Traditional telephony network and protocols

Traditional telephony network and protocols Nicolas Montavont nicolas.montavont@telecom-bretagne.eu Universidad de los Andes Merida, Venezuela May 2011 Outline!Introduction What is telephony Historic!Architecture of the PSTN!Common Channel Signaling!Call setup page 2

Introduction!What is telephony? page 3 Introduction!What is telephony? page 4

Introduction!What page is telephony? 5 Introduction! What is telephony Make the illusion to users that they are in the same room and that they can talk together! Technically, it involves To set up a network To locate users To advertise users about incoming calls - signalling Voice encoding - Convert the voice signal to a digital signal Transmission and routing Management and supervision (administration)! Global interoperability Need for standardization! Quality of service Call set up failure Time to establish a communication Quality of the sound Interactivity page 6

Main principles!passband for the voice transmission is [300; 3400Hz] where the voice is actually between [300; 7000Hz]!Circuit switched network Communication circuit reservation Need for a call setup and clear-down!digital transmission of the signal Pulse Code Modulation (PCM) Voice rate is 64 kbps!signaling network is independent from the voice transmission network page 7 History of telephony! French invention 1854 : Charles Bourseul was the first to invent a system for the electric transmission of the voice!first patent in 1876 Alexander Graham Bell <tele> far away and <phone> sound! Manual switch The connexion between two peers was made manually in telephony offices - Operators manually plugged in cords to provide the necessary circuit connections!nowadays The main concepts remain the same The technologie is totally different - Digital, automatic and computer programs page 8

The PSTN network Public Switched Telephone Network!Allow to set up a call Find a path between a caller and a receiver Temporary connection between two subscribers - Allocate the resources for the duration of the call Clear down the resources after the call ends!main concepts Connection-oriented service Circuit switched Multiplexing page 9 Base elements of the PSTN Local loop on battery Hundred meters to few kilometers Central office switch Central office switch Central office switch Central office switch Tandem Switch Tandem Switch Trunks A hundred or more connections - fiber (used to be 2 pair of wires) page 10

Link between switches!digital Multiplexing Transport of multiple channels on the same physical support Multiplexing unit: the sample Multiplexing in wavelength for optical fibers!required bandwidth 8000 bytes / second (1 byte every 125!s) 64 kbps per voice channel Unique transport system page 11 Hierarchical switched Network page 12

Routing! Objective : Find a path in the graph of the switched network! How does it work Static routing: routing tables are defined before deployment at the national level and uploaded in the switches page 13 Network property What is the time to cross the network?! Asynchronous : No temporal constraints on packets. Each packet needs to reach the destination as fast as possible! Synchronous : Temporal constraint on each packet : keep the end-to-end delay below a maximum threshold! Isochronous : Double temporal constraint for each packet: packets must be transported between a minimum and maximum time page 14

Impact of the delay!defined in the ITU-T G.114 recommandation " t in ms G.114 Recommandation 0 to 150 ms Acceptable for most applications 150 to 400 ms Acceptable if the effect on applications are known > 400 ms Not acceptable but in exceptional cases page 15 Signaling and signaling network! This section presents two topics Signaling network: network for the transport of messages Signaling channel: application level!features Optimized for digital network High level of reliability Evolving Adapted for channels at 64 kbit/s A single signaling channel manages 2000 circuits page 16

What is Signaling?!Set of control information exchanged among switches or between switches and end-terminals that are used to setup, tear down, or manage a communication!the signaling is used for Set up and clear down a voice call Billing control Supervision and maintenance page 17 Introduction to the telephony signaling!in data network there are 2 signaling modes In-band signaling - The signaling is transported inside the data out-of-band signaling - The signaling is transported independently from the data!... in the PSTN SS5: Channel Associated Signaling (CAS) - Multiplexing of the voice and signalling within the same channel - DTMF 'Dual-Tone multi-frequency' signaling SS6 - SS7:Common Channel Signalling (CCS) - A specific (separated) channel is dedicated to the signaling of several voice channels - Allow for new services (signaling independent from a call, or during a call) page 18

