TK 5123
`
`.483
`.483
`.S78
`.578
`2003
`2003
`COPY 1
`
`. Mobile Packet Data Services
`
`EVOLUTION
`
`GOOGLEEXHIBIT 1023
`
`Ms
`
`"Yhe
`
`Peter Stuckmann
`
`~
`
`Page 1 of 45
`
`Page 1 of 45
`
`GOOGLE EXHIBIT 1023
`
`

`

`THE
`
`GSM
`EVOLUTION
`
`Mobile Packet Data Services
`
`Peter Stuckmann
`Aachen University, Germany
`
`1.I
`
`JOHN WILEY & SONS, LTD
`
`Page 2 of 45
`
`

`

`Copyright © 2003
`
`John Wiley & Sons, Ltd.,
`The Atrium, Southern Gate, Chichester,
`West Sussex, P019 8SQ, England
`
`Telephone (+44) 1243 779777
`
`E-mail (for orders and customer service enquiries): cs-books@wiley.co.uk
`
`Visit our Home Page on www.wileyeurope.com or www.wiley.com
`
`All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any
`form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except under the
`terms of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright
`Licensing Agency Ltd, 90 Tottenham Court Road, London W1T 4LP, UK, without the permission in writing of the
`Publisher. Requests to the Publisher should be addressed to the Permissions Department, John Wiley & Sons Ltd,
`The Atrium, Southern Gate, Chichester, West Sussex, P019 8SQ, England, or emailed to permreq@wiley.co.uk, or
`faxed to (+44) 1243 770571.
`
`This publication is designed to provide accurate and authoritative information in regard to the subject matter covered.
`It is sold on the understanding that the Publisher is not engaged in rendering professional services. If professional
`advice or other expert assistance is required, the services of a competent professional should be sought.
`
`Other Wiley Editorial Offices
`
`John Wiley & Sons, Inc .. 111 River Street, Hoboken, NJ 07030, USA
`
`Jessey-Bass, 989 Market Street, San Francisco, CA 94103-1741, USA
`
`Wiley-VCH Verlag GmbH, Boschstr. 12, D-69469 Weinheim, Germany
`
`John Wiley & Sons Australia Ltd, 33 Park Road, Milton, Queensland 4064, Australia
`
`John Wiley & Sons (Asia) Pte Ltd, 2 Clementi Loop #02-01, Jin Xing Distripark, Singapore 129809
`
`John Wiley & Sons Canada Ltd, 22 Worcester Road, Etobicoke, Ontario, Canada M9W 1L1
`
`Library of Congre986 Cataloging-in-Publication Data
`
`Stuckmann, Peter.
`The GSM Evolution : mobile packet data services I Peter Stuckmann
`p. cm.
`Based on a tutorial presented at several international conferences and as training
`courses for companies. The book has been expanded from a chapter contributed by
`Stuckmann for Bernhard Walke's Mobile radio network.
`Includes bibliographical references and index.
`ISBN 0-470-84855-3
`1. Global system for mobile communications. 2. Packet switching (Data transmission)
`I. Title.
`
`TK5103.483.878 2002
`621.382-dc21
`
`2002031120
`
`British Library Cataloguing in Publication Data
`
`A catalogue record for this book is available from the British Library
`
`ISBN 0-470-84855-3
`
`Produced from LaTeX files supplied by the author.
`Printed and bound in Great Britain by T. J. International Ltd, Padstow, Cornwall.
`This book is printed on acid-free paper responsibly manufactured from sustainable forestry
`in which at least two trees are planted for each one used for paper production.
`
`Page 3 of 45
`
`

