Information

System

System Description D900/D1800

GPRS PLMN
A50016-D1111-V12-2-7618
System Description D900/D1800 Information
GPRS PLMN System

f Important Notice on Product Safety

Elevated voltages are inevitably present at specific points in this electrical equipment. Some of the
parts may also have elevated operating temperatures.
Non-observance of these conditions and the safety instructions can result in personal injury or in prop-
erty damage.
Therefore, only trained and qualified personnel may install and maintain the system.
The system complies with the standard EN 60950 / IEC 60950. All equipment connected has to comply
with the applicable safety standards.

The same text in German:

Wichtiger Hinweis zur Produktsicherheit
In elektrischen Anlagen stehen zwangsläufig bestimmte Teile der Geräte unter Spannung. Einige Teile
können auch eine hohe Betriebstemperatur aufweisen.
Eine Nichtbeachtung dieser Situation und der Warnungshinweise kann zu Körperverletzungen und
Sachschäden führen.
Deshalb wird vorausgesetzt, dass nur geschultes und qualifiziertes Personal die Anlagen installiert und
wartet.
Das System entspricht den Anforderungen der EN 60950 / IEC 60950. Angeschlossene Geräte
müssen die zutreffenden Sicherheitsbestimmungen erfüllen.

Trademarks:
All designations used in this document can be trademarks, the use of which by third parties for their
own purposes could violate the rights of their owners.

Copyright (C) Siemens AG 2004.

Issued by Information and Communication Mobile

Hofmannstraße 51
D-81359 München

Technical modifications possible.

Technical specifications and features are binding only insofar as
they are specifically and expressly agreed upon in a written contract.

2 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

This document consists of a total of 178 pages. All pages are issue 2.

Contents
1 Overview of System Description D900/D1800 . . . . . . . . . . . . . . . . . . . . . . . 9
1.1 Documentation Overview of System Description D900/D1800. . . . . . . . . . . 9
1.2 Scope of the “GPRS PLMN” Document . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.3 Definition of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

2 PLMN Subsystem Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.1 Internal Architecture of a GPRS Switching Subsystem (GSS) Node . . . . . 11
2.1.1 Hardware Architecture of an SGSN/SLR Node . . . . . . . . . . . . . . . . . . . . . 12
2.1.2 Hardware Architecture of a GGSN Node . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1.2.1 CPG-3300 GGSN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1.2.2 CPG-3200 GGSN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.1.2.3 Miscellaneous Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.1.3 Hardware Architecture of an Intelligent Packet Solution (IPS) . . . . . . . . . . 22
2.1.3.1 Hardware Architecture of a Gi Node and eGGSN Node . . . . . . . . . . . . . . . 25
2.1.4 Hardware Architecture of a Charging Gateway (CG) as
a Stand-Alone Node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.1.5 Software Architecture of SGSNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.1.5.1 Software Architecture of MP Platform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.1.5.2 Software Architecture of SP Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2.1.6 Software Architecture of CPG-3300/IPS-3300 Platform . . . . . . . . . . . . . . . 29
2.1.7 Software Structure of CG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.1.8 OEM Products with Hardware Platform / Software Release . . . . . . . . . . . . 30
2.2 Internal Architecture of an SSS Node (for GPRS PLMN) . . . . . . . . . . . . . . 31
2.2.1 Combination of Network Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.2.2 Hardware Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.3 Internal Architecture of a BSS Node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.3.1 Network Elements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.3.2 Hardware Architecture of the BSS Nodes. . . . . . . . . . . . . . . . . . . . . . . . . . 34
2.3.2.1 Base Transceiver Station Equipment (BTSE) BS-24x . . . . . . . . . . . . . . . . 35
2.3.2.2 Base Transceiver Station Equipment (BTSE) BS-4x . . . . . . . . . . . . . . . . . 38
2.3.2.3 Base Transceiver Station Equipment (BTSE) eMicro BS-82 . . . . . . . . . . . 40
2.3.2.4 Base Transceiver Station Equipment (BTSE) BS-2x and BS-6x . . . . . . . . 41
2.3.2.5 Base Station Controller (BSC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
2.3.2.6 Transcoding and Rate Adaption Unit (TRAU). . . . . . . . . . . . . . . . . . . . . . . 48
2.3.2.7 Serving Mobile Location Center (SMLC) . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.3.3 Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.3.3.1 BS-24x and BS-4x BTSE Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.3.3.2 BS-2x and BS-6x BTSE Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.3.3.3 BSC Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
2.3.3.4 TRAU Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
2.3.3.5 SMLC Software Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
2.3.3.6 Software Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
2.4 Internal Architecture of an OMS Node . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
2.4.1 Network Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2.4.1.1 OMC for the GSS (and SSS) and the BSS . . . . . . . . . . . . . . . . . . . . . . . . . 53

A50016-D1111-V12-2-7618 3
System Description D900/D1800 Information
GPRS PLMN System

2.4.2 Hardware of the Switch Commander (SC). . . . . . . . . . . . . . . . . . . . . . . . . . 53

2.4.3 Software Architecture of the SC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
2.4.4 IP Manager Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
2.4.5 IP Manager Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
2.4.6 Hardware of the RC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
2.4.7 Software Architecture of the RC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

3 GPRS PLMN Subsystem Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

3.1 Functions of the GSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.1.1 Functions of SGSN/SLR Network Element . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.1.2 Functions of the GGSN Network Elements . . . . . . . . . . . . . . . . . . . . . . . . . 64
3.1.2.1 Functions of the Intelligent Packet Solution (IPS) Network Elements . . . . . 66
3.2 Functions of the SSS Network Elements (for GPRS PLMN) . . . . . . . . . . . . 67
3.3 GPRS PLMN Functions of the BSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
3.3.1 Functions of the BSC and BTS (for GPRS PLMN) . . . . . . . . . . . . . . . . . . . 68
3.3.1.1 Functions of the PCU (in BSC) and CCU (in BTS) . . . . . . . . . . . . . . . . . . . 75
3.3.2 Functions of the BSC and BTS (for GPRS PLMN -
explicit with EDGE/EGPRS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
3.3.2.1 Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
3.3.2.2 EGPRS Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
3.4 Functions of the OMS for GPRS PLMN . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
3.4.1 Basic O&M Functions of the Switch Commander (SC) and IP Manager . . . 80
3.4.2 Basic O&M Functions of the Radio Commander (RC). . . . . . . . . . . . . . . . . 81
3.4.3 Central Overload Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
3.4.3.1 Central Overload Handling on the SC and RC. . . . . . . . . . . . . . . . . . . . . . . 83
3.4.4 Recovery Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
3.4.5 Special RC Management Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
3.4.5.1 Sleeping Cell and Carrier Detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
3.4.5.2 National OMC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
3.4.6 Mediation Functions for the RC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
3.5 IN or CAMEL Subsystem Functions in a GPRS PLMN . . . . . . . . . . . . . . . . 85
3.5.1 SGSN Support of Prepaid Service for PS Services . . . . . . . . . . . . . . . . . . . 85
3.5.2 SGSN Support of Virtual Private Network (VPN) Service for PS Services . 88

4 Network Functions for GPRS PLMN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

4.1 Functions of Packet-Switched Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
4.1.1 Mobility Management States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
4.1.2 Separated Mobility Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
4.1.2.1 GPRS Attach/Detach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
4.1.2.2 Routing Area Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
4.1.2.3 Inter-System Routing Area Update (2G to/from 3G RAU) . . . . . . . . . . . . . . 96
4.1.2.4 Inter-PLMN Handover (Routing Area Update) . . . . . . . . . . . . . . . . . . . . . . . 96
4.1.2.5 Mobility Management with the Packet Data Routing in
the Downlink Direction (Paging). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
4.1.3 Combined Mobility Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
4.1.4 PDP States. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
4.1.5 PDP Context Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
4.1.6 PDP Types (ISP Access Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
4.1.7 IP Header Compression. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

4 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.8 IP Address Determination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

4.1.9 RADIUS Client (Non-Transparent Access to PDN (Internet)) . . . . . . . . . . 110
4.1.9.1 RADIUS Access in a WAP/MIA Environment . . . . . . . . . . . . . . . . . . . . . . 111
4.1.10 Dynamic Host Configuration Protocol (DHCP) Client . . . . . . . . . . . . . . . . 112
4.1.11 Routing Functions on the Gi Interface and the Gn Interface. . . . . . . . . . . 112
4.1.12 Inter-PLMN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
4.1.13 Secure Network Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
4.1.13.1 General Packet-Switched Configuration with IPsec . . . . . . . . . . . . . . . . . 115
4.1.13.2 Network Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
4.1.14 QoS Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
4.1.14.1 Basic Quality of Service (QoS) Handling/Support. . . . . . . . . . . . . . . . . . . 121
4.1.14.2 Enhancement of Quality of Service (QoS) Handling. . . . . . . . . . . . . . . . . 122
4.1.14.3 QoS Enhancements at 2G-SGSN and GGSN/IPS with DiffServ . . . . . . . 124
4.1.14.4 QoS Enhancements with MPLS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
4.1.14.5 Resource Management (RM)/Admission Control . . . . . . . . . . . . . . . . . . . 126
4.1.15 Radio-Access Security and User Authentication Functions . . . . . . . . . . . 127
4.1.15.1 GPRS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
4.1.15.2 User Identity Confidentiality (P-TMSI Reallocation) . . . . . . . . . . . . . . . . . 128
4.1.15.3 User Data Confidentiality (GPRS Ciphering) . . . . . . . . . . . . . . . . . . . . . . 129
4.1.16 Roaming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
4.1.17 Sharing of PLMN Resources (Infrastructure Sharing) . . . . . . . . . . . . . . . 135
4.1.18 Packet Data Routing in the Uplink Direction . . . . . . . . . . . . . . . . . . . . . . . 138
4.1.19 Packet Data Routing in the Downlink Direction . . . . . . . . . . . . . . . . . . . . 139
4.1.20 Handling of GPRS Mobile Data Services . . . . . . . . . . . . . . . . . . . . . . . . . 141
4.1.21 Handling of Short Message Service (SMS) Over GPRS . . . . . . . . . . . . . 142
4.1.22 Local Overload Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
4.1.23 Enhancements of Gb Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
4.1.24 Insert/Delete Subscriber Data - Stand Alone . . . . . . . . . . . . . . . . . . . . . . 146
4.1.25 Transmit Power Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
4.2 Location Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
4.2.1 Mobile Terminating Location Request (MT-LR) . . . . . . . . . . . . . . . . . . . . 150
4.3 Charging and Billing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
4.3.1 Charging Collection Function (Generation of Session Data Recording) . . 154
4.3.2 Charging Gateway Function (CGF) / Interface to Billing Domain . . . . . . . 158
4.3.3 Special Charging Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
4.4 Lawful Interception Package. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
4.5 Operation and Maintenance Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
4.5.1 Display of SGSN Mobile Subscriber Data. . . . . . . . . . . . . . . . . . . . . . . . . 164
4.6 Communication Protocols and Signaling Functions in the GPRS PLMN . 164
4.6.1 Structure of the GSM Radio Interface Signaling System
(for GPRS PLMN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
4.6.2 Protocol Structure of the Gb Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
4.6.3 Protocol Structure of the IP-based Interfaces . . . . . . . . . . . . . . . . . . . . . . 169
4.6.4 Structure of the SS7 Signaling System (for GPRS PLMN) . . . . . . . . . . . . 171

5 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

A50016-D1111-V12-2-7618 5
System Description D900/D1800 Information
GPRS PLMN System

Illustrations
Fig. 2.1 Block diagram of a SGSN/SLR network node . . . . . . . . . . . . . . . . . . . . 13
Fig. 2.2 Block diagram of line interface card (LIC(TDM)-E1) . . . . . . . . . . . . . . . . 15
Fig. 2.3 Block diagram of line interface card (LIC(ATM)-STM1) . . . . . . . . . . . . . 15
Fig. 2.4 CPG-3200 basic configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Fig. 2.5 CPG-3200 medium configuration architecture . . . . . . . . . . . . . . . . . . . . 19
Fig. 2.6 Local charging gateway operation (example with CPG-3300) . . . . . . . . 22
Fig. 2.7 IPS-3300 deployment as an eGGSN . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Fig. 2.8 IPS-3300 deployment as a Gi Node . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Fig. 2.9 IPS-3300 deployment indicating back-office system elements . . . . . . . . 24
Fig. 2.10 Block diagram with a combined HLR/AC of type SSS node . . . . . . . . . . 31
Fig. 2.11 Structure of a D900/D1800 SSS “innovation node” . . . . . . . . . . . . . . . . 32
Fig. 2.12 Structure of the D900/D1800 BSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Fig. 2.13 Functional structure of the BS-24x BTSE
(with basic rack and extension rack (and service rack)) . . . . . . . . . . . . . 37
Fig. 2.14 Functional structure of the BS-4x BTSE
(on basis of the service rack) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Fig. 2.15 Functional structure of the eMicro BTSE . . . . . . . . . . . . . . . . . . . . . . . . 40
Fig. 2.16 Functional structure of the BS-2x and BS-6x BTSE
(with separate TX and RX paths) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Fig. 2.17 Functional structure of the BS-2x and BS-6x BTSE
(with duplex combiner (DUCOM)) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Fig. 2.18 Functional structure of the BS-2x and BS-6x BTSE
(with duplexer and LNA module (DULAMO)) . . . . . . . . . . . . . . . . . . . . . 43
Fig. 2.19 Functional structure of the BSC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Fig. 2.20 Functional structure of the TRAU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Fig. 2.21 OMS network architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Fig. 2.22 OMC for the GSS (and SSS) and BSS . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Fig. 2.23 Components of SC software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Fig. 2.24 Components of RC software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Fig. 3.1 PCU as multiplexer and router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Fig. 3.2 Connection between a GPRS-MS and stationary
data terminal equipment (DTE). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Fig. 3.3 National OMC (in particular for RC/OMC). . . . . . . . . . . . . . . . . . . . . . . . 84
Fig. 3.4 Network architecture of CAMEL based prepaid for
packet-switched (PS) services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Fig. 4.1 Mobility management state transition . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Fig. 4.2 GPRS attach and detach procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Fig. 4.3 Routing area update procedure (without SGSN/SLR change) . . . . . . . 94
Fig. 4.4 Routing area update procedure (with SGSN network element change) . 95
Fig. 4.5 Gs interface state model in the SGSN/SLR/SLR. . . . . . . . . . . . . . . . . . . 99
Fig. 4.6 PDP state transition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Fig. 4.7 PDP context activation communication procedure
between the different nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Fig. 4.8 Packet transfer protocol for PDP type IP v4 . . . . . . . . . . . . . . . . . . . . . 105

6 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Fig. 4.9 Packet transfer protocol stack for the PDP type PPP
(with PPP termination) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Fig. 4.10 Packet transfer protocol stack for PDP type PPP
(with L2TP tunnelling - over UDP/IP) . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Fig. 4.11 TCP/UDP/IP header compression in SGSN . . . . . . . . . . . . . . . . . . . . 109
Fig. 4.12 RADIUS access procedure in a WAP/MIA environment . . . . . . . . . . . 111
Fig. 4.13 DHCP proxy client function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Fig. 4.14 OSPF routing configuration for Gn/Gp. . . . . . . . . . . . . . . . . . . . . . . . . 113
Fig. 4.15 Main IPsec VPN configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Fig. 4.16 Packet-switched core secure configuration . . . . . . . . . . . . . . . . . . . . . 117
Fig. 4.17 Site configuration with separate IPsec devices . . . . . . . . . . . . . . . . . . 120
Fig. 4.18 Site configuration with integrated IPsec devices . . . . . . . . . . . . . . . . . 120
Fig. 4.19 Site configuration with router integrated IPsec . . . . . . . . . . . . . . . . . . 121
Fig. 4.20 GPRS authentication procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Fig. 4.21 Network sharing configuration example. . . . . . . . . . . . . . . . . . . . . . . . 136
Fig. 4.22 Roaming cooperation configuration example. . . . . . . . . . . . . . . . . . . . 137
Fig. 4.23 Packet data routing procedure in the uplink direction
to a PDN subscriber/server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Fig. 4.24 Packet data routing procedure in the downlink direction
(with routing origin in the fixed PDN) . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Fig. 4.25 Protocol model for packet data transmission with the
GPRS point-to-point bearer service (PTP). . . . . . . . . . . . . . . . . . . . . . 142
Fig. 4.26 Network architecture for the short message service via GPRS . . . . . . 143
Fig. 4.27 Protocol hierarchy for SMS over GPRS at the GSM radio interface . . 143
Fig. 4.28 Network architecture to support location services for GPRS-MS . . . . 148
Fig. 4.29 General network positioning for a MT-LR with “basic functionality” . . . 151
Fig. 4.30 Lawful interception with interception for a mobile-originated
packet data transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Fig. 4.31 Communication protocol/signaling routes for the traffic
connections of the GPRS PLMN (and GSM PLMN) . . . . . . . . . . . . . . 165
Fig. 4.32 Signaling routes for the O&M connections of the GPRS PLMN . . . . . 166
Fig. 4.33 Layers and levels of the GPRS PLMN communication
protocol/signaling functions of a GPRS mobile traffic connection . . . . 166
Fig. 4.34 Structure of the GSM radio interface signaling
system (for GPRS PLMN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Fig. 4.35 Protocol structure of the Gb interface . . . . . . . . . . . . . . . . . . . . . . . . . 168
Fig. 4.36 Protocol structure of the IP-based interfaces. . . . . . . . . . . . . . . . . . . . 169

A50016-D1111-V12-2-7618 7
System Description D900/D1800 Information
GPRS PLMN System

Tables
Tab. 1.1 Use of the individual System Description D900/D1800 documents . . . . . 9
Tab. 2.1 Packet-switched domain IP products in the current software version. . . 30
Tab. 3.1 Comparison of GSM and EDGE data . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Tab. 4.1 IP security mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Tab. 4.2 QoS mapping table in case of GPRS . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Tab. 4.3 Mapping table GPRS QoS class to default DSCP in
current software version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Tab. 4.4 Interworking of the subfeatures
(parameters of the subscription check). . . . . . . . . . . . . . . . . . . . . . . . . 131
Tab. 4.5 Methods of infrastructure sharing and GSS/CN relevancy . . . . . . . . . . 135
Tab. 4.6 SS7 components on the signaling routes (in the GPRS PLMN) . . . . . . 171

8 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

1 Overview of System Description D900/D1800

1.1 Documentation Overview of System Description

D900/D1800
The entire System Description D900/D1800 consists of the following individual docu-
ments:
• Network System Concept
• GSM PLMN
• GPRS PLMN
• GSM-R
The individual document can be used for the 2nd generation (2G) network (GSM/GPRS
PLMN) including the 2G railway network (GSM railway PLMN) as shown in Tab. 1.1.
Only the “Network System Concept” document can be used both for GSM/GPRS PLMN
and for GSM railway PLMN.

Network generation 2G

Network subsystem SSS GSS BSS OMS

Network System Concept + + + +

GSM PLMN + + +
Individual
document
GPRS PLMN + + +
GSM-R + + +

Tab. 1.1 Use of the individual System Description D900/D1800 documents

To get an overview of a GSM Network (2G circuit-switched) we recommend that

you read:
– Network System Concept
– GSM PLMN.
To get an overview of a GPRS Network (2G packet-switched) we recommend that
you read:
– Network System Concept
– GPRS PLMN.
To get an overview of a GSM Railway Network (2G circuit-switched) we recom-
mend that you read:
– Network System Concept
– GSM PLMN
– GSM-R.

A50016-D1111-V12-2-7618 9
System Description D900/D1800 Information
GPRS PLMN System

1.2 Scope of the “GPRS PLMN” Document

The scope of the “GPRS PLMN” document is to give an introduction and overview of the
SIEMENS second-generation (2G) packet-switched (GPRS) part of the combined Glo-
bal System of the Mobile communication (GSM)/Universal Mobile Telecommunication
System (UMTS) network system based on 3GPP standards (Release 99 and Release
4; but also backward compatible to former Releases 97/98).
The GSM/GPRS network system (2G) consists of the:
– Switching Subsystem (SSS)
– GPRS Switching Subsystem (GSS)
– Base Station System (BSS)
– Operation and Maintenance Subsystem (OMS).
This System Description D900/D1800 describes only the pure 2G software releases for
i circuit-switched and packet-switched domain.
The following described 3G network subsystems defined by 3GPP are described in a
separate System Description UMTS. The System Description UMTS consists of the four
sub descriptions: Network System Concept, UMTS PLMN, GSM PLMN and
GPRS PLMN. Here the sub descriptions GSM PLMN and GPRS PLMN are congruent
with the sub descriptions used in the System Description D900/D1800. The System De-
scription UMTS describes a combined 2G/3G software release for circuit-switched and
packet-switched domain each.

The UMTS network system (3G) consists of the:

– Core Network (CN)
– UMTS Terrestrial Radio Access Network (UTRAN)
– UMTS Management System (UMS).
Based on the GPRS Switching Subsystem node configurations, this “GPRS PLMN” doc-
ument describes only the 2G packet-switched GPRS PLMN part of the SIEMENS prod-
uct lines of GSS, BSS, OMS. Subjects are: PLMN system architecture (hardware,
software), PLMN system functions, network functions.
The purpose of this document is to support a network provider who provides:
• a pure 2G GPRS network

1.3 Definition of Terms

In this System Description D900/D1800, the following terms are used as described be-
low:
GSM-MS is used for the 2G circuit-switched functional part of a
subscriber’s mobile. It consists of the mobile equipment & SIM.
GPRS-MS is used for the 2G packet-switched functional part of a
subscriber’s mobile. It consists of the mobile equipment & SIM.
GSM PLMN is used only for the 2G circuit-switched PLMN part.
GPRS PLMN is used only for the 2G packet-switched PLMN part.
(Note: in 3GPP, GPRS is sometimes used for the 2G and
3G packet-switched part. Thus 3GPP uses the term GPRS
PLMN for 3G, too.)
MP platform is used for the product name SSNC.
SP platform is used for the product name SURPASS HiD3140 (former XP140).

10 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2 PLMN Subsystem Architecture

2.1 Internal Architecture of a GPRS Switching Subsystem

(GSS) Node
Network nodes house the network elements of the GPRS Switching Subsystem (GSS).
The network element SGSN is integrated in the combined SGSN/SLR switching nodes.
The GPRS Switching Subsystem (GSS) therefore consists of the:
– Serving GPRS Support Node (SGSN)/Subscriber Location Register (SLR)
– Gateway GPRS Support Node (GGSN)
– Intelligent Packet Solution (IPS)
– Home Location Register (HLR)
– Authentication Center (AC)
– Charging Gateway (CG) - as stand-alone node
The network nodes in the GPRS switching subsystem (GSS) are realized with the prov-
en ATM MP platform together with the ATM SP platform. The advantages of ATM plat-
forms include:
– Fully digital design
– Compliance with ITU-T and ETSI/3GPP
– Completely modular
hardware, autonomous subsystems with their own controls
software, functionally divided into software shells, subsystems and modules
– Mechanical construction, flexible in combining modules, frames and racks
– Clear-cut functional organization
– Standardized internal and external interfaces
– Mature CHILL technology or C++ technology
– Extensive safeguarding measures to ensure trouble-free operation

A50016-D1111-V12-2-7618 11
System Description D900/D1800 Information
GPRS PLMN System

2.1.1 Hardware Architecture of an SGSN/SLR Node

A SGSN/SLR node is based on the same new hardware comprising the following ele-
ments which consists of MP platform parts and SP platform parts, which are both ATM
based.

MP platform parts
The following MP platform parts are available:
• Main processor (MP) used for the operating system and the application software.
A part of packet-switched specific functions (e.g., session management, mobility
management) is implemented on the MPs (e.g., MP:PD/SH, MP:MM). Other appli-
cation functions are signaling (SS7) and control plane which are implemented on the
MPs (MP:SM, MP:SLT, MP:CAP). All GPRS-specific control functions are imple-
mented in the MPs.
• Line interface card (LIC) providing connectivity to the ATM switching network from:
– Gd, Gr, Gs and Ge interface, which build external line interfaces (LIC(TDM)-E1)
– Line interfaces in direction of ATM SP platform (LIC(ATM)-STM1)
• ATM switching network (ASN) to interconnect the MPs and the LICs.
The ASN consist of the ATM multiplexer AMX and the core ASN.

SP platform parts
The following SP platform parts are available:
• Server processor (SP) used for the operating system and the application software.
The following GPRS interface-specific functions are realized on the SPs for:
– Gb interface: SP:BSSGP (server processor for BSSGP)
– Gn interface: SP:GTP (server processor for GTP)
• Line interface card (LIC) providing connectivity of
– Gb interface, which builds an external line interface to the SP platform coming
from the BSS (LIC(FR)-E1)
– Gn interface, which builds an external line interface to the SP platform coming
from the GPRS backbone from other GSNs (LIC:GTP)
– Line interfaces in the direction of the MP platform (LIC(ATM)-STM1)
Fig. 2.1 shows the block diagram of the single SGSN node

12 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

to BSS) MP platform SP platform

(Gb Interface) LIC(FR)
to GGSN
(Gn interface)
MP:PD/SH LIC:GTP
SP:BSSGP

SP:GTP
MCP *) MP:MM/CAP

MCP *)
LIC(ATM) *)
LIC(ATM)

LIC(ATM) *)
SP platform LIC(ATM)

SNMP /
MP:SLT UDP/IP
ASN

to GMLC
(Lg interface) LIC(TDM) MP:SM

to HLR/AC *) SP platform: MCP and

(Gr interface) MP:ACC LIC(ATM)-STM1 for connec-
LIC(TDM) tion to MP platform equipped
only once per SP system
to SCP (IN/CAMEL) MP-SA
(Ge interface) LIC(TDM) MP:STATS

to MSC/VLR
(Gs interface) LIC(TDM) MP:OAM Switch Commander
TCP / IP (SC)
to SMSC
(Gd interface) LIC(TDM)
MP:OAMD
TCP / IP to DPPS/ABC or CG
(Ga interface)

Fig. 2.1 Block diagram of a SGSN/SLR network node

For the Gb interface, a modification is necessary at the BSC side (PCU). This interface
i is realized in the SIEMENS Base Stations by adding PCU cards to the BSC rack. Only
a software download is needed (CCU) in the Base Transceiver Systems (BTSs). The
local maintenance terminal (LMT) for the BSCs has to be extended with enhanced O&M
functionality.

Main Processor (MP)

The main processor (MP) is a general processing platform that is optimized for packet
handling and data processing. The MP supports all operations, administration and main-
tenance functions, a man-machine local interface, a backup storage facility, an overall
system alarm handling and network management interface. An MP consists of two iden-
tical main processor units (MPUs) working in micro synchronous mode. This means that
two separate modules are synchronized and carry out the same operations on each unit

A50016-D1111-V12-2-7618 13
System Description D900/D1800 Information
GPRS PLMN System

on a clock-by-clock basis. If one of them fails, the other takes over without interruption.
The micro synchronous mode provides for continuous checks via comparators. After a
comparator mismatch, the defective MPU is quickly localized and the partner MPU re-
sumes normal operation without any recovery being necessary.
From MPUs there is a small computer system interface (SCSI) which supports connec-
tion of a magnetic disc device (MDD) and magneto-optic disc device (MOD). MOD is
used to enable loading of software and configuration data into MP:OAM. MDD is used
as an off-board mass storage.
MP is a common name for a main processor regardless of its specific representation. It
may be used in all cases where the use of the name is unambiguous and where the spe-
cific representation of the MP needs not be defined any further.
The different variants of the MP are:
• MP: common name for a main processor regardless of its specific representation
It may be used in all cases where the usage of the name is unambiguous and where
the specific representation of the MP need not be defined any further.
• MP-SA: Main processor with standalone capability
The MP-SA has standalone capabilities: it provides for peripheral interfaces to be
connected to O&M devices, statistics capability, system alarming capability, time of
day source, and maintenance capability including an emergency action interface.
The MP-SA is equipped with an alarm indication module (ALI) and radio clock.
The following software packages are available for the MP-SA:
– MP:O&M (operation and maintenance)
– MP:STATS (statistics - for performance management/traffic management).
• MP-AP: Main processor used for application software processing
The MP-AP, which does not provide for peripheral interfaces for O&M devices, is
used for application software processing.
The following software packages/load types running on the MP-AP are:
– MP:PD/SH (packet dispatching and session handling tasks)
– MP:MM (mobility management tasks)
– MP:SM (signaling management tasks)
– MP:SLT (signaling link termination tasks)
– MP:CAP (CAMEL application part tasks)
– MP:ACC (accounting/charging tasks)
• MP-IO: Main processor used for input and output
– MP:OAMD (for charging/accounting output processing)
In many cases the load types MM and CAP are combined on the same MP-board. The
same is for load types OAM and STATS.
In the current software release a new MPU type MPUE is supported for application MPs
i (MP:OAM, MP:OAMD, MP:SM, MP:SLT and MP:ACC). The MPUE is the successor of
the MPUD and provides higher performance.

Line Interface Card (LIC) - (within MP platform)

The line interface card (LIC) provides for connectivity of the external line interfaces to
the ATM switching network (AMX, ASN Core).

14 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The current software version contains the following two LIC variants:
• LIC(TDM)-E1 (for connection of PCM30 links)
The LIC(TDM)-E1 shall provide 8 E1 standard interface lines. One E1 line is able to
operate at 2.048 Mbit/s.
The block diagram (Fig. 2.2) is a general overview of the LIC(TDM)-E1. The line
specific part consists of the PCM interface, cell processing & ATM adaptation layer
type 1 (AAL1), and glue logic. Other functional blocks are common for all LIC types:
ATM layer part and peripheral control platform (PCP).

LIC(TDM)-E1

(LIC specific part)

Physical layer part
E1- Cell processing
ATM layer part
interfaces PCM interface &
(1 ... 8) AAL1 layer part

Glue logic

Peripheral control platform (PCP)

Fig. 2.2 Block diagram of line interface card (LIC(TDM)-E1)

• LIC(ATM)-STM1 (for connection of STM1 links)

The LIC(ATM)-STM1 shall provide STM-1 standard interface multiport lines based
on the SDH STM-1 (according to ITU-T). One STM1 line is able to operate at 155
Mbit/s.
The block diagram (Fig. 2.3) is a general overview of the LIC(ATM)-STM1. The LIC-
specific part consists of the line interface unit (LIU), framer & HDLC controller, and
glue logic. Other functional blocks are common for all LIC types: ATM layer part and
peripheral control platform (PCP).

LIC(ATM)-STM1

(LIC specific part)

Physical layer part
STM1- Framer
ATM layer part
interface (LIU) &
HDLC controller

Glue logic

Peripheral control platform (PCP)

Fig. 2.3 Block diagram of line interface card (LIC(ATM)-STM1)

A50016-D1111-V12-2-7618 15
System Description D900/D1800 Information
GPRS PLMN System

ATM Switching Network (ASN)

The ATM switching network (ASN) is the central part of a node that is responsible for
transporting ATM cells between peripheral units (i.e. access units) as well as internal
communication with the control subsystem.
It is functionally divided into two units:
• ASN Core
The ASN core is responsible for the non-blocking connection between the ATM mul-
tiplexer (AMX). The ASN core is the central part of the ATM switching network for
medium and large size products. It is non-blocking at the virtual connection level: an
ATM cell arriving at any input can be routed to any output, independently of the traffic
on other ASN ports, provided the required bandwidth is available at the respective
input and output.
• ATM multiplexer (AMX)
The ATM multiplexer (AMX) is responsible for multiplexing and concentration (if sup-
ported by software) as well as the connection of line interface circuits (LICs) to the
ASN core. The AMX is used as a multiplexer and concentrator in front of the ASN
core or as a switching stage in standalone applications. A separate module that is
identical to the one used in the ASN core performs AMX control and clock provision-
ing.
The maximum size of the ASN core is 128 STM-1 equivalent ports and 32 STM-1 equiv-
alent ports for ASN 20 and ASN 5 respectively.
For redundancy, the ATM cells belonging to a virtual connection are sent in both planes
and routed in parallel through both planes. The cells of both data streams are combined
in a redundant path combining circuitry at the receiving end (e.g., LIC or MP). This meth-
od guarantees high availability of virtual connections, even if faults occur in a plane.

Service Processor (SP)

The SP:BSSGP (base station system GPRS protocol) handles the Gb interface and is
responsible for the distribution of Gb interface primitives to MP:PD/SH.
The SP:GTP (GPRS tunneling protocol) handles the whole Gn and Gp functionality.

Line Interface Card (LIC) - (within SP platform)

The line interface card (LIC) provides connectivity of the Gb interface (LIC(FR)) with the
following types:
– E1
The line interface card (LIC) provides connectivity of the Gn interface (LIC:GTP) with the
following types:
– STM1
– Ethernet
The LIC(ATM)-STM1 provides connectivity to line interfaces of MP platform part.

16 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2.1.2 Hardware Architecture of a GGSN Node

A new GGSN (CPG-3300/CPG-3200) based on CISCO platforms has been introduced
i for the SIEMENS UMTS and GPRS PLMNs. The old GGSN (CPG-3000) based on the
SP platform is still supported, but only for features until previous software version. For
information about this SP platform, refer to the documentation for the previous software
version. New features are only available on the following described GGSN (CPG-
3300/CPG-3200).
CPG-3300/CPG-3200 (which are described in the following) are used for the current
software version. CPG-3200 was already introduced for the last software version.

2.1.2.1 CPG-3300 GGSN

The CPG-3300 architecture is modular. The GGSN functionality is implemented in a
GGSN server card, the so-called mobile wireless access module (MWAM). The scaling
of CPG-3300 can be achieved by installing multiple MWAM cards into the same CISCO
7613 chassis and running multiple GGSN software images on each MWAM card. Load
sharing between different MWAM cards and between multiple GGSN software images
per MWAM is achieved through an integrated SLB function.
SIEMENS offers upgrade packages between the CPG-3300 configurations. Moreover,
migration from CPG-3000 and CPG-3200 to CPG-3300 is also possible.

CPG-3300 configurations
All available CPG-3300 configurations require only a single CISCO 7613 chassis. The
following configurations are offered with CPG-3300:
– CPG-3300 basic configuration with one MWAM card installed
– CPG-3300 medium configuration with two MWAM cards installed
– CPG-3300 large configuration with three MWAM cards installed
– CPG-3300 x-large configuration with four MWAM cards installed
With the CPG-3300 configurations, both LAN interfaces and WAN interfaces can be
used to establish LAN/WAN interconnectivity for Gn and Gi interfaces as well as connec-
tivity for Ga interfaces, OAM, DNS servers, DHCP servers, etc. The following LAN/WAN
interface cards can be used:
LAN interface cards
– 48-port Ethernet (E)/Fast Ethernet (FE)
– 16-port Gigabit Ethernet (GE)
WAN interface cards
– 1-port ATM STM-4/OC-3
– 1-port POS STM-4/OC-3
The WAN interface cards are the same as the WAN interface cards offered for the IP
router platform 7206 in CPG-3200. Installation of these cards in the CISCO 7613 chas-
sis requires a specific adapter, the FlexWAN module. A FlexWAN module accepts up to
two WAN interface cards.
Furthermore, an IPsec server card can be installed in the CISCO 7613 chassis of all
CPG-3300 configurations. This card has no external interfaces and is required if the IP-
sec tunneling protocol is used as a security feature.

A50016-D1111-V12-2-7618 17
System Description D900/D1800 Information
GPRS PLMN System

2.1.2.2 CPG-3200 GGSN

The hardware of the CISCO-based GGSN CPG-3200 is scalable, reliable, flexible, and
of exceptionally high quality. Four configurations are available: basic, double basic, me-
dium, and large. The maximum number of supported PDP contexts is dependent on the
traffic model used.
CPG-3200 was introduced for the last software version and is described in the following.
i In the current software version, CPG-3300 should be used.

SIEMENS offers upgrade packages between the CPG-3200 configurations.

The GGSN node consists of the following components:
• GGSN routers
• Server load balancers (SLB)
• LAN switches

CPG-3200 basic configuration

The CPG-3200 basic configuration contains one 7206-GGSN that is equipped with
GGSN software (Fig. 2.4).

7206-GGSN
FE Ports

Gn Gi

Fig. 2.4 CPG-3200 basic configuration

Two charging gateways can be optionally assigned to 7206-GGSN.
The 2 Fast Ethernet (FE) ports available from the input/output controller can be used for
i Gn and Gi interconnectivity. Additional Gn/Gi interfaces and interfaces for connectivity
of Ga interface, OAM, DNS servers, DHCP severs, etc. must be ordered separately.

With the GGSN basic configuration, only LAN interfaces are possible. The following LAN
interface cards can be used:
– 4/8-port Ethernet
– 2-port Ethernet (E)/Fast Ethernet (FE)
– 1-port Gigabit Ethernet (GE)

CPG-3200 double basic configuration

The CPG-3200 double basic configuration contains two 7206-GGSNs. It acts as two in-
dependent basic configurations from an application and operational point of view. With
the double basic configuration, only one charging gateway can be assigned to one
7206-GGSN.

CPG-3200 medium configuration

In order to double performance of the CPG-3200 basic configuration, the CPG-3200 me-
dium configuration contains two 7206-GGSNs. SIEMENS has designed the GGSN me-
dium configuration to be able to offer integrated load balancing for true scalability and
full redundancy.

18 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The main components of the GGSN medium configuration are (Fig. 2.5):
– Two 7206-GGSNs
– Two 7206 server load balancers (SLB)
– Two 3550 LAN switches

7206-GGSN
Gn 7206-SLB 3550 LAN Switch

7206-GGSN
Gi 7206-SLB 3550 LAN Switch

Fig. 2.5 CPG-3200 medium configuration architecture

Each 7206-GGSN includes, in addition to its contents in the GGSN basic configuration,
a 2-port FE card for redundancy of Gn/Gi interfaces and an 8-port Ethernet card for con-
nectivity of Ga interface, OAM, DNS servers, DHCP servers, etc.
The 7206-SLB serves two functions:
– It distributes PDP contexts between the two 7206-GGSNs according to the prevail-
ing load conditions. The load information retrieves the 7206-SLB dynamically from
the 7206-GGSN.
– It provides the GGSN's outbound LAN/WAN interfaces for Gn/Gi interconnectivity
and optionally for Ga, OAM, DNS, and DHCP WAN interfaces.
A second 7206-SLB is retained for redundancy purposes.
The 3550 LAN switch of type Catalyst provides LAN connectivity between the 7206-
GGSN and the SLB as well as outbound LAN connectivity for Ga interface, OAM, DNS
serves, DHCP servers, etc. In addition, the performance of the LAN switch is also dou-
bled for redundancy purposes.
With the GGSN medium configuration, both LAN interfaces and WAN interfaces are
possible. The following LAN/WAN interface cards can be used:
LAN interface cards
– 4/8-port Ethernet (E)
– 2-port Ethernet/Fast Ethernet (FE)
– 1-port Gigabit Ethernet (GE)
WAN interface cards
– 4/8-port serial E1
– 1-port ATM STM-1/OC-3
– 1-port POS STM-1/OC-3
All LAN interfaces for connectivity of Ga interface, OAM, DNS servers, DHCP servers,
i etc. are always included in the GGSN medium configuration.

Furthermore, an IPsec server card can be installed in the 7206-SLBs of the GGSN me-
dium configuration. This card has no external interfaces and is required if the IPsec tun-
neling protocol is used as a security feature.

A50016-D1111-V12-2-7618 19
System Description D900/D1800 Information
GPRS PLMN System

CPG-3200 large configuration

In order to treble the performance of the CPG-3200 basic configuration, the CPG-3200
large configuration contains three 7206-GGSNs. SIEMENS has designed the GGSN
large configuration to be able to offer integrated load balancing for true scalability, as
well as for full redundancy.
The main components of the GGSN large configuration are:
– Three 7206-GGSNs
– Two 7206 server load balancers (SLB)
– Two 3550 LAN switches
Apart from the additional 7206-GGSN, the CPG-3200 large configuration is absolutely
identical to the CPG-3200 medium configuration.

2.1.2.3 Miscellaneous Hardware

Supervisor card (SUP)
An SUP/MSFC card with two Gigabit Ethernet (GE) slots is used in both CPG-3300
GGSN and IPS-3300 (section 2.1.3). SUP stands for "supervisor". Whenever a packet
enters the node via a line interface card, it has to be passed to the SUP. The same ap-
plies to packets leaving the node. Internally, SUP dispatches the packets among the
server cards, e.g., MWAM.
The server load balancer (SLB), which distributes the PDP context requests among
GGSN instances, runs on the SUP.

Mobile wireless access module (MWAM)

This card is used in both products CPG-3300 GGSN and IPS-3300 (section 2.1.3).
There are five processors on the MWAM card . All processors run the same input/output
software (IOS) containing the GGSN functionality. One processor is reserved for VPN
aggregation.

Line interface cards

The line interface cards are optional for CPG-3300 GGSN and IPS-3300 (section 2.1.3).
There are two types of line interface cards:
– Electrical (48 Port E/FE)
– Optical (FlexWAN and 16 Port GBIC)

FlexWAN cards
FlexWAN cards are used in the CPG-3300 GGSN solution. The FlexWAN module ac-
cepts up to two WAN port cards. The ports can be configured either as ATM ports or as
Packet over SONET (PoS) ports. ATM and PoS interface cards provides one port in sin-
gle mode only.

LAN cards
LAN cards are used in both CPG-3300 GGSN and IPS-3300 (section 2.1.3) solutions.
There are two types of LAN cards:
– Ethernet (E) and Fast Ethernet (FE)
The LAN card 48 Port E/FE offers 48 RJ 45 ports. Each port can be configured either
for Ethernet or Fast Ethernet.

20 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– Gigabit Ethernet (GE)

GE interface module with 16 optical ports can provide connectivity to support the Gn
and the Gi interface. This LAN card is extended by adapters for transforming elec-
trical signals into optical signals and vice versa.

Switch
The CISCO Catalyst 3550-24-DC switch is part of the "CISCO Catalyst 3550 Intelligent
Ethernet Switches" series, which is a line of stackable, multilayer switches that provide
high availability, quality of service (QoS), and security to enhance network operations.
With a range of Fast Ethernet and Gigabit Ethernet configurations, the CISCO Catalyst
3550 is a powerful option for enterprise applications. This switch is optional.

Terminal server
For a convenient configuration, a terminal server CISCO 2610 XM-DC can be used op-
tionally. It allows the operational staff to configure each component inside the 7613 us-
ing virtual terminals. The terminal server supports the OAM tasks regarding
configuration.

Disk array - with RAID technology

CPG-3300 GGSN and IPS-3300 (section 2.1.3) contain a high-performance storage
system that is based on redundant array inexpensive device (RAID) technology. There-
fore a SUN StorEdge 3310 with SCSI bus is introduced.

Local Charging Gateway (L-CG) - with SUN Netra 240 server

CPG-3300 (and CPG-3200) and IPS-3300 (section 2.1.3) can be equipped with a Local
Charging Gateway (L-CG) in order to prevent loss of charging data. The L-CG prevents
the loss of charging data in case of failures of the connection between the GGSN and
remote billing system. The L-CG is located in the GGSN itself. The communication be-
tween the GGSN and the L-CG also runs across the GGSN Ga interface. However, the
L-CG remains inactive under normal operation.
CPG-3300 (and CPG-3200) supports GGSN charging across the Ga interface according
to 3GPP standards. The Ga interface is used to connect the GSNs with the Charging
Gateways (CG) - local or centralized. The protocol used is similar to the GTP of Gn in-
terface and is called GTP’.
There are four different configurations with the Local Charging Gateway (L-CG) and
i Cental Charging Gateway (C-CG):
1. Only Local Charging Gateways (L-CGs)
2. Only Central Charging Gateways (C-CGs)
3. Local and Central Charging Gateways (L-CGs/C-CGs), but there is no interface
between these gateways
4. Local and Central Charging Gateways (L-CGs/C-CGs) with a Ga interface between
L-CG and C-CG - not supported in the current software release.

In CPG-3300, the Local Charging Gateway (L-CG) is located in the same rack as the
7613 GGSN node. The L-CG software has been derived from the “message coordinator
(MCR)” software that is offered by SIEMENS as a Central Charging Gateway (C-CG)
solution. The L-CG software, however, runs on a downsized platform - a desktop SUN
Netra 240, which provides appropriate performance for the L-CG application.
The CG can either be located locally within CPG-3300 (or CPG-3200) or centrally within
the billing mediation device (BMD). If the connection between GGSN and the C-CG fails,

A50016-D1111-V12-2-7618 21
System Description D900/D1800 Information
GPRS PLMN System

the GGSN sends its charging data to the L-CG as long as the failure persists. As soon
as the connection recovers, the GGSN re-establishes its original data path to the C-CG.
Charging data can be collected from the L-CG via FTP data transfer (Fig. 2.6). Both the
L-CG and C-CG are connected via the Ga interface to exchange status information.
Note that a disk-array can additionally be used to increase the L-CG's storage capacity,
thus increasing the maximum time, the GGSN can operate on link failures to a remote
billing system without losing charging data. The disk-array is offered as an option as well
and can be shared by two L-CGs if applicable.
The CGs are configured as primary and secondary. That is, if the primary CG is not
available, the charging data is transferred to the secondary CG.

CPG-3300 BMD

7613 GGSN Ga L-CG FTP

Mediation
(MCR) Ga
(sta
tus
exc FTP
Du han
plic ge)
ate
Ga han
dlin C-CG
g
(MCR)

Fig. 2.6 Local charging gateway operation (example with CPG-3300)

IPsec hardware acceleration

CPG-3300 (and CPG-3200) supports IPsec tunneling and encryption. The new IPsec
server card of CPG-3300 includes hardware-based acceleration of IPsec. Because IP-
sec hardware acceleration is bound up with the 7613 hardware architecture, CPG-3200
does not include this feature.

2.1.3 Hardware Architecture of an Intelligent Packet Solution (IPS)

The Intelligent Packet Solution (IPS)-3300 from SIEMENS is provided as an extension
of the Core Network (CN) defined by 3GPP. The IPS combines access features with in-
telligent routing and packet-inspection capabilities. These enable PLMN operators to of-
fer such highly interesting features as differentiated charging, by analyzing the layer 3
to 7 protocols and the content, as well as the access over access point names (APN) to
a wide range of selected services offered by the PLMN operator itself and possibly by
third parties via agreements (also called “on-net” services by dedicated PLMN opera-
tors) and the other services offered by other providers (also called “off-net” services by
dedicated PLMN operators). The IP products supplied by SIEMENS for this purpose are
based on the CISCO 7613 platform. Thus, the synergy effect realized by integrating the
products of the market leaders in the packet-switched network field is available in IPS-
3300.

