Page 1 of 18
`
`NOVATEL EXHIBIT 1030
`
`

`
`This book is published by the authors. Correspondence, in particular for
`orders, but also for comments, should be mailed to:
`
`M. MOULY et Marie—B. PAUTET
`
`49, rue Louise Bruneau
`F-91 120 PALAISEAU
`
`FRANCE
`
`Copyright © 1992, Michel MOULY and Marie-Bernadette PAUTET
`
`All rights reserved. No part of this book may be reproduced, translated, or
`utilised in any form or any means, electronic or mechanical, including
`photocopying, recording, or any information storage or retrieval system,
`Without permission in writing from the authors.
`
`All drawings are original, and all corresponding rights reserved.
`
`The name and logo GSM (and "Global System for Mobile communications")
`are registered.
`
`A International Standard Book Number:
`
`2.=-9507190-0-7
`
`.7»,
`
`.7, ,_ m
`
`—
`
`—
`
`_
`
`Page} of 18
`
`
`
`
`
`‘..,3‘-YY,‘."'.WWHz;‘Mum..».\~\.;“,‘v.}i_i».-,i,_»:_\fli.‘,\
`
`[-3
`..L.’~.7_-.
`an
`
`Page 2 of 18
`
`

`
`
`
`SETTING THE SCENE 59
`
`Data Services: a Summary
`
`The Specifications define services in the same way as ISDN does.
`They distinguish “bearer services” which correspond to the transportation
`of user
`data
`between
`two
`“terminal-modem”
`interfaces,
`from
`“teleservices” which are complete end—to—end services, including terminal
`capabilities. The list of bearer services appearing in the Specifications in
`given in table 1.4.
`
`Though identified as a separate bearer service, the basic “PAD
`access circuit asynchronous” service requires in fact nothing specific in
`the GSM networks compared to the “data circuit duplex asynchronous”
`service. The same sort of remark also applies to several teleservices, as
`can be derived from table 1.5. For instance, the specificity of a teleservice
`such as videotex, compared to the relevant bearer service, does not
`concern the GSM domain. Though videotex is identified as a separate
`teleservice in the Specifications (at least for phase 1), the GSM networks
`need not implement anything specific to offer their customers access to
`Videotex, on top of the basic support of the “data circuit duplex
`asynchronous, 1200/75 bit/s” bearer service. Other examples are X.400
`message handling systems and teletex. Conversely, some teleservices are
`supported by GSM in the same way,
`though not mentioned by the
`Specifications. Examples are group 4 facsimile or access to voice
`messaging centres.
`
`Teleservice
`
`Corresponding bearer service
`
`Telephony
`
`Emergency calls
`
`— Automatic facsimile group 3
`
`Short message service MT/PP
`Short message service MO/PP
`Short message cell broadcast
`
`_
`
`—
`—
`
`Advanced MHS access (X.400)
`
`Data circuit duplex synchronous
`
`Videotex access (profiles 1, 2 or 3)
`
`Data circuit duplex asynch. 1200/75 bit/s
`
`Teletex
`
`Data circuit duplex synchronous
`
`Alternate speech/facsimile group 3
`
`Table 1.5 — Teleservices offered in GSM
`
`Page 3 of 18
`
`True GSM teleservices include speech, fax and short messages.
`
`Page 3 of 18
`
`