`

`Contents
`
`Preface
`
`1 Introduction
`1.1
`The IMT-2000 Family of Systems
`1.2 GPRS and EDGE .
`1.3
`Traffic Engineering
`1.4 Outline . . . . . . .
`
`2 Packet Data Support in GSM Networks
`2.1 GSM-Global System for Mobile Communication
`2.1.l
`GSM History . . . . . . .
`2.1.2
`Specifications and Phases
`2.1.3
`Logical Architecture .. .
`2.1.4
`GSM Mobile Station .. .
`2.1.5
`GSM Numbers and Addresses
`2.1.6
`Basic Telecommunication Services.
`2.1.7
`Radio Interface ... .
`.
`. .. .
`2.2 GPRS- General Packet Radio Service
`2.2.l
`Design Approach .
`.
`2.2.2
`Logical Architecture ..
`2.2.3
`Service Types .
`.
`.
`.
`. .
`2.2.4
`Parallel Use of Services .
`2.2.5
`Radio Interface . . . . .
`
`3 Data Transmission in GPRS Networks
`. . . . . .
`.
`.
`.
`3.1 GPRS Tunneling Protocol (GTP) .
`3.2
`Base Station Subsystem GPRS Protocol (BSSGP)
`3.2.1
`Flow Control between SGSN and BSS
`3.2.2
`BSS Context
`. . . . . . . . . . . . . . .
`3.2.3
`BSS P acket Flow Context Creation . . .
`3.2.4
`BSS Packet Flow Context Modification .
`3.2.5
`BSS P acket Flow Context Deletion .. .
`Sub-Network Dependent Convergence Protocol (SNDCP)
`Logical Link Control (LLC) .. .
`. .. . . . . .
`3.4. l
`Layer Entities and Service Access Points
`3.4.2
`Logical Link Identifiers ..
`3.4.3
`LLC Frame Structure ...
`3.4.4
`LLC Frame Transmission
`3.4.5
`Ciphering
`. . . . . . . . .
`Radio Link Control (RLC) and Medium Access Control (MAC)
`3.5.l Multiplexing Principles ...
`3.5.2
`RLC/MAC Block Structure ... ... . ... . . . . . .
`
`3.3
`3.4
`
`3.5
`
`ix
`
`1
`1
`3
`3
`4
`
`7
`7
`7
`8
`9
`11
`12
`12
`14
`21
`22
`22
`23
`25
`25
`
`31
`31
`32
`32
`33
`34
`35
`35
`35
`36
`37
`37
`37
`38
`41
`41
`41
`43
`
`Page 4 of 45
`
`

`

`vi
`
`Contents
`
`Cc
`
`RLC Functions
`3.5.3
`3.5.4 MAC Functions .
`TBF Setup ...
`3.5.5
`3.5.6
`RLC Block Transfer
`3.5. 7
`Channel Coding Schemes
`Physical Layer (PL) . . . . . . . .
`
`3.6
`
`4.3
`
`4 GPRS Signaling
`4.1
`The GPRS Control Plane . . . . . . . .
`4.2 Mobility Management
`. . . . . . . . . .
`4.2.1
`Location Area and Routing Area
`4.2.2 Mobility Management Procedures .
`4.2.3
`Location Management Procedures .
`4.2.4
`GPRS Roaming . . . . . . .
`Session Management
`. . . . . . . .
`4.3.l
`The IP Interworking Model
`PDP Context Handling ...
`4.3.2
`4.3.3
`Session Management States
`4.3.4
`Session Management Procedures
`4.4 Quality of Service Management
`4.4.l
`General Aspects . . . . . . . . . .
`4.4.2
`GPRS QoS Management . . . . .
`QoS Attributes According to GPRS Release 97 /98
`4.4.3
`4.4.4
`QoS Profile Information Element
`. . . . . .
`4.4.5
`QoS in GPRS Release 99 . . . . . . . . . . .
`4.4.6
`QoS in the Core Network Applying DiffServ
`
`5 EDGE and Evolution to GERAN
`5.1
`EDGE-Enhanced Data Rates for GSM Evolution
`5.1.1
`8-PSK Modulation versus GMSK Modulation
`5.1.2 Modulation and Coding Schemes .. .
`5.1.3
`Link Quality Control . . . . . . . . . .
`Flow Control Modifications for EDGE
`5.1.4
`5.1.5
`The EDGE Compact Concept . . . . .
`5.2 GERAN-GSM/EDGE Radio Access Network
`5.2.l
`GERAN System Architecture
`5.2.2
`GERAN Protocol Architecture
`5.2.3
`Core Network Evolution . . . .
`
`6.2
`
`6 Evolving Applications and Traffic Models for GPRS and 3G
`6.1 WWW Applications . . . . . . . . . . . . . . .
`Adapted Mosaic WWW Model . . . . .
`6.1.1
`6.1.2
`Choi's Behavioral Model of Web Traffic
`E-mail Applications . . . . . . ..
`6.2.l
`SMTP, POP3 and IMAP .
`6.2.2
`E-mail Traffic Model
`File Transfer Applications
`6.3.1
`FTP Protocol ...
`6.3.2
`FTP Traffic Model
`
`6.3
`
`7
`
`45
`52
`52
`54
`56
`57
`
`59
`59
`60
`60
`63
`67
`75
`76
`76
`77
`78
`79
`83
`83
`86
`89
`91
`92
`93
`
`97
`97
`98
`99
`101
`104
`104
`105
`106
`107
`111
`
`117
`117
`119
`120
`121
`121
`121
`123
`123
`124
`
`Page 5 of 45
`
`