22 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The IPS-3300 can be deployed in two ways, which, from a network point of view, provide
the identical overall functionality. Three different types of IPS core element are used in
such a deployment configuration.
These IPS core elements as well as other optional IPS elements are listed below:
• IPS core elements
– Gateway GPRS Support Node (GGSN) CPG-3300
– Content services gateway (CSG)
– Service selection gateway (SSG)
• Futher IPS elements (that are also elements of the GGSN CPG-3300)
– Local charging gateway (L-CG) with disk array
– Terminal server (access server) for local administration
– LAN switch
L-CG is mandatory for IPS-3300 if post-paid charging is required by the PLMN operator.
i SIEMENS offers a stable post-paid charging interface with ASN.1 encoded CDRs. Fre-
quent changes to a mediation device of the customer are avoided (because CISCO
changes with each maintenance release also CDR layouts or even introduces new CDR
types).

The IPS-3300 is an extension of the packet-switched domain of the GPRS public land
mobile network (PLMN). The GPRS PLMN is also referred to as the GPRS backbone.
The main features of the IPS-3300 core elements are listed below. IPS-3300 can be de-
ployed in two ways. Either as part of the GPRS backbone or directly adjoining it. The two
deployment methods are:
a) As an enhanced GGSN (eGGSN) (see Fig. 2.7)
An eGGSN can replace an already existing GGSN or operate in parallel to it (i.e., a
separate, additional eGGSN). An eGGSN is fully compliant with the GGSN-related
3GPP, IETF and RFC specifications.
The IPS constituent parts of such an eGGSN are:
– Gateway GPRS Support Node (GGSN)
– Content service gateway (CSG)
– Service selection gateway (SSG)

GGSN CSG SSG

SGSN Gn Gi
ISP/Internet
eGGSN

GPRS backbone

Fig. 2.7 IPS-3300 deployment as an eGGSN

b) As a Gi Node (see Fig. 2.8)

A Gi Node has no inherent GGSN functionality. It is compliant with the major IETF
and RFC specifications.

A50016-D1111-V12-2-7618 23
System Description D900/D1800 Information
GPRS PLMN System

The IPS constituent parts of such a Gi Node are:

– Content service gateway (CSG)
– Service selection gateway (SSG)

SGSN Gn GGSN Gi CSG SSG ISP/Internet

Gi Node
GPRS backbone

Fig. 2.8 IPS-3300 deployment as a Gi Node

Enforced-decision architecture
IPS-3300 is based on an enforcement-decision architecture, whereby the aforemen-
tioned IPS-3300 core elements (GGSN, CSG and SSG) form the enforcement part of
the architecture. The decision intelligence resides in the separate back-office system
(see Fig. 2.9). The goal of the enforcement-decision architecture is to provide end-to-
end policy enforcement across the Internet in accordance with preset management
rules. During connection establishment (PDP context setup), this will include negotia-
tions between decision points in different domains.

Back-office System

OA&M AAA Billing C-CG *) R&C System

System (QS)

SNMP RADIUS FTP GTP’ GTP’

enhanced

Services
L-CG *)

2G/3G SGSN GGSN CSG SSG E.g., Corporate

IPS

*) L-CG and C-CG are alternative solutions. The preferred solution is with L-CG.

Fig. 2.9 IPS-3300 deployment indicating back-office system elements

The back-office system covers the following areas (see Fig. 2.9):
– Authentication, authorization and accounting (AAA)
Preferred solution is the @vantage mobile session manager (MSM).

24 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– Operation, administration and maintenance (OAM)

IPS-3300 is managed by the SIEMENS’ IP manager (IP-M) and Switch Commander
(SC).
– Support for online charging, viz., rating and charging (R&C), transaction mediation
Preferred solution is charging@vantage or charge@once.
– Support for offline charging, viz., charging detail record (CDR) collection
Preferred solution is the Local Charging Gateway (L-CG).
– Billing system
– PLMN operators’ service platform

2.1.3.1 Hardware Architecture of a Gi Node and eGGSN Node

IPS-3300 is built on a CISCO 7613 platform (like CPG-3300 GGSN (see section 2.1.2)).
The configurations for IPS-3300 (and CPG-3300) are achieved by inserting/extracting
modules such as SUP, MWAM, CSM etc., and by their number in the shelf. The
IPS-3300 architecture is modular.

Supervisor card (SUP)

SUP/MSFC card with two Gigabit Ethernet (GE) slots is used in both IPS-3300 and
CPG-3300 GGSN (see section 2.1.2). SUP stands for "supervisor". Whenever a packet
enters the node via a line interface card, it has to be passed to the SUP. The same ap-
plies for packets leaving the node. Internally, SUP dispatches the packets among the
server cards, e.g., MWAM.
The server load balancer (SLB), which is needed to distribute the PDP context requests
among GGSN instances, runs on the SUP.

Mobile wireless access module (MWAM)

This card is used in both IPS-3300 and CPG-3300 GGSN (see section 2.1.2). There are
five processors on the MWAM card. All processors run the same input/output software
(IOS) containing either the GGSN functionality or service selection gateway (SSG) im-
age. One processor is reserved for VPN aggregation.

Content service gateway (CSG)

The CSG is used within IPS-3300 product. The CSG focuses on charging in PLMNs.
The CSG can support layers 3 to 7 (e.g., IP to FTP, HTTP 1.0/1.1, POP3, RTSP, SMTP,
WAP 1.0/2.0). The CSG cards are grouped together in a 7613 chassis. Each pair forms
a virtual CSG. The virtual CSG is addressed by its alias IP address. Each virtual CSG
is statically assigned to a MWAM-GGSN.

Content switching module (CSM) with firewall load balancer (FLB)

This is a firewall load balancer (FWLB) module based on the CISCO content switching
module (CSM). The CISCO content switching module (CSM) is a CISCO Catalyst®
6500 line card that balances client traffic to farms of servers, firewalls, secure sockets
layer (SSL) devices, or virtual private network (VPN) termination devices. In IPS-3300
the FWLB software runs on the content switching module (CSM).

Line interface cards

The line interface cards are optional for IPS-3300 and CPG-3300 GGSN (see section
2.1.2).

A50016-D1111-V12-2-7618 25
System Description D900/D1800 Information
GPRS PLMN System

There are two types of line interface cards:

– Electrical (48 Port E/FE)
– Optical (FlexWAN and 16 Port GBIC)

LAN cards
LAN cards are used in both IPS-3300 and CPG-3300 GGSN (see section 2.1.2) solu-
tions.
There are two types of LAN cards:
– Ethernet (E) and Fast Ethernet (FE)
The LAN card 48 Port E/FE offers 48 RJ 45 ports. Each port can be configured either
for Ethernet or for Fast Ethernet.
– Gigabit Ethernet (GE)
GE interface module with 16 optical ports can provide connectivity to support the Gn
and the Gi interface. This LAN card is extended by adapters for transforming elec-
trical signals into optical signals and vice versa.

Switch
The CISCO Catalyst 3550-24-DC switch is part of the "CISCO Catalyst 3550 Intelligent
Ethernet Switches" series, which is a line of stackable, multilayer switches that provide
high availability, quality of service (QoS), and security to enhance network operations.
With a range of Fast Ethernet and Gigabit Ethernet configurations, CISCO Catalyst
3550 is a powerful option for enterprise applications. This switch is optional.

Terminal server
For a convenient configuration, a terminal server CISCO 2610 XM-DC can be used op-
tionally. It allows the operational staff to configure each component inside the 7613 us-
ing virtual terminals. The terminal server supports the OAM tasks regarding
configuration.

Local charging gateway (L-CG) - with SUN Netra 240 server

As a local charging gateway (L-CG), the SUN Netra 240 server is deployed in IPS-3300
(eGGSN and Gi Node) and CPG-3300 GGSN (see section 2.1.2). In addition a message
coordinator (MCR) software is needed. This L-CG MCR software is a SIEMENS prod-
uct. The SUN Netra 240 server is designed for high-performance, high-density environ-
ments, and it provides significant expendability.

Disk array - with RAID technology

In IPS-3300 and CPG-3300 GGSN (see section 2.1.2) contain a high performance stor-
age system that is based on redundant array inexpensive device (RAID) technology.
Therefore a SUN StorEdge 3310 with SCSI bus is introduced.

2.1.4 Hardware Architecture of a Charging Gateway (CG) as a Stand-

Alone Node
Within packet-switched reference architecture alternatively to the local a central storage
solution named Charging Gateway (CG), or Central Charging Gateway (C-CG) is sup-
plied. The main task of the CG/C-CG is to collect, correlate, and mediate the charging
records of the GSNs and transfer the modified records to a billing system. The CG/C-
CG fulfills the charging gateway function according to the 3GPP standards and is only
used in the packet-switched domain. Furthermore, the CG/C-CG can be used to corre-

26 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

late a charging detail record (CDR) that belongs to the same communication service but
originates from different nodes. In case of CG integration, the Ga interface is recom-
mended between both SGSN/GGSN and the CG/C-CG with a transaction oriented
transfer protocol for CDR-bulk provisioning - named GTP’.
In the Administration and billing Center (ABC) the CDRs are used for rating and gener-
i ating of the (e.g., monthly) bill. Hotbilling servers are used for billing related to rental
phones (e.g., hotel billing) and also for alternative pre-paid solutions. The Billing Medi-
ation Device (BMD) was introduced as a pre-processing and interface adaption func-
tion. Due to the similar or overlapped functional scope of the CG and a BMD a
converged product is also possible.

SUN Netra 240 server

A SUN Netra 240 server is deployed like the local charging gateway (L-CG) the in the
products CPG-3300 GGSN (see section 2.1.2) and IPS-3300 (eGGSN and Gi Node,
see section 2.1.3). In addition a message coordinator (MCR) software is needed. This
L-CG software MCR is a SIEMENS product.
The SUN Netra 240 server is designed for high-performance, high-density environments
and provides significant expendability. Occupying only two rack units of vertical space,
the SUN Netra 240 server is configured with high-performance, 64-bit, SPARC® Ver-
sion 9-compliant UltraSPARC IIIi processors, each with 1 MB of L2 cache.

2.1.5 Software Architecture of SGSNs

2.1.5.1 Software Architecture of MP Platform

Main processor (MP)
Different software packages are available for the main processor:
• MP:PD/SH (packet dispatching/session handling) covers all subscriber-dependent
packet processing and protocol functions such as session management, resource
management, short message service (SMS), location services (LCS), parts of the
BSS GPRS protocol (BSSGP), the logical link control (LLC) protocol, and parts of
the subnetwork-dependent convergence protocol (SNDCP).
This MP:PD/SH also contains closely related functions like GMM-TF (GPRS mobility
management - transport function).
• MP:MM (mobility management) performs the mobility management-related func-
tions in the system. This MP handles the GMM-AF (GPRS mobility management -
application functions), MAP (mobile application part), TCAP (transaction capabilities
application part), SCCP (signaling connection control part). The central function is
the GMM-AF, which handles all user data, which mainly concerns the mobility state
of the (MS) and the routing area, and the short message service (SMS) and location
services (LCS) functions. The SGSN location register (SLR) is a component of the
GMM-AF and contains all necessary information about the MS.
• MP:CAP (CAMEL application part) hosts the software part of the CAMEL message
handling and budget management for the prepaid service (MP:CAP is combined
with MP:MM in one load type MP-MM). This MP handles the MAP (mobile applica-
tion part) protocol based on TCAP (transaction capabilities application part) and
SCCP (signaling connection control part).
• MP:SM (signaling management) is used for SS7 handling.

A50016-D1111-V12-2-7618 27
System Description D900/D1800 Information
GPRS PLMN System

• MP:SLT (signaling link termination) is used for SS7 handling and creates the con-
nection with the HLR through the Gr interface.
• MP:OAM (operation and maintenance) is a software component that runs on the
MP-SA module covering all operation, administration and maintenance functions,
and statistic functions. It is also responsible for the output processing of accounting
data and layer management. When the decentralized charging gateway function
(CGF) is used, the accounting/charging data is retrieved regularly by the Adminis-
tration and Billing Center (ABC). However, if the centralized CGF is enabled, the ac-
counting/charging data are transferred with the protocol GTP’ via the Ga interface to
the charging gateway (CG). The Switch Commander (SC) is connected to this MP.
• MP:STATS (statistics) is a software component that runs on the MP-SA load type
covering all functions related to statistics (for performance management/traffic man-
agement) .
• MP:ACC (accounting/charging) is used for performing accounting/charging func-
tions. It is responsible for the collection of accounting/charging data and generates
and formats the corresponding charging detail records (CDR).
• MP:OAMD (also called MP:ACCIO)
MP:OAMD is used for the output processing and distribution of CDRs which have
been transferred from MP:ACC. The LAN interfaces of MP:OAMD are used to sup-
port a separate FTP interface for billing file transfer, the Ga interface in a SGSN con-
figuration and the hot operation interface in case of a MSC configuration. The
MP:OAMD is optional, either MP:OAM or the MP:OAMD can be used for the ac-
counting/charging output processing functionality. MP-IO is the hardware used for
MP:OAMD.

Line interface cards (LIC)

The MP platform uses two different types of LICs for GPRS:
• LIC for E1, TDM based (LIC(TDM)-E1), supporting the SS7 application on the Gr in-
terface, Gd interface, Gs interface and SCP/CSE-connection. This LIC provides sym-
metrical interfaces with bit rates of up to 2.048 Mbit/s. It provides cell-based traffic
on the internal interface to the ASN. The external line interface carries constant bit
rate (CBR) traffic, therefore the LIC provides functions for interworking between
STM and ATM using AAL1 service type for packeting CBR traffic into ATM cells.
• LIC for STM1 (LIC(ATM)-STM1), supporting the interface to the LICs of SP platform.

2.1.5.2 Software Architecture of SP Platform

Service Processor (SP)
Different software packages are available for the service processor:
• SP:BSSGP (base station system GPRS protocol) handles the Gb interface and is
responsible for the distribution of Gb interface primitives to MP:PD/SH.
• SP:GTP (GPRS tunneling protocol) handles the whole Gn and Gp functionality.

Line Interface Card (LIC)

The ATM SP platform uses three different types of LICs for GPRS:
• LIC for E1 (LIC(FR) or LIC:GTP), supporting the Gb and Gn interfaces. This LIC pro-
vides symmetrical interfaces with bit rates of up to 2.048 Mbit/s. The LIC(FR) pro-
vides frame relay (FR) services to the ATM network.
• LIC for ATM (LIC(ATM)-STM1), supporting the interface to the LICs of MP platform.
This LIC provides symmetrical interfaces with bit rates of up to 155.52 Mbit/s.

28 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

• LIC for Ethernet10/100 BaseT (LIC(IP)-Ethernet), supporting the Gn interfaces. This

LIC provides symmetrical interfaces with bit rates of up to 100 Mbit/s.

2.1.6 Software Architecture of CPG-3300/IPS-3300 Platform

Supervisor card (SUP)
The SUP software supervises the packets that enter or leaves the node via a line inter-
face card. Internally SUP software dispatches the packets among the server cards, e.g.,
MWAM.

Mobile wireless access module (MWAM)

The CPG-3300/IPS-3300 platform uses two different types of MWAM images (software
packages) for GPRS that use the same input/output software (IOS) software:
• GGSN image
• SSG image
The server load balancer (SLB) software, which is needed to distribute the PDP context
requests among GGSN instances run on SUP.

Content service gateway (CSG)

The CSG software focuses on charging in PLMNs. The CSG software is capable to sup-
port the layers 3 to 7 (e.g., IP to FTP, HTTP 1.0/1.1, POP3, RTSP, SMTP, WAP 1.0/2.0).

Content switching module (CSM) with firewall load balancer (FWLB)

The content switching module (CSM) software balances client traffic to farms of servers,
firewalls, secure sockets layer (SSL) devices, or virtual private network (VPN) termina-
tion devices. In IPS-3300 the FWLB software is running on the content switching module
(CSM).

Local charging gateway (L-CG)

The L-CG software has been derived from the “message coordinator (MCR)” software
that is offered by SIEMENS. The L-CG software runs on a downsized platform - a desk-
top SUN Netra 240, which provides appropriate performance for the L-CG application.

2.1.7 Software Structure of CG

The CG based on Netra V420 server is running on operations system SUN Solaris.

Message coordinator (MC)

The CG software has been derived from the “message coordinator (MCR)” software that
is offered by SIEMENS as a Central Charging Gateway (C-CG) solution. The CG soft-
ware, uns on a downsized platform - a desktop SUN Netra 240, which provides appro-
priate performance for the CG application.

A50016-D1111-V12-2-7618 29
System Description D900/D1800 Information
GPRS PLMN System

2.1.8 OEM Products with Hardware Platform / Software Release

In the following Tab. 2.1 gives an overview of packet-switched domain IP products in
the current software version.

IP product Hardware platform Software release Features

Packet router CISCO 7206 VXR 12.1 (14) E or Routing, VLAN, IPsec,
CPR-3200 12.2 (5) E GRE, MPLS, HSRP,
IOS, Firewall

Packet router CISCO 7213 SUP: 12.2.(18)S, 12.3M Routing, VLAN, IPsec,
CPR-3300 IPSec: run by SUP GRE, MPLS, HSRP,
FW: FWM-1.1-K9 Firewall

Radius SUN Fire 280 R MSM 2.1 RADIUS

DNS SUN Fire 280 R Solaris 9 DNS BIND 8.3.2

DHCP SUN Fire 280 R Solaris 9 DHCP

NTP Meinberg LANTIME LANTIME/GPS NTP

VPN Gateway CISCO PIX 515 E 6.3 IPsec

(IPsec device)

Firewall CISCO PIX 525 CISCO PIX 525 E 6.3 Firewall

Firewall CISCO PIX 535 CISCO PIX 535 E 6.3 Firewall

Firewall Checkpoint SUN Fire 280 R FW-1 NG AI (FP4) Firewall

FW-1 NG

Firewall Checkpoint SUN Fire 280 R FW-1 GX 2.0 Firewall

GX-1 NG

Tab. 2.1 Packet-switched domain IP products in the current software version

30 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2.2 Internal Architecture of an SSS Node (for GPRS PLMN)

2.2.1 Combination of Network Elements

The modularity of the D900/D1800 network elements allows different configurations of
the SSS. Each configuration consists of the SSS network elements mentioned above.
The following points must be taken into account when selecting a configuration:
– Performance capacity
– Storage capacity of the coordination processors involved
– Transmission capacity of the links between the separate network nodes
Estimates of the transmission capacity of the SS7 show that the home location register
(HLR) should not be physically separated from the authentication center (AC). This pro-
duces the combination HLR/AC.
Fig. 2.10 shows a block diagram with a combination of HLR/AC.

digital trunks to SGSN/GGSN LTG SN

with SS7(MAP)

SSNC
SS7 links (optional)

via LAN(TCP/IP) to SC
SC Coordination area
via PSDN(X.25) to SC (CP113C,
MB, CCG)

Fig. 2.10 Block diagram with a combined HLR/AC of type SSS node

2.2.2 Hardware Architecture

The hardware architecture of D900/D1800 SSS permits many flexible combinations of
switching subsystem elements and has clearly-defined interfaces. This forms the basis
for cost-effective use of D900/D1800 in all areas of the broad spectrum of applications.
Functions determined by the network environment are handled by the line trunk groups
(LTGs). The signaling system network control (SSNC) for SSS “innovation nodes” or
common channel signaling network control (CCNC) for SSS “classic nodes” handles the
message transfer part (MTP) of signaling system SS7. The function of the switching net-
work (SN) is to interconnect the trunks in accordance with the call requirements of the
subscriber and the network administration. The controls of the subsystems involved car-
ry out practically all the tasks arising in their area independently (e.g., the line/trunk
groups handle digit reception, charge registration, supervision and other functions).
Only for system-wide and coordination functions, such as routing and zoning for exam-
ple, do they require the assistance of the coordination processor (CP113). Fig. 2.11
shows how the most important controls are distributed throughout a SSS network node
(HLR/AC). This principle of distributed control reduces the amount of coordination in-
volved and the need for communication between the processors, and contributes to
D900/D1800's very high dynamic performance standard. The flexibility inherent in dis-

A50016-D1111-V12-2-7618 31
System Description D900/D1800 Information
GPRS PLMN System

tributed control also makes it easy to introduce and modify features and to assign fea-
tures to specific subscribers.
For interprocessor communication, the switching network sets up 64-kbit/s connections
in the same way as connections between subscribers. However, the connections be-
tween the processors remain established and are therefore referred to as semiperma-
nent connections. This avoids the need for a separate interprocessor control network.
The structure of an SSS network node comprises the following main hardware compo-
nents:
– Line trunk groups (LTG)
– Switching network (SN)
– Signaling system network control (SSNC)/
common channel signaling network control (CCNC)
– Coordination area with coordination processor (CP113), message buffer (MB) and
central clock generator (CCG)
Fig. 2.11 shows an example of an SSS network node (HLR/AC).

SN
Digital trunks to/from other SSS LTG
network nodes (e.g., MSC/VLR,
HLR/AC, EIR) GP

SSNC
SS7 links
(optional) MP

Coordination CCG MB
area

Via PSDN(X.25) or CP113

LAN(TCP/IP) to the SC

EM CTL

Fig. 2.11 Structure of a D900/D1800 SSS “innovation node”

With the current software version the hardware components described in the next sec-
i tions are used for new equipping of the SSS network node. These components are:

– line/trunk groups (LTG) of type P or N for trunk use

– switching network (SN) of type D or B
– signaling system network control (SSNC)/
common channel signaling network control (CCNC)
– coordination area, with coordination processor (CP113) of type E or C, message
buffer (MB) of type D or B, central clock generator E (CCG(E))

32 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2.3 Internal Architecture of a BSS Node

2.3.1 Network Elements

The Base Station System (BSS) and the corresponding Operation and Maintenance
Subsystem (OMS), i.e. Radio Commander (RC) form the Siemens Base Station System
(SBS). The Base Station System (BSS) consists of Base Station Controllers (BSCs),
Base Transceiver Stations (BTSs) integrated into BTS Equipment (BTSE), Transcoding
and Rate Adaption Units (TRAUs) and local maintenance terminals (LMTs) as shown in
Fig. 2.12. The structure containing an intelligent centralized controller part and several
low cost transceiver stations is suitable for both the smallest cell networks, preferably
used in urban areas, and large-cell rural networks. The advantage of the smallest cell
networks is the internal handover offered by the BSCs and the advantage of large-cell
networks is the coverage of large areas by low-cost BTSs.

Um BTSE
(PCU)
Gb
BTS
(from/to SGSN)
(CCU)
(E-CU) TRAU
Abis
remote
BSC A

Um Asub (from/to MSC)

BTS

(CCU)
(E-CU)
Abis (from/to RC via MSC, with
remote PCM30 NUCs))

Um T
Tµ T

BTS LMT
LMT (CCU)
(E-CU) O
together with
(from/to RC, with
BSC
X.25/PSDN)

(Interface to an
external CBC)
LMT LMT

Fig. 2.12 Structure of the D900/D1800 BSS

A50016-D1111-V12-2-7618 33
System Description D900/D1800 Information
GPRS PLMN System

To support GPRS, the BSC has to be expanded with a new hardware unit, known as a
i packet control unit (PCU). Furthermore, a new software functionality, called channel co-
dec units (CCU), has to be added to the BTS.
To support EDGE, the BTS has to be expanded with a new hardware unit, known as an
EDGE carrier unit (E-CU) instead of the old carrier unit (CU).

Base Transceiver Station Equipment (BTSE)

BTSEs are distributed over the entire radio service area. In general, each BTSE sup-
ports at least one BTS, sometimes more. Each BTS serves a radio cell.
GPRS support: The PCU function in the BSC is completed by more channel codec units
(CCU) in the BTS which is implemented as a software function. The CCU software func-
tion performs channel coding, including forward error correction and interleaving. Fur-
thermore, it performs radio channel measurements and mapping of GPRS and signaling
onto the Abis interface in the direction of the BSC.
EDGE support: The E-CU is a modified CU that uses the same interfaces as a CU, but
also supports enhanced data rates for GSM evolution (EDGE) functionality in the uplink
and downlink.

Base Station Controller (BSC)

One or more BSCs are linked to a Mobile-services Switching Center (MSC). Physically,
the BSCs can be grouped together at a central point on MSC sites or remotely in a shel-
ter or in a confined space. The BSC can then act as a concentrator for the links between
the Abis and Asub interfaces. A BSC serves one or more BTSs.
GPRS support: The packet control unit (PCU) is a logical part of the BSC. The PCU pro-
vides interworking between the network side of the GPRS system and the radio side. In
particular it performs the radio-specific function of the GPRS operation. That is, it re-
quests the radio resources from the BSC, manages the sub-multiplexing of multiple
GPRS-MSs on one physical channel and performs the automatic repeat request (ARQ)
protocol to guarantee a reliable link to the GPRS-MS. Furthermore, it supports layer 1
protocols (frame relay) via the Gb interface in the direction of the SGSN. In the same way
as the TRAU, the PCU can be located near (or in) the BSC and the SGSN.

Transcoding and Rate Adaption Unit (TRAU)

Although the TRAU is logically a part of the BSS, it is designed to be physically located
at the MSC site. This helps to save transmission capacity on the Asub interface.
HSCSD support: The TRAU supports the new transcoding data rate of 14.4 kbit/s by
supplying new IWF transcoding boards.

2.3.2 Hardware Architecture of the BSS Nodes

The BSS consists of
– Base Transceiver Station Equipment (BTSE)
– Base Station Controllers (BSCs) and
– Transcoding and Rate Adaption Units (TRAUs)
as shown in Fig. 2.12.
Firstly, the BTS variants based on the new BTS+ architecture are described as follows:
– BTSE BS-240/BS-241 (BS-24x)
(including BS-240 XL, BS240 C, and BS240 XS)

34 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– BTSE BS-40/BS-41 (BS-4x)

– BTSE BS-82 eMicro
Secondly, the BTS variants based on the standard type BTS architecture are described
as follows:
– BTSE BS-20/BS-21 (BS-2x) and BS-60/BS-61 (BS-6x)

The great advantage of the new BTS+ family is the fact that all the features and the fu-
i ture evolution will be supported in a homogeneous way, from the BS-24x to the eMicro
variant.

The BS-24x, BS-4x, and BS-82 eMicro, and the existing BS-6x/BS-2x are all compatible
at Abis level. Therefore, they can be connected to the same BSC in a loop, multidrop or
even in a cross-connect scenario. This aspect facilitates the introduction of the new
BTS+ generation. All kinds of upgrade scenarios are possible; an extra BTS at one site,
extra BTS in a loop or replacement of existing old BTS.

2.3.2.1 Base Transceiver Station Equipment (BTSE) BS-24x

This section describes the new “future-proof evolution of BTS equipment (BS-24x)” .
i One major aim of the BS-24x is the evolution of the BTS hardware platform to prepare
the architecture for new applications and to overcome some existing restrictions, for ex-
ample there is currently no rack extension, no core redundancy, strong limitation on the
number of carriers per radio cell or site and restrictions on some combining configura-
tions. Another aim is to offer the latest “state of the art” technology for highest modularity
and flexibility, low volume per carrier for a high power “macro-BTS”, more flexibility in
combining configuration (e.g., mixture of FICOM and DUCOM), minimized power con-
sumption and minimized costs (factory, installation and maintenance). Furthermore, the
BS-24x platform will be the basis for the seamless migration strategy to UMTS through
hardware reuse and convergence (GSM, GPRS, EDGE). The modular hardware/soft-
ware concept and mechanical handling will be identical.

Highlights of the BS-24x are 24 TRXs in 3 racks with 8 TRX each, significantly reduced
volume per TRX, and a future-oriented preparation for new features. Increasing de-
mands for a higher capacity are solved by a reduced volume per TRX and an expansion
number of 8 TRXs per rack, 12 TRXs per radio cell and 24 TRXs per site. This also
makes the BS-24x a powerful dual band base station.
A full spectrum of combining equipment gives high output power to all radio cell config-
urations and an optimal tower mounted amplifier (TMA) guarantees highest receiver
sensitivity. The modular architecture and flexible internal structure with at least 2 MBit/s
data rates will enable the BS-24x to deal with new GSM features, e.g., enhanced data
rate for GSM evolution (EDGE). Necessary hardware upgrades are reduced to a mini-
mum.
The BS-24x BTSE (with basic rack and extension rack) consists of the following func-
tional blocks (Fig. 2.13):
• Carrier unit (CU) / EDGE carrier unit (E-CU)
• Core boards (COBA/COSA)
• Combining equipment (DUAMCO or FICOM and DIAMCO)
The main communication between the modules is provided by bi-directional serial link
communications between the carrier units (CU) / EDGE carrier unit (E-CU) and the core
boards. The serial link also provides an effective way of implementing baseband fre-

A50016-D1111-V12-2-7618 35
System Description D900/D1800 Information
GPRS PLMN System

quency hopping. All alarms beside the alarms that are generated in the core and in the
CU/E-CU boards are transported via the CAN bus (industry standard, ISO 11898). The
BS-24x supports external alarms for the PLMN operator. These are physically connect-
ed to the alarm connector terminal (ATM). There is an ATM_M for the master rack (base
rack) and an ATM_S for the slave racks (extension and service racks).

Carrier unit (CU)

The carrier unit (CU) takes care of the BS-24x for all carrier-oriented tasks. Two radio
frequency signals (diversity) are received in the uplink direction and then converted into
TRAU frames and signaling data. TRAU frames and signaling data are received in the
downlink direction and converted into a GMSK modulated radio frequency signal, which
is amplified to the desired power level.
The CU consists of the power amplifier and transceiver unit (PATRX) which provides the
main analog functions of the CU and the signal processing unit (SIPRO) which provides
all digital functions of the CU.

EDGE carrier unit (E-CU)

The E-CU is a modified CU that uses the same interfaces as the CU, but also supports
enhanced data rates for GSM evolution (EDGE) functionality in the uplink and downlink.
In downlink direction, the signaling and traffic data are received from the core network
and converted into a GMSK or EDGE modulated signal, which is amplified to the desired
power level.
EDGE functionality makes it possible to combine EDGE and non-EDGE timeslots on the
same carrier. The E-CU carries two independent receivers (normal and diversity chan-
nel) to provide the antenna diversity function. In uplink direction, the received signal is
converted to IF-band. The IF-band is converted to a digital GMSK/8PSK-signal.
The E-CU is a newly developed and enhanced CU which supports GMSK and 8PSK
modulation in uplink and downlink. It is a hardware compatible to the CU and fits into the
BTS+ rack. The E-CU consists of the following functional subunits: a power amplifier
and transceiver unit (E-PATRX) and a signal processing unit (E-SIPRO).

Core boards (COBA/COSA)

The core boards have the following tasks inside the BTSE:
– Local controlling of the entire BTSE
– Generation of system clocks
– Providing up to 8 Abis interfaces to BSC or other BTSEs
– Routing Abis data up to 24 CUs/E-CUs
– Providing an interface to the LMT/open test platform (OTP)
– Handling and processing of O&M messages
The following two core boards exist:
• Core basis (COBA)
The COBA is the central board of the core. The functionality of the advanced clock
generation (ACLK) and the base core controller (BCC) of the entire BTSE are inte-
grated. In addition, two PCM30 Abis interfaces are available on COBA.
• Core satellite (COSA)
The COSA consists of 6 PCM30 interfaces for Abis and 16 CU/E-CU interfaces.

36 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

BTSE
(Base Rack)

TX/RX antenna
Duplexer Carrier unit Core basis
amplifier (CU/E-CU) (COBA)
multi coupler
(DUAMCO)

Alarms
Carrier unit Core basis
T-interface LMT
(CU/E-CU) (COBA)
BSC
.. up to 8 CU AAbis-
bis
ACT_M interface
(2 x PCM30)
CAN bus

BTSE
TX antenna (Extension Rack)

TX path Carrier unit Core satellite

(FICOM) (CU/E-CU) (COSA)

RX antenna

RX path Carrier unit Core satellite BSC

(DIAMCO) Abis
(CU/E-CU) (COSA)
interface
(6 x PCM30)
.. up to 8 CU
ACT_S

CAN bus

BTSE
(Service Rack)

-wave, NTPM AC/DC ......

AC/DC control
AC panel

ACT_S CAN bus

Battery

Fig. 2.13 Functional structure of the BS-24x BTSE (with basic rack and extension rack (and service rack))

A50016-D1111-V12-2-7618 37
System Description D900/D1800 Information
GPRS PLMN System

Combiner

Filter combiner (FICOM)

A filter combiner (FICOM) can be tuned remotely and facilitates a combination of up to
8 carriers in a rack in the downlink direction (TX). The advantage of this filter combining
technique is the very low insertion loss, for example if 8 transmitters are combined to
one antenna. In principle, the FICOM offers the following main functions: RF functions
(such as RF power combining and transmitter spurious signal suppression), con-
trol/monitoring functions (such as status reporting and internal performance monitoring).

Di(=2) amplifier multicoupler (DIAMCO)

The di-amplifier multicoupler (DIAMCO) contains two submodules with receiving filters
(RX), low noise amplifiers (LNAs) and power splitters. Therefore, for the uplink direction
(RX), the DIAMCO has to be used to filter and distribute the received signals to the car-
rier units (CU) / EDGE carrier units (E-CU).

Duplexer amplifier multicoupler (DUAMCO)

The duplexer amplifier multicoupler (DUAMCO) contain filters for combining the trans-
mitting path (TX) and the receiving path (RX) into one antenna connector. The receiving
path (RX) consists of a low noise amplifier (LNA) and a power splitter. The transmitting
path (TX) consists of isolators, a hybrid coupler and an antenna supervision unit (ASU).
The DUAMCO has two different operation modes which are classified, regardless of
whether the tower mounted amplifier (TMA) is used or not.

Tower mounted amplifier (TMA)

The tower mounted amplifier (TMA) contains two duplex filters for combining the trans-
mitting and receiving path into one antenna after amplification of the receiving signal.
The receiving path consists of the RX part of the duplex filter and a low noise amplifier
(LNA), including a fail-safe switch. The transmitting path consists of the two TX parts of
a duplexer. When the TMA is used, the DUAMCO/DIAMCO is used in the so-called mul-
ticoupler mode. In this mode the DUAMCO/DIAMCO mainly works as a multicoupler to
split the receiving signal for the subsequent CUs/E-CUs.

2.3.2.2 Base Transceiver Station Equipment (BTSE) BS-4x

The concept and main components of this new SIEMENS BS family are the same as
those of the BS-24x.
The BS-2x consists, in principle of only three different types of boards:
– Carrier-oriented boards called carrier units (CU) / EDGE carrier units (E-CU)
– Core boards (COSA/COBA)
– Combining equipment (DUAMCO, FICOM)
This has to be advantage of a low number of spare parts that facilitates logistics and ser-
vice. Moreover, the integrated cross connect (up to 8 PCM lines can be connected) fa-
cilitates installation and reduces leased line costs. Evolution to EDGE is also very
simple. To take advantage of the higher data rates provided by EDGE, all that is required
is to insert an additional EDGE-capable carrier unit (E-CU) into the rack and download
the new software. This paves the way for 3G systems.
The main difference between this and the BS-24x family is the compact BTS design
which is optimized for high-coverage applications with small to medium capacity de-

38 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

mands. Highlights are an all-in-one base station with up to 4 TRXs, AC/DC, battery
backup and line equipment included in one rack (Fig. 2.14).

BTSE
(Service Rack)

TX/RX antenna
Duplexer Carrier unit Core basis
amplifier (CU/E-CU) (COBA)
multi coupler
(DUAMCO)

Alarms
Carrier unit Core basis
T-interface LMT
(CU/E-CU) (COBA)
BSC
.. up to 8 CU Abis-
interface
(2 x PCM30)
CAN bus

TX antenna

TX path Carrier unit Core satellite

(FICOM) (CU/E-CU) (COSA)

RX antenna

RX path Carrier unit Core satellite BSC

(DIAMCO) Abis-
(CU/E-CU) (COSA)
interface
(6 x PCM30)
.. up to 8 CU

CAN bus

-wave, NTPM AC/DC ......

AC/DC control
AC panel

ACT_S CAN bus

Battery

Fig. 2.14 Functional structure of the BS-4x BTSE (on basis of the service rack)

For description of the hardware components, see the above section 2.3.2.2 of BS-24x.
Its compact design with high output power makes the BS-4x the ideal solution for
– rural applications
– GSM railway networks and

A50016-D1111-V12-2-7618 39
System Description D900/D1800 Information
GPRS PLMN System

– a powerful multiband base station which allows the integration of different bands on
BTS level inside one rack.

2.3.2.3 Base Transceiver Station Equipment (BTSE) eMicro BS-82

The eMicro is based on the future-proof architecture of the BS-24x family which is al-
ready prepared for service evolution (GPRS, EDGE). It is compliant with all GSM micro-
cellular application requirements and micro BTS installation scenarios, but its
application range has also been greatly extended by a higher TX power and higher ca-
pacity of 4 TRXs per cabinet (up to 8 TRXs per cell cascading 2 cabinets). The higher
TX power also increases the installation flexibility, allowing several site/antenna config-
urations. Both pole and wall mounting options are available.
The product architecture is derived from the BS-24x base station family. The eMicro
concept is based on the new “modulo 2” TRX units which are called dual-carrier units
(DCU).
The eMicro consists of a “master cabinet” which can include one or two DCU units (up
to 4 TRXs). It can also be connected to an “extension cabinet” to reach up to 8 TRXs.
Up to 2 “add-on” modules can be attached on both cabinets to supply optional features
(e.g., combining 4:1, 4:2, etc.) or for future expansion purposes.

Add-on
Module 2 .. up to 4 .. up to 4

Add-on Add-on
Module 1 Module 1

Master Base Extension Base

Unit Unit

Dual Dual Dual Dual

carrier carrier carrier carrier
unit unit unit unit
(DCU) (DCU) (DCU) (DCU)

COBA

CAN bus
AC/DC, Battery AC/DC, Battery

Abis .. up to 2

Fig. 2.15 Functional structure of the eMicro BTSE

Applications
Enhanced Micro (eMicro) BTS is the new generation of SIEMENS microbase stations.
The term microbase station indicates a product characterized by compact and flexible
installation. Nowadays, these kind of products are required to be more powerful and
complete, with capabilities far beyond the classic microcellular requirements. The eMi-

40 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

cro can address applications ranging from the “classic micro” to the “compact base sta-
tion”.
The eMicro addresses all kinds of microcellular applications, “hot spots”, “dark spots”,
both indoor and outdoor, and can meet very high capacity demands and dual-band op-
erations.
Furthermore, the eMicro is able to address macro cellular applications, especially in ur-
ban areas (where cells are normally smaller and also in rural areas. In addition, the
planned booster option makes the TX output power fully comparable with actual Macro
BTS:
– Airports, train stations, etc.
– Shopping malls
– Urban areas
– “Hot spots”
– ”Dark spots”
– Dual band applications
– In-building coverage by means of distribution

2.3.2.4 Base Transceiver Station Equipment (BTSE) BS-2x and BS-6x

This section describes the “standard” type BTS equipment (BS-2x and BS-6x).
i
The BS-2x and BS-6x BTSE are controlled by the Base Station Controller (BSC) which
is connected via the Abis interface. The BS-2x and BS-6x BTSE may be either remotely
located or collocated with the BSC. The traffic channels set up in the different BTSEs
are switched transparently to the Transcoding and Rate Adaption Unit (TRAU) which,
although it is part of the BSS, will usually be remotely located at the MSC site.
The BTS is defined by the GSM standard as a network component serving one cell, the
latter in turn being defined by one distinct base station identity code (BSIC) from the mo-
bile station’s perspective.
The hardware architecture of the logical BTS is such that it is possible to serve several
logical BTSs (sector radio cells) with one physical BTSE. This reduces equipment costs
by sharing central BTSE hardware equipment.
The BS-2x and BS-6x BTSE are normally connected by one or more 2,048 kbit/s PCM
links, a so-called Abis interface to the BSC. Each BS-2x and BS-6x BTSE rack is con-
nected to the Abis interface by means of a line interface, which converts the external
PCM signal into an internal data link called bus2 and bus1. Within each BS-2x and BS-
6x BTSE rack, bus1 connects the transceiver to the other BTS functional blocks.
The BS-2x and BS-6x BTSE (with separate TX and RX paths) consists of the follow-
ing functional blocks (Fig. 2.16):
• BTSE control
• Link interface
• Transceiver
– baseband & signal processing
– transceiver and processor
– power amplifier
• TX combiner (HYCOM, FICOM)
• RX pre-amplifier (RXAMOD)
• RX splitter (RXMUCO)

A50016-D1111-V12-2-7618 41
System Description D900/D1800 Information
GPRS PLMN System

The BS-2x and BS-6x BTSE (with duplex equipment) consists of the following other
functional blocks within the TX and RX path (Fig. 2.17 and Fig. 2.18):
• Duplex combiner (DUCOM) or duplexer and low noise amplifier module (DULAMO)
• Receiver antenna module and multicoupler (RXAMCO)

BTSE control
The BTSE control is represented by the core controller (CCTRL) which controls all O&M
tasks of an entire BTSE and controls all radio cells (BTS) belonging to one BTSE site.
The CCTRL is installed once in the master rack.

Link interface
The link interface (LI) extracts the network clock information for the common clock gen-
erator and passes all BTSE-relevant data to bus2. It provides a PCM30 link to the BSC
(Abis interface) on OSI layer 1. The physical part of the LI may change, depending on
the transmission link type which must be supported on the Abis interface.

BTSE Transceiver
TX antenna

TX combiner Abis
Power Link interface interface BSC
(HYCOM/
amplifier (LI)
FICOM)
RX antenna
B
u
RX pre- RX splitter s
Transceiver B
amplifier (RXMUCO) Baseband& 2
and u
RX antenna (RXAMOD) signaling
processor s
(TPU) 1
RX pre- RX splitter
amplifier (RXMUCO)
(RXAMOD)
T interface
BTSE LMT
Diversity (optional)
control
External alarms

External control

Fig. 2.16 Functional structure of the BS-2x and BS-6x BTSE (with separate TX and RX paths)

42 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

BTSE Transceiver

Abis
Power Link interface interface BSC
amplifier (LI)

TX/RX antenna Duplex combiner

(DUCOM) Power B
amplifier u
Transceiver
TXFIL/ Baseband& s
and B
signaling 2
processor u
RXAMCO s
RXFIL
TX/RX antenna 1

TXFIL/
BTSE T interface
control LMT
RXAMCO
RXFIL

Diversity (optional) External alarms

External Control

Fig. 2.17 Functional structure of the BS-2x and BS-6x BTSE (with duplex combiner (DUCOM))

BTSE Transceiver

Abis
ACOM Power Link interface interface BSC
TX/RX amplifier (LI)
antenna Duplexer and
B
u
TXFIL Baseband& s
B
RXAMCO Transceiver signaling 2
u
TX/RX RXFIL LNA or and s
antenna RXAMCO processor 1

TXFIL
RXAMCO
BTSE T interface
or LMT
RXFIL LNA control
RXAMCO

Diversity (optional) External alarms

External Control

Fig. 2.18 Functional structure of the BS-2x and BS-6x BTSE (with duplexer and LNA module (DULAMO))

A50016-D1111-V12-2-7618 43
System Description D900/D1800 Information
GPRS PLMN System

Baseband & signal processing

This functional block is represented by the baseband and signal processing unit (BB-
SIG) which receives the traffic channel from the link interface via bus2 and receives OSI
layer 3 messages via bus1. It encodes, encrypts and interleaves signaling and user data
in accordance with the channel type used and executes pre-processing of the uplink
measurements and measurement reports sent from mobile stations (MS) and performs
power control and handover recognition.

Transceiver and processor

The transceiver is represented by the transceiver and processor unit (TPU) which con-
sists of two main blocks, the TRXA and the TRXD. The TRXA part contains all the ana-
log signal processing parts and has a transmitting and receiving part. The TRXD part
contains all the digital signal processing parts.

Power amplifier
The power amplifier (PA) provides the required RF power in the downlink path. There
are separate low power and high power PA modules for the frequency bands of D900
and D1800. For D900/D1800 there is a low power version and a high power version.

TX antenna combiner (ACOM)

There are two kinds of TX antenna combiner (ACOM):
• Hybrid combiner (HYCOM)
The hybrid combiner (HYCOM) can be divided in two parts. One part is the hybrid
network which uses a hybrid combining technique that can be used for up to 4 car-
riers. The other part is the transmitting antenna module (TXAMOD) which consists
of a transmission band filter and a directional coupler.
The transmission band filter provides the required suppression of intermodulation
products outside the transmitting band, and protects the receiver against TX phase
noise and spurious emission impacts.
HYCOM can be used with baseband frequency hopping and with synthesizer fre-
quency hopping.
• Filter combiner (FICOM)
The filter combiners (FICOM) are remote tunable which enable a combination of up
to 6 carriers in a rack. FICOM can only be used with baseband frequency hopping.

RX pre-amplifier (RXAMOD)
The RX pre-amplifier is represented by the receiver antenna module (RXAMOD) which
is the first part of the receiver. It can be mounted near to the receiving antenna, and
therefore of utmost importance for the receiver performance.
The content is a band filter for the entire receiving band (RXFIL), and a 2-branch low-
noise pre-amplifier.
The parallel architecture provides, a degraded but ongoing operation of the BTSE
should the low-noise amplifier fail.

RX splitter (RXMUCO)
The RX splitter is represented by the receiver multicoupler (RXMUCO) which provides
a multicoupler for the rack internal distribution of the received signals. The multicoupler
consists of an amplifier and a splitter.

44 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Duplex combiner (DUCOM)

The duplex combiner (DUCOM) can be divided in two main parts. One part is a band-
pass filter for the transmitting path (TXFIL) and a bandpass filter for the receiving path
(RXFIL).

Duplexer and noise amplifier module (DULAMO)

The DULAMO consists of a duplexer section (with TXFIL and RXFIL) and a low noise
amplifier (LNA). It provides the means to simultaneously have two antennas per radio
cell with every type of antenna combiner, an LNA close to the antenna and to take ad-
vantage of “on air combining”. DULAMO can be utilized with every type of antenna com-
bination (FICIOM, HYCOM, DUCOM).

Receiver antenna module and multicoupler (RXAMCO)

The receiver antenna module and multicoupler module (RXAMCO) amplifies the RX sig-
nal with low-noise value and splits the RX signal into four receiving signals, plus a sep-
arate high-level output.

2.3.2.5 Base Station Controller (BSC)

The BSC is the central component of the BSS. Fig. 2.19 shows the functional structure
of the BSC. The BSC supports full-rate as well as half-rate operation. A half-rate up-
grade has an impact on all the main functional parts of the BSC.
There are in principle two variants of BSC architecture:
• Regular capacity BSC
• High capacity BSC
The high capacity BSC introduces a remarkable upgrade of performances in terms
of connectivity (i.e., PCM lines), packet data handling capability and LAPD signaling
to cope with different network configurations.