Common Channel Signaling Circuit 1 Circuit i Circuit n UNI signalling UNI Signalling Control unit Control unit page 19 Signal Transfert Point Signaling channel NNI Signalling Signal Transfert Point SS7 Network components! Service Switching Point (SSP) SSPs are the "brains" of the SS7 network and are usually located at phone switches. Because signaling messages will either originate or terminate within them, SSPs are considered "end points" on a network.! Signaling Transfer Point (STP) STPs relay signaling messages. An STP is a packet switch that acts as a hub to transfer messages to other STPs, SCP databases, or SSPs.! Service Control Point (SCP) An SCP is a database that holds information required to provide services that are more complex than basic call control (e.g., providing a business with an 800 number). Voice circuits page 20 SS7 link SS7 link

SS7 protocols architecture OSI model SS7 protocols page 21 MTP - Message Transfer Part! Switched network for data transmission First 3 levels of the stack! The goal of MTP is to route signaling packets and ensure reliability! MTP1 Called Signaling Data Link Functional Level (Data Link Level) Equivalent to the physical layer of OSI! MTP2 Called Signaling Link Functional Level (Link Level) Equivalent to the data link of OSI (HDLC-like) Provides error detection and sequence checking, and retransmits unacknowledged messages! MTP3 Signaling Network Functional Level (Network Level) Equivalent to the network layer of OSI Addresses are only valid on the local (national) network page 22

Message Signaling Unit ISUP Routing label CIC INFORMATION MTP3 SIO DPC OPC SLS INFORMATION SLS : Route between the Signaling Point OPC / DPC : Src and dst SP SIO: SAP MTP2 Header SIO DPC OPC SLS INFORMATION FIN page 23 User protocols!generate the signaling!several types ISDN User Part (see next) SCCP (signaling Connection Control Part) - Add functionalities to MTP3 - offer connection and non-oriented connection mode - Allow exchange of data independently from any telephony communication TCAP (Transactions Capabilities Application Part) - Also called Transaction Manager - Between the application and SCCP to facilitate dialog independently from any applications - Communication support for applications - Examples: Location of users Call with a credit card (need further verification) Network administration page 24

ISDN User Part (ISUP)!Signalling protocol Use the MTP3 services (may also use SCCP)!User sub-system Call setup Call clear-down Supervision of the call channel ((un)blocking, check, restart) Additional services!usage Analogic networks Mix networks Digital networks page 25 Protocols stack of ISUP Source Destination SCCP ISUP SCCP ISUP MTP 3 MTP 3 MTP 2 MTP 2 MTP 1 MTP 1 SS7 Signalisation NNI page 26

Overview of the user protocol A B Call Phone is ringing icks up User p Signaling User Part Communication User hangs page 27 up Call scenario A B IAM ACM ANM Communication REL RLC page 28

Call scenario STP IAM STP STP IAM IAM Commutateur destination Commutateur d origine SSP pick up Tone SSP CAA SSP Ring CTP CTS Dial page 29 SSP CAA Call scenario STP ACM STP STP ACM ACM Commutateur destination Commutateur d origine page 30 SSP SSP CAA CTS SSP SSP CTP CAA

Call scenario STP ANM STP STP ANM ANM Commutateur destination Commutateur d origine SSP SSP CAA page 31 CTS SSP SSP CTP Décroché CAA Call scenario STP STP STP Commutateur destination Commutateur d origine SSP SSP CAA CTS SSP SSP CTP CAA Communication page 32

ISDN Integrated Services Digital Network!First and last hop digital!why digital Allow the transmission of various type of communication on the same line (voice, image, video, text) May be seen as the evolution of the telephony network Tolerate more errors than an analogic signal Increase the power of computation (multiplexing, switch)!isdn Digital continuity from end to end Extend the concept of Common Channel Signaling to the interface between the user and the switch page 33 Goals and implementation!the ISDN signaling extends the information exchanged between the user and the network Dedicated signaling channel!setup of a single network Simultaneous and heterogeneous services (e.g., voice + data)! Service support Voice Audio 3,1KHz Digital Information without restriction! Téléservice Télécopie Videotex Téléconférences Additional services : id of the caller, portability, call presentation, etc page 34

