CA2078198C - Signaling arrangements in a cellular mobile telecommunications switching system - Google Patents

Abstract

This invention relates to apparatus and methods for providing cellular mobile telecommunications service in accordance with the requirements of the Global Systems for Mobile Communications (GSM) standard. A modular switching system is provided which performs the functions of the mobile switching center plus those of a home location register, authentication center, visitor location register, and equipment identity register. The latter functions are advantageously spread among the modules of the switching system, thus avoiding the getting started cost of expensive dedicated data bases. A wireless global switching module advantageously switches mobile communications control messages among the modules of the system and between the modules and the base station systems, and terminates signaling links between the mobile switching center and the base station systems.

Description

2Q7gl98 SIGNALING ARRANGEMENTS IN A
CELLULAR MOBILE TELECOMMUNICATIONS ~iWll~lilNG SYSTEM
Technical Field This invention relates to signaling .... A~ J' for wireless 5; ' sysoems.
Problem Mobile radio sysoems for permitting customers calling from mobile stations such as vehicular stations mounted in ~ ' ' portable stations of medium weight which may be transported readily, or small l ,,- . ~' t, hand held10 personal c, stations are becoming ..~ prevalent, (E~or the sake of simplicity, all such units are referred to hereinafter as mobile stations.) Such systems use the principles of cellular technology to allow the same ~ , of a common allocated radio bandwidth to be reused in separated local areas or colls of a broader region. Each cell is served by a base transceiver station comprising a group 15 of local ~ connected to a common anoenna The base station systems, each comprising a controller and one or more transceiver stations are :
via a switching system, called a mobile switching center, which is also connected to the public switched telephone network Such cellular systems are now entering a second generation ~ h~ by digital radio ~ and a different set 20 of standards such as thc European Global Systems for Mobile (`~
(GSM) standard, ~ , ' by the Special Mobile Group (SMG).
Such mobile h' ' systems have many units which need to. signaling ~ forcontrolling...~ ",.. 11 of ~
Such signaling r " is ' ' over channels separate from the 25 channels carrying actual voice or data ~ o~ - - between the customers being connected. Among the units that need to ~- are the mobile station (MS), the Base Station System (BSS) connected by radio to the mobile station, the mobile switching center (MSC) and the various data bases which are consulted for the : '" ' of mobile calls including the home location register (E~R), the visitor 30 location register (VLR) and the equipment identiq register (EIR).
Signaling " for land based telephone systems include the use of a global switch module, described l r , which serves as an interface bet~,veen a local switching system and common channel signaling data links, and the described in Warq et al.: U.S. Patent 4,827,499 used for a l" r,l.
35 mobile switching system. *

A problem of the prior art is that there is no economic, efficient way of hl,~l,;"~ all of these signaling ~ . paths. The problem is further - - r - when a distributed control system such as the SESS~9 Switch described in The AT&T Technical Journal, vol. 64, no. 6, part 2, July/August 1985, 5 pages 1305-1564, which is modular and which has separate call control processors for controUing each of the switching modules of the system is used as the MSC.
Solution The above problem is solved and an advance is made over the prior art in accordance with the principles of applicants' invention wherein a special signal 10 switching means, a wireless global switching module tWGSM) is added to the system and is used as a data switch for essentially all signaling .,, for mobile caUs; these virtual circuit . include ~ - to BSSs, to wireless switch modules tWSMs) tand their control processors), and to WSMs containing HLR or VLR data. All WSMs are connected to the WGSM by message 15 delivery paths, terminated on each end by a protocol handler. Each BSS is connected to the WGSM via a signaling data link to a WSM, through the WSM via a digital facility interface and a time slot ' ~ unit, through the .
module (time 'i, l ~ switch), to a protocol handler of the WGSM. Temporary virtual circuits (Signaling Connection Control Part (SCCP) . ) are then set 20 up between the WGSM and a BSS. All of the associated data c~ c for a call or othor wireless service are identified by a common reference number for handling by a common protocol handler. A subfield of the reference nurnber identifies that protocol handler. Theso . are then used to serve the WSMs and the MS.
The WGSM logically terrninates the signaling hnks between a BSS and the MSC to 25 process the CClTT Signaling System 7 (SS7) protocols to and from the BSS.
Adv ~ l~" the WGSM acts as a data switch to transmit the CCITT messages to a protocol handler at the correct (11~ctin~ n In one specific , l of the invention, the mobilo switching centN is a 5ESS~9 switch which comprises a plurality of switching modules and a 30 c. . ." . ~ A - module for ~ the switching modules. In this distributed 1 , each BSS is physically connected via signaling data links to at least two WSMs through at least two protocol handlers in the WGSM.
Adv ~ 'y, such an ~ ~ allows a high degree of reliability. If, for example, one switching module or protocol handler of the WGSM is out of ærvice 35 and the BSS is physically connected to several switching modules, then the signaling path from the BSS to the WGSM can go over a physical channel to the other switching module connected to that BSS, and the comnection to that other module can be established through the . .",..."",i. ~li",. module of the SESS switch.
The WGSM protocol handlers terminate signaling data links and distribute Base Station System Application Part (BSSAP) messages to the 5 ayyl~lyl;~ wireless switching module (WSM) of the mobile switching center. In return, the WSM may then transmit a message via the WGSM to a BSS or a MS
where appropriate. In accordance with one aspect of this invention, the Temporary Mobile Subscriber T~l~ntifio~icn (TMSI) is encoded to include an indication of which WSM contains the VLR data for the mobile station identified by that TMSI.
0 The protocol handlers of the WGSM are also equipped to translate from the Tl,t. . .I,.li.-.l~l Mobile Subscriber l~lpntifir~tinn to an indication of the module that contains data for the mobile station.
In accordance with one aspect of the invention there is provided in a cellular mobile switching center (MSC), a method of signaling from any mobile 15 station via a base station system to a selected one of a plurality of controlprocessors, each control processor for controlling a wireless switching module for switching wireless calls of said MSC, the selected processor for assisting in the control of a wireless service for a mobile subscriber, comprising the steps of:
ll,.l.~,.lillil~g signaling messages, said messages having a common reference number, 20 said messages for control of said service for said subscriber, from said mobile station via a base station system (BSS), via a protocol handler of one of said wireless switching modules connected to said BSS, over a physical circuit connection to acentralized signal switching means of said MSC, for performing protocol handlingand data switching for said messages received from any of said wireless switching 25 modules of said MSC; within said centralized signal switching means, .,,~;.,l-il,;.,~
state information for controlling the protocol of a plurality of virtual circuitconnections, each virtual circuit connection having a common reference numbel; and for identifying one of said plurality of virtual circuit connections between the BSS
and the centralized signal switching means; and ll,."~",illil,g messages, of said one of 3 o said plurality of virtual circuit connections received in said centralized signal switching means, over one of a plurality of second physical circuit connections therefrom to one of said control processors of said switchin~ system for assisting in the control of a wireless service.
. ~ .. .~c - 3 a 2 0 78 1 9 Brief Dcsçription of the I)rawi!l~s FIG. I is a block diagram of the basic GSM model of a mobile switching center and its direct and indirect interfaces;
FIG. 2 illustrates how this model is implemented in one exemplary 5 embodiment;
FIG. 3 illustrates the various signaling protocols used for signaling messages in mobile tclP~""".l~ ionc systems;
FIG. 4 illustrates the i...~l,,.,.mc~ Lions among mobile stations, land-based stations, base station systems, the public switched telephone network, and a 10 mobile switching center;
F~G. 5 illustrates the physical paths used for signaling and for voice or data i~ Lions;
FIGS. 6-8 illustrates the signaling illt~ .~ vllllc~,lions including the role of the wireless global switch module (WGSM);
FMS. 9-13 illustrflte the process of establisbing a mobile to land call;
FIG. 14 illustrates the release of a mobile call;
FIGS. 1~-18 illustrate the handover process;
FIGS. 19-21 illustrate the handover process in terms of message exchanges;

2 o FIGS. 22-28 illustrate an incoming call to a mobile station.
Detailed l~escr~ption FIG. 1 is a block dia~ram of the reference model of the European standard, the Global Systems for Mobile Cull.~ liOns (GSM). Each of the lines o,.l~e- lil.g blocks of the diagram that is identified with a letter, has a GSM

