication for the LAC

WR_LD_002 WR_LD_004
PMLX 6054 PMLX 6056

NULL

7.10

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.10

 7.1 BSS overload processing
Message - Flow control request

Message identification Parameters Phase 2

« Flow control request » - Message type M

MI_OVERLOAD - Cause (1) M

BSC Î RCF - Cell identifier (2) O

M: Mandatory
O: Optional
(1) ‘0100011’ = CCCH overload
‘0100100’ = Processor overload
(2) Cell identification discriminator = ‘0000’ (Cell Global Identification)
= ‘0001’ (LAC+CI)

7.11

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.11

 7.1 BSS overload processing
Message - Load indication

Message identification Parameters Phase 2

« Load indication » - Message type M

MI_LOAD_INDICATION - Cell identifier list (1) M

BSC Î RCF

M: Mandatory
O: Optional
(1) The list of BSCs involved is deduced from the "Cell identifier list"
parameter.

7.12

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.12

 7.1 BSS overload processing
Programmable data

F-PA-004 : Conditions the recognition of BSSMAP_OVERLOAD messages from BSCs as part of paging procedures.

Sys. Par.: PARNAME = RB_F_PA_004, NUM = BOOL, RTDMS Database: RELNAME = RYR_SYSB, ATR =
D_FPA004
Relevant process:
A BSC can declare an overload via the BSSMAP_OVERLOAD message with one of the following causes:
"Processor overload".
"CCCH overload", accompanied by a "Cell identifier" stipulating the cells affected by the radio congestion.
Field values:
VRAI (TRUE): The overload messages from the BSCs are handled by the RCP and, in the event of Paging, the
congestion state of the BSCs and the BSC and LAC pairings is taken into account.
It is essential to make sure that the values of timers T5_LAC, T6_LAC, T5_BSC and T6_BSC are correctly set.
On receipt of the BSSMAP_OVERLOAD message from a BSC, with "processor overload" as the cause, timers
T5_BSC and T6_BSC are started.
No BSSMAP_PAGING message is sent to the BSC marked as congested.
On receipt of the BSSMAP_OVERLOAD messages from a BSC with "CCCH congestion" as the cause, timers
T5_LAC and T6_LAC are started. The LAC is marked as being congested. The BSSMAP_PAGING messages
sent to the BSC show restrictions affecting the cells of the congested location areas in the "Cell Identifier List"
parameter.

Tip: To manage congestion effectively, it is preferable for the cell's identification format to be LAC (or even
LAI) in the BSSMAP_PAGING message. In practice, the LAC+CI format runs the risk of being replaced by "All
Cells" when it does not fit in the Paging message, which would mean failure to manage the congestion. The
same applies for the "whole CGI" and "CI" formats.
FAUX (FALSE): The RCF takes no account of the BSSMAP_OVERLOAD messages. They have no impact on
how paging is processed. Timers T5_LAC, T6_LAC, T5_BSC and T6_BSC are not started.

7.13

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.13

 7.1 BSS overload processing
Programmable data

T5_BSC : Time during which processor overload messages are disregarded for a BSC.

Sys. Par.: PARNAME = T5_BSC, NUM = NUM, RTDMS Database: RELNAME =

RYR_SYSG, ATR = D_T5BSCL

Relevant process:
A monitoring timer linked to T5_BSC is activated on receipt of the
BSSMAP_OVERLOAD message containing "Processor Overload" as the cause.
Example = D'2/ H'00000002 Seconds

Time during which BSSMAP_OVERLOAD messages containing "CCCH

T5_LAC : congestion" as the cause are disregarded, to avoid reducing traffic too rapidly.

Sys. Par.: PARNAME = T5_LAC, NUM = NUM, RTDMS Database: RELNAME =

RYR_SYSG, ATR = D_T5LACL
This timer is meaningful only if F-PA-004 is set to the TRUE state.
Example = D'2/ H'00000002 Seconds

7.14

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.14

 7.1 BSS overload processing
Programmable data

T6_BSC : Timer for determining the end of a BSC's overload condition.

Sys. Par.: PARNAME = T6_BSC, NUM = NUM, RTDMS Database: RELNAME

= RYR_SYSG, ATR = D_T6BSCL
This timer is started on receipt of the BSSMAP_OVERLOAD message
containing "Processor Overload" as the cause, that is, at the same time as the
monitoring timer associated with T5_BSC.
Example = D'5/ H'00000005 Seconds

T6_LAC : Timer for determining the end of overload concerning the BSC and LAC pairing.

