GPRS各接口信令分析.doc

gprs各接口信令分析一 gprs air interface1. 空中接口逻辑信道。(1) 分组广播控制信道(pbcch-packet broadcast control channel)向小区内所有gprs移动终端发送系统信息，下行。(2) 分组公共控制信道(pccch-packet common control channel)a. 上行分组随机接入信道(prach-packet random access channel)gprs用户通过该信道向基站发出业务信道的申请。b. 下行分组寻呼信道(ppch-packet paging channel)用于寻呼gprs被叫用户c. 下行分组接入允许信道(pagch-packet access grant channel) 在开始传送分组之前，向移动终端发送资源分配消息，用以对prach作出应答。d. 分组通知信道(pnch-packet notification channel) 用于在ptm-m（点对多点的多播业务）分组开始传送之前，向一组移动终端发送ptm-m通知。该通知内有用于分组传送的资源分配格式。下行。(3) 分组业务信道(pdtch-packet data traffic channel)a. 分组数据业务信道(pdtch-packet data traffic channel)传送gprs分组数据。一个移动终端可以并行使用一个以上的pdtch（即占用多时隙工作）传送一个用户的分组信息。下行和上行。b. 分组随路控制信道(pacch-packet assosiated control channel)在传送gprs数据业务过程中传送控制信令的信令通道，如传送功率控制（pc）信息。2. 空中接口信令(1) mobile originated packet transferaccess & allocation(如果是mt接受数据时的通信流程，还应在prach前面接上ppch用以寻呼用户)msnetworkpacket channel requestpacket immediate assignmentpacket resource requestpacket resource assignmentprach or rachpagch or agchpacchpacch(optional)(optional)(2) mobile terminated packet transferdownlink pdtch assignment in ready statemsnetworkpacket resource assignmentpacch orpagch oragch(3) mobile terminated packet transferwith resource reassignmentdata blocktemporary packet ack/nack access and assignmentmsnetworkpdtchpacchpacket resource reassignmentpacket resource reassignment ackpacchpacchpacchfinal packet ack/nackdata blockpdtchdata blockpdtchdata block (polling)pdtchdata blockpdtchdata blockpdtchdata blockpdtchdata blockpdtchdata blockpdtchdata block (last, polling)pacch3. coding schemes and multiple timeslotsincreased data transmission ratesvia newcoding schemescs-19.05kbpscs-213.4kbpscs-315.6kbpscs-421.4kbpsbundling of up to 8 physical channels“net” transmission rate up to171.2 kbpsum接口上新增了以上四种编码方式，同时支持最多8时隙的时隙合并传输方式。因此gprs最高速率可达到171.2kbps。注：edge在单时隙时的用户速率为48 kbps，占用8个时隙的用户速率为384 kbps二mobility managementmobility management (mm) handles the subscriber when he is requesting access to the gprs network or when he wants to stop using the gprs network. mm handles the location management procedure transferring the necessary information from one sgsn/papu unit to another sgsn/papu unit and updating hlr if subscriber has changed sgsn. as described in module sgsn architecture, all mm procedures related to one ms are handled by the papu serving the ra in which the ms is currently located in nokia 2g sgsn implementation. if the subscriber has attached to cs services, mm updates the location also to vlr. mm handles the subscribers authentication functions and provides information to charging and statistics services.the procedures of mobility management are: gprs attach gprs detach purge security- authentication- subscriber identity confidentiality- ciphering- identity check location management- cell update- normal/periodic routing area update subscriber management interaction with msc/vlr- imsi attach/detach, combined imsi/gprs attach/detach - combined routing area and location area update- cs paging- non-gprs alert - identification procedure- mm information.(一) gprs attachms向新sgsn发送激活请求消息，消息中包括ptmsi旧的rai(没有可用的ptmsi时用imsi)、cksn、激活类型(只激活gprs、imsi已被激活的情况下激活gprs、gprsimsi联合激活三者之一)、drx参数(discontinuous reception，非连续性接收)、旧ptmsi签名。 attach request 新sgsn向旧sgsn发送身份认证请求消息(ptmsi、旧rai、旧ptmsi签名)，以获取ms的imsi。旧sgsn回送认证响应消息(imsi，鉴权三参数组)，如果旧sgsn不能认证ms，将回送相应的出错原因。 identification request/identification response请求与答复移动台imsi或p-tmsi 如果新、旧sgsn都无法认证ms，那么新sgsn将向ms发送认证请求消息(认证类型=imsi)， ms回送响应消息(imsi)。 identity request/identity response ms、新sgsn、hlr之间进行保密鉴权。sgsn用取得的imsi到hlr中请求认证三码组（authentication triplets），并对 ms进行鉴权。authentication ms、新sgsn、eir之间进行imei检查。 imei check 如果是初次激活或者再次激活时sgsn编号已改变(比较上次而言)，sgsn要通知hlr。由新 sgsn向hlr发送位置更新消息(sgsn编号、sgsn地址、imsi（注意已经转换为e.214码）) update location；hlr向旧sgsn发送位置消除消息 (imsi，消除类型) cancel location；旧sgsn应答(imsi) cancel location ack；hlr向新sgsn发送插入用户数据消息(imsi，gprs用户数据(包括16进制格式的apn，包括msisdn?) insert subscriber data；新sgsn检查ms在新ra的合法性，如果ms是局部受限用户而不允许在新ra激活，则新sgsn向hlr返回应答(imsi，sgsn区域受限)，拒绝激活请求。如果是其他原因不允许激活，则返回hlr的是应答(imsi，原因)。如果ms经检查合法，则返回应答(imsi) sgsn根据移动台的gprs签约数据决定是否允许移动台在当前路由区内附着，如允许，sgsn将向hlr返回一条消息insert subscriber data ack。；hlr向新sgsn回送位置更新应答update location ack。 如果第点中的激活类型为后两者(imsi已被激活的情况下激活gprs、gprsimsi联合激活)，当sgsn与mscvlr之间的gs接口存在时，要更新vlr。vlr的编号从ra获取。