," f~

2~781 ,~

standard specified interface. Briefly, dhe purpose of each of the blocks is the following:
The Home Location Register (HLR~ 102 contains data for a mobile customer. The data stored in the HLR is dhe permanent data that is l~r ' of 5 the customer's present location, plus temporary data such as the addresses of Service Centers which have stored short messages for a mobile station. (An example of such a message is a request to turn on a "voice message waiting" lamp indicatiQg that a voice message has been stored for dte mobile station user in a voice messaging system.) Tltese addresses ate erased after the short messages have been delivered.
10 The HLR also indicates the Signaling System 7 point code used to find a module that contains the Visitor Location Register (VLR) 104 currendy associated with dhe mobile station.
The VLR contains current data for each mobile customer, including that customer's mobile station's present or most recently known location aroa, the 15 station's on/off status, and security parameters. A remote VLR 106 coMected via a G interface is also shown.
The L - '- - center (AUC) 108 provides ' and encryption parameters to ensure dhat a mobile customer cannot falsely assume theidentity of another mobile customer and provides data for encryption of the voice or 20 data, and control signals tr~tnsmitted via dhe air between the mobile station and a serving BSS. Tlte GSM reference model prescribes digital ~ over the radio channels. Since it is possible to listen to these radio channels, encryption becomes desirable for the link between dte mobile station and the radio transceiver at a base station serving that mobile station.
The Mobile Switching Center (MSC) 110 is for switching calls involving at least one mobile station.
The BSS 112 comprises a base st~ttion controller (BSC) 114 and one or more base transceiver stations (BTS) 116 for . ,, with mobile stations (MS) 120. The BSS and tlte MS via radio ,. The BSS is 30 also connected via trunks to carry the voice or data, and control messages between the mobile stations and the MSC Tlte BSC and BTS may be in different physical locations (for example, the BSC may be co-located wit~t the MSC) in which case atrunk is required to ;llt~ the two. S m represents the human interface to the MS.

, The equipment identity register (EIR) 124 retains a reeord of ranges of certified equipment i~ and ranges of or individual equipment i-l. iri. ~ whieh are under observation or balred from serviee. The equipment r '' is reeeiYed from a mobile station at the mobile switching 5 center. The EIR is used to verify that the equipment number of the MS is certified for use in the public network and is not on the observation or service balred list.
Mobile switching centers are connected to other mobile switching centers, directly or via the public switched telephone network 128, to the public switched telephone network for accessing land-based customer stations and to 10 integratedservieesdigitalnetwork(ISDN)networks 126fore.",.",--aeeording to the protocols of ISDN.
While the standards specify the funetions of eaeh of these blocks, they do not specify how each of these blocks is to be , ' ' It is the purpose of this desc}iption to illustrate one ~ ~ ..L, " ,l for , ' ,, these standards in an 15 2~1v ~ manner.
FIG. 2 illustrates the system: for ,~ a GSM
mobile ~ system. The mobile station (MS) 202 . with the BSS 204 over radio links 206 using optionally encrypted digital radio for the voice or data. and control c between tbe MS and 20 the BSS. The MS . via the BSS with the mobile switehing center (MSC~ 210. The BSS and MS exchange eontrol messages with the mobile switeh eenter using the CCITT sigDaling system 7 protoeol (SS7).
In this I ~ ~ the ~R 212, VLR 214, AUC 216 and EIR 218 reeords are all integrated into the MSC 210. When an MSC needs the HLR, ~ILR, 25 AUC or EIR reeords from aDother network entity, it obtains them via SS7 messages to the entity that eurrently holds this r ~
The MSC, with a billing eenter 220 for ~ g billing reeords using the CCITT X.25 protoeol and also . with an Operations and ~ ' Center (OMC) 222 using the CClTI X.25 protoeols.
30 The OMC . with BSSs via the MSC using SS7. In one , - the OMC ,. with a eustomer ~ system 224 using a staDdard RS-232 link. In addition. messages between the BSS
and OMC are transmitted using SS7 with the Base Station System Operation r' - aDd A.- - Part (BSSOMAP) protoeol.

Signaling System 7 is described in detail in A. R. Modarressi et al.:
"Signaling System No. 7: A Tutorial," EEE r. Ma~azine, July 1990, pages 19-35. The GSM standard protocols are specified in the GSM standard c which at this time is in Yersion 3.8.
S FIG. 3 is a diagr. m of the protocols used in different types of C~ æcording to the GSM standard. Most of these protocols are those of SS7. Of the seven layers of the protocol according to the T~ l Standards Or~ ul~ (ISO) layered message protocol, only the top (application layer) and the bottom dlree layers (Network, Data and Physical) are shown on the left. Four10 types of messages are shown: The first double column includes those from switching system to switching system fc)r land-based trunks including either a telephone user part (TUP) or an ISDN user part (ISTJP) (both SS7 standards) for the application layer. The second column is for messages among MSCs, VLR, ELR and EIR which messages use the SS7 standard Transaction rsp--llilih~c (TC), 15 Tr.qncq~ hi~m rspq~ s Application Part (TCAP) and Mobile Application Part (MAP) sublayers of the application layer (MAP is enhanced with GSM standards).
When these messages are shicdy internal to the MSC, theso protocols are simplified and messages hansmitted directly or via protocol handlers between dhe responsible processors. The third column is for between the mobile switching 20 center and a BSS. The final column is for ~ between the mobile switching center and mobile station.
The dlree bohom sublayers of thc protocol (layer 1, dle physical layer, layer 2, dhe data layer, and sublayer 3, the message hransport part (MTP) sublayer, a sublayer of the network layer) are identical for all of these types of ~
25 and are in accordance with the SS7 Message Transport Part (MTP) standards of the CCITT Q.701 - Q.707 standard. The Signaling Connection Conhrol Part (SCCP), a sublayer of dhe network layer, also a CClrT standard Q.711-Q.714, is connecion oriented for the MSC/MS: is ~ ' for the second column, and may be either for dhe MSC/BSS c, SCCP is available for some 30 ISUP ~ For dhe first column (switch to switch) the TUP and ISUP
application layer ,- directly with MTP 3 sublayer of the network layer.
~ l between the MSC and either the BSS or the mobile station use a Radio Subsystem (Base Station System) Application Part (BSSAP) protocol. For: between the mobile switching center and the BSS, 35 layer 7 uses the protocols of the BSSAP including a Base Station System r r ~ ApplicationPart(BSSMAP). The, betweenthe 2~7~198 mobile switching center (MSC) and the mobile station ale performed in the protocols of BSSAP including a Direct Transfer Application Part (DTAP). BSSAP, including BSSMAP and DTAP are GSM standards.
FIG. 4 is a basic block diagram of a mobile switching center 400 5 (switchj, as l~ l ' using AT&T's SESS~V Switch. The switch, described in detail in The AT&T Technical Journal, vol. 64, no. 6, part 2, July/August 1985, pages 1305-1564, (Joumal) includes an ' v~ module 402, a c, module 404, and a group of switching modules 406-412. ThG switching modules applicable in the GSM network are of four types; a wireless switching module 10 (WSM) 406 for u ,, with BSSs, and also optionally . ' ,, with the public switched telephone network (PSTN); s~vitching modules (SM) 408 for g, with the PSTN; a wireless global switch module (WGSM) 410 for serving the signaling needs for controlling calls involving mobile stations; and a PSTN Global Switch Module (PSTN GSM) 412 used if PSTN trunks 15 are of ISUP or TUP types, i.e., use SS7 for signaling to the PSTN. The PSTN GSM
processes ISUP or TUP protocols and can optionally also be connected to PSTN
trunks.
The functions of the ~ G module (AM)"
module (CM) and switching module (SM), in relation to the PSTN are essentially as 20 described in the referenced Journal. The purpose of the WGSM, as described h- r~ t-~r, is to simplify the signaling, between BSSs and the WSM serving calls for the BSS, and between the MS and the WSM. The PSTN
GSM is for controlling common channel signaling between the MSC and the PSTN.
The PSTN GSM is connected by message delivery paths to protocol handlers in the 25 SMs.
The signaling ' : ~, of the mobile switching center is ., ~ l simplified by having signaling messages go through a common set of data switchesand protocol handlers in a wireless global switching module (WGSM). Physically, the wireless global switching module is connected via nailed up channels (message 30 delivery paths) switched through the time i ' ' switch of the u module to each of the wireless switching modules. These are 64 kilobit channels,the same as the PCM voice channels of the SESS switch module.
Over another nailed up physical channel connecting the WGSM with a WSM
messages are sent for a BSS via virtual channels in that physical channel; other35 virtual channels of that physical channd carry messages that originate from or are destined for the mobile stations.