BSC

Switch
unit

Abis- Line Line Asub-/

BTSE interface interface interface A-interface TRAU

BSC control T interface (V.11)

O interface LMT
(X.25 or IP based)
RC

ext. CBC interface

ext. CBC

Fig. 2.19 Functional structure of the BSC

A50016-D1111-V12-2-7618 45
System Description D900/D1800 Information
GPRS PLMN System

The BSC consists of

– BSC control
– Line interface
– Switch unit.

BSC control
Basic GSC control components (as used in a GSM PLMN):
The BSC control is a multiprocessor system. It contains two main processors performing
call processing and O&M tests, and a set of slave processors for peripheral tasks and
for communicating between the components of the BSS. To achieve a high degree of
reliability, the main processors are duplicated. A hard disk is provided as a background
storage device.
One of the two main processors is the so-called administrative processor represented
by the main processor control card (MPCC). This controls the connections of the switch-
ing unit on the basis of the telephony processor messages. The other of the two main
processors is the so-called telephony processor represented by the telephony and dis-
tributor processor card (TDPC), which is responsible for message exchange with the
other network entities via the peripheral pre-processors.
Regular capacity BSC:
There are two types of peripheral processors. One of them is the peripheral processor
for LAPD channels (PPLD) which is responsible for handling the OSI level 2 LAPD pro-
tocol (used for signaling on the Abis and Asub interfaces). The other type is the peripheral
processor for SS7 (PPCC), which handles SS7 MTP OSI layer 2 for signaling towards
the MSC (A interface, via Asub interface).
High capacity BSC:
Peripheral processor for enhanced protocol handling (PPXX). The PPXX board is an en-
hanced, high-capacity evolution of PPCU, providing a common hardware support of
both for LAPD/SS7 and GPRS applications; the two applications are mutually exclusive,
and depend on the software loaded on the board:
– Generic PPXX board loaded with software for LAPD/SS7 is named PPXL
– Generic PPXX board loaded with software for GPRS is named PPXU
The operation and maintenance functions of the BSS can be accessed remotely via a
dedicated interface (O interface) to an Operation and Maintenance Center for BSS
(OMC), i.e. Radio Commander (RC). In addition, a local maintenance terminal (LMT)
may be connected allowing for operation at the BSC on site. For this, there is the O&M
interface (IXLT), which allows the main processor control card (MPCC) to be connected
to the O&M center by an ITU-T X.25 interface and to the local maintenance terminal
(LMT) by an ITU-T X.21/X.11 interface using the LAPB protocol. Connection to an ex-
ternal cell broadcast center (CBC) is possible via a separate interface.
An IP-based O interface feature introduces the IP-based O interface between the BSC
and the RC as well as between the BSC and the CBC. The TCP/IP link uses Ethernet
10/100 Base T. PLMN operators, which currently apply a X.25 network, can now replace
their X.25 networks with an IP network. This significantly speeds up the O interface. The
IP-based O interface is introduced in addition to the already supported X.25 link. The
BSC supports either X.25 or IP, while the RC also supports mixed configurations, e.g.,
X.25 and IP connections can be used simultaneously. The option of handling IP-based
O interfaces expands the BSC, by replacing the existing MPCC and TDPC boards with
new versions. Although the key functionality is implemented within the MPCC board,
both boards have to be replaced because MPCC and TDPC operate closely together.

46 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The BSC is equipped with two connectors to support either X.25 links or IP links in an
exclusive way. In the case of X.25, the cable is connected to the existing IXLT (Interface
X.25 - LMT); in the case of IP, it is connected to the new MPCC board. For redundancy,
each BSC is equipped with two IXLT boards and two MPCC boards; therefore, two con-
nectors are needed.
Additional BSC control components (as used in a GPRS PLMN):
The packet control unit (PCU) function is located within the BSC control. The PCU is a
unit composed of two cards and is called a peripheral packet control unit (PPCU). While
the first card provides service, the second one is in cold standby. Each BSC can include
two PCU units. In this case, the traffic is divided statically to both units by means of con-
figuration settings. The new PPCU cards will be inserted in the BSC rack instead of
some PPLDs. The insertion of PPCU cards reduces the capacity of LAPD channels per
BSC as follows: No PCU = 112 LAPD channels, 1 PCU = 80 LAPD channels, 2 PCU =
48 LAPD channels.

Line interface
The line interface (QTLP) provides the connections to the BTSs (Abis interface) and
TRAUs (Asub interface) via standard 2 Mbit/s digital lines.
Each line interface handles four 2 Mbit/s PCM lines; each PCM line has four physical
interfaces (terminal); the active physical interface is selected, on a per channel basis,
under software control.
In order to reduce the use of PCM lines and to obtain cost-effective operations,
8x8 kbit/s submultiplexing traffic channels are inserted in one PCM-slot.
If required, the QTLPs can be distributed deliberately between Abis and Asub interfaces.

Switching unit
It provides, under the control of the main processor control card (MPCC), traffic connec-
tions by linking mobile station time slots with the assigned MSC trunk time slots. This
allows, for example, management of the handover among BTSs covering adjacent radio
cells still belonging to the same BSC service area without directly involving the MSC re-
sources.
Regular capacity BSC:
The switching unit (SN16) is a non-blocking time-stage able to switch 12.288 unidirec-
tional 16 kbit/s time slots, which are conveyed to/from the outside by means of 23 x
8,192 kbit/s highways (for line interface connection; 1 highway is unused) and 4 x 2,048
kbit/s (from the signaling terminal connection).
High capacity BSC:
The standard switching network advanced performance (SNAP) is a non-blocking time
stage able to switch 49.152 unidirectional 8 kbit/s timeslots, which are conveyed to/from
outside by means of 48 x 8,192 kbit/s highways (for line interface connection; 1 highway
is unused) and 2 x 8,192 kbit/s highways (for signaling terminal connection).

A50016-D1111-V12-2-7618 47
System Description D900/D1800 Information
GPRS PLMN System

2.3.2.6 Transcoding and Rate Adaption Unit (TRAU)

Although the Transcoding and Rate Adaption Unit (TRAU) is logically part of the BSC,
it is designed to be physically located at the MSC site. This helps to save transmission
capacity between the BTS and MSC site. Fig. 2.20 shows the functional structure of the
TRAU.

TRAU

BSC Transcoder MSC

Asub A interface
BSC interface boards interface MSC
interface

T-interface

LMT

Fig. 2.20 Functional structure of the TRAU

The TRAU consists of the following functional blocks

– BSC interface
– MSC interface
– Transcoder boards

BSC interface
The BSC interface is represented by the BSC interface card (BSCI) which houses the
central controller of the TRAU and includes an interface to the BSC using normal PCM
links with a 16 kbit/s traffic channel structure. It multiplexes the serial lines generated by
the TRAC boards to build the complete lines to be sent to BSC and is transparent for the
SS7 channel (64 kbit/s channel) and for the X.25 link between BSC and RC (64 kbit/s
channel).

MSC interface
The MSC interface is represented by the MSC interface card (MSCI) which multiplexes
the serial lines generated by the TRAC boards to build the complete 64 kbit/s traffic
channel structure to be sent to the MSC/VLR node and processes the LAPD protocol
residing in the control link of the BSC. By using a dedicated serial communication link,
it sends the messages received from the BSC to the BSCI (directly or via another TRAU)
and receives the messages from BSCI to be inserted in the link to the BSC.

Transcoder boards
Transcoder boards are represented by the transcoding and rate adaption card (TRAC)
which processes 24 TRAU frames for 24 x 16 kbit/s traffic channels (uplink) with refer-
ence to the Asub interface side and for 24 x 64 kbit/s traffic channels (downlink) with ref-
erence to the A interface side. They operate with speech and data on each channel,
either at full-rate, half-rate and enhanced full-rate (coding and rate adaption function)
and performs the DTX/VAD function (for the full-rate channels) and performs the volume
control to compensate for possible losses of the speech level on a per-call basis.

48 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2.3.2.7 Serving Mobile Location Center (SMLC)

The BSS-based Serving Mobile Location Center (SMLC) is a key component of the
PLMN for supporting location services (LCS). It manages the overall coordination and
scheduling of resources required to determine the geographical location of a mobile
station (MS). The SMLC server is based on commercial, high-performance, reliable
and rackable carrier-grade servers. These servers are compliant with the Telcordia
NEBS standards Level 3 (mission critical). They are not equipped with a graphics card
and therefore have to be remotely managed from another console device. The SMLC
product is available in two SMLC server configurations:
• Single computing element (CE), or “single node”
• Two-CE Cluster, or “two-node cluster”
The single-node configuration provides a high-performance, high-volume and reliable
SMLC solution that can be integrated in racks. The two-node cluster configuration addi-
tionally provides a fully redundant system and, like single-node configurations, repre-
sents one network element in a GPRS PLMN network.
The SMLC server is connected to the SS7 network as well as to an Ethernet LAN. The
SS7 connections are used for the communication with the BSCs. Each SS7 interface
supports 16 SS7 links at 64 kbit/s within a E1 physical port. The Ethernet connections
allow the SMLC server to be managed remotely from terminals on the LAN.

2.3.3 Software

2.3.3.1 BS-24x and BS-4x BTSE Software

The BS-24x and BS-6x BTSE software comprises three main blocks:
– Operating system
– Radio and terrestrial channel handling (call processing)
– Operation and maintenance functions
All the BS-24x and BS-6x BTSE software in the BTSE (the basic bootstrap programs
excluded) can be downloaded.

2.3.3.2 BS-2x and BS-6x BTSE Software

The BS-2x and BS-6x BTSE software comprises three main blocks:
– Operating system
– Radio and terrestrial channel handling (call processing)
– Operation and maintenance functions
All the software in the BS-2x and BS-6x BTSE (the basic bootstrap programs excluded)
can be downloaded.

2.3.3.3 BSC Software

The BSC software can be subdivided into 5 main blocks:
– Operating system
– MPCC software
– TDPC software
– PPXX software
– XLT software

A50016-D1111-V12-2-7618 49
System Description D900/D1800 Information
GPRS PLMN System

2.3.3.4 TRAU Software

The main blocks of the TRAU software are:
– Operating system
– BSCI software
– MSCI software
– TRAC software
For all processors the software can be loaded from the BSC.

2.3.3.5 SMLC Software Architecture

The SMLC software consists of various application-specific and OEM software compo-
nents. Whereas the same SIEMENS-developed application-specific software is utilized
in both the single-node and cluster configurations, the OEM software components differ
between the two configurations.
The application-specific software components of the SMLC are:
• SMLC server
• SMLC local maintenance terminal (LMT)
• SMLC cell-ID/timing advance positioning calculation function (CITA-PCF)
The main OEM components are:
• Sun Solaris 2.8
• Sun Cluster 3.0 (cluster configuration only)
• VERITAS Volume Manager (cluster configuration only)
• Resilient Telco Platform (RTP)
• Oracle 8i Enterprise (single-node only)
• Oracle Parallel Server 8i (cluster only)
• Orbix 2000
• Ulticom Signalware
• Java Runtime Environment

2.3.3.6 Software Management

The D900/D1800 BSS has a structured software management to comply with the spe-
cific GSM standards about network management procedures. The software manage-
ment includes a strategy about software recovery which is a kind of software fault
defence action. The software-related recovery actions consist of
– initialization and
– downloading or reloading procedures

Initialization
An initialization procedure can affect only the involved data areas and is distinguished
by
– system restart (bring up initialization), with reload
– full initialization and
– lower level initialization
• System restart
A system restart is the initialization that occurs after a reload.

50 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

• Full initialization
The full initialization is the restart (without reloading) of the affected network ele-
ment. It can be manually activated (from LMT and/or RC) but can also be activated
automatically by the system defence action for specific errors which have occurred.
• Lower level initialization
A lower level initialization is performed according to a specific software task. It can
be manually activated but can also be activated automatically by the system defence
action for specific errors.

Downloading, loading/reloading
• Downloading
Downloading is the procedure of transferring executable files (load image files) from
RC/LMT to the BSC hard disks and subsequently to the other BSS network ele-
ments. In the RC/LMT, there is an installation program that moves the software pack-
ages being released into three directories. A directory “backup” holds a copy of the
current running software version for all the BSS network elements, another directory
“fallback” holds a reliable software version for all BSS network elements and a third
directory, “new”, holds the new software version in case of update/upgrade.
• Loading/reloading
The loading/reloading procedure affects a data and software image transfer which
describes the actual phase of putting the code into the processor’s memory. The
loading procedure can be divided into system bring-up and software version chang-
es.
A system bring-up is intended to (re-)start the complete BSS after a power-
down/power-up sequence.
A software version change is the loading of a new software version while the BSS is
running and keeping the loss of service at a minimum level.

Software image
A software image consists of executable code and/or of data areas. This data is a kind
of semipermanent data which can be modified by the operator during the lifetime of the
system. Transient data cannot be recovered via downloading or reloading procedures.

System upgrades
System upgrades, for the introduction of new features for example, are based on the
GSM standards and include
– loading the new software onto the RC
– downloading the BSS software
– amending the BSS database
– activating the new software and parameter changes
– bringing the BSS back into service
All these activities are operator-invoked actions which are provided by the BSS.

A50016-D1111-V12-2-7618 51
System Description D900/D1800 Information
GPRS PLMN System

2.4 Internal Architecture of an OMS Node

The Operation and Maintenance Subsystem (OMS) is implemented by element manag-
ers and consists of a Switch Commander (SC) or IP Manager for administering GSS
(and SSS) network elements and a Radio Commander (RC) for administering BSS net-
work elements within the PLMN. The operation and maintenance for GS (and SSS) and
BSS are independent of each other. The SC/IP Manager and RC can also be connected
to the network components of an Operations System (OS) via a LAN or PSDN with
TCP/IP protocol (Fig. 2.21). Components of an OS are, for example, the Security Man-
agement Center (SMC) or the Administration and Billing Center (ABC).

OS

PSDN/
LAN

SC/ RC
IP Manager

PSDN/LAN
D900/D1800 OMS

D900/D1800 GSS/SSS/BSS

GSS network SSS network BSS network

elements elements elements

Fig. 2.21 OMS network architecture

Logically, an SC or an IP Manager is linked to one or more GSS (or SSS) network

nodes, and an RC is linked to one or more BSCs even if the BSCs are connected to dif-
ferent MSCs.

52 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

2.4.1 Network Components

2.4.1.1 OMC for the GSS (and SSS) and the BSS
The structure of the SC/IP Manager and RC is shown in Fig. 2.22.

OS (PCS, SMC, NMC...)

Q3

CT CT CT CT OMT OMT

LAN LAN LAN

SC server/
SC server RC
IP Manager
D900/D1800 OMS

Q3:TCP/IP D900/D1800 GSS/SSS/BSS Q3:TCP/IP X.25

SGSN/GGSN/CG MSC/VLR HLR/AC TRAU/BSC/BTSE

CT CT CT LMT

Fig. 2.22 OMC for the GSS (and SSS) and BSS

The client terminals (CT)/operation and maintenance terminals (OMT) and the SC serv-
ers/IP Managers/O&M processors (OMPs) are connected to local area networks (LANs)
in the OMC. The SC server or IP Manager has access to the network nodes of the GSS
(and SSS) via the LAN with TCP/IP and the OMP has access to the network nodes of
the BSS (the BSCs) via the packet-switched data network (PSDN). All connections to
the PSDN are the ITU-T standard X.25 connections.

2.4.2 Hardware of the Switch Commander (SC)

The Switch Commander (SC) comprises the SC servers for GSS nodes (and SSS
nodes) and the client terminals (CT) which are connected to the SC servers via a local
area network (LAN). In this case, the SC server and the CT represent the client and
server of a client-server LAN architecture.

SC server (GSS nodes and for SSS nodes)

The SC servers are commercial computers (Windows 2000 servers). In addition to their
O&M functions (central management of the GSS network elements), they handle com-
munication with the GSS network elements via TCP/IP-based networks (DCN). The SC
is a highly scalable system and can be configured from a small expansion unit up to a
large TMN-OS for many network elements. The smallest possible configuration is a sin-

A50016-D1111-V12-2-7618 53
System Description D900/D1800 Information
GPRS PLMN System

gle server configuration. In a 100 Mbit/s LAN, the SC can have up to 40 communication
servers and 300 clients.

Client terminals (CT)

The CTs are commercial computers (Windows NT PCs). They provide the man-machine
interface between the operator and the SC server and the GSS nodes (or SSS nodes).
This interface is implemented with the functions of a graphical user interface (GUI) and
a command line interface (CLI). A CT either runs on the SC server, which in turn inter-
works with the CN node, or it runs on a metaframe server, which has access to the SC
via metaframe clients.
For local operation there is a single-machine configuration of SC. This is called craft ter-
minal local (CTL) which is a boot terminal connected to the GSS node via a TCP/IP or
V.24 interface.
The SC also supports interworking with UNIX workstations in order to fit into the admin-
istration concept of the PLMN operator. Notably, connectivity between UNIX-based ad-
ministration servers and the SC Windows 2000 computers exists for the following
services maintained on a UNIX-based administration server:
– File service
– NIS (user management)
– Mail service / SMTP
– X.11 / remote login
– System backup
A connection to Radio Commander (RC) is possible to increase productivity by common
i alarm surveillance.

2.4.3 Software Architecture of the SC

The software supplied for the components of the SC consists of a software platform, ba-
sic system and application software (Fig. 2.23). This application software is adapted to
the needs of a telecommunication management network (TMN). It consists of processes
for the various requirements of the operation and maintenance applications, e.g., oper-
ator can enter and send messages from the GSS nodes (or SSS nodes).

54 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Operation and maintenance

applications

Communication software

FTP, CMIP,
TELNET, HTTP,
SNMP
TCP-UDP/IP

Database
management
system
(DBMS;
Windows
ORACLE)
2000
Utilities

Basic system

Fig. 2.23 Components of SC software

Software platform
The software platform consists of commercially-available software systems complying
with international standards. The main components are:
– Operating system Windows 2000 ®
– Network file system
– Database management system (DBMS)
(the commercial database product ORACLE®)
– Communications software:
for WAN communication: for LAN communication: FTP, CMIP, TELNET, HTTP,
SNMP (based on TCP-UDP/IP).

Basic system
The basic system includes the following parts:
– Installation
– Recovery
– Central functions which allow general access to utilities
– LAN and WAN communication
– File transfer functions to the GSS nodes (or SSS nodes) or to the OS

Application software
The application software is divided into:
– Basic applications
– Applications for the GSS nodes (or SSS nodes)

• Basic applications
The basic applications include:

A50016-D1111-V12-2-7618 55
System Description D900/D1800 Information
GPRS PLMN System

– Security management (access protection mechanisms)

– User interface
– Computer and database structure
– Facilities for interworking the client terminal (CT) to the SC
• GSS applications
GSS applications include:
– Configuration management
– Fault and maintenance management
(managed by the graphical user interface alarm and massage display at the CTs
for GSS nodes (or SSS nodes))
– Performance management (with performance data collector (PDC))
– Automated patch supply (Autopatch)

2.4.4 IP Manager Hardware

The hardware equipment of the IP Manager is based on the standard computer hard-
ware components for computers running on Windows 2000. The IP Manager must be
installed on a network operators’s server which is used for the central storage of data-
bases, programs, application software, etc.
The IP Manager provides complete O&M functionality for all connected network ele-
ments. The connection between IP Manager and network elements is created via a ded-
icated O&M LAN network providing two-way data transfer via UDP. The IP Manager
uses Simple Network Management Protocol (SNMP) to exchange management infor-
mation and monitor and manage the network elements. For further tasks, Telnet, FTP,
Xwindows, and SSH are used.
Windows-based remote clients may use Web access or terminal services clients to the
IP Manager. For Web-based access, only standard Web browser software (Netscape
Navigator or Microsoft Internet Explorer) is needed on the remote client. This reduces
costs for maintenance and upgrading as well. However, a 2 Mbit/s connection is recom-
mended. Optionally, the OEM software product Citrix MetaFrame can be used for re-
mote access. This represents an economical solution for heterogeneous clients, such
as UNIX, OS/2, LINUX. Installing Citrix MetaFrame server software on the IP Manager
allows a number of different clients to access the IP Manager functions. Access via Citrix
MetaFrame clients only requires a low transmission bandwidth of about 30 kbit/s.

2.4.5 IP Manager Software

The IP Manager software strictly complies with an object-oriented approach and has
been designed with the following aims in mind: Operability, flexibility, and scalability,
high performance, continuity, and robustness.
As far as possible, IP Manager is based on standard software products and guarantees
high reliability and maintainability. This especially applies to the following parts of the
software:
– Windows 2000 operating system
– HP OpenView Network Node Manager,
for connection to the GSS network elements via an O&M LAN as the central user
interface
– IP Manager application software
– Protocol stacks (SNMP, Telnet, HTTP, X-window (X11))
– Database tools

56 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– Communication software (SNMP / UDP/IP)

– Remote operation applications (FTP, RLogin ...)
– Products for file handling, backup/restore of data.
Running on top of the base software, individual software packages are provided to sup-
port configuration, Fault and Performance Management functions for the different net-
work elements and versions (routers/switches, location servers etc.). This modular
concept also supports the seamless introduction of future IP-based network element
types or versions by simply installing an additional software package. This provides the
necessary flexibility for a rapidly changing market. The IP Manager software is rounded
off by the optional functional feature unit statistical collection for collecting and present-
ing statistics data from the network.

2.4.6 Hardware of the RC

The Radio Commander (RC) comprises the operation and maintenance processors for
the BSS (OMP) and the operation and maintenance terminals (OMT) which are connect-
ed to the OMP via a local area network (LAN). In this case, the OMP and OMT represent
the client and server of a client-server LAN architecture.

OMP
The OMP used is a commercially available computer (SUN Sparc/Workgroup or Enter-
prise). The OMP can be optionally duplicated with hot standby redundancy. The OMP
redundancy can also be supported by the use of internal hardware redundancy of the
SUN server.

OMT
Typically, the OMT is a graphical workstation, but given the Radio Commander's flexi-
bility, it is possible to work with a broad range of different types of OMTs, for graphical
user interface (GUI) and command line interface (CLI) access, such as:
– SUN graphical workstations
– X-terminals
– Graphical workstations acting as X-terminal
– PCs with X-terminal emulation
– PCs/workstations with alphanumeric terminal emulation for alphanumeric access
(via TELNET)
The standard configuration allows at least 8 active GUI sessions simultaneously (four of
which on X-terminals) or at least 16 alphanumeric sessions in addition to GUI sessions
on OMT local or remote.
The protocol stacks for transferring information between the OMC and the network en-
tities and/or other NMC/OMCs utilize standardized protocols, procedures and services
for TMN applications. The NMC can be connected via LAN/router for management ac-
tivity (CMISE) and via LAN/router for remote login. Communication between remote
OMTs and the OMP is based on TCP/IP.
The OMT for “National OMC” (see section 3.4.5.2) application (OMT/N) is connected via
X.25 (X.21 port) for management activities (CMISE) and LAN/router for remote login.
From the OMP point of view, the OMT/N is just another OMT, hence the same protocol
is used.

A50016-D1111-V12-2-7618 57
System Description D900/D1800 Information
GPRS PLMN System

Flexible and mobile remote access to the Radio Commander (RC) is provided via stan-
dard technologies such as
– PC/Windows NT
– LAN/ISDN/modem/mobile
– Web interface
The functionality supported include CLI, GUI (fault management (FM), performance
management (PM), configuration management (CM)), database access, and remote
printing.
For increased access security, it is possible to use SSL for encryption/decryption.
The OMC <--> OMC interface is used for remote operation via TCP/IP and X-11 proto-
col.
The Radio Commander (RC) also provides a CORBA-based interface to allow the inte-
gration of external offline applications.
The RC also supports standardized interfaces to:
– Microwave equipment
– External alarm devices
– Stand-alone post-processing tools
– And supports standardized interfaces for remote SQL database access, remote
UNIX login and remote CLI access

LMT
As local maintenance terminals (LMT) commercially-available hardware is used. The
same LMT hardware with its T interfaces is used for the BSS entities (TRAU, BSC,
BTS). LMT are available for operation and maintenance work at the BSS network ele-
ment (TRAU, BSC, BTS) site. The proprietary interface T (X.21/V.11) is used.

2.4.7 Software Architecture of the RC

New software technologies and programming languages such as CORBA (common Ob-
ject request broker architecture) and Java are applied to implement the management
applications. This ensures high flexibility, modularity and interconnectivity of the TMN
solutions offered. In addition, the operator is offered an efficient and user-friendly graph-
ical user interface which allows access via the Internet/Web. Both screen level integra-
tion with and into foreign TMN systems and remote operator access are supported. All
state-of-the-art TMN systems are based on the client-server architecture and work in
distributed environments.
The RC software architecture has been designed according to the standards and rec-
ommendations established by the OSF (open software foundation) in order that the soft-
ware will be as hardware platform-independent as possible.
The software supplied for the components of the RC consists of a software platform
(e.g., operating system SOLARIS®/UNIX®, database product ORACLE®), basic sys-
tem and application software (Fig. 2.24). This application software is adapted to the
needs of a Telecommunication Management Network (TMN). It consists of processes
(in the UNIX sense) for the various requirements of the operation and maintenance ap-
plications, e.g., operator inputs or messages from the network nodes of the BSS.

58 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Operation and maintenance

applications

Communication software

FTAM,
CMISE,
X.25

Database X/Window
management (OSF/Motif)
system
(e.g., UNIX®
ORACLE®)
Utilities

Basic system

Fig. 2.24 Components of RC software

Application software
The application software is divided into:
– basic applications
– applications for the OMS
– applications for the BSS and
– mediation functions (MF).
• Basic applications
The basic applications include:
– Security management (access protection mechanisms)
– Graphical user interface
– Online help system
– Time synchronization in RC
– Command logging
– Computer and database structure
– Use of a more comfortable Windows manager
(common desktop environment (CDE))
– Printer interfaces
– OMC management/configuration
– Connection possibilities of the OMT.
• OMS applications
OMS applications include:
– Configuration management (CM)
– Fault management (FM)

A50016-D1111-V12-2-7618 59
System Description D900/D1800 Information
GPRS PLMN System

• BSS applications
BSS applications include
– Configuration management (CM)
which contains the management of the network resources (e.g., radio channels)
– Fault management (FM)
which contains the measures necessary to detect and remove faults
– Performance management (PM)
which contains the supervision and evaluation of the traffic load and the perfor-
mance of the BSS network
– Software management (SWM)
which contains the management and control of the software and the databases
of the BSS
– BSS manual on OMT
– Graphical user interface (GUI).
The basis of the RC application is a hierarchy of geographical maps, functional pan-
els and rack layouts on which the current status of all “managed objects” is dis-
played. Further, this offers the possibility of approaching every fault management,
configuration management or software management application with as much user
guidance as possible.
• Mediation functions (MF)
The mediation functions (MF) convert the Q3 interface (TMN) between OS network
components (e.g., a Network Management Center (NMC)) and RC into the Qx inter-
face between the RC and the BSS network elements. Owing to the mediation func-
tions, the OS has access to the necessary data of the network elements or network
nodes of the BSS.
There is, for example, a mediation function for fault management (dialog of alarm
messages between the BSS network elements and the OS).

60 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

3 GPRS PLMN Subsystem Functions

3.1 Functions of the GSS

The General Packet Radio Service (GPRS) functionality of the GSS is described below
in terms of the individual functions of GPRS GSS network elements (GGSN/IPS and
SGSN).
Additional functions, such as accounting and interception, are described in section 4.

3.1.1 Functions of SGSN/SLR Network Element

The SGSN registers all GPRS mobile subscribers located in its service area. As long as
a GPRS mobile subscriber is present, the SGSN/SLR contains all the parameters of the
GPRS mobile subscriber required by the packet session functions.

Mobility management
The packet-switched services include addressing and identification to allow a packet-
switched service setup. The international mobile subscriber identity (IMSI) is used as an
access key at the user interface.
The GPRS-MS is authenticated during the GPRS attach procedure. The HLR is in-
formed about the new location of the GPRS-MS. The subscription data will be retrieved
from the HLR. The temporary logical link identity (TLLI) is assigned by the mobility man-
agement. This function is always the first action of the GPRS-MS because without
GPRS attach the GPRS-MS is not known in the SGSN. In case of an attach procedure,
the SGSN/SLR informs the MSC/VLR via the Gs interface (if available). When the
GPRS-MS moves to another SGSN, the routing area update procedure is initiated by
the GPRS-MS, but then the GPRS-MS is known in the old SGSN.
The routing area update procedure is initiated by the GPRS-MS via the SGSN if the
GPRS-MS changes the routing area. The procedure determines the routing area of the
GPRS mobile subscriber (SGSN address of previous 2G-SGSN derived from old routing
area) for the HLR and the authentication parameters of the GPRS mobile subscriber for
the SGSN concerned.
As in the case of non-GPRS operation, paging is necessary for packet data routing in
the downlink direction if the exact radio cell where the GPRS-MS camps is not known.
There is also the possibility of a so-called combined mobility management. In this case,
the SGSN handles the routing area update procedure and informs the MSC/VLR via the
Gs interface during routing area update about the location data of the combined
GPRS/GSM-MS.

Location services
A mobile terminating location service request is handled in same way as via circuit-
switched connections but without the need to suspend packet connections. Therefore
the location service capability is provided by the SGSN/SLR to transfer location requests
between the Gateway Mobile Location Centre (GMLC) and the Serving Mobile Location
Centre (SMLC). The Lg interface is introduced for the connection between Gateway Mo-
bile Location Centre and SGSN.

A50016-D1111-V12-2-7618 61
System Description D900/D1800 Information
GPRS PLMN System

Radio access security and user authentication management

The GPRS authentication for a GPRS mobile subscriber is performed in a similar way
to the authentication for the GSM subscriber, but is carried out by the SGSN.
GPRS authentication is activated in conjunction with a routing area update if the GPRS
mobile subscriber exceeds the limit of the SGSN or during a GPRS attach procedure.
For this purpose, the new SGSN requests the unused triplets from the previous SGSN
(each triplet consisting of the random number for authentication (RAND), the signed re-
sponse (SRES) and the cipher key (Kc)). These triplets are used by the new SGSN for
GPRS authentication. The new SGSN can request a new set of triplets from the AC via
the HLR if the value falls below a minimum number in the SGSN. An authentication re-
quest message sent by the SGSN causes the GPRS-MS to respond. The SGSN com-
pares the value of the signed response (SRES) transmitted by the MS with the value
stored in its data record. If these values match, authentication is successfully concluded.
If authentication is not successful, an entry can be made in the security file.
The confidentiality of GPRS packet data on the GSM radio interface function protects
the confidentiality of user information on GSM radio interface traffic channels by GPRS
ciphering of the GPRS packet data on the GSM radio interface. This GPRS ciphering of
the GPRS packet data information extends only from the GPRS-MS to the SGSN path
and not to the entire packet session distance. The end-to-end protection of user data is
the responsibility of the user.
The implementation of confidentiality of GPRS mobile subscriber identity prevents an
outsider from identifying a GPRS mobile subscriber and establishing his location by
monitoring the signals on the radio path. For this purpose, the SGSN creates a TLLI and
P-TMSI appropriate to the IMSI which is SGSN-specific and is output over the radio in-
terface.

Session management
Session management (SM) provides the functionality required for the handling of packet
data protocol (PDP) contexts in single SGSN node or GGSN/IPS node. SM covers the
activation, modification and deactivation of PDP contexts.
Each GPRS-MS is able to use subscribed PDP contexts. For each subscribed PDP con-
text, a data set is available in the HLR and if the GPRS-MS is attached in the SGSN. To
activate such a PDP context, the GPRS-MS uses the activation procedure covered by
the SM. During activation an association is generated between the GPRS-MS and the
PDN via the SGSN and GGSN/IPS. Packet data transfer is possible for an active PDP
context.
The SM function is split over the SGSN and the GGSN/IPS. SM provides or triggers the
provision of all information necessary for transferring packet data units (PDUs) for an
active PDP context between a GPRS-MS and a PDN.
The SM in SGSN handles only the active contexts. For each attached subscriber, all
subscribed PDP contexts are available in the SGSN, irrespective of the state of the PDP.

Resource management
Resource management (RM) provides the functionality required to perform admission
control with respect to the QoS profile and evaluates the extent to which subscriber re-
quests can be granted. It defines procedures to calculate which user data transport re-
sources are required to support the requested QoS parameters, procedures to

62 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

determine whether these resources are available and procedures to reserve these re-
sources.

Packet handling (also called packet dispatching (PD))

Packet handling contains all the functions necessary for the routing and transfer of pack-
et data units (PDUs) via the SGSN and the GGSN/IPS. In contrast to circuit-switched
networks, where no more routing action is necessary after a connection has been es-
tablished, the GPRS backbone has to route each user data packet to its destination sep-
arately for data transfer. The packet data units (PDUs) are tunneled and moved through
the system transparently. This is done via several protocols such as BSSGP, LLC, SND-
CP, GTP/GTP-U (and IP) which form the transmission system together with a relay func-
tion.
The GSM radio interface represents the bottleneck in GPRS communication between
the Internet (ISP) and the GPRS-MS. In the downlink direction there is a flow control at
the SGSN which prevents congestion in the BSS (PCU).

SMS handling
An SMS transmission via SGSN, i.e. over GPRS radio channels, is more radio-efficient
than via MSC, i.e. over circuit-switched connections. Therefore, the SMS capability is
provided by the SGSN to transfer short messages between GPRS/GSM-MS and short
message service center (SMSC). The Gd interface is introduced for the connection be-
tween SGSN and the SMS-GMSC. The SGSN provides both short message service
mobile originated (SMS MO) and short message service mobile-terminated (SMS MT).

Database
The SGSN/SLR network element maintains a database which contains data records
similar to the database in the MSC/VLR network element. This database contains a mo-
bility management (MM) context for each attached GPRS-MS. Each MM context con-
tains zero or more activated PDP contexts. The SGSN obtains the subscriber profile and
the subscribed PDP contexts from the HLR. These subscribed PDP contexts are stored
in the SGSN. If PDP contexts are deactivated, the MM context contains zero PDP con-
texts. If PDP contexts are activated then the MM context contains more PDP contexts.
This database, which is also called the SGSN location register (SLR), is therefore a tem-
porary store of subscriber data delivered by the HLR, and GPRS mobility data used by
the mobility management and the session management. Because of the temporary na-
ture of subscriber data and dynamic requirements, the database is located in transient
memory.
The database contains coordination methods for handling asynchronous parallel access
to the same subscriber records.
The following information is also available:
– GPRS mobile subscriber identity
– Subscribed packed data protocol (PDP type) and address (PDP address)
– Network layer access point identifier (NSAPI)
The NSAPI points to the associated routing context of the GPRS mobile subscriber.

Accounting
The SGSN collects and formats all relevant charging data. The data is compiled in data
records and evaluated in an Administration and Billing Center (ABC). The Charging
Gateway Functionality (CGF) performs the interface to the ABC.

A50016-D1111-V12-2-7618 63
System Description D900/D1800 Information
GPRS PLMN System

Two types of CGF may be installed:

– distributed CGF: the CGF is located within the network elements. The charging data
of the SGSN is stored on a local disk.
– centralized CGF: the tickets are sent via Ga interface to the Charging Gateway (CG),
a separate network element of the GSS.
Charging of Prepaid subscribers can either be done:
– online with CAMEL, or
– offline via Charging Mediation Server

3.1.2 Functions of the GGSN Network Elements

The GGSN is the gateway between the GPRS PLMN and the external packet data net-
work (PDN). It is able to access IP-based networks of several service providers (ISP).
On the other hand, the GGSN forwards the packet data units (PDUs) of the external
packet data protocols to the related SGSN where the destination user resides, by using
the tunneling protocol. Therefore, the GGSN holds a GPRS specific routing table which
is updated by the GPRS mobility management of the SGSN. The information of an
SGSN change is transferred by the GTP-C. The GGSN can assign dynamic packet data
protocol addresses.

Access management (authentication and accounting)

For user authentication by the Internet service provider (ISP), there is also a so-called
non-transparent access to the Internet (RADIUS access) which can be used as ISP au-
thentication. For this, the ISP supports a RADIUS server and the GGSN supports a RA-
DIUS client which checks the user-ID and password.
The ISP authentication is additional to the GPRS authentication procedure.

DHCP support for GGSN

The dynamic host configuration protocol (DHCP) is used for the configuration of remote
dial-in clients. To implement the DHCP functionality for remote dial-in clients without in-
tegrated DHCP client, a DHCP proxy client is used in the GGSN.

Session management
Session management (SM) provides the functionality required for handling packet data
protocol (PDP) contexts in the SGSN node or the GGSN node. SM covers the activation,
modification and deactivation of PDP contexts.
A context is only provided in the GGSN for active PDPs. The GGSN assigns temporary
PDP addresses itself or gets them from the DHCP server or RADIUS server of the In-
ternet service provider (ISP) if no static PDP address is assigned to the PDP.

Packet handling (also called packet dispatching (PD))

Packet handling contains all the functions necessary for the routing and transfer of pack-
et data units via the SGSN and the GGSN. In contrast to circuit-switched networks,
where no more routing action is necessary after a connection has been established, the
GPRS backbone has to route each user data packet to its destination separately for data
transfer. The packet data units (PDUs) are tunneled and moved through the system
transparently. This is done by a number of protocols such as GTP, GTP-U and IP which
form the transmission system, together with a relay function.
From the outside, the GPRS network will look like any other IP network or subnetwork.
In IP networks, the interworking with sub-networks is done via IP routers. The GGSN is

64 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

seen as a normal IP router from the external IP network. Therefore the GGSN basically
has a routing functionality. The current software version can only interwork with the IPv4
network. One or more ISP networks can be connected to the GGSN.
The following PDP types are possible for packet transfer:
– IPv4
– Point-to-point protocol (PPP) (and termination at the GGSN)
– Point-to-point protocol (PPP) (with L2TP encapsulation)

Database
The GGSN maintains a data record for each activated PDP context.
The following information is also available:
– GPRS mobile subscriber identity
– Registered packed data protocol (PDP type) and address (PDP address)
– IP address of the SGSN where the GPRS-MS camps and the corresponding tunnel
endpoint identifier (TEID)
– Negotiated quality of service (QoS)
– Access point name (APN)

Accounting
The GGSN performs the collection and formatting of all relevant charging data. The data
is compiled in data records and evaluated in an Administration and Billing Center (ABC).
The Charging Gateway Functionality (CGF) performs the interface to the ABC.
Two types of CGF may be installed:
– Distributed CGF: the CGF is located within the network elements. The charging data
of the GGSN is stored on local charging gateway (L-CG).
– Centralized CGF: the tickets are sent via Ga interface to the Charging Gateway (CG),
a separate network element.

Support of Go interface to IMS

The IP Multimedia Subsystem (IMS) allows control of mobile user sessions on the ap-
plication level. IMS connects to the GGSN accross the Gi interface. In order to allow IMS
to apply control functions on mobile user sessions, e.g., an increase or decrease of
bandwidth, the Go interface between IMS and GGSN has been standardized within
3GPP Release 5.
This feature is supported with an enhanced software release of CISCO based GGSN.
i The Go interface provides full QoS control of the packet-switched domain. It conveys
message enabling the Policy Decision Function (PDF) to apply policy (i.e., QoS) to the
bearer usage in the GGSN. Common open policy service (COPS) as protocol is used.
The IMS components Call Session Control Function (CSCF) or Policy Decision Func-
tion (PDF) are implemented according to 3GPP Rel5 and the CISCO based GGSN is
implemented according to 3GPP Rel99/Rel4.

A50016-D1111-V12-2-7618 65
System Description D900/D1800 Information
GPRS PLMN System

3.1.2.1 Functions of the Intelligent Packet Solution (IPS) Network Elements

As described in section 2.1.3 IPS consists of the following core elements:
– Gateway GPRS Support Node (GGSN)
– Content services gateway (CSG)
– Service selection gateway (SSG)
There are two deployment methods: enhanced GGSN (eGGSN) and Gi Node (consists
only of CSG and SSG).
The IPS enables following PLMN operator benefits:
• Roll-out of attractive applications
The IPS-3300 is designed to support the rollout of attractive applications and servic-
es with transparent, value-based tariff.
• IP flow based charging
The IPS-3300 allows the PLMN operator to charge based on IP data flows. With to-
day’s network elements charging is APN based. This allows PLMN operator to pro-
ceed from pure bit pipes towards service providers, with the opportunity to
distinguish and charge between own and foreign services.
The IPS combines access features with intelligent routing and packet-inspection capa-
bilities. These enable PLMN operators to offer such highly interesting features as differ-
entiated charging, by analyzing the layer 3 to 7 protocols and the content, as well as the
access over access point names (APN) to a wide range of selected on-net and off-net
services.

Traffic analyser
The Content Service Gateway (CSG) performs statefull session control “per flow” and
“per user” for layer 3-7 called “shallow” (bearer level) and “deep” (application level)
packet inspection. It deploys online (real-time, quota based) and offline (CDR based)
charging mechanisms for volume and/or time as well as hot billing. It supports Advice-
of-Charge and for low credit balances redirection to top-up applications.

Intelligent routing
The Service Selection Gateway (SSG) performs session control “per flow” and “per us-
er” for layer 3 access control. Layer 2/3 switching and routing is mainly deployed for cor-
porate data access.

Access control
The 3GPP-compliant GGSN service module performs access and session control per
primary and secondary PDP context. It represents the QoS enforcement point and is
compliant to the 3GPP IP Multimedia Subsystem (IMS).

Local charging gateway (L-GW)

The local charging gateway (L-CG) offers the secure storage of charging detail records
(CDRs) on non-volatile discs. The GTP’ interface is used for CSG. CSG supports “type
length vector (TLV) to standardized ASN.1 format conversion” and the file transfer to-
wards the billing system via FTP. It provides the Ga interface, optionally compression of
the output file and the suppression of CDRs.
The Ga interface is only offered as CDR input interface towards the GGSN blades in the
IPS-3300. The only CDR output interface is via FTP towards a downstream system such
as a central CG or mediation device.

66 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The main functions of the IPS-3300 core elements are listed here according to the net-
work elements:

Gateway GPRS support node (GGSN)

The functions given here, are the functions which, in addition to the standard backbone
functions, are necessary for IPS-3300.
– Session control by managing PDP contexts (PDP context management)
– QoS management (enforcement)
– Bearer management
– IMS complient (via Go interface, with the enhanced software release)

Content service gateway (CSG)

For IPS-3300, the CSG performs the following traffic analyzer functions.
– Session control per flow and per user for layers 3 to 7
– Shallow (bearer level) and deep (application level) packet inspection
– Online (real-time quota-based) and offline (CDR-based) charging mechanisms
– Volume- and/or time- or event-based charging (hot billing) support
– Redirection for advice-of-charge and for top-up applications

Service selection gateway (SSG)

For IPS-3300, the SSG performs the following intelligent routing functions.
– Session control per flow and per user for layer 3
– Access control (user authentication, personalized access control lists)
– Layer 2 and 3 switching and routing
– Corporate data access (VPN) using e.g., L2TP tunneling

3.2 Functions of the SSS Network Elements (for GPRS PLMN)

HLR network element
The HLR network element stores all the subscriber data necessary for a GPRS-MS to
invoke GPRS services. The “update GPRS location request” received from a SGSN is
handled by the HLR in a way similar to a location update request from a MSC/VLR. How-
ever, the GPRS subscription data is downloaded to the SGSN.
Database:
The HLR holds the GPRS mobile subscriber profile which is used for the GPRS sub-
scription check and activation procedure.
The following GPRS data is also stored:
– PDP identifier (PDP ID) which identifies the PDP context per GPRS mobile subscrib-
er in the HLR (and SGSN)
– Permitted packed data protocol (PDP type)
– Packet data address (PDP address) or an indication that a dynamically assigned ad-
dress can be used
– Subscribed quality of service (QoS)
– Access point name (APN)
– International mobile subscriber identity (IMSI)
– Mobile subscriber identity number (MSISDN).
Each PDP subscription is seen as a basic telecommunications service.

A50016-D1111-V12-2-7618 67
System Description D900/D1800 Information
GPRS PLMN System

AC network element
The AC network element is responsible for generating and storing of authentication/ci-
phering triplets on a mobile subscriber basis.

MSC/VLR network element

The MS may require a combined attach request, combined routing area/location area
update and combined detach request in a PLMN which supports the Gs interface.
In this case, the SGSN triggers the VLR network element for the MS request to start the
respective mobility functions.
Furthermore, the SGSN is able to handle a circuit-switched page request received from
VLR. The circuit-switched paging function of the SGSN for GPRS is necessary for class-
B mobiles which are not able to operate simultaneously in the circuit-switched domain
and in the packet-switched domain.

EIR network element

The current software version doesn’t support an IMEI check because the Gf interface
i between SGSN and EIR is not implemented.

3.3 GPRS PLMN Functions of the BSS

The functionality of the BSS for a GPRS PLMN is described below in terms of individual
functions of the BSS network elements (BSC and BTS).

