ZTE 数据产品系列

CDMA Service and

MAP Signaling Flow
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 HLR SCP

MAP MAP CAP

TUP/ISUP
MSC/VLR TUP/ISUP MSC/VLR/SSP
TO PSTN
MAP
BSSAP BSSAP

BSS BSS

网络实体间的连接协议
 MAP signaling
MAP protocols include interfaces among MSC, VLR, HLR, AUC an
d SC. MAP signaling realizes the information exchange between entities
by means of protocol stipulations. Most signalings are interacted by one t
ransmission and one receipt simultaneously. MAP signaling is transmitte
d via SS7, and lies on the upper side of MTP, SCCP and TCAP layers.
Its main function is to switch non circuit-related data and signaling b
etween MSC,HLR and VLR and so on.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 Mobility management

This function is developed in line with the specialty of mobile

Communication network and meets the special requirements of mobile
communication .

1. The Registration/De-registration Function

2. MS inactive function
When a registered roaming MS is confirmed to be inactive, the
MSC/VLR will initiate an MS inactive operation to release the
resources occupied by such subscriber.
 Mobility management
the main signaling involved:
1. REGNOT
it initiates from VLR to HLR , Report the new registration location
of MS, and meanwhile approves MS, and acquires the profile of M
S.
2. REGCAN
HLR sends to the original VLR that the ms belongs to, Report that t
he formerly-registered MS is beyond its service.
3. CANDEN
VLR sends to the HLR ,it denys deleting ms’s data from database
4. MSINACT
VLR notices to the HLR that the ms is inactive(stop activities)
 Mobility management
1. Mobile station registration
 Mobility management

a ． When the BS receives the registration request from the mobile station, it
sends a Location Update Request message to the current service system
(MSC/VLR2) to start the registration process;

b ． The current service system sends the registration notification message

REGNOT to the MS's HLR.
purpose ：
1 ） report MS’s location （ MSCID,VLRID,VLRIN ）；
2 ） report MS’s status （ activation ， inactive ）；
3 ） get MS’s approvable information ；
4 ） get MS’s profile
 Mobility management

c ． If the MS has previously registered elsewhere, the HLR will send the r
egistration cancellation notification message REGCANC to the previous sy
stem MSC/VLR1, and MSC/VLR1 will delete all the records of the involve
d MS from the database.

d ． MSC/VLR1 returns the registration cancellation result to the HLR.

e ． HLR returns the registration notification result to MSC/VLR2, includ

e the user’s profile or approval information.

f ． If the registration is successful, MSC/VLR2 will send the Location Up

date Accept message to the BS indicating the successful registration of MS.
Registration signaling tracer
2.MS de-registration
a ． The serving MSC/VLR determines to perform de-registration
based on the MS's shutdown (power off) indication or other inactive
reasons.
b ． The serving MSC/VLR deletes all the records of the involved MS
and sends the MSINACT message with the cancelled registration
type parameters to the HLR.
c. The HLR deletes the pointer that points to the MSC/VLR from the
MS data and sends a null MSINACT to the MSC/VLR to confirm
operation..

MS MSC/VLR HRL/AU

Power off
a
MSINACT(DEREG)
b

msinact
c
3. MS Inactive
When a registered roaming MS is confirmed to be inactive, the MSC/VL
R will initiate an MS inactive operation to release the resources occupied
by such subscriber.

a ． When a registered roaming MS is confirmed to be no longer active, the MSC/VL

R marks the MS as deactivated, and sends the MSINACT message to the HLR.

b ． The HLR sets the MS as deactivated, deletes the pointer of the MSC/VL
R, and then sends the msinact to the MSC/VLR to confirm the operation.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
basic conception:
1.the calling:the user who initiates a call;
2.the called: the user who receive a call;
3.local office call: the calling and the called are in the same msc/vlr;
4.inter-office call :the calling and the called are not in the same msc/vlr;

the main signaling involved:

1.LOCREQ(Location Request):
The initiating MSC adopts this message to acquire data for call handling from HLR. This call
is identified by the number in the called mobile station directory received by MSC.