-8- 2a7819 The wireless switching modules (WSM) are combined packet and circuit switching modules each comprising a switching module processor (SMP), a packet switching unit (PSU) comprising a plurality of protocol handlers by a local area network, and circuit switching ~ including 5 a digital facility interface (DFI) and a time slot ;llt~ unit (TSIU). The TSIU is connected to a time .... l~ l switch of the cl ' ~ module for ~ " s the switching modules. Switching modules comprising a packet switching unit ate disclosed in M. W. Beckner et al.: U.S. Patent 4,592,048.
The signaling paths between the BSS, WSM, and the wireless global 10 switching module (WGSM) are as follows. Each base station is connected by digital carrier facilities to two or more of the wireless switch modules 504 (FIG. 5). Many of these digital facilities include one or more signaling channels, the signaling channels from each BSS being connected to at least two WSMs. The signaling channel is connected via the digital interface of this wireless switch module 504 into 15 the TSIU of the wireless switch module and is thereby connected through the , module 506 and to a protocol handler (PH) in the wireless global switch module. The wireless global switch module protocol handlers are illt~ ' via a local area network in the paeket switeh unit of the WGSM.
The portion of the signaling path between the WGSM and a destination 20 wireless switeh module is as follows. The WGSM has at least one protocol bandler with a port for ~ L messages to and receiving messages from a speci~ie wireless switeh module. This port is conneeted to a message delivery path that passes via a nailed up connection through a time, l . 11 ;l,l. - l switch of the c- ,. .. 1 . ~ - module. Eaeh sueh message delivery path is a 64 kilobit data link 25 and is eonneeted to a port of a protoeol handler at each end. In case of a failure of a protocol handler at either end, spare protoeol handlers can be used to replace the failed protocol handlers. The protocol handler in the wireless switch module ~ on its local area network side via a packet interface with a switching module proeesso~ of the WSM. This switching module proeessor performs caU
30 processing and generates or processes, for example, the BSSAP portion of a message between a WSM and a BSS. The message delivery paths and the physieal signaling data links ' , g a BSS and a wireless switch module carry a plurality of virtual data paths, usuaUy, temporary virtual data paths (SCCP .
associated either with a mobile caU or a mobile service such as a loeation update.

2~781~8 These signaling r ~, have a number of advantages. By having at least two signaling data links between each base station and at least two ~- reless switch modules, ' ' y is gained and operation can continue even if either of the signaling channels (including the protocol handlers at each end of a signaling 5 channel) or a WSM fails. The use of a single wireless global switch module with inhereM sparing of protocol handlers . the translation r .~
required to select a destination wireless switch module when, for example, VLR data for a particulat customer, as identified by that customer's T ' Mobile Subscriber T~l..,1 'r.,-,;.... (IMSI) is required. Failure of one or more of the protocol 10 handlers in the WGSM can be overcome by replacing a failed protocol handler with a working spare and by properly initializing that protocol handler to take over the functions of a failed protocol handler. Local reference numbers, discussed hereinafter are used to identify SCCP - As described hereinafter, because key; c~ " . . ~ is stored in the local reference numbers, and because 15 duplicate records are maintained on aU stable SCCP ~ - through protocol handlers of the WGSM, none of these . are lost even though they may have been served by a failed protocol handler.
The WGSM has at least one spare protocol handler per shelf of a PSU.
In the event of a failure of any protocol handler, a spare takes its place. If no 20 redundant data were available, then in the event of a simplex failure in a protocol handler the dynamic data regarding SCCP, - would be lost and '~, all BSSAP calls switched through that protocol handler would be lost.
R~ , of this data is added to the software ' to ensure the integrity of this connection data.
When a connection is set up between a mobile switching center and a BSS, a local connection identifier is associated with each distinct :- In order to keep each instance of the connection . ' ' between the MSC and the BSS, this connection ;..r...,.~ .. is shared through the use of SCCP local reference numbers. According to the CCrlAT SS7 protocol, each end will send its local 30 reference number and the far end's local reference number when first confirming the setup of a valid ~ ' , dialog requires the sending of the far end's local reference number. The value of this local reference number is not constricted by standards. When a connection is first initiated in the mobile switching center, the local reference number is encoded to include a connection identifier and the number 35 of the protocol handler on which the connection resides.

.

The MTP layer provides for load sharing on a data link, ch.~ ,v. ~,. and ' _ ' k, with the possible result that incoming messages for a connection may arrive on a different physical link than messages being sent. When this occurs, the SCCP message arriving in a different protocol handler is wuted to the proper S protocol handler by decoding the local reference number since that quantity contains the i~ ;r~ ... of the protocol handler (PH) upon which the connection resides.
Whenever a SCCP connection goes into an active (stable) state, this connoction ' is shared with the next ascending PH in the PSU community (wherein the first PH is the "next ascending" PH for the last PH). This "next 10 ascending" PH is known as a "backnp PH." When a PH fails, a spare PH is switched into its position and thereby connected to the sources and ~' of messages for that PH. The "next ascending" PH transmits to the spare PH a list of reference numbers of stable from the failed PH; tho "next ascending" PH will continue to control these ~ as long as they are active. The spare PH
lS assigns local reference numbers for new ~ - that have the same logical PH
nurnber as the formerly served by the failed PH. When the sparo PH
receives a message for an active connectdon, it first checks to see whether the reference number is one of a connection controlled by the "next ascending" PH. If so, the spare PH transrnits that message to the "next ascending" PH which has the 20 ;.. r.. -~;.. for processing that message, and which therefore can maintain the vrrtual In this way in the event that a PH fails, messages received on existing SCCP, for the failed PH are ~-ltr~m~ ly routed to the "next ascending" or backup PH. When a PH fails, the backnp PH will _ 'ly resta~t timers associated with the SCCP from this backup ' In this 25 way, stable . - will remain stable as will calls dopendent on those Every PH, that sets up SCCP t; has a dedicated backnp PH.
Since a spare PH then assumes the logical role and name of the failed PH and accepts new SCCP message connection requests for that PH, this will gradually reduce the temporary overload on the backnp PH. When the failed PH is eventually30 restored to service, it then takes the role of a spare PH.
While in this ~ the "next ascending" PH is used as a backnp, any other ~ ' backup _ t, such as the "next ascending skipping 1" (in a system with an even number of active PHs) could be used instead.
The ter~n "~lc ' ' adjacent" is used to describe any 1~ ; ' backup PH
35 selection.