`
`SETTING THE SCENE
`
`67
`
`can offer a number of functions locally, without the help of a network.
`Examples include the dialling of abbreviated numbers,
`the storage of
`received short messages,
`the edition of short messages,
`the automatic
`repeat of failed calls, the automatic answering of calls, and so on. In some
`cases,
`like in the latter example,
`the same function can be fulfilled
`locally, if the terminal implements it, or by the infrastructure, if a voice
`messaging facility is provided.
`
`The standard places few constraints on the local features. Mobile
`station manufacturers may or may not include them in their products.
`Some are specified by the standard simply because they are provided in
`fact by the SIM (see next section), and not by the part built by the mobile
`station manufacturer. In factthe only real imposed constraints pertain to
`the automatic repetition of call attempt,
`for which a number of
`I restrictions are put, to diminish the risk of overloading the networks with
`useless attempts.
`
`Another point worth noting is the existence of the ‘+’ key, which is
`specified as a harmonised shortcut replacing the international prefix,
`whatever the convention of the network the user happens to get service
`from. For instance, when in Sweden, a GSM user can call somebody in
`Italy by dialling +39 followed by the national number, instead of dialling
`O9939... Another important advantage in so doing is that the stored
`“+39...” number will be recognised correctly by all GSM PLMNS
`(including in Italy), and therefore remains valid irrespective of roaming.
`
`1.3.1.6. The Subscriber Identity Module
`
`A mobile station in any cellular network must be personalised, i.e.,
`associated with a given subscription. This is needed since the identity of
`the subscriber is not in a one—to—one correspondence with the physical
`medium used for access as in a wireline network. The usual approach is
`to store in a permanent memory of the machine the required information,
`such as a subscription identifier. This is what is done in most analogue
`cellular networks (an exception is the German C network). The approach
`in GSM is different.
`
`A GSM mobile station is split in two parts, one of which contains
`the hardware and software specific to the radio interface, and another
`which contains the subscriber—specific data:
`the Subscriber
`Identity
`Module, or SIM. The SIM can be either a smart card, having the well-
`known size of credit cards, or alternatively it can be “cut” to a much
`
`Page 4 of 18 ‘
`
`Page 4 of 18
`
`

`
`68
`
`THE GSM SYSTEM
`
`Figure 1.7 — The two types of SIMS
`
`The plug—in SIM has been designed to enable smaller handhelds to be built,
`and will not be removed as often as the card—sized SIM.
`
`smaller format, called “plug—in SIM” (see figure 1.7). This smaller format
`was introduced to put less constraints on the design of handhelds. The
`SIM is a kind of key. Once removed from the terminal, the latter cannot
`be used except for emergency calls (if the network permits), that is to say
`it cannot be used for any service which will impact the subscriber’s bill.
`
`This View must be somewhat qualified, because the insertion and removal of the
`SIM is not necessarily easy with all mobile stations. Since its small size does not make it
`easy to manipulate, it is not foreseen that plug—in SIMS will be easy to remove, and in
`some cases mobile manufacturers have even secured them in the handheld station by a
`screwed lid. But the possibility still remains for the user to change it.
`
`The possibility to remove the SIM presents many advantages for
`the user beside its role as a key. For instance, if his mobile station fails
`and must be taken to repairs, another one can be used for the interim
`period. It suffices to remove the SIM from one equipment and to put it in
`the other. Another example is the case of urban users, which have only a
`handheld, for reasons of economy. When needed, they can borrow a more
`powerful station to be used in the countryside, or rent a car equipped with
`a Vehicle—mounted station. In all cases, they can use their own SIM, in
`
`g.
`Page 5 of 18
`
`Page 5 of 18
`
`