3.3.1 Functions of the BSC and BTS (for GPRS PLMN)

Packet session functions
The packet session functions for the packet data channel comprise:
– Physical packet data channel (PDCH)
– Use of the packet data channel (PDCH)
– Logical packet channels
– Radio resource management principles
– Radio link control and medium access control (RLC/MAC)
– Automatic “horizontal” allocation
– Packet transfer on non-broadcast control channel (BCCH) transceivers
– Support of all four channel coding schemes (CS-1 to CS-4)
– Dynamic Abis resource allocation
– Link adaptation
– Network controlled radio cell reselection
– GPRS/EGPRS-MS / Gb flow control
– Multiplexing of GPRS and EGPRS users on the same timeslot
– GPRS and EGPRS quality of service

• Physical packet data channel (PDCH)

The physical channel structure, such as the one for non-GPRS operation, is used for
GPRS purposes. This means that carrier frequencies, modulation and transmit-
ter/receiver characteristics do not differ from non-GPRS operation.
However, the physical link layer for GPRS is different from that for non-GPRS oper-
ation. The transfer unit via the GSM radio interface is one radio block which spans

68 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

four TDMA frames. GPRS uses a rectangular interleaving of the radio block over four
consecutive TDMA frames.
• Use of the physical packet data channel (PDCH)
Unlike the circuit-switched services, one physical channel and therefore one physi-
cal packet data channel (PDCH) can be used by more than one GPRS-MS at the
same time. The assignment of a physical packet data channel (PDCH) to a particular
GPRS-MS is done per radio block and not for a specific period of time, i.e. the sig-
naling and packet traffic of more than one GPRS-MSs are statistically multiplexed
into one physical packet data channel (PDCH). Furthermore, it is possible to assign
the physical packet data channel (PDCH) asymmetrically. On the other hand, one
GPRS-MS is able to use more than one physical packet data channel (PDCH) simul-
taneously.
• Logical packet channels
As in non-GPRS operation, GPRS defines different logical channels: The packet
common control channel (PCCCH) which comprises the packet random access
channel (PRACH), the packet paging channel (PPCH), the packet access grand
channel (PAGCH) and the packet notification channel (PNCH), the packet broadcast
control channel (PBCCH), the packet traffic channel (PTCH) which comprises the
packet data traffic channel and the packet-associated control channel (PACCH).
As mentioned above, the data unit which is transferred over the GSM radio interface
is the so-called radio block. In most cases, the radio block consists of a radio link
control (RLC) block. The RLC block is the universal container which carries all kinds
of packet channel data. It is therefore possible to map different logical packet chan-
nels within one physical packet data channel (PDCH). The distinction is undertaken
on a per-block basis for different kinds of RLC blocks, i.e. there is one physical pack-
et data channel (PDCH) which can contain all logical packet data channels. If no PC-
CCH is established within a certain radio cell it is possible to use the non-GPRS
CCCH for that purpose.
• Radio resource management principles
The physical radio resources are shared by GPRS and non-GPRS operation. It is
possible to allocate GPRS resources on demand or permanently by administration.
The CCCH is used if no PCCCH is established within a certain radio cell. This
means that no dedicated GPRS resource needed to support GPRS. A packet traffic
channel must only be allocated if at least one GPRS-MS transfers packet data. The
physical channel is available for circuit-switched purposes in other cases. This meth-
od is applicable for a scenario with low packet traffic. Because a packet transmission
is very short (a few seconds) the temporary allocation of a packet traffic channel
(PTCH) does not necessarily decrease the blocking probability within the radio cell.
If GPRS use increases, dedicated GPRS resources (i.e. packet data channels
(PDCH)) should be allocated permanently so that it can carry the PCCCH too. This
may decrease the load of the CCCH and the PCH.
• Radio link control and medium access control (RLC/MAC)
The radio link control and medium access control uses the RLC protocol which
transfers the necessary information. One task of the RLC protocol is the assignment
of the packet data channel (PDCH) to a GPRS-MS (MAC). The corresponding RLC
blocks form the control channel. The other task of the RLC is the reliable transfer of
packet data between the GPRS-MS and PCU (RLC). Therefore, a mechanism for
the recovery of transmission errors is defined. In addition, the RLC provides means
of multiplexing the traffic of multiple users on one packet data channel (PDCH).

A50016-D1111-V12-2-7618 69
System Description D900/D1800 Information
GPRS PLMN System

• Automatic “horizontal” allocation

Up to now, GPRS-MS allocations were made using a “vertical” allocation strategy on
a radio cell basis and dependent on the special parameter's value for the maximum
number of GPRS-MSs per PDCH (e.g., UL 1-7, DL 1-16), which resulted in a con-
centration of traffic in mainly one timeslot of a single carrier. This GPRS-BSC auto-
matic “horizontal” allocation feature introduces a mobile allocation strategy based on
the “cell/carrier load” that ensures that mobile packet-switched data transfers are
distributed “uniformly” among all of the “available” carriers and PDCHs when no car-
rier congestion exists. This is applicable in a GPRS context (packet-switched data
transfers) with “best effort” treatment of mobile-originated (UL direction) or mobile-
terminated (DL direction) “transactions”.
This feature introduces a PLMN operator-controlled allocation option, which ensures
the best possible throughput per user, while making optimum use of existing re-
sources and reducing real-time processing needs.
• Packet transfer on non-broadcast control channel (BCCH) transceivers
This feature has been introduced to extend the use of the GPRS service to non-
BCCH TRXs and enables the customer to use a larger number of the channels for
GPRS data transmission and ensures a more even distribution of the TRX alloca-
tions. The customer-oriented configuration basis of this feature allows those TRXs
offering the best signal quality without interference to be used. The choice of the in-
volved TRXs is determined by the PLMN operator. The non-BCCH TRXs reserved
in this manner for GPRS service belong to the complete radio cell, which means that
in the case of concentric radio cells/dual bands, the TRX belongs to the complete
area.
Considering that the BCCH TRX is still the preferred TRX for GPRS service, this fea-
ture offers the following options:
– When no BCCH TRX channels are available for new GPRS calls, a non-BCCH
TRX can be used for that purpose.
– All of the non-BCCH TRXs configured for this feature have the same priority, i.e.
the BSC (TDPC) checks to find out which one of them can be used.
– When the BCCH TRX is occupied, the TDPC makes a check to find a channel for
the allocation of a certain GPRS-MS on another TRX. This check is strictly de-
pendent on the strategy adopted in the above-described feature “automatic hori-
zontal allocation” and involves a new non-BCCH TRX.
– If the initial TRX is already fully occupied by other GPRS sessions, a second non-
BCCH TRX will be checked until a non-BCCH TRX can be found to accommodate
the new GPRS session.
• Support of all four channel coding schemes (CS-1 to CS-4)
Four channel coding schemes (CS-1 to CS-4) are specified for the General Packet
Radio Service (GPRS), whereby the coding schemes CS-1 and CS-2 have already
been introduced within a previous software version. The support of the new coding
schemes CS-3 and CS-4 allows higher throughputs of up to 21.4 kbit/s per channel
to be achieved in good radio conditions.
The following gross data rates according to the selected coding scheme can be
achieved by the different coding schemes depending on C/I.
– 9.2 kbit/s (CS-1)
– 13.2 kbit/s (CS-2)
– 15.6 kbit/s (CS-3)

70 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– 21.2 kbit/s (CS-4)

The optimized data throughput is achieved via LA (link adaptation), which selects the
appropriate coding scheme, depending on the air conditions.
The coding schemes CS-3 and CS-4 optimize the use of the radio resources by pro-
viding high data rates for GPRS. This feature is a step forward for completion of the
GPRS functionality and it significantly helps to improve the end user's QoS.
As already mentioned before, the different data rates are related to the different cod-
ing schemes, in relation to the radio conditions, i.e. the ratio of C/I.
The radio blocks on the Abis interface are transferred using PCU frames. Two kinds
of PCU frame formats are available:
– Concatenated PCU frames (used when CS-3/CS-4 is enabled)
– Standard PCU frames (used when CS-3/CS-4 is disabled)
For the transfer of GPRS data, related to CS-3/CS-4, one Abis timeslot (16kbit/s) is
not sufficient; two slots (32 kbit/s) are necessary. This correlates to two concatenat-
ed PCU frames.

Scheme Radio Block Size in Bits for N Concatenated PCU Frames

DL/UL
CS-1 184 1 (max. 216 payload bits)
CS-2 271 2 (max. 488 payload bits)
CS-3 315 2 (max. 488 payload bits)
CS-4 431 2 (max. 488 payload bits)

The table above shows that CS-1 and CS-2 can be supported using both standard
and concatenated PCU frames. Due to the higher header size (more in-band signal-
ing overhead) in the first subframe, concatenated PCU frames require 2 subframes
to be allocated for CS-2. The table also shows that the standard PCU frame capacity
is not enough for radio blocks, which are coded with CS-3 or CS-4. Consequently,
concatenated PCU frames are always required when using CS-3/CS-4.
The PLMN operator can configure the selected PCU frame format. If the PLMN op-
erator enables the support of CS-3/CS-4, concatenated PCU frames are used by the
system.
• Dynamic Abis resource allocation
The high data rates enabled by the 8-PSK modulation for EGPRS (see section 3.3.2)
and the introduction of the additional high coding schemes (CS-3 and CS-4) for
GPRS require an enhanced Abis capacity of up to 5x16 kbit/s. The strategy applied
in the previous software versions is fixed Abis configuration, which is no longer suffi-
cient or efficient because it requires an Abis configuration according to the highest
possible data rates. Therefore, static allocation would waste Abis resources. Conse-
quently, a new strategy is applied in order to allocate the Abis resources in a flexible
and efficient way.
Dynamic Abis resource allocation is applied both to packet-switched services and cir-
cuit-switched services. According to the service applied, the appropriate number of
Abis resources is dynamically allocated. Because the capacity of each GSM radio
interface timeslot can vary during runtime, the dynamic Abis allocation adjusts the
Abis capacity to the required GSM radio interface capacity.
The introduction of the dynamic Abis allocation through optimized sharing of Abis re-
sources saves Abis capacity. If less capacity is needed on one radio channel, more
Abis capacity will be available for other radio channels. Dynamic Abis allocation can

A50016-D1111-V12-2-7618 71
System Description D900/D1800 Information
GPRS PLMN System

also be applied for circuit-switched services. This means that additional statistical
capacity can be gained.
The dynamic Abis allocation strategy is based on Abis pools and appropriate Abis
subpools, which can be configured per base-station site using O&M procedures.
The pool concept no longer assigns a fixed relation between the GSM radio interface
and the appropriate Abis lines (e.g., one to two 2*16kbit/s Abis subslots). An Abis pool
is the amount of 16 kbit/s subslots, which is defined per base-station site. Abis sub-
slots are selected from the pool and allocated to radio channels at channel activa-
tion. An Abis pool is composed of one or several subpools. Each subpool belongs to
a single PCM line, routed together with one associated LAPD link to manage a cor-
rect fault propagation from the LAPD link to the Abis resources.
Abis pools and Abis subpools have the following properties and relations:
– Different Abis subpools, belonging to the same or different Abis pools can be de-
fined on the same PCM line.
– Subpools can be distributed over all PCM lines belonging to a base-station site
(at least one subpool per line).
– The Abis subslots allocated to a radio channel can be distributed over different
subpools and consequently over different PCM lines. The subslots do not have to
adjacent.
– Overlapping of pools and subpools is not permissible.
With the common pool concept, any radio timeslot is dynamically associated to an
appropriate number of Abis resources from the Abis pool.
• Link adaptation
To optimize the given radio link quality at the GSM radio interface, the coding
scheme for transmitting the radio link control (RLC) blocks is dynamically selected
and changed. This is referred to as “link adaptation”. When using General Packet
Radio Service (GPRS), up to four different coding schemes (CS-1 to CS-4) are de-
fined. Nine different modulation and coding schemes (MCS-1 to MCS-9) are provid-
ed for the Enhanced General Packet Radio Service (EGPRS) radio blocks. All those
coding schemes differ in data rate and robustness according to fading and interfer-
ence. Some modulation and coding schemes produce a satisfactory performance
even when used in poor radio conditions, whereas others only manage the high data
throughput in a good radio environment. For example, modulation and coding
schemes available for the EGPRS allow a data throughput of 8.8 kbit/s up to 69.2
kbit/s. Link adaptation is fully automated by the system, which evaluates the block
error rate (BLER) of the radio link control (RLC) data blocks.
At any radio link quality that may occur at any moment, the fully automated proce-
dures select the best modalities by applying link adaptation to find out the best pos-
sible coding schemes for optimum throughput. The fully automated link adaptation
does not require any additional planning. Fine-tuning may be useful, especially if
specific environmental conditions occur. Without link adaptation, the high data rates
provided by the higher coding schemes cannot be exploited because this would
mean using fixed O&M configured coding schemes, which cannot vary during runt-
ime. Consequently, high data rates and 3G-like services would not be supported.
• Network controlled radio cell reselection
In the event of traffic congestion within one radio cell, the network controlled radio
cell reselection is applied for GPRS and EGPRS in order to distribute the load by
transferring some traffic to the neighboring radio cells. Based on radio cell traffic
thresholds, the traffic is distributed among the radio cells belonging to the same
packet control unit (PCU) within the appropriate BSC. The BSS updates the internal

72 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

references that indicate the location of the GPRS-MS, and related information is
sent to the serving GPRS support nodes (SGSN) involved.
Redistributing the GPRS/EGPRS-MSs among their radio cells and their neighboring
radio cells ensures optimum use of the available network resources with the inten-
tion of meeting the requested QoS. Therefore, optimal usage of all available network
resources is provided because network-controlled radio cell reselection avoids con-
gestion and waste of resources when capacity is available in neighboring radio cells.
The PLMN operator is guaranteed the best revenue. This feature can be configured
by the PLMN operator on a radio cell by radio cell basis. A set of parameters triggers
the radio cell reselection and regulates acceptance of GPRS/EGPRS-MSs by other
radio cells.
• GPRS/EGPRS-MS / Gb flow control
This feature controls the GPRS/EGPRS data traffic from SGSN to the BSC via the
Gb interface and the flow from the BSC over the GSM radio interface to the
GPRS/EGPRS-MSs. The data traffic from SGSN to the BSC may depend on the
load of the internet traffic, whereas the flow on the GSM radio interface is deter-
mined by C/I conditions and consequently on the selected coding scheme. The
packet control unit (PCU) of the Base Station Controller (BSC) is involved in order
to cooperate. The SGSN receives continuous information from the PCU (BSC) and
transfers data at a rate that is assumed to be properly received by the PCU (BSC).
The calculations of the PCU (BSC) are refined in such a way that the data flow is
observed both per radio cell and per GPRS/EGPRS-MS. Each GPRS/EGPRS-MS
is assigned to its own transfer bucket. Consequently, the flow control provides steady
GPRS/EGPRS data traffic and reduces transmission delays for the user.
Without this feature, the flow control is radio cell specific and does not allow for indi-
vidual flow rates of specific MS. This may effect all other MSs, which are allocated
within the radio cell. MS/Gb flow control is based on a cascaded MS and radio cell
oriented flow control scheme. The mechanism first operates at MS level and calcu-
lates the flow rate for each MS within the same radio cell. The second level regulates
the radio cell specific Gb data flow.
• Multiplexing of GPRS and EGPRS users on the same timeslot
MSs using GPRS and MSs using EGPRS in the same radio cell can be multiplexed
on the same packet data channel (PDCH). Each MS (GPRS as well as EGPRS) de-
codes the uplink state flag (USF). The network uses Gaussian minimum shift keying
(GMSK) modulation when coding the respective uplink state flag (USF), i.e., either
CS-1 to CS-4 or MCS-1 to MCS-4 in those blocks that assign a next uplink radio
block to one MS capable of GMSK. The other blocks use the 8-phase shift keying
(8PSK) modulation. Thus, the customer is no longer forced to use separated packet
data channels for GPRS and EGPRS. This saves network resources.
• GPRS and EGPRS quality of service
The optimal exploit of network resources in order to give each MS exactly those re-
sources, which it needs to have enough resources available for other MSs, is fo-
cused on this feature. In the event of scarce resources, service priorities, which can
be defined by the PLMN operator, are used to give priority to important services, es-
pecially in congestion situations.
Within previous software versions, SIEMENS has introduced features, which im-
prove the system QoS:
– Service dependent channel allocation, step 1
– Automatic horizontal allocation
– GPRS on non-BCCH

A50016-D1111-V12-2-7618 73
System Description D900/D1800 Information
GPRS PLMN System

Within the current software version, the improved resource manager provides an op-
timized strategy for the allocation of resources and a new scheduler handles fair al-
location of these resources according to the service priorities defined by the SGSN.
QoS for GPRS and EGPRS deals with:
– Taking into account EDGE-capable MSs
– Radio resource allocation based on peak throughput requirements
– Scheduler enhancement for the prioritization of temporary block flows (TBF: ac-
tive data flows) in multiplexing condition according to their service precedence
and radio priority attributes
– Upgrading of radio resources assigned to an MS in specific situations, e.g., pre-
vious preemption by circuit-switched services, deterioration of radio condition,
downgraded-assignment of a TBF, as well as restarting of a TBF during delayed
release periods in requesting a higher peak throughput
The system follows the rule of throughput maximization and tries to allocate a suit-
able number of resources to each new TBF. However, when resources are becoming
scarce, the system cannot always guarantee the best solution. In this case, TBFs
are multiplexed and prioritized according to their required QoS.
The feature redesigns the existing radio resource manager and the scheduler. The
goal is to give an MS the resources it currently needs, yet no more, in order to have
enough resources available for other MSs. This helps to delay the multiplexing of
TBFs on the same timeslots and to avoid preemption of resources for circuit-
switched traffic. Changes of throughput requirements handled during upgrading pro-
cedures. The scheduler grants access to the radio resources according to the
scheduling priorities of the different TBFs.
The modified radio resource allocation algorithm manages the presence of EDGE-
capable MSs and transceivers (TRX). The algorithm maximizes the throughput ac-
cording to the defined O&M parameters and minimizes the number of allocated radio
resources. The system gives EDGE-capable mobile stations precedence in the use
of EDGE-capable transceivers (TRX).
Compared to previous releases, higher data rates can be achieved via a lower num-
ber of radio resources. The system separates the TBFs in GPRS mode and the
TBFs in EGPRS mode. Hence, the system favors the use of non-EDGE-TRXs by
non-EDGE-capable MSs.
Maximizing throughput is one of the most important criteria in handling radio re-
sources. Feature capabilities are beneficial for the user because they are use to op-
timize resource availability and the perceivable quality of both uplink and downlink
data transfers. Working on operator-defined allocation rules enables network oper-
ators to increase the number of granted service requests. For example, the system
maximizes throughput as long as it is available under normal conditions, but adapts
and manages congestion situations and conditions according to the QoS require-
ments predefined by the PLMN operator.
The scheduler is prepared to provide EGPRS and GPRS MSs the same resources
(carriers). At the same time, it satisfies QoS commitments by using a dynamic radio

74 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

resource sharing strategy among all active TBFs. Multiplexed TBFs on the same re-
sources are served due to operator defined priorities.
The basic BSS functions, which are described in the circuit-switched GSM (see System
i Description D900/D1800, register GSM PLMN), are also valid for GPRS BSS operation.
These functions include:
- Handover
- Frequency hopping
- Antenna diversity

3.3.1.1 Functions of the PCU (in BSC) and CCU (in BTS)
The GPRS features within the BSS are implemented in the following two functional
units:
• PCU (located in the BSC)
The PCU provides resource allocation and protocol conversion between the BTS
and the SGSN. The PCU acts as a statistical multiplexer and router. It receives RLC
packets from the Abis channel related to more than one GPRS-MS and packs them
into BSSGP frames. These BSSGP frames are then routed to the SGSN and vice
versa together with other BSSGP frames coming from other Abis channels.
• CCU (located in the BTS)
The CCU performs channel coding functions and channel measurement functions.

PCU
The PCU is a functional unit within the BSC that acts as a statistical multiplexer and rout-
er (Fig. 3.1). The PCU is responsible for (when looking at the protocol stack):
– Channel access control functions, e.g., access requests and grants
– PDCH scheduling functions for uplink and downlink data transfer
– Radio channel management functions, e.g., power control, congestion control,
broadcast control information, etc.
– PDCH RLC ARQ functions, including buffering and retransmission of RLC blocks
– BSSGP layer PDU segmentation into RLC blocks for downlink transmission
– RLC layer PDU reassembly into BSSGP blocks for the uplink transmission
– BSSGP protocol provides PCU - SGSN communication in terms of the BSSGP vir-
tual connection identifier (BVCI)
– Network service functions provide PCU - SGSN communication in terms of the vir-
tual channel (network service virtual channel (NSVC)).

BSC SGSN
TRAU frames Frame Relay
TRAU frames
TRAU frames PPCU
TRAU frames

Abis Gb
TDPC

Fig. 3.1 PCU as multiplexer and router

A50016-D1111-V12-2-7618 75
System Description D900/D1800 Information
GPRS PLMN System

CCU
The CCU is a software functional unit within the BTS that is responsible for:
– channel coding functions, including forward error correction (FEC) and interleaving
– radio channel measurement functions, including received quality level, received sig-
nal level and information related to timing advance and
– continuous timing advance.

3.3.2 Functions of the BSC and BTS (for GPRS PLMN - explicit with
EDGE/EGPRS)
Definition of Enhanced Data rates for GSM Evolution (EDGE) -
Enhanced General Packet Radio Services (EGPRS)
The current specifications and concept papers issued by the European Telecommuni-
cations Standards Institute (ETSI) GSM 05 series release 99 define 8-phase-shift keying
(PSK), a modulation method that coexists with the conventional modulation used by
GSM.
Enhanced Data rates for GSM Evolution (EDGE) uses 8PSK as a solid basis for the in-
troduction of new services and new business opportunities. This feature, for example,
profits from its speedy transmission rates while exploiting existing GSM radio resources.
The EDGE carrier unit (E-CU) was introduced to ensure that 3G mobile communication
requirements are fulfilled for the support of both GSM and EDGE standards. EDGE
standards cover both Enhanced Circuit Switched Data (ECSD) and Enhanced General
Packet Radio Service (EGPRS) and, although the EDGE platform is open to ECSD in
future releases, this feature deals solely with EGPRS.

Customer Benefits
EDGE is the only system capable of offering 3G services that is not based on a com-
bined GSM/UMTS network. This feature, EGPRS support, enables established GSM
operators to increase packet data rates within their GSM networks and, thus, make an
evolutionary step towards 3rd generation (3G) services.
Using EDGE and EGPRS brings the following advantages:
– Providers don't need to plan expenses for new UMTS frequencies or licenses to be
able to offer 3G services.
– Operators are given a system that enables them to balance traffic and is open to the
evolution of multimedia services.
– Subscribers and providers alike profit from the seamless balance of varying 3G ser-
vice situations, for example, handovers and cell reselections can be easily made be-
tween GPRS, EGPRS, and UMTS services.
The E-CU supporting EDGE is supplied with an automatic plug-in configuration that al-
lows easy upgrades plus the advantages of:
– Using EGPRS and GPRS together with GSM voice and GSM data
– Achieving high radio frequency power output helps to minimize the number of addi-
tional sites required, e.g., for wide-area coverage of rural environments

Traffic balancing between GPRS and UMTS

EGPRS (EDGE) is especially designed to balance the load between GPRS and UMTS.
Thus, GPRS, EGPRS, and UMTS services harmonize with one another to offer custom-
ers seamless switches between the networks.

76 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The GSM system of providers (GSM operators) that hold a UMTS license already cov-
ers a large area. The UMTS system satisfies the demands of urban areas while EGPRS
mainly offers coverage of suburban and rural areas. Although 3G services will continue
to vary, some of the situations they propose make continuous efficient long-term use of
the GSM frequency bands. Therefore, UMTS users are not subject to being stranded on
islands of high data rates and operators are able to provide 3G services nationwide. In
keeping with future needs, providers can adapt and develop their networks towards
UMTS step by step. This applies to most future IP services.
As seen from the point of view of reusing the known GPRS infrastructure, 2G invest-
ments are redeemed, and the cost of introducing 3G services is kept to a minimum. Fast
rollouts of 3G services are the active assets necessary for effective and early availability
of 3G services achieved by seamlessly integrating UMTS, EGPRS, and GPRS. Of
course, this depends on the structure of GSM equipment within the network and the re-
lationship between rural and urban coverage. Therefore, the rollout of services involves
the GPRS infrastructure by exploiting the options to upgrade the system. EDGE carrier
units (E-CU) are being implemented step-by-step, and the relevant software upgrades
are being performed.

Stand-alone-EDGE solution
Providers that don't have a UMTS license can also support 3G services by applying
EDGE. GSM operators can provide and build up a competitive GSM and EDGE Radio
Access Network (GERAN) in order to support their new 3G services at a much lower
cost than by building their own UMTS networks.

3.3.2.1 Functionality
The evolution from GSM to EDGE is performed to support high data rates in all of the
GSM frequency bands established by PLMN providers/operators. This feature supports
EGPRS (not ECSD); the goals of which are as follows:
• The 8PSK modulation principle enhances the radio interface data rates of an exist-
ing GSM carrier frequency. It uses eight symbols, each covering three bits and de-
termining the phase shift applied within one entire wavelength.
• 8PSK modulation is applied to packet data traffic channels (PDTCH). Existing logical
radio interface channels, as well as existing burst and radio block structures are
used.
• Message flow protocols adapted for EGPRS can connect an EDGE-capable GSM-
MS to the GPRS Support Nodes (GSN) and Packet Data Networks (PDN).
• The use of several modulation and coding schemes provides a seamless adaptation
to varying radio interface conditions.
EDGE pinpoints a GSM evolution and offers a new modulation method that provides
higher data rates. While preserving most of the features of the GSM radio interface, e.g.,
200 kHz channeling, TDMA scheme, burst structure, radio cell-planning process, EDGE
introduces the new service of Enhanced GPRS (EGPRS). The key architecture of En-
hanced GPRS (EGPRS) is similar to that of standard GPRS. In comparison with stan-
dard GSM services, EDGE is capable of offering higher data rates without requiring new
frequencies or licenses. The spectrum of efficiency offered by EDGE fills the gap be-
tween GPRS and UMTS. GSM, GPRS, EGPRS, and UMTS can interact via inter-sys-
tem handovers and radio cell reselection.
The advantages of EDGE (EGPRS) are especially suited to accelerating Internet ac-
cess. Customer demands concerning Internet services are continually increasing

A50016-D1111-V12-2-7618 77
System Description D900/D1800 Information
GPRS PLMN System

throughput. Tab. 3.1 shows that EDGE considerably improves the payload per burst
and the gross throughput per timeslot in comparison to GSM.

GSM EDGE

Modulation GMSK 8PSK

Symbol rate 270.833 ks/s 270.833 ks/s

Payload per burst 114 bits 346 bits

Gross throughput per timeslot 21.4 kbit/s 69.2 kbit/s

Tab. 3.1 Comparison of GSM and EDGE data

The evolution from GSM to EDGE is performed in order to support high data rates by
applying 8PSK modulation, whereas GMSK modulation is used as a robust modulation
mode. EDGE is standardized by ETSI and can be applied to the following frequency
bands:
– GSM900
– GSM1800
– GSM850/GSM1900 (for US networks).
This means that EDGE can be used in all those GSM frequency bands without any li-
censing problems for the established GSM network providers and PLMN operators.

Functional split
MS: The GSM mobile station (MS) is capable of 8PSK modulation.
BTS: The E-CU of the BTS plus supports the higher data rates transferred via the radio
interface. The BTS plus handles the respective algorithms for the configuration of the
new hardware equipment (E-CU) and its specific alarms.
BSC: The BSC copes with the high data rates of the high-speed coding schemes (e.g.,
MCS-9) and selects the most suitable coding scheme for the current radio interface con-
ditions. The BSC handles the alarms and EDGE specific state attributes of the BSC, the
BTS, and point-to-point packet transfers (PTPPKF).

3.3.2.2 EGPRS Architecture

The EGPRS architecture includes an EDGE-capable GSM mobile station (MS), which
is connected via the GSM radio interface (Um) to the E-CU that supplies EDGE function-
ality.
Two classes of mobile stations (MS) are provided. One class of MS is able to apply the
8PSK modulation in both the uplink and the downlink directions, which means that they
support advanced facilities and capabilities. The other class applies 8PSK modulation
in the downlink direction and GMSK modulation in the uplink direction.
The BTS is equipped with carrier units denoted as E-CUs that are EDGE-capable or with
standard carrier units usually denoted as G-CUs, GSM-CUs, or simply CUs that do not
supply EDGE.
The packet-switched traffic output from the E-CU in the BTS is transmitted to the packet
control unit (PCU) of the BSC from where it is routed to the GPRS backbone.
The Fig. 3.2 shows the connection between a GPRS-MS and stationary data terminal
equipment (DTE).

78 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

PLMN
Packet
data
EDGE
network
Um Gb Gn
BSS Gi
SGSN/ GGSN/
(BTS(E-CU), SLR IPS
BSC(PCU))
mobile
GPRS-MS
DTE stationary
DTE

Fig. 3.2 Connection between a GPRS-MS and stationary data terminal equipment
(DTE)

3.4 Functions of the OMS for GPRS PLMN

The O&M functions apply to the GPRS PLMN subsystems and thus to the network ele-
ments of the GSS, SSS, BSS and the network components of the OMS (SC and IP Man-
ager and RC) itself. The Switch Commander (SC) and IP Manager are used for GSS
nodes. The Radio Commander (RC) is used for BSS nodes.
To support a regionalized OMS network structure, the centralized operation of what is
known as a national OMC is supported for the RC, in particular.
The basic functions of the SC and IP Manager or RC comprise:
– Access protection mechanism
– User interface
– Online help
– Computer and database structure
– Facilities for interworking the client terminal (CT)/operation and maintenance termi-
nal (OMT) to the SC and IP Manager or RC
– SSS node task tree definitions
– Client terminal (CT)/operation and maintenance terminal (OMT) package
The basic O&M functions in the SC and IP Manager for the GSS nodes include:
– Fault management
– Configuration management
– Accounting (charging and billing) management
– Performance management
– Security management
– Automated delivery of software corrections (Autopach) - as optional application.
The basic O&M functions in the RC for the BSS network elements include:
– Fault management
– Configuration management
– Performance management
– Software management
– BSS manuals on the OMT.

A50016-D1111-V12-2-7618 79
System Description D900/D1800 Information
GPRS PLMN System

General O&M functions which include all D900/D1800 subsystems:

– Overload handling
– Recovery procedure
The function of a national OMC in the area of the OS, in particular for RC, encom-
passes:
– A regional assignment of OMC in an initial level
– In a further level, a national OMC in the area of the OS (with night service/weekend
service configuration).
The O&M mediation functions of the RC with respect to the BSS network elements
include:
– Fault management.

3.4.1 Basic O&M Functions of the Switch Commander (SC) and IP Manag-
er
Fault management
The alarm surveillance application monitors the system status of the individual network
elements according to the ITU-T recommendations Q.821, X.733, and X.734. It displays
clearly the alarm status of the monitored network elements and enables the operator to
take specific maintenance measures. For this purpose, the interactive document brows-
er application can be started from alarm surveillance to start fault clearance in the net-
work element. The alarm messages are displayed according to their alarm priority. It is
possible to view and process all kinds of alarms from one place.
The PLMN operator can retrieve a list of the outstanding alarms by clicking on the relat-
ed alarm indication object to start the respective maintenance actions.
Because at the Q3 (and SNMP) management interface, all management interactions re-
fer to objects, all these alarm sources are represented by instances of object classes
with “alarm notifications” and optionally “alarm attributes”.

Configuration management
Configuration management offers the PLMN operator the functionality that is required to
administer the network resources and the network changes in the GPRS Switching Sub-
system (GSS), and to retrieve status information from the GSS network elements (i.e.
SGSN/SLR, GGSN/IPS, HLR/AC). The TCP/IP-based Q3 (and SNMP) interface and the
related external Q3 object model are both used for the O&M functions that are located
on the GSS network elements.

Accounting (charging and billing) management

Charge-relevant data is generally collected within the service processing GSS network
elements. Therefore, the GSS network elements have a charging data collection func-
tion. The charging data collection function is responsible for preprocessing the collected
data and providing it to the billing system.
This charging function in the GSS network elements can be administered via the Switch
Commander (SC) and IP Manager. Charging data (i.e. ticket) transfer to the charging
gateway (CG) is performed using the charging gateway protocol GTP’ via the Ga inter-
face. However, file transfer to the Administration and Billing Center (ABC) is performed
using the file transfer protocol (FTP) service via TCP/IP over a wide area network
(WAN).

80 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Performance management
Performance management covers a number of operations required to obtain information
that can be used to verify the performance of the physical and logical configuration of
the SSS network elements and to localize potential problems as soon as possible.
All performance measurements are managed fully based on a Q3 standard approach
according to Q.822, X.738, and X.739. The Q3 presentation service is used by the op-
erator to manage the performance measurement-related object instances. The perfor-
mance data collected by the simple scanners is logged in performance measurement
logs at the GSS network element side. The operator can retrieve this data either by us-
ing Q3 requests or by the optional performance data collector (PDC). Postprocessing,
analysis and presentation of measurement results is usually performed by means of
dedicated applications or tools like SPOTS.

Security management
Security management combines the security mechanism of the element managers with
the security mechanism of the network elements. This allows for example the adminis-
tration of the SC or IP Manager user access to configuration tasks and applications,
forced minimum password length, quality requirements on passwords, maximum num-
ber of failed login and unauthorized command execution attempts, maximum password
lifetime and user time scheduling.

Automated delivery of software corrections (Autopatch)

Autopatch for Switch Commander will support the worldwide process for delivery of soft-
ware corrections (patches). The patches will be transmitted in the form of patch sets
from the central development database via the individual technical service centers
(TSC) to the network element and installed there automatically at particular times.

3.4.2 Basic O&M Functions of the Radio Commander (RC)

Configuration management
The configuration management reflects the status of the BSS network elements of the
PLMN. The objects in the configuration management are
– Hardware components
– Logical units
– Software modules.
Each configuration object is characterized by a set of attributes. In the database the con-
figuration objects and their attributes can be created, changed, deleted or printed out by
the PLMN operator. An example of this is the extension of a BSC by further BTSs (within
the framework of the existing hardware equipment).
The configuration management software provides functions for
– defining new configuration objects or deleting existing ones;
– creating, changing or deleting relationships between the configuration objects;
– listing the identity, the type, the relationships and other attributes of the configuration
objects on request;
– defining default values for variable attributes and
– defining or changing operating characteristics.

A50016-D1111-V12-2-7618 81
System Description D900/D1800 Information
GPRS PLMN System

Fault management
For BSS network elements, fault management is handled by the graphical user interface
(GUI) which serves as a special O&M function in the RC.
Fault management includes fault detection, fault recovery, alarm logging and alarm re-
porting.
• Fault detection
In general, fault detection is in charge of noticing the presence of a fault or more gen-
erally any malfunction of the system. Fault detection comprises the functions of fault
recognition, fault location, fault analysis, and fault classification.
• Alarm reporting
It represents the alarm generation, alarm collection/filtering and alarm indication
parts.
• Fault recovery
This includes all the actions needed to minimize the damage caused by the fault and
to restore the full operating condition of the system. The actions performed depend
on the individual fault and range from initialization, automatic reconfiguration and re-
loading to redundancy switchover.
• Alarm logging
All relevant alarms for retrieval by the managing system are stored in the database.
In addition, a special BSC event logging feature allows the PLMN operator to exam-
ine system behavior where malfunctions occur. The logging file is stored on disk and
can be transferred to an external terminal (OMT/LMT) using a file transfer process
(upload command). The monitoring of past BSC events allows for a subsequent his-
tory reconstruction and a deeper analysis of the system’s behavior without requiring
the LMT to be connected to the BSC.

Performance management
For the BSS network elements, performance management produces statistical data on
the traffic load and performance of the PLMN. Performance management is mostly sup-
ported by counters and timers.
The statistical data is used by the PLMN operator for trend analysis, to optimize the per-
formance of the PLMN.
The performance management software provides functions for
– collecting data;
– statistically analyzing this data;
– storing the statistical data together with the history and
– outputting statistics on request, e.g., in graphical form.
The statistical analyses could relate to
– incoming/outgoing connection requests;
– successful/unsuccessful connection requests;
– handover requests;
– detected faults and
– time between events.
To speed up operation and transmission capabilities the performance data can be com-
pressed at the BSC. After uploading, the RC automatically decompresses the sent per-
formance management data for further processing.

82 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Software management
Software management supports the downloading of software to the network elements
of the BSS network elements from the RC. The grade of service is not affected during
the download process.

3.4.3 Central Overload Handling

3.4.3.1 Central Overload Handling on the SC and RC

The purpose of central overload handling is to supervise the loads of available resourc-
es, such as
– network nodes in the GSS (SGSN/SLR, GGSN/IPS, HLR/AC) and
– network elements in the BSS (BSC, BTS).
Further, it is intended to trigger quick and well-informed responses in overload situa-
tions. The aim is to balance load and resources at a selected level without compromising
the system’s grade of service at any time.
The PLMN operator at the SC or RC (as well as the PLMN operator local to the network
node/network element, System Description D900/D1800, register GSM PLMN) receives
messages relating to the existence and extent of an overload via CT/OMT to permit ad-
ditional overload actions to be taken by manual entry of Q3 tasks/MML commands at
the CT/OMT, if necessary. Overload handling can access the results of performance
management (load information) and initiate overload control measures.

3.4.4 Recovery Procedure

In every GPRS PLMN subsystem (BSS, GSS and in the OMS itself), independent auto-
matic recovery procedures are made available by the computer-controlled network ele-
ments and/or network nodes to maintain overall system operation. In the CN/GSS
network nodes, for instance, a distinction is made between an automatically initiated re-
covery (e.g., on the occurrence of a fault) and a manually initiated recovery by means
of a Q3 task/MML command at the CT/OMT (at the man-machine interface). In the first
case a message is signaled via the CT/OMT, in the second case a dialog at the CT/OMT
is possible.

3.4.5 Special RC Management Functions

3.4.5.1 Sleeping Cell and Carrier Detection

For BSS network elements an early-detection mechanism for sleeping radio cells and/or
sleeping carriers is introduced. Should cases occur when no GPRS-MSs are served by
a radio cell or a single carrier, but no alarm is given to the PLMN operator, such cells/car-
riers would be referred to as “sleeping”.
This feature provides an effective means of also covering these difficult-to-detect situa-
tions. The PLMN operator is informed in due time about possible sleeping cells/carriers
so that he can invoke recovery actions in good time. Possible cells and carriers with no
activity and no alarm indication can be detected at a very early stage. This enables the
operator to take appropriate recovery actions in good time so that service outages can
be kept to an absolute minimum.

A50016-D1111-V12-2-7618 83
System Description D900/D1800 Information
GPRS PLMN System

3.4.5.2 National OMC

The national OMC provides a means of centralizing O&M functions. This is particularly
useful for the BSS side of O&M providing a simple means of bringing together all infor-
mation from regional, usually geographically dispersed RCs. This overlay operation is
shown in the hierarchical structure of Fig. 3.3. The national OMCs can be assigned to
the OS area and correspond to the OS components of the Network Management Center
(NMC) type. The national OMCs allow what is known as a night/weekend service con-
figuration of all the OMC activities. To connect a regional OMC and national OMC X.25
connections (PSDN) to an OSI stack, an object-oriented information model of the BSS
is used.
The national OMC has the same functions as the regional OMCs, including for example:
– Status management
– Configuration management
– Fault management
– Performance management.
Additional functions such as night service configuration and the monitoring of trunk lines
to the regional OMCs are also included.

Night service configuration National

OMC

PSDN (X.25)

Regional Regional
RC/OMC RC/OMC

OMS/OS

PSDN (X.25) BSS/CN-GSS

BSS network CN/GSS CN/GSS BSS network

element network element network element element

Fig. 3.3 National OMC (in particular for RC/OMC)

3.4.6 Mediation Functions for the RC

The mediation functions (MF) in the OMS allow access to the BSS network elements by
an Operations System (OS). The MFs translate the Q3 interface of a TMN between
OMS and OS to the vendor-specific Q3 interface between OMS and the BSS network
elements, in particular, the different object models on both sides of the interfaces (see
also System Description D900/D1800, register Network System Concept, section exter-
nal GSM PLMN interfaces).

84 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Examples of mediation functions are:

– Alarm message dialog/transfer between the BSS network elements and the OS net-
work components (e.g., Network Management Center (NMC)) with the dialog ser-
vice CMISE
– RC Q3 interface for fault management.

3.5 IN or CAMEL Subsystem Functions in a GPRS PLMN

The basic network components of the IN/CAMEL are described in the system descrip-
tion D900/D1800, register GSM PLMN, section IN or CAMEL subsystem functions in a
GSM PLMN.
In this section the IN/CAMEL functions are described as follows:
– SGSN support of prepaid service for PS services
– SGSN support of virtual private network (VPN) service for PS services
CAMEL is introduced in three phases: CAMEL phase 1, CAMEL phase 2 and CAMEL
phase 3.
SIEMENS introduced CAMEL based prepaid service for GPRS (packet-switched (PS)
i services in a previous software version of GPRS PLMN. In the last release and this re-
lease, the functionality is enhanced to fully support CAMEL phase 3 for short message
service (SMS) and PDP context model. The chosen approach allows for the support of
sophisticated prepaid service and virtual private network (VPN) service. This features in
the GSS (packet-switched domain) needs an appropriate software version in the
SCP/CSE nodes of the IN&CAMEL part.

3.5.1 SGSN Support of Prepaid Service for PS Services

Prepaid via CAMEL enables the PLMN operator to charge
• A PDP context based on time and/or on transferred data volume and
• A short message service mobile-originated (SMS MO) over the GPRS.
For GPRS CAMEL is introduced with CAMEL phase 3.
Enhancements in the current software version contain extension of trigger and event
i detection points for PDP context handling by the SCP/CSE and the functionality activity
test for verification of an active PDP context of a GPRS mobile subscriber between the
SCP/CSE and the SGSN.

The CAMEL-based mechanism improves the quality of service substantially as real-time

online charging is now possible:
– Online charging prevents fraud for the PLMN operator as the account of a GPRS
mobile subscriber cannot be overdrawn.
– The transparency of the charging principle for the GPRS mobile subscriber is also
improved. The packet-switched prepaid service has the same look and feel as the
well-known circuit-switched prepaid service.
– The prepaid service is now also available for roaming subscribers.
– The GPRS CAMEL phase 3 features work in a SIEMENS environment. Therefore,
national and international roaming will only be supported via a “roaming subscriber
table” in SGSN (also see System Description D900/D1800, register GSM PLMN,
IN/CAMEL: Roaming subscriber table in VLR).

A50016-D1111-V12-2-7618 85
System Description D900/D1800 Information
GPRS PLMN System

Functions of the network components/elements involved for the support of

CAMEL based prepaid for PS services
• Visited GPRS PLMN
SGSN/SSP:
- Recognition of the prepaid service for packet-switched services.
- Implementation of the IN/CAMEL network component SSP with enhanced CAP ca-
pabilities in the SGSN.
- New charging ticket layout and new prepaid file generation, while the ABC tickets
are extended by GPRS CAMEL information.
- The SGSN generates charging tickets which contain CAMEL information and are
sent to the Charging Gateway (CG) via GTP’ protocol or to the ABC via FTP proto-
col.
• Home GPRS PLMN
HLR:
- CAMEL subscription data (GPRS-CSI and SMS-CSI).
- New MAP messages on HLR to SGSN/SSP interface, for updating visited SGSN
with certain subscriber data (such as GPRS-CSI) at the packet-switched routing
area updated by the HLR.
• IN/CAMEL
SCP/CSE:
- Prepaid budget information such as volume, time, tariff information, etc. will be
transported from SCP/CSE via CAP to SGSN/SSP.

Fig. 3.4 shows the functional architecture for CAMEL phase 3-based prepaid for pack-
et-switched (PS) services. The figure shows the functional elements involved in packet-
switched sessions requiring CAMEL support.
If the result of the CAMEL dialog triggered by a PDP context activation or an SGSN
change (new SGSN) indicates that prepaid charging shall apply a certain budget is giv-
en to the SGSN. The budget may be a duration limit for an activated PDP context and/or
a data volume which is permitted to transfer. If one or both budgets are in danger to run
out the SGSN requests additional budget. On a context deactivation or an SGSN
change (old SGSN) the remaining budget will be returned to the SCP/CSE.
Each PDP context activation triggers a separate dialog toward the SCP/CSE even it
points to the same subscriber. The dialog is suspended by the SGSN if all prepaid rele-
vant data are available and is resumed at re charge or PDP context deactivation.
If the result of the CAMEL dialog triggered by an SMS transfer indicates that prepaid
charging shall apply a budget for a single SMS is given to the SGSN. After short mes-
sage transmission the delivery status of the short message will be returned to the
SCP/CSE.
The CAMEL phase 3-based prepaid functionality within the SGSN can be subdivided
into three logical parts:
• CAMEL extensions to mobility management handling
• CAMEL PDP context handling
• CAMEL SMS handling

86 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Home GPRS PLMN IN/CAMEL

MAP SCP/ SMP

HLR
CSE

ABC
MAP
CAP

BSS Internet
SGSN/SSP GGSN/
IPS

Firewall
visited
CG
GPRS PLMN

ABC
SMSC

GPRS-MS

Fig. 3.4 Network architecture of CAMEL based prepaid for packet-switched (PS)
services

CAMEL extensions to mobility management handling

Both GPRS mobile subscriber subscriptions GPRS-CSI and SMS-CSI are supported in
the current software version and are subscriber data in the HLR. The GPRS-CSI and
the SMS-CSI contain trigger detection points. During the attach/routing area update the
CSIs are downloaded to the mobility management application in the SGSN and stored
in the SGSN/SLR. The GPRS-CSI is also stored within the mobility management con-
text in the context table of the serving SGSN.
Before attaching a CAMEL subscriber to the SGSN, the mobility management applica-
tion has to check whether the feature is active in this node. Owing to the restricted im-
plementation of the CAMEL phase 3 standard, it’s the PLMN operator’s responsibility to
restrict roaming only to networks having the same reduced capabilities. Therefore, it is
necessary to read the “roaming subscriber table” for all foreign subscribers.

CAMEL PDP context handling

On PDP context activation, session management (SM) checks the GPRS-CSI (if there
is one) for the relevant trigger detection point. When this trigger detection point is
reached, SM interrupts the activation and informs the SSP. The SSP sends a request to
the SCP/CSE for further instructions. After a positive response is received, the context
activation is continued from SM. If budget information is received from SCP/CSE, the
budget control is activated.
CAMEL interworking for QoS change:
QoS changes are related to modifications in the PDP context. The changes may be re-
quested by the GPRS-MS or by the SGSN due to the traffic situation. If the budget con-

A50016-D1111-V12-2-7618 87
System Description D900/D1800 Information
GPRS PLMN System

trol function encounters a “QoS change”, the SGSN sends a report message to the
SCP/CSE and waits for further instructions, i.e. new budget information.

CAMEL SMS handling

The relevant trigger is active during SMS MO handling. If this trigger detection point is
reached, the activation is interrupted and the SSP is informed. The SCP/CSE is in-
formed via SSP. After a positive response from SCP/SCE has been received, the SMS
is sent to the SMSC. The accounting tickets are enhanced by CAMEL-specific informa-
tion.

3.5.2 SGSN Support of Virtual Private Network (VPN) Service for PS Ser-
vices
If the result of the CAMEL dialog triggered by the PDP context activation indicates that
a change of the access point name (APN) will apply the SGSN uses the indicated APN
for further proceeding of the PDP context activation. In this case the rules for the “nor-
mal” APN processing are overwritten. That is, the indicated APN will be used as it is.
If the result of the CAMEL dialog triggered by the mobile originated SMS indicates that
a change of A/B number or gateway address shall apply the SGSN uses the indicated
numbers or addresses. In this case the normal rules for processing of roaming restric-
tions are overwritten.