`

`it en ts
`
`Contents
`
`6.5
`
`6.4 WAP-based Applications .
`6.4.l WAP Release l.x .
`6.4.2 WAP Release 2.0
`6.4.3 Multimedia Messaging Service (MMS)
`6.4.4 WAP Traffic Model .
`Streaming Applications .
`6.5.1
`Video Streaming
`6.5.2
`Audio Streaming
`6.6 Voice over IP . . . . . .
`6.6.1
`Session Initiation Protocol (SIP)
`6.6.2
`Audio Codecs . . . . . . . .
`6.6.3
`Performance Issues . . . . .
`6.6.4
`Voice Traffic Characteristics
`6.6.5
`Packet Voice Traffic Model .
`
`45
`52
`52
`54
`56
`57
`
`59
`59
`60
`60
`63
`67
`75
`76
`76
`77
`78
`79
`83
`83
`86
`89
`91
`92
`93
`
`97
`97
`98
`99
`101
`104
`104
`105
`106
`107
`Lll
`
`17
`l17
`~19
`.20
`.21
`.21
`21
`23
`23
`24
`
`7.3
`7.4
`7.5
`
`7.6
`7.7
`7.8
`
`7.9
`
`7 The (E)GPRS Simulator GPRSim
`7.1
`Structure of the (E)GPRS Simulator
`7.2
`Packet Traffic Generators
`7.2.l
`Internal Structure . . . . . . .
`7.2.2
`Implementation .
`. . . . . . .
`Traffic Generator.for Circuit-switched Services .
`Channel Management . . . . . . . . . . . . . . .
`Quality of Service Management . . . . . . . . .
`7.5.l
`QoS Profile and Aggregate BSS QoS Profile
`7.5.2
`PDP Context . . . . . . . . . . . . . .
`7.5.3
`GPRS Register (GR) . . . . . . . . . .
`7.5.4
`Connection Admission Control (CAC)
`7.5.5
`Scheduler
`The SNDCP Layer ..
`The LLC Layer . . . .
`The RLC/MAC Layer
`7.8.1
`RLC/MAC in the Base Station
`7.8.2
`RLC/MAC in the Mobile Station
`Transceiver . . . . . . .
`7.9.1
`Channel Models . . . . . .
`7.9.2 Mobility Model . . . . . .
`7.9.3
`Radio Propagation Model
`Input-Output Behavior ..
`7.10.1
`Initialization . . . . . . .
`7.10.2 Output/Statistics ... .
`7.10.3 Graphical Presentation .
`7.11 Web Interface . . . . . . . . . .
`
`7.10
`
`8 Traffic Performance of GPRS and EGPRS
`8.1
`General Simulation Parameter Settings
`8.2
`Performance and Capacity Measures
`8.3
`Simulation Results for GPRS
`. . . . .
`8.3.1
`Fixed PDCH Scenarios ... .
`.
`8.3.2
`Effect of the Multislot Capability
`
`vii
`
`125
`125
`126
`127
`129
`130
`130
`139
`142
`142
`143
`145
`147
`150
`
`151
`151
`153
`153
`154
`155
`156
`157
`157
`157
`158
`158
`160
`161
`162
`164
`164
`172
`176
`176
`178
`181
`182
`182
`183
`183
`183
`
`187
`187
`188
`189
`189
`193
`
`Page 6 of 45
`
`

`

`viii
`
`Contents
`
`8.4
`
`8.5
`
`8.6
`
`8.3.3
`8.3.4
`
`. . . . . . . . . . . . . . . . .
`On-demand PDCH Scenarios
`Remarks on Mixed Configurations with Fixed and On-demand
`PDCHs . . . . . . . . . . . . . . . . . . . . . . . . .
`Summary of GPRS Performance . . . . . . . . . . .
`8.3.5
`Simulation Results for EGPRS and Comparison with GPRS
`8.4.1
`Effect of the Modulation and Coding Schemes . . . .
`8.4.2
`Effect of LQC on the Block Error Probability . . . .
`8.4.3
`Performance Evaluation Regarding Different LQC Mechanisms
`8.4.4
`Summary of EGPRS Performance . . . . . . . . . . . . . .
`Performance of Evolving Mobile Applications
`. . . . . . . . . . .
`8.5.1 WAP in Comparison to Internet Applications over GPRS
`8.5.2
`Traffic Mix with WAP and WWW /e-mail over GPRS ..
`8.5.3
`Video Streaming over GPRS and EGPRS . . . . . . . . .
`Summary of the Traffic Performance of Evolving Applications
`8.5.4
`Performance Gain through QoS Management
`. . . . . .
`8.6.1
`Scenario Parameter Settings . . . . . . . . . . . . .
`8.6.2
`Simulation Results Neglecting the Core Network
`.
`8.6.3
`Simulation Results Considering the Core Network .
`Summary of the Performance Gain through QoS Management
`8.6.4
`
`Acronyms
`
`Bibliography
`
`Index
`
`193
`
`196
`196
`197
`197
`199
`201
`202
`202
`205
`206
`207
`209
`209
`210
`210
`212
`213
`
`215
`
`223
`
`233
`
`Wi1
`arq
`intl
`suli
`th€
`tio:
`ne1
`be1
`grc
`err.
`mi
`Tl
`te:
`sy
`d~
`
`G
`OI
`tr
`d:
`t€
`a:
`C1
`a
`c
`t·
`
`c
`s
`
`Page 7 of 45
`
`