`
`
`
`SETTING THE SCENE 69
`
`order for calls toward their personal number to be routed to the rented
`terminal, and for the call charges to be put on the same bill as for the calls
`made through their handheld.
`
`The SIM is also the custodian of much information involved in the
`local provision of services to the user. The SIM can be protected by a
`password, a PIN code (Personal
`Identity Number),
`similar
`to the
`(typically 4—digit) PINs of credit cards. Unlike many credit card PINS, the
`GSM PIN may be chosen by the subscriber. The SIM may also contain a
`list
`of
`abbreviated
`dialling
`numbers, with
`the
`corresponding
`alphanumerical index (for the name of the correspondent for instance)
`and the type of call (speech, fax, ...). The SIM can also be used to store
`short messages, in particular those received when the user is not present.
`A more technical application is the storage of a list of preference for the
`choice of a network when several are possible. Since the user will have to
`choose which network he will get service from, for instance when he
`crosses an international boundary, the SIM stores information to make
`this choice automatically,
`taking into account
`the user’s preferences.
`When real—time advice of charge becomes available on networks, the SIM I
`will also be able to memorise this charging information,
`to keep the
`subscriber informed of his expenses.
`
`An interesting development for the user is the potentiality to read
`and modify part of the personal information stored in the SIM. This can
`of course be done using the keyboard of a mobile station, but a more
`comfortable approach could also be offered, using a card reader
`connected to a personal computer, and relevant software to enter
`abbreviated dialling numbers, to archive short messages on the computer,
`etc. Of course, this only holds for part of the data stored in the SIM, since
`most of the information is protected against alterations and in some cases
`even against reading. The scope of the SIM can even be extended beyond
`GSM, and the concept of a multi—application card is emerging. The '
`compatibility of the SIM specification with internationally—recognised
`ISO standards in this domain makes the GSM application a good
`candidate for inclusion into a multi—app1ication card. The concept of the
`SIM is yet in its infancy, and will undoubtedly become a basis for a better
`interworking between a user and a terminal.
`
`Another portentous aspect of the SIM is related to roaming. We
`have already seen how roaming can be achieved by using the same
`mobile equipment to get service from two different networks with a
`single subscription. We will call this kind of roaming “MS—roarning” (MS
`standing for mobile station), since there is another possibility. The
`interface between the SIM and the rest of the mobile station is
`standardised in the Speczficatiorzs, and this standard could provide a basis
`for roaming between PLMNs having different Air Interfaces, which will
`Page 6 of 18
`
`Page 6 of 18
`
`

`
`70
`
`THE GSM SYSTEM
`
`single radio .
`interface
`
`single SIM—ME
`interface
`
`{I} SIM
`4
`
`(a) SIM-roaming
`
`(b) MS=roaming
`
`Figure 1.8 — PLMN interfaces
`
`Inter—PLMN interfaces must be fully standardised to allow any kind of roaming;
`in addition, MS—roaming requires a standardised air interface,
`whereas SIM—roaming requires a standardised SIM—ME interface.
`GSM offers the most flexible form of roaming, with full MS— and SIM—roaming.
`(the greyed rectangles indicate the areas where standardisation is required).
`
`be referred to as SIM-roaming. SIM—roaming does not offer the fully
`automatic network selection as MS—roaming does (except with dual— or
`multiple—mode mobile stations), but it allows inter—operability at a much
`larger scale between systems based on different radio techniques. Instead
`of carrying his mobile station, a user would only take his subscriber card
`with him and use a different mobile equipment to adapt it to the networks
`he wants to access (see figure 1.8).
`
`Moreover, SIM—roaming does not present any technical obstacle to
`the extension to any kind of telecommunication network, wire—accessed
`or radio—accessed, since the network aspects of the roaming issue do not
`depend on the access scheme used in each network. The SIM appears
`then as the technical Vector for personal numbering, that is to say a means
`to provide each user with a single telecommunication number whatever
`the network the user happens to be connected to. This is an important
`topic at the date of writing, with the studies concerning UPT (Universal
`Personal Telecommunications). Undoubtedly, the Specifications in this
`domain prefigure a future world—wide telecommunication system,
`in
`
`Page 7 of 18
`
`Page 7 of 18
`
`