Signaling ISUP ISUP Q.931 Q.931 UNI NNI UNI page 35 How does it work? Terminal equipment TE TE TE ISDN bus : 144 kbits/s Each of the B channel: 64 kbps D channel : 16 kbps Digital termination of the network TNR RTC page 36

Q.931 signaling - main messages! SETUP indicating the establishment of a connection! CALL PROCEEDING indicating that the call is being processed by the destination terminal! ALERTING tells the calling party that the destination terminal is ringing! CONNECT sent back to the calling party indicating that the intended destination has answered the call! DISCONNECT sent to indicate a request to terminate the connection, by the end that seeks to terminate! RELEASE sent in response to the disconnect request indicating that the call is to be terminated! RELEASE COMPLETE sent by the receiver of the release to complete the handshake page 37 Classical call flow A Call Phone is ringing User picks up B A Set Up Call Proceeding Alerting Connect B Communication Communication User hangs up Disconnect Release Release Complete page 38

Conclusion! Global network for a dedicated application Everything is defined! High level of QoS! Main concepts PCM coding - Passband [300, 3400Hz] - Sampling at 8 khz - 64 kbps Separate two planes - Data plane - Control plane! High cost of maintenance and evolution page 39 On overview of GSM networks Global System for Mobile communication

Terrestrial Mobile Service!The terrestrial mobile service designates the telecommunication system that allows mobile stations to communicate, while being subject to movement within the border of a country or a continent This definition does not include satellite systems We consider bi-directional services We consider services including voice communications We focus on cell phone networks page 41 From the fixed network to the mobile network!during the 1900 s, a fixed network for telephony has been set up PSTN - Public Switched Telephony Network A network dedicated for telephony!gsm aims at extending the PSTN to mobile user Use a radio interface between the user and the network - Cut the cable which link a phone, computer, fax Support user mobility Main principals are maintained - Separation of control and data plans - Application protocol to establish / realize voice calls - Digital communication - Circuit switched network page 42

Main challenges for GSM!Interconnection with the PSTN and potentially other networks!radio interface is shared among large amount of users is a broadcast channel is less reliable is rare and expensive Security!Support the users mobility Roaming (movement without communication) Handover (movement while being in communication) page 43 Principles!Re-use of radio resources!several identities for users!authentication and confidentiality!location managers!gateways between different kinds of networks!integration of services Voice and data Security Teleservices page 44

Cellular concept!the goal of the GSM technology is to provide mobile communication for an entire country! Communication between Base Station and Mobile Station The coverage is provided by a set of Base Stations - Base Stations are distributed within an area in a way to provide full coverage Mobile Stations attach to those Base Stations which allow voice calls and other services!the link between fixed telephony network and mobile system is provided through a fixed network called PLMN (Public Land Mobile Network)! Frequency bands are 450MHz, 900MHz and 1800MHz page 45 Concept of a cell! A service is made available if the radio link with a mobile station is good enough! Control the power of the Base Station which are distributed on a region The area within which a Mobile Station is able to establish a link with a Base Station is called a Cell! The problem is to set up a system with continuous services, which means that cells must be continuous Cell Base Station Mobile Station? page 46

Deployment example Where is a user? Which frequency to use? page 47 Roaming and handover!a mobile station must be able to call and to be called wherever it is located in the network!during a communication, a Mobile Station may exit the coverage area of its serving Base Station The mobile Station needs to switch Base Station page 48

Overview of the location management for an incoming call 1. Initiate a communication with Mobile 2. Call Mobile Home Registery Mobile 1 is in Cell 1 Visited registery 4. Voice conversation 3. Call Mobile Cell 1 Cell 2 page 49 Overview of the Location Management Active voice communication Home Network Mobile 1 is in Cell 1 2. Information exchange between old and new location 3. Redirection of voice traffic Cell 1 Cell 2 1. Mobile moves to Cell 2 page 50