2~78~ 98 As discussed above, when the spare PH assumes the role of the failed PH, the backup PH wiU report the present status of all its active ~ A to the spare PH. The spare PH wiU not reuse re ources, such as connection identifier numbers, for active c., ~ stiU running on the backup PH when setting up new 5 SCCP The backup PH wiU then continue to service all presently active until they are released, as weU as servicing new SCCP c - for itself.
When a mobile station is first powered up within a specified mobile network, the ' mobile subscriber ~ (IMSI) is used by the 10 mobile station to identify itself. This IMSI is used to route a request for VLR data to the WSM that contains that data. Each protocol handler of the WGSM contains a table that stores the IMSI-WSM map, the table being created from data supplied by the WSMs. In order to aUow HLR and, where possible, associated VLR records to be stored in any WSM, this look-up table has one entry per IMSI. During the 15 location update or regictr tti-~n process, the SM that stores the VLR data wiU
associate a Temporary Mobile Subscriber T l~ (TMSI) with a mobile station. The TMSI, whose value, while at least irl part random, is not otherwiseconstricted according to the GSM standard, is speciaUy encoded with the identity of the WSM (i.e., a switching module having wireless software) that contains the VLR
20 so that accessing the proper WSM for incoming messages when VLR data is required is simplified if the TMSr is available. R-- ' of the TMSI is maintained by ' ~ three of its four octets. Except on initial mobile stationpower up, as described above, the TMSI wiU normaUy be used for aU BSSAP
~ "~ When a mobile station initiates a transnction (such as a caU or location 25 update), the SCCP connection data base that stores ' about the i also stores ~ to identify the WSM that contains VLR data as weU as the WSM that contains the trunk connected to the BSS. This is used for the routing of aU subsequent messages for this which contain no TMSI.
As an example of the operadon of the signaling system, consider a data 30 connection between a BSS and a mobile switching center. Assume that the connection is initiated in the BSS. An initial message would first be transported by MTP in the BSS from the BSS over a signaling data link logicaUy thc BSS and a WGSM. Thc protocol handUer, in the wireless global switch module, which terminates the signaling data link passes the mcssage from MTP to a SCCP
35 control progranL This SCCP program strips off the MTP header and par~es the message. Depending on the contents of the message, a connection is established or rcleased, or the transfer of data is required. In this example, connection ' ' ' is requested and a SCCP connection (i.e., a virtnal circuit) is temporatily set up between the protocol handler in the WGSM end of the signalingdata link and the protocol handler in the BSS. The SCCP control program inforrns a 5 base station system application part (BSSAP) (also referred to as a radio subsystem application part in FIG. 3) of the request for a connection: ' ' ' via a primitive interface. BSSAP then parses the BSSAP message and obtains the identity of the destination wiroless switch modnle. In the case, for example, of a query requiring VLR data, this destination WSM is identified by the; ,t~ . . " ;" -I mobile 10 subscriber identity (IMSI) field contained in the BSSAP message. The BSSAP
control process uses the IMSI to index a look-up table to find the WSM where theVLR data base for this IMSI is to be found. The message is then sent within the WGSM from the protocol handler terminating the signaling data link to a protocolhandler that ter~ninates a message delivery path to the identified WSM. This 15 protocol handler then sends the message to a protocol handler on the destination WSM which in turn forwards the message to the switching module processor of thatWSM. A BSSAP control process in the destination WSM then futther parses the message and passes it on to a call processing program for processing a mobile call or service.
Another example of the signaling procedures carried out in this e 1: ' of the invention is the procedure for sending a message from a wireless switch module to a BSS via an established connection. In the i ~ wireless switch module, a BSSAP process assembles a BSSAP layer of the message that is tagged with the local reference number identifying the SCCP ~ This 25 process then forwards the messagc to a protocol handler in the source wireless switch module, which then transmits the message over a nailed up message delivery path going through the ~ module to a first protocol handler in the wireless global switch module. This first protocol handler examines the local reference number of the message and uses this to determine the second protocol 30 handler that terminates the SCCP ~ - (This local reference number was previously derived during the process of ~ . l- ~ the SCCP ) This protocol handler then uses a SCCP process to ~ r ~ the message with a SCCP
header and passes the message to a message ttansport part (MTP) process for adding the MTP headers. The message is then sent over the (logical) data link to the BSS.
35 (The physical data link C~ c to this logical data link has been described earlier.) - 13 - 2~ 78198 Adv. .~,~,vl~ly, this type of Al ~ permits essentially all of the SS7 protocol handling functions to be carried out in the packet switching unit of the WGSM (without involving the switching module processor of the WGSM) and allows the ~ ; e and receiving WSMs to process their messages ' r ~ ' S of the d~ctin~ n Effectively, the set of protocol handlers of the packet switch unit of the WGSM acts as the handler of all signaling protocols. (A maximally equipped WGSM contains 75 active and 5 spare protocol handlers.) The WGSM assembles and .1~ the Signaling System 7 headers to the application data of the messages and switches the messages for ~ - A _` - - to the proper WSM which may lO either accept the messages (if the destination is the mobile switching center) or originates messages to the appropriate BSS (if the destination is either a BSS or a mobile station).
In addition, the MSC . from the _ ' v~ module with an external service center 224, using the X.25 protocol for delivery of short5 messages, such as an indication of a voice message waiting The MSC
with the public switched telephone network using a land-based signaling system such as SS7.
The switching modules also ~- messages via the message switch of the module as is done in a land-based SESS switch. Call 20 processing messages, such as the messages that are exchanged in order to set up a connection through the: module between, for example, a switching module conrlected to the public switched telephone network portion of a land-to-mobile or mobile-to-land call and the wireless switching module that is connected via the BSS to the mobile station end of the call, are sent in this way.
Whenever arl MS is itl the region served by its home MSC, i.e., the MSC that contains the E~R for that MS, the base VLR is attached to the HLR in such a way tnat common data is stored only once for the two registers; the VLR and E~R are then stored im the same module.
When the mobile station is either in the power-off state or in the power-30 on state but not in any active call state, only a base version of the VLR is maintained for that mobile station in the VLR WSM. When a call is originated by a mobile station or a call is received for that mobile station, a separate dynamic version of part of the VLR is stored and maintained in the WSM that controls the mobile calls. This copy of the VLR is linked to the terminal process in that WSM that controls the 35 mobile station end of the call. If the mobile station moves and the call is handed over to a different switching module, then the dynamic copy of the VLR is 2~78198 transferred to the new WSM serving the mobile station for that call and is linked to a terminal process for serving that call in that WSM. Note that the data in the base VLR that is not relevant to the MS locations is changed only by A~ A l i v~
actions or such customer programming actions as the `l'' ; r . -~ i. "~ of a call 5 forwarding number and are not copied into the dynamic VLR. When necessary, the system A~ l modilqes the HLR which in turn updates the base VLR; the - -, has ~reæd only" access to the base VLR for trouble shooting purposes.
The location of the mobile station is not updated in either the dynamic or the base VLR during a call, and is updated in the base VLR only as part of a 10 location update procedure. Location update procedures are carried out when the mobile station is idle with power on, and moves from one location area to another.
A location area is the area that is paged when a call terminating to an MS is received.
All incoming calls first check the HLR. This is because the HLR is ~ced and the location of the HLR record is tied to the called number (directory 15 number) of a mobile station. The HLR has stored within it the i . . r. ." " - ~ ;. .,1 necessary to find the base VLR; this i . . r .., . ,A, i. ..l includes an ;~ ; r ~ of the mobile switching center that contains the base VLR. For this detailed ~ cArir~i~n this MSC
is the same as the MSC of the HLR, and the HLR and VLR are stored as one block sothatifeitherislocatedtheotherisalsolocated. AllA.l,~ l,Aliv~changesof 20 data associated with a mobile station are entered first into the HLR which then sends messages for entering the cu..c.~ ..ling change in the base VLR, Customer initiated changes such as the l~ of a different call forwarding number are forwarded initially to the base VLR which does not initially make any change in its record but forwards the request to the HLR which makes the necessary change and 25 generates a message for updating the base VLR. The HLR is accessible via the mobile station directory number or the T,~ ;. ."Al Mobile Subscriber T11~n-ifirA-il-n (IMSI). The VLR is accessible via the rMSI or the TMSI; the HLR can also æcess the VLR by a special ISDN address. ISDN addresses are maintained for VLRs, HLRs, MSCs, and EIRs according to the GSM ~recifin~rif~n The VLR is attached to the HLR so that common data need only be stored once. This A, . . ~,. " ,. " l is satisfactory as long as the mobile station is in the regionservedbytheMSC;C",~Ci.l,,..l;."~ofthestorageoftheVLRwhenthemobile station leaves that region is beyond the scope of this description.
The combined HLR and VLR is stored in the wireless switching 35 modules of the MSC. Each switching module stores records for a range of mobile directory numbers and each module has a range translation to select a module based 2Q7~198 on the directory number. Since the HIR/VLR must also be accessible via the IMSI,a table is stored in each protocol handler of the WGSM to identify the module that has stored the VLR/HLR for each IMSI served by the MSC. No translation is required for access via the TMSI since that contains a subfield for identifying the S VIJVE~R modules.
FIG. 5 is a block diagram illustradng the physical signaling paths between base stations and wireless switching modules. The base stations 502 ate connected through permanent vi~tnal circuits which physically pass through a WSM 504 serving the base station and through the ~ module 506 to a 10 protocol handler in the WGSM 508. The protocol handler receives messages in the SS7 protocol used to with the base station and transmits the message to the correct WSM; the digital facility interface connected to the BSS transmits the messages to a protocol handler of the WGSM which is connected by a switchable physical nailed up data channel to the destination WS~, where it terminates on a15 protocol handler which is connected to the switching module processor of the WSM.
Ad~ , the WGSM terminates a standard protocol and aUows any WSM to control any caUs from the base stations that have trunks to the WSM, since the processor of the switching module (SMP) for controlling the caU need not be the SMP for controlling a specific connection between a BSS trunk and a channd to a 20 CM or to another output of the WSM.
F~G. 6 shows the logical signaling system. The base station system 602 with the WGSM 604 wbich then delivers its message via the ~A~ll~ll''''"' -1;~''~ module 506 to the appropriate WSM 610.
As shown in FIG. 7, the VLR data for a particular mobile switching 25 center is spread out over the WSMs 702,...,704 in that center. In the particular example, when WSM 702 needs VLR; r~ .... from WSM 704, it requests the ;,.r... ,., ~;.... via the caU processing inter-module data links switched through the message switch of the modules of the 5ESS switch.
FIG. 8 illustrates the modules involved in a mobile-to-land caU. The 30 base station system 802 nearest the mobile is connected by a voice path to a wireless switching module (WSM) 804 which is ' ' through the ~
module (CM) to another switching module for connection via the public switched telephone network (PSTN) 808 to the caUed customer. The PSTN global switching module (GSM) 810 is used for controlling SS7 signaling to the public switched 35 tdephone network. The WSM 812 that contains the base VLR data is connected via virtnal data links to the WSM 804 controlling the mo~ile station leg of the caU . The . ~ 2~78198 SM 806 and WSM 804 are connected by a virtual data link in order to coordinate the activities of the terminal process handling the call in each of these modules. The WGSM 8141 all data to and from the BSS and transmits it as necessaly to either the WSM 804 or the VLR-WSM 812.
Consistent with the principles of operation of the SESS switch for land-based calls, the r ~ . module 508 (I;IG. 5) is used for selecting outgoing PSTN trunks on mobile originated calls and for selecting time slots for voice paths between switching modules. In addition, the ' ~, module is used for selecting a trunk between the mobile switching center and a base station cont~oller.
10 The base station controller selects a path htween the incoming trunk to the base station controller and the base transceiver station. As previously indicated, this path may be a land-based trunk. The trunks between the BSSs and the mobile switching center are one way outgoing from the mobile switching center. This makes the finding of an idle trunk from the centralized p-l- " '~ , module efficient and 15 allows the trunks to be fully utilized: whether the call is originated by a mobile station or is terminated to a mobile station, the ttunk will be hunted for and allocated by the r ' ' ' 'v~ module which is a part of the mobile switching center.
FIGS. 9-13 illustrate the messages required in processing a mobile-to-land call and shows the source and destination of each rnessage. The call is initiated 20 by a control channel request message 902 (FIG. 9) from the MS to the BSS to request the assignment of a dedicated control channel for further signaling from the MS. The BSS responds with a control chanrlel assignment message 904 to allow theMS to access the proper control channel. The MS then transmits a service requestmessage 906 to the BSS which passes this service request message 908 to the 25 WGSM. The WGSM transmits a process access request message 910 to the WSM
that contains the VLR r - ' The WGSM has the data for ~ which WSM contains the VLR ~ for this mobile station. This data is used when the TMSI is not available. If the TMSI is available, it has the VLR-WSM ~) encoded in it for easy ' ~ of the VLR-WSM. The message from the 30 WGSM to the VLR-WSM is for processing the service request and for creating the connection data in the VLR-WSM for the request. The VLR-WSM enters a tuple in the coMecdon data block for the process that handles the request. The data includes the ' ~ of the connecdon transacdon using the, An , :h. ;. -~ ;.... process, if needed, is inidated by the VLR-WSM, which transmits a 35 message 1002 (E~IG. 10) to the mobile stadon (the message is actuaOy transmitted via the WGSM, the WSM coMected to the BSS, and the BSS) to request L ' ' ' algorithm c qln..lqh..n The mobile stadon rcsponds to thc VLR-WSM with a message 1004 containing the result of the ~ algorithm calculation.
r ~ the VLR-WSM transmits a message 1006 to the .-l;V~; module (AM) requesting the assignment of a BSS trunk for the call 5 and the AM transmits a message 1008 to the WSM connected to that trunk for creating a wireless originating terminal process in that WSM for handling the call.
The WSM then returns a message 1010 to the VLR-WSM for notifying the VLR-WSM which trunk WSM (i.e., WSM connected to the trunk to the BSS serving the call) and BSS trunk has been assigned to the call. As will bc seen below, the VLR-10 WSM is required for controlling the ciphering ;" r. ,. ., ~;., for the call.
If ciphering is used, the VLR-WSM transfers (message 1102, FIG. 11) to the WSM for handling the call, a copy of the call processing related; . .r. ." . ~ i, . .
relating to the mobile station from the VLR record to the call controlling WSM. If ciphering is used, the VLR-WSM transfers the cipher comrnand to the BSS via the 15 WGSM (messages 1104 and 1106). The BSS transmits a cipher mode com~nand (message 1108) to the mobile stadon. The mobile stadon then sets up the cipher mode and transmits back to the BSS, a cipher modc completed message 1110. The BSS sends a message to the VLR-WSM that the cipher process has been completed 1112. At this dme, both the BSS and the mobile station are in a 20 .,~ , " 3 cipher mode. The details of the . ~ are specified in the GSM standard.
The mobile station then sends a setup request message (1114 and 1116) via the WGSM to the call controlling WSM (i.e., the WSM that contains the terminal process for the mobile station). The WGSM had previously been informed of the 25 idendty of the WSM in message 1104. The WGSM checks to ensure that no failures have been ~ ~ ~ ' up to this time bcfore c 11 setup request. If any failures have occurred, the failures are reported to the WSM. The WSM then transmits a message 111 8 to the mobile station indicadng that the call is ~
Next, if the equipment validation function is ne~ded, the VLR-WSM in 30 ~ with the call controlling WSM and the mobile station performs that function. (r . , validation is opdonal in GSM according to the wishes of the t~,l~; - operator.) The VLR-WSM requests (message 1202) the mobile stadon to furnish its T 't- - I - ~ I Mobile Equipment T.l- ~ (IMEI). The mobile station responds with its IMEI (message 1204) to the VLR-WSM which 35 checks to insure that the mobile stadon is authorized to use the network. The VLR-WSM sends the result of its check (message 1206) to the call controlling WSM.

