無(wú)線接口信令協(xié)議剖析課件

1、無(wú)線接口信令協(xié)議剖析無(wú)線接口信令協(xié)議剖析Um 接 口 信 令24GSM系統(tǒng)專用協(xié)議群DTAPDTAP Direct Transfer Application PartBSSMAP BSS Management Application PartCM Call ManagementMM Mobile ManagementRR Radio Resource ManagementSCCP Signalling Connection Control PartMAP Mobile Application PartTCAP Transaction Capability Application PartISU

2、P ISDN User PartMTP Message Transfer PartCMMMRRSig. layer 2Layer 1 (air)Sig. layer 2Sig. layer 1MTPSCCPBSSMAPRR(CM+MM)MSBSCMTPMTPSCCPSCCPCMMMBSSMAPTCAPMAPISUPMSCSig. layer 2Layer 1 (air)BTS(CM)(MM)(RR)(CM)(MM)(RR)(CM)(MM)(LAPDm)(LAPDm)(LAPD)Sig. layer 2Sig. layer 1(LAPD)BTSMBTSMRRBTSM BTS Management

3、Um InterfaceAbis InterfaceA-interfaceInter-MSCInterface3GSM系統(tǒng)專用協(xié)議群DTAPDTAP Direct TranChannel RequestEstablishment Cause emergency callCall re-establish Location update Answer to paging: same as channel needed in Paging NECI=0: MO&procedure be complete with SDCCH NECI=1: MO TCH/F Procedure be comple

4、te with SDCCHRandom Reference立即指配流程MSBSSCHANNEL REQUEST(1)IMMEDIATE ASSIGNMENT(EXTENDED)Immediate AssignmentL2 Pseudo lengthProtocol discriminator Skip indicationMessage typeN(SD) for MS side Page modeChannel descriptionRandom referenceTiming advanceMobile allocationStarting timeIA rest octetsT3126M

5、MRRCHANNEL REQUEST(2M+1)IMMEDIATE ASSIGNMENT REJECTSABM(L3) (1)UA(L3)SABM(L3) (26) Protocol discriminatorCall control;call related SS messagesMobility management messagesRadio resource management messagesSkip indicationOther than 0 should be ignorePage modeNormal pagingExtended pagingPaging reorgani

6、zationSame as beforeChannel descriptionChannel type and TDMA offset SDCCH/8+SACCH/8+subchannel SDCCH/4+SACCH/4+subchannel TCH/F+ACCHTNTSCHopping channel single channel:ARFCN RF hopping channel:HSN+MAIORequest referenceRandom Access InformationT1/T2/T3FNT1=(FN/1326)mod 32T2=(FN)mod 26T3=(FN)mod 51(FN

7、)mod 42432=51x(T3-T2)mod 26)+T3+51x26xT1Mobile allocationIndex for CAStarting timeT1/T2/T3IA rest octetsMAIO+Mobile allocation(frequency parameters before time)Immediate Assignment ExtendedPage modeChannel description1Random reference1Timing advance1Channel description2Request reference2Timing advan

8、ce2Mobile allocationStarting timeIA rest octetsImmediate Assignment RejectPage modeRandom reference1Waiting Indication1Random reference2Waiting Indication2Random reference3Waiting Indication3Random reference4Waiting Indication4Waiting IndicationT3122:0255 secondSS+T-10max(8,T)-1T3101T200:235msMM要求進(jìn)入

9、專有模式RR響應(yīng)尋呼允許接入網(wǎng)絡(luò)T3122T3126:T+2S5 secondRACHRACHAGCHAGCHSDCCHSDCCHSDCCH4Channel Request立即指配流程MSBSSCHANPaging Request Type1Paging modeChannel needed for mobile1Mobile identity1(IMSI/TMSI)Channel needed for mobile2Mobile identity2(IMSI/TMSI)尋呼流程MSBSSPAGING REQUEST TYPE1/2/3PAGING REQUEST TYPE 1/2/3CHAN

