GPRS各接口信令分析

二．Mobility management

Mobility Management (MM) handles the subscriber when he is requesting access to the GPRS network or when he wants to stop using the GPRS network. MM handles the location management procedure transferring the necessary information from one SGSN/PAPU unit to another SGSN/PAPU unit and updating HLR if subscriber has changed SGSN. As described in module SGSN Architecture, all MM procedures related to one MS are handled by the PAPU serving the RA in which the MS is currently located in Nokia 2G SGSN implementation. If the subscriber has attached to CS services, MM updates the location also to VLR. MM handles the subscribers' authentication functions and provides information to charging and statistics services.

The procedures of Mobility Management are:

? ? ? ?

GPRS Attach GPRS Detach Purge Security

? ? ? ?

Authentication

Subscriber identity confidentiality Ciphering Identity check

?

Location management

? ?

Cell update

Normal/periodic routing area update

? ?

Subscriber Management Interaction with MSC/VLR

? ? ? ? ? ?

IMSI attach/detach, combined IMSI/GPRS attach/detach Combined routing area and location area update CS paging Non-GPRS alert Identification procedure MM information.

(一) GPRS Attach

①MS向新SGSN发送激活请求消息，消息中包括P－TMSI＋旧的RAI(没有可用的P－TMSI时用IMSI)、CKSN、激活类型(只激活GPRS、IMSI已被激活的情况下激活GPRS、GPRS

／IMSI联合激活三者之一)、DRX参数(discontinuous reception，非连续性接收)、旧P－TMSI签名。 Attach Request

②新SGSN向旧SGSN发送身份认证请求消息(P－TMSI、旧RAI、旧P－TMSI签名)，以获取MS的IMSI。旧SGSN回送认证响应消息(IMSI，鉴权三参数组)，如果旧SGSN不能认证MS，将回送相应的出错原因。 Identification Request/Identification Response 请求与答复移动台IMSI或P-TMSI

③如果新、旧SGSN都无法认证MS，那么新SGSN将向MS发送认证请求消息(认证类型=IMSI)， MS回送响应消息(IMSI)。 Identity Request/Identity Response

④MS、新SGSN、HLR之间进行保密鉴权。SGSN用取得的IMSI到HLR中请求认证三码组（Authentication Triplets），并对 MS进行鉴权。Authentication

⑤MS、新SGSN、EIR之间进行IMEI检查。 IMEI Check

⑥如果是初次激活或者再次激活时SGSN编号已改变(比较上次而言)，SGSN要通知HLR。由新 SGSN向HLR发送位置更新消息(SGSN编号、SGSN地址、IMSI（注意已经转换为E.214码）) Update Location；HLR向旧SGSN发送位置消除消息 (IMSI，消除类型) Cancel Location；旧SGSN应答(IMSI) Cancel Location Ack；HLR向新SGSN发送插入用户数据消息(IMSI，GPRS用户数据(包括16进制格式的APN，包括MSISDN?)) Insert Subscriber Data；新SGSN检查MS在新RA的合法性，如果MS是局部受限用户而不允许在新RA激活，则新SGSN向HLR返回应答(IMSI，SGSN区域受限)，拒绝激活请求。如果是其他原因不允许激活，则返回HLR的是应答(IMSI，原因)。如果MS经检查合法，则返回应答(IMSI) SGSN根据移动台的GPRS签约数据决定是否允许移动台在当前路由区内附着，如允许，SGSN将向HLR返回一条消息Insert Subscriber Data Ack。；HLR向新SGSN回送位置更新应答Update Location Ack。

⑦如果第①点中的激活类型为后两者(IMSI已被激活的情况下激活GPRS、GPRS／IMSI联合激活)，当SGSN与MSC／VLR之间的Gs接口存在时，要更新VLR。VLR的编号从RA获取。新SGSN向新MSC／VLR发送位置更新请求消息(新LAI、IMSI、SGSN编号，位置更新类型)；新VLR向HLR请求位置更新(IMSI，新VLR)；HLR通知旧VLR消除位置信息(IMSI)；旧VLR对HLR应答(IMSI)； HLR向新MSC／VLR发送插入用户 数据消息(IMSI，GSM用户数据)；新VLR应答HLR(IMSI)。这时新MSC／VLR向新 SGSN发送位置更新接受的响应(VLRTMSI)。

⑧新SGSN向MS发送激活接受消息(P－TMSI，VLRTMSI，P－TMSI签名)。 Attach Accept

⑨MS向新SGSN回送激活完成消息(P－TMSI，VLRTMSI)。 Attach Complete

⑩新SGSN向新MSC／VLR发送TMSI再分配完成消息(VLRTMSI)。TMSI Reallocation Complete

When subscriber wants to start using services of GPRS network, he has to connect to the network.