新sgsn向新mscvlr发送位置更新请求消息(新lai、imsi、sgsn编号，位置更新类型)；新vlr向hlr请求位置更新(imsi，新vlr)；hlr通知旧vlr消除位置信息(imsi)；旧vlr对hlr应答(imsi)； hlr向新mscvlr发送插入用户数据消息(imsi，gsm用户数据)；新vlr应答hlr(imsi)。这时新mscvlr向新 sgsn发送位置更新接受的响应(vlrtmsi)。 新sgsn向ms发送激活接受消息(ptmsi，vlrtmsi，ptmsi签名)。 attach accept ms向新sgsn回送激活完成消息(ptmsi，vlrtmsi)。 attach complete 新sgsn向新mscvlr发送tmsi再分配完成消息(vlrtmsi)。tmsi reallocation completewhen subscriber wants to start using services of gprs network, he has to connect to the network. the ms informs sgsn that it desires to connect to gprs network. he informs sgsn with a mobility management procedure called gprs attach procedure. only ms can start this procedure.the procedure is described in figure 1.figure 1.gprs attach procedure1the ms initiates the attach procedure by the transmission gmm. attach request (imsi or ptmsi and old rai, classmark, cksn, attach type, drx parameters, old ptmsi signature) message to the papu handling the ra in which the ms is camped. if the ms has a valid ptmsi, then ptmsi and the old rai associated with ptmsi shall be included. in this case if it has also stored its old ptmsi signature, then the ms shall include the old ptmsi signature in the attach request message for identification checking purposes. classmark contains the mss gprs multislot capabilities and supported gprs ciphering algorithms. attach type indicates which type of attach that is to be performed, i.e., gprs attach only, gprs attach while already imsi attached, or combined gprs / imsi attach (in this section gprs attach only is analysed). drx parameters indicates whether the ms uses discontinuous reception or not. if the ms uses discontinuous reception, then drx parameters also indicate when the ms is in a non-sleep mode able to receive paging requests and channel assignments.noteptmsi signature is a random number optionally allocated and sent by the sgsn to the ms in attach accept and routing area update accept messages. if the ptmsi signature has been sent by the sgsn to the ms since the current ptmsi was allocated, then the ms shall include the ptmsi signature in the next routing area update request and attach request for identification checking purposes. in the attach and routing area update procedures, the sgsn compares the ptmsi signature sent by the ms with the signature stored in the sgsn. if the values match, the sgsn may use the security functions to authenticate the ms. if the values do not match or if the ptmsi signature is missing, sgsn uses security functions to authenticate the ms. ptmsi signature parameter has only local significance in the sgsn that allocated the signature.2 if the ms has detached in a routing area handled by the same papu, the papu already has the subscriber p-tmsi-imsi association. this means that papu can directly perform step 3 (authentication, see section (五) and shall accept the attach request. a.if ms was previously attach in a ra handled by different papu the imsi is first inquired from the old papu unit that has stored the p-tmsi-imsi association. the new papu sends a gtp.identification request (p-tmsi, old rai and old p-tmsi signature) to the old papu to get the imsi of the ms. the old papu responds with gtp.identification response (imsi, authentication vectors). in order to find the ip address of old papu two cases can be distinguished:l the old papu belongs to different sgsn: the new papu has to find out the ip address of the old papu asking from the dns server. old papu name is formed by the old rai(=mcc+mnc+lac+rac) in the following way: racrac.laclac.mncmnc.mccmcc.gprs (for example if the old rai is 222 + 10 + 1234 + 100 the rai name is rac100.lac1234.mnc010.mcc222.gprs) l the old papu belongs to the same sgsn: the ip address of the previous papu unit is known by the mchu of same sgsn and no dns queries needs to be performed. in this case papu interrogates the gprs parameter database (gpdata) in mchu where are stored the relation between ip papu address and rai handled by sgsn. b.if for the some reason the new papu cannot find imsi of ms (e.g. papu reset or detached subscriber storage time is expired), it asks the imsi directly to the ms sending to him gmm.identity request (identity type = imsi). the ms shall respond with a gmm.identity response (imsi) message. 