88 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4 Network Functions for GPRS PLMN

The services of the GPRS PLMN are based on the network functions.
The network functions of GPRS PLMN are divided into:
– Functions of packet-switched services
(with mobility management and session management functions)
– Location services
– Charging and billing
– Lawful interception package
– Operation and maintenance functions
– Communication protocols and signaling functions in the GPRS PLMN

4.1 Functions of Packet-Switched Services

Functions of packet-switched services are used between a GPRS mobile subscriber
and a PDN. They comprise the functions resulting from the architecture of the GPRS
PLMN network. These functions apply to GPRS mobile subscribers.
These include:
• GPRS mobility management (GMM) - separate or combined
– Mobility management (MM) states
– GPRS attach/detach
– Routing area update (2G to 2G, inter-system 3G to/from 2G, inter-PLMN)
– Mobility management with the packet data routing in the downlink direction (pag-
ing).
• Session management
– PDP states
– PDP context management
– PDP types.
• IP header compression
• IP address determination
• RADIUS client
• DHCP client
• Routing functions on the Gi interface and Gn interface
(OSPF, RIP, BGP)
• Inter-PLMN configuration
• Secure network configurations
– Network security
– General packet-switched configuration with IPsec
• Quality of service (QoS) profile
– QoS enhancements at SGSN and GGSN/IPS with DiffServ
– QoS enhancements with MPLS
• Resource management (RM)/Admission control
• Radio-access security and user authentication functions
– GPRS authentication
– Data integrity
– Confidentiality functions (e.g., ciphering)
– User identity confidentiality (P-TMSI reallocation).
• Roaming
– National roaming agreements
– Flexible roaming

A50016-D1111-V12-2-7618 89
System Description D900/D1800 Information
GPRS PLMN System

– Network access subscription

– Equivalent PLMN list
• Packet data routing in the
– Uplink direction
– Downlink direction
• Handling of GPRS mobile data services
– Packet-switched data services
– SMS over GPRS
• Local overload handling
• Transmit power control (BTS function)

Basic BSS functions which are described in the circuit-switched GSM (see system de-
i scription D900/D1800, register GSM PLMN, section 3) are also valid for the GPRS BSS
operation. Examples of these functions are:
- Frequency hopping
- Single-cell and multicell operation
- Concentric radio cells
- Extended radio cells (distance)
- Support of the satellite link on the A, Asub and Abis interface
- BTS multidrop-star cross connect
- Hierarchical radio cell structure.

4.1.1 Mobility Management States

The GPRS mobility management (GMM) state model for both the GPRS-MS and the
SGSN/SLR consists of the following states (Fig. 4.1):
– IDLE state
– STANDBY state
– READY state.

IDLE state
A GPRS-MS in the IDLE state does not operate. It is merely detached (with respect to
GPRS). Only GPRS subscription information in the HLR is available. There is no further
information in other network elements such as SGSN/SLR or GGSN/IPS.
It is not possible to activate a packet data protocol (PDP) in this state or keep a PDP in
the active state.
To leave the IDLE state, the GPRS-MS performs the GPRS attach procedure. On the
successful outcome of it, the GPRS-MS enters the READY state.

READY state
In the READY state, the SGSN/SLR knows the routing area and the radio cell where the
GPRS-MS camps. If the GPRS-MS enters a new radio cell supporting GPRS it updates
the SGSN/SLR by transferring any LLC (BSSGP) frame. Therefore, there is no need to
page the GPRS-MS if the SGSN/SLR wants to deliver a data packet in the downlink di-
rection. The ready state does not imply any established physical connection between
the GPRS-MS and the SGSN/SLR.
The GPRS-MS and the SGSN/SLR leave the READY state on execution of the GPRS
detach procedure (or on expiration of the ready timer or forced to standby or transmis-
sion failure). The GPRS-MS and the SGSN/SLR also changes to the STANDBY state
on failure of a packet transmission.

90 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

STANDBY state
In STANDBY state, the GPRS-MS is attached to the GPRS PLMN. The GPRS-MS and
the SGSN/SLR contain a mobility management context similar to that for circuit-
switched connections. The SGSN/SLR knows the routing area where the GPRS-MS
camps. The GPRS-MS informs the SGSN/SLR when it enters a new routing area and
answers request messages by paging.
In order to move to the READY state, either the SGSN/SLR pages the GPRS-MS or the
GPRS-MS initiates data transfer. The GPRS-MS and the SGSN/SLR move to the IDLE
state on expiration of the standby timer.

IDLE state

GPRS attach

GPRS detach

READY state

Expiration of the READY timer or forced to

data transfer STANDBY or transmission failure

STANDBY
timer expiry STANDBY state

Fig. 4.1 Mobility management state transition

4.1.2 Separated Mobility Management

Separated mobility management means mobility management within a GPRS PLMN,
i without a Gs interface between the GPRS PLMN and GSM PLMN. Thus, no interference
between the GPRS PLMN and GSM PLMN is possible.

4.1.2.1 GPRS Attach/Detach

If the GPRS mobile subscriber has inserted/removed his chip card SIM (and therefore
the IMSI) the SGSN/SLR is informed about the activated/deactivated state of the GPRS-
MS with the function GPRS attach/detach. The GPRS attach/detach function is used to
establish or delete a GPRS mobility management (GMM) context for a GPRS-MS in the
SGSN/SLR. After a successful GPRS attach, a GMM context and GPRS mobile sub-
scriber data are available in the SGSN/SLR location register (SLR).
Attach procedure: (here without changing the SGSN/SLR since detach)
1. The GPRS-MS sends a GPRS attach request for this to the SGSN/SLR which in turn
attaches the relevant IMSI/P-TMSI in the individual database. The GPRS attach pro-
cedure resets the detached state again. The SGSN/SLR then sends an attach ac-
knowledgment to the GPRS-MS. If no MM context for the GPRS-MS exists
anywhere in the network, the GPRS authentication is mandatory.
2. The SGSN/SLR sends an attach accept to the GPRS-MS.

A50016-D1111-V12-2-7618 91
System Description D900/D1800 Information
GPRS PLMN System

Detach procedure:
1. The GPRS-MS detaches by sending a detach request (detach type, switch off) to the
SGSN/SLR. Detach type indicates which type of detach is to be performed, i.e.
GPRS detach only, IMSI detach only, combined GPRS and IMSI detach. “Switch off”
indicates whether the detach is due to a switch off situation or not.
2. If “switch off” indicates that the detach is not due to a switch off situation, the SG-
SN/SLR sends an attach accept to the GPRS-MS.
Fig. 4.2 shows the GPRS attach/detach procedures.

SGSN/S
LR

1 2

BSS

1 2

GSM radio interface

GPRS-MS

Fig. 4.2 GPRS attach and detach procedures

Network initiated detach of incactive subscribers

The amount of subscriber with GPRS capable mobiles (GPRS-MS) is increasing dra-
matically. This is especially a problem for incumbent PLMN operators which have a
large base of GSM subscribers and allow, according to their marketing strategy, every
subscriber to enter the packet-switched domain, i.e. the network access mode (NAM) is
set to "circuit-switched / packet-switched" in the subscribers dataset at the HLR. This
means, that a subscriber with a GPRS capable mobile is attached to the Serving GPRS
Support Node (SGSN) - regardless whether the subscriber really wants to use packet-
switched services or not. The result is that usage of mobile data services over GPRS is
only a small part of the subscribers which are attached to the SGSN. Therefore the
PLMN operator has to provide a large subscriber capacity at the SGSN or to deploy a
lot of SGSN but the "data session ratio" is characterized by a very low value.
Of course this problem can be solved otherwise but this alternatives are dependent on
the network conditions and the concept of the PLMN operator:
– Dedicated subscription for GPRS subscribers.
– Some GPRS-MS do not automatically attach at the SGSN after GPRS-MS activa-
tion. An attach is only done directly before the subscriber is setting up a PDP context
and establishes a mobile data session over GPRS.
With this feature the SGSN provides a mechanism to restrict users from the PLMN which
have a GPRS capable mobile (GPRS-MS) but don't use GPRS services for a certain
time. The SGSN detaches any subscribers from its SGSN Location Register (SLR) who
has not activated a PDP context (data session) during a certain time frame. A reattach

92 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

is only triggered by the GPRS-MS. This avoids a large investment in SGSN subscriber
capacity and allows an optimal PLMN utilization as far as the usage of GPRS is still low.
UMTS packet-switched subscribers are not supervised. The time frame for the inactivity
duration supervision is predefined to 4 hours.

4.1.2.2 Routing Area Update

The SGSN/SLR supports seamless GPRS service provision to the GPRS mobile sub-
scriber with an active PDP context without an Gb interface while the routing area is being
changed.
In the GPRS domain, handover is part of the mobility management function routing area
i update (RAU). Handover control (HOC) is triggered by mobility management to coordi-
nate the SGSN change.

The general procedure of the routing area update (RAU) is a so-called “forward han-
dover”, i.e. the GPRS-MS initiates a routing area update on the SGSN/SLR serving the
new routing area. The SGSN/SLR change is triggered by the GPRS mobility manage-
ment (GMM) to coordinate the SGSN/SLR change.
A routing area update (RAU) takes place when a GPRS-MS in the GMM-READY or
GMM-STANDBY state changes from one routing area to another inside the GPRS sys-
tem. Both cases can result in a SGSN change (inter-SGSN RAU) or not (intra-SGSN
RAU). If SGSN was changed, the GMM and PDP contexts must be allocated in a new
SGSN and GGSN/IPS and the HLR must be updated.
There are two kinds of RAU:
• Intra-SGSN/SLR routing area update
- without SGSN/SLR change
• Inter-SGSN/SLR routing area update
- with SGSN/SLR change

Routing area update procedure (intra-SGSN, without SGSN/SLR change)

A GPRS mobile subscriber can roam in a radio cell which is served by the same SG-
SN/SLR.
1. By detecting all neighboring BTSs and continuously analyzing the available mea-
surement results, the GPRS-MS can determine when a radio cell must be changed.
If the routing area is changed then the GPRS-MS sends a routing area update re-
quest to the SGSN/SLR via the BSS.
2. For identification, the GPRS mobile subscriber uses the packet temporary mobile
subscriber identity (P-TMSI)/logical link control (LLC) identity and the previous rout-
ing area identity (RAI). The SGSN/SLR requests the international mobile subscriber
identity (IMSI) and the unused triplets from its database.
3. The SGSN/SLR may perform authentication.
4. The SGSN/SLR assigns a new packet temporary mobile subscriber identity (P-TM-
SI)/logical link control (LLC) identity to the GPRS mobile subscriber.
Fig. 4.3 shows the sequence of a routing area update procedure (without SGSN/SLR
change).

A50016-D1111-V12-2-7618 93
System Description D900/D1800 Information
GPRS PLMN System

SGSN/SLR 3

4 1

BSS

4 1
GSM
radio interface

GPRS-MS
GPRS-MS

Roaming (changing from one

radio cell to another which
belongs to another routing area)

Fig. 4.3 Routing area update procedure (without SGSN/SLR change)

Routing area update procedure (inter-SGSN, with SGSN/SLR change)

When a GPRS-MS moves into a routing area served by a new SGSN/SLR, GMM of the
new SGSN/SLR triggers the SGSN/SLR change function to retrieve mobility manage-
ment data (e.g., IMSI, authentication data, parameters for ciphering) and session man-
agement (SM) context data (e.g., active PDP contexts) from the previous SGSN/SLR
via the Gn interface. When interworking with the previous SGSN/SLR fails, the new
SGSN starts an identity request to the GPRS-MS and queries the HLR. This procedure
is similar to a normal attach. If this procedure also fails, the RAU is rejected by GMM and
forces the GPRS-MS to re-attach. In this case, the active PDP contexts cannot be re-
trieved.
Therefore, the inter-SGSN change is a location management procedure on the Gn inter-
face to allow the handling of the GPRS-MS mobility in case the GPRS-MS changes the
SGSN/SLR routing area.
This is achieved by the following steps coordinated by the SGSN/SLR change proce-
dure:
1. By detecting all neighboring BTSs and continuously analyzing the available mea-
surement results, the GPRS-MS can determine when a radio cell must be changed.
If a new routing area is entered then the GPRS-MS sends a routing area update re-
quest to the SGSN/SLR via the BSS.
2. For identification, the GPRS mobile subscriber uses the packet temporary mobile
subscriber identity (P-TMSI)/logical link control (LLC) identity and the previous rout-
ing area identity (RAI). The new SGSN/SLR sends an SGSN context request mes-
sage to the old SGSN in order to obtain information about the mobility management
(MM) context (IMSI; authentication info) and the PDP context information.
3. The SGSN context request message from the new SGSN/SLR causes the old SG-
SN/SLR to stop sending PDUs to the GPRS-MS.
4. The GPRS mobility management (GMM) and active PDP contexts of the relevant
user in the old SGSN/SLR are sent to the new SGSN/SLR.

94 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

5. At the new SGSN/SLR, the SM and MM protocol entities are reestablished.

6. The PDP contexts are updated within the GGSN/IPS to enable downlink PDUs to be
sent to the new SGSN/SLR.
7. GMM causes the HLR to update its SGSN/SLR address.
8. The SLR contents (MM contexts) and context table records (PDP context) within the
old SGSN/SLR are canceled.
9. The subscription data is inserted within the new SGSN/SLR.
10. The GPRS-MS is notified about successfully performed inter-SGSN change.
Fig. 4.4 shows the sequence of a routing area update procedure (with SGSN change).

HLR 7

8 5, 9
2, 3
SGSN SGSN 6 GGSN/
IPS
4

1
10

BSS BSS

GSM
1
radio interface 10

GPRS-MS
GPRS-MS

Roaming (changing from one

radio cell to another which
belongs to another routing area)

Fig. 4.4 Routing area update procedure (with SGSN network element change)

Bearer establishment with the requested QoS:

This feature handles the case where a routing area update (RAU) is made back to a ra-
dio cell where a higher bandwidth or higher QoS value is available, which was not avail-
able in the last radio cell, but was requested at session setup.
After an inter-SGSN change (inter-SGSN RAU), with or without system change, the
PDP contexts (Gn/Gb user plane) are established or modified using information con-
tained in the “QoS requested” field of the “PDP context” information element.
All three QoS profiles (requested, negotiated, and subscribed) are contained in special
messages. Thus, the information required to establish the new radio bearer after RAU
with the originally requested QoS values is available. Taking the formerly requested
QoS values (lowest value between QoS requested and QoS subscribed) as the basis
for bearer establishment, a GPRS-MS is automatically provided with the best possible
service within the requested and subscribed limits. The change of QoS during RAU re-
quires interworking to the GGSN/IPS for PDP context modification. The information is
sent to the GGSN/IPS via an “update PDP context request” message.

A50016-D1111-V12-2-7618 95
System Description D900/D1800 Information
GPRS PLMN System

If the new allocated QoS value is different from the negotiated QoS value received from
the old SGSN, the new SGSN starts a network initiated PDP context modification pro-
cedure to communicate the QoS change to the GPRS-MS after RAU is completed.

4.1.2.3 Inter-System Routing Area Update (2G to/from 3G RAU)

The routing area update (RAU) procedure is performed to update the serving function-
ality of the network for a new location of the mobile subscriber. Inter-system routing area
update describes the RAU if a mobile subscriber moves from GPRS (2G) to UMTS (3G)
and vice versa. This kind of RAU can also be called “inter-system” routing area updates
(RAU). The GTP version 1 and the GTP version handling are recommended between
the SGSNs and the SGSN and the GGSN/IPS.
The following different types of RAUs exist:
• Inter-system RAU (with SGSN network element change)
– GPRS (2G) to UMTS (3G)
– UMTS (3G) to GPRS (2G)

Inter-system RAU (with SGSN network element change)

• GPRS (2G) to UMTS (3G) RAU
The inter-system change from GSM to UMTS takes place when a GPRS-attached
MS changes from GSM radio access (BSS) to UTRAN/RNS, and the UTRAN node
(RNC) serving the MS is served by a different SGSN. In this case, the routing area
changes. Therefore, the MS initiates a UMTS RAU procedure by establishing a radio
resource control (RRC) connection and initiating the RAU procedure.
• UMTS (3G) to GPRS (2G) RAU
An inter-system change from UMTS to GSM takes place when an UMTS-attached
MS in the PMM-IDLE or PMM-CONNECTED state changes from UTRAN/RNS to
GSM/GPRS radio access (BSS), and the BSS node (BSC) serving the MS is served
by a different SGSN. In this case, the routing area changes. Therefore, the MS ini-
tiates a GSM/GPRS RAU procedure. The RAU procedure is either a combined rout-
ing area (RAU)/location update (LUP) or only RAU.

4.1.2.4 Inter-PLMN Handover (Routing Area Update)

PLMN operators tend to seek partnerships in other countries or operate in several coun-
tries. This enables them to offer their mobile subscribers or partner network mobile sub-
scribers inter-PLMN handover (RAU) for packet-switched domains (here GPRS PLMN),
in accordance with the subscribers’ roaming agreements.
If roaming agreements between GSM1800 and GSM900 operators exist, handover be-
tween both networks is usually possible. In general, GSM1800 operators do not have
full countrywide coverage, in contrast to GSM900 operators. This feature allows
GSM1800 operators to gain extended coverage (and thus attract more mobile subscrib-
ers) and GSM900 operators to increase revenue.
In less populated areas, PLMN operators can share investment and operating costs (as
well as revenue), but are able to offer their subscribers full coverage (better service).
An existing GSM/GPRS PLMN operator can start a UMTS PLMN in an urban area, or a
UMTS PLMN operator can cooperate with an existing GSM/GPRS PLMN operator. This

96 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

enables enhanced coverage for UMTS subscribers during an active call (packet-
switched session).
In inter-SGSN change (RAU), an inter-PLMN handover has to be supported. It is as-
i sumed that no intra-SGSN inter-PLMN handover is possible. Inter-PLMN handover is
only possible if the SGSN has been changed.
This feature describes an extension of the already implemented inter-SGSN RAU, with
or without system change.

To perform the inter-PLMN handover check procedure, a list of allowed mobile country
codes (MCC) - mobile network codes (MNC) is necessary to “administer” an SGSN. To
minimize administrative work, the allowed MCC-MNCs’ list is “administered” through a
source patch. During routing area update, the handover control function performs the
inter-PLMN handover check procedure.
Inter-PLMN check procedure:
The inter-PLMN check is initiated during inter-SGSN RAU after authentication if the in-
ter-PLMN handover was detected (flag is set). The original PLMN (MCC-MNC) is ex-
tracted from IMSI and compared with the MCC-MNC allowed table. The source PLMN
(MCC-MNC) is extracted from the old RAI received, and is also compared with the MCC-
MNC allowed table.
If the original or source PLMN (MCC-MNC) is not found in the MCC-MNC allowed table,
the inter-PLMN handover must be rejected. Otherwise, it is accepted.

4.1.2.5 Mobility Management with the Packet Data Routing in the Downlink
Direction (Paging)
The mobility management functions (routing area registration, GPRS attach/detach) are
described in sections 4.1.2.2 and 4.1.2.1).
For packet data routing in the downlink direction, the following mobility management
function is also available.

Paging (for GPRS operation)

Paging is necessary for packet data routing in the downlink direction if the exact radio
cell where the GPRS-MS camps is not known. Because the downlink data transfer is
only possible in the GMM state READY, a downlink data PDU that arrives while the
GPRS-MS (and SGSN/SLR) is in the GMM state STANDBY, activates the paging func-
tion. The paging of a GPRS-MS is carried out in a similar way to the paging of non-
GPRS operation, but partially uses the GPRS capability. The SGSN/SLR initiates the
paging procedure by sending a paging request to the BSS. The BSS delivers the paging
request through the paging channel. The required channel (GPRS) is indicated in the
paging message. The GPRS-MS sends any LLC (BSSGP) frame as a paging response
to the SGSN/SLR. Any uplink LLC (BSSGP) frame initiates a GMM state transition to
the READY state.

A50016-D1111-V12-2-7618 97
System Description D900/D1800 Information
GPRS PLMN System

4.1.3 Combined Mobility Management

If the GPRS PLMN and GSM PLMN are combined, the network resources can be used
i more efficiently by “combined mobility management” of the packet-switched PLMN and
the circuit-switched PLMN by introducing the Gs interface. The Gs interface has to be
supported by the SGSN/SLR and the MSC/VLR.
The MSC/VLR part of the Gs interface is not part of this feature. This part is described
in the System Description D900/D1800, register GSM PLMN.

In a combined GPRS/GSM PLMN which supports the Gs interface, special mobile sta-
tions, i.e. GPRS class A and class B mobile stations, can initiate a combined mobility
management procedure. This means that the
• attach/detach
• location update/routing area update and
• paging
• TMSI reallocation and
• mobile subscriber information
procedures need only be performed in the GPRS PLMN. After completion of the proce-
dure, the SGSN/SLR informs the MSC/VLR about the action.
Class A mobile stations (MS) support the use of data connections at the same time as
speech connections, while class B mobile stations (MS) support only one of the two con-
nection types at a time. The Gs interface allows a mobile subscriber having a class B
mobile station (MS) with an ongoing data connection to disconnect the data connection
and accept an incoming speech call.
The main gain of the interface is traffic reduction on the GSM radio interface. If the in-
terface is available, the signaling traffic to the GPRS-MS is processed by the SGSN,
e.g., a combined routing area/location update request is sent to the SGSN which up-
dates its data and forwards the request to the MSC which updates the VLR and sends
a response to the SGSN. The interworking with the HLR is done by the SGSN and MSC.
A further advantage is the possibility of reaching a GPRS-MS operating in class B node
during a packet-switched session by the MSC/VLR in the case of paging. In addition, the
paging procedure of the SGSN is more efficient, because the GPRS-MS is paged in the
radio cell if it is in the READY state.
The purpose of “TMSI-reallocation” is to provide identity confidentiality of the subscriber
at which initiation of the procedure can be functionally integrated to the combined loca-
tion update procedure (implicit TMSI-reallocation). The TMSI-reallocation in this case is
an enhancement of the location update procedure towards the MSC/VLR via the Gs in-
terface. Thus the reallocation of the TMSI of an mobile subscriber can be started implic-
itly by the VLR during the combined location update procedure.
The “mobile subscriber information” procedure is used by the VLR to retrieve mobile
subscriber specific information - for example location information - from the SGSN/SLR.
The initiation of the procedure is done stand-alone by the VLR and can be done anytime
as long as the GPRS mobile subscriber is attached for circuit-switched services (i.e. the
state of the association is Gs-Associated). Possible parameters to be requested from
the SGSN/SLR are: Mobile location information, P-TMSI, IMEI, TMSI and different com-
binations of the GPRS mobile subscriber identities.
If the Gs interface is not available, the SGSN/SLR informs the mobile station that the
combined mobility management procedure failed. The mobile station will then perform
the same procedure again in the circuit-switched network. This would cause an addition-
al signaling load on the GSM radio interface.

98 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Gs interface state model

The standard defines a state model for the Gs interface. The state of the Gs interface is
subscriber-specific. The SGSN/SLR determines the necessary action, for example trig-
ger regular or combined location update, based on the current status of the Gs interface.
The SIEMENS implementation of this state model in the SGSN/SLR/SLR (Fig. 4.5) can
be described as follows:
Gs null state: After the mobile station has requested a non-combined routing area up-
date, the Gs interface state is set to Gs-Null state in the SGSN/SLR/SLR. The Gs-null
state is also set after a location area update reject is received from the MSC/VLR via the
Gs interface.
Gs-LA update requested state: After the SGSN/SLR/SLR has sent a “location area up-
date request” to the MSC/VLR, the state of the Gs interface is set to Gs-LA update re-
quested. The Gs-LA update requested state is set after a mobile station has requested
a combined routing area update.
Gs-associated state: After the location area update has been performed and the “loca-
tion update accept” has been received by the SGSN/SLR via the Gs interface, the Gs
interface state is set to the Gs-associated state.

Gs-Null
Send location area update
request (to the VLR)
Paging
received
Non-combined Routing
area update request Location area
received from the MS update reject
received

Gs-LA-Update
Paging Requested
Combined routing area
received
update request received
from the MS *)

Location area update

Gs-Associated accept received

Combined routing area update *) With: Location area has changed, SG-
request received from the MS SN/SLR has changed or IMSI attach indi-
(any other cases) cated

Fig. 4.5 Gs interface state model in the SGSN/SLR/SLR

Combined attach
Combined attach means that the attach procedure is performed in the GPRS PLMN.
During the procedure, the SGSN/SLR informs the MSC/VLR about the action via the Gs
interface.

A50016-D1111-V12-2-7618 99
System Description D900/D1800 Information
GPRS PLMN System

The principle, the GPRS attach procedure in the GPRS PLMN is described in section
4.1.2.1.

Combined location update/routing area update

Combined location update/routing area update means that the routing area update is
performed in the GPRS PLMN. During the procedure, the SGSN/SLR informs the
MSC/VLR about the action via the Gs interface.
The basic routing area update procedure in the GPRS PLMN is described in section
4.1.2.2.

Combined paging
Combined paging means that the paging procedure is performed in the GPRS PLMN.
The SGSN/SLR pages the MS and the MS will answer this paging to the MSC/VLR.
The basic GPRS paging procedure in the GPRS PLMN is described in section 4.1.2.5.

4.1.4 PDP States

The state model to a certain packet data protocol (PDP) consists of the (Fig. 4.6):
– INACTIVE state and the
– ACTIVE state.

INACTIVE state
The INACTIVE state of a PDP means that the PDP is not activated. There is no related
routing context in the GPRS-MS, the SGSN/SLR and the GGSN/IPS. The transition to
the ACTIVE state is performed by activating a PDP context. This is only possible if the
mobility management context is established. This means GPRS-MS, is in the GMM
STANDBY or READY state. If the GPRS-MS is in the IDLE state, there is no routing con-
text of any available PDP context.
In the INACTIVE state, it is not possible to transfer any packets of the related PDP con-
text. A data packet unit (PDU) which reaches the GPRS PLMN will be rejected or ig-
nored.

ACTIVE state
The GPRS-MS, SGSN/SLR and GGSN/IPS hold a routing context in the ACTIVE state.
It is possible to transfer data packets.
The ACTIVE state will be left explicitly if the GPRS-MS deactivates a certain PDP con-
text. If the GPRS-MS is detached or the standby timer expires, all activated PDPs of the
GPRS mobile subscriber will be deactivated implicitly.

INACTIVE state

Deactivation of a PDP context

Activation of an PDP context
or
GPRS detach
or
Expiration of the STANDBY timer

ACTIVE state

Fig. 4.6 PDP state transition

100 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.5 PDP Context Management

Session management (SM) outlines the functionality required for handling PDP contexts
in the GPRS support nodes SGSN/SLR and GGSN/IPS. It defines procedures for the
activation and deactivation of PDP contexts.
The SM functionality consists of PDP context handling, subscription check, network fa-
cility check and context table management. For example, the SM has interfaces with re-
source management (RM), the domain name server (DNS) proxy, the SNDCP and with
handover SGSN/SLR change.
To execute the packet data protocol (PDP) activation/modification/deactivation, the
GPRS-MS must be attached to the GPRS PLMN.

PDP context activation

For each subscribed PDP context, a data set is available in the HLR and, if the GPRS-
MS is attached, also in the SGSN/SLR location register (SLR). To activate a PDP con-
text, the GPRS-MS initiates the context activation procedure.
During the context activation procedure, the GPRS-MS provides the following informa-
tion:
• GPRS-MS identity
• Desired PDP with the corresponding
– packet data (IP) address, or an indication that a dynamic IP address should be
used
– the access point to the external PDP network, or an indication that the network
may choose an access point and the
– quality of service (QoS) parameter.
The SGSN/SLR checks the requested service against the subscriber data in the SLR
(subscription check). In addition, the SM verifies whether the requested service can be
supported by the network node (network facility check).
A packet data protocol (PDP) context is assigned for each session. The GPRS-MS,
therefore, must activate a PDP context for the requested session (see Fig. 4.7.) During
context activation, the tunnels which are used for the packet transfer through the packet-
switched domain are established.
Fig. 4.7 shows the context activation procedure between the different nodes (in case of
PDP type IPv4):
1. The GPRS-MS initiates PDP context activation by sending the context request to the
SGSN. After subscription check and network facility check the APN must be convert-
ed into an IP address for addressing the GGSN/IPS. The DNS resolver on the SGSN
(SP:GTP) is, therefore, queried.
2. The DNS resolver retrieves the possible GGSN IP addresses either from a local list
or sends a request to the DNS in the GPRS backbone.
3. The DNS responds with the IP addresses of the possible GGSN/IPS. The admission
control checks whether there are sufficient resources. The SGSN establishes the
packet tunnel towards the GGSN/IPS by creating a tunnel switching point (TSP) and
assigns a tunnel endpoint ID (TEID).
Afterwards the SGSN (SP:GTP) assigns a tunnel endpoint identifier (TEID) and con-
tacts the resource management (RM) to perform an admission control to find out
whether or not the requested QoS profile can be granted. The RM checks which
SGSN network element processor on the Gn interface has sufficient resources to
support the requested service.

A50016-D1111-V12-2-7618 101
System Description D900/D1800 Information
GPRS PLMN System

4. The SGSN sends the create context request to the GGSN/IPS.

5. If the requested APN requires RADIUS, the GGSN/IPS sends a “RADIUS access
request” to the RADIUS server. The RADIUS client supports challenge handshake
authentication protocol (CHAP) and password authentication protocol (PAP).
6. The RADIUS server checks the authentication parameters and sends back the “RA-
DIUS access accept” message.
7. If the APN supports DHCP request, the GGSN/IPS sends a “DHCP discover” mes-
sage to the DHCP server to request an IP address for the context and DNS address-
es.
8. The DHCP server sends back its offer.
9. The GGSN/IPS checks the IP address against its address ranges and then sends
the “DHCP request” to confirm the addresses.
10. The DHCP server finishes the dialog with the “DHCP acknowledge” message.
11. The GGSN/IPS informs the SGSN about successful context creation. Included in the
Create PDP context response is the dynamic IP address (see 4.1.8), if dynamic IP
addressing were required.
A positive response from the GGSN/IPS indicates that all checks were passed suc-
cessfully, that all requested resources were reserved and that the PDP context can
be activated. At this stage, a tunnel is established between the SGSN network ele-
ment and the GGSN/IPS. After a positive response from the GGSN/IPS, which in-
cludes the charging identifier and possibly a dynamically assigned IP address, the
SM informs the accounting probe (AP) server about the activated context. If dynamic
IP addressing was requested by the GPRS-MS, the GGSN/IPS sends the deter-
mined IP address to the SGSN network element, which adds this address to the
GPRS-MS’s context (and forwards it to the GPRS-MS).
12. Context activation is completed with the “activate PDP context accept” message to-
wards the GPRS-MS. With this message the GPRS-MS gets its IP address and the
negotiated QoS.
As soon as the “active PDP context response” message is sent to the GPRS-MS,
meaning that the context was created in the SGSN network element and in the
GGSN/IPS, the SGSN network element is able to route packets between the GPRS-
MS and GGSN/IPS.
13. If RADIUS accounting is enabled, the GGSN/IPS sends a “RADIUS accounting re-
quest” to the RADIUS server.
14. The RADIUS server sends back the “RADIUS accounting response” message.
Context activation is performed as shown in Fig. 4.7, without RADIUS and DHCP, cre-
i ating a Gi endpoint with a PPP stack (see Fig. 4.9) using predefined profiles. In the case
of the PDP type PPP, RADIUS is performed during the inband setup of PPP sessions
after successful PDP context activation.

102 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Gn interface
ISP/Internet

11
SGSN GGSN/ POP
4 IPS 5, 6, 7, 8, 9,
10,13, 14
5, 6, 7, 8, 9,
12 1 10, 13, 14
GPRS
2, 3 backbone
BSS RADIUS/
DHCP
server
DNS
12 server
1

GSM radio interface

GPRS-MS

Fig. 4.7 PDP context activation communication procedure between the different
nodes

Activation of secondary PDP contexts for SGSN

This feature defines the support of establishment of secondary PDP contexts. The PDP
address and other context information of an already established context can be reused.
Secondary PDP contexts allow an APN/PDP address pair to be reused for a packet flow
with, for example, different QoS parameters. This enables efficient use of the IP ad-
dresses. By means of only one allocated IP address, the mobile subscriber can use sev-
eral services with different QoS profiles. Additionally, the services are charged
differently depending on the QoS profile, even though only one IP address is used.
All secondary PDP contexts use the same GTP-C, and the GPTv1 has to be used for
this feature. 3GPP R’98 does not support activation of secondary PDP contexts. Since
GTPv0 can only transport up to R’98 message format, GTPv0 does not support second-
ary PDP contexts.
Possible applications:
• One possible application is multimedia calls. For example, the mobile subscriber
has a voice call that needs a real-time bearer with strong delay requirements, but a
low data rate, a file transfer via a best effort bearer and a video stream over a real-
time bearer with low delay requirements, but a high data rate in parallel. All three
parts of the multimedia call are sent via the same IP address, but via different PDP
contexts which are charged differently.
• Another application enables an “always on” PDP context with very low QoS param-
eters; every time the user starts a current application a secondary PDP context pro-
viding the necessary QoS is activated.

A50016-D1111-V12-2-7618 103
System Description D900/D1800 Information
GPRS PLMN System

• IP Multimedia Subsystem (IMS) is a 3GPP R’5 feature. Nevertheless, IMS is stan-

dardized in such a way that a pre-release 5 3G-SGSN can be used also.
Secondary PDP contexts not only affect the SGSN, but also the GPRS-MS and the
i GGSN/IPS.
The 3GPP standards do not restrict the activation of secondary PDP context on any
PDP type; therefore, secondary PDP contexts are possible for the supported PDP types
PPP and IPv4, but the PDP type of a secondary PDP context has to be the same as the
PDP type of the primary PDP context.

PDP context modification

According the modification procedures specified in 3GPP, this software release does
not support any PDP context modification procedure.
But the SGSN performs a PDP context modification to the MS as a result of a SG-
SN/SLR change. This software release does not support a PDP context modification
which is initiated by the SGSN, as specified in the 3GPP standards, e.g., the SGSN does
not initiate a PDP context modification if subscriber data is inserted (updated). If the QoS
profile subscribed of an active PDP context has changed and no longer matches the
QoS negotiated that is used, the SGSN initiates the PDP context deactivation.

PDP context deactivation

The deactivation procedure is used to deactivate a particular PDP context. The routing
context concerning the registered PDP context for the particular GPRS mobile subscrib-
er will be deleted in the GGSN/IPS and deactivated in the SGSN/SLR.
The deactivation procedure is performed separately for each PDP used.

PDP context synchronization

A PDP context usually exists in both the GPRS-MS and the PLMN (SGSN or
GGSN/IPS). In some cases, however, asymmetric situations occur, in which a PDP con-
text exists on one side only (i.e. in the GPRS-MS or in the PLMN). For such situations,
the “PDP context synchronization” feature is needed to reestablish a symmetric situation
by deactivating the “one-sided” contexts. In this section, such contexts are also referred
to as “surplus contexts”. In the case of surplus contexts, network resources are wasted
and PDP contexts that are not visible to the GPRS-MS user are charged.
The following two scenarios are possible:
– At least one PDP context is active in the PLMN which is not active in the GPRS-MS.
– At least one PDP context is active in the GPRS-MS which is not active in the PLMN.
PDP contexts are synchronized during routing area update (RAU) procedures. There-
fore, the “PDP context status” information element has been introduced in the “routing
area update request” messages, which are sent from the GPRS-MS to the SGSN (ac-
cording to 3GPP standards). With this information element, the GPRS-MS indicates the
status of its own PDP contexts (active/inactive). Thus, the SGSN is able to compare its
own status with the status in the GPRS-MS. Active surplus PDP contexts are deactivat-
ed in the PLMN.

4.1.6 PDP Types (ISP Access Modes)

Internet service providers (ISPs) provide Internet access connections. Connection can
be established via a static or dynamic IP address. The GGSN/IPS or the ISP assign the
dynamic IP address.

104 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

There are four different user packet handling methods which define the following PDP
types (ISP access modes):
• PDP type IPv4
• PDP type PPP (and PPP termination at GGSN/IPS)
• PDP type PPP (with forwarding via L2TP encapsulation)
The PDP type IPv4 defines a connection with the standard Internet protocol (IP) stack
between the GPRS-MS and the ISP. The point-to-point protocol (PPP) is often used by
ISPs to offer their customers dial-in connections to the Internet via serial lines.

PDP type IP v4
The PDP type Internet protocol (IP) v4 provides the packet-switched method for trans-
porting datagrams over point-to-point links.
There is no specification of layers L1 and L2 on the Gi interface. That means that they
are operator-specific.
Fig. 4.8 shows the packet transfer (user plane) protocol stack for PDP type IPv4.

Application Application

TCP/UDP TCP/UDP

IP
IP
IP IP

L2 L2

GPRS bearer L1 L1

MS SGSN/SLR GGSN/IPS ISP

Fig. 4.8 Packet transfer protocol for PDP type IP v4

PDP type PPP (and PPP termination at GGSN/IPS)

The PDP type point-to-point protocol (PPP) provides a standard method for transporting
datagrams over point-to-point serial links.
PPP comprises three main components:
– A method for encapsulating multiprotocol datagrams over serial links
– A link control protocol (LCP) for establishing, configuring and testing at the data link
connection
– A family of network control protocols (NCPs) for establishing and configuring differ-
ent network-layer protocols.
In order to establish communication over a point-to-point link, each end of the PPP link
must first send LCP packets to configure and test the data link. After the link has been
established and optional facilities (e.g., RADIUS authentication) have been negotiated
as needed by the LCP, PPP must send NCP packets to choose and configure one or
more network layer protocols. As soon as each of the chosen network layer protocols
has been configured, datagrams from each network layer protocol can be sent via the
link.

A50016-D1111-V12-2-7618 105
System Description D900/D1800 Information
GPRS PLMN System

PDP type PPP (and PPP is being terminated) uses the two components with LCP and
NCP but not the encapsulation component, as described in the following PDP type.
If the PDP type PPP is used, it is possible to terminate PPP on the GGSN/IPS. In such
a configuration, the only possible network layer protocol is IPv4, i.e. only interworking
with networks based on IPv4 is possible on the Gi reference point in this case. Fig. 4.9
shows the packet transfer (user plane) protocol stack for the PDP type PPP (with PPP
termination).

Application Application

TCP/UDP TCP/UDP

IP

IP
IP
PPP
PPP

L2 L2

GPRS bearer L1 L1

MS SGSN/SLR GGSN/IPS ISP

Fig. 4.9 Packet transfer protocol stack for the PDP type PPP (with PPP termination)

PDP type PPP (with forwarding via L2TP encapsulation)

The PDP type point-to-point protocol (PPP) uses additional encapsulation components
which are performed by the Layer 2 tunnelling protocol (L2TP). L2TP will be used to tun-
nel PPP sessions. It allows that L2 end point and the PPP end point to reside on different
devices. These devices are called L2TP access concentrator (LAC) and L2TP network
server (LNS). The LAC interconnects the terminal equipment (TE) with the LNS via
L2TP tunnels. The LNS is the termination point of the PPP sessions. Interconnection be-
tween the LAC and LNS is a packet-switched network based on IP or ATM, for example.
For each PPP session an L2TP session from the LAC to the LNS will be established.
Such a configuration brings out the following advantages:
– L2TP might be used for accessing VPNs over an already existing infrastructure such
as the Internet. This solves the problem of overlapping IP address ranges and has
the advantage that there is no need to build up a private, expensive infrastructure
– if a subscriber is not in the home country of his ISP, he would have to use a long
distance call to his home country to access e.g., the Internet. You may use L2PT for
a cheaper access. In this case the subscriber calls the local LAC which extends the
PPP session over e.g., the Internet to the home ISP.
– from the LACs perspective there is no need to know about the networking protocol
which is encapsulated in PPP
If PDP type PPP is used, it is possible to tunnel the appropriate PPP sessions via L2TP
tunnels. For this reason, the GGSN/IPS has to act like a L2TP access concentrator
(LAC). In this type of configuration, the network layer protocol which is encapsulated in
PPP is not visible to the GGSN/IPS. Therefore, each L3 protocol used from the GPRS-
MS is supported by the SGSN and GGSN/IPS. Fig. 4.10 shows the packet transfer pro-
tocol stack for PDP type PPP (with L2TP tunnelling) using an IP network.

106 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Upper
Upper
layers
layers
e.g.,
e.g.
UDP/IP
UDP/IP

PPP PPP

L2TP L2TP

PPP UDP UDP

PPP
IP IP

L2 L2

GSS (packet domain bearer L1 L1

MS SGSN GGSN/IPS (LAC) ISP (LNS)

Fig. 4.10 Packet transfer protocol stack for PDP type PPP (with L2TP tunnelling -
over UDP/IP)

• Virtual private network (VPN) access of mobile subscriber using PPP/L2TP

Mobile subscribers also want secure access to private data at their homes and of-
fices. For this reason, it's essential to support Virtual Private Networks (VPN) by tun-
neling remote sites back to a central site. To enable “virtual dial-in” remote access
functions to any private PSDN encapsulation and tunneling mechanisms like the
Point-to-Point Protocol (PPP) and Layer 2 Tunneling Protocol (L2TP) have been de-
fined. PPP provides standard methods for the transport of packets between two
peers over point-to-point links (e.g., dial-in for connection oriented networks). PPP
is capable of encapsulating multiple protocols and provides easy connection of a
wide variety of hosts, bridges and routers. L2TP covers enhancements for PPP and
allows to tunnel the link layer of PPP access sessions within IP-based networks to
terminate them at any remote access server (RAS). L2TP access concentrator
(LAC) and L2TP network server (LNS) built therefore the tunnel endpoints.
PPP / L2TP provide the following enhancement of IP networks:
– Enhanced privacy and security over public IP-networks. The mobile subscribers
can only exchange VPN data with predefined destinations. For further security re-
quirements additional encryption may be practicable.
– Prevention of address conflicts with the use of private addressing schemes. In
case of extending private data networks over the public Internet the private ad-
dresses used within the private network could either be used by some other party
or be unknown in the public Internet. The isolation of address spaces of the public
and the private network prevents form addressing conflicts.
– Multi-protocol support of non IP-based PDN (e.g., SNA, IPX) is possible since the
complete layer 2 packets are transferred as payload within the IP network.
– Multi-provider support for connections across multiple IP-networks from different
network providers. VPN solutions have to enable interworking between multi-ven-
dor equipment and provide facilities for the exchange of information.
The GPRS mobile subscriber may use any private addressing schemes indepen-
dent from the underlying packet-switched domain and ISP network. Further L2TP
tunneling makes it possible to offer GPRS mobile subscribers and ISPs the use of
protocols encapsulated within PPP which else are not supported by GGSN/IPS,

A50016-D1111-V12-2-7618 107
System Description D900/D1800 Information
GPRS PLMN System

e.g., SNA, IPX. L2TP tunnel selection can be configured on a per access point name
(APN) basis (via NAS-ID) and in dependency on remote authentication dial-in user
service (RADIUS) authentication response. The user authentication of the tunneled
session can be carried out by network access server (NAS) or by network access
and L2TP network server (LNS). The tunnel itself will be authenticated separately
when the first session has to be established for this tunnel.
• Support of “virtual routers” for alternative VPN
Support of virtual routers is the foundation for connecting more than one Internet Do-
main (e.g., Internet service provider (ISP)) with its own unique IP address space to
the GGSN/IPS. The address spaces of several virtual routers are allowed to be over-
lapped. Each router has its own routing table including the possibility to define a de-
fault route. Beside one “management router” and one “public router” several “virtual
routers” will be supported. The availability and number of virtual routers depends on
the resources. Including the public and management router a maximum of 64 virtual
routers is supported. The router (public/virtual router) selection for a PDP context
will be done in dependency of the APN.

4.1.7 IP Header Compression

The number of available GPRS services is expected to increase rapidly, which will in
turn lead to an increase in the capacity allocation of GPRS-related channels in the Base
Station Subsystem (BSS). Compression techniques can help reduce the bandwidth re-
quired to be able to offer end users a reasonable level of service.
Much of the header information remains unchanged over the lifetime of a packet stream.
In the case of non-TCP packet streams, virtually all header fields remain constant. In the
case of TCP, many fields remain constant and others change with small and predictable
values. Header compression is a method used to reduce the overhead caused by infor-
mation elements in the header that are redundant or constant during the lifetime of a
packet stream.
The general principle of header compression is to occasionally send a packet with a full
header; the sender only transmits the changes the made to the header information
(compression) and the complete header is reconstructed at the receiving end (decom-
pression).
In the GPRS network, the header compression mechanism can be used to significantly
improve channel efficiency between the GPRS-MS and the SGSN at the subnetwork-
dependent convergence protocol (SNDCP) layer. (Fig. 4.11 shows the protocol struc-
ture of IPv6).

108 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

TCP/
UDP
IPv6 TCP/UDP
IPv6
IP header compression
SNDCP SNDCP GTP GTP
IP
LCC LLC UDP/TCP UDP/TCP

RLC RLC BSSGP BSSGP IP IP

MAC MAC
FR FR L2 L2 L2

GSM RF GSM RF L1 (E1) L1 (E1) L1 (E1)

GPRS-MS BSS SGSN GGSN/IPS

Fig. 4.11 TCP/UDP/IP header compression in SGSN

Header compression is an optional feature of the SNDCP layer. The SNDCP, as de-
scribed in the 3GPP standards, supports two algorithms:
• TCP/IP header compression according to RFC1144
One mechanism defined is the “van Jacobson header compression” according to
RFC1144. This compression algorithm is specifically designed to work well over
TCP/IP links with nontrivial packet-loss rates. This compression mechanism can be
used to significantly improve channel efficiency between the GPRS-MS and the
SGSN or between the GPRS-MS and the GGSN/IPS. TCP/IP header compression
is located in the SNDCP. It is applicable for N-PDUs containing TCP/IP packets.
• TCP/UDP/IP header compression according to RFC2507
Whereas the header compression algorithm according to RFC1141 only applies to
TCP/IPv4 headers, the header compression algorithm according to RFC2507 is de-
signed to work on TCP, UDP, IPv4, and IPv6 base and extension headers as well.
The usage of this feature is based on the ability of the GPRS-MS and the SGSN to sup-
port IP header compression. If the network is equipped with both SGSNs supporting IP
header compression and SGSNs without IP header compression support, this does not
lead to any restrictions because the IP header compression parameters are reset or re-
negotiated during handover.
For PDP type PPP, IP header compression is performed at PPP level, i.e., at the SND-
CP layer only data compression is to be negotiated and used. Negotiation of both head-
er compression and data compression is possible for PDP type IPv4 and IPv6.
User data compression can be used to reduce redundant information in the user data.
i One mechanism defined is the user data compression according to V42bis. This will be
located in SNDCP and is applicable for entire N-PDUs. This will be realized in future re-
leases.