`

`ks
`
`of
`~k
`
`4
`GPRS Signaling
`
`The GPRS protocol architecture is organized into two planes, the user plane, also
`called transmission plane, and the control plane, also called signaling plane. The
`user plane is responsible for data transmission, when packet data transfer is actually
`requested in uplink or downlink. To realize the transfer between the correct network
`nodes with adequate performance characteristics, the user plane protocols need certain
`information such as addresses of peer entities, the status of network elements or
`requested protocol options. This information has to be provided at the beginning of
`a session and has to be kept up-to-date during an ongoing session, while the mobile .
`user might move around with his terminal or use different services in parallel or
`consecutively with idle periods in between.
`The GPRS control plane realizes these management functions, namely GPRS Mo(cid:173)
`bility Management (GMM), Session Management (SM) and Quality of Service (QoS)
`management. GMM keeps track of the MS's location and its state, updates databases
`with this information and supports cell change procedures. The SM manages the
`logical context between the MS and an external Packet Data Network (PDN) based
`on TCP /IP or X.25, when a new session is set up or changing its performance re(cid:173)
`quirements. In GPRS networks different applications with different performance re(cid:173)
`quirements are supported. QoS management in GPRS networks enables the network
`to establish QoS contracts with the MS differentiating applications and subscribers
`according to their QoS requirements. The GPRS QoS support is based on the SM
`procedures.
`
`4.1 The GPRS Control Plane
`
`In Figure 4.1 the GPRS control plane between MS and SGSN is shown. The signaling
`layers SM and GMM reuse the layer-2 protocols and the GPRS channel interface of the
`user plane (see Chapter 3) to transmit signaling messages over the air interface. The
`control plane between SGSN and the registers shown in Figure 4.2 (see Section 2.1.3) is
`based on the GSM-specific extension of the Signaling System Number 7 called Mobile
`Application Part (MAP) and an enhanced version of the Base Station Subsystem
`Application Part (BSSAP), called BSSAP+ at the interfaces Gr (SGSN-HLR), Gs
`(SGSN-MSC/VLR) and Gr (SGSN-EIR). In the GPRS core network between the
`GPRS Support Nodes (GSNs) the control part of the GTP, the GPRS Tunneling
`Protocol (Control plane) (GTP-C) (see Section 3.1) is used to perform signaling in
`the core network (see Figure 4.3) .
`
`Page 8 of 45
`
`

`

`60
`
`4 GPRS Signaling
`
`GMM/SM
`
`LLC
`
`RLC
`
`MAC
`
`GSM RF
`
`MS
`
`I
`
`I
`
`l
`Um
`
`SGSN
`SSS
`Figure 4.1: GPRS control plane (MS - SGSN)
`
`Relay
`SSGP
`
`RLC
`,______
`MAC
`
`GSM RF
`
`Network
`Service
`L1bis
`
`I
`I
`I
`I
`I
`
`I
`Gb
`
`GMM/SM
`
`LLC
`
`BSSGP
`
`Network
`Service
`L1bis
`
`4.2 Mobility Management
`
`Mobility management in GSM and GPRS [29) includes functions for location regis(cid:173)
`tration with the PLMN and location updating to report the current location of an
`MS. Additionally it is responsible for identification and authentication of subscribers.
`The GMM concept allows combined procedures for GSM and GPRS to reduce
`the signaling load. The handover procedure is split up into the cell update and the
`Routing Area (RA) update.
`In contrast to the GSM system, where the handover decision is made by the network
`based on measurement reports sent by the MS [2], the cell change, also called cell
`reselection, in GPRS is not necessarily prepared and triggered by the network, but is
`mostly decided by the MS, when it detects that it has entered a new cell or even a
`new RA by reading the system information on the broadcast channel.
`
`4.2.1 Location Area and Routing Area
`
`The Location Area (LA) and Routing Area (RA) are different areas comprising a
`certain number of cells (see Figure 4.4) [86). For example one LA may comprise 30
`cells. This hierarchical structure with LAs is chosen for GSM networks to manage the
`location of an MS . The network initially only knows the LA in which the MS is located.
`The MS provides this information periodically, or when the MS changes its LA. When
`it becomes necessary to determine the exact cell location of an MS, the network sends
`a paging command in all cells of the LA. The MS, which continuously monitors the
`broadcast channel, responds to this paging command so that a connection or a context
`can be established. With this procedure the signaling load on the air interface is
`minimized, since the network need not know about the exact cell location of the MS
`when it is not active. Additionally, the VLR does not have to be updated by the
`SGSN, as long as the MS is staying inside one LA.
`The RA that does not exist in GSM networks without GPRS support was intro(cid:173)
`duced to speed up the paging procedure and lower the signaling load for paging. The
`number of cells in an RA is generally less than or equal to that of an LA . For example,
`one LA with 30 cells may comprise three RAs with 10 cells each. An RA can not
`span more than one LA and an RA is served by only one SGSN. One SGSN can
`handle several RAs and the size of an RA can range from a part of a city to an entire
`
`c
`I
`
`Page 9 of 45
`
`