10、NEL REQUESTIMMEDIATE ASSIGNMENT(EXTENDED)SABM(Paging response)UA(Paging response)Paging Request Type2Paging modeChannel needed for mobile1Mobile identity1(TMSI)Channel needed for mobile2Mobile identity2(TMSI)Channel needed for mobile3Mobile identity3(IMSI/TMSI)Paging Request Type3Paging modeChannel

11、needed for mobile1Mobile identity1(TMSI)Channel needed for mobile2Mobile identity2(TMSI)Channel needed for mobile3Mobile identity3(TMSI)Channel needed for mobile4Mobile identity4(TMSI)PCHPCHAGCHAGCHSDCCHSDCCHT3113Paging ResponseCiphering key sequenceMobile station classmark 2MS identity(IMSI/TMSI)Cl

12、assmark Information 2Phase1/Phase2 MSControlled Early Classmark Sending RF Power CapabilityPseudo Synchronization CapabilitySupplementary Service Screening IndicationMT SMS pt. To pt. CapabilityFrequency Capability(GSM900 Extended?)A5/1;A5.2;A5/3Classmark 3 5Paging Request Type1尋呼流程MSBSSPMeasurement

13、 reportBA-usedDTX-usedMeas-validRxlev_full/sub(serving cell)Rxqual_full/sub(serving cell)NO-NCELL-MRxlev(neighbor cell 16)BCCH-Freq-Ncell(16)BSIC-Ncell(16)SACCH流程MSBSSSYSTEM INFORMATION 5/5bis/5ter/6MEASUREMENT REPORTSACCH Downlink L1 HeaderOrdered MS power levelOrdered timing advanceSACCH Uplink L1

14、 HeaderActual MS power levelActual timing advanceSYSTEM INFORMATION 5/5bis/5ter/6MEASUREMENT REPORTSACCHSACCHSACCHSACCH6Measurement reportSACCH流程MSBSSASSIGNMENT COMMANDChannel descriptionPower commandCell channel descriptionStarting time Mobile allocation(after time)Mobile allocation(before time)Cha

15、nnel mode指配流程MSBSSASSIGNMENT COMMANDASSIGNMENT FAILUREUASABM(1)SDCCHSDCCHFACCHFACCHASSIGNMENT COMPLETESABM(26)ASSIGNMENT FAILURET3107FACCHFACCHSDCCHASSIGNMENT COMPLETEASSIGNMENT FAILURERR CauseRR CauseNormal eventAbnormal release,unspecifiedAbnormal release,channel unacceptableAbnormal release,timer

16、 expiredAbnormal release,no activity on radio pathPreemptive releaseHandover impossible,timing advance out of rangeChannel mode unacceptableFrequency not implementedCall already clearedSemantically incorrect messageInvalid mandatory informationMessage type non-existent or not implementedMessage type

17、 not compatible with protocol stateConditional IE errorNo cell allocation availableProtocol error unspecifiedChannel modeSignalling onlySpeech full rate version1Speech full rate version2Data,14.5kbps radio interface rateData,14.5kbps radio interface rateData,12.0kbps radio interface rateData,6.0kbps

18、 radio interface rateData,3.6kbps radio interface rate7ASSIGNMENT COMMAND指配流程MSBSSASSHANDOVER CommandCell descriptionChannel descriptionHandover referencePower command and access typeCell channel descriptionMobile allocation(after time)Channel modeTiming AdvanceSynchronization indication(偽/預(yù))同步切換流程M

19、SBSSHANDOVER COMMANDSDCCH/FACCHSABMT3103Cell DescriptionBCCH ARFCNBCCNCCBSSHANDOVER ACCESSHANDOVER ACCESSHANDOVER ACCESSHANDOVER ACCESSSABMUAHANDOVER COMPLETEHANDOVER FAILURESDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHPower Command and Access Ty

20、pePower levelAccess type control:Sending Handover access is mandatory or optional Synchronization IndicationReport observed timing difference: shall be include in Handover complete or notOTD=RTD+t1-t0Synchronization indication: non-synchronized synchronized pre-synchronized pseudo-synchronizedNormal