4.1.8 IP Address Determination

The following two IP address-determinating methods are possible:
– Dynamic IP address allocation
– Static IP address.

A50016-D1111-V12-2-7618 109
System Description D900/D1800 Information
GPRS PLMN System

IP addresses can be assigned by the HPLMN, VPLMN or external PDN. The GGSN/IPS
has to allocate/release the dynamic PDN address.

Dynamic IP address allocation

In the case of transparent access (i.e. without RADIUS authentication, but GPRS user
authentication), the IP address can be assigned by the GGSN/IPS. For this, it is possible
to administer IP address ranges in the GGSN/IPS or by DHCP. The GPRS-MS obtains
its IP address from these ranges.
The IP address can be assigned either by the GGSN/IPS or by the RADIUS server for
non-transparent access (i.e. with RADIUS authentication). If the IP address is assigned
by the RADIUS server, this IP address is used for the GPRS-MS. If it is not given by the
RADIUS server, an IP address from the IP address range of the GGSN/IPS is used for
the GPRS-MS.
Besides the assignment of an IP address by a RADIUS server, the IP address can also
be assigned by dynamic host configuration protocol (DHCP) (see section 4.1.10).

Static IP address
The GPRS-MS may use static IP addresses in the GGSN/IPS either in transparent ac-
cess or in non-transparent access. The IP address of the GPRS mobile subscriber is ad-
ministered in the HLR.

Security
IP address filtering to the source IP address is performed. All packets with wrong source
IP addresses are discarded.

4.1.9 RADIUS Client (Non-Transparent Access to PDN (Internet))

In the case of non-transparent access, there is an additional authentication procedure
controlled by the packet data network (PDN) operator (i.e. Internet service provider
(ISP)). The GGSN/IPS initiates a RADIUS access procedure within the PDP context ac-
tivation. As a prerequisite, the ISP must provide and administer a RADIUS server.
Key features of RADIUS are:
– A network access server (GGSN/IPS) operates as a client of RADIUS
The RADIUS client is implemented by a network access server (NAS) that prompts
the user-ID and password. The RADIUS client is responsible for passing user infor-
mation (user-ID and password) to designated RADIUS servers, and is responsible
for acting on the response which is returned.
– RADIUS servers are responsible for receiving user connection requests, authenti-
cating the user and then returning all configuration information necessary for the cli-
ent to deliver service to the user.
– A RADIUS server can act as a proxy client to other RADIUS servers or other kinds
of authentication servers.
– Transactions between the client and RADIUS server are authenticated by using a
shared secret code which is never sent over the network. In addition, all user pass-
words are sent encrypted between the client and RADIUS server to eliminate the
possibility that someone snooping on an unsecured network could determine a us-
er’s password.
– The RADIUS server can support a variety of methods to authenticate a user. When
it is provided with the user name and original password given by the user, it can sup-
port special authentication mechanisms.

110 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Fig. 4.7 shows a RADIUS access procedure within the PDP context management de-
scription.

4.1.9.1 RADIUS Access in a WAP/MIA Environment

The wireless application protocol (WAP)/mobile Internet access (MIA) environment is
connected to a GGSN/IPS of the GPRS infrastructure. The WAP/MIA environment con-
sists of at least the WAP gateway, the firewall and the RADIUS server which can be lo-
cated somewhere in the domain of the GPRS PLMN operator. A connection to the
intranet is at least necessary.
Fig. 4.12 shows a RADIUS access procedure in a WAP/MIA environment which com-
prises an accounting functionality. The starting point of the RADIUS access procedure
occurs in the GGSN/IPS within the PDP context activation initiation.
1. The GPRS-MS connects to the MIA by activating a PDP context to the access point
name (APN) of the MIA in the GGSN/IPS.
2. This PDP context activation causes an authentication and accounting procedure to
start the RADIUS access procedure.
3. The GPRS-MS receives a temporary IP address of the MIA-owned IP pool. The
GGSN/IPS is in charge of managing the dynamic IP pool.
4. The RADIUS client within the GGSN/IPS is activated for this APN to request a RA-
DIUS authentication at the RADIUS server, send the MSISDN and a dynamic IP ad-
dress.
5. After receiving a positive acknowledgement from the RADIUS server, the GGSN/IPS
completes the PDP context activation to the addressed APN and the user can ac-
cess the WAP gateway.
6. The relation between the MSISDN and dynamic IP address is stored in the database
of the RADIUS server for further user identification at the WAP gateway and other
platforms.

Intranet Internet
1, 3

2, 4, 5 Router
SGSN/ 1, 3 GGSN/IPS Firewall Server
SLR (with
RADIUS
client 2, 4, 5
1, 3 (NAS))
4 6 RADIUS WAP
server gateway
BSS

1, 3
GSM radio interface

GPRS-MS

Fig. 4.12 RADIUS access procedure in a WAP/MIA environment

A50016-D1111-V12-2-7618 111
System Description D900/D1800 Information
GPRS PLMN System

4.1.10 Dynamic Host Configuration Protocol (DHCP) Client

The dynamic host configuration protocol (DHCP) may be used for the subscriber config-
uration. The subscriber’s IP address and the DNS server can be assigned by DHCP.
The 3GPP standards describes the functionality for remote dial-in clients with integrated
i DHCP client and without integrated DHCP client. In the current software version, only
remote dial-in clients without an integrated DHCP client are supported.

The GGSN/IPS supports the DHCP proxy client. If the GPRS-MS does not support the
DHCP, the GGSN/IPS must provide a proxy functionality (Fig. 4.13).

GPRS-MS GGSN/IPS DHCP

DHCP proxy server

(like a client)

Fig. 4.13 DHCP proxy client function

The following functions are also provided: the DHCP proxy client transmits to the remote
dial-in client, the client IP address and the first and second domain name server (DNS)
and the server IP address that is obtained from the DHCP sever via the Gi interface. The
possible time parameters are managed in the DHCP proxy client. Each DHCP proxy cli-
ent supports a primary and a secondary DHCP server.

4.1.11 Routing Functions on the Gi Interface and the Gn Interface

Routing protocols
In GGSN/IPS, the dynamic routing protocols open shortest path first (OSPFv2), routing
information protocol (RIPv2) and boarder gateway protocol 4 (BGP4) are supported if
required by the customer. The SIEMENS GSNs support OSPFv2 and RIPv2 as the in-
terior routing protocols. For the PLMN IP backbone, the routing protocol OSPF is the
more scalable choice that provides a faster convergence if the network topology is
changed. For the inter-PLMN connection, the Border Gateway (BG) may be connected
with direct lease lines to other VPLMNs or via intermediate IP networks using GBP4.

4.1.12 Inter-PLMN Configuration

The GPRS PLMNs of different operators are interconnected with Border Gateways
(BGs) using international IP backbones called GPRS Roaming Exchange (GRX).
3GPP R’4 definition: The Border Gateway (BG) is a gateway between a PLMN sup-
porting GPRS and an external inter-PLMN backbone network, which is used to intercon-
nect with other PLMNs that also support GPRS. The role of the BG is to provide the
appropriate level of security to protect the PLMN and its mobile subscribers. The BG is
only needed in PLMNs supporting GPRS.
This node must perform the following functions:
– Security functions for inter-PLMN network at IP level: IPsec, VPN, and ACLs (see
section 4.1.13, Secure Network Configurations).

112 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

– Interworking of inter-PLMN routing protocols with GRX and foreign PLMN routing
protocols: OSPF, BGP-4, and IS-IS interworking (see section 4.1.11, Routing Func-
tions on the Gi Interface and the Gn Interface).
– Interworking with other IP versions: IPv4 to IPv6 interworking: routing and address
mapping and address resolution (DNS interworking)
– Inter-PLMN QoS support based on different network technologies (ATM, FR, MPLS)
– Redundant network configuration for BG.

IP routing protocol interworking

The SIEMENS GSNs support OSPFv2 and RIPv2 as the interior routing protocols. For
the PLMN IP backbone, the open shortest path first (OSPF) routing protocol is the more
scalable choice, providing faster convergence if the network topology changes. From
the external PLMN, only the site router is visible as one IP-subnetwork and, if all sites
can be aggregated to one CIDR-subnet, only one routing entry exists for the complete
PLMN.
For the intra-PLMN configuration, OSPF can be configured in a two-tier topology with
one central OSPF area zero and separate OSPF areas for each site or with one flat
OSPF area with all network elements, a site router, and BGs.
The following figure shows the two-tier configuration, which is more scalable. The au-
tonomous system border router (ASBR) and the border router (BR) (see Fig. 4.14) can
be located in the BG.

Site 1
OSPF RA 101
Site 3
OSPF RA 102 Site 2
ABR OSPF RA 103

ABR ABR
ABR

OSPF Routing Zone

BR BR AS 400
Central site 0
OSPF RA 0

ASBR ASBR
Boardergateway Boardergateway R: Site Router
BGW: Boarder Bateway
GRX: GPRS Roaming eXchange
AS: Autonomous System
BR: Backbone Router
GRX ABR: Area Border Router
BGP-4 Routing Zone ASBR: AS Border Router
BG BG

Other BGP-4
BGP-4 Other
PLMN AS 300
AS 200 PLMN

Fig. 4.14 OSPF routing configuration for Gn/Gp

A50016-D1111-V12-2-7618 113
System Description D900/D1800 Information
GPRS PLMN System

For the inter-PLMN connection, the BG can be connected with direct leased lines to oth-
er VPLMNs or via intermediate IP networks using BGP-4 or IS-IS routing protocols.
Between PLMNs other than the home PLMN, the BGP-4 exterior protocol can be used.
The BG must perform the external BGP-4 protocol and the OSPF protocol used inter-
nally by the PLMN.
For MPLS based networks, a special extension of BGP-4 can be used to provide routing
updates in the event of link failure for MPLS based networks. The BG must support all
these features.

4.1.13 Secure Network Configurations

This section describes the IP security concept of the packet-switched domain of the mo-
bile Core Network. It addresses all important information security issues arising from:
– Usage of IP-based networks to interconnect the packet-switched domain network el-
ements
– Interconnection of the packet-switched domain with external IP based networks, in
particular the Internet
– Usage of potentially flawed implementations of "IP protocols" including IP, ICMP and
IP-routing protocols, IP-based transport protocols such as UDP and TCP, IP based
application protocols such as Telnet, FTP, HTTP or SNMP
All network elements providing IP-based interfaces and all types of IP based traffic are
considered:
– User traffic like GTP-U on the Gn interface or IP on the Gi interface
– Signaling traffic like GTP-C
(note: SS7 traffic in packet-switched domain is not IP-based in the current software
release and therefore not considered in this section)
– Control traffic like routing protocols or DHCP
– OAM traffic
– Charging traffic
– Traffic for lawful interception (LI)

Basic security considerations

In the traditional GSM world, security is associated with radio-access security and user
authentication (see also section 4.1.15). Time division multiplexed (TDM) based SS7
networks are closed networks with fixed configured routing tables and require no addi-
tional mechanism to secure the CN. ATM networks are also considered closed networks
that do not need additional security features. The introduction of IP packet-based net-
works for the mobile core network and the usage of service level agreements (SLA) be-
tween different IP operators has made security considerations necessary for the CN.
The network security must be provided with:
– Network separation at link layer with ATM and MPLS
– Confidentiality and authentication functionality at IP layer with IPsec
– Application layer filtering for DNS, GTP and routing protocol to external network in-
terfaces (Gi , Gp)
– All network elements nust provide separate management interfaces
Tab. 4.1 gives an overview of the security mechanisms used in IP networks.

114 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Security function Description

Link layer network separation at OSI L2-VPNs are ATM, FR or MPLS networks. This L2 separation of
layer 2 IP traffic requires a common L2 infrastructure.
L2-traffic separation provides protection from denial of services
(DoS) attacks.

IP network separation with IPsec or Link-layer independent traffic separation requires no L2 configu-
GRE ration changes in the backbone. The IPsec or GRE protocol must
only be provided in the end systems or in the IP router of the con-
nected networks.

IP access security with access lists Policy based routing provides traffic separation in one IP network
(ACL) and policy based routing (PBR) based on the source and destination IP-address and on the
source and destination TCP or UDP port number. PBR is an ex-
tension of the normal destination address based IP routing. ACLs
provides only traffic filtering based information fields in the IP and
UDP or TCP header.

Application security with statefull in- Firewalls analyze the complete IP packet including higher proto-
spection firewalls (FWs) col layers and prevent several well-known IP attacks. FWs are
transparent for the IP traffic.

Application security with application This security function is application dependent. The application
proxy between two IP nodes is terminated at this proxy and filter all non
application related IP packets. Proxies known as HTTP and FTP
proxies.

Tab. 4.1 IP security mechanisms

4.1.13.1 General Packet-Switched Configuration with IPsec

The IPsec functionality should be provided on the Gn interface, Gi interface, OAM, billing
and interception interfaces for SGSN and GGSN/IPS.
In the current software version, IPsec is used at the SGSN for charging and interception
i data.

Why IPSec?
The IPsec technology is independent of transport network and provides the same secu-
rity as accepted ATM and MPLS networks. The IPsec protocol is defined for transport
and tunnel mode and can be located in the router, special VPN gateways or in the net-
work elements itself.
The following figure shows the main VPN configurations with IPsec based VPNs.

A50016-D1111-V12-2-7618 115
System Description D900/D1800 Information
GPRS PLMN System

Router

IPsec

Router
integrated
Network
IPsec
element
Router
Router
IPsec Network
Network IPsec
element element

IPsec Router
Network
Network element
element IP network IPsec
Router
IPsec
IPsec
Network
Network
Separate element
element
integrated IPsec
IPsec device

Fig. 4.15 Main IPsec VPN configuration

IPsec can be used to connect multiple packet-switched sites over a multi-service back-
bone with an IPSec-capable router or separate IPsec gateways. The network redundan-
cy must be provided by a redundant router and gateway configuration.
Network elements with integrated IPsec functionality provide the highest level of security
because insecure IP access between network element and the IPsec functionality is not
possible. The strong authentication mechanism of IPsec can be used to authenticate the
network element itself. This is not possible if the IPsec functionality and the network el-
ement are separated.
The IPsec devices support extranet access. Extranet access means IPsec connection
between gateways with different managed networks. The IPsec devices must support
extranet access for the following networks:
– The PLMN interconnection between BGs of different PLMNs (GTP-C security)
– The connection between different IMS domains (SIP security)
– The Gi interconnection to different corporate ISPs
– VPN connection to different monitoring center (MC)/law enforcement agency (LEA)
for interception service

116 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.13.2 Network Security

The current ETSI/3GPP security architecture is focused on radio-access security (SIM
i key agreement and ciphering). For the SS7-based MAP protocol, the network domain
security architecture is defined by the 3GPP standards.
For IP-based signaling like GTP-C for the packet-switched domain and SIP for the IMS
domain, the 3GPP standards recommend the virtual private network (VPN) protocol IP-
sec for inter-PLMN signaling protection. In all 3GPP documents, IPsec is the recom-
mended protocol for the protection of any IP traffic in the mobile Core Network
(CN/GSS).
The usage of higher-level protection mechanisms (firewalls and intrusion detection sys-
tems) is not a focus of the standardization and must be provided by the normal IT infra-
structure.

The following Fig. 4.16 shows the main security mechanism used in the packet-
switched Core Network (CN/GSS).

Appl. service

Network service IMS domain

Go

FW
Internet

SGSN GGSN/ IPsec

RNS OAM VPN
IPS IPsec FW Corporate
ISP
Gi domain

Billing VPN

Gn VPN

BG + other
IPsec
SEG PLMN

BG +
GRX
Interception SEG
VPN
IPsec BG + other
SEG PLMN

PS core comain

Fig. 4.16 Packet-switched core secure configuration

Application separation:
• The SGSN, GGSN/IPS, and BG core elements divide the packet-switched domain
into completely separate networks.

A50016-D1111-V12-2-7618 117
System Description D900/D1800 Information
GPRS PLMN System

• The SGSN separates the Radio Access Network (RAN) for GPRS from the Core
Network (CN/GSS) at application level (GTP). Between the RAN and the CN/GSS,
no direct IP routing is defined.
• The GGSN/IPS separates the Gn "network" from the Gi/Go "network". The
GGSN/IPS acts as a remote access server (RAS) for the mobile user and only at-
tached subscribers with a public IP address can be accessed from the public Inter-
net. This direct Internet access must be protected with additional security functions
and filters.
• The BG+SEG separates the own PLMN from other PLMNs and roaming partners.
The main difference between the BG and the SGSN and GGSN/IPS is that the BG
acts as an IP router between the foreign networks. The protection of the internal net-
work must be provided by firewall and VPN mechanisms.

Packet-switched core domain security

The packet-switched Core Network (CN/GSS) is subdivided into the following IP net-
works with different security policies:
– Gn/Gp network
– O&M network
– Billing network
– Interception network
These networks may be separated with MPLS, ATM or IP virtual private network (VPN)
technologies like IPsec. From the security level these protocols are equal and it is up to
the PLMN operator to use these technologies. However, it is possible to combine ATM,
MPLS and IPsec in one network.
The O&M and billing network should not be not reachable from the Gn interface because
the Gn network is accessible from all roaming networks via the Gp interface.

Inter-PLMN domain security

The Border Gateway (BG) separates the PLMN from foreign PLMNs. All security func-
tionality must be provided with the BG or the separate collocated Security Gateway
(SEG).
The following security functions must be fulfilled from the BG:
• VPNs
IPsec based VPNs to other PLMNs for GTP-C (3GPP requirement).
• Service security
The BG must ensure that only GTP and DNS traffic from allowed roaming networks
passes the BG. All other traffic must be blocked with access lists (ACLs) and firewall
functionality.
The required IPsec interface for interception may be located in a separate node or is
i integrated part of the BG.

• Routing domain separation

The internal routing protocols must be separated from the external used routing pro-
tocols.

118 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

• DNS configuration rules

DNS is one of the most attacked services in the IP world. Several configuration rules
must be followed to keep the service secure. One of the most effective configura-
tions is the split DNS configuration for internal and external requests.
Split DNS means that the external DNS server is only reachable from external networks.
i The internal DNS server is only reachable from internal networks.

Gi domain security
For the Gi interface the security consideration are divided into the following parts:
• Gi-Gn separation
The GGSN/IPS does not allow direct IP routing between the Gi interface and the Gn
interface and terminates all IP traffic at GTP application level. All user traffic (IP or
PPP frames) is linked through associated GTP tunnels or is discarded if no GTP tun-
nel exists.
• Corporate ISP protection
For subscriber address allocation and accounting, the GGSN/IPS is connected to
ISP local services such as RADIUS and DHCP. These services must be protected
and separated from other IP networks. Corporate ISP access should be protected
with IPsec VPNs. The IPsec functionality can be integrated into the GGSN/IPS or is
provided by an external device.
• Subscriber protection
The subscriber traffic must be protected with firewalls and the subscriber must be
protected from DoS attacks.

Site configuration with IPsec

This chapter shows the different site configurations with separate IPsec devices, IPsec
devices integrated in network elements, and router-integrated IPsec.The IPsec config-
uration for the Gi interface is described in a separate chapter.
Common for all configurations is that the IPsec functionality shall not reduce the reliabil-
ity and the performance of the other services. The protocol overhead with IPsec must
be taking into account for the network planning.

• Site configuration with separate IPsec device

Separate IPsec gateways are normally located in an Ethernet environment between
the IP router and the network elements. The multiple internal used networks must
be separated ba a separate LAN infrastructure or a secure VLAN configuration. The
separate IPsec devices must provide at least one physical interface for each internal
network. The devices must be connected to the site router with redundant interfaces.
The separate IPsec gateways must process all IP traffic from the network elements,
even if only a small part of the traffic must be protected with IPsec. For security rea-
sons, all internal networks use different IPsec tunnels and can use the same IP in-
terface towards the site router. The use of separate interfaces may be required for
traffic engineering and performance issues.
Separate IPsec gateways must be doubled for non-interruptible network service.
Most of the gateways interrupt their service during upgrade or configuration chang-
es.

A50016-D1111-V12-2-7618 119
System Description D900/D1800 Information
GPRS PLMN System

Site A
Network
element
IPsec
Router
IPsec
Network
element

Fig. 4.17 Site configuration with separate IPsec devices

From the O&M handling, a "rack-integrated" IPsec device is the same as an external
i separate IPsec gateway.

• Site configuration with integrated IPsec devices

The integrated IPsec functionality has no influence on the local LAN configuration of
the site. The reliability and redundancy mechanism must be provided together with
the platform and interface reliability.

Site B Network
element

IPsec
Router

Network
element

IPsec

Fig. 4.18 Site configuration with integrated IPsec devices

• Site configuration with router integrated IPsec

The site configuration with IP router integrated IPSec functionality is shown in the
following figure.

120 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Site C
Network
element
Router

IPsec

Network
element

Fig. 4.19 Site configuration with router integrated IPsec

The redundancy mechanism of IPsec must fit into the redundancy mechanism of the
site router. If two site routers are used in load sharing manner, IPsec must provide
load sharing over two IPSec tunnels. If only one router is active, and the configura-
tion is hot standby, then IPsec must also support this mechanism. With the router
integrated IPsec, the IP network and the IPsec security configuration are managed
in one device.

• IPsec management
All IPsec devices are to be managed from a central system, which provides key man-
agement with pre-shared keys or certificate-based management and policy man-
agement.
The central IPsec management unit should be located in the O&M network, and all
IPsec devices must be reachable from this management unit. All error messages
and SNMP traps must be forwarded to a central alarm collection system.

4.1.14 QoS Support

4.1.14.1 Basic Quality of Service (QoS) Handling/Support

Basic QoS concept
• The requested QoS profile (stored in the HLR/HSS) included in the PDP context ac-
tivation request is compared with the subscribed QoS profile and negotiated be-
tween the GPRS-MS, the SGSN, and the GGSN/IPS. A mobile subscriber initiated
modification is not supported for GPRS.
• Uplink traffic: The BSC should provide traffic shaping of uplink user data traffic ac-
cording to negotiated QoS profiles.
• General traffic shaping: The SGSN and the GGSN/IPS provide traffic shaping of up-
link and downlink user data traffic according to QoS attributes, the current interface
condition, and node load conditions.
• The SGSN and the GGSN/IPS map the negotiated QoS profiles to different DiffServ
code points (DSCP) of the type of service (TOS) field of the IPv4 header at the Gn/Gp
and Gi interfaces.

A50016-D1111-V12-2-7618 121
System Description D900/D1800 Information
GPRS PLMN System

During a PDP context activation or modification phase, quality of service (QoS) support
provides mechanisms to negotiate QoS attributes for a PDP context within the GPRS
Support Nodes (GSNs) according to the capability and conditions of the GSNs and the
GPRS mobile subscriber’s contract. QoS support also includes the mapping of PDP
context-specific QoS attributes to lower layer QoS attributes. After establishing the PDP
context, the GSNs provide the correct handling of user (and signaling) traffic according
to the negotiated QoS profile.

4.1.14.2 Enhancement of Quality of Service (QoS) Handling

Without the feature “enhancement of QoS handling”, all PDP context requirements are
i handled with equal priority and a network facility check on SGSN rejects the traffic class
“interactive” and suggests the traffic class “background” instead.

This QoS enhancement feature provides the PLMN operator with the means to develop
different tariff models and to introduce different profiles for different subscriber require-
ments. In the HLR different QoS profiles of a GPRS mobile subscriber can be stored in
conjunction with different access point names (APN). With this option, the PLMN oper-
ator can distinguish its services from those of its competitors.
In general, the different QoS profiles can be characterized by one of the following four
classes:
– Conversational class
– Streaming classic
– Interactive class
– Background class.
The interactive and background classes are used by non-real-time applications and are
defined for GPRS. The interactive class is used by applications expecting messages (re-
sponses) within a certain time, whereas the background class is intended for applica-
tions such as file transfer or e-mails in the background in which the destination is not
expecting the data within a certain time.
The scope of the first two classes are non-real-time applications. For GPRS, only these
i two classes are defined. The best known use of the conversational class is voice or vid-
eo telephony. However, with the Internet and multimedia, a number of new applications
will require this layout, e.g., video conferencing. The streaming class is intended to sup-
port services such as real-time video (audio), which is one-way transport and very sen-
sitive to time variation between packages.

For each traffic class, QoS attributes are defined in the 3GPP R’99 and R’4 specifica-
tions. All QoS attributes, as defined in the 3GPP standards, can be interpreted by SIE-
MENS GSNs.
Within the scope of this basic QoS feature “QoS profile enhancement”, the GSNs sup-
port the non-real-time “interactive” and “background” traffic classes, as described in the
3GPP standards. At the Gb and Gn interfaces, the mapping of traffic classes to a DSCP
(differentiated service code point) or TOS (type of service) value is supported. Dedicat-
ed handling of signaling traffic is also supported.

QoS negotiation and resource reservation

During QoS negotiation, the GSNs verify that the requested QoS profile of a PDP con-
text matches the subscribed QoS profile (subscription check in SGSN only), the network
capability of the node (network facility check) and the available resources to support the
requested QoS (admission control and resource reservation). If the profiles do not

122 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

match, each GSN negotiates the requested QoS profile to the applicable lower values.
The result is a negotiated QoS profile. The QoS negotiation is executed first within the
SGSN. Afterwards, the negotiated QoS profile is handed to the GGSN/IPS that performs
its QoS negotiation based on the SGSN negotiated profile.
The SGSN supports mapping of 3GPP Rel’99 QoS attributes to Rel’97/98 QoS at-
tributes according to the specifications in the 3GPP standards.
The “allocation retention priority” (or “precedence class” for Rel’97/98) is used to deter-
mine the relative priority of a PDP context request with regard to other PDP context re-
quests in certain load situations. PDP context requests with a higher allocation retention
priority value take priority over PDP context requests with a lower value.

QoS parameter mapping

The current software version fully supports 3GPP R’99 and R’4 QoS attributes respec-
tively and provides backward compatibility to the R’97/98 parameters. GPRS QoS pa-
rameters are mapped to lower protocol layers, such as BSSGP and IP.
Session management (SM) determines the “radio priority level” of user data transmis-
sion (refer to the 3GPP standards) based on the negotiated QoS profile and delivers it
to the GPRS-MS during the PDP context activation and PDP context modification pro-
cedures. Because the radio priority level is only relevant for user data transmission over
the Gb interface, the appropriate priority level is derived from the supported non-real-
time traffic classes and the traffic handling priority or R’97/98 delay class respectively
(refer to the 3GPP standards).

Delay class Traffic class Traffic handling --> Radio priority

(R97/98) (R99) priority (R99) level

1 Interactive 1 --> 1

2 Interactive 2 --> 2

3 Interactive 3 --> 3

4 Background - --> 4

Tab. 4.2 QoS mapping table in case of GPRS

At the IP level (Gn interface), the traffic class is mapped to configurable DiffServ code
points (DSCP).
This mapping is administrable and set by default to the type of service (TOS) classes
“priority” and “best effort” in the last software version. In the current software version, the
default mapping is enhanced to DCSP (see Tab. 4.3). In addition, the DSCP setting is
supported on the Gi interface. This mapping on the Gi interface can be administered in-
dependent of mapping on the Gn interface.

QoS class Default DSCP

Signaling AF21 - 010010

Interactive AF11 - 011010

Traffic handling priority 1

Tab. 4.3 Mapping table GPRS QoS class to default DSCP in current software ver-
sion

A50016-D1111-V12-2-7618 123
System Description D900/D1800 Information
GPRS PLMN System

QoS class Default DSCP

Interactive AF12 - 011100

Traffic handling priority 2

Interactive AF13 - 011110

Traffic handling priority 3

Background BE - 000000

Tab. 4.3 Mapping table GPRS QoS class to default DSCP in current software ver-
sion

In IP networks with limited capacity, it is useful to introduce QoS classes according to

i which packets can be handled in the IP routers. Real-time services in particular require
QoS. In addition, the introduction of a premium class for business users, for example,
also represents a further possible advantage. The data related to a premium class has
higher priority in the PLMN. To enable QoS in a GPRS network, both the SGSN and the
GGSN/IPS support differentiated services (DiffServ). The GGSN/IPS supports these at
both the Gn interface and the Gi interface; the SGSN supports these services at the Gn
interface.

4.1.14.3 QoS Enhancements at 2G-SGSN and GGSN/IPS with DiffServ

The support of different services comprises an overall quality of service (QoS) concept
for the GPRS PLMN, which enhances the QoS concept of the previous software version.
It covers, in particular, QoS issues, such as packet handling and signaling aspects. The
proper packet handling is achieved by new DiffServ functionality (i.e. DiffServ schedul-
er).
This SGSN feature “QOS enhancements (DiffServ)” of the current software version only
supports the background and interactive QoS classes for GPRS. The “background” and
“interactive” traffic classes were supported by the previous software version. Additional-
ly, the “interactive” traffic class can be handled differently, according to the “traffic han-
dling priority” attribute. All QoS attributes, as defined in the 3GPP standards, are
supported.
The SIEMENS QoS concept and architecture in the current software version is based
i on the 3GPP Release 4 standardization work. The DiffServ functionality is also compli-
ant with IETF RFC 2474 and RFC 2475.

DiffServ
Differentiated services (DiffServ) is a protocol for specifying and controlling network traf-
fic by class enabling certain types of traffic to take priority over other types. A six-bit field,
known as the differentiated services code point (DSCP), in the Internet Protocol (IP)
header, specifies the per hop behavior of a given flow of packets. In general, the goal of
the DiffServ functionality is to determine shared SGSN resources on SP modules and
egress virtual connections (VCs) for packet flows of varying priorities. This is accom-
plished by introducing appropriate queuing/scheduling disciplines for these packet flows
at ingress and egress.
If DiffServ is used, the TOS class is unused. These are two different QoS mechanisms
for the IP layer. Only the TOS field of the IPv4 header is used for the transport of the
DSCP. At each GGSN/IPS, SGSN or backbone IP router, this DSCP is evaluated and
the packet is put in the according queue. Packets of higher priority are put in a queue

124 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

which is emptied faster and, in the event of overload, low- priority packets are dropped.
Subsequently, the packets are routed. In this way, it is possible to differentiate between
traffic flows. At the egress side (the way out), high-priority packets are sent first and, in
the event of overload, low-priority packets can be dropped. The GSS has to be config-
ured in such a way that packets that have made it over the GSM radio interface are nev-
er dropped in the GSS. This is only allowed for down-link packets and should occur
rarely.
This packet priority:
– Is set up by the mobile application (within SGSN, GGSN/IPS, or other PLMN entities
connected to the xGSNs) based on a GPRS traffic class.
– Can be fixed configured per VC, i.e. is packet-independent.
Egress DiffServ functionality also helps to avoid packet loss on congested VCs for traf-
fic, which requires a higher delivery guarantee as best effort, e.g., signaling traffic. In
general, incoming traffic on the Gb interface is limited by the GSM radio interface and
incoming traffic on the Gn interface is limited at the GGSN/IPS (i.e. via traffic limiter per
PDP context at the Gi interface). This limitation applies to single PDP contexts, but not
to the aggregated traffic on an interface.

Mapping of the QoS classes to DiffServ code points (DSCP)

The SGSN can internally differentiate three traffic classes. These classes represent the
four GPRS traffic classes “background”, “interactive”. An additional class is specifically
assigned for the signaling traffic. The class for the “interactive” traffic can be additionally
distinguished by three drop-precedence classes (according to AF classes). This drop
precedence represents the “traffic handling priority” of the “interactive” GPRS traffic
class.
The mapping between the GPRS traffic class and the DSCP used at the IP layer is the
basic mechanism of the current software version. The DSCP assigned to a traffic class
is specific to the external IP domain and can be configured per logical interface.

4.1.14.4 QoS Enhancements with MPLS

The GGSN type CPG-3300 itself does not support MPLS. Here MPLS can only be used
i with an additional router.

With multi protocol label switching (MPLS), certain label-switched paths (LSPs) are de-
fined through the network, either for QoS reasons or for the definition of VPNs. LSPs
can be established statically or dynamically. IP packets that belong to a certain “high-
priority class” obtain an additional MPLS header, which is evaluated at each router be-
fore the complete IP header is read. Based on the MPLS header only (i.e. without rout-
ing), the packet is switched at layer 2 towards the next hop in the LSP. On the one hand,
this means that the packet is handled faster by the router because no routing has to be
performed, and secondly that a path can be defined, for example, over over-dimen-
sioned routers, which are bottleneck-free.
Multi protocol label switching (MPLS) is a standardized technology that provides con-
nection-oriented switching based on IP routing protocols and labelling of data packets.
It is the integration of Layer 2 and Layer 3 technologies and is used in context of traffic
engineering, IP quality of service and virtual private networking. MPLS stands for “multi
protocol” label switching, multiprotocol because its techniques are applicable to any net-
work layer protocol, such as ATM, IP, Frame Relay, etc.
A router which supports MPLS is known as a “label switching router” (LSR).

A50016-D1111-V12-2-7618 125
System Description D900/D1800 Information
GPRS PLMN System

Label switched paths (LSPs) are typically set-up in the direction of an IP route/address
between MPLS edge routers of an MPLS domain. The path of an LSP will follow the nor-
mal IP route i.e. shortest path or may be explicitly specified by the ingress MPLS edge
router. Explicit paths require the traffic-engineering extension of e.g., resource reserva-
tion protocol (RSVP). An MPLS edge router is also called label edge router (LER) while
a core router without LSP end points is called label switching router (LSR).
Packets entering the MPLS domain are assigned a local label and an outbound interface
based on a local forwarding decision. The local label is attached to the packet via a light-
weight encapsulation mechanism. At the next MPLS switch, the forwarding decisions
are based on the incoming label value, where the incoming label determines the next
hop interface and next hop label, using a local forwarding table indexed by label. This
lookup table is generated by a combination of the locally used IP routing protocol, to-
gether with a label distribution protocol, which creates end-to-end transit paths through
the network for each IP destination.
The major observation here is that this lightweight encapsulation, together with the as-
sociated notion of boundary-determined transit paths provides many of the necessary
mechanisms for the support of traffic control including QoS. Each MPLS switch uses a
label-indexed forwarding table, where the attached label of an incoming packet deter-
mines the next hop interface and the corresponding label.
• MPLS-TE (traffic engineering)
MPLS-TE is currently regarded as the most interesting and urgent application of
MPLS. MPLS-TE provides means for service providers to optimize traffic forwarding
independent of the underlying layer 2 or layer 3 technology and regard constraints
for selecting the path. This can be utilized to redirect flows in order to use the net-
work resources efficiently, guarantee (or fulfill with high probability) resources or de-
lays.
MPLS as a multilayer switching technology combines traditional destination based
IP routing and ATM-like path based switching. MPLS takes the software control from
the IP router and integrates it with the forwarding performance and traffic engineer-
ing possibilities of a connection oriented (ATM-like) label swapping switch, thus pro-
viding the best of both worlds.
• MPLS-VPN (virtual private network)
The VPN realization allows the establishment of tunnels between two label edge
router (LER) through any MPLS enabled IP network. VPN, when used with MPLS,
allows several sites to transparently interconnect through a service provider's net-
work independent of the physical layer used. One network can support multiple dif-
ferent IP VPNs, each of which appears to its users as a private network. The
respective connections are isolated from the rest of the IP/MPLS network providing
it. Within a VPN, each site can send IP packets to any other site in the same VPN,
but are shielded from other users.

4.1.14.5 Resource Management (RM)/Admission Control

The resource management (RM) outlines the functionality that is required to perform an
admission control with respect to the QoS profile and an evaluation of the extent to
which subscriber requests can be granted.
It defines procedures for calculating which user data transport resources are required to
support the requested QoS parameters, the procedures to determine whether these re-
sources are available and the procedures to reserve these resources.

126 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Because the QoS profile defines QoS parameters between reference points R and Gi
and no methods have so far been defined on how to actually guarantee certain delays
or certain throughput rates, it is presumed that RM only has to consider the GSN re-
sources while the backbone network provides sufficient transmission capacity to never
become the limiting factor. It is currently presumed that differentiated services will be the
first QoS mechanism within the backbone network.
RM has interfaces with the session management (SM) and with the handover SG-
SN/SLR change.
Each time there is a PDP context activation request, SM first carries out a subscription
check in the SGSN/SLR to verify whether the requested QoS profile has equal or lower
QoS requirements than the subscribed QoS profile. It then carries out a network facility
check to verify whether the network node is able to support the requested service. In
case of a negative verification the QoS parameters are downgraded corresponding to
the current capabilities of the 2G-SGSN. The GPRS-MS is informed about the down-
graded QoS profile in the response to the GPRS-MS. After a positive verification, SM on
the SGSN/SLR triggers RM with the necessary QoS information to perform admission
control. Admission control determines whether the required transport resources are
available on SGSN/SLR and informs SM. The request is denied by RM if admission con-
trol fails. The SM on the SGSN/SLR generates a message to the GGSN/IPS. The
GGSN/IPS can further restrict the QoS negotiated according to its current load situation.
Finally, the SM on the SGSN/SLR informs the GPRS-MS about the changed QoS pro-
file. The GPRS-MS can either accept the modified QoS profile or initiate the PDP context
deactivation.

4.1.15 Radio-Access Security and User Authentication Functions

These security functions protect:
– access to mobile services and
– disclosure of information on the radio path.
These security functions safeguard:
– authentication of the GSM mobile subscriber;
– the confidentiality of the GPRS packet data on the GSM radio interface
(GPRS ciphering) and
– the confidentiality of the GPRS mobile subscriber identity (P-TMSI reallocation).

4.1.15.1 GPRS Authentication

For GPRS the authentication is performed in a way similar to that for non-GPRS opera-
tion, but is carried out by the SGSN/SLR. The SGSN/SLR requests the security triplets
from the HLR/AC itself and stores them.
The GPRS-MS may start the authentication procedure during requests, e.g., GPRS at-
tach, routing area update or PDP context activation.
Authentication procedure:
1. If the GPRS mobile subscriber data is not yet known to the SGSN/SLR, the SG-
SN/SLR also requests the triplets from the HLR with this data.
2. The HLR itself requests these triplets from the AC and sends the requested data to
the SGSN/SLR.
3. The SGSN/SLR sends the random number RAND of a triplet via BSS to the GPRS-
MS.

A50016-D1111-V12-2-7618 127
System Description D900/D1800 Information
GPRS PLMN System

4. The GPRS-MS calculates the value for the signed response SRES from the current
RAND with the aid of the values of algorithm A3 and the individual subscriber au-
thentication key Ki which are stored on the chip card (SIM). The GPRS-MS also cal-
culates the value of the cipher key Kc using RAND, A8 and Ki.
5. The GPRS-MS sends SRES to the SGSN/SLR.
6. The SGSN/SLR compares the SRES which was pre-calculated in the PLMN with the
SRES received from the GPRS-MS.
If the two SRESs match, GPRS authentication has been performed successfully. If
GPRS authentication was unsuccessful, an entry can be made in the security file of
the SGSN/SLR.
Fig. 4.20 shows the GPRS authentication procedure in the GPRS PLMN.

6
2
SGSN/ HLR AC
SLR 2
1
3 5

BSS

3 5

GSM radio interface

4
GPRS-MS

Fig. 4.20 GPRS authentication procedure

4.1.15.2 User Identity Confidentiality (P-TMSI Reallocation)

The purpose of this function is to exclude the possibility of an unauthorized person de-
termining which GPRS mobile subscriber is using a particular resource (radio channel)
on the GSM radio interface by monitoring the data exchange on the GSM radio inter-
face. This is intended to guarantee a high level of confidentiality for user and signaling
messages, while also offering protection against tracking the subscriber's position. For
this reason, the IMSI is replaced in the authorized SGSN/SLR by a P-TMSI which can
be changed during the GPRS attach and routing area update procedure. The P-TMSI is
unique in the SGSN/SLR service area.
To secure the confidentiality of the user identity, GPRS uses a so-called temporary log-
ical link identity (TLLI). The TLLI is handled in the same way as the TMSI for non-GPRS
operation but is assigned by the SGSN/SLR and identifies the GPRS-MS (IMSI) unam-
biguously within a routing area. The TLLI is only known by the GPRS-MS and the SG-
SN/SLR and may be changed while the GPRS-MS is attached. The TLLI is exchanged
by the routing area update messages.

128 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.15.3 User Data Confidentiality (GPRS Ciphering)

The confidentiality of GPRS packet data on the GSM radio interface is a function by
means of which the user information exchanged on the traffic channels is not made
available or revealed to unauthorized persons, bodies or processes.
This function protects the confidentiality of user information on GSM radio interface traf-
fic channels by GPRS ciphering the GPRS packet data on the GSM radio interface. This
GPRS ciphering of the GPRS packet data information extends only to the path GPRS-
MS to SGSN/SLR and not to the entire packet-switched services distance. The end-to-
end protection of user data is the responsibility of the user.
This is in contrast to the standard GSM ciphering, which is done on the logical channel
i between MS and BTS.

The cipher key Kc is computed in the GPRS-MS (chip card with SIM) during the authen-
tication procedure described in section 4.1.15.1 (in Fig. 4.20) with the aid of the individ-
ual subscriber authentication key Ki, the random number RAND and algorithm A8 of the
cipher key Kc. This means that this parameter is also available in the GPRS-MS without
having to be sent via the GSM radio interface. On the PLMN side, the SGSN/SLR is re-
sponsible for GPRS ciphering where the required Kc is available.
After authentication, both sides can begin GPRS ciphering of the messages to be sent
via the GSM radio interface. The GPRS ciphering algorithm GEA1 (GPRS encryption
algorithm) is used for GPRS ciphering.
Generally speaking, the 2G PLMN supports two defined variants, i.e. GEA/1 and GEA/2.
On the GSS sides, the algorithm variants GEA/1 and GEA/2 are supported in one and
the same GPRS PLMN simultaneously. In this way, it is possible to operate a GSM
phase 2+ PLMN which can drive all the existing mobile stations.

4.1.16 Roaming
Roaming means that the GPRS mobile subscriber can move freely within a Public Land
Mobile Network (PLMN) or in the international GSM/GPRS service area. The GPRS mo-
bile subscriber always remains accessible, subject to any allocated roaming restrictions,
and can set up outgoing circuit-switched calls or packet-switched sessions at any time
(provided these possibilities are not barred with the supplementary “traffic restrictions”
services) and receive incoming circuit-switched calls.
During the attach and routing area update (RAU) procedure - before any subscription
restriction check is performed - the visited SGSN/SLR first verifies if restrictions related
to international and national roaming agreements apply by checking the appropriate da-
tabases.
1. Roaming restrictions on the basis of the definition of international roaming agree-
ment
The service providers of several PLMNs, belonging to different countries, can decid-
ed according to international roaming agreements. This type of agreement offers
GPRS mobile subscribers the ability to access standard services at specific loca-
tions outside their home PLMN and in a PLMN outside their own country.
2. Roaming restrictions on the basis of the definition of national roaming agreement
The service providers of several PLMNs, belonging to the same country, can decide
on national roaming agreements. This type of agreement offers GPRS mobile sub-
scribers the ability to access standard services at specific locations outside their
home PLMN or equivalent PLMN, but still in a PLMN of their own country.

A50016-D1111-V12-2-7618 129
System Description D900/D1800 Information
GPRS PLMN System

3. Roaming restrictions on the basis of the definition of flexible roaming

A service provider can also use the optional “flexible roaming” feature. This feature
allows the provider to choose which categories of roaming subscribers can roam on
which networks. This feature is more advanced than national roaming services.
4. Roaming restrictions on the basis of the network access subscription / subscription
restriction
When GPRS mobile subscribers are roaming, the HLR always checks the UMTS
subscription/ subscription restriction before informing the visited SGSN/SLR that the
location update is accepted. The network access subscription/subscription restric-
tion is entered in the HLR, where it is stored in each GPRS mobile subscriber’s data
records.
GPRS mobile subscribers are administered in the HLR in a collocated subscriber data
i records together with GSM mobile subscribers.

The “flexible network access control” feature and its subfeatures “flexible roaming”,
i “Barring of foreign 3G access only” and “network access subscription”, and the “equiv-
alent PLMN list” feature are in principle 3G features. This section, however, provides a
complete overview and describes the whole roaming administration and function for in-
frastructure sharing of 2G and 3G PLMNs (see also section 4.1.17).

Flexible network access control

This feature allows PLMN operators to control network access of GPRS mobile sub-
scribers depending on their:
– Access subscription (allowed access type)
– Access type (attach/RAU via Gb:2G or via Iu:3G)
– Current location (location area code)
– Membership in a class of subscriber, identified by their IMSI* (this is a partly qualified
IMSI)
A new database has to be created to have an administrable base for the allow/restrict
decision. This enables operators to allow or restrict network access of visiting and/or
their own GPRS mobile subscribers in a very flexible way.
For example, a 3G (UMTS) subscriber can roam in a 2G area, whereas a 2G
(GSM/GPRS) subscriber is restricted to roaming in a 2G area only. This can be en-
hanced by restricting roaming of the 2G subscriber to special 3G areas (e.g., near an
airport), whereas the same 2G subscriber can roam in a 3G area which is not a special
3G area (e.g., in a city). It also allows the PLMN operator to administer the sharing of
their network resources with other PLMN operators (e.g., a PLMN operator is able to al-
low the network access of a visiting subscriber only via 2G equipment but not via 3G
equipment).
Network access control can be divided into 4 subfeatures or practical applications:
• National/International roaming
Mobile country code (MCC) and mobile network code (MNC) (as a part of the IMSI*)
and LAC depending (SGSN administered)
• Flexible roaming
IMSI*, LAC and access type depending (SGSN administered)
• Barring of foreign 3G access only
Access type depending (SGSN administered)
• Network access subscription
IMSI and access subscription dependent, whereas a previous SGSN based IMSI*

130 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

and LAC selection is made via database query (HLR administered, HLR: response
is strictly subscriber related)
The first criterion to allow/restrict network access (except for the barring of foreign 3G
access subfeature) is the so-called IMSI*. This is the first part of a normal IMSI which
includes all IMSIs starting with the same digits as the IMSI*. This criterion is used for
three of the subfeatures. A special handling for the IMSI parts MCC & MNC will be done
for the subfeature national/international roaming. Additionally, the target LAC is used as
selection criteria for performing network access checks, too.
The “barring of 3G access” subfeature can be fully covered by the “flexible roaming” fea-
ture (with an appropriate database). It therefore makes no sense to activate both fea-
tures at the same time. These features are not independent of each other; they are
placed in a hierarchy:
1. International roaming
2. National roaming
3. Flexible roaming
4. Network access subscription
Depending on what other features are released, the criteria and the granularity for the
subscription checks vary. In other words: If “network access subscription” is released to-
gether with “international roaming”, the result is not just the sum of both subfeatures, but
a new quality of the “network access subscription” subfeature (e.g., IMSI and LAC de-
pendent). Tab. 4.4 shows the parameter used for the subscription check.