`
`
`
`SETTING THE SCENE 7 1
`
`which the user simply equipped with his SIM will be able to access any
`telecommunication system.
`
`1.3.1.7. Security Functions
`
`A radio accessed network is inherently less secure than a fixed
`network. This comes from the possibility to listen to and to emit radio
`waves from anywhere, without tampering with operator’s equipment. To
`correct a little this state of affair, several types of security functions have
`been introduced in GSM in order
`to protect
`the network against
`fraudulent access and to ensure subscriber privacy. These functions
`include:
`
`0
`
`0
`
`0
`
`authentication of
`unregistered users;
`
`the
`
`subscriber,
`
`to prevent
`
`access of
`
`radio path ciphering, in particular ciphering of all subscriber
`information to prevent third—party tapping;
`
`subscriber identity protection,
`disclosure.
`
`to prevent subscriber location
`
`These‘ facilities are not subscribed to, and are not under control of
`the user. The reason for this is that it would be much more costly and
`complicated to manage a per-subscriber or per—call protection as far as
`ciphering and subscriber identity protection are concerned. As far as
`authentication is concerned,
`the issue 1S not even relevant
`since
`
`All security functions involve the SIM, which is in fact the real
`subject of authentication (a correct approach is to say that what
`is
`authenticated is the SIM, and not the subscriber or the mobile station). A
`first consequence is that none of these functions. are provided when the
`SIM is not inserted. Another consequence is that the physical presence of
`the SIM is absolutely necessary to get most services, the only exception
`being the emergency call.
`It
`is not possible for a mobile station
`manufacturer to provide a mobile equipment which reads the SIM once,
`and then is able to provide services under the guise of the subscriber
`when the SIM is removed. Moreover, SIMS are so designed that it is very
`difficult to duplicate them (except by their issuer, a network operator).
`Thus the combination of the security functions and of the SIM provides a
`high protection of the users and of the networks against fraudulent access.
`
`Page 8 of 18
`
`Page 8 of 18
`
`

`
`
`
`468 THE GSM SYSTEM
`
`The MSC/VLR may answer autonomously in some cases, or
`alternatively may have to update the HLR first, with the procedure
`described in the next section. There is one case when the MSC/VLR
`
`cannot do otherwise than answer on its own: when it cannot reach the
`HLR for lack of any roaming agreement between the two operators. This
`case is not addressed in the Specifications, though it can happen. The
`4 answer of the MSC/VLR is necessarily negative and must be chosen to
`ensure that the mobile station will search other PLMNS (for instance, by
`sending the cause “PLMN not allowed”).
`
`The usual “normal case” when the MSC/VLR can answer on its
`
`own is when the subscriber is already registered in the database of the
`MSC/VLR. The response in that case is usually positive, and can be
`negative only in case of national roaming restriction (cause “location area
`not allowed for national roaming”, used only in DCS1800); regional
`subscription cannot lead to a negative MSC/VLR answer without HLR
`involvement, since the MAP restricts regional subscription to be offered
`on a per—VLR basis.
`
`National roaming then merits some attention. The rule is that if the
`mobile station belongs to an unwanted PLMN, and if the requested
`location area is restricted, the MSC/VLR is entitled to directly answer
`negatively. Most of the time the MSC/VLR will not be able to Contact the
`HLR, and this would be a particular case of the situation mentioned
`above, with the difference that the cause sent to the mobile station is
`specified.
`
`When the MSC/VLR needs to contact the HLR of the subscriber, it
`must first know which HLR is concerned. Subscribers are identified for
`the internal business of GSM by a number,
`the IMSI (International
`Mobile Subscriber Identity). This number is provided by the mobile
`station anytime it accesses the network (the number is not always given
`directly, see the notion of TMSI, page 484). The IMSI is so specified that
`the MSC/VLR is able to derive the identity of the subscriber’s home
`PLMN, and possibly more information on the HLR equipment in charge
`of the subscriber. Figure 7.6 shows the IMSI structure. With the help of
`the relevant translation tables, the MSC/VLR is then able to derive the
`SS7 address to which the location updating request must be sent. In
`practice,
`the HLR can usually be identified by looking at
`the most
`significant digits of the IMSI following the mobile country code and
`mobile network code. However,
`this possibility is usually only used
`inside the home PLMN country. PLMNS of other countries route their
`messages using the IMSI as a global title, towards a gateway entity in the
`home PLMN country. There the global title can be translated in the
`Signalling Point Code of the right equipment in the right PLMN, as
`explained in Chapter 5.
`.
`
`Page 9 of 18
`
`Page 9 of 18
`
`