3. depending on plmn parameter authentication repetition rate for gprs attach, the papu performs authentication procedure toward ms (authentication, see section (五).4.depending on plmn parameter imei check repetition rate for gprs attach the papu may perform the equipment checking functions. identity check procedure is described in section (六).5.if the sgsn number has changed since the gprs detach, or if it is the very first attach, then the sgsn informs the hlr and performs the update location procedure to hlr (see section (四): update location procedure to hlr).6.the papu selects radio priority sms, and sends an gmm.attach accept (p-tmsi, p-tmsi signature, radio priority sms, periodic ra update timer, force to standby) message to the ms. force to standby (sgsn parameter: fts) may indicate force to standby not indicated or force to standby indicated. it is to force the ms to stop the ready timer in order to prevent the ms to perform cell updates. p-tmsi is included if the sgsn allocates a new p-tmsi. if p-tmsi was changed, the ms acknowledges the received p-tmsi with gmm.attach complete (p-tmsi).a gprs ms has now a mm context in papu serving the ra in which the ms in camped and the gprs subscription data are downloaded from hlr and are stored in smmu.if the attach request cannot be accepted, the papu returns a gmm. attach reject (imsi, cause) message to the ms.ms makes attach to network using imsiif ms has not a valid p-tmsi, the ms shall send the gmm.attach request (imsi, attach type) where attach type is gprs attach. in this case the papu performs directly:step 3: authentication procedure as mandatory (see section (五): authentication). step 4: imei checking procedure (see section (六): identity check procedure).step 5: update location procedure to hlr (see section (四): update location procedure to hlr).step 6: the papu selects radio priority sms, and sends a gmm.attach accept (p-tmsi, p-tmsi signature, radio priority sms) message to the ms. p-tmsi is included if the sgsn allocates a new p-tmsi. if p-tmsi was changed, the ms acknowledges the received p-tmsi with gmm.attach complete (p-tmsi).if the attach request cannot be accepted, the papu returns a gmm.attach reject (imsi, cause) message to the ms.(二) gprs detachthe detach function allows an ms to inform the network that it wants to make a gprs and/or imsi detach, and it allows the network to inform an ms that it has been gprs-detached or imsi-detached by the network. the different types of detach are:- imsi detach;- gprs detach; and- combined gprs / imsi detach (ms-initiated only).the ms is detached from gprs either explicitly or implicitly: explicit detach: the network or the ms explicitly requests detach. implicit detach: the network detaches the ms, without notifying the ms, a configuration-dependent time after the mobile reachable timer expired, or after an irrecoverable radio error causes disconnection of the logical link.in the explicit detach case, a detach request (cause) is sent by the sgsn to the ms, or by the ms to the sgsn.when network receive detach request from ms or send a detach request to ms, it aborts any data transfer for the subscriber.the ms can make an imsi detach in one of two ways depending on if it is gprs-attached or not:- a gprs-attached ms sends a detach request message to the sgsn, indicating an imsi detach. this can be made in combination with gprs detach.- an ms not attached to the gprs makes the imsi detach as already defined in gsm.in the mo detach request message there is an indication to tell if the detach is due to switch off or not. the indication is needed to know whether a detach accept message should be returned or not.in the network-originated detach request message there may be an indication to tell the ms that it is requested to initiate gprs attach and pdp context activation procedures for the previously activated pdp contexts.after successful detach, the ms state shall change to idle and its mm context and pdp contexts in papu are removed. however, the subscribers imsi-ptmsi association is not removed from papu. it is removed after the subscriber is removed from visiting gprs subscriber database in smmu. the subscriber information in visiting gprs subscriber database (gsbase) in smmu may be deleted after a successful detach. alternatively, the smmu may keep the subscriber information and the authentication vectors of the detached ms, so that the contexts can be reused at a later gprs attach without accessing