Feature International National Flexible Network access

roaming roaming roaming subscription

standalone MCC, LAC MNC, LAC LAC, access type access type,
subscription

international LAC, access type, access type,

roaming released MCC subscription,
MCC, LAC

national roaming LAC, access type, access type,

released MNC subscription,
MNC, LAC

flexible roaming access type,

released subscription,
LAC, re-evaluation
of subscription
possible

Tab. 4.4 Interworking of the subfeatures (parameters of the subscription check)

To allow/restrict 2G or 3G access for foreign subscribers using the “flexible roaming”

subfeature, the “International/national roaming” subfeature(s) must also be enabled.
The “network access subscription” feature can be administered independently of the
other features, but if neither the “international/national roaming” or “flexible roaming”
features are subscribed, the preselection according to IMSI* and LAC within the SGSN
cannot be performed (due to no database query). This means that the “network access
subscription” check is performed for all incoming requests.

A50016-D1111-V12-2-7618 131
System Description D900/D1800 Information
GPRS PLMN System

The features that are LAC dependent (“international / national / flexible roaming and net-
work access subscription”) are only available at location or roaming area level. To re-
duce database administration, one database is used to administer all subfeatures.

International/national roaming agreements

International/national roaming includes the option of restricting the use of telecommuni-
cation services for GPRS mobile subscribers who are located in a PLMN other than their
home PLMN in their individual SGSN/SLR area. A restriction of this type is defined at
the location areas level in the relevant SGSN/SLR network node.
International/national roaming controls access of foreign national or international mobile
subscribers to the VPLMN, depending on their mobile country code (MCC) and mobile
network code (MNC) within a special identified location area.
The “national roaming” subfeature is only available for national applications. This means
that the MCC of the mobile subscriber IMSI has to be the same as the MCC of the SGSN
identification. The “international roaming” subfeature also allows network access of mo-
bile subscribers with different MCCs.
Whenever an MS initiates an attach or routing area update (RAU), the SGSN evaluates
the IMSI (to have MCC+MNC) as soon as it is available (before authentication). It eval-
uates the LAC and queries a database whether the GPRS-MS is allowed to roam. If
roaming is not allowed, the reject cause is a part of the database and can be adminis-
tered. IMSI/TMSI mismatch can cause GPRS mobile subscribers to be rejected who are
actually allowed to use the requested service. If roaming is not usually allowed, the
cause value 13 (included in the RAU_reject and attach_reject messages) is adminis-
tered in the database. The 3GPP standard describes this cause.

Flexible roaming
This feature enables a PLMN operator to allow/restrict network areas for its own or for-
i eign subscriber categories (access type specific) and, therefore, offers an additional
means of optimizing network resources.
This feature can be used for certain infrastructure sharing scenarios (see also section
4.1.17), whereas infrastructure sharing in general is one of the most powerful tools for
optimized resource management.
Infrastructure sharing is a very important measure to speed up network roll-out and, at
the same time, achieve considerable CAPEX and OPEX savings.
Infrastructure sharing scenarios: e.g., roaming cooperation between two or more nation-
al PLMN operators.

The “flexible roaming” subfeature supports the introduction of a UMTS network. “Flexi-
ble roaming” controls the use of the access type (Gb or Iu Interface). In principle, a 2G
subscriber is able to attach a network via the Gb (or Iu) interface and a 3G subscriber is
able to attach a network via the Iu (or Gb) interface. The signaling does not provide an
indicator of a 2G or 3G subscription. The SGSN does not contain information about
whether attaching mobile subscribers have a UMTS or GPRS subscription in their com-
mercial contract with the HPLMN operator. Technically speaking, there is no distinction
between a 2G and a 3G subscription. The flexible roaming subfeature is designed to
map the commercial roaming agreements (use of access types) into the SGSN.
Flexible roaming is a new function which allows a PLMN operator to allow/restrict roam-
ing in its PLMN, or in certain areas of its PLMN (areas to be defined on LAC granularity)
for all roaming GPRS mobile subscribers (i.e. own mobile subscribers, foreign national

132 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

mobile subscribers and foreign international mobile subscribers), depending on four cri-
teria:
– Type of subscription (2G or 3G; only applicable in combination with the general sub-
scriber subscription)
– Type of the used access interface (Gb, or Iu interface)
– Location (LAC)
– Home PLMN (i.e. the MCC/MNC has to be evaluated)
The SGSN compares the first digits of the IMSI with a number tree and detects whether
there is an entry for the IMSI and the LAC. If there is an entry, it contains control data
for the flexible roaming service logic, such as the granted access type and an access
reject cause (included in the RAU_reject and attach_reject messages). The cause will
be administered by the PLMN operator, a default cause must be defined in compliance
with the 3GPP standards.
Flexible roaming is applicable for GSM/GPRS and UMTS; however, it provides the
greatest benefits in a combined GSM/GPRS/UMTS network. It needs to be implement-
ed in all SGSN/SLRs.
If the network consists of a circuit-switched domain and a packet-switched domain (i.e.
GPRS PLMN), it is also recommended that the equivalent circuit-switched feature is
used.

Barring of foreign 3G access

This subfeature allows the PLMN operator to bar all incoming requests via 3G equip-
ment from foreign mobile subscribers. “Foreign mobile subscriber” means all mobile
subscribers who have a different MCC or MNC. The subfeature is only active if the “in-
ternational/national roaming” and “flexible roaming” features have been enabled, other-
wise barring can be administered in the new database.

Network access subscription

The “network access subscription” subfeature enables network access to be allowed,
depending on the accessed resources (Gb or Iu) compared with a date stored in the HLR
of the mobile subscribers.
The main difference between the “network access subscription” and the “flexible roam-
ing” subfeature is that the allowed access type for “network access subscription” is
stored centrally in the HLR and is mobile subscriber dependent. For the “flexible roam-
ing” subfeature, this information has to be entered in each database of the affected SG-
SN.

Subscription restriction
The PLMN operator can issue the following roaming restrictions for all GPRS mobile
subscribers in the HLR within the context of what is known as a subscriber agreement
(see also System Description D900/D1800, GSM PLMN):
• Roaming in all GSM/GPRS PLMNs nationally and internationally
• Roaming only for the MS's individual national GSM/GPRS PLMN and all other inter-
national GSM/GPRS PLMNs
• Roaming exclusively in the individual PLMN
The basis of this subscriber agreement (subscription restriction) is a roaming agreement
between the home PLMN (HPLMN) and the diverse PLMNs (VPLMN) that are visited.
An international service area encompasses several national GSM/GPRS service areas
with one or more PLMN and corresponding administrative agreements between the

A50016-D1111-V12-2-7618 133
System Description D900/D1800 Information
GPRS PLMN System

PLMN operators. A prerequisite for international roaming is the use of signaling system
no.7 (SS7) in the international telephone network.

Equivalent PLMN list

Under normal circumstances, GPRS mobile subscribers are dedicated to their home
PLMN, and the visited PLMNs are owned by only one PLMN operator and are identified
by a single combination of mobile country code (MCC) and mobile network code (MNC).
In the telecommunications world of today, there is, however, a need for MSs to handle
a number of PLMNs in the same way.
Call procedure:
The SGSN/SLR (2G, 3G, or 2G/3G; applicable for GPRS and UMTS) provides an
“equivalent PLMN list” during the attach and routing area update (RAU) procedures. The
members of this list are handled by the GPRS-MS as equivalent to each other. The code
of the equivalent PLMN list which has to be sent during the attach and routing area up-
date (RAU) is always added to the list. This mechanism makes a VPLMN equivalent to
the HPLMN for the network selection process, for cell selection and reselection process-
es, and handover.
In handling of combined procedures (Gs interface), only the equivalent PLMN list of the
i SGSN is downloaded.

It allows the GPRS-MSs of multiple PLMNs to select a shared RAN or a shared network
equivalent to their HPLMN, even if it indicates a VPLMN code. Moreover, it allows the
“handing over” of MSs to another defined PLMN when the GPRS-MS leaves a PLMN
coverage and enters the coverage of another PLMN. The roaming agreements can be
mapped into the list. The GPRS-MS stores the list provided by the PLMN, except that
any PLMN code that is already in the “forbidden PLMN' list” is removed from the “equiv-
alent PLMNs” list before it is stored by the MS. In addition, the MS adds the PLMN code
of the network that sent the list to the stored list. All PLMNs in the stored list are regarded
as equivalent to each other for PLMN selection, cell selection, and cell reselection. The
stored list in the GPRS-MS are replaced each time the attach accept message and rout-
ing area update (RAU) accept message are sent. If no list is contained in the message,
then the stored list in the GPRS-MS is deleted. The GPRS-MS stores this list while it is
switched off so that it can be used for PLMN selection when it is switched on.
The GPRS-MS does not change to its home PLMN from a RAN which broadcasts a vis-
ited PLMN (VPLMN) code if the GPRS-MSs home PLMN (HPLMN) code is in the equiv-
alent PLMN list. This mechanism makes a VPLMN equivalent to the HPLMN for PLMN
selection, cell selection and cell reselection.
Additionally, this function enables international PLMN operators to define their different
PLMNs in different countries as equivalent to each other regarding international roaming
of their mobile subscribers.
If the PLMN consists of a circuit-switched domain and a packet-switched domain (that
is the case if an GPRS PLMN is collocated to GSM PLMN), the equivalent circuit-
switched feature must also be implemented.

134 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

The equivalent PLMN list feature is required for certain infrastructure sharing scenarios
i (see also following section 4.1.17), whereas infrastructure sharing in general is one of
the most powerful tools for optimized resource management.
Infrastructure sharing on its part is a very important measure to speed up network roll-
out and to achieve considerable CAPEX and OPEX savings at the same time.
Infrastructure sharing scenarios: Roaming cooperation, (Core/GPRS Switching Sub-
system) Network sharing. Global PLMN operators which operate various PLMNs in dif-
ferent countries.

4.1.17 Sharing of PLMN Resources (Infrastructure Sharing)

To reduce investment for network equipment and allow fast service coverage roll-out,
the sharing of PLMN resources is becoming important for new networks. The different
scenarios and their relevance for the GPRS Switching Subsystem (GSS) (or Core Net-
work (CN)) are summarized in the following table:

Shared Site NodeB Multi- Multiple RAN at Common shared Roaming

resource /BTS operator one SGSN / network cooperation
RAN Multi-operator CN

GSS/CN no no no yes yes yes

affected

GSS/CN --- --- --- Equivalent PLMN Equivalent PLMN Equivalent PLMN
related list list list
features

National/flexible National/flexible National/flexible

roaming roaming roaming

Iu flexibility *) Inter-system and Inter-system and

inter-PLMN han- inter-PLMN han-
dover dover

*) The feature Iu flexibility is not available with the current software version (it is first specified with 3GPP
R’5 feature from standardization).

Tab. 4.5 Methods of infrastructure sharing and GSS/CN relevancy

In practice, the different methods shown in Tab. 4.5 can be combined for a specific sce-
nario/configuration. Network sharing and roaming cooperation are summarized as fol-
lows:
Both variants (equivalent PLMN list (see section 4.1.16), national/flexible roaming (see
section 4.1.16)) do not request any new type of interface in terms of the GPRS Switching
Subsystem architecture. Network sharing and roaming cooperation are based on circuit-
switched/packet-switched entities (see line GSS/CN related features in Tab. 4.5). The
main difference is the use of an additional third common used network (RAN and
GSS/CN) for shared network configuration. In both cases, different roaming and han-
dover related functionality of both packet-switched and handover entities is required.
Network sharing:
The shared network can have direct access to partner networks for circuit-switched mo-
bile originating calls (MOC) or packet-switched session setups of shared network roam-
ers. The use of the shared network point of interconnection (POI) for circuit-switched
mobile terminating calls (MTC) delivery seems only to be useful in the case of a config-

A50016-D1111-V12-2-7618 135
System Description D900/D1800 Information
GPRS PLMN System

uration where the shared network offers exclusively 3G (PLMN of operator A and B sup-
port only 2G), and 3G access is handled with a separate numbering scheme (a separate
UMTS subscription is recommended). In addition to the IN/CAMEL dependency for the
shared network, the interrogation tables are to be updated accordingly to operator A and
B within the shared network entities (Fig. 4.21 shows a configuration where only outgo-
ing calls are handled by the shared network).
Fig. 4.21 shows an example of a principle configuration where two PLMN operators use
an additional third network for common use – as shown here, a 3G network. This net-
work can be provided by operator A, operator B, or a third party. Appropriate roaming
and handover mechanisms are applied for user traffic routing/control. Additional fea-
tures for service differentiation can only be provided on IN/CAMEL basis because SCP
and HLR are always non-shared entities and therefore not part of the shared network.

2G/3G-SGSN BSC BTS

HLR, SCP GSS/CN A RNC NodeB

Operator A
User traffic
to/from Handover and roaming related
partner traffic to/from shared networks
Other networks (PSTN, ISDN, PLMN)

networks

3G-SGSN RNC NodeB

CN A, B Shared 3G network
(Operator AB)

User traffic to/from Handover and roaming related

partner networks traffic to/from shared networks

HLR, SCP GSS/CN B

BSC BTS

2G/3G-SGSN RNC NodeB

Operator B

Fig. 4.21 Network sharing configuration example

Roaming cooperation:
Roaming agreements/functionality in the single network elements are a prerequisite of
roaming. In terms of the GPRS Switching Subsystem (GSS)/Core Network (CN) (net-
work configuration, interfaces, point of interconnection), no new considerations are nec-
essary.
Fig. 4.22 shows a scenario, where operator B is a Greenfield with support of 3G exclu-
sively. A roaming cooperation with operator A guarantees area wide coverage for oper-
ator B from the outset. In contrast to the network-sharing scenario, there are no common
network resources. Both networks are fully independent of each other. Like network
sharing, a roaming agreement and the corresponding support of handover/roaming fea-

136 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

tures within the CNs of both operators represent the functional basis. In both cases, the
related traffic share has to be considered for the regarding point(s) of interconnection
(POI).

2G/3G-SGSN BSC BTS

Other networks (PSTN, ISDN, PLMN)

HLR, SCP GSS/CN A RNC NodeB

Operator A
User traf-
fic to/from Handover and roaming related
partner traffic to/from roaming partner
networks

HLR, SCP GSS/CN

CN B

3G-SGSN RNC NodeB

Operator B

Fig. 4.22 Roaming cooperation configuration example

A50016-D1111-V12-2-7618 137
System Description D900/D1800 Information
GPRS PLMN System

4.1.18 Packet Data Routing in the Uplink Direction

With an established mobile-originated packet-switched service, a transfer in the uplink
i and downlink direction is possible. A packet-switched data service is set up by a PDP
context activation. If a PDP context is activated, the GPRS-MS, the SGSN network el-
ement, and the GGSN/IPS hold a routing context. This enables packets to be trans-
ferred in the uplink and downlink directions.
Here, each routing is characterized by a GSM basic telecommunication service (bearer
service).

Packet data routing in the uplink direction refers to outgoing data packets from a GPRS-
MS to a packet data network (PDN). With a normal session setup, the packet data units
(PDUs) are routed in accordance with the destination IP address.

Packet data routing procedure

1. The GPRS-MS forwards the packet data units (PDUs) to the SGSN/SLR. In addition,
it provides its identification (TLLI) and an index to the used routing context (NSAPI).
2. The SGSN/SLR itself searches in its database for a valid entry of the indicated
GPRS mobile subscriber. If a valid entry is found, the PDU is encapsulated and for-
warded to the GGSN address which matches the database entry.
3. The GGSN/IPS decapsulates the PDU and directs it to the Gi interface of the appro-
priate ISP/PDN.
Fig. 4.23 shows the packet data routing procedure in the uplink direction to a PDN sub-
scriber/server.

Sending GPRS
subscriber PLMN
(GPRS-MS)

BTS/BSC(PCU)

1 Receiving
BSS host/server
GSS

SGSN/SLR GGSN/
2 IPS 3

Gi

Fixed PDN (e.g., Internet)

Fig. 4.23 Packet data routing procedure in the uplink direction to a PDN subscrib-
er/server

138 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.19 Packet Data Routing in the Downlink Direction

Packet data routing in the downlink direction refers to incoming data packet units
(PDUs) to a GPRS-MS from a PDN.
The sending host/server does not need to know the current routing area (location) of the
GPRS-MS subscriber for a packet-switched service in the downlink direction. The
GPRS mobile subscriber is accessible everywhere in the GPRS PLMN by sending its
IMSI (associated with its current IP address).
If the GPRS-MS is in the STANDBY mobility management state (i.e. the radio cell is not
known in the SGSN/SLR, only the routing area is known - see section 4.1.1), the SG-
SN/SLR pages the GPRS-MS before a downlink transfer is started.
Fig. 4.24 shows the packet data routing procedure in the downlink direction (with the
routing origin in the fixed PDN).

Packet data routing procedure

The forwarding of the packet data unit (PDU) to the GPRS-MS takes place in two stages.
The GGSN/IPS knows only the address of the SGSN/SLR which serves the GPRS-MS,
while the SGSN/SLR knows the precise routing area (location) of it. If the GPRS-MS is
in the READY state, the radio cell (cell ID) is also known in the SGSN/SLR.
1. Via IP routing, a packet data unit (PDU) for a GPRS mobile subscriber arrives at the
Gi interface of the packet-switched domain at the GGSN/IPS.
2. First, the PDU is processed by the GGSN/IPS, i.e. the GGSN/IPS views the IP ad-
dress of the PDU and knows the corresponding GTP tunnel in the direction of the
SGSN network element. The GGSN/IPS searches its database for an entry that cor-
responds to the packet data protocol (PDP) and address of the received PDU.
3. If it finds a valid database entry, the GGSN/IPS forwards the PDU to the SGSN/SLR
by means of the GPRS tunneling protocol (GTP) encapsulation function. In addition,
it provides the tunnel endpoint identifier (TEID) which corresponds to the routing
context in the SGSN/SLR. If the GGSN/IPS cannot find a database entry, the PDU
is discarded.
4. If the PDU arrives at the SGSN/SLR, the database entry that matches the corre-
sponding TEID is searched for. This entry contains the necessary information (rout-
ing area (location) of the GPRS-MS, TLLI and NSAPI) to forward the PDU over the
radio interface to the GPRS-MS.
5. If the GPRS-MS is in the STANDBY state, the SGSN/SLR initiates paging to deter-
mine the location of the GPRS-MS.
6. Upon receipt of the paging request, the GPRS-MS answers with an LLC packet. The
SGSN/SLR then knows the exact location (radio cell) of the GPRS-MS.
7. Finally, the downlink PDU is sent to the GPRS-MS.

A50016-D1111-V12-2-7618 139
System Description D900/D1800 Information
GPRS PLMN System

Receiving
GPRS
subscriber
6, 7 PLMN

BTS/BSC(PCU) BTS/BSC(PCU) BTS/BSC(PCU)

5 5 6 7 5
BSS

GSS

4 SGSN/SLR

2 GGSN/IPS
1
Gi Sending
host/server

Fixed PDN (e.g., Internet)

Fig. 4.24 Packet data routing procedure in the downlink direction (with routing origin in the fixed PDN)

140 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.20 Handling of GPRS Mobile Data Services

The bearer services provide the necessary basis for the operation of data services. In
the GPRS Switching Subsystem, all bearer service connection setups are PTP bearer
services.
The SGSN/SLR provides the GPRS mobility management (GMM) function for this ser-
vice. The GMM performs the attach procedure of the GPRS-MS within the SGSN/SLR.
After completion, the GPRS-MS and its subscriber data is known to the SGSN/SLR.
After a successful attach procedure, the GPRS-MS is able to request a GPRS data ses-
sion. This request is processed by the session management (SM) in the SGSN/SLR.
The SM checks the requested service against the subscriber data and the network fa-
cility. If the check is successful, a PDP context will be created and the SM of the
GGSN/IPS will be contacted. Either the ISP assigns the IP address or the SM of the
GGSN/IPS assigns an IP address (see 4.1.8) and creates a PDP context too. The as-
signed IP address will be sent to the SM of the SGSN/SLR which puts it into its PDP
context and sends it to the GPRS-MS. After confirmation the PDP context is set to ac-
tive. The session has now been set up and the GPRS-MS is able to exchange packet
data units (PDUs) with the specified PDN.
Fig. 4.25 shows the protocol model for packet data transmission with the GPRS point-
to-point bearer service (PTP) or the traffic channel in the GPRS network.
The PTP service uses different protocols such as BSSGP, LLC, GTP (and IP). The in-
terface to the LLC for the packet transfer is implemented by the subnetwork-dependent
convergence protocol (SNDCP). The SNDCP segments all downlink PDUs to the nego-
tiated LLC PDU length. In the other direction, the received PDUs will be reassembled
and handed over to the packet routing management (PRM). The LLC supports the ac-
knowledged and the unacknowledged mode. In the SGSN/SLR, the PDUs are routed by
the PRM. The PRM is responsible for routing the uplink PDUs to the corresponding in-
stance at the Gn interface. The PDUs are forwarded from there to the corresponding
GGSN/IPS. The downlink PDUs have to be routed to the corresponding SNDCP in-
stance of the PDP context. The transfer of the PDUs between the SGSN/SLR and
GGSN/IPS is implemented via the Gn interface by the GTP-U. The transfer of the PDUs
between GGSN/IPS and PDN is implemented by using the IP. The downlink PDUs will
be routed to the corresponding SGSN/SLR by using GTP-U.
The radio resources that are used by the PTP service are shared resources, therefore,
a temporary lack of one or more GPRS-MSs is possible. In such a case, the downlink
PDUs will be buffered in the SGSN/SLR.

A50016-D1111-V12-2-7618 141
System Description D900/D1800 Information
GPRS PLMN System

GPRS-MS BSC (PCU) GSS

(in the BSS)
Data MT
terminal SGSN GGSN/IPS
User protocol

Server
IP IP
fixed PDN
SNDCP SNDCP GTP GTP (Internet)

LLC LLC UDP UDP

User
data RLC RLC BSSGP BSSGP IP IP
rate
TAF MAC MA Frame Frame L2 L2 L2
C Relay Relay
L1 L1 L1 L1 L1 L1 L1

R GSM radio Gb Gn Gi R
interface interface interface interface interface interface

Fig. 4.25 Protocol model for packet data transmission with the GPRS point-to-point
bearer service (PTP)

In the GPRS-MS, the terminal adoption function (TAF) adapts packets received from
and transmitted to the mobile termination (MT) to a form suitable for transmission within
the GPRS PLMN.

4.1.21 Handling of Short Message Service (SMS) Over GPRS

According to the GSM standard, the short message service (SMS) via GPRS is a point-
to-point service. This describes the SMS functionality of a SGSN/SLR to transfer short
messages between the SMS center and the GPRS-MS via a SGSN/SLR. An SMS trans-
mission via SGSN/SLR, i.e. via GPRS, is normally more radio efficient than via MSC, i.e.
via circuit-switched connections. Therefore, the SMS capability of SGSN/SLR is imple-
mented to provide the possibility of transferring short messages between GPRS-MS and
the SMS center via a SGSN/SLR.
There are two different kinds of SMSs. SMS mobile-originated (SMS-MO) is used to
transfer short messages from the GPRS-MS to a short message service center (SMS
center). The transmission of short messages from the SMS center to the MS is called
SMS mobile-terminated (SMS-MT).
The following interfaces are provided to give the SGSN/SLR the capacity to support
SMS (Fig. 4.26):
– Gd interface: the interface between the SGSN/SLR and SMS gateway MSC (SMS-
GMSC)/interworking MSC (SMS-IWMSC) which supports SMS MAP services
– Gr interface: the interface between the SGSN/SLR and HLR is extended by a special
MAP service (MAP v3 is needed).

142 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

PLMN
Intermediate
HLR/AC network PSTN/ISDN
or
Gr
PSDN
C (or other
SGSN/SLR PLMN)
BSS SMS-GMSC

SMS
Gb
center

SMS-IWMSC

Gd

SMS
operator
GPRS-MS

Fig. 4.26 Network architecture for the short message service via GPRS

To support short message transfer across the GSM radio interface, both the short mes-
sage control (SM-C) and the short message relay (SM-R) functions are implemented in
the SGSN/SLR according to GSM standards. The communication and transport of short
messages between the SM-C and SM-R functions are based on corresponding peer
protocols.
Fig. 4.27 reflects both:
– the SM control protocol (SM-CP) between itself and the SM-C function and
– the SM relay protocol (SM-RP) between itself and the SM-R function
on the GPRS-MS and SGSN/SLR site.

GPRS-MS BSC (PCU) GSS

(in the BSS ) (SGSN)

Data MT
terminal

SMS SMS MAP

SM-RP protocol
SM-R SM-R v3 PSTN/ISDN
SM-CP protocol
SM-C SM-C Intermediate or
network PSDN
LLC LLC TCAP (or other
PLMN)
SCCP
User RLC RLC BSSGP BSSGP
data MTP3
rate
64 MTP2
TAF MAC MAC Frame Frame SMS SMS
Relay kbit/s Relay L1 GMSC center

R GSM radio Gb Gd
interface interface interface interface

Fig. 4.27 Protocol hierarchy for SMS over GPRS at the GSM radio interface

A50016-D1111-V12-2-7618 143
System Description D900/D1800 Information
GPRS PLMN System

In addition to SM-C and SM-R functionality, the SGSN/SLR provides the relay function
which delivers/receives short message user information elements (transfer protocol
data unit, TPDU) and notification to/from the MAP. The SM-RP and SM-CP are neces-
sary for the transmission of short message TPDUs. The short message TPDUs will be
put into SM-RP messages, which will be transmitted with SM-CP messages to the peer
entity. The LLC entity will put the SM-CP messages into unconfirmed information frames
for transmission to the peer entity.
In case of SMS mobile-originated (SMS-MO) the short message is initiated from the
GPRS mobile subscriber over the Gb interface. The SGSN relays the short message to
the SMS-IWMSC over the Gd interface.
In case of SMS mobile-terminated (SMS-MT) the SMS-GMSC tries to deliver a short
message to a GPRS mobile subscriber. Therefore the SMS-GMSC queries/interrogates
the HLR for the mobile subscriber’s location. The HLR will reply the mobile subscriber’s
location over the C interface. The mobile subscriber’s location received from the HLR
will be the SGSN address (or MSC address) or both. This depends on the mobile sub-
scriber’s subscription. After receiving the mobile subscriber’s location from the HLR, the
SMS-GMSC may deliver short message over the PS mode (or CS mode). If the SMS-
GMSC is to deliver the short message over the PS side, the SMS-GMSC will send out
the short message to the SGSN via the Gd interface. A paging procedure may be re-
quired and then the SGSN will relay the short message to the mobile subscriber over
the Gb interface.
An SMS mobile-terminated is only possible if the GPRS mobile subscriber is attached.
In this case, the TPDUs will be put into an MAPv3 message and sent to the SMS-IWM-
SC. The SGSN/SLR forwards it to the GPRS-MS on receipt of the transfer result (i.e. the
delivery report) from the SMS center via the SMS-IWMSC.
When the SGSN/SLR receives a mobile-terminated SMS via the MAP-interface from the
SMS-GMSC, it unpacks the MAPv3 message and transfers the TPDU. The TPDU con-
tains the SMS for the GPRS-MS using the logical link control (LLC) protocol. The re-
ceived transfer result from the GPRS-MS will be delivered to the SGSN/SLR which
generates and submits an appropriate delivery report to the SMS Center (SMSC) via the
SMS-GMSC.

SMS absent subscriber enhancement for MAPv3

With the additional feature “SMS absent subscriber enhancement for MAPv3” commu-
nication with the GPRS-MS and SMSC will be enhanced over their respective interfac-
es. Over the Gd interface, the capability to use MAP version 3 for SMS-MO and SMS-
MT will be introduced (upgraded from MAPv2). Over the Gd/Gb interface, formerly un-
used optional parameters existing in the SMS RP-layer protocol will be put to use to sup-
port the MAPv3 enhancement.
When the SMS-MT happens and the mobile subscriber is absent, the SGSN may reply
the subscriber absent reason back to the SMSC (the reason can be paging no response
via the SGSN or IMSI detached). The HLR may receive the subscriber absent reason
from the SMSC (see also in the System Description D900/D1800, register Network Sys-
tem Concept, section PLMN organization/Codes of GPRS PLMN) the reason may be for
the SSS (CS domain) or for the GSS (PS domain).

144 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.1.22 Local Overload Handling

Overload handling is used to maintain a stable system, providing a stable throughput
and a stable performance even under extreme load conditions. The impact will not be
noticed by the mobile subscriber under normal running conditions of the system. How-
ever if an overload occurs, the traffic load is reduced by discarding or rejecting packet
data units (PDUs). The loss of PDUs depends on the overload level and the correspond-
ing measures taken in order to reduce the load. Overload handling must not result in a
blocked system, neither during the overload nor after return to normal load conditions.
Overload handling is the sum of all measures for monitoring the load situation of a given
system, detecting different overload levels and bringing overload treatment in action.
Overload detection is installed to monitor the current load state of a platform and to de-
termine, in the case of SGSN, whether a main processor (MP) or server processor (SP)
is in normal operation or in an overload state. It defines the methods of measurement of
the load situation and the categorization of overload levels.
Overload treatment defines the measures, being started after detection of a certain
overload level, in order to reduce the system load and to return the system to normal
operation. It tries to protect a system from uncontrolled behavior if extreme data or sig-
naling traffic situations occur, or when processing capacities are exhausted.
The final goal is to keep the system running under all circumstances. The quality of ser-
vice (QoS) profile takes part in the overload handling strategy.
The basic ideas for overload handling are:
– to detect an overload situation as early as possible within the message flow;
– to discard data and signaling in a systematic and ordered way;
– to only generate a small additional contribution to the traffic load in normal operation;
– to keep existing transactions as long as possible and reject new transactions;
– to differentiate between data and signaling packets, which have a higher priority.
Overload handling is performed in the SGSN on main processor platforms (e.g.,
MP:PD/SH and MP:MM) and on server processor platforms (e.g., SP:GTP). Each pro-
cessor is responsible for maintaining its own system behavior. Aspects of quality of ser-
vice (QoS) are taken into consideration, i.e. overload handling of high priority data is
differentiated from overload handling of low priority data. This also applies to SMS data.
The CISCO based GGSN/IPS, the network node also supports server load balancing
i (SLB), providing increased reliability and availability in the network. When configuring
GTP load balancing, a pool of GGSNs is configured as a server farm, across which the
load of GTP sessions is balanced.
The dynamic feedback protocol (DFP) calculates load balancing weights dynamically.
Each GGSN/IPS that acts as a DFP agent collects status information from one or more
real host servers, converts the information to relative weights and reports the weights to
the DFP manager for load balancing the real servers. The weight for each GGSN/IPS
is primarily based on the ratio of existing PDP contexts on the GGSN/IPS and the max-
imum number of allowed PDP contexts.

A50016-D1111-V12-2-7618 145
System Description D900/D1800 Information
GPRS PLMN System

4.1.23 Enhancements of Gb Interface

In order to decrease signaling efforts for the radio cell information of a mobile station the
following procedure are available on Gb interface:
• Radio status procedure
A BSS and an GPRS-MS radio interface communication may be unsuccessfully
completed due to various reasons. The GPRS-MS may go out of coverage or the
link quality can be too bad for the communication, in which cases the SGSN should
stop sending LLC-PDUs to the cell for the GPRS-MS. If the BSS has ordered the
GPRS-MS to perform a cell-reselection, the SGSN should wait for the cell update
before resuming the transmission of LLC-PDUs. The BSS signals such exception
conditions to the SGSN by sending a radio-status-PDU.
• Cell update procedure
The GMM READY timer should not be started after a cell update without active user
data transmission.
There are also the following features:
• BSS packet flow context procedure
In order to support end-to-end QoS a packet flow manager (PFM) is introduced to
the packet flow context procedure of the BSS as well as the SGSN. These PFMs are
responsible for the creation, modification and deletion of the packet flow context
(PFC) in the BSS which carries the QoS information supplied by the SGSN. Each
PFC is identified by a packet flow identifier (PFI) which is predefined for best effort,
SMS and signaling.
• BSSGP feature negotiation
The introduction of a feature bitmap to the BSSGP layer allows the negotiation of
optional features on the Gb interface for backward compatibility between BSS and
SGSN. After the negotiation the two network nodes will settle into the common fea-
ture set supported by both nodes. This is done using bits to identify the optional fea-
tures that can be supported by the network service entity. After completion of the
signaling both entities locally determine the common set of optional features.
• Gb messaging enhancements
This feature improves the SGSN performance in downlink direction by reducing the
number of overhead octets in a dedicated processing part and by minimizing seg-
mentation of downlink packets on the Gb interface.

4.1.24 Insert/Delete Subscriber Data - Stand Alone

This feature enables instant transfer of GPRS mobile subscriber data from the HLR to
the SGSN/SLR if the data is changed in the HLR. It is possible to delete, modify or add
parts of the GPRS mobile subscriber data held in the SGSN database (SLR).
Using a special message, it is possible to insert new PDP contexts and replace/modify
certain PDP contexts or general ODB categories, charging characteristics, as well
GPRS CAMEL subscription information have to be modified in the SLR. Moreover, the
SMS-MO teleservice subscription can be given and, in this connection, SMS-relevant
ODB data can be inserted in the SLR, too.
When the “update SLR data” message is received, session management checks wheth-
er a PDP context is allowed to remain active due to updated PDP context GPRS mobile
subscriber data from the HLR with respect to packet-switched services. Session man-
agement has to search whether a subscribed record matches an active PDP context us-

146 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

ing the available updated GPRS mobile subscription data. That is, which subscribed
record matches best.
If GTP v1 is being used between SGSN and SGSN (old SGSN - new SGSN), the sub-
i scriber record can be identified by the PDP context identifier. When using GTP v0 on
the Gn interface between SGSN and SGSN, the PDP context ID of an active PDP con-
text is not available.

4.1.25 Transmit Power Control

In the BTS, power control is important for spectrum efficiency as well as for minimizing
power consumption in the mobile stations (GSM/GPRS-MS). In order to minimize the
impact on the existing frequency plans when introducing GPRS, the amount of interfer-
ence power generated is kept at a minimum.
The present GSM radio interface supports the uplink and downlink power control based
on received signal level and received signal quality measurements during continuous
two-way connections. This mechanism is not applicable to the unbalanced burst nature
of data communications. Therefore, new power control mechanisms are introduced as
standard by ETSI/3GPP and these comply with the GPRS requirements.

Only MS open loop power control will be supported in the current BSS software version.
i The algorithm is based on parameters configured by the customer (PLMN operator).
There is, therefore, no support for the BTS downlink power control (BCCH carrier used
for PDCH allocations).

4.2 Location Services

The location services (LCS) feature is a new radio access network capability which en-
ables the PLMN to determine the geographic location of an MS in order to use this in-
formation in certain location based applications.
LCS is primarily a BSS based feature.
i
Implementation of the LCS feature is the basis for a wide range of new functions for op-
timizing a network: detection of hot spots, handover performance analysis, hierarchical
radio cell system planning, or automatic capacity adjustment. Further potential LCS ap-
plication categories are listed below.
Value added services use LCS to support various commercial services, such as infor-
mation services, tracking services and navigation services.
PLMN internal location services are functions which enhance or support certain O&M-
related tasks or intelligent network services, e.g., location-dependent routing, location-
dependent (home zone) billing or location assisted handover.
Emergency services determine the position of a mobile subscriber, e.g., for a car break
down service.

Location services network architecture

Fig. 4.28 shows the location services network architecture according to 3GPP release
4 to support location services for GPRS-MS.

A50016-D1111-V12-2-7618 147
System Description D900/D1800 Information
GPRS PLMN System

SMLC HLR

Lb Lh
GPRS- interface interface
MS

LCS
BTS BSC
SRNC SGSN/SLR GMLC client

Um Abis Gb Lg Le
interface interface interface interface interface

Fig. 4.28 Network architecture to support location services for GPRS-MS

The SGSN/SLR contains functionality responsible for authorizing GPRS mobile sub-
scriber subscription and managing session-related and session unrelated positioning
requests of location services. The SGSN is accessible to the GMLC via the Lg interface.
The location service functions of SGSN are related to charging and billing, location ser-
vice coordination, location request, authorization, and operation of the location services.
The Serving Mobile Location Center (SMLC) performs a key control function for the
introduction of location services (LCS) implemented in D900/D1800 PLMN subsystems.
The SMLC manages the overall coordination and scheduling of resources required to
determine the geographical location of a mobile station (MS). It also calculates the final
location estimate and estimates the achieved accuracy. There can be more than one
SMLC in one PLMN. An SMLC receives location requests from its associated BSCs and
determines the positioning calculation method to be used, based on the quality of ser-
vice (QoS) parameters, the capabilities of the network, and the GPRS-MS’s own loca-
tion capabilities. The SMLC calculates the final location estimate and accuracy and
returns this data to the requesting BSC. The SMLC is connected to the BSC via an Lb
interface.
The SMLC reports the location information together with the time of day and the estimat-
ed errors of the location of the GPRS-MS to the client. The client is allowed to specify
QoS parameters when requesting the service (e.g., accuracy). The location request
message of a client can specify the following reporting event: “direct”, immediately re-
port the current location of the specified GPRS-MS.
The MS’s location is specified by returning the geographical coordinates of the radio
cell’s center as an estimate of the MS’s geographical coordinates. The form of the loca-
tion reporting is specified in the location request message. If CGI reporting is specified,
the location reported is normally the cell global identifier (CGI) derived from the cell ID
of a radio cell from the active set of the GPRS-MS . If geographical coordinate reporting
is specified then the cell ID is determined in the same way as in CGI reporting, and the
coordinates of the center point of the selected radio cell are returned as the GPRS-MS
location.
The Gateway Mobile Location Center (GMLC) provides external LCS clients with ac-
cess to the GPRS PLMN and its location service capability. There can be several GM-
LCs in one PLMN. The GMLC stores LCS subscription information on a per-LCS-client

148 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

basis. The HLR uses the subscriber’ privacy information to verify if the mobile subscriber
is allowed to be positioned, i.e., if the LCS service has been subscribed. The GMLC re-
quests information from the HLR of the GPRS-MS to be located. The visiting SGSN ad-
dress and international mobile subscriber identity (IMSI) of this GPRS-MS are used to
route the location request to the SGSN currently serving the GPRS-MS. It uses the sub-
scribers's privacy information to verify that the LCS client is allowed to position the
GPRS-MS. The GMLC receives the final location estimates and determines whether
they satisfy the requested QoS for the purpose of retry/reject. It can transform a received
location estimate to local coordinates before sending it to the requesting LCS client. Fur-
thermore, the GMLC generates LCS-related charging and billing data.
The LCS client provides the mobile subscriber with location-dependent services. It in-
teracts with an LCS server to obtain location information about the GPRS-MS.

Positioning methods
The location information can be requested by a client attached to the GPRS-PLMN. In
addition, LCS can be offered without subscription to basic telecommunications services
and is applicable to any target MS, regardless of whether it supports LCS.
The standard/enhanced cell identification timing advance (CITA/E-CITA) method can be
used.

Network positioning procedure

The network positioning procedure is initiated by the GMLC. It consists of the following
subprocedures:
– location preparation procedure
verifies the privacy restrictions of the GPRS mobile subscriber, to reserve network
resources and determine the positioning method according to the requested QoS
and the capabilities of the MS and network.
– positioning measurement procedure
makes measurements from which the position of the GPRS-MS can be calculated.
– location calculation and release procedure
is initiated after the measurements are completed and is concerned with calculating
the MS’s location, releasing all involved network and/or GPRS-MS resources and
sending the charging information to the GSS.
The messaging and processes in each subprocedure depend on the source of the loca-
tion request. According to 3GPP Release 4, the following cases can be distinguished:
• Mobile terminating location request (MT-LR)
The LCS application invokes the positioning procedure and receives the location es-
timate. Privacy is an issue here.
• Mobile originating location request (MO-LR) - for self location/not yet released for
D900/D1800 GPRS.
The GPRS-MS itself invokes the positioning procedure and gets the location esti-
mate, optionally the location estimate is in addition transferred to a third party.
• Network induced location request (NI-LR) - not yet released for D900/D1800.
The network invokes the positioning procedure autonomously.

A50016-D1111-V12-2-7618 149
System Description D900/D1800 Information
GPRS PLMN System

4.2.1 Mobile Terminating Location Request (MT-LR)

The request goes first to a Gateway Mobile Location Center (GMLC) where a query is
performed to the HLR to obtain the visited SGSN address. Then the GMLC sends a re-
quest for the GPRS-MS location to the visited SGSN, which obtains the location (from
the Serving Mobile Location Center (SMLC)) and returns it to the GMLC. To enable a
GPRS-MS user to control which external location service clients are allowed to receive
the GPRS-MS location via an MT-LR, privacy subscription options are provided in the
HLR and downloaded to the SLR.
Call procedure:
A mobile terminating location request (MT-LR) is characterized by the fact that the LCS
client is external to the PLMN (e.g., fleet management center). This GSS subfeature en-
ables an external location service client to request the location of a specifically identified
GPRS-MS.
1. If an external LCS client requests the current/last known location of a target GPRS-
MS, the GMLC sends a “provide subscriber location” message to the SGSN/SLR in-
dicated by the HLR. This message carries the type of location information request-
ed, the GPRS-MS subscriber's IMSI/MSISDN, and LCS quality of service (QoS)
information. For a session related location request, the message also carries the
APN on which the user has established the session. For a value-added LCS client,
the message will carry the client name and the external identity of the LCS client.
For a PLMN operator LCS client, the message carries the internal identity of the LCS
client.
2. The SGSN/SLR first verifies that a location request is allowed from this GMLC. The
SGSN/SLR then verifies LCS barring restrictions in the GPRS-MS user subscription
profile in the SGSN/SLR. In verifying the barring restrictions, barring of the whole lo-
cation request is assumed if any part of it is barred or any requirements are not met.
If LCS is to be barred, an error response is returned to the GMLC.
3. If the GPRS-MS is in stand-by mode, the SGSN/SLR performs paging.
4. The SGSN/SLR sends a “perform location request” message to the SMLC. This
message includes the type of location information requested, the requested QoS,
and routing area information.
5. When the location information that best meets the requirements of the requested lo-
cation type and QoS has been obtained, the SMLC returns this information to the
SGSN/SLR in a “perform location response” message.
6. The SGSN/SLR returns the location information and its age to the GMLC. If the
SMLC did not return a successful location estimate, but the privacy checks were
successfully executed, the SGSN/SLR may return the last known location of the tar-
get GPRS-MS, if this is known, and the LCS client requests the current or last known
location.
Fig. 4.29 shows the general network positioning for a mobile terminated - location re-
quest (MT-LR) with “basic functionality”.

150 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

SMLC HLR

4
MS 5 1

5 6 6 LCS
BTS BSC
SRNC SGSN/ GMLC client
SLR
3 3 3 1 1
2

Fig. 4.29 General network positioning for a MT-LR with “basic functionality”

Full LCS privacy subscription

The following LCS privacy classes, subscribed to by an GPRS-MS in the subscriber lo-
cation privacy profile (SLPP) in the HLR, are defined in the 3GPP standards in terms of
allowing or disallowing location.
• Universal class
Allow positioning by all LCS clients.
• Session related class
Allow positioning by specific identified value-added LCS client or groups of value-
added LCS client to which the GPRS-MS originated a session.
For all clients in the session related class, or for each identified LCS client or group
of LCS clients, one of the following subscription options (GMLC restrictions) applies:
– Location request allowed only from GMLCs identified in the SLPP
– Location request allowed only from a GMLC in the home country
– Location request allowed from any GMLC (default case)
• Non-session related class
For each identified value added LCS client or groups of value added LCS clients in
the privacy exception list, one of the following GMLC restrictions applies:
– Location request allowed only from GMLCs identified in the SLPP
– Location request allowed only from a GMLC in the home country
– Location request allowed from any GMLC (default case)
• PLMN operator class
Allow positioning by specific types of PLMN operator clients within or association
with the VPLMN (i.e. where the GMLC is in the VPLMN), with the following types of
client identified:
– Clients providing a location related broadcast service
– O&M client in the HPLMN (when the GPRS-MS is currently being served by the
HPLMN)
– O&M client in the VPLMN
– Clients recording anonymous location information without any GPRS-MS identifi-
er

A50016-D1111-V12-2-7618 151
System Description D900/D1800 Information
GPRS PLMN System

– Clients enhancing or supporting any supplementary service, IN service, bearer

service or teleservice subscribed to by the target GPRS-MS subscriber
If the GPRS-MS subscribes to the PLMN class, a location is allowed if the client with-
in the VPLMN, or the client identified by the GMLC, either matches a generic type of
client contained in the SLPP of the MS or is otherwise authorized by local regulatory
requirements to locate the GPRS-MS.

4.3 Charging and Billing

The charging and billing functions follow the corresponding requirements of 3GPP stan-
dards.

Charging
Charging is an overall term for the whole accounting function and the limited pre-billing
functions within the network elements or in co-operation with add-on service platforms
(e.g., IN/CAMEL). Such pre-billing functions are for example charge determination.
The term “accounting” is sometimes used as a synonym to “charging”.
i
Charging can be subdivided into two following categories:
• Offline method
The offline method is the traditional one. The PLMN operator performs the commu-
nication service, i.e. the resource usage by the mobile subscriber, before payment
by the responsible mobile subscriber. The charge is calculated at the earliest after
finishing of the communication service or service part. Further delay depends on the
billing processing. I.e. the PLMN operator goes in submission.
• Online method
The online method is the contrary method. The charge is calculated during running
of the communication service. Mobile subscriber supervision and pre-paid service
can be done. In contrast to the offline charging method the charge is calculated be-
fore or during network usage. In case of pre-paid service the mobile subscriber goes
in submission (gives a credit) by pre-charge of an account. This account will be
counted down during the communication service.
Charging is done for two purposes:
• Mobile subscriber charging
The main purpose is mobile subscriber charging. The mobile subscriber, who was
(offline charging) / is (online charging) responsible for the communication service or
service part, is debited with a related bill. For that mobile subscriber and communi-
cation service related data are collected and processed for the relationship mobile
subscriber (user) - PLMN operator (network). Mobile subscriber charging is done
within the network elements of the visited network (e.g., SGSN).
• Inter-administration charging
The second purpose is the inter-administration charging between different PLMN
operators. If a communication service covers different administration areas (net-
works) a charge balancing for mutual resource usage is done. For that communica-
tion service related data at the network gateways are collected and processed for
the relationship PLMN operator - PLMN operator. Inter-administration charging is
done on the network gateways of the involved neighboring networks (e.g.,
GGSN/IPS). But also the mobile subscriber charging output can be used for making
inter-administration billing.