`
`
`
`5 10 THE GSM SYSTEM
`
`can be initiated when the destination subscriber becomes reachable. This
`mechanism calls for signalling exchanges between network entities to
`alert the short message service centre.
`
`the communication management
`list of
`This completes our
`functions, and we can now look in more details to each of these issues.
`'
`
`
`
`8.1. CALL CoNTRoL
`
`Before describing the architecture and the procedures involved in
`call control, we will analyse how calls to a mobile subscriber can be
`routed, since this aspect underlies much of the network architecture, and
`is of foremost importance in understanding many aspects of the system,
`such as, e.g., how to call a GSM user or charging.
`
`8.1.1. THE ROUTING OF MOBILE TERMINATING
`
`CALLS
`
`For a Mobile Terminating call, the number given by the calling
`party does not refer to a telephone line or a location; but points to a
`record in some HLR. The-first digits of a GSM directory number are
`sufficient to indicate that the number is a GSM number, and furthermore
`to designate the operator with which the subscription is held. The
`structure of the GSM directory number, also called “MSISDN” because it
`is part of the same numbering plan as ISDN numbers,
`is defined in
`
`interrogation
`
`to actual location
`
`Figure 8.2 — The two parts of a mobile terminating call route
`
`The call route consists of two parts: the first part is based on the called
`directory number, and continues to the point where the actual location
`of the called GSM subscriber is taken into account for the rest of the route.
`
`{Page1oof13
`
`Page 10 of 18
`
`

`
`COMMUNICATION MANAGEMENT
`
`5 1 1
`
`national
`destination code
`
`country code N»
`
`i CC i NDC
`
`subscriber number
`
`+44
`
`802
`
`UK GSM number (Ce||net)
`
`+44
`
`385
`
`UK GSM number (Vodafone)
`
`+44
`
`956
`
`UK DOS 1800 number (Mercury P.C.)
`
`+44
`
`973
`
`UK DCS 1800 number (Hutchinson Microtel)
`
`+358
`
`+358
`
`40
`
`50
`
`Finnish GSM number (Telecom Finland)
`
`Finnish GSM number (OY Radiolinja)
`
`Figure 8.3 — The structure of a GSM directory number
`
`A GSM “MSISDN” looks like a standard PSTN or ISDN number,
`
`but the knowledge of the “National Destination Code” (NDC)
`identifies an operator within a country, and not an area code.
`The first digits following the NDC are used to identify
`the relevant subscriber’s HLR within the home PLl\/IN.
`
`CCITT Recommendation E164 and is shown in figure 8.3. The HLR
`holding the record of the subscriber can be determined by the analysis of
`the first digits of this number.
`
`The HLR record contains information necessary for finding the
`final destination of the call,
`i.e.,
`the MSC where the GSM user is
`currently Visiting. As a consequence, the final routing can be done only
`after the interrogation of the HLR. This splits the call establishment into
`two parts: before the interrogation, and after the interrogation. This
`corresponds also to a clear division of the call route into two parts: from
`the call originating point to the interrogation point, and the rest, as
`represented in figure 8.2.
`
`What follows applies to'l\/lobile Terminating calls requiring the
`establishment of a circuit. The routing of Mobile Terminating Short
`Messages is similar, but bears a few differences and will be described
`separately in the section dealing with Short Message Services. Another
`point is that what is specified in GSM applies mainly, if not only, to the
`
`Page 11 of 18
`
`Page 11 of 18
`
`