Sys. Par.: PARNAME= T6_LAC, NUM = NUM, RTDMS Database: RELNAME

= RYR_SYSG, ATR = D_T6LACL
A monitoring timer linked to T6_LAC is activated on receipt of the
BSSMAP_OVERLOAD message containing "CCCH congestion" as the cause,
that is, at the same time as the monitoring timer linked to T5_LAC.
Example = D'5/ H'00000005 Seconds

7.15

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.15

 7.1 BSS overload processing
Programmable data

Describes the reaction of the RCP when it receives from a BSC a

F-LD-002 :
BSSMAP_LOAD_INDICATION message (cell overload message).
Sys. Par.: PARNAME = PB_F_LD_002, NUM = BOOL, RTDMS Database:
RELNAME = PYR_SYSB, ATR = D_LD_002
Field values:
VRAI (TRUE): The BSSMAP_LOAD_INDICATION messages are processed by
the RCP (received and transmitted).
F_LD_002 is meaningless if F_PA_008 is set to the TRUE state.
FAUX (FALSE): The BSSMAP_LOAD_INDICATION messages are not
processed by the RCP.
Example = FAUX / H'0

7.16

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.16

 7 Defence

7.2 Simplified security procedure

7.17
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.17

 7.2 Simplified Security Procedure
Introduction

▼ The RCP application detects overload situations by comparing the data

(processor load, number of tasks waiting, etc) against predefined
thresholds (RTOS).
▼ For a load value exceeding threshold 1:
z Periodic location updates are not handled.
z If option F-LD-003 is active:
Î The old triplets are reused (when the mobile is declared in the
VLR).
Î In the case of an intra-VLR location update, there is no
authentication or reallocation of TMSI.
▼ For a load value exceeding threshold 2:
z If option F-LD-001 is active, the response to the "Provide roaming
number" message will be an "Absent subscriber" error message.
z The actions itemised for threshold 1 are also handled.

7.18

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.18

 7.2 Simplified Security Procedure
Scenario - RCP regulation

Load regulation in the RCP Threshold1 reached ?

F-LD-003 set ?

Y
Simplified security
procedure

PB_FRG002 = True PB_FRG001 = True

N N
Intra-VLR
Location update

Normal procedure
No authentication Reuse of triplets in
No TMSI reallocation the VLR
Threshold2
reached ?

Y
TC calls are released. F-LD-001 TC calls are no longer
"Absent Subscriber" Y = True ? N handled.

7.19

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.19

 7.2 Simplified Security Procedure
Programmable data

F-LD-003 : Is used to implemented a simplified security procedure if regulation threshold 1

is reached.
Functional option F-LD-003 (with neither parameters nor attributes) depends on
the values of the PB_FRG001 and PB_FRG002 parameters.

PB_FRG001 : Describes the reaction of the RCP when load regulation threshold 1 is reached
(regulation transparent to the subscriber).
Sys. Par.: PARNAME = PB_FRG001, NUM = BOOL, RTDMS Database:
RELNAME = PYR_SYSB, ATR = D_FRG001
Field values:

VRAI (TRUE): The old triplets (RAND, SRES, Kc) are reused in the VLR if they
are still valid.

FAUX (FALSE): The normal procedure is followed.

Example = VRAI / H'1

7.20

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.20

 7.2 Simplified Security Procedure
Programmable data

PB_FRG002 : Describes the reaction of the RCP when load regulation threshold 1 is reached
(regulation transparent to the subscriber).
Sys. Par.: PARNAME = PB_FRG002, NUM = BOOL, RTDMS Database:
RELNAME = PYR_SYSB, ATR = D_FRG002
Field values:

VRAI (TRUE): There is no authentication procedure or TMSI reallocation in the

event of a location update internal to the VLR.

PB_FRG002 is meaningless if option F-SC-008 is set to the TRUE state.

FAUX (FALSE): The normal procedure is followed.

Example = VRAI / H'1

7.21

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.21

 7.2 Simplified Security Procedure
Programmable data

F-LD-001 : Describes the reaction of the MSC to terminating calls when load regulation
threshold 2 is reached.
Sys. Par.: PARNAME = PB_F_LD_001, NUM = BOOL, RTDMS Database:
RELNAME = PYR_SYSB, ATR = D_F_LD01
Field values:

VRAI (TRUE): Terminating calls are released by the RCP with "absent
subscriber" as the cause.

For higher regulation thresholds, terminating calls are disregarded.

FAUX (FALSE): Terminating calls are disregarded. This means that the RCP
initiates no processing on receipt of an incoming call. No release initiated by the
RCP is sent to the SSP.

7.22

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.22

 7 Defence

7.3 “Status” message management

7.23
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.23

 7.3 "STATUS" message management
introduction

▼ The "STATUS ENQUIRY" message is generated by the RCF following a

switchover. The mobile's response ("STATUS" message) is analysed by
the RCF and used to resynchronise the call on the information concerning
the state of the call contained in the message.

