GMM | GPRS for Mobile Internet

7.1 GMM

The management of GPRS mobility in the network ensures the continuity of packet services when a given subscriber moves from one GPRS LA to another. This implies that the network must know the identifier of the GPRS LA indicating where the MS is located.

The GMM functions enable the network infrastructure to keep track of subscribers' locations within the PLMN or within another PLMN. The SGSN, which is the serving node of an MS, handles the mobility context management related to it. This context contains information such as the IMSI, the P_TMSI, the RAI, and the CI. This mobility context management is also stored at the MS side, in the SIM card. All GPRS mobility procedures require a TBF connection at the RLC/MAC layer between the MS and the PCU.

7.1.1 Procedures

7.1.1.1 GPRS Attach Procedure

When an MS needs to signal its presence to the network in order to access to GPRS services, it performs an IMSI attach procedure for GPRS services. During this procedure a MM context is created between the MS and the SGSN.

There are two types of GPRS attach procedures:

Normal GPRS attach. This procedure is used by the MS to be IMSI attached for GPRS services only.
Combined attach procedure. This procedure is used by a class A or class B MS to be IMSI attached for GPRS and non-GPRS services in a cell that supports GPRS in network operation mode I (see Section 3.5.3.1).

Note that by default, the IMSI-attach procedure is referred to as the attach procedure for circuit-switched services. The IMSI-attach procedure for GPRS services is also called the GPRS-attach procedure.

Normal GPRS Attach

Figure 7.1 describes a GPRS-attach procedure. In this scenario, the MS signals itself to the network by sending it its old P-TMSI identifier associated with the old RAI identifier. When the SGSN receives this information, it analyzes the RAI identifier in order to determine the associated SGSN. If there is an SGSN change, the new SGSN must contact the old SGSN from its RAI identifier in order to retrieve the MS identity. Authentication functions may be performed; they are mandatory if no MM context information related to the MS, such as IMSI, P-TMSI, CI, and RA exists anywhere in the network. Then the new SGSN informs the HLR of SGSN change, and location information in the HLR database is updated via the MAP protocol on SS7 signaling. If the HLR receives an indication from an SGSN different from the one stored in its table for a GPRS subscriber, it requests the old SGSN to remove GPRS data related to this subscriber, and then transmits this data to the new SGSN.

Figure 7.1: GPRS-attach procedure.

The new SGSN then transmits to the MS the GPRS-attach confirmation. If a new P-TMSI is allocated by the SGSN, it is acknowledged by the MS to end the GPRS-attach procedure.

Combined Attach Procedure

Figure 7.2 describes a combined GPRS/IMSI attach procedure in a cell that supports GPRS in network operation mode I. The difference with the previous scenario is that the new SGSN sends an IMSI attach request to the MSC/VLR via the Gs interface as soon as the new SGSN receives data related to the GPRS subscriber from the HLR. When the new SGSN receives the acceptance of IMSI attach from the MSC/VLR entity, it transmits the IMSI and GPRS attach confirmation. If the MS receives a new P-TMSI identifier or a new TMSI identifier, then it acknowledges it to end the combined attach procedure.

Figure 7.2: Combined GPRS/IMSI attach procedure.

7.1.1.2 GPRS Detach

When an MS does not need to access GPRS services anymore, an IMSI-detach procedure is initiated, either by the MS or by the SGSN. During this procedure, the MM context between the MS and the SGSN is removed.

There are two types of GPRS-detach procedures:

Normal GPRS detach. This procedure is used to IMSI detach only for GPRS services.
Combined detach procedure. This procedure is used to IMSI detach a class A or B MS for GPRS or non-GPRS services in a cell that supports GPRS in network operation mode I.

This procedure is initiated either by the MS or by the network

MS-Initiated Detach Procedure

MS-Initiated Normal GPRS Detach When a GPRS MS wishes to be IMSI detached for GPRS services, it initiates a GPRS-detach procedure to the SGSN. The procedure is ended upon the receipt of the DETACH ACCEPT message by the MS, as illustrated in Figure 7.3.

Figure 7.3: Normal GPRS detach initiated by MS.