2. ROUTREQ(Route Request): this message is only used when the calling and the called are
not in the same msc/vlr.
Used to request the determination of route for a specific ms .
1. Local office calL(mobile user to mobile user)

BSS MSC/VLR/SSP HLR/AUC

CM_Service_Request
a
Assignment Request
b
Assignment Complete
c
Location Request
d
Location Result
e
Page Request
f
Page Response
g
Assignment Request
h
Assignment Complete
i
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the calling is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the calling.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR will give a Location Result message correspondingly informing the MSC of
the present location of the called party. In this example, both the calling and the called
parties are subscribers of a same MSC.
F. After that, MSC sends the paging request message to the BS where the called MS is
located

G. The BS sends the paging response message to the MSC.

H. The BS performs assignment of ground circuit and air channel.

I. Upon the BS's completion of such an assignment, the called phone rings. IF the called
party hooks off, the conversation starts.
Call Signaling Tracer of the same msc/vlr
 2. Inter- office calL(mobile user to mobile user)

BSC MSC/VLR HLR MSC/VLR BSC

CMserviceReq(IMSI,ESN,MIN,CalledNum,Mobile Identity)
a
AssignReq(Channel Type,CIC)
b
AssignCmp(Channel Number,LAI,CI)
c

LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
d
ROUTREQ(MSCID,BILLID,NIN,ESN,SystemTypeCode)
e
routreq(MSCID,Digits(TLDN))
f
locreq(MSCID,MIN,ESN,TERMLIST,REDIND)
g
IAI
h
PageReq(IMSI,LAI)
i
PageRsp(IMSI,ESN)
j
AssignReq(Channel Type,CIC)
k

AssignCmp(Channel Number,LAI,CI)
l
ACM
m
Connect
n
ANC
o

Conversation
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR find the called and the calling are not in the same msc/vlr through mscid(vlrin),
So HLR send the route request message to the msc/vlr of the called requesting the called’s
Route information.
 he msc/vlr of the called returns the roureq message ,include the TLDN allocated by the
c/vrl of the called.
HLR returns the the locreq response message ,include the location information of the
led and indicates the call type is inter-office;
The original msc/vlr send the IAI message to the destination msc/vlr according to the
DN
MSC sends the paging request message to the BS where the called MS is located.
he BS sends the paging response message to the MSC.
f the subscriber is legal, the MSC sends the Assignment Request message to the BS,
rts to assign ground circuit and instruct the BS to assign service channel for the MS.
he BS completes channel assignment and then sends the Assignment Complete
ssage to the MSC.
The msc/vlr of the called send ACM message ,the calling hears ring- back tone.
The called hooks off, BSC send connect message to msc/vlr
Msc/vlr of the called send ANC message to the calling , conversation begins.
3. Outgoing Call ( MOBILE USER TO FIXED USER)

BSC MSC/VLR PSTN

CMserviceReq(IMSI,ESN,MIN,CalledNum,Mobile Identity)
a

AssignReq(Channel Type,CIC)
b
AssignCmp(Channel Number,LAI,CI)
c
IAI
d
ACM
e
ANC
f
Conversation
A. The BS sends the CM Service Request message to the MSC, carrying the called
number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC will send the Assignment Request message to
the BS, and start to assign ground circuit and instruct the BS to assign service channels
for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D, E and F attempt to connect with the called party via TUP or ISUP signaling until
getting through.
4. Incoming Call (FIXED USER TO MOBILE USER)

PSTN MSC/VLR HLR BSC

IAI
a
LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
b
locreq(MSCID,MIN,ESN,TERMLIST,REDIND)
c
PageReq(IMSI,LAI)
d
PageRsp(IMSI,ESN)
e
AssignReq(Channel Type,CIC)
f
AssignCmp(Channel Number,LAI,CI)
g
ACM
h

Connect
i
ANC
j
Conversation
A. GMSC sends the IAI message with the called address to the called party

B. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical locati

c. The HLR will give a Location Result message correspondingly informing the MSC of
the present location of the called party.

d. MSC sends the paging request message to the BS where the called MS is located.

e. The BS sends the paging response message to the MSC.

f. f and g assign ground circuit and air channel.

h. The BS sends the ACM message to the calling, and the calling hears the ring-back tone.

i. The called hooks off, BSC send connect message to msc/vlr

J. Msc/vlr send ANC message to PSTN, conversation begins.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
 Security manmagement