▼ The "Status" message can also be sent, during a call, by the mobile or the
RCP following protocol errors.

▼ On receipt of a "STATUS" message, the RCP checks the compatibility of

the states received with those in its own possession. If the states are
incompatible, and if functional option F-DN-001 is deactivated (FALSE),
the RCP releases the call.

7.24

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.24

 7.3 "STATUS" message management
Messages

Message identification Parameters Phase 2

- Message type M

MI_STATUS - Cause (1) M

MS Î RCF - Call State (2) M

- Auxiliary states (3) O

M: Mandatory
O: Optional

7.25

▼ (1) Cause : GSM specific cause values for call control (see DTAP protocol ETSI EN 300 940)
z #30: Response to "STATUS ENQUIRY" message
z ‘#95 semantically incorrect message’
z ‘#96 invalid mandatory information’
z ‘#97 message type non–existent or not implemented’
z ‘#98 message type not compatible with protocol state’
z ‘#99 information element non–existent or not implemented’
z ‘#100 invalid information element contents’

▼ (2) Call control state

z N0 NULL STATE
z N0.1 MM CONNECTION PENDING
z N0.2 Wait for START CC
z N0.4 Wait for CC ESTABLISHMENT CONFIRMED
z N0.5 Wait for REMOTE USER FREE
z N0.6 Wait for RECALL response
z N1 CALL INITIATED
z N3 CALL PROCEEDING
z N4 CALL DELIVERED
z N6 CALL PRESENT
z N7 CALL RECEIVED
z N8 CONNECTION REQUEST
z N9 MOBILE TERMINATING CALL CONFIRMED
z N10 ACTIVE
z N12 DISCONNECT INDICATION
z N19 RELEASE REQUEST
z N28 CONNECT INDICATION

▼ (3) The state of the auxiliary equipment is linked to the CH and MPTY procedures.
z (The state of the auxiliary equipment is not taken into account on a switchover).

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.25

 7.3 "STATUS" message management
Programmable data

F-DN-001 : Describes the reaction of the RCP to the receipt of a DTAP_STATUS message
from a mobile.
Sys. Par.: PARNAME = RB_F_DN_001, NUM = BOOL, RTDMS Database:
RELNAME = RYR_SYSB, ATR = D_IGMSTA
Field values:

VRAI (TRUE): The DTAP_STATUS message from a mobile is disregarded.

FAUX (FALSE): The DTAP_STATUS message from a mobile is processed (call

released if the state returned by the DTAP_STATUS message is inconsistent
with the RCP's data concerning the mobile).
Example = VRAI / H'1

7.26

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.26

 7 Defence

7.4 HLR supervision

7.27
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.27

 7.4 HLR supervision
Introduction

▼ Functional option F-DN-002 enables the HLR to be supervised from the

RCP.
▼ Supervision is based on the following VLR-HLR messages:
z Send parameters (MAP phase 1).
z Send authentication info (MAP phase 2).
z Inter-VLR update location.
▼ The RCP manages a counter for each HLR of the HPLMN. This counter
is not sent to the NMC, and is not stored on disk or in the standby
subsystem.
▼ When an HLR fails to respond to an open dialogue request (concerning
the Send authentication info and Inter-VLR location messages), the
corresponding counter is incremented. When the threshold defined by the
system parameter is reached, an alarm start is generated.

7.28

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.28

 7.4 HLR supervision
Programmable data

F-DN-002 : Indicates whether the HLR supervision by the RCP function is available.

Sys. Par.: PARNAME = PB_F_DN_002, NUM = BOOL, RTDMS Database:

RELNAME = PYR_SYSB, ATR = D_DN_002
Relevant process:
Supervision of the HLR entails counting the messages sent to an HLR for which
there has been no valid response. If the counter reaches a threshold, an alarm
is generated. The receipt of a valid response results in the counter value being
decremented.
Field values:

VRAI (TRUE): HLR supervision by the RCP is available

FAUX (FALSE): HLR supervision by the RCP is not available

Example = FAUX / H'0

7.29

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.29

 7 Defence

7.5 unsolicited messages

7.30
© Alcatel University - 8AS 90200 0727 VT ZZA Ed.01

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.30

 7.5 Unsolicited messages

▼ Unsolicited Messages

z PMLX/6053 : Start of paging congestion on a BSC, LAC

pair

z PMLX/6054 :End of paging congestion on a BSC, LAC pair

z PMLX/6055 : Start of paging congestion on a BSC

z PMLX/6056 : End of paging congestion on a BSC

7.31

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.31

 7 Defence
Evaluation

▼ Objective: to be able to manage PLMN

common data related to defence

Thank you for answering

the self-assessment
of the objectives sheet

7.32

© Alcatel University - 8AS 90200 0727 VH ZZA Ed.01 Page 7.32