Radio resource management!number of frequencies is limited!number of Base Stations is large to cover a region => Re-use of the frequencies in non-adjacent cells D R R - Radius of the cell D - Re-use distance R page 51 Cellular deployment!pave the area with regular hexagon!optimize the number of simultaneous communication in an area page 52

Multiplexing!Objectives Provide channel access to several users Provide a downlink and an uplink!uplink and downlink Frequency division Half of the frequency band is used for downlink and half is used for uplink!share the medium among several users TDMA - Time Division Multiple Access 8 time slots are used per channel page 53 Terminal and SIM card! Subscriber = person who obtains a service from an operator and who is responsible of the payment! SIM = Subscriber Identity Module Subscriber Mobile phone - device Smart card Store the user data - Identity - Last location area - Authorized services - Personal passwords page 54

Phone numbers and identities!msisdn Mobile Station ISDN Number Phone number at which a subscriber can be called!imsi International Mobile Subscriber ID Uniquely identifies a user in the network!imei International Mobile Equipment ID Unique identifier of equipment (cell phone)! Other numbers MSRN - Mobile Station Roaming Number TMSI - TEmporary Mobile Station ID page 55 Why having multiple identities?!more practical to manage subscribers!it is possible to associate several numbers to a single user!protect the user from identity stealing Avoid sending the IMSI over the radio interface!manage mobility page 56

GSM Architecture Three sets!bss - Base Station Subsystem Radio interface management!nss - Network Subsystem Communication management (switch and data base)!oss - Operation Support System Network management by the operator page 58

Why these sets?!nss vs BSS Communication management VS radio management NSS manages roaming - Memorize location and route calls BSS manages the specifics of the radio - channel allocation, radio transmission, handover page 59 Global overview Um page 60

Components! BSS: radio subsystem BTS Base Transceiver Station - Antenna with a minimum of intelligence BSC - Base Station Controller - Control a set of BTS NSS: Fixed subsystem MSC - Mobile Service Switching center Switch for mobile VLR - Visitor Location Register Data base for visiting mobiles HLR - Home Location Register Data base for subscribers page 61 Power of the BTS!It is possible to dynamically control the power of the BTS Class Power in Watts for GSM 900 Power in Watts for DCS 1800 Normal BTS 1 from 320 to 640 from 20 to 40 2 from 160 to 320 from 10 to 20 3 from 80 to 160 from 5 to 10 4 from 40 to 80 from 2.5 to 5 5 from 20 to 40 6 from 10 to 20 7 from 5 to 10 8 from 2.5 to 5 Micro-BTS M1 from 0.08 to 0.25 from 0.5 to 1.6 M2 from 0.03 to 0.08 from 0.16 to 0.5 M3 from 0.01 to 0.03 from 0.05 to 0.16 page 62

BTS-BSC configuration page 63 BSC functionalities!smart part of the BSS!Manage the radio interface Channels Allocation Use of the measures made by the MS and the BTS Control the power of the MS Decision for handovers!manage interfaces with the architecture With BTS With MSC With OSS page 64

HLR - Home Location Register!Manage data base for subscribers Information on a user - IMSI - International Mobile Station Identity - MSISDN - Mobile Station ISDN Number - Profile: restriction, additional services, etc Location information - Identity of the VLR where the subscriber is page 65 MSC - Mobile-Services Switching Centre! Manages communication between the mobile stations and the PSTN! Executes some handover! Link with the PSTN network! GMSC function Gateway for the incoming calls! SM-GMSC function Gateway for short messages! Scale several hundred of thousands subscribers page 66

VLR - Visitor Location Register! Data base of mobile users that are currently connected to the MSC IMSI - International Mobile Station Identity MSISDN - Mobile Station ISDN Number TMSI - Temporary Mobile Station Identity User profile (restriction, additional services) Location area! Manage the roaming number MSRN Mobile Station Roaming Number Used for incoming calls between the GMSC and the MSC! Deployment It is possible to have n VLR for 1 MSC or 1 VLR for n MSC Usually 1 VLR is coupled with 1 MSC Several hundred of thousands subscribers are managed by a VLR page 67 Administration subsystem! Role Monitor network performance Commercial administration Monitor security Equipment maintenance! EIR - Equipment Identity Register Optional - may not be used Data base of IMEI (International Mobile Equipment Identity)! Network management is split in 2 parts OMC - Operation and Maintenance system - Supervise a set of local equipment - Ex: an OMC-radio may manage some BTS and BSC NMC - Network Management Centre - General administration of the whole network page 68