~ -18- 2078198 Meanwhile the trunk WSM notifies the BSS of the identity of the previously assigned BSS trunk (message 1208). The WSM also requests that the BSS pick a radio channel for the voice (or data) with the mobile station. This radio channel wiU then be associated with the assigned BSS ttunk for the length of 5 the caU or until the call is handed over to another BSS or terminated. The BSSassigns the radio channel and notifies the mobile station of the assignment (message 1210). The mobile station responds (message 1212) when it has received this assignment and has tuned its radio to that channel. The BSS then reports back to the WSM that the radio channel assignment process and the radio to trunk 10 connection have been completed (message 1214). The WSM requests (message 1216) the v~ module to hunt for a trunk to the public switched telephone network for completing the land part of the caU and the a~ ivc module assigns this trunk and requests the switching module connected to that trunk to create a ternunal process for tho caU (message 1218). The switching module then 15 transmits a message læO to the WSM that the network connection is proceeding and transmits a message 12æ to the PSTN GSM which tr~nsmits message 1224 to the public switched telephone network to set up the call. (This is a TUP or ISUP
message depending on the t,Ype of trunk signaling used to access the next switching systcm of the PSTN.) The public switched telephone network then responds to the SM with a message 1302 (FIG. 13) indicating that the caUed customer is being alertcd and the SM transmits a message 1304 to the WSM which sends a message 1306 to the mobile station to connect alerting tone. (This is supphed locaUy within the mobile station.) Sometime later, the public switched telephone network sends message 1308 to thc SM that the caUed customer has answered. The SM sends a message 1310 to the caU control WSM to indicate that an end-to-end talking path has been ~ Thc caU control WSM so informs the mobile station (message 1312). The mobile station responds with an ..~,L.~,..I~,d~,~..,.~.
30 (message 1314) and the caU is now actiYe.
Next, thc disconnect process wiU be discussed (FIG. 14). It will be assumed that thc mobilc ~'' first. The mobile sends a disconnect message 1402 to the WSM whose terminal process is controUing the mobile end of the caU and the WSM transmits a release messagc 1404 to the mobile and a network35 release request 1405 to the SM connected to the public switched telephone network.
The mobile then transmits a release complete message 1406 to the WSM. The SM