The MS informs SGSN that it desires to connect to GPRS network. He informs SGSN with a mobility management procedure called GPRS Attach procedure. Only MS can start this procedure. The procedure is described in Figure 1.

MS1. GM.Attach RequestMnew PAPUold PAPUHLR2a.GTP Identification Request2a. GTP Identification Response2 b. GM Identity RequestM2 b. GM Identity ResponseM3. Authentication4. IMEI check5. Update location to HLR6. GM Attach AcceptM6. GM Attach CompleteM

Figure 1. GPRS Attach procedure

1．The MS initiates the attach procedure by the transmission GMM. Attach Request (IMSI or P-TMSI and old RAI, Classmark, CKSN, Attach Type, DRX Parameters, old P-TMSI Signature) message to the PAPU handling the RA in which the MS is camped. If the MS has a valid P-TMSI, then P-TMSI and the old RAI associated with P-TMSI shall be included. In this case if it has also stored its old P-TMSI Signature, then the MS shall include the old P-TMSI

Signature in the Attach Request message for identification checking purposes. Classmark contains the MS's GPRS multislot capabilities and supported GPRS ciphering algorithms. Attach Type indicates which type of attach that is to be performed, i.e., GPRS attach only, GPRS Attach while already IMSI attached, or combined GPRS / IMSI attach (in this section \Parameters indicates whether the MS uses discontinuous reception or not. If the MS uses discontinuous reception, then DRX

Parameters also indicate when the MS is in a non-sleep mode able to receive paging requests and channel assignments.

Note

P-TMSI Signature is a random number optionally allocated and sent by the SGSN to the MS in Attach Accept and Routing Area Update Accept messages. If the P-TMSI Signature has been sent by the SGSN to the MS since the current P-TMSI was allocated, then the MS shall include the P-TMSI Signature in the next Routing Area Update Request and Attach Request for identification checking purposes. In the Attach and Routing Area Update procedures, the

SGSN compares the P-TMSI Signature sent by the MS with the signature stored in the SGSN. If the values match, the SGSN may use the security functions to authenticate the MS. If the values do not match or if the P-TMSI Signature is missing, SGSN uses security functions to authenticate the MS. P-TMSI

Signature parameter has only local significance in the SGSN that allocated the signature.

2． If the MS has detached in a routing area handled by the same PAPU, the PAPU already

has the subscriber P-TMSI-IMSI association. This means that PAPU can directly perform

step 3 (Authentication, see section (五)) and shall accept the attach request.

a.If MS was previously attach in a RA handled by different PAPU the IMSI is first inquired from the old PAPU unit that has stored the P-TMSI-IMSI association. The new PAPU sends a GTP.Identification Request (P-TMSI, old RAI and old P-TMSI Signature) to the old PAPU to get the IMSI of the MS. The old PAPU responds with GTP.Identification

Response (IMSI, Authentication Vectors). In order to find the IP address of old PAPU two cases can be distinguished: ?

the old PAPU belongs to different SGSN: the new PAPU has to find out the IP address of the old PAPU asking from the DNS server. Old PAPU name is

formed by the old RAI(=MCC+MNC+LAC+RAC) in the following way:

\example if the old RAI is 222 + 10 + 1234 + 100 the RAI name is \ the old PAPU belongs to the same SGSN: the IP address of the previous PAPU unit is known by the MCHU of same SGSN and no DNS queries needs to be performed. In this case PAPU interrogates the GPRS Parameter Database (GPDATA) in MCHU where are stored the relation between IP PAPU address and RAI handled by SGSN.

?

b.If for the some reason the new PAPU cannot find IMSI of MS (e.g. PAPU reset or \asks the IMSI directly to the MS sending to him GMM.Identity