Terminal equipment! Car phone Equipment which is mounted inside a vehicle with an outdoor antenna! Portable Equipment that we can carry, but the antenna is not physically attached to the set keyboard/screen.! Hand-held station Cell phone where the antenna, the keyboard and the screen are on the same device GSM 900 Power Type Class 2 8W Vehicule/Portable Class 3 5W hand-held Class 4 2W hand-held Class 5 0.8W hand-held page 69 Protocols suite

Role of each interface Name Location Usage Um MS - BTS Radio interface Abis BTS - BSC Various A BSC - MSC Various (interface BSS - NSS) C GMSC - HLR Request HLR for incoming calls C SM-GMSC - HLR Request HLR for incoming short msg D VLR - HLR Location and subscription management SS7 D VLR - HLR Additional services E MSC - SM-GMSC Short messages transport E MSC - MSC Handover execution F VLR - VLR Subscriber information management G MSC - EIR Check the terminal ID H HLR - AUC Authentication page 71 SS7 usage in GSM networks! SS7 is the signalling system in telephony network! SS7 is used on A interface, between the BSC and MSC/VLR Within NSS! Organization Each operator defines its own semaphore network MSC/VLR and HLR are Semaphore Point a MSC/VLR from a country must be able to call an HLR in another country! Use of MAP (Mobile Application Part) for mobility management in NSS! Re-use ISUP protocol for call establishment page 72

Inter-connection with PSTN page 73 International connection!each PLMN is connected To the international SS7 network To the international telephony circuit switched network page 74

Level 3 of the radio interface! CM - Connection Management Re-use of the layer 3 of ISDN between the MS and the MSC (Q.931) 3 components - CC - Call control - SS - Supplementary services - SMS - Short Messages! MM - Mobility Management Between the MS and the MSC Location update, authentication, MM connection management! RR - Radio Resource management Between the MS and the BSC Allocate channel, handover decision, etc page 75 The protocol stack (SS7) CM = Connection Management MM = Mobility Management RR = Radio Ressource LAPD = Link Access Protocol-D Channel MTP = Message Transfer Part SCCP = Signaling Connection Control Part BSSAP = Base Station System Application Part page 76

Message identification Wired case!each subscriber line is connected to a port on the switch Physical identification of the link page 77 Message identification GSM case Physical channel SCCP connection! MS sends messages over the radio interface!msc receives the messages from a SCCP connection with the BSC Does not see the radio specificities!usage of an association table in the BSC BTS + physical channel SCCP connection 15 (slot 3, Freq 41) Connection 27...... page 78

Layered architecture in NSS CO!Principles Use SS7 Re-use at maximum classic protocols (ISUP, SSUTR2) Additional protocol MAP to manage roaming page 79 Roaming and security

Problem Statement!Roaming Location of each mobile station Active mobile, even if is is in stand-by mode!radio channel User authentication Temporary identity Encryption page 81 Numbers! IMSI - International Mobile Station Identity Permanent identification of a user within the GSM network! TMSI - Temporary Mobile Station Identity Temporary identity of a mobile station used between the mobile station and its BTS! MSISDN - Mobile Station ISDN Number Phone number (can be used by other network, e.g., from the PSTN)! MSRN - Mobile Station Roaming Number Number which is allocated for a call! IMEI - International Mobile Equipment Identity Uniquely identify a device (phone terminal) page 82

Call example 1. The MSISDN is dialed and routed by the fixed network to the closest MSC 2. GMSC requests the HLR to identify the current MSC 3. HLR translates the MSISDN and request the current VLR 5. HLR forwards the MSRN to GMSC 4. VLR allocates a MSRN and send it to the HLR 6. GSMC establishes the call toward the current MSC, just as a classic call 7. MSC finally calls the MS by using the TMSI page 83 Authentication and encryption!radio communication Confidentiality threads - Communication may be listened Security threads - Pirate mobile phone!gsm solution IMSI confidentiality User authentication User data confidentiality Signaling confidentiality page 84