21、 cell indication: TA63 is ignored TA63 trigged handover failure HANDOVER Failure/CompleteRR CauseMobile observed time differenceRR CauseNormal eventProtocol error unspecified Handover impossible,timing advance out of rangeChannel mode unacceptableFrequency not implementedHANDOVER FAILUREUA8HANDOVER

22、Command(偽/預(yù))同步切換流程MSBHANDOVER CommandCell descriptionChannel descriptionHandover referencePower command and access typeCell channel descriptionMobile allocation(after time)Channel modeTiming AdvanceSynchronization indication非同步切換流程MSBSSHANDOVER COMMANDSDCCH/FACCHSABMT3103BSSHANDOVER ACCESS(1)HANDOVE

23、R ACCESS(n)SABMUAHANDOVER COMPLETEHANDOVER FAILURESDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHPhysical InformationTAPHYSICAL INFORMATION(1)PHYSICAL INFORMATION(2Ny1)T3105T3124:675ms(SDCCH),320ms(TCH)HANDOVER FAILUREUASDCCH/FACCHSDCCH/FACCH9HANDO

24、VER Command非同步切換流程MSBSSHA連接釋放流程MSBSSCHANNEL RELEASE(DEACTIVE SACCH)DISCUASDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHDISC(26)T3109Channel ReleaseRR CauseBA rangeT3110:240470msT3111=T3110RR CauseNormal eventAbnormal release,unspecifiedAbnormal release,channel unacceptableAbnormal release,timer expire

25、dAbnormal release,no activity on radio pathPreemptive releaseNo cell allocated availableProtocol error unspecified10連接釋放流程MSBSSCHANNEL RELEASE(DEAFrequency RedifinitionChannel descriptionMobile allocationStarting timeCell channel description無(wú)線資源管理其他流程MSBSSFREQUENCY REDEFINITIONRR STATUSCHANNEL MODE

26、MODIFYSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHSDCCH/FACCHCHANNEL MODE MODIFY ACKCIPHERING MODE COMPLETESDCCH/FACCHSDCCH/FACCHSDCCH/FACCHCipher Mode SettingA5/0A5/7CIPHERING MODE COMMANDCLASSMARK ENQUIRYCLASSMARK CHANGERR StatusRR causeChannel Mode Modify (ACK) Channel descriptionChannel modeCipher Response

27、IMEISV(IMEI+Software Version) shall be included or notClassmark Information 2Phase1/Phase2 MSControlled Early Classmark Sending RF Power CapabilityPseudo Synchronization CapabilitySupplementary Service Screening IndicationMT SMS pt. To pt. CapabilityFrequency Capability(GSM900 Extended?)A5/1;A5.2;A5

28、/3Classmark 3 Classmark Information 3Multi-bands supported,E-GSM/DCS1800/R-GSMRF Power Capability for each bandA5/4,A5/5,A5/6,A5/7UCS2CIPHERING MODE COMMANDCipher mode settingCipher responseCiphering Mode CompleteIMEISVClassmark ChangeClassmark 2Classmark 311Frequency Redifinition無(wú)線資源管理其他TMSI重分配流程MS

29、BSSTMSI REALLOCATION COMMANDTMSI REALLOCATION COMPLETESDCCH/FACCHSDCCH/FACCHT3250TMSI Reallocation CommandLAI=MCC+MNC+LACTMSI12TMSI重分配流程MSBSSTMSI REALLOCATIO鑒權(quán)流程MSBSSAUTHENTICATION REQUESTAUTHENTICATION RESPONSESDCCH/FACCHSDCCH/FACCHT3260:12sAuthentication RequestCiphering key sequence number:06Auth