`

`g
`
`4.2 Mobility Management
`
`61
`
`1
`
`{
`
`MAP
`
`TCAP
`
`SCCP
`
`MTP3
`
`MTP2
`
`PHY
`
`I
`I
`I
`I
`I
`'
`I
`I
`
`I
`I
`
`I
`I
`
`I
`I
`'
`I
`
`MAP
`
`TCAP
`
`SCCP
`
`MTP3
`
`MTP2
`
`PHY
`
`BSSAP+
`
`SCCP
`
`MTP3
`
`MTP2
`
`PHY
`
`I
`I
`I
`1
`
`'
`'
`I
`I
`
`I
`I
`
`I
`I
`
`I
`
`BSSAP+
`
`SCCP
`
`MTP3
`
`MTP2
`
`PHY
`
`SGSN
`
`HLR (or EIR)
`Gr (or) Gf
`
`SGSN
`
`MSCNLR
`
`Gs
`
`MAP Mobile Application Part
`
`BSSAP+ BSS Application Part +
`
`TCAP Transaction Capabilities Application Part
`
`SCCP
`
`Signaling Connection Control Part
`
`MTP
`
`Message Transfer Part
`
`Figure 4.2: GPRS control plane (SGSN -. HLR, SGSN - VLR)
`
`GTP-C
`
`UDP
`
`IP
`
`L2
`
`L1
`
`I
`I
`I
`I
`I
`
`I
`I
`
`I
`I
`
`I
`I
`
`I
`
`GTP-C
`
`UDP
`
`IP
`
`L2
`
`L1
`
`GTP-C
`
`UDP
`
`IP
`
`L2
`
`L1
`
`I
`I
`I
`I
`1
`
`I
`I
`
`I
`I
`
`I
`I
`
`I
`
`GTP-C
`
`UDP
`
`IP
`
`L2
`
`L 1
`
`SGSN
`
`Gn
`
`SGSN
`
`SGSN
`
`Gn
`
`GGSN
`
`Figure 4.3: GPRS control plane (SGSN - SGSN, SGSN - GGSN)
`
`province or even a small country. Figure 4.4 shows an example cell scenario, in which
`it is possible to see how cells could be grouped in a cell planning configuration. Cells
`1, 2 and 3 together build one RA. Cell 4 alone builds another distinct RA. Together
`these two RAs form one LA. A set of LAs are served by one BSC, and many BSCs are
`served by an SGSN. The SGSNs are interconnected and represent the highest level in
`the GMM hierarchy. Cell 14 belongs to another SGSN in this example.
`After an MS has changed from one cell to another it reads the system information
`of the new cell. Since the RA is broadcast as part of the system information, the MS
`can determine whether it has changed its RA. If this is the case, the MS sends an
`RA update to the SGSN to inform it about the new RA. The cell update and RA
`
`Page 10 of 45
`
`

`

`62
`
`4 GPRS Signaling
`
`Cell 1
`RA Cell 2
`{
`0 Cell 3
`
`LA
`{
`® RA{ Cell 4
`0
`
`LA{ RA{ Cell 5
`O Cell 6
`®
`
`Cell 7
`lf RA Cell 8
`{
`{
`~ O Cell 9
`
`{
`
`RA{ Cell 10
`o Cell 11
`Lt RA{ Cell 12
`o Cell 13
`•
`LA { RA {Cell 14
`
`MSC
`SGSN
`
`MSC
`SGSN
`
`Figure 4.4: Example of a cell scenario comprising all cell change possibilities
`
`2
`/"'-
`
`2 ...
`
`~1----
`{MCC=
`1
`// MNC=
`LAI/ ~~
`LAC= /, . GI / " '
`2 3 ...
`1 2 3 ...
`~ ....,....~
`2...
`1 2 ...
`LAI = Location Area Identity
`RAI = Routing Area Identity
`Cl
`= Cell Identity
`CGI =Cell Global Identity
`
`r Cl=
`
`RAI
`"-RAC= 1
`
`MCC = Mobile Country Code
`MNC = Mobile Network Code
`LAC = Location Area Code
`RAC = Routing Area Code
`
`Figure 4.5: Relationship of the different GMM identities in GPRS
`
`update procedures are described in detail in Section 4.2.3 . The following rules for the
`different identities apply in GPRS (see Figure 4.5):
`
`• The Location Area Code (LAC) identifies an LA within one GSM network. The
`Location Area Identity (LAI) is unique among all networks and is composed of
`the Mobile Country Code (MCC), the Mobile Network Code (MNC) and the
`LAC. The MCC identifies the country in which the GSM PLMN is located.
`
`• The Routing Area Code (RAC) identifies the RA inside one LA and is only
`unique when presented together with the LAI. Therefore the Routing Area Iden(cid:173)
`tity (RAI) is composed of the LAC and the RAC.
`
`Page 11 of 45
`
`