MS-Initiated Combined GPRS Detach When an MS both IMSI and GPRS attached wishes to perform a GPRS detach in a cell that supports GPRS in network operation mode I, it initiates a combined detach procedure to the SGSN. The latter sends an explicit request to the MSC/VLR to deactivate the association between SGSN and MSC/VLR in order that circuit-switched incoming calls are no longer routed to SGSN. Figure 7.4 illustrates this scenario. The same scenario is used for an MS both IMSI and GPRS attached wishing to be IMSI detached or both IMSI and GPRS detached in network operation mode I.

Figure 7.4: Combined GPRS detach initiated by an MS in network operation mode I.

Network-Initiated Detach Procedure

Network-Initiated Normal GPRS Detach When an SGSN wishes to IMSI detach a given MS for GPRS services, it initiates a GPRS-detach procedure. The procedure is ended upon the receipt of DETACH ACCEPT message by the SGSN, as illustrated in Figure 7.5. The network may request the MS to perform a reattach in the case of a network failure condition.

Figure 7.5: Normal GPRS detach initiated by an SGSN.

Network-Initiated Combined GPRS Detach When an SGSN wishes to IMSI detach a class A or B MS for GPRS or non-GPRS services, it notifies the relevant MS of a GPRS detach. It also sends an explicit request to MSC/VLR to deactivate the association between SGSN and MSC/VLR. Circuit-switched incoming calls are no longer routed to SGSN. Figure 7.6 illustrates this scenario.

Figure 7.6: GPRS detach initiated by SGSN in network operation mode I.

An HLR may initiate a GPRS detach for operator purposes in order to remove the subscriber's MM and PDP contexts at the SGSN. The HLR sends a CANCEL LOCATION message in order to delete the subscriber's MM and PDP contexts from the SGSN. This latter then notifies the relevant MS of a GPRS detach. If the MS is both IMSI and GPRS attached, the SGSN sends an explicit request to the MSC/VLR to deactivate the association between the SGSN and the MSC/VLR. Figure 7.7 illustrates this scenario.

Figure 7.7: Combined GPRS detach initiated by HLR.

7.1.1.3 Paging on PCCCH

An MS, IMSI attached for GPRS services, may be paged on PCCCH channels if they are allocated in a cell it is camped. There are two types of paging on PCCCH:

GPRS paging in a cell that supports GPRS in network operating modes I or III;
Circuit-switched paging in a cell that supports GPRS in operating mode I (presence of Gs interface).

Note that paging modes are described in Section 3.5.3.1.

GPRS Paging

In a cell supporting PCCCH channels and operating in network operation modes I or III, an MS both IMSI and GPRS attached in GMM STANDBY state can be paged by the network if the SGSN receives a PDU for it. When the MS receives a paging for packet-switched services, it requests of the BSS a TBF establishment in order to send any LLC frame to the SGSN. On LLC frame transmission, the MS goes to GMM READY state. Upon receipt of the LLC frame, the SGSN goes to GMM READY state. As the MS is now located at cell level, the packet transfer mode may start on downlink. This scenario is shown in Figure 7.8.

Figure 7.8: Packet-switched paging for network operation mode III with PCCCH channels.

Circuit-Switched Paging

In a cell supporting PCCCH channels and operating in network operation mode I, an MS both IMSI and GPRS attached monitors the PCCCH channels in order to detect incoming circuit-switched calls. As soon as the MS recognizes its IMSI identifier in the GPRS PAGING REQUEST message received on the PPCH, it switches on the CCCH channels and requests the network to allocate radio resource in order to answer to circuit-switched paging. The MSC/VLR stops the paging procedure upon receipt of an SCCP connection establishment containing the paging response message from the MS via the A interface. This scenario is shown in Figure 7.9.

Figure 7.9: Paging for establishment of a circuit-switched connection for network operation mode I.

7.1.1.4 Authentication Procedure

The authentication procedure allows the network to identify and authenticate the user in order to protect the radio link from unauthorized GPRS calls.

During an authentication procedure, a new SGSN needs to retrieve the triplet (Kc, signed RESult [SRES], random) from the HLR/AUC entity via the MAP protocol using the SS7 network. When the SGSN has retrieved this triplet , it authenticates the MS by sending the random number in the AUTHENTICATION AND CIPHERING request message. Upon receipt of this number, the MS will calculate the SRES number and the ciphering key Kc. Next the MS forwards to the network the SRES number. The network compares the SRES number calculated by the MS with the one sent by the entity HLR/AUC. If the two SRES numbers are identical, the SGSN considers that the outcome of the authentication of the GPRS subscriber is positive. Figure 7.10 illustrates the authentication of a GPRS subscriber.