releases the call and transmits a network release message 1410 to the public switched telephone network. The SM also transmits a messagc 1412 to the r ' ' ' module to release the trunk to the PSTN and the WSM sends messages 1414 to , module for releasing the BSS trunk and 1416 for making a billing S record of the call if necessary. (Several billing records are sent in one message so that not every call generates a billing message from an SM to the AM.) The WSM
also sends a release message 1418 to the VLR-WSM to update the status of the mobile station of the call. The VLR-WSM sends a clear command 1420 to the WGSM for clearing the connection ~ for messages if the call is the last 10 transaction for the mobile station. (If other ~ such as the delivery of a message waiting signal message, are required, the connection is kept up; the VLRremains involved in caU control, but not the WSM attached to the BSS for controlling the call.) The WGSM sends a clear command to the BSS to release the radio channel and receives an ~,h~v..l~lg.n~ l 1424 from the BSS that the radio 15 channel has been released. The BSS sends a clear command 1426 to the mobile station to release the ~ e channel. The WGSM then sends a clear complete message 1428 to the VLR-WSM to confirm that the mobile station is now released.
The handover procedure will now be describcd. Since a mobile station may travel during the course of a call, it could easily get outside the effective range 20 of the base transceiver stations of one BSS and into the effective range of another.
Under these ~ it is important that the mobile station be retuned to a frequency of a transceiver of the second BSS and that the call be continued via that transceiver. The process will first be described in terms of the: then in terms of the message exchanges.
F~GS. 15-18 illustrate the process of a handover tv a base transceiver station in another BSS served by the same MSC The request is originally made frvm the BSS 1502 serving the call in response to a message from the mobile station 1504 reporting the signal strengths of the serving base transceiver station and nearby candidate base transceiver stations. At this time the call is served fromBSS 1502 and wireless switching module 1506. The wireless switch module 1506 selects a new base transceiver station which is, in this example, on a new BSS 1510.
The ~ ., module selects a trunk 1512 (FIG. 16) between wireless switching module 1512 and BSS 1510. The - ' v~, module also selects a network time slot 1532 between the switching module 1530 (the pivot module) 35 connected to the land-based station via the public switched telephone network 1540 and the wireless switching module 1520. BSS 1502 then sends a message to the . ~ 2a7slss mobile station to retunc to the transceiver system of BSS 1510. At the completion of retune (FIG. 17), the connection through the time slot vh~ v in the pivot module is switched to the connection 1532 to wireless switch module 1520. At this point, the land-based station is connected tbrough Ihe puWic switched telephone 5 network 1540, through pivot switch module 1530, and through WSM 1520 and BSS 1510 to the mobile station 1504, Finally, the old resources, namely the connection 1542 oetween the pivot module 1530 and WSM 1506 as well as the connection between WSM 1506 and BSS 1502 are released as are the radio resourcesfor the call in BSS 1502 (E~IG. 18).
The handoverprocess will now be described (FIGS. 19-21) in terms of the appropriatc message exchanges. According to the standards discussed previously, a mobile station performs the task of measuring the strength of signals received from different BSSs in its vicinity. The mobile station periodically sends the, . ,. .. ,t~ message 1902 (FIG. 19) to the base station currently serving that 15 station. If the BSS detects that the signal from the BSS currentdy serving that mobile station is below the threshold of signal strength required for reliable c~ the BSS sends a message 1904 to the WGSM of the mobile switching center including am ordered set of candidate base transcdver stations for handling the call further. The WGSM delivers the message 1904 to the WSM
20 currently handling the call (the old WSM), indicating that a handover is required and passing the list of candidate base tr msceiver stations. The old WSM after consulting the terminal process for the mobilo station to determine that handover may proceed, passes this ;" r " ~ via message 1906 to the ~ ., module for the aUocation of a trunk to the first camdidate BSS. The ' ~. module transmits 25 a message 1908 to the WSM connected to the selected trunk of the BSS (the new WSM) and the new WSM transmits a message 1910 to the switching module conrlected to tbe lamd path (the pivot SM) to set up a second time slot path for use with the new connection from the public switched telephone network to the new WSM, and to inform the pivot SM of the new WSM and new terminal process 30 identity. The new WSM sends a message 1912 to the old WSM indicating that thenew path setup is complete and the old WSM transfers the copy (message 1914) of the VLR i .r .. ,. -~;.., which it has stored associated with the terminal process for this call to the new WSM. The new WSM then sends a handover request message 1916 to the new BSS for assigning a channel in the new BSS, and the new BSS returns an 35 a,~w..l~de,.~ l918. Thehandoverrequesta~.h.v.~l~',. includesthe frequency and channel which the new BSS will use to ~ with the mobile -21- ~7~1~8 station.
The new WSM sends Io the old WSM a handover rvquest avhlu .. Ivd~ 2002 (FIG. 20) which includes the i~ of the new frequency and channel to which the mobile station is to be tuned. The old WSM
5 transfers that call's specific data to the new WSM via message 2004 and defersprocessing of all messages to and from the MS that are being sent to the old WSM.
Such messages will 1 , '~, be forwarded to the new WSM. The new WSM
returns a message 2000 indicating that the call's specific data transfer has been completed, and the old WSM transmits message 2008 to the VLR-WSM, indicating 10 that the actual channel switching is about to start and rvquesting the VLR-WSM to defer the processing of new input signals. (Examples of new input signals whose processing is deferred during handover are short message delivery requests, e.g. a rvquest to deliver a "turn on voice message waiting lamp" short message, or new calls to the mobile station.) The old WSM then transmits a handover command 2ûlO15 to the old BSS, which forwards that handover command 2012 to the mobile station.
In response to this handover command, the mobile station tunes to the new assigned frequency and channel for ~ v with the new BSS. The mobile station then transmits a handover access mvssage 2014 to the new BSS which transmits a messagv ("use physical channel" message 2016) requesting the mobile station to 20 establish frame ~,~ ;.... with the base station physical channel. The mobile station transmits a handover detect message 2018, indicating that a physical layer connection has been established to the new BSS, and that the mobile station has retuned. The new BSS transmits a message 2020 to the new WSM that the handover has been detected, which, in response to that message, requests the pivot SM to 25 switch to the new path (message 2022). The pivot SM switches to the new path and transmits an avhlu .. I~v message 2024 to the new WSM.
After the layer 3 protocol is ec~shlich~l. the mobile station sends a handover completion in message 2100 (E;IG. 21) to the new BSS which forwards themessage 2102 to the new WSM. The new WSM then transmits to tho old WSM a 30 message 2102 ~7IG. 21) that the handover has been completed and the old WSM
transmits a message 2104 to the VLR-WSM that the handover has been completed;
this message includes the identity of the new WSM. The old WSM transmits to the new WSM any queued mcssages 2106 for this mobile station and the new WSM
~Ivhlu .. Ivv6v~ the end of this message transfer (message 2108). The old WSM
35 transmits a message 2110 to itlform the pivot SM to release the old path. The old WSM also trdnsmits a message 2112 to the d.l . ~ ;vv module to release the old ,~

dme slot. In the meantime, the VLR-WSM, in response to the receipt of the handover end message 2104, transmits message 2114 to the old BSS to release the old radio channel, and the old BSS releases this channel and transmits an a~h~ 5u.~ 2116 to the VLR-WSM.
In the transitional stages, the new WSM is connected to the pivot SM
but the path is not continued through the time slot . ' " of that SM for connection to the far party. This connecdon is made after the mobile stadon has tuned to the radio frequency of the new BSS, and is made at the same dme as the old dme-slot ' ~ connecdon for connecting the current WSM to the public 10 switched telephone network, is dropped. Thus, only one connecdon is made through the SM connected to the far party and that connecdon is made through the dme-slot i...~,.~ ' , of that switching module. This permits a very rapid transidon from one connection to another, since all other are made before the time-slot ' ~ connecdon is switched.
As long as a mobile switching center condnues to serve a pardcular mobile station, the VLR for that mobile station is maintained in that mobile switching center and is retained in the same switching module of that mobile switching center even as the mobile moves to different areas served by that switching center. (The procedures for handing over a mobile stadon from one 20 bile switching center to another are beyond the scope of this Detailed Descripdon.) Since the switching module which contains the call data for serving a call for a pardcular mobile stadon, retains the bulk of the r - from the VLR, and further retains the idendty of the switching module that contains the base copy of the VLR, there is no need to move that base copy even when a mobile moves and25 is ' , ly served by a different wireless switching module.
A land-to-mobile call will now be described. An incoming call message 2202 (FIG. 22) is received from the public switched telephone network atthe mobile switching center. lNote that the land-to-mobile call could also originate in the mobile switching center.) For the case of SS7 signaling on the incoming side, 30 the mobile switching center sends an address complete message 2204 to the public switched telephone networ~. The MSC which received the incoming call is the MSC
that, on the basis of the telephone number, is the "home" for this mobile stadon.
(The procedure for handling calls with base HLR ;i~r~ in another Msc is beyond the scope of this Detailed Descripdon.) This MSC contains the base ~R
35 r for the mobile unit.

2378~98 .