`

`g
`
`4.2 Mobility Management
`
`63
`
`• The Cell Identity (CI) identifies a radio cell inside one LA and is only unique
`when presented together with the LAL A unique cell identifier, the Cell Global
`Identity (CGI), is composed of LAI and CI [4].
`
`4.2.2 Mobility Management Procedures
`
`The GPRS Mobility Management (GMM) procedures comprise access control and
`authentication functions. To obtain access to GPRS services the MS has to initiate
`the GPRS attach procedure (see Figure 4.6). During Mobility Management (MM)
`procedures user data can, in general, be transmitted while the signaling is going on.
`This can lead to loss of data during attach, authentication and RA update procedures.
`In order to minimize retransmissions the MS and SGSN should not transmit user data
`during these procedures.
`
`4.2.2.1 GPRS Attach Procedure
`
`During the GPRS attach procedure the MS communicates with the SGSN. The MS
`provides its International Mobile Subscriber Identity (IMSI) (see Section 2.1.5) or
`Packet Temporary Mobile Subscriber Identity (P-TMSI), if available, for identification
`at the SGSN in the Attach Request message. Different types of attach procedures
`are defined in [29] depending on which identifiers are available before the attach
`request. At the RLC/MAC layer, the MS shall identify itself with a Foreign TLLI, or
`a Random TLLI (see Section 3.4.2) if a valid P-TMSI is not available. The Foreign
`or Random TLLI is used as an identifier during the attach procedure until a new
`P-TMSI is allocated.
`The parameters of the Attach Request message include the MS's GPRS multislot
`capabilities, supported GPRS ciphering algorithms, the type of attach performed, and
`further modes and capabilities of the MS.
`If the MS identifies itself with P-TMSI and the SGSN has changed since detach,
`the GTP-C entity (Section 4.1) of the new SGSN sends an Identification Reque~t
`message to the old SGSN to request the IMSI. The old SGSN responds with Iden-
`. tification Response containing the IMSI and authentication parameters. If the
`MS is unknown in both the old and new SGSN, the GMM entity of the SGSN sends
`an Identity Request to the MS. The MS responds with Identity Response and
`provides the IMSI. After authentication and security functions are performed between
`SGSN and the GPRS registers using information requested from the MS, the location
`of the MS is updated with the messages Update Location and Update Location
`Achnowledge between SGSN and HLR or VLR using MAP and BSSAP+ (see Sec(cid:173)
`tion 4.1) signaling, respectively. After that the GMM entity of the SGSN sends an
`Attach Accept message with the assigned P-TMSI and the VLR TMSI to the MS.
`If the P-TMSI or VLR TMSI was changed, the MS acknowledges the received TMSI
`returning an Attach Complete message to the SGSN. If the VLR TMSI was changed,
`the BSSAP+ entity of the SGSN confirms the VLR TMSI reallocation by sending a
`TMSI Reallocation Complete message to the VLR. If the Attach Request cannot
`be accepted, the GMM entity of the SGSN returns an Attach Reject message to the
`MS.
`
`Page 12 of 45
`
`