30、entication parameter RAND:128bitsAuthentication ResponseAuthentication parameter SRES:32bitsAUTHENTICATION REJECTT3240:10sSDCCH/FACCHIDLE(No IMSI,roaming not allowed)13鑒權(quán)流程MSBSSAUTHENTICATION REQUES身份確認(rèn)流程MSBSSIDENTITY REQUESTIDENTITY RESPONSESDCCH/FACCHSDCCH/FACCHT3270:12sIdentity RequestIdentity ty

31、pe:IMSI/IMEI/TMSI/IMEISVIdentity ResponseMobile Identity14身份確認(rèn)流程MSBSSIDENTITY REQUESTIDEIMSI分離流程MSBSSIMSI DETACH INDICATIONSDCCH/FACCHT3220:5sIMSI Detach IndicationMobile station classmark 1Mobile IdentityMobile Station Classmark 1Phase1/Phase2 MSControlled Early Classmark Sending RF Power Capabilit

32、yA5/1;15IMSI分離流程MSBSSIMSI DETACH INDICAbortReject cause移動(dòng)管理其他流程MSBSSABORTSDCCH/FACCHMM InformationFull name for networkShort name for networkNetwork time zoneNetwork time and time zoneReject CauseIllegal MSNetwork failureIDLE(if illegal MS,No IMSI,roaming not allowed)MM INFORMATIONMM STATUSMM Status

33、Reject causeReject CauseMessage type non-existent or not implemented16Abort移動(dòng)管理其他流程MSBSSABORTSDCCH/F位置更新流程MSBSSLOCATION UPDATE REQUEST (1)SDCCH/FACCHSDCCH/FACCHLocation Update RequestLocation update typeCiphering key sequence numberLocation area identificationMobile Station classmark 1Mobile identit

34、yLocation Update TypeLUT:Normal location updatePeriod location updateIMSI attachFOR:(no)follow-on request pendingLOCATION UPDATE ACCEPTT3212SDCCH/FACCHIDLE(No IMSI,roaming not allowed)LOCATION UPDATE REJECTLOCATION UPDATE REQUEST(2)Location Update AcceptLocation area identificationMobile identityFol

35、low-on proceedLocation Update RejectReject causeT3210:20sLOCATION UPDATE REQUESTT3211:15sTMSI REALLOCATION COMPLETET3250:12sT3240:10s(wait for RR release)LOCATION UPDATE REQUEST(34)Reject CauseIMSI unknown in HLRIllegal MSIllegal MEPLMN not allowedLocation Area not allowedRoaming not allowed in this

36、 location areaMandatory information element error Protocol error,unspecifiedInformation element not exist or not implementedConditional IE error17位置更新流程MSBSSLOCATION UPDATE REQ移動(dòng)管理連接建立流程MSBSSSABM(CM SERVICE/RE-EST REQUEST 1)CM Service RequestCM service typeCiphering key sequence numberMobile station

37、 classmark 2Mobile identityUA(CM SERVICE/RE-EST REQUEST)T3230:15sCM SERVICE ACCEPTT3240:10s(wait for RR release)SABM(CM SERVICE/RE-EST REQUEST24)Reject CauseIMSI unknown in VLRIllegal MENetwork failureCongestionService option not supportedRequested service option not subscribedService option tempora

38、rily out of orderCM SERVICE REJECTCM Service TypeMobile originating call establishmentEmergency call establishmentShort message service Supplementary service activationCM SERVICE ABORTAUTHENTICATION REQUESTCM Re-establishment RequestCiphering key sequence numberMobile station classmark 2Mobile ident

39、ityLocation area identificationCM Service RejectReject cause18移動(dòng)管理連接建立流程MSBSSSABM(CM SERVICEEmergency SetupProtocol DiscriminatorTransaction IdentifierMessage Type-N(SD) for MS SideBearer capability移動(dòng)主叫呼叫建立流程MSBSSCM SERVICE/RE-EST REQUESTSetupBearer capabilityFacility(only used for SS)Called party B

40、CD numberSS versionCLIR suppressionCLIR invocationCall control capability(DTMF support)T303:30sCM SERVICE ACCEPTSETUP/EMERGENCY SETUPBearer capabilityInformation transfer capability:SpeechDataFacsimile group 3Alternate speech/facsimile group 3,speech startTransfer mode: Circuit mode/Packet modeCodin