Figure 7.10: Authentication of a GPRS subscriber.

Note that:

The GPRS ciphering algorithm is sent to the MS in the authentication and ciphering request message. The GPRS ciphering starts after the AUTHENTICATION AND CIPHERING response message is sent.
A GPRS ciphering key sequence number (CKSN) identifies the ciphering key Kc on the MS and network sides.

7.1.1.5 Location Procedures

A location procedure is always initiated by the MS. Under normal circumstances, a location change occurs when the MS decides to camp on a new cell for better radio conditions.

If an MS in GMM READY state camps in a new cell within its current RA, it needs to perform a cell update procedure in order to receive directly downlink PDUs from the network without being paged. If the MS camps in a new cell belonging to a new RA, it needs to perform an RA update procedure in order to update MM context information between the MS and the SGSN.

Cell Update

When a GPRS MS in GMM READY state detects a new cell within its current RA, it performs a cell update procedure by sending any LLC frame containing its identity. Figure 7.11 illustrates the cell update notification.

Figure 7.11: Cell update.

RA Update Procedure

An RA update procedure is performed when a GPRS MS has detected a new RA. This procedure is always initiated by the MS. There are four types of RA update procedures:

Normal RA update, performed by a class C MS or by a class A or B MS in a cell that supports GPRS in network operation mode II or III upon detection of a new RA;
Periodic RA, performed by any GPRS MS upon expiry of a timer;
Combined RA and LA update, performed by a class A or B MS in a cell that supports GPRS in network operation mode I upon detection of a new LA;
Combined RA and IMSI attach, performed by a class A or B MS in a cell that supports GPRS in network operation mode 1 in order to be IMSI attached for non-GPRS services when the MS is already IMSI attached for GPRS services.

Normal RA Update

Intra-SGSN HA Update During an RA update procedure, the MS signals itself to the SGSN by sending its old P-TMSI signature associated with the RAI identifier from its old RA. The SGSN has the necessary information about the MS if the SGSN also handles the old RA.

In the case of an intra-SGSN change, the SGSN validates the presence of the MS in the new RA by returning to it a ROUTING AREA UPDATE ACCEPT message. If the SGSN allocates a new P-TMSI identifier, it is acknowledged by the MS. This procedure is called intra-SGSN RA update since the SGSN does not need to contact an old SGSN, GGSN, and HLR. Figure 7.12 illustrates an intra-SGSN RA update procedure.

Figure 7.12: Intra-SGSN RA update.

Note that a periodic RA update is always an intra-SGSN RA update procedure.

Inter-SGSN RA Update When the SGSN detects that the old RA sent by the MS is handled by another SGSN, the SGSN has no information about this MS. In this case, the SGSN needs to contact the old SGSN, the GGSN, and the HLR in order to retrieve information and update the routing information. This procedure is called an inter-SGSN RA update procedure.

Thus the new SGSN is able to contact the old SGSN from the RAI identifier in order to retrieve MM and PDP context information related to the MS identified in the old SGSN by its old P-TMSI. If the old signature does not match the one saved in the old SGSN, the new SGSN performs an MS authentication procedure. If the old SGSN has saved in its buffer some packets addressed to the MS, it forwards the packets toward the new SGSN.

When the new SGSN has retrieved MM and PDP context information, it updates the data related to the new SGSN in the GGSN. The new SGSN then updates location information in the HLR database via the MAP protocol using the SS7 network. If the HLR receives an indication from an SGSN different from the one saved in its table for a GPRS subscriber, it requests the old SGSN to remove GPRS data related to this subscriber. It then transmits this data to the new SGSN.

When the new SGSN receives an RA update confirmation in the HLR database, it transmits the RA update confirmation to the MS with its new P-TMSI identifier and the receive N-PDU number. This message contains the acknowledgment of N-PDUs successfully transferred by the MS before the start of the update procedure. The RA update procedure ends as soon as the MS acknowledges its new P-TMSI identifier.

Figure 7.13 illustrates the inter-SGSN RA update procedure.

Figure 7.13: Inter-SGSN RA update.