`

`64
`
`4 GPRS Signaling
`
`..,.__ __ _
`
`1 ' 3, 4, 5, 8, 9
`
`MSCNLR
`
`7, 10
`
`BSC
`
`2
`
`SGSN
`
`("old")
`
`1.Attach Request (MS - SGSN)
`2. Identification Request (new - old SGSN)
`3. Identity Request (SGSN - MS)
`4. Authentication (SGSN - HLR, SGSN - MS)
`5. IMEI Check (SGSN - MS, SGSN - EIR)
`
`6. Update Location (SGSN - HLR)
`7. Location Updating (SGSN - MSC/VLR)
`8. Attach Accept (SGSN - MS)
`9. Attach Complete (MS - SGSN)
`10.TMSI Reallocation Complete (SGSN - MSC/VLR)
`
`Figure 4.6: Overview of the attach procedure in GPRS
`
`4.2.2.2 GPRS Detach Procedure and Purge Function
`
`The GPRS detach procedure allows an MS to inform the network that it does not
`want to access the GPRS services any longer and allows the network to inform an MS
`that it does not have access to the SGSN-based services any more. The MS is detached
`either explicitly or implicitly. In the explicit detach procedure the network or the MS
`explicitly requests detach, while in the implicit detach, the network detaches the MS,
`without notifying the MS, a configuration-dependent time after the mobile reachable
`timer expired, or after an irrecoverable radio error causes disconnection of the logical
`link. In the explicit detach case, a Detach Request is sent by the SGSN to the MS, or
`by the MS to the SGSN. If the MS performs the detach procedure, it sends a Detach
`Request message to the SGSN. If requested by the MS a Detach Accept message is
`returned.
`The purge function allows an SGSN to inform the HLR that it has deleted the Mo(cid:173)
`bility Management (MM) and Packet Data Protocol (PDP) contexts (see Section 4.3)
`of a detached MS. The SGSN may, as an implementation option, delete the contexts
`of an MS immediately after the implicit or explicit detach of the MS. Alternatively,
`the SGSN may keep for some time the contexts of the detached MS, so that they can
`be reused at a later GPRS attach without accessing the HLR. After deleting the con(cid:173)
`texts of a detached MS, the SGSN sends a Purge MS message to the HLR containing
`the IMSI. The HLR updates the entry of the MS in the database and acknowledges
`with a Purge MS Acknowledge message.
`
`4.2.2.3 Authentication
`
`The security authentication function for prevention of unauthorized GPRS ser(cid:173)
`vice usage and confidentiality is performed during the attach procedure (see Sec-
`
`Page 13 of 45
`
`

`

`4.2 Mobility Management
`
`65
`
`~ ..
`,_ °""' -::-
`- - -
`
`1___,,_Ne~w~Cel~l-~...,.
`
`Figure 4. 7: Mobility management states on the MS and SGSN side
`
`tion 4.2.2.1). This function performs the identification and authentication of the
`service requester, and the validation of the service request type to ensure that the
`user is authorised to use the particular network services . Security-related network
`functions are completely based on the GSM standard as described in (I].
`
`4.2.2.4 States of the Mobility Management
`
`The GMM functionalities are based on three different MM states defined at the MS
`and the SGSN states, in which each MS can be. These MM states are:
`
`l. The idle state.
`
`2. The standby state.
`
`3. The ready state.
`
`In each of these MM states the MS and the SGSN hold a different set of informa(cid:173)
`tion about the GPRS terminal. These are denoted MM contexts. Figure 4.7 shows
`the different states on the two sides. The MM context in the MS comprises among
`others the MM state MS identifiers, location and security data and zero or more PDP
`contexts, while the MM context at the SGSN additionally contains classmarks for the
`communication with the registers.
`
`In the idle state the MM context is empty, because the subscriber is not attached
`to the GPRS network. The MS and SGSN do not hold any valid information
`about the cell and RA in which the MS is located. Therefore no MM procedures
`are performed. The MS is seen as not reachable and can not be paged.
`
`In the standby state the MS is attached to the network. Each of the MS and SGSN
`have established an MM context. Both the MS and the SGSN know the RA in
`which the MS is located. In this state the SGSN can send paging messages to
`all the cells of the RA to find the MS, if it wants to send messages to it in the
`downlink direction. The MS may receive PTM-M and PTM Group Call (PTM(cid:173)
`G) paging messages, but can not receive or transmit any data.
`
`------------~-----~-
`
`Page 14 of 45
`
`

`

`66
`
`4 GPRS Signaling
`
`IDLE
`
`IDLE
`
`GPRS Attach
`
`GPRS
`Defach
`
`GPRS Detach
`or
`Cancel Local/On
`
`READY
`
`Implicit Detach
`or
`Cancel Location
`
`READY
`
`READY timer expiry
`
`Force to STANDBY POU transmission
`
`READY timer expiry
`or
`Forca to STANDBY
`or
`Abnormal ALC condition
`
`PDU reception
`
`STANDBY
`
`STANDBY
`
`MM State Model of MS
`
`MM State Model of SGSN
`
`Figure 4.8: MM state transitions
`
`In the ready state the SGSN knows in which cell the MS is located and can there(cid:173)
`fore send a continuous stream of data packets on the downlink, even if the
`MS changes its cell supported by Location Management (LM) procedures (see
`Section 4.2.3). The MM context is practically the same as in the case of the
`standby state but extended by the information on the cell in which the MS is
`located. The MS may receive PTM-M and PTM-G data (see Section 2.2.3) in
`the ready state and the SGSN must not initially page the MS to send data. In
`this state the MS can activate or deactivate PDP contexts. The MM context
`remains in the ready state even if there is no data to send. It returns to the
`standby state after the expiry of the ready timer (see Section 4.2.2.6).
`
`4.2.2.5 GMM State Transitions
`
`In Figure 4.8 all possible state transitions of the MM context are shown. For example,
`when moving from idle to ready the MS performs a GPRS attach and a logical link is
`initiated to an SGSN. When the implicit detach occurs the MM and PDP contexts in
`the SGSN return to idle and inactive state and the GGSN PDP context is deleted.
`A cancel location is triggered when a MAP cancel location message is received from
`the HLR. When an MS sends a PDU to the SGSN its MM state switches to ready and
`when the SGSN receives this PDU it also goes into the ready state. The SGSN can
`also force the state to standby before the ready timer expires. The context returns
`also to standby after an irrecoverable radio error causes disconnection of the logical
`link.
`
`Page 15 of 45
`
`