The MSC consults the HLR for that mobile unit in the appropriate ~vireless switching module (action 2206), and obtains r '- as to which MSC
is currently serving the moWle unit (action 2208). lf the mobile unit is currently roaming and outside the range of the home MSC, the MSC reroutes the call to the 5 MSC that serves the mobile unit. In this example, the mobile station is controlled by the home MSC. If the mobile station has requested that calls be forwarded to another number, this will also be reported to the MSC for further processing, either by the MSC if the call forwarding number is served by the home MSC, or for further processing by another MSC or the public switched telephone network, if the call 10 forwarded number is not served by the home MSC.
In this case, assume that the mobile station has not requested call forwarding and is being served by the home MSC. The MSC determines the WSM
which contains the VLR of the mobile station, which VLR is integrated in the MSCfor this ~ ~ The MSC queries that VLR taction 2210). The VLR
15 determines the most recent location area of the mobile station, in order to have the mobile station paged by the BSSs in the most recent location area. The VI,R
responds with the identity of the location area for performing the page (action 2212).
The MSC then sends a message 2302 (FIG. 23) to the BSSs serving the location area requesting the page. The BSSs send out paging signals (action 2304) 20 and the mobile station responds to this request (action 2306) via one of the BSS, witn a request to assign a control channel to this mobile station. That BSS transmits to the mobile station a channel assignment 2308 for the dedicaoed control channel to be used. Tbe mobile station tunes to that control channel and delivers its page response 2310 over that control channel.
Under the principles of the GSM standard for mobile ~ ' s~ a mobile unit is tlmed to a single paging channel. If the mobile unit is turned on, it tunes to the paging channd of the base transceiver station witn the strongest signal.
This is done by taking signal strength of the broadcast channels of several nearby base transceiver stations and selecting the sysoem witn the strongest 30 signal. The bile station then tunes to the common control charmel, paging subchannel of that system. If a mobile unit has moved across location area boundaries while the mobile station is powered on but not in the connected state, then the mobile station will send a location update message to the MSC which is used to update the VLR for that mobile station. The mobile station recognizes this 35 transition because its internal record of a location area differs fr~m the location area signal received from the base transceiver station via the broadcast control channel.

2~7~

When a mobile is originally paged, it is paged by all the transceiver stations in the location area where the MS has last registered. This paging message is transmitted from the protocol handlers of the wireless global switching module to all the appropriate base station controllers. Within the WGSM, a paging request 5 message received from a switching module contains the locatioD area identi{ier(LAI). This is translated to derive a senes of point codes for the BSSs that contain Base T . ~ Stations which must broadcast the page. The E~H that received the paging request message from the switching module broadcasts a message to the WGSM protocol handlers that also includes the identity of the mobile (the IMSI or 10 TMSI as discussed hereinafter with respect to the ' procedure), the point codes and a single logical route, effectively appended to each point code. The logical route is a four bit quantity used to spread the signaling traffic over the different signaling links to the BSSs. Each protocol handler e~amines the point codes and the logical route to see if it is involved (i.e., serves a signaling link that is 15 used) in 1, A 11~.11 ' 1 l, I.g paging request messages. Each involved protocol handler transmits a paging rcquest message to each of these BSS controllers for which that protocol handler is the designated source of paging messages for the point code and logical route; this paging request message includes a list of the BTSs in the LAI so that a BSS that includes porlions of two or more LAIs can transmit a paging request 20 only to the base transceiver stadons serving that LAI. In an alternative version, not covered by the present GSM ~ . the LAI is sent and the BSS translates to find the _. ~ r ' base transcdver station for paging.
An alternate approach is to make a translation within the protocol hatldler that receives the paging request message from the switching module to 25 determine which protocol handlers of the WGSM should receive a multicast paging message that includes the point codes of the BSSs and the logical routc for those BSSs involved in thc paging, plus a list of base transcdver stations. Each of the recipients of this multicast message then translates the point codes and logical route to see if it is to transmit a paging message; if so it transmits the 30 ~ paging message. In this approach, the initial translation to determine which protocol handlers may bc involved in the process of ,, paging request messages to base station controllers is pcrformcd in the single protocolhandler that initially receives the paging request message. A di~ ~lLa2j~, of this approach is that each of the protocol handlers that malces the initial translation needs 35 a table for storing the translation r ' The simpler translation of the preferred; 1 " is only from the LAI to point codes, a relatively static 2~8~ 98 translation. The updating of protocol handlers to respond to trouble conditions only affects the tables of protocol handlers actuaUy ,, data to the BSSs.
The page response 2310 received by one of the BSSs is returned (message 2312) to the mobile switching center, specifically, the WGSM. The 5 WGSM then transmits a message 2314 to the wireless switching module which contains the VLR ,r. ,. " . ~ for this bile station to initiate the A~
process if necessa~y. Previously, the VLR has received from the ' via the E~R five sets of data used for ' ~ the identity of the mobile station and for use as an encryption key. If the VLR has only one set left, then it obtains an 10 additional set via the HLR from the ' center, using messages 2402, 2404, 2406 and 2408 (E;~G. 24). The VLR-WSM .,~ to the mobile station an ' request 2410 for it to perform algorithm ' ' The mobile station then, the result (message 2412) of the calculation to the VLR-WSM which compares the result with the ' data it stores.
The VLR then transmits an encipher command (message 2502, FIG. 25), if necessary, to the BSS which transmits, over the radio channel, a cipher mode command 2504 requesting the moWe station to enter the cipher mode. The mobile station responds with a cipher mode complete messagc 2506 to the BSS and the BSS reports to the switching modnle containing the VLR that the encipher 20 process has been completed (message 2508). The original encipher command sentfrom the VLR to the BSS includes the key for nse in ~ g the signals transmitted between the mobile staion and the BSS. The mobile station had previously received r '' for deriving the key during the ' process.
If the i '~ operator has specified that an equipment identity check is required, the mobile switching center then requests (message 2602, FIG. 26) from the mobile station its ' mobile equipment ' ~
(Il~/IEI). The mobile station responds with that r ' (message 2604) and this ;..r.., .. ~ '.... is checl~ed (action 2606) in the equipment . . r ' ' register (EIR) 30 data base also stored in the MSC for that mobile. The check result is returned (action 2608) from the E~ The equipment validation is performed to insure that the mobile unit is authorized to make caUs. CaUs are only completed if both the VLR and the EIR data indicate that the mobile is authorized to make and/or receive calls.

,~ .

Thereafter, the mobile switching center sets up a call conrlection to the mobile station. It transmits a message 2702 (FIG. 27) including a transaction .. for all messages generated by the mobile station, respecting this call.
The mobile station responds with a call confirm message 2704. The mobile 5 switching center then requests (message 2706) the base station to assign a traffic (i.e., voice or customer data) channel to this call. The BSS selects the radio frequency and channel and informs the mobile station (message 2708) of the same so that the mobile station can tune to this frequency and channel. The mobile station does so, reports (message 2710) that the channel assignment has been completed, 10 which permits the BSS to report (message 2712) to the mobile switching center that the traffic channel has been assigned.
The mobile station responds to the previously received traffic channel assignment request by locally generating an alerting signal to the subscriber. An "alert" message 2802 (~:IG. 28) is sent from the mobile station to the MSC to inform 15 the MSC that mobile station user is being alerted. The mobile switching center transmits an audible tone to the caller (action 2804). When the called customer at the mobile station goes offhook, i.e., answers the call, the mobile station sends a conrlection indication 2806 to thc mobile switching center, which forwards that connection indication to the far party (action 2808) and transmits a connection 20 a~h~ Alb_ message to the mobile station 2810.
In order to detect the fraudulent condition wherein two or more mobile stations have thc same idGntity, a situation which should not occur and will occur only as a result of an attempt to ~ , cause i ' ' charges to be incurred by the primary owner of that ;.l ,~ ., the following steps are taken.
Each of a class of state transitions is examined to see if the particular state transition is likely, in view of prior state of the mobile station. Whenever a mobile station changes state to one of the specified states, the previous one of the specified states for that mobile station is examined and if the transition is unlikely, a record is made for the mobile t~,h,c. ' network ' ' ' ' These 30 records are an indication of possible fraud. The state transitions to which are examined are the following. attached mobile station, detached mobile station, page response, location update, service request, and cancel location (a message from an HLR to a VLR to indicate that tho mobile has moved outside the area served by the MSC, and therefore, the VLR). Unlikely events include the reception of an attach, 35 when the mobile station is already attached, a detach when the mobile station is already detached, the rcceipt of multiple page responses for a single page request of ~ 2~78198 - 27 ~
one mobile, the receipt of a location update while another update procedure or connection procedure is in progress; the receipt of a service request when a mobile station is detached, in a location update procedure, or during an attach or detach procedure; or a change location message received when a caU is in progress.
Whenever a state change is one that is unlikely to occur, a peg count is made of the state change. The frequency of the unusual ~ ~ is displayed at a mobile switching control center or the Operation and r ' ~ Center (OMC) so that a fraudulent use of an ;.1. .,~ can be detected. If the count exceeds a threshold, a special message is displayed or printed.
The ~ ' process will now be described. The process is initiated as a result of a service request by the mobile station or following a successful page of a mobile station, but is performed primarily under the control of the VLR. According to the wishes of the h' operator, this ' process may be perfo~med every time a mobile station originates or a 15 caU is terminated to a mobile station. In addition, if the ' of the mobile switching system so desires, the: ' may take place whenever a location is updated for a mobile station that is in the power-on and idle state. In addition, may be perfommed when a mobile station registers by turning on its power.
In the case of a request for service originated by a mobile station, the mobile station sends a message to the mobile switching center recording one of the requests discussed above. This message includes the IMSI (r.t~ t~ 1 Mobile Subscriber r,~ ~ - ) or a TMSI ~emporary Mobile Subscriber T - ~ ) The choice of an IMSI or a TMSI as the primary ' - ~ - ' is made 25 by the system operator. The IMSI is a permanent number which is assigned to every mobile station. Al he TMSI is assigned to a mobile station only after an A. lh. 1;. a~ and has only local ~ , If this is the first :h .~
request or an ~ ' request which for some reason has failed and the system A.l. .~ - ;~l . - l ;. .. is using A~MSI i~ then the backup IMSI is used for the30 pur~ose of ' - - 1~ the customer and assigning a new TMSI. The source of data used in: -' is an -' - - center which in the present system is present in each mobile switching module of the MSC This -' - center (AUC) does not store any data for each customer. Al'he purpose of the ' center is to generate random numbers which are used in . ; with data in the 35 HLR to generate ,Ih....1;~ data. Initially, at the time when a customer subscribes for service, that customer is assigned an initial key K i . lAhis key atld a 2~781g~