`
`560
`
`THE GSM SYSTEM
`
`8.3.3. MoBILE TERMINATING SHORT MESSAGES
`
`A short message addressed to a GSM subscriber must first be
`routed from the sender to a Short Message Service Centre, and from then
`be routed to the actual destination. The way the message first reaches the
`SM—SC is once again out of scope of the Specifications. There also a
`variety of solutions can be imagined to enable PSTN users to send
`messages towards GSM users, using human operators or inter—working
`with other services such as videotex.
`
`When the SM—SC has a message to send to some GSM subscriber,
`it builds a SM—TP SMSPDELIVER message, containing various pieces of
`information for the benefit of the recipient. This information includes in
`particular the user content, the identification of the original sender, and a
`time—stamp indicating when the message was received by the SM—SC.
`Similarly with the Mobile Originating case,
`the SM—TP SMS—DELIVER
`message will be transferred on Various interfaces, using the capabilities of
`lower layer protocols described in Chapter 5, in particular to convey the
`acknowledgement back to the SM—SC.
`
`Before the SM—TP SMS—DELIVER message can reach its destination
`(the mobile station),
`its actual routing must be derived using the
`interrogation functions of MAP/C. This is achieved in the following
`manner. The SM—SC conveys the short message to an SMS—gateway to
`which the service centre is connected, which it chooses depending on the
`subscriber it wants to reach, since most often a gateway will be able to
`deal with only some of the subscribers (for instance those’ of some
`country, or some operator). The subscriber is then identified by his
`directory number (the same MSISDN as for telephony, typically), entered
`originally by the originator of the message. This enables the SMS—
`gateway to identify the relevant HLR and interrogate it. The interrogation
`is done by sending a special message, the MAP/C SEND ROUTING INFO FOR
`SHORT MESSAGE message. This is answered by either the corresponding
`MAP/C SEND ROUTING INFO FOR SHORT MESSAGE RESULT message, which
`contains an SS7 address pertaining to the MSC/VLR where the subscriber
`is visiting, or by a rejection message if the subscriber is known not to be
`reachable at this instant. There is no need for a specific roaming number,
`as for circuit calls, since the short message uses only SS7 signalling
`means to be transported to the visited MSC.
`
`The SMS—gateway makes use of the SS7 address to forward the
`message to the relevant MSC, which delivers it to the mobile station after
`setting if need be a signalling connection, as for the mobile originating
`case. The delivery to the mobile station does not involve the user. The
`
`Page 12 of 18
`
`Page 12 of 18
`
`

`
`
`
`COMMUNICATION MANAGEMENT 5 6 1
`
`message can be stored until the user decides to discard it after reading.
`More precisely, it is stored in the SIM, and then can be kept in storage
`even after the mobile station has been switched off, or even read on
`
`another mobile station. The limited memory capacity of the SIM,
`however, raises a small problem when for any reason the memory is full.
`In phase 1, a message delivered to a SIM with no free memory could be
`lost. In phase 2, a mechanism has been specified to enable a crude sort of
`flow control by the mobile station, which will then be able to indicate to
`the network when the memory is full, or conversely when it is back to a
`state where messages can be accepted again.
`
`An important Variation from this basic scenario corresponds to
`cases when the mobile station cannot be reached. To provide a satisfying
`quality of service, the message is not lost in these cases, and steps are
`taken so that this message, and possibly following ones, are kept and
`delivered to the subscriber as soon as possible. Since the message, if not
`acknowledged, is still stored for some time in the SM—SC, it can be sent
`anew as soon as the subscriber resumes contact with the network. This
`requires the GSM network to store the lack of delivery condition and the
`address of the SM—SC, and to start a procedure to “alert” the SM—SC
`when the subscriber pops up again. The HLR is obviously the “focal
`point” in such mechanisms. Let us describe how they work, by looking at
`the different situations in which delivery fails,
`
`Three different kinds of non—reachability can be identified, similar
`to what we have seen with circuit calls. The HLR can know beforehand
`
`that the subscriber is not reachable for the moment, the VLR can know it,
`but not the HLR, and finally it can be discovered after failure of the
`effective attempt
`to deliver
`the message by the MSC/VLR. When
`interrogated by an SMS—gateway, the HLR may know immediately that
`delivery cannot take place, because it already holds a non—empty list of
`service centres which have not succeeded in transmitting messages, and
`waiting to be alerted. It then adds if possible the new SM-SC identity to
`this list. In such situations, it will usually indicate the problem to the
`SMS—gateway with a negative answer to the MAP/C SEND ROUTING INFO
`FOR SHORT MESSAGE message. The same course is taken when the HLR
`knows that
`the subscriber is not reachable, for instance because the
`subscriber is not entitled to get service in the geographical area where he
`is currently located. There is however one exception to this rejection at
`the HLR level. A priority indication is linked with each message, and it is
`used to bypass the straightforward rejection of the HLR when some
`messages are still undelivered. The HLR will answer positively if the
`message is of high priority, and the potential delivery problem, if it still
`exists, will be detected by the MSC/VLR.
`I
`
`Page 13 of 18
`
`Page 13 of 18
`
`