152 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Billing
Billing is the function of the administration and billing centre (ABC), i.e. outside of the
network elements. The charging related data delivered by the network elements are cor-
related with a relevant tariff model in order to create the bill. The bill is used for payment
demand to the mobile subscriber, responsible for the whole communication service or
service part.

Charging and billing principles

The following charging and billing principles exist:
– For charging the related data are collected within these network elements where the
user access to the PLMN is done and where additional services (e.g., IN/CAMEL
services) are used for modification and enhancement of the origin communication
service request.
– The related data are collected within these network elements (i.e. SGSN).
– The related data are collected at the network gateways in case of internetwork ser-
vices. Mobile subscriber charging can be also used, if the information is sufficient,
which is not collect directly at the gateway.
– The related data are not exchanged via administration (network) borders. Only
unique identifier (so-called charging ID) can be exchanged between the network el-
ements involved into the communication service signaling. Such unique identifiers
comply with different standards and can be used for charging data correlation from
one or different networks.
– Billing for the mobile subscriber is always done from the home PLMN (HPLMN) op-
erator (or service provider).
– In the case of a roaming mobile subscriber within a visited PLMN (VPLMN) or ser-
vice usage within a foreign network the charging data has to be forwarded from the
visited to the home PLMN operator (or service provider). The data exchange is done
between the ABCs via the transferred account procedure (TAP) procedure by using
of a clearinghouse.
– The tariff modelling and price building is the task of the PLMN operator (or provider).
Charging has the task to provide the necessary information about the communica-
tion service in order to classify which tariff model has to be used for anyone.
– The charge for inter-administration communication services is done between the
ABCs. The charge is a sub-amount received via mobile subscriber billing.
The billing base of packet-switched domain is the volume (bearer charging). Beside vol-
ume the duration is also measured in packet-switched domain. The using of the mobile
subscriber charging can do the inter-administration charging. Within packet-switched
domain this has to be done by statistic and accounting functions of the border gateway
between two administration areas.
Charging covers the following main functions within the network elements:
1. Charging collection function
– Collection of charging related data
– Generation of charging records at defined communication service events
– Formatting of the charging records
2. Charging gateway function / interface to billing domain
– Storage of the charging records on non-volatile memory
– Interface provision to ABC
3. Special charging features
– Online charging by CAMEL based charge calculation

A50016-D1111-V12-2-7618 153
System Description D900/D1800 Information
GPRS PLMN System

– Charging of prepaid subscriber

4.3.1 Charging Collection Function (Generation of Session Data Record-

ing)
Detailed session data is generated for the GPRS mobile subscriber during every ses-
sion. The SIEMENS GPRS solution supports volume-dependent charging, i.e. charging
based on the amount of data transferred with the assistance of a decentralized/distrib-
uted charging gateway function (CGF) according to the ETSI/3GPP standards. All rele-
vant charging data is collected for each GPRS-MS in the SGSN network element and
GGSN/IPS to be pre-processed in the Charging Gateway (CG) or processed in the Ad-
ministration and Billing Center (ABC).
The fundamental tasks of the CGF are: charging data merging into records (charging
detail records (CDR)) optimized for the billing processing, intermediate record storage,
record formatting into standardized format, data transfer of the charging information
from the GSN to the billing system and support functions for the billing system (e.g., data
pre-processing or filtering of data not required).
These charging detail records (CDR) can be used for:
– GPRS-MS billing and
– Inter-operator billing via the GPRS-MS billing information.
From a PLMN operator’s point of view accounting for GPRS makes it possible to:
– Bill one’s individual GPRS mobile subscriber for using PLMN resources
– Charge foreign PLMN for foreign mobile subscribers roaming in the PLMN
– Get the highest possible accuracy and security of accounting data.

Main record types

In the current software version there are two main record types for GPRS-MS to PDN
PDP context service, two for the SMS via packet-switched service and one for the mo-
bile-terminated location service.
Each PDP context generates its individual raw record which is called a PDP context
record. The GPRS-MS activates the PDP context in the SGSN network element and the
GGSN/IPS respectively. The SGSN network element (where the GPRS-MS is attached)
creates a SGSN network element PDP context record and writes a GGSN PDP context
record in accordance with the GGSN/IPS (where PDN access is undertaken).
Information is collected to charge the user for transporting the user data within the
GPRS network from the service origination to the termination. Charging is based on the
user “net” data contents. The volume collection is performed at the lowest application
layer outside the GPRS function. Charging information is collected for each GPRS-MS
by the SGSN network element and the GGSN/IPS which are serving that GPRS-MS.
The SGSN functionality within the SGSN network element collects charging information
related to the radio network use, while the GGSN/IPS collects charging information re-
lated to the external data network (Internet) use. Both of them collect the volume per tar-
iff period in their PDP context record layouts. A list of traffic volumes collected in the time
between tariff switches can be written into the records.
The SGSN/SLR (where the GPRS-MS is attached) collects the raw data for sending or
receiving an SMS and creates an SMS charging record.
Record types:
• SGSN PDP context record

154 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

• GGSN PDP context record

• SGSN mobile-originated SMS record
• SGSN mobile-terminated SMS record
• SGSN mobile-terminated location request record
The record sequence per PDP context can consist of one or several records. If there is
only one record to be processed then it is called “single”. When more than one record
has to be processed for one PDP context per GSN type, the first one is called “first”, the
last “final” and the other “intermediate”. According to the standard this information is not
part of the record. The only indicator for partial record generation is the record sequence
number. If it exists in the record, then several records are generated per PDP context.
Every record includes only traffic activity because the last record was generated.
For both PDP context records the following partial/intermediate record generation is
possible:
– Partial record if the volume limit has been reached.
– Partial record if the time limit has been reached.
– Partial record if the maximum change condition has been reached. Maximum con-
ditions mean maximum number of list of traffic volumes.
All charging records for one PDP context are assigned with a unique charging-ID num-
ber (CID) and the GGSN/IPS control plane address. That enables the billing center to
collect all relevant records from different network nodes to charge for one activated PDP
context. The CID is generated in the GGSN/IPS and passed to the SGSN network ele-
ment.

Charging collection
Generally, raw information is collected to charge the user for the transport of the user
data within the GPRS PLMN between the service origination to the termination. Charg-
ing is not done depending on the user “net” data contents. The volume collection is done
at the lowest application layer outside the GPRS function.
• SGSN network element PDP context record
This raw record is used to collect charging information related to a PDP session and
the data transferred for a GPRS-MS in the SGSN network element. In addition, mo-
bile access via the radio interface and the mobile management is recorded. The cor-
responding record type within the GGSN/IPS is the GGSN/IPS PDP context record
created for the same context.
The record contains:
– Served subscriber related data (e.g., IMSI, MSISDN, GPRS-MS network and ra-
dio access capability, location (LAC, cell ID, system type)
– Control data (e.g., record type, charging ID, record sequence number)
– Seized PLMN data (e.g., SGSN network element and GGSN address, PDP ad-
dress and type)
– Additional service data (e.g., CAMEL parameter (SCP address, service key, etc.),
location service)
– Service measurement data (e.g., record opening time, context duration, uplink
and downlink traffic volume depending on change condition, release reason)
• GGSN PDP context record
This raw record is used to collect charging information related to a PDP session and
the data transferred for a GPRS-MS in the GGSN/IPS. In addition, external access
to the PDN is recorded.
The record contains:

A50016-D1111-V12-2-7618 155
System Description D900/D1800 Information
GPRS PLMN System

– Served subscriber related data (e.g., IMSI, MSISDN)

– Control data (e.g., record type, charging ID, record sequence number)
– Seized PLMN data (e.g., SGSN network element and GGSN address, PDP ad-
dress and type, APN)
– Service measurement data (e.g., record opening time, context duration, uplink
and downlink traffic volume depending on change condition, release reason).
• SGSN mobile-originated SMS record
This raw record is used to collect charging information related to the transmission of
the mobile-originated SMS for a GPRS-MS in the SGSN/SLR.
The record contains:
– Served subscriber related data (e.g., MSISDN, IMSI, GPRS-MS network and ra-
dio access capability, location (LAC, cell ID) at the sending time of the GPRS-MS,
system type)
– Control data (e.g., record type)
– Seized PLMN data (e.g., recording network element, service center address)
– Additional service data (e.g., CAMEL parameter (SCP address, service key, etc.))
– Service measurement data (e.g., SMS origination time corresponds to the send-
ing time, SMS result)
– Partner identification (origination MSISDN), i.e. the addressed subscriber for the
SMS
• SGSN mobile-terminated SMS record
This raw record is used to collect charging information related to the transmission of
the mobile-terminated SMS for a GPRS-MS in the SGSN/SLR.
The record contains:
– Served subscriber related data (e.g., MSISDN, IMSI, GPRS-MS network and ra-
dio access capability, location (LAC, cell ID) at the receiving time of the GPRS-
MS, system type)
– Control data (e.g., record type)
– Seized PLMN data (e.g., recording network element, service center address)
– Service measurement data (e.g., SMS origination time corresponds to receiving
time, SMS result)
– Partner identification (origination MSISDN), i.e. the sending subscriber for the
SMS
• SGSN mobile-terminated location request record
This raw record is used to collect charging information related to the transaction of
a mobile terminated location request for location service (LCS) via GPRS in the SG-
SN.
The record contains:
– Served subscriber related data (e.g., MSISDN, IMSI, charging characteristics, lo-
cation (LAC) at receiving time of the SGSN, system type)
– Control data (e.g., record type)
– Seized network data (e.g., recording entity, Mobile Location Centre number)
– Additional service data (e.g., LCS parameter (LCS client type, LCS client identity,
location type LCS priority, position data, etc.))
– Service measurement data (e.g., measurement duration, mobile-terminated loca-
tion request result)

156 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Formatting (for SGSN)

The collected charging information is formatted into an abstract syntax notation 1
(ASN.1) coding layout and stored on disk in sequential files or transferred via Ga inter-
face to the Charging Gateway (CG). Several file parameters are configurable via Q3.

Simple ticket layout administration (for SGSN and IPS)

For more flexibility in ticket layout usage, SIEMENS supports to configure the layout of
the charging detailed records (CDR).
The feature “simple ticket layout administration” allows the layout of charging detailed
records (CDR) to be administered in the SGSN. The administration of the following
charging items on the MP-platform is introduced:
– Data record format version used for the charging gateway protocol
– Layouts for the different client records
With the corresponding circuit-switched software release, the administration interface of
i the MSC is adapted so that it is the same time schedule that is used at SGSN in the
GSS. Therefore, a common administration interface for CDR layout administration for
MSC/VLR (based on MP-platform) and SGSN is provided.
Simple ticket layout administration should only be performed by SIEMENS staffs.

The L-CG of the IPS-3300 offers also a simple ticket layout administration (as described
i above for SGSN) and is part of the "IPS-charging gateway function (CGF)" consisting
of GGSN, CSG and L-CG.

Enhanced support of charging characteristics (for SGSN)

The feature “enhanced support of charging characteristics” provides the following new
functionality and major enhancements:
• Support of charging characteristics in xGSN
The 3GPP release 4 standards expands on the functionality/meaning of the charg-
ing characteristics for packet-switched call detailed records (CDR). The charging
characteristics (CC) field allows the PLMN operator to apply different kind of charg-
ing methods in the CDRs. GPRS mobile subscribers may have CCs assigned to
their subscription and/or subscribed access point names (APN), which causes the
creation of specific properties of the packet data protocol (PDP) contexts at activa-
tion time in the GSNs. These CCs can be supplied by the HLR as part of the sub-
scription information, and, upon activation of a PDP context, the SGSN can transfer
the CCs to the GGSN/IPS via the Gn/Gp interface according to the rules specified in
the 3GPP standards. The CCs have to be used by the GSNs e.g., to activate/deac-
tivate CDR generation and control the generation of intermediate CDRs or the traffic
volume containers. To provide the mentioned functions, the CDR field parameter
“charging characteristics” specifies a set of so-called accounting profiles and their
expected behavior associated with each profile. The internal structure of an account-
ing profile is not defined/specified by the ETSI/3GPP standardization.
According to the 3GPP standards, the GSNs apply alternatively pre-configured “de-
fault” profiles if no CCs are supplied by the HLR (to SGSN) or CCs are not accepted
by the GSNs. The GSNs support three different default profile configurations:
– A home default profile for a GPRS-MS of the SGSN's public land mobile network
(PLMN)
– A visiting default profile for a GPRS-MS visiting the SGSN PLMNs and using a
GGSN/IPS belonging to the same PLMN as the SGSN and

A50016-D1111-V12-2-7618 157
System Description D900/D1800 Information
GPRS PLMN System

– A roaming default profile for GPRS-MSs visiting the SGSNs PLMN but using a
GGSN/IPS belonging to their home PLMN
Additionally to standards definition, to be backward compatible to the 3GPP release
99 solution, the GSNs are able to support appropriate accounting methods. Both
SGSN and GGSN/IPS select the charging profile for PDP context CDR generation
(i.e. SGSN-CDR and GGSN-CDR, respectively) upon activation of a corresponding
PDP context. The profiles for SGSN-short message mobile originated/terminated -
CDR (S-SMO/T-CDRs) are selected by the SGSN if a short message transfer was
executed. The profiles for SGSN-mobile terminated-LCS request (LCS-MT-CDRs)
are selected by the SGSN if a mobile terminated LCS request was executed.

Formatting, simple layout ticket administration and enhanced support of charg-

ing characteristics (for CISCO based GGSN/IPS)
Formatting storage is done via Local Charging Gateway (L-CG). Simple layout ticket ad-
i ministration is only done via L-GC.

4.3.2 Charging Gateway Function (CGF) / Interface to Billing Domain

The packet-switched communication networks support the following basic functionality
for connection to the billing domain:
– Storage of charging information (tickets) on non-violate memory
– Provision of standardized interface
Within the packet-switched domain standardization this function is called charging gate-
way function (CGF). There are two types of CGF:
– Distributed CGF localized within the network elements
– Central CGF as external device, also called Charging Gateway (CG)

Distributed CGF
As the ticket storage medium the local hard disk of network element is used. For that a
pre-allocated range is reserved by administration. The configurations for SGSN and
GGSN/IPS depend on the network element hardware architecture.
For files containing tickets the following configurations are possible in the packet-
switched domain:
– SGSN (with MP-platform): MP:OAM hard disk with file array system
– SGSN (with MP-platform): MP:OAMD (if available) hard disk with
file array system
– GGSN/IPS (with local CG (L-CG)): L-CG hard disk with file system
As ticket transfer interface the O&M interface of the network elements with file oriented
procedure is used. For files containing tickets the following configurations are possible:
– SGSN (with MP-platform): FTP via TCP/IP
– GGSN/IPS (with local CG (L-CG)): FTP via TCP/IP
FTP support the pull mechanism. I.e. the remote post-processing system (ABC) has to
request the file transfer.

Centralized CGF
The ticket storage medium is outside the network elements, which handle the user traf-
fic, on an independent device. I.e. a local disk isn't required. Such independent devices
are Billing Mediation Device (BMD), Charging Gateway (CG; standardized in 3GPP for
packet-switched domain networks ) but also hot billing server.

158 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

For packet-switched networks, an IP-based protocol is standardized (GTP' protocol via

Ga interface). This protocol is used to connect the GSNs to the CG.
Additionally the GTP' can work optionally with network element local storage capability
as fallback facility in case of interface failure.
Centralized CGF is supported as network element feature for all charging. It needs a
transaction-oriented procedure for ticket transfer. It is an alternative transport mecha-
nism to the file-oriented principal (e.g., FTP):
– SGSN (with MP-platform): GTP' via TCP/IP
– GGSN/IPS: GTP' via TCP/IP

4.3.3 Special Charging Features

IN/CAMEL charging collection function
During context activation of a prepaid subscriber with CAMEL subscriber information
(CSI) a dialogue with the Service Control Point (SCP) or CAMEL service environment
(CSE) of the Intelligent Network is executed for checking the subscriber’s liquidity. Dur-
ing the active PDP context an online count down of budget slices is done, which are re-
freshed periodically by the CSE. If the budget runs out, the PDP context is interrupted
immediately (see also section 3.5.1, SGSN Support of Prepaid Service for PS Services).
CAMEL charging records can be distinguished by the additionally included CSI with
SCP address and service key.

Tariff Time Switch

Tariff time switch is not supported by IPS-3300 (i.e. CSG does not support this).
i
The feature “tariff time switch” provides the PLMN operator with the means to establish
complex tariff models based on data volume accounting. The operator is enabled to
charge a GPRS mobile subscriber for traffic data volumes transferred during certain tar-
iff periods.
Unlike circuit-switched networks where merely the time span is sufficient for any tariff-
ing, traffic data volumes have to be collected separately for each tariff period in packet-
switched networks. Therefore a fixed database is provided which stores the information
of the tariff periods according to the tariff model.
Even though accounting collects charging data and generates charging data records
(CDR) it does not compute subscription fees. Tariff models on which the provider calcu-
lates usage fees are very extensive, may change very often and even depend on sub-
scriber issues (provider may define a couple of tariff models it can belong to) or current
location. Therefore,
– an adequate tariff model is supported, which merely covers basic requirements and
– it represents the summary of all needed tariff periods, for example of all Internet pro-
viders of a GGSN owner.
Tariff periods are easy to explain to the subscriber and known from the conventional cir-
cuit-switched networks. It gives the chance to shift the load of the GSN to low traffic
hours.
The features of the provided functionality are as follows:
• It is defined to have 24 ”time tariff switches” per day without calendar function in the
SGSN.

A50016-D1111-V12-2-7618 159
System Description D900/D1800 Information
GPRS PLMN System

• It is possible to have different time switches in the SGSN network element and
GGSN.
• The charging data record (CDR) generation for the SGSN network element and
GGSN PDP context records is extended by the trigger condition “tariff time change”
by adding a “list of traffic data volumes” container.

4.4 Lawful Interception Package

This feature package ensures the compliance with governmental interception require-
i ments. Therefore, this feature is mandatory so as to attain or keep the mobile network
operator license. The functionality and content of this package have been discussed
and agreed on by national authorities.

Lawful interception involves using a monitoring function to trace packet-switched servic-

es between the Internet and a GPRS mobile subscriber so that data describing the pack-
et-switched services is provided to the Lawful Interception - Interception Management
System (LI-IMS) and also to a monitoring center (MC) (Fig. 4.30). Internet sessions
based only on IP v4 are supported. The consumer in the MC is represented by a law
enforcement agency (LEA).

Data packet content duplication in the SGSN an transfer to the monitoring center
(MC)
The functions implemented for content duplication and transferring the intercepted prod-
uct to the MC are:
– Delivery function of intercepted products (duplication of user data) located in the
SGSN
– Transfer function via TCP/IP from SGSN to MCs
– Anticipation of the Gn interface on the 3G-SGSN (short cut to Gi router)
– Implementation of a protocol stack on the interlace between SGSN and MCs
– Implementation of a virtual private network (VPN) by means of IPsec on the Gi router
– Implementation of a “ping” mechanism to maintain the interface to MCs

IRI-tickets
The collection of interception-relevant data is performed in the SGSN/SLR. Data de-
scribing the packet-switched services is transferred in the form of IRI-tickets via a
TCP/IP connection to an Lawful Interception - Interception Management System (LI-
IMS) and then forwarded to the monitoring center (MC). IRI-tickets consist of all inter-
cepted data relevant to attach, detach, routing area update, PDP context (transaction)
and SMS (MO/MT) of the monitored GPRS-MS coded in ASN.1 format. These IRI-tick-
ets are created for packet-switched services (PDP context activation/deactivation) and
for actions not related to the traffic channel (SMS MO/MT). The IRI-tickets contain,
among other data, the directory numbers of the session subscribers, the provider ID, op-
erator ID, switch ID and the location code for the subscriber at the call time (CGI/RAC),
if available. In general, the MSISDN, IMSI or IMEI form the basis for selecting an inter-
cepted subscriber.
Lawful interception enhancements in current software version:
• Failed attach notification
The generation of interception related information (IRI) tickets for failed subscriber
attach.

160 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

• Adaption of the latest standard enhancements for inter-PLMN RAU

After inter-PLMN RAU an interception start ticket is sent to all LEAs (via LI-IMS) ob-
serving the GPRS mobile subscriber. This ensures that a LEA that is observing in
the serving PLMN after RAU but not in the serving PLMN before RAU, gets a ticket
to correlate this information with the delivered communication content.
• Enhanced buffering of tickets with optional storing on disk
Enhanced buffering within the system is implemented with an optional overflow on
disk.

Execution sequences
Three independent procedures are provided for the lawful interception functionality (see
Fig. 4.30):
– Enhanced administration (1): identifying the GPRS mobile subscriber as a
IRI-subscriber
The identification is undertaken in the network components SGSN/SLR in the inter-
ception database by CMISE operation from the LI-IMS via the TCP/IP interface
(MML is not usable as the administration language).
– Packet data processing/interception product (2)
Duplicating the data packets in the SGSN/SLR by a packet duplicator. A new inter-
face delivers the intercepted product which is transmitted to the consumer (LEA).
– IRI-ticket generation and transfer (3)
Data describing attach, detach, routing area update, PDP context activation/deacti-
vation or SMS MO/MT (IRI-ticket) is generated at the start/stop of monitoring and
transferred via hot operation over a TCP/IP connection using CMISE to the IMS
where the IRI-tickets are transferred to the monitoring center (MC)/law enforcement
agency (LEA).

A50016-D1111-V12-2-7618 161
System Description D900/D1800 Information
GPRS PLMN System

LI-IMS
Monitoring center (MC)
OS (1)

Evaluation for
consumers (LEA) VPN via
Internet/Q3 (1) (3)
(TCP/IP) IPsec
CMISE
(3) Internet/Q3
(TCP/IP)
CMISE

GPRS (2)
network node Internet
(SGSN/SLR)

PLMN Point of
BSS presence
(POP)

Calling GGPRS subscriber Called server

Fig. 4.30 Lawful interception with interception for a mobile-originated packet data
transfer

162 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.5 Operation and Maintenance Functions

These operation and maintenance functions enable the PLMN operator to manage data
throughout the network in a simple manner and to control functions which influence or
control the GPRS mobile subscriber traffic. The network-wide management and control
of the facilities of the GPRS mobile subscriber functionality are usually performed in the
GPRS Switching Subsystem (GSS).
The complete management of the GSN nodes is described by means of an object mod-
el. In principle, this implies that a PLMN operator sees the telecommunication functions
and the equipment to perform these functions as managed objects. Therefore, managed
objects represent the physical (equipment related) and logical entities which make up
the GSN nodes. The managed objects are described by their behavior, their attributes
with their values, the operations that can be performed on them and the notification they
issue.
Information available at the GSN nodes is typically modeled as attributes of managed
objects. Managed objects and their attributes are managed via Q3/SNMP tasks (com-
mands) directly issued by a PLMN operator or indirectly generated by an application.
The actual object class instances and the values to their attributes are stored in one form
or another in the GSN node DBMS. Administration is executed by means of proper
Q3/SNMP tasks (commands).

Management functions in the packet-switched (GPRS) domain nodes

GPRS provides the operator with various management functions such as:
– Configuration management
– Fault and maintenance management
– Performance management
– Accounting (charging and billing) management.
GPRS mobile subscriber administration is implemented in the circuit-switched part
i which is described in the System Description D900/D1800, register GSM PLMN.

The management functions are implemented via O&M tasks generated with them. An
O&M task (operational task) is a higher-level abstraction over a machine language
which the network element understands. This operational task is a single element of op-
erational flow, represented in the GSNs/SC by a single element of the task tree.
The GPRS PLMN nodes are managed by means of the Q3/SNMP interface which al-
lows standardized management of the network. The GSNs are administered by graphi-
cal user forms for individual Q3/SNMP operations. The PLMN operator invokes them via
a task tree. The task tree comprises all major operation and maintenance tasks which
in turn contain the appropriate graphical user forms.
This tasks can be defined in the form of Q3/SNMP scripts, Q3/SNMP requests and
Q3/SNMP scenarios.
– Q3/SNMP script: A sequence (flow with decisions) of Q3/SNMP tasks (commands)
written into a batch file. Reaction on events is possible. Predefined values can be
used.
– Q3/SNMP request: A single Q3/SNMP command characterized by fixed values for
managed object class and operation (create, set, get, delete, actions). All other pa-
rameters have to be selected by the PLMN operator.
– Q3/SNMP scenario: A flow of tasks and/or NT executables.
These tasks can be introduced either locally (with craft terminal local, CTL) or remotely
(with client terminal, CT in the Switch Commander (SC) or the IP Manager (IP-M)). Re-

A50016-D1111-V12-2-7618 163
System Description D900/D1800 Information
GPRS PLMN System

mote introduction is implemented via the SC/IP-M or OS. TMN interfaces with corre-
sponding services (e.g., CMISE, FTAM) are available for this (section 4.6,
Communication Protocols and Signaling Functions in the GPRS PLMN).

4.5.1 Display of SGSN Mobile Subscriber Data

This feature allows the PLMN operator to display the values of SGSN data. For the sev-
eral consisting user features separate actions are defined in the O&M and also new
O&M tasks are defined.
The feature is divided into 6 “use”' features, each of them defined for display of a certain
set of data. The following features display data of one mobile subscriber, using a certain
IMSI or MSISDN value as input:
– Display of basic mobile subscriber data of one mobile subscriber, located in the SLR
– Display of the subscribed PDP context data, located in the PDP context record pool
of the SLR, of a mobile subscriber
– Display of actual PDP context data, located in the context table on MP:PD/SH; data
of one mobile subscriber
– Display of CAMEL related data, located in the SLR, of one mobile subscriber
– Display of multiple mobile subscribers in the SLR
– Display of multiple CAMEL prepaid subscribers

4.6 Communication Protocols and Signaling Functions in the

GPRS PLMN
The frame relay (FR) protocol with OSI layer structure is used for communication/signal-
ing between the BSS and the SGSN/SLR.
The IP protocol with an OSI layer structure is used for communication/signaling between
the GGSN/IPS and the PDN (Gi interface) and between GGSN/IPS and SGSN/SLR or
between two SGSN/SLR (Gn interface) with the GTP protocol layer.
The common channel signaling system SS7 is used in the GPRS PLMN for signaling
functions between the SSS network nodes (MSC/VLR or HLR/AC) and SGSN/SLR.
The TCP/IP communication protocol with OSI layer structure is used for signaling for Q3
interfaces between the SC in the OMS and the network elements of the GSS on the ba-
sis of a LAN (Ethernet).
The UDP/IP communication protocol with OSI layer structure is used for signaling for Q3
interfaces between the SC and the OS on the basis of a WAN (Internet).
Fig. 4.31 shows an overview of the communication/signaling routes for the traffic con-
nection in the GPRS PLMN, indicating the communication protocol/signaling system
(e.g., frame relay (FR), IP, SS7) and the highest level user parts (UP) or application
parts (AP) (e.g., IP or MAP).
There can be additional signaling connections present between GPRS network ele-
ments and the additional project-dependent network elements (service centers).
Such service centers can be:
– Service centers for GSM subscriber-related routing of service numbers
– Interworking MSC (as link to an SMS service center).

164 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

*) In case of IPS, the CSG does not offer

Ga interface, but a GTP’/TLV interface.

FS
GPRS-MS GSS

GSM signaling CG
Ga interface Ga interface (without L-CG) *)
system
FTP interface (with L-CG)
(CM, MM, RR)

BSS
LLC SGSN/SLR GTP GGSN/IPS IP PDN
(BSSGP/ (IP) (IP)
FR)
SS7
SS7
(MAP)
(MAP)
SS7
SSS
(ISUP/TUP,
EIR MAP) HLR/AC FS

SS7
SS7 SS7 (MAP)
(MAP) (MAP)

SS7 MSC/VLR SS7 GMSC SS7 PSTN/

(BSSAP) (ISUP/TUP) (ISUP/TUP) ISDN

Fig. 4.31 Communication protocol/signaling routes for the traffic connections of the GPRS PLMN (and GSM
PLMN)

Fig. 4.32 shows an overview of the communication protocol/signaling routes for the
O&M connections in the GPRS PLMN between OMS components and the telecommu-
nication network elements indicating the communication protocol (TCP/IP via LAN
(Ethernet), UDP/IP via WAN (Internet)) and the user services (CMIP, FTP, SNMP). A
mobile integrator (MI) architecture, as described in the System Description
D900/D1800, register Network System Concept, section entitled network components
of the mobile integrator (MI), is not taken into consideration in this figure.

A50016-D1111-V12-2-7618 165
System Description D900/D1800 Information
GPRS PLMN System

LI-IMS ABC OS

UDP/IP
(CMIP, TCP/IP
SNMP) (FTP,
SC CMIP,
SNMP)
OMS

TCP/IP
(FTP, GSS
CMIP,
SNMP)

SGSN/SLR GGSN/IPS

Fig. 4.32 Signaling routes for the O&M connections of the GPRS PLMN

Fig. 4.33 shows the protocol/signaling structure of the GSS network nodes (e.g., SG-
SN/SLR) and the signaling structure of the BSS (BSC/BTS) with reference to the X.200
layer model in accordance with OSI (OSI layer).

BSS network node SGSN/SLR network GGSN/IPS network

(BSC/BTS) node node

Interworking unit Interworking unit Interworking unit

OSI layer

6
5 SNDCP GTP GTP

4 LLC UDP UDP

3 RLC BSSGP BSSGP IP IP IP

2 MAC FR FR L2 L2 L2

1 L1 L1 L1 L1 L1 L1

GSM radio Gb interface

interface Gn interface Gi interface

Fig. 4.33 Layers and levels of the GPRS PLMN communication protocol/signaling
functions of a GPRS mobile traffic connection

166 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.6.1 Structure of the GSM Radio Interface Signaling System (for GPRS
PLMN)
The structure of the GSM radio interface signaling system (for GPRS PLMN) is based
on three OSI layers (Fig. 4.34):

Interworking unit

OSI layer OSI layer

Applica-
tion
7 7

SNDCP 5–6
5–6
LLC
4 4

RLC RLC
3 3

2 MAC MAC 2

L1 L1 1
1

Um interface

Fig. 4.34 Structure of the GSM radio interface signaling system (for GPRS PLMN)

Layer 3 of the GSM radio interface (for GPRS PLMN) consists of the radio link control
(RLC) protocol which provides a reliable link via the radio interface which fits the block
structure of the physical channel. It segments and reassembles the LLC frames.
Layer 2 of the GSM radio interface (for GPRS PLMN) consists of the media access con-
trol (MAC) protocol which provides access to the physical radio resource. This means,
that it is responsible for the physical allocation of a packet data channel. It is strongly
associated with the RLC layer.
Layer 1 of the GSM radio interface (for GPRS PLMN) consists of the physical radio
channel used to transfer the data packets, i.e. carrier frequencies, modulation and trans-
mitter/receiver characteristics.

A50016-D1111-V12-2-7618 167
System Description D900/D1800 Information
GPRS PLMN System

4.6.2 Protocol Structure of the Gb Interface

Fig. 4.35 shows the structure of the communication protocol of the Gb interface be-
tween the BSS (BSC (PCU)) and the SGSN/SLR. The Gb interface offers the possibility
of connecting the SGSN/SLR to the BSS/PCU via frame relay (FR). Frame relay frames
are exchanged via permanent virtual connections (PVC) between the SGSN/SLR and
the PCU.

Interworking unit

OSI layer OSI layer

Applica-
tion
7 7

SNDCP 5–6
5–6
LLC
4 4

BSSGP BSSGP
3 3
Frame Frame
2 2
relay relay

1 L1 L1 1

Gb interface

Fig. 4.35 Protocol structure of the Gb interface

Layer 7 (application layer)

The application layer is on top of the transport layer. It contains all the higher-level pro-
tocols. This layer is transparent in the frame relay (FR) system.

Layers 6, 5 (presentation and session)

This layer contains the subnetwork-dependent convergence protocol (SNDCP) which
supports the tasks, compression, segmentation/reassembling and multiplexing/demulti-
plexing a tone or more LLC service access points.

Layer 4 (transport layer)

The layer above the BSSGP contains the logical link control (LLC) which provides the
service necessary to maintain the communication capability between the GPRS-MS and
the SGSN/SLR.

Layer 3 (network layer)

The network layer defines the BSS GPRS protocol (BSSGP) which is used to transfer
the LLC frames together with related information between the SGSN/SLR and the PCU.

168 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

Layer 2 (data link layer) and layer 1 (physical layer)

The frame relay (FR) layer is applied below the BSSGP layer (layer 3) as the link layer
protocol to connect the SGSN/SLR to the PCU.

4.6.3 Protocol Structure of the IP-based Interfaces

Fig. 4.36 shows the structure of the Internet protocol (IP) based interfaces implemented
for example at the Switch Commander (SC) local area network (LAN).

Interworking unit

OSI layer OSI layer

Applica- Applica-
tion tion
7 7

5–6 5–6

TCP/ TCP/
4 UDP UDP 4

IP IP
3 3

2 Host-to- Host-to- 2
network network
1 1

Fig. 4.36 Protocol structure of the IP-based interfaces

Layer 7 (application layer)

On top of the transport layer is the application layer. It contains all the higher-level pro-
tocols. The early ones included file transfer protocol (FTP), TELecommunication NET-
work (TELNET), simple mail transfer protocol (SMTP) and simple network management
protocol (SNMP). The FTP provides a way to move data efficiently from one machine to
another. The TELNET provides a remote login or virtual terminal. The SMTP provides
the transmission of electronic mail. The SNMP provides the transfer of management in-
formation between network elements and management systems.

Layers 6, 5 (presentation and session)

These layers are not present in the IP reference model.

Layer 4 (transport layer)

The layer above the Internet layer in the IP model is usually called the transport layer. It
is designed to allow peer entities on the source and destination hosts to carry on a con-
versation in the same way as in the OSI transport layer.

A50016-D1111-V12-2-7618 169
System Description D900/D1800 Information
GPRS PLMN System

There are two possible protocols:

– User datagram protocol (UDP)
carries PDUs for protocols which do not need a reliable data link (e.g., IP). UDP pro-
vides protection against corrupted PDUs.
– Transport control protocol (TCP)
carries PDUs for protocols which need a reliable data link. TCP provides flow control
and protection against lost and corrupted PDUs.

Layer 3 (network layer)

The Internet layer defines an official packet format and protocol called IP (Internet pro-
tocol). The job of the Internet layer is to deliver IP packets where they are supposed to
go. Packet routing is clearly the major issue here. For these reasons, it is reasonable to
say that the IP Internet layer is very similar in functionality to the OSI network layer.

Layer 2 (data link layer) and layer 1 (physical layer)

There is a great void beyond the Internet layer (layer 3). The IP reference model does
not really say much about what happens here, except to point out that the host must con-
nect to the network using a particular protocol so that it can send IP packets over it. This
protocol is not defined and varies from host to host and network to network.

170 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

4.6.4 Structure of the SS7 Signaling System (for GPRS PLMN)

The SS7 signaling system can be divided into:
– Message transfer part (MTP)
– Signaling connection control part (SCCP)
– User parts (UP, e.g., ISUP)
– Application parts (AP, e.g., TCAP, MAP, BSSAP+).
Tab. 4.6 shows the signaling routes for SS7 in the GPRS PLMN with the SS7 signaling
components used.

Signaling link Signaling components

SGSN/SLR – MSC/VLR SS7:

(Gs interface) MTP, SCCP, BSSAP+

SGSN/SLR – HLR/AC SS7:

(Gr interface) MTP, SCCP, TCAP, MAP

SGSN/SLR – SMS GMSC/IWMSC SS7:

(Gd interface) MTP, SCCP, TCAP, MAP
SGSN/SLR – GMLC SS7:
(Lg interface) MTP, SCCP, TCAP, MAP

Tab. 4.6 SS7 components on the signaling routes (in the GPRS PLMN)

Some SS7 signaling components are described in the relevant sections of the System
i Description D900/D1800, register GSM PLMN. For GPRS PLMN, the BSSAP will be en-
hanced to fulfill the requirements of SGSN/SLR to MSC/VLR and the MAP will be en-
hanced to fulfill the requirements of SGSN/SLR to HLR/AC and SGSN/SLR to SMS
GMSC/IWMSC interworking, as described below.

Mobile application part (MAP)

The MAP regulates communication between the network elements in the GPRS GSS to
control network access of the GPRS-MS. The MAP provides signaling procedures for
this purpose which perform self-contained control tasks. The MAP functions are used to
transfer subscription and routing area information for the SGSN/SLR to the HLR inter-
face (Gr) in particular.
The following functions are provided:
– Routing area registration (routing area update)
– Authentication
– Retrieving GPRS mobile subscriber parameters for session setup
– Updating HLR and SGSN/SLR GPRS mobile subscriber parameters
– Function relating to the short message service
– Function relating to the location services

A50016-D1111-V12-2-7618 171
System Description D900/D1800 Information
GPRS PLMN System

5 Abbreviations
3G Third Generation
AAL1 ATM Adaption Layer 1
ABC Administration and Billing Center
AC Authentication Center
ACL Access List
ACOM Antenna Combiner
ALI Alarm Indication Module
AMX ATM Multiplexer
AP Accounting Probe
APN Access Point Name
ARQ Automatic Repeat Request
ASBR Autonomous System Border Router
ASN ATM Switching Network
ASN.1 Abstract Synatax Notation 1
BBSIG Baseband and Signal Processing
BG Boarder Gateway
BGP4 Boarder Gateway Protocol 4
BLER Block Error Rate
BMD Billing Mediation Device
BR Border Router
BSC Base Station Controller
BSCI BSC Interface Card
BSIC Base Station Identity Code
BSS Base Station System
BSSGP BSS GPRS Protocol
BTS Base Transceiver Station
BTSE Base Transceiver Station Equipment
CAMEL Customized Application for Mobile Network
Enhanced Logic
CAN Customer Access Network
CAPEX Capital Expenditure
CBC Cell Broadcast Center
CBR Constant Bit Rate
CC Charging Characteristics
C-CG Central Charging Gateway
CCNC Common Channel Signaling Network Con-
trol
CCTRL Core Controller
CCU Channel Codec Unit
CDE Common Desktop Environment

172 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

CDR Charging Detail Record

CE Computing Element
CGF Charging Gateway Function
CGI Cell Global Identifier
CID Charging-ID Number
CITA Cell Identification Timing Advance
CLI Command Line Interface
CMIP Common Management Information Proto-
col
COBA Core Basis
COPS Common Open Policy Service
COSA Core Satellite
CSCF Call Session Control Function
CSG Content Service Gateway
CSM Content Switching Module
CTL Craft Terminal Local
CU Carrier Unit
DBMS Database Management System
DCN Data Communication Network
DFP Dynamic Feedback Protocol
DHCP Dynamic Host Configuration Protocol
DIAMCO Di Amplifier Multi Coupler
DiffServ Differentiated Services
DNS Domain Name Server
DoS Denial of Services
DSCP Differentiated Service Code Point
DUCOM Duplex Combiner
DULAMO Duplexer and Low Noise Amplifier Module
E Ethernet
E1 European PDH Signal, Level1 (PCM30)
E-CITA Enhanced Cell Identification Timing Ad-
vance
E-CU EDGE Carrier Unit
EDGE Enhanced Data rates for GSM Evolution
eGGSN Enhanced GGSN
EGPRS Enhanced General Packet Radio Services
ETSI European Telecommunication Standards
Institute
FE Fast Ethernet
FICOM Filter Combiner
FM Fault Management
FR Frame Relay

A50016-D1111-V12-2-7618 173
System Description D900/D1800 Information
GPRS PLMN System

FTP File Transfer Protocol

FW Firewall
FWLB Firewall Load Balancer
GE Gigabit Ethernet
GEA GPRS Encryption Algorithm
GERAN GSM and EDGE Radio Access Network
GMLC Gateway Mobile Location Center
GMM GPRS Mobility Management (in 2G-SG-
SN/SLR)
GRX GPRS Roaming Exchange
GSN GPRS Support Node
GSS GPRS Switching Subsystem
GUI Graphical User Interface
HLR Home Location Register
HSCSD High-Speed Circuit Switched Data
HSS Home Subsriber Server
HYCOM Hybrid Combiner
IMS IP Multimedia Subsystem
IMSI International Mobile Subscriber Identity
IN Intelligent Network
IOS Input/Output Software
IP Internet Protocol
IPsec IP Secure (an IETF protocol framework for
securing IP transport)
IRI Interception Related Information
ISUP Integrated Services Data Network (ISDN)
User Part
ITU-T International Telecommunication Union,
Sector Telecommuniction Standardization
IXLT O&M Interface
L2TP Layer 2 Tunneling Protocol
LAC L2TP Access Concentrator
LAC Location Area Code
LAN Local Area Network
LCS Location Service
LER Label Edge Router
LI Link Interface
LIC Line Interface Card
LI-IMS Lawful Interception - Interception Manage-
ment System
LLC Logical Link Control
LMT local maintenance terminal
LNA Low Noise Amplifier

174 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

LNS L2TP Network Server

LSP Label Switched Path
LSR Labele Switching Router
LTG Line/Trunk Group
MAC Medium Access Control
MAP Mobile Application Part
MC Monitoring Center
MCC Mobile Country Code
MCR Message Coordinator
MF Mediation Function
MIA Mobile Internet Access
MM Mobility Management
MNC Mobile Network Code
MO-LR Mobile Originating Location Request
MP Main Processor
MP:ACC Main Processor:Accounting
MP:MM Main Processor:Mobility Management
MP:OAM Main Processor:Operation, Administration
and Maintenance
MP:PD/SH Main Processor:Packet Dispatching and
Session Handling
MP:SLT Main Processor:Signaling Link Termination
MP:SM Main Processor:Signaling Management
MP:STATS Main Processor:Statistics
MP-AP Main Processor used for Application soft-
ware Processing
MPCC Main Processor Control Card
MP-IO Main Processor used for Input and Output
MPLS Multi Protocol Label Switching
MP-SA Main Processor with Standalone Capability
MPU Main Processor Unit
MPUD Main Processor Unit Type D
MS Mobile Station
MSC Mobile-Services Switching Center
MSCI MSC Interface Card
MT-LR Mobile Terminating Location Request
MTP Message Transfer Part
MWAM Mobile Wireless Access Module
NAM Network Access Mode
NMC Network Management Center
NSAPI Network Layer Access Point Identifier
O&M Operation and Maintenance

A50016-D1111-V12-2-7618 175
System Description D900/D1800 Information
GPRS PLMN System

OMS Operation and Maintenance System

OMT/N OMT for National OMC application
OPEX Operational Expenditure
ORACLE Commercially database product
OSF Open Software Foundation
OSPF Open Shortest Path First
OTP Open Test Platform
PA Power Amplifier
PATRX Power Amplifier and Transceiver unit
PBR Policy Based Routing
PC Personal Computer
PCP Peripheral Control Platform
PCU Packet Control Unit
PD Packet Dispatching
PDC Performance Data Collector
PDF Policy Decision Function
PDN Packet Data Network
PDP Packet Data Protocol
PDU Packet Data Unit
PFC Packet Flow Context
PFI Packet Flow Identifier
PFM Packet Flow Manager
PLMN Public Land Mobile Network
PM Performance Management
PoS Packet Over SONET
PPCC Peripheral Processor for CCS7
PPCU Peripheral Packet Control Unit
PPLD Peripheral Processor for LAPD Channels
PPXL Peripheral Processor for LAPD Chan-
nels/SS7
PPXU Peripheral Processor for GPRS Traffic
PRM Packet Routing Management
PSK Phase Shift Key
PTP Point-To-Point
PTPPKF Point-To-Point Packet Transfer
PVC Permanent Virtual Connection
QTLP Quad Trunk Line Interface
RAID Redundant Array Inexpensive Device
RAS Remote Access Server
RAU Routing Area Update
RC Radio Commander
RF Radio Frequency

176 A50016-D1111-V12-2-7618
Information System Description D900/D1800
System GPRS PLMN

RIP Routing Information Protocol

RLC Radio Link Control
RM Resource Management
RRC Radio Resource Control
RSVP Resource Reservation Protocol
RX Receiver
RXAMCO Receiver Antenna Module and Multi Cou-
pler Module
RXAMOD Receive Antenna Module
RXFIL Bandpass Filter for Receive Path
RXMUCO Receiver Multi Coupler
SBS Siemens Base Station System
SC Switch Commander
SCCP Signaling Connection Control Part
SCSI Small Computer System Interface
SDH Synchronous Digital Hierarchy
SE System Element
SEG Security Gateway
SIPRO Signaling Processing unit
SLA Service Level Arrangement
SLB Server Load Balancer
SLPP Subscriber Location Privacy Profile
SLR SGSN Location Register
SM Session Management
SMC Security Management Center
SMLC Serving Mobile Location Center
SMSC SMS Service Center
SMTP Simple Mail Transfer Protocol
SN(B) Switching Network B
SN16 Switching Unit with 16 kbit/s Submultiplex-
ing
SNAP Switching Network Advanced Performance
SNDCP Subnetwork Dependent Convergence Pro-
tocol
SNMP Simple Network Management Protocol
SONET Synchronous Optical Network
SP:BSSGP Server Processor:Base Station System
GPRS Protocol
SP:GTP Server Processor:GPRS Tunneling Proto-
col
SSG Service Selection Gateway
SSL Secure Sockets Layer
STM Synchronous Transfer Mode

A50016-D1111-V12-2-7618 177
System Description D900/D1800 Information
GPRS PLMN System

STM1 Synchronous Transfer Mode 1

SUP Supervisor card
SWM Software Management
TAF Terminal Adoption Function
TAP Transferred Account Procedure
TCAP Transaction Capabilities Application Part
TCP Transport Control Protocol
TCP/IP Transmission Control Protocol/Internet Pro-
tocol
TDM Time Division Multiplex
TDPC Telephony and Distributor Processor Card
TELNET TELecommunication NETwork
TLLI Temporary Logical Link Identity
TMA Tower Mounted Amplifier
TOS Type of Service
TPDU Transfer Protocol Data Unit
TPU2 Transceiver and Processor Unit
TRAC Transcoding and Rate Adaption Card
TRAU Transcoding and Rate Adaption Unit
TRXA Analogue Signal Processing Part
TRXD Digital Signal Processing Part
TSC Technical Service Center
TSP Tunnel Switching Point
TX Transmitter
TXAMOD Transmit Antenna Module
TXFIL Bandpass Filter for Transmit Path
UDP User Datagram Protocol
UIAMCO Duplexer Amplifier Multi Coupler
VAD Voice Activity Detection
VC Virtual Connection
VPN Virtual Private Network
WAN Wide Area Network
WAP Wireless Application Protocol

178 A50016-D1111-V12-2-7618