Combined RA and LA Update

During a combined RA and LA update procedure in a cell that supports GPRS in network operation mode I, the new SGSN (in case of SGSN change) retrieves MM and PDP context information related to the MS from the old SGSN. The new SGSN sends its address to the GGSN, updates routing information in the HLR via the MAP protocol, and retrieves data related to the GPRS subscriber from the HLR. The new SGSN transmits an LA update request via the Gs interface.

If the LA change involves a new MSC/VLR entity, the new MSC/VLR updates the location information in the HLR via the MAP protocol. When the HLR receives a notification from an MSC/VLR different from the one saved in its table, it requests the old MSC/VLR to remove data related to the GPRS subscriber and then transmits this data to the new MSC/VLR data.

When the new SGSN receives the LA update confirmation from the new MSC/VLR with the allocation of a new TMSI identifier value, it transmits the confirmation of the combined RA and LA update message toward the MS. The new SGSN allocates a new P-TMSI identifier for packet services and also returns the receive N-PDU number, containing the acknowledgment of N-PDUs successfully transferred by the MS before the start of the combined procedure. The combined RA and LA update procedure ends as soon as the MS acknowledges its new TMSI and P-TMSI identifiers.

Figure 7.14 illustrates the combined RA and LA update procedure.

Figure 7.14: Combined RA and LA update procedure.

Note that the combined RA and IMSI attach scenario generates the same message exchange between the MS, SGSN, GGSN, MSC/VLR, and HLR entities as the combined RA and LA update scenario.

7.1.1.6 PLMN Selection

Selection Mode

When an MS that is both attached for GPRS and non-GPRS services exceeds the limits of PLMN radio coverage indicated by its subscription (see notion of home PLMN defined in Section 1.2.6), it may choose a different PLMN from its HPLMN (see notion of visited PLMN defined in Section 1.2.6).

There are two PLMN selection modes in the MS:

Automatic mode;
Manual mode.

In automatic mode, the MS attempts to register on a PLMN that belongs to a PLMN list sorted by priority order. In order to attempt a registration on a given PLMN, the MS camps on a cell for which the reception field power level meets an acceptable radio criterion. In case of registration failure on this PLMN, the MS registers on a PLMN that has the next best priority in its list. The MS scans its PLMN list from the highest down to the lowest priority until it succeeds in registering on a given PLMN.

In manual mode, the user selects manually the desired PLMN among the list of available PLMNs that is presented by the MS. The user has the opportunity to choose the PLMN selection mode at any time on the MS. At the power switch on, the default selection mode corresponds to the last used selection mode.

Management of Forbidden PLMNs

The MS receives an explicit registration reject on a given PLMN when the user subscription does not contain any roaming agreements with the operator of the visited PLMN (VPLMN). In this case the MS inscribes the PLMN identity in its forbidden PLMN list stored on its SIM card in order to avoid another registration request in automatic mode. This PLMN is removed from the list of forbidden PLMNs if the MS succeeds to register on it in manual mode.

As the roaming agreements between two operators may be different for circuit-switched services and packet-switched services, a given PLMN may reject a GPRS registration of a subscriber even when it may have already accepted a GSM registration of this subscriber. For this reason, the GPRS MS manages a specific list of forbidden PLMNs for GPRS in order to avoid another GPRS registration request. This list of forbidden PLMNs for GPRS is removed on SIM card extraction or at MS switch off. Moreover, a forbidden PLMN is removed from the list of GPRS forbidden PLMNs if the MS succeeds in registering on it in manual mode.

An MS configured in class A or B remains IMSI-attached for non-GPRS services in a network that operates in network operation modes II or III when it receives an explicit reject of GPRS subscription from the PLMN. When an MS configured in class A or B receives an explicit reject of GPRS subscription from the PLMN that operates in network operation mode I, it then performs another IMSI-attach procedure on the same PLMN. This is due to the fact that the IMSI-attach request has not been previously forwarded by the SGSN to the MSC/VLR. An MS configured in class C performs a new PLMN selection when it receives from the PLMN an explicit reject of GPRS subscription in automatic mode.

The reject cause "GPRS not allowed in PLMN" may also occur during an RA update procedure or during a combined RA and LA update procedure. In the case of an RA update procedure, an MS configured in class A or B in a network that operates in network operation mode II or III remains IMSI attached. In the case of a combined RA and LA update procedure a class A or B mobile performs a new LA update procedure in order to update its new LA. This is due to the fact that the location request has not been previously forwarded toward the MSC/VLR by the SGSN.