`
`
`
`562 THE GSM SYSTEM
`
`TMSI ) SM—SC address
`
`error reporting
`________§
`
`%4._/
`
`IMSI )» message waiting
`
`Figure 8.23 — Short message failed delivery management
`
`When the MSC is able to deliver a short message to the mobile station,
`this state of things is stored in both MSC/VLR and HLR, for triggering retries
`when the mobile station reappears.
`
`In the cases where the MSC/VLR is given the message but is not
`able to deliver it, a failure indication is first sent to the SMS—gateway, as
`an answer to the MAP/H FORWARD SHORT MESSAGE message. The
`gateway then sends on one hand a negative report to the SM—SC, and on
`the other a MAP/C SET MESSAGE WAITING DATA message to the HLR,
`which acknowledges the updating of its table by a MAP/C SET MESSAGE
`WAITING DATA RESULT message. This state of affairs is stored by both the
`MSC/VLR and the HLR in the subscriber record. In addition, as already
`mentioned, the HLR maintains for each subscriber a list of addresses for
`the SM—SC holding messages in wait. The sequence of events is
`represented in figure 8.23.
`Eventually, the subscriber surfaces again. This may be known for
`instance by a contact with the MSC/VLR where the subscriber _was
`located (e.g., a mobile originating call attempt). When such an event
`happens, thanks to the stored indication of a previous delivery failure, the
`MSC/VLR notifies the HLR with a MAP/D NOTE MS PRESENT message.
`
`Page 14 of 18
`
`iK
`
`Page 14 of 18
`
`

`
`COMMUNICATION MANAGEMENT
`
`5 63
`
`IMSI ) SM-SC address
`
`IMSI } message waiting
`
`Figure 8.24 — Service Centre alerting
`
`When a subscriber becomes reachable, the HLR alerts all the service centres
`
`which are known to hold messages not delivered to the given subscriber.
`
`The mobile station may also reappear within coverage of another MSC,
`in which case the HLR will be directly aware of this state of things,
`thanks‘ to the mobility management procedures which have been
`described in Chapter 7. In any case, the HLR then sends an indication of
`the subscriber’s reappearance to all the SM-S'Cs whose identities are
`stored as holding a message for this subscriber. This is achieved by
`sending a MAP/C ALERT SERVICE CENTRE message to the suitable SMS—
`gateway for each service centre. The whole sequence as described above
`is shown in figure 8.24. The SMS—gateway will convey the relevant
`information to the service centre, to trigger a new transfer attempt.
`
`The alerting mechanism must be supported by all MSC/VLRS, but
`it is an operator’s option to store the list of SCs in the HLR and to alert
`them.
`
`Page 15 of 18
`
`Page 15 of 18
`
`