the hlr. subscriber information is removed from smmu when the detached subscriber storage time timer expires (sgsn parameter: stt). when the smmu deletes the subscriber data from its memory, it shall initiate the purge procedure to inform hlr about deleting (see section error! reference source not found. error! reference source not found.).ms-initiated detach procedure(1) 用户发送分离请求消息 带有detach type p-tmsi p-tmsi signature switch off 给sgsn 从而发起分离流程 detach type指示将要进行何种类型的分离流程 即gprs分离 imsi分离 联合分离 switch off指示用户的分离是否是因为关机 分离请求消息带有用户的p-tmsi和p-tmsi签名 签名是用来检查用户分离消息的合法性的 如果用户的签名不合法或者没有带 sgsn应该发起鉴权(2) 如果是gprs分离 存在于ggsn中属于该用户的激活的pdp上下文的去活 是通过sgsn向ggsn发送删除pdp上下文请求消息 带有teid 来实现的 ggsn以删除pdp上下文响应消息予以确认(3) 如果是imsi分离 sgsn应该发送imsi分离指示消息给vlr(4) 如果用户需要在gprs分离同时保留imsi附着 sgsn应该发送gprs分离指示消息给vlr vlr删除和sgsn的关联 并且不再通过sgsn发起寻呼和location update(5) 如用户不是因为关机发起分离 sgsn应该回应分离接受消息给用户(6) 如果用户发起gprs分离 sgsn释放ps域信令连接ms requests detach from the gprs network when it wants to stop using services of gprs network. the procedure is described in figure 2.figure 2.ms-initiated gprs detach procedurethe ms detaches by sending gmm.detach request (detach type, switch off) to the papu serving the routing area where ms is camped. switch off indicates whether detach is due to a switch off situation or not. the detach type information element may indicate “gprs detach with switching off”, “gprs detach without switching off”.in gprs detach case, the ms could have one or more active pdp context. all the active pdp contexts in the ggsns regarding this particular ms are deactivated by the papu sending gtp.delete pdp context request (teid) to the ggsns. the ggsns acknowledge with gtp.delete pdp context response (teid). description of pdp context in module sgsn and session management.as internal process of sgsn, papu removes mm context and pdp contexts of ms but it does not remove the imsi-ptmsi association for that ms. in this way the ms can present itself to the network with ptmsi also during attach request. papu informs the smmu with a dx200 message that ms is detached. smmu may delete subscriber information in visiting gprs subscriber database (gsbase) or may keep the information of ms updating the flag time stamp of gprs detach in subscriber record.if switch off indicates that the detach is not due to a switch off situation, the papu sends a gmm.detach accept (force to standby) to the ms. force to standby (sgsn parameter: fts) may indicate force to standby not indicated or force to standby indicated. it is to force the ms to stop the ready state timer in order to prevent the ms to perform cell updates. network-initiated detach procedurethe gprs network may also initiate gprs detach procedure. gprs network may initiate detach procedure because of some error situation in network. also if the subscribers data is removed from hlr, the hlr initiates a detach procedure. 1) the sgsn informs the ms that it has been detached by sending detach request (detach type) to the ms. detach type indicates if the ms is requested to make a new attach and pdp context activation for the previously activated pdp contexts. if so, the attach procedure shall be initiated when the detach procedure is completed.2) the active pdp contexts in the ggsns regarding this particular ms are deactivated by the sgsn sending delete pdp context request (tid) messages to the ggsns. the ggsns acknowledge with delete pdp context response (tid) messages.3) if the ms was both imsi- and gprs-attached, the sgsn sends a gprs detach indication (imsi) message to the vlr. the vlr removes the association with the sgsn and handles paging and location update without going via the sgsn.4) the ms sends a detach accept message to the sgsn any time after step 1.hlr-initiated detach procedurethe hlr-initiated detach procedure is initiated by the hlr. the hlr uses this procedure for operator-determined purposes to request the removal of a subscribers mm and pdp contexts at the sgsn.1) if the hlr wants to request the immediate deletion of a subscribers mm and pdp contexts from the sgsn, the hlr shall send a cancel location (imsi, cancellation type) message to the sgsn with cancellation type set to subscription withdrawn.2) the sgsn informs the ms that it has been detached by sending detach request (detach type) to the ms. detach type shall indicate that the ms is not re