Authentication parameters ：

A-KEY 、 MIN 、 ESN 、 SSD and authentication

algorithm 。
This function is designed to protect legal subscribers and prevent phony
subscribers from "invasion". Each registered subscriber has been given a
subscriber number, mobile station identification number (MIN) and an
authentication key (A-KEY). The MIN and A-KEY are written into the
subscriber's mobile phone by means of air activation service or special equipment.
By means of SSD updating, a Shared Secret Data (SSD), which is to be used future
authentication and encryption algorithm calculation, is generated in both the
AUC and the subscriber's mobile phone to be used for. If the VLR visited
supports SSD sharing, this SSD is also saved in the VLR.
The 128-bit SSD is divided into two parts, 64-bit SSD_A for authentication
calculation and the 64-bit SSD_B for the encryption calculation respectively.
 RAND_CALLENGE ESN AUTH_DATA SSD_AUTH
RANDSSD ESN A-Key
56 32 64 RAND ESN MIN1 SSD_A_NEW
32 32 24 64

SSD_Generation Auth_Signature
Procedure Procedure

AUTHR
SSD_A_NEW SSD_B_NEW 18
64 64

SSD generation algorithm authentication algorithm

The authentication data in AUC:
MIN,ESN,A-Key,SSD(SSD-A and SSD-B)

The authentication data in VLR when VLR supports SSD sharing :

MIN,ESN,SSD(SSD-A and SSD-B)

SSD: shared secret data

It is generated by A-Key,ESN,RandSSD and CAVE algorithm 。 It can not be
transmitted between MSC/VLR and BSC .it can be stored in AUC,MS and
VLR (support ssd sharing)
Signaling involved:

1.AUTHREQ(authentication request):authenticate an MS with authentication capabiity

It initiates from VLR to AUC when the ms is needed

2.AUTHDIR(authentication direction):Modify
direction) MS authentication parameter
Through this message ， AUC can initiate unique inquiry 、 SSD update
or VLR initiates unique inquiry .

3.BSCHALL(Base station inquiry):

respond to the base station inquiry command received from ms.

4.ASREPORT :Report the result of an authentication operation

5.AFREPORT: report MS authentication failure

1. Gloable challenge

Taking registration for example

MS MSC/VLR HLR/AUC

OMT(AUTH=1,RAND)
a
Location Updata Request
(RANDC,AUTHR,COUNT)
b

AUTHREQ(RAND,AUTHR,COUNT)
c
authreq
d
REGNOT
e

regnot
f
 A. The AUTH=1 in the OMT message of air interface means that authentic
ation is required when access to the system. The RAND used in authentication is
provided by the BS. The MS, using the RAND and the SSD/-A and MIN/ESN dat
a in its own memory, executes the CAVE algorithm to obtain the authentication r
esult AUTHR.

B. The MS registers in the new serving MSC/VLR, and provides authentica

tion parameters such as MIN/ESN, AUTHR, RANDC etc. in the Location Update
Request message.

C. MSC/VLR sends the authentication request message AUTHREQ to the

HLR/AUC, and the HLR/AUC executes the CAVE algorithm using the MIN/ES
N, RAND and currently stored SSD-A to calculate the authentication result AUT
HR, and compares the result with the MS-sent AUTHR.

D. HLR/AUC returns the authentication result "authreq" to the MSC/VLR.

E. If the authentication is successful, the MSC/VLR will initiate the registra
tion service.

F. HLR returns the registration result.

2. Unique inquiry:
This procedure can be initiated by AUC and VLR(only SSD is shared)

MS MSC/VLR HLR/AUC
AUTHDIR
[min,esn,randssd,randu,authu] a
authdir[] b

Unique random inquiry request c

Unique random response d

ASREPORT[min,esn] e
asreport[] f
 A. HLR/AUC selects a unique inquiry random number (RANDU), and generates
an authentication response by executing CAVE with the currently stored SSD-A, ESN,
MIN1 and MIN2. HLR/AUC sends an AUTHDIR to MSC/VLR that currently accessed
by MS.

B. MSC/VLR sends a null authdir to HLR/AUC. Authdir is only used to notify H

LR/AUC of receipt of messages.

C. The serving MSC/VLR adopts RANDU provided by AUTHDIR (Step a) to sen

d a unique inquiry direction.

D. MS employs RANDU and currently stored SSD-A, ESN, MIN1 and MIN2 to e
xecute the CAVE program for the purpose of generating an authentication response (A
UTHU), and then sends AUTHU to the service MSC/VLR.