`
`NETWORK MANAGEMENT
`
`5 89
`
`IMEI = 15 digits
`
`FAC
`
`serial number
`
`I
`
`Figure 9.6 — Structure of the IMEI
`
`The IMEI, ranges of which are allocated upon the granting of type approval,
`references the mobile equipment type approval a11d the final assembly plant,
`and includes a serial number which is unique for each unit of a given type.
`
`is
`structure shown in figure 9.6. The Final Assembly Code (FAC)
`intended to be used as an identification of the final assembly plant. Serial
`numbers are allocated by ranges to the manufacturer for inclusion in the
`produced mobile stations. Operators, through the permanent secretariat of
`the GSM MoU, are notified of the valid IMEIS of type approved mobile
`stations they can expect on their networks.
`T
`
`9.3.0.2. Mobile Equipment Management
`
`«When maintenance activities detect a problem which are attributed
`to a mobile station, the network must determine the IMEI of this mobile
`station. The procedures on the radio interface are such that the mobile
`station does not volunteer its IMEI. The network must ask for it, through
`the
`RIL3—MM IDENTITY REQUEST message. Depending
`on
`the
`implementation, this request can be systematic, at the beginning of each
`RR—session (but this creates a lot of additional signalling traffic), or can
`be done at certain occasions only, e.g., at each location updating and for a
`sample of call attempts. The knowledge by the operator of the IMEI of
`the (presumed faulty) mobile station will help to produce statistics and to
`determine the origin of the fault, in order to take corrective measures. In
`the worst case, all mobile stations of a given type and series might have
`to’be removed from the market, if the defaults are important enough to
`justify a retrofit. An advisory group consisting of GSM MoU members
`has been set up to exchange information on problems identified during
`commercial operation; these problems may reflect a need for new tests in
`Page 16 of 18
`
`Page 16 of 18
`
`

`
`590
`
`THE GSM SYSTEM
`
`(granting of new type approvals)
`
`Visited
`
`PLMN
`
`———§ update of IMEI status
`
`<1) interrogation of IMEI status
`
`Figure 9.7 — The Equipment Identity Register (EIR)
`
`The status of IMEIS is stored in EIRs, to be checked by the MSCS at any time.
`Operators may interconnect their EIRs to update the status of IMEIS.
`
`the type approval process, which would then be discussed with the
`appropriate authorities.
`
`The next problem for an operator is to bar mobile stations which
`do not operate properly,
`i.e.,
`to refuse to grant them service (except
`possibly for emergency calls). This can also be applied to stolen mobile
`equipment (subscription barring is insufficient in this case, since the
`equipment can be used with another, legitimate, SIM). To achieve this,
`IMEIS for which problems have been detected must be recorded in a
`database. This database, referred to as the Equipment Identity Register
`(EIR) in the Specifications, is updated though the OSS. It can be accessed
`by the MSC/VLRS to check the status of a particular IMEI. This access is
`supported in the Specifications by MAP procedures. Figure 9.7 shows the
`position of the EIR in the system architecture. As an example of a
`realistic configuration, it shows two levels of EIRS, one at the individual
`network level, and one common to all networks. The interconnection of
`EIRS between themselves is not specified in the phase 1 Speczfications,
`and is a matter for operators to agree on.
`
`The information stored in the EIR can be to a large extent operator
`dependent. However,
`the control, of, e.g., stolen mobile stations, will
`
`Page 17 of 18
`
`Page 17 of 18
`
`

`
`
`
`NETWORK MANAGEMENT 5 9 1
`
`only become effective if operators with a roaming agreement have an
`agreed IMEI checking policy. This is obtained for instance by an
`harmonisation at the level of the GSM MoU. Within this group, operators
`have agreed to use three levels for the status of the IMEI, and the
`Specifications define three corresponding “lists” to be stored in EIRS. The
`white list includes the ranges of IMEIS allocated to type approved mobile
`equipment. Consequently, an IMEI not
`in the white list does not
`correspond to a valid type—approved mobile station. The black list
`includes the list of the IMEIS for stations which need to be barred, either
`because they have been stolen or because of severe malfunctions. ‘The
`grey list, as its name implies, is intermediate between the white and black
`lists, a