`

`r •
`
`4.2 Mobility Management
`
`4.2.2.6 GMM Timers
`
`67
`
`Besides the events described above that are controlling the state transitions, timers
`are defined in the GMM that can also provoke state transitions.
`
`The ready timer controls the duration an MM context remains in the ready state
`in the MS and in the SGSN. This timer is reset and begins running on the MS
`side when an LLC PDU is transmitted and on the SGSN side when an LLC
`PDU is correctly received. At expiry of the timer the context on both sides
`returns to standby. The duration of the timer is the same on both sides and
`only the SGSN can change its value using Attach Accept, RA Update Accept
`or PDP Context Accept messages. If the ready timer length is set to zero, the
`MS immediately is forced into standby state. If the timer length is set to 1 s,
`the ready timer function is deactivated, i.e. the timer no longer runs and the
`MS remains in ready state.
`
`The Periodic RA Update timer is set periodically and its length, which is constant
`in one RA, is included in the RA Update Accept message from the SGSN or
`after an Attach Accept message. At expiry the MS performs an RA update
`procedure.
`
`The Mobile reachable timer controls the periodic RA update procedure in the
`SGSN. It is slightly longer then the periodic RA update timer. It is set when the
`SGSN context returns from ready to standby and stopped when the transition
`to ready is performed. This timer is reset when a periodic RA update reaches
`the SGSN, because in this case, the SGSN knows that the MS is reachable.
`If the timer expires then the MS is, e.g., out of coverage and the SGSN stops
`paging the MS.
`
`4.2.3 Location Management Procedures
`
`The Location Management (LM) function controls the cell and PLMN selection and
`provides a mechanism which enables the SGSN to know the RA of the MS in the
`standby and ready states [29]. If an MS is in the ready state, the SGSN knows the
`location of the MS on cell level based on the CGI.
`Figure 4.9 shows a node view of the GMM, which is located in the SGSN and
`communicates over the LLC layer with the MS that this SGSN serves. The LLC
`PDUs are transmitted over the RLC/MAC layer across the air interface to the MS.
`The GMM has to maintain that the packet flow is routed to the correct destination,
`i.e. first to the correct BSC, then to the correct BTS.
`When an MS enters a new cell, three different procedures can be performed:
`
`1. A cell update procedure.
`
`2. An RA update procedure (intra- or inter-SGSN) .
`
`In Figure 4.10 all the cell change possibilities are shown. These can be derived from
`Figure 4.4, in which a cell planning scenario is shown. All these cases will be described
`below in detail. The first possibility is the intra-SGSN cell update intra-BSC where
`an MS changes between two cells belonging to the same RA served by one BSC. In
`this case, the MS performs a cell update procedure. The second possibility is the
`
`Page 16 of 45
`
`

`

`--------~--------
`
`68
`
`4 GPRS Signaling
`
`RLC/MAC
`
`LLC
`
`SGSN
`
`Figure 4.9: Node view of the GPRS mobility management on the network side
`
`Intra SGSN Cell Update
`(Intra SSC):
`
`Intra SGSN RA Update
`(Intra SSC):
`
`~
`
`Intra SGSN RA update
`(Inter SSC):
`
`Inter SGSN RA update
`(Inter SSC):
`
`Figure 4.10: All cell change possibilities in GPRS
`
`intra-SGSN RA update intra-BSC. Here the RA changes from one cell to the other.
`The MS has to perform an RA update procedure. In the third case the responsible
`BSC changes (intra-SGSN RA update inter-BSC). The fourth and last case is the
`inter-SGSN RA update where also the responsible SGSN changes.
`The cell update and the RA update are mostly triggered by the MS in GPRS
`networks. This differs from the procedure in circuit-switched GSM networks, where
`the handover is completely controlled by the network. The reason for this difference
`is that GPRS is designed for packet transport, where delays due to a cell change are
`not as critical as delays during a voice conversation. In the GSM the handover is
`prepared by the network in a way which allows a conversation to stay uninterrupted
`and undisturbed. In GPRS there is a clear inte