E. The serving MSC/VLR compares the AUTHU value provided by AUTHDIR

(Step a) with that received by MS. The service MSC/VLR sends an ASREPORT to HLR
/AUC, reporting the success or failure of unique inquiry.

F. HLR/AUC sends an asreport to the service MSC/VLR.

3.SSD updating:
when the SSD valuses of the MS don not match with those In the AUC ,or in
consideration of security,AUC need to perfom SSD updating to the MS.
a. AUC determines whether it is necessary to update the shared secret data (SS
D) in MS. This determination can be made according to some reasons such as
AUC management procedure or AUC authentication timer timeout.
AUC applies ESN, A-key, and RANDSSD provided by AUC to execute CAVE to
generate a new SSD value. 。
note: ： Ac must save the new SSD and the old SSD until receive the updating rusult infomed by V
LR.

AUC sends authentication direction message (AUTHDIR) to MSC/VLR where MS is c

urrently located.

b. Service MSC/VLR delivers authdir to HLR/AUC .

c. The service MSC/VLR employs the RANDSSD value provided by HLR/AUC to send a
n SSD updating direction.
d. MS applies ESN, A-key, and RANDSSD provided by SSD updating direction to execut
e CAVE to generate a new SSD value. MS selects a random number RANDBS, and se
nds the base station inquiry direction to the service MSC, RANDBS included. Then,
MS executes CAVE by adopting the new SSD-A, ESN, MIN1 and the random number
(RANDBS) to generate an authentication result (AUTHBS).
e. The service MSC/VLR sends BSCHALL to HLR/AUC.

f. Then, HLR/AUC executes CAVE by adopting the new SSD-A, ESN, MIN1 and the rand
om number (RANDBS) provided by BSCHALL to generate an authentication result
(AUTHBS). AUTHBS value returns to MSC/VLR when returning the base station inq
uiry message results (bschall).

g. Service MSC/VLR sends the calculation results of AUC to the MS contained in the bas
e station inquiry response message.

h. If AUTHBS result provided by AUC complies with the calculation value of MS, the MS
saves the new SSD, and will use it in future execution of CAVE. Then, sends SSD to th
e service MSC/VLR to update acknowledgement messages.

i. The service MSC/VLR sends a special inquiry direction to the MS with RANDU provid
ed by AUTHDIR (Step C).
 j. MS employs RANDU, and currently saved SSD-A, ESN, MI
N1 and MIN2 to execute CAVE for generating a unique inquir
y authentication response (AUTHU); then, sends AUTHU to M
SC/VLR. The service MSC/VLR compares the AUTHU provid
ed by AUTHDIR with that received from the MS.

K. The service MSC/VLR sends an ASREPORT to MSC/

VLR, reporting the success or failure of SSD updating and uni
que inquiries.

L. The new SSD will be saved by HLR/AU and used for future
execution of CAVE. The asreport sent from HLR/AUC to MSC
/VLR specifies the services available for MS.
Agenda

Basic service

Mobility management
Basic call
Security function

Supplementary service
1. Call forwarding services
1) Call forward unconditional (CFU)
When this supplementary service has been activated, all the incoming

calls to the subscriber concerned will be unconditionally forwarded

to a third party subscriber registered by such called subscriber.
2) Call forward busy (CFB)
With this service activated, all incoming calls to a mobile subscriber

will be forwarded to a third subscriber registered by such

subscriber when he is busy.
3)Call forward no answer (CFNA)
No answer means that the called mobile subscriber does not hook off
for a long time after the MS rings. When the CFNA service has been

activated, incoming calls of the subscriber will be forwarded to a

third party if the mobile subscriber does not answer.
 4) Call Forward Default (CFD)
By CFD (call forward default), in case of no paging response or n
o
answer of a mobile subscriber, or the mobile subscriber is
unavailable due to he is in a blind area, the system will forward
the call to a third party. This function is actually a combination of
CFB and CFNA.
2. of Call barring services
Call barring services include originating call barring services and
incoming call barring services.
1) Subscriber PIN access (SPINA)
When this service has been activated, the subscriber will not be able
to access to the MS unless he can provide the correct -PIN.
2) Subscriber PIN interrupter (SPINI)
When this service is activated, the subscriber dials a certain numbe
r,
meeting the predefined conditions such as local call, national call,
 3) Password calling acceptance (PCA)
PCA service provides a call filtering function. When the MS that has
subscribed for this service acts as the called party, the calling
subscriber must input the correct password before the call can be
accepted.
4) Selective Call Acceptance (SCA)
The SCA service also provides a call filtering function. With this servic
e
activated, the subscriber can accept only calls from the numbers
specified in the SCA filtration list, and all other calls will be rejected.
5) Do-Not-Disturb Service (DND)
Once this service has been activated, the subscriber will not receive
any incoming calls.
 3. Number identification server
1) Calling Number Identification Presentation (CNIP)
This service is a called-party-initiated service. If a subscriber has subscribed
for the CNIP service, he will receive the calling number at the same time when
he receives an incoming call.