41、g standard:GSM standardized CodingRadio channel requirement: Full rate/Dual rate, full rate prefer/Dual rate, half rate prefer Speech version indication: FR/EFR/HR all supported be included in order of preference CALL PROCEEDINGALERTINGRELEASE COMPLETEDISCONNECTCONNECTCONNECT ACKCall Proceeding/Aler

42、ting/ConnectFacilityProgress indicatorRelease Complete/DisconnectCauseFacilitySS versionProgress indicatorCoding stardard:Standard defined for the GSMPLMNS as described belowLocation:Private network serving the local userPublic network serving the local userPublic network serving the remote userPriv

43、ate network serving the remote userNetwork beyond interworking pointProgress description:Call is not end-to-end PLMN/ISDN, further call progress information may be available in-bandDestination address in non-PLMN/ISDNOrigination address in non-PLMN/ISDNCall has returned to the PLMN/ISDNIn-band infor

44、mation or appropriate pattern now availableCall is end-to-end PLMN/ISDNQueueing Unspecific CauseCoding standard:same as Progress indicatorLocation:same as Progress indicatorCause valuenormal event class 1normal event class 2resource unavailableservice or option not availableservice or option not imp

45、lementedinvalid message (e.g. parameter out of range)protocol error (e.g. unknown message) interworkingT310:30sT313:30sT313DISCONNECTTransaction IdentifyTI flag:0-message is send from the side that originates the TI1-message is send to the side that originates the TI TI value:06,given PD,given SAP,d

46、istinguish different message flow19Emergency Setup移動(dòng)主叫呼叫建立流程MSBSS移動(dòng)被叫呼叫建立流程MSBSSPAGING RESPONSESetupBearer capabilityFacility(only used for SS)Calling party BCD numberProgress indicatorSignalSETUPRELEASE COMPLETESignaldial tone onring back tone onintercept tone onnetwork congestion tone onbusy tone

47、onconfirm tone onanswer tone oncall waiting tone onoff-hook warning tone ontones offalerting offDISCONNECTCONNECT ACKCall ConfirmBearer capabilityCauseCall control capabilityT310T313:30sDISCONNECTCALL CONFIRMEDALERTINGCONNECTT303T301:180sALERTING/CONNECTFacilitySS version20移動(dòng)被叫呼叫建立流程MSBSSPAGING RESP

48、ONSE呼叫其他流程MSBSSProgressProgress indicatorPROGRESSNotification IndicatorUser suspendedUser resumedBearer changeSTATUSNOTIFYMODIFYMODIFY COMPLETEMODIFY REJECTNotifyNotification indicatorCall State nullconnection pendingCC prompt presentWait for network informationCC-Establishment presentCC-Establishme

49、nt confirmed Recall present call initiated mobile originating call proceedingcall delivered call present call received connect request mobile terminating call confirmed active disconnect request disconnect indication release request mobile originating modify mobile terminating modify connect indicat

50、ionStatusCauseCall stateAuxiliary statesAuxiliary StateHold auxiliary state idle hold requestcall held retrieve requestMulti party auxiliary state idleMPTY requestcall in MPTYsplit requestModify/Modify CompleteBearer capabilityModify RejectBearer capabilityCauseHOLDHOLD ACKNOWLEDGEHOLD REJECTRETRIEV

51、ERETRIEVE ACKNOWLEDGERETRIEVE REJECTHold Reject/Retrieve RejectCause21呼叫其他流程MSBSSProgressPROGRESSNotDTMF流程MSBSSSTART DTMFStart DTMF(ACK)Keypad facilitySTART DTMF ACKSTOP DTMFSTOP DTMF ACKStart DTMF RejectCause22DTMF流程MSBSSSTART DTMFStart DTM呼叫釋放流程MSBSSDISCONNECTRELEASERELEASE COMPLETEDISCONNECTRELEA