7.1.1.7 GPRS Parameter Update Status

The GPRS update status parameter is an internal MS parameter that gives the outcome of the last location request procedure such as GPRS attach or RA update request. This status defines the behavior of the MS. It is defined for a GPRS MS in any mode, when the GPRS function is disabled, when the MS is GPRS attached, or when the establishment of the GPRS-attach procedure is in progress. The service level to which a GPRS subscriber has access depends on the GPRS update status. This status is updated by a network-initiated GPRS attachment/detachment, authentication, and RA update procedure. The last value of this parameter is stored in the SIM card.

The values of these parameters are as follows :

GU1: UPDATED. The GPRS update-status parameter is set to GU1 when the last attachment procedure or the last RA update procedure was successful. In this case, the SIM contains valid data related to the RAI, P-TMSI, GPRS ciphering key, and GPRS ciphering sequence number parameters.
GU2: NOT UPDATED. The GPRS update-status parameter is set to GU2 when the last attachment procedure or last RA update procedure has failed (no response was received from the network after that the GMM procedure was initiatied by the mobile).
GU3: ROAMING NOT ALLOWED. The GPRS update-status parameter is set to GU3 when the network response to a GPRS attachment or RA update procedure is negative. This case may occur on subscription or roaming restrictions. In this case, the SIM card does not contain valid data related to the RAI, P-TMSI, GPRS ciphering key, and GPRS ciphering sequence-number parameters.

7.1.1.8 Construction of the TLLI

The TLLI identifies a GPRS user. The relationship between TLLI and IMSI is known only in the MS and in the SGSN. The TLLI identifier is sent to the LLC layer in order to identify a logical link connection.

There are three types of TLLIs:

Local TLLI is used when P-TMSI is valid-namely, when no location procedure is required;
Foreign TLLI is used when an update of the P-TMSI is required by a location procedure;
Random TLLI is used when no P-TMSI value exists.

The TLLI consists of 32 bits (its format is described in Table 7.1). The local TLLI value is deduced from the P-TMSI value allocated by the serving SGSN. Each time the P-TMSI value changes during a P-TMSI reallocation procedure, the GMM entity in the MS and the SGSN will rebuild the local TLLI value. The foreign TLLI value is deduced from the P-TMSI value allocated by an old SGSN. The random value is built directly.

Table 7.1: Structure of TLLI ^[*]
31	30	29	28	27	26 to 0	Type of TLLI
1	1	T	T	T	T	Local TLLI
1		T	T	T	T	Foreign TLLI
	1	1	1	1	R	Random TLLI
^[*] T bits are those derived from the P-TMSI value (length of 30 bits); R bits are chosen randomly by the MS when no P-TMSI is available.

7.1.2 Case Study: Control of the LLC Layer Operation

As the GMM service states reflect MS behavior, the GMM layer controls the following LLC operations:

Sending or not sending user data;
Sending or not sending signaling information.

Figure 7.15 shows the exchange of primitives between GMM and LLC entities during a GPRS-attach procedure within the MS. When GPRS services are activated, the GMM entity will provide a random TLLI to the LLC entity if no valid P-TMSI is stored in the MS in order to initiate a GPRS-attach procedure. The signaling information flow is resumed at the LLC layer upon request from the GMM layer. As soon as a new P-TMSI is assigned by the SGSN, the GMM layer provides a new local TLLI to the LLC layer. At the end of the GPRS-attach procedure, the user data flow is resumed at the LLC layer upon request from the GMM layer.

Figure 7.15: Control of LLC layer from GMM layer during a GPRS-attach procedure within the MS.

Figure 7.16 shows the exchange of primitives between GMM and LLC entities during an RA update procedure within the MS. During this procedure, the user data flow is suspended in the LLC layer upon request from the GMM layer. A foreign TLLI is assigned to the LLC layer when the GMM layer detects a new RA in the selected cell. As soon as a new P-TMSI is assigned by the SGSN, GMM provides a new local TLLI to LLC. At the end of the GPRS-attach procedure, the user data flow is resumed at LLC layer upon request from GMM.

Figure 7.16: Control of LLC layer from GMM layer during an RA update procedure in the MS.