2) Calling Number Identification Restriction (CNIR)

This is of calling initiating service for restricting the calling line identification
representation for the connected line.
4. Other supplementary servers
1) Call Waiting (CW)
With this service subscribed for, when no channel is available for an incoming call, the
called subscriber will be notified and the call will be holding on. The called subscriber
can decided whether to answer the call. Only one waiting call is acceptable at a time.
2) Conference call (CC)
This service permits calls among more than two subscribers. With this service subscribed
for, the subscriber can hold a telephone conference at any time as the controlling party.
The controlling party can add the members of the conference by inputting telephone
numbers one by one.
3) Call transfer (CT)
When a two-party call is ongoing, one of the subscribers can transfer the call to a third
party and disconnect himself, so that the other subscriber continues the conversation
with the third subscriber.
4) Three-Way Calling (3WC)
This service allows the telephone conversation among three parties.
5) Remote service control (RSC)
By means of this service, the subscribers can perform certain operations, such as call
forwarding services etc., on other own terminals (fixed telephone set or mobile handset).
1.Call forward busy (CFB): A B C ;A and B not in the same msc/vlr,A and
C in the same msc/vlr;
BSC MSC/VLR HLR MSC/VLR

CMserviceReq(IMSI,ESN,MIN,CalledNum,Mobile Identity)
a
AssignReq(Channel Type,CIC)
b
AssignCmp(Channel Number,LAI,CI)
c
LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
d
ROUTREQ(MSCID,BILLID,NIN,ESN,SystemTypeCode)
e
routreq(MSCID,AccDenRsn)
f
locreq(MSCID,MIN,ESN,TERMLIST,REDIND)
g

LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
h
locreq(MSCID,MIN,ESN,TERMLIST,REDIND)
i
PageReq(IMSI,LAI)
j
PageRsp(IMSI,ESN)
k
AssignReq(Channel Type,CIC)
l
AssignCmp(Channel Number,LAI,CI)
m

Connect
n
A. The BS sends the CM Service Request message to the MSC, carrying the called
Number and other parameters needed to set up the call.

B. If the subscriber is legal, the MSC sends the Assignment Request message to the BS,
starts to assign ground circuit and instruct the BS to assign service channel for the MS.

C. The BS completes channel assignment and then sends the Assignment Complete
message to the MSC.

D. When the MSC confirms the called party is a mobile subscriber through number
analysis and the HLR address of the called number is traceable, the MSC will send
Location Request message to the HLR of the called party requesting its physical location.

E. The HLR find the called and the calling are not in the same msc/vlr through mscid,
So HLR send the route request message to the msc/vlr of the called requesting the called’s
Route information.
 he msc/vlr of the called returns the roureq message ,include the user’s status is busy.
HLR returns the the locreq response message ,include the forward number and indicates
e forward type is busy;
When the orignal MSC confirms the forward user is a mobile subscriber through number
alysis and the HLR address of the called number is traceable, the MSC will send
cation Request message to the HLR of the forward user requesting its physical location.
he HLR will give a Location Result message ,including the location information of the
ward user; In this example, both the calling and the forward user are subscribers of a
rward
me MSC.
MSC sends the paging request message to the BS where the called MS is located.
The BS sends the paging response message to the MSC.
the subscriber is legal, the MSC sends the Assignment Request message to the BS,
rts to assign ground circuit and instruct the BS to assign service channel for the MS.
The BS completes channel assignment and then sends the Assignment Complete
ssage to the MSC.
Upon the BS's completion of such an assignment, the called phone rings. IF the called
rty hooks off, the conversation starts.
2. Call forward no answer (CFNA)