User identity confidentiality!gsm avoids to send IMSI over the radio interface Maintain the confidentiality of users identity Usage of the TMSI!Implementation VLR generates TMSI for MS - At least each time the MS changes VLR, and maybe more often VLR maintains the correspondence between IMSI and TMSI Only at bootstrap or upon failure, the IMSI needs to be sent over the radio interface The allocation of the TMSI is encrypted page 85 TMSI allocation SIM MSC/VLR Location Updating Request (LAI, TMSIold) Encryption process TMSI Reallocation Command (TMSInew) Allocation of TMSInew Memorize TMSInew TMSI Reallocation Complete Deallocation of TMSIold page 86

Authentication and encryption Main principles!random Numbers (RAND)!Authentication key Ki Ki is the base secret Allocated to a user (never sent over the network) Authentication (SRES) and determination of the encryption key Kc!Kc is an encryption key!several algorithms SRES = A3(RAND, Ki) Kc = A8(RAND, Ki) A5 algorithm for encryption from Kc page 87 Security principals RAND Ki A3 A8 Triplet RAND SRES Kc Authentication A5 Encryption page 88

User ID authentication page 89 Encryption page 90

Distribution of security data page 91 Roaming & Location Management

Why do we need location management?! The last hop is wireless Radio interface No wired link between the network and the terminal! No wire mobility Users can move around - While they are in stand-by mode - While they are in a communication We need to locate a user In case of an incoming call Support its mobility : do not break the communication while the user is moving Provide efficient methods - To scale to a large number of users and coverage - Because signaling is not paid by users page 93 Definition!Roaming: MS without any active communication which is in motion!handover: MS with an active voice call which is moving!several types of movement Inter / intra BSC Inter / intra MSC!Paging Research of a user in the network page 94

Location management Different choices! Only search a MS when you need it Cost of location: 0 Cost of research: high - The entire network is flooded to find the MS! Always know the exact position of MS Cost of location: high - Each movement must be advertised to the network - The network needs to store large amount of information Cost of research: 0 - The network knows exactly where is the MS, paging is not needed! Intermediate mechanism Define Location Area page 95 Location Area!Set of cells!location of the MS = identifier of the location area!allow having a rough location of the MS Cell Border of the location area page 96

When do you update the location?!manually In some systems (e.g., CT2/CAI) users could manually update their position Simplify the terminal and network functions Does not scale! Periodically Every Xs, the terminal sends its position to the network Easy to implement, but may generate to much traffic!update upon a change When the terminal detects a change in its location area, it informs the network Need the BTS to periodically send a Location Area Identifier page 97 Roaming management! Location trade-off Make the precise location of MS known by all entity is costly - Frequent location updates are needed Maintain a rough location of MS - Cost of location update is low - Research of the MS is costly! GSM choice : 2 mechanisms Location - Knowledge of the location area of the mobile station - Location updates are made by the MS At each change in the location area Periodically Paging - Find the precise location of a mobile station upon an incoming call - Only look into the known location area page 98

Location Area Identification MCC MNC LAC!MCC - Country Code!MNC - PLMN identification!lac - Number of the location area, freely allocated by the operator page 99 Who knows what? GMSC MSISDN => VLRi, IMSIa IMSIa => MSCj, LAIk, TMSIa MSCj IMSIa, TMSIa, LAIk page100 LAIk

Some call flows Outgoing calls page102

Incoming call page103 Incoming call page104

Conclusion!GSM is a very popular system By 2005, more than 75% of the worldwide cellular network market Over 3 billions of subscribers in 219 countries! Extend the fixed telephony network with a radio interface TArget the same quality of service - a dedicated architecture for a dedicated (single) application!strongly evolve over the past 15 years towards data communication GSM 1992 2G 3G 4G GPRS 1997 EDGE 1998 UMTS 2000 HSPA 2002 HSPA+ 2007 LTE 2008 LTE-Adv 2011 page105