52、SERELEASE COMPLETET305:30sT308RELEASET308:30sRELEASERELEASET305:30sRELEASERELEASET308RELEASET308:30sRELEASEDISCONNECTRELEASE COMPLETERELEASEReleaseCauseseconde causeFacilitySS versionT306:30sT30823呼叫釋放流程MSBSSDISCONNECTRELEASEREUm接口信令流程(早分配)Originated MSTerminated MSICM service acceptIAssignment Comm

53、andSABMCM_Service_ReqUIPaging Request Type 1/2/3NetworkChannel RequestUACM_Service_ReqUIImmediate AssignmentRRUISystem Info 5/6UIMeasurement ReportISETUPRRICall ProceedingUISystem Info 5/6UIMeasurement ReportRRChannel RequestUIImmediate AssignmentSABMPaging ResponseUAPaging ResponseRACHAGCHSDCCHSDCC

54、HSDCCHSDCCHSACCHSACCHSDCCHSDCCHSDCCHSACCHSACCHSDCCHSDCCHPCHRACHAGCHSDCCHSDCCHRRSDCCH24Um接口信令流程(早分配)Originated MSTermOriginated MSTerminated MSUISystem Info 5/6IAlertingIAssignment CompleteISetupNetworkSABMRRUAUIMeasurement ReportUISystem Info 5/6UIMeasurement ReportRRRRIAssignment CommandUISystem In

55、fo 5/6UIMeasurement ReportICall ConfirmedRRRRSABMUAIAssignment CompleteRRIAlertingRRUISystem Info 5/6UIMeasurement ReportFACCHFACCHFACCHFACCHSACCHSACCHSACCHSACCHFACCHFACCHFACCHFACCHFACCHSACCHSACCHSDCCHSDCCHFACCHFACCHFACCHSDCCHSDCCHSACCHSACCHSDCCHSDCCHUm接口信令流程(早分配)25Originated MSTerminated MSUIOrigin

56、ated MSTerminated MSRRRRRRNetworkIConnectIConnect ACKIConnectIConnect ACKRRUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportSAC

57、CHSACCHFACCHFACCHFACCHFACCHSACCHSACCHSACCHSACCHSACCHSACCHSACCHSACCHSACCHFACCHFACCHFACCHFACCHSACCHUm接口信令流程(早分配)26Originated MSTerminated MSRRRROriginated MSTerminated MSRRRRRRNetworkIDisconnectIReleaseIDisconnectIReleaseRRUISystem Info 5/6UIMeasurement ReportUAIRelease CompleteRRUISystem Info 5/6UIMe

58、asurement ReportUISystem Info 5/6UIMeasurement ReportUISystem Info 5/6UIMeasurement ReportIChannel ReleaseRRDISCRRIRelease CompleteRRIChannel ReleaseDISCUASACCHSACCHFACCHFACCHFACCHFACCHSACCHSACCHSACCHSACCHFACCHFACCHFACCHFACCHFACCHFACCHFACCHFACCHFACCHSACCHFACCHFACCHFACCHFACCHFACCHSACCHFACCHFACCHUm接口信

59、令流程(早分配)27Originated MSTerminated MSRRRR信令流程(特別早分配)Originated MSTerminated MSICM service acceptIChannel Mode ModifySABMCM_Service_ReqUIPaging Request Type 1/2/3NetworkChannel RequestUACM_Service_ReqUIImmediate AssignmentRRUISystem Info 5/6UIMeasurement ReportISETUPRRICall ProceedingUISystem Info 5/6

60、UIMeasurement ReportRRChannel RequestUIImmediate AssignmentSABMPaging ResponseUAPaging ResponseRACHAGCHFACCHFACCHFACCHFACCHSACCHSACCHFACCHFACCHFACCHSACCHSACCHFACCHFACCHPCHRACHAGCHFACCHFACCHRRFACCH28信令流程(特別早分配)Originated MSTerminOriginated MSTerminated MSUISystem Info 5/6IAlertingIChannel mode Modify