random numbe} (RAND) supplied from the, ~ center are acted upon by a first algorithm (A3) to generate a secondary number, an r Ih ,~ .... number, referred to as Signed Response (SRES), a result of , ' _ the random number using the A3 algorithm. In addition, the random number and Ki are acted upon by a 5 second algorithm (A8) to generate an encryption key Kc . Values of RAND, SRES
and Kc are requested from HLR as needed by the VLR In the preferred "" ,1 .o 1~ of the invention, five sets of RAND/SRES/ K C are generated and stored in the VLR each time a set of c~ .nc is made.
When the ' is needed, the MSC sends the random number 10 to the MS. The MS retrieves Ki from its ' memory (which may be initialized at the time of the purchase of the mobile station~ and calculates SRES and Kc from the random number and the Ki using algorithms A3 and A8. It then stores the Kc in the main station and sends the SRES result to the mobile switching center.
The mobile switching center verifies that the SRES value calculated by the mobile 15 station matches the SRES value that has been stored in the VLR and was previously calculated. If tbe values match, this is a successful ' and it is assumed that the two values of the key Kc as stored in the MSCIVLR and in the mobile station are identical.
Note that with this ~ ~ t, only the random number and SRES are 20 1 over the air. The two i --l. I.. 1~ ,lly generated values of the encryption key, Kc, each generated from the random number and each generated using a value of Ki which is also never transmitted through the air, are not transmitted over the air.
Since a separate algorithm is used for deriving Kc and SRES, the fact that SRES and RAND are transmitted over the air does not permit an interloper to discover Kc - In case ' fails, if the system: ' uses TMSI, then the IMSI is sent as a backnp in case the TMSI for one reason or another became garbled. If another using the IMSI is attempted and if that ,...lh. .,l;. -l;.,..issuccessful,anewTMSIissentandactionswhicharebasedona successful ~-h. .li~-l;.. canbeperformed. If thesystem~ usesan 30 IMSI and ,~ l fails or if h~ fails following an IMSI backup of a TMSI, then all service except emergency service is normally denied to that mobile station.
Note that both the TMSI and the IMSI may h~e sent over the airwaves without cl ~ security since these values are useless if the Ki 35 , .. ~ to that IMSI is not available to a potential interloper.

2û781 9~

Some L ' ' ' may choose not to perform an Al~ on every call. If this is the casc and an IMSI or TMSI has been intercepted, then afraudulent call may be made, or a call may be ' ' ' '~, received. However, if this is a call on which l '- is made in an ' which chooses to S ' some percentage of its calls, then ' ' will fail and the failure Of," h..,l;. l;.",isawarningtothe~ ' thattheparticularIMSIorTMSI
has been ~UIll~JlUlll.i~L
Only a single pair of algorithms is normally used at any one time. It is possible for a system . ' to vary betwcen pairs of such algorithms but 10 thcre are no plans at this time to assign two different mobiles different algorithm pairs.
It is to bc understood that the aoove description is only of one preferred cil.lb~ ' of the invention. Numerous other ~ may bc devised by one skilled in the art without departing from the scope of the invention. The invention is l5 thus hmited only as defined in the a.,.,u.~ J.hlg claims.

2~7~

APPENDIX A
ACRONYMS AND ABBREVIAT~ONS
AUC A ' Center AM A~ , Module BSC Base Station Controller BSS Base Station System BSSAP Base Station System Application Part BSSOMAP BSS Operation r ~ and ~ Part BSSMAP Base Station System M ~,, Application Part BTS Base Transeeiver Station CM f} Module DFI Digital Faeility Interfaee DTAP Direct Transfer Application Part EIR Equipment Identity Register GSM Global Systems for Mobile t~ ;.. c ISDN Integrated Services Digital Network ISO T ' Standards (~r~
HLR Home L~eation Register IMEI I ' Mobile Equipment T ' " ' IMSI T ' Mobile Subscriber T ' ISUP ISDN User Part LAI Loeadon Area Identifier OMC Operations and r ~ Center MAP Mobile Application Part MS Mobile Station (personal c.~.. ,.. - - _I;~A station) MSC Mobile Switching Center MTP Message Transpc~rt Part PH Protoeol Handler PSTN Publie Switehed Telephone Network PSTN GSM PSTN Global Switeh Module PSU Paeket Switehing Unit RAND Random Number ' ~`

SCCP Signaling CoMection Control Part SrM Subscriber Identity Module SM Switching Module SMG Special Mobile Gtoup S SMP Switching Module Processor SRES Signed Response SS7 Signaling System 7 TC T ~qp ~ilih.~e TCAP Trqn~ hil-n ~ rqhilih~-c Application Pqrt 10 T~ISI TemporLLry Mobile Subscribe}1-1.. iri. l;.. , TSIU Time Slot II~LC1- ", Unit TUP Telephone User Part WGSM Wireless Global Switching Module WSM Wireless Switch Module VLR Visitor Location Register

Claims (10)

Claims:

1. In a cellular mobile switching center (MSC), a method of signaling from any mobile station via a base station system to a selected one of a plurality of control processors, each control processor for controlling a wireless switching module for switching wireless calls of said MSC, the selected processor for assisting in the control of a wireless service for a mobile subscriber, comprising the steps of:
transmitting signaling messages, said messages having a common reference number, said messages for control of said service for said subscriber, from said mobile station via a base station system (BSS), via a protocol handler of one of said wireless switching modules connected to said BSS, over a physical circuit connection to a centralized signal switching means of said MSC, for performing protocol handling and data switching for said messages received from any of saidwireless switching modules of said MSC;
within said centralized signal switching means, maintaining state information for controlling the protocol of a plurality of virtual circuit connections, each virtual circuit connection having a common reference number, and for identifying one of said plurality of virtual circuit connections between the BSS and the centralized signal switching means; and transmitting messages, of said one of said plurality of virtual circuit connections received in said centralized signal switching means, over one of a plurality of second physical circuit connections therefrom to one of said control processors of said switching system for assisting in the control of a wireless service.

2. The method of claim 1 wherein the step of transmitting messages received in said centralized signal switching means comprises:
transmitting said messages through a switchable circuit connection of a voice/data communications switching network of said MSC.

3. The method of claim 1 wherein the step of transmitting messages received in said centralized signal switching means comprises the step of performing a translation to determine which of said control processors should receive a message.

4. The method of claim 3 wherein said translation is performed to determine which of said control processors comprises a data base to which said message is to be transmitted.

5. The method of claim 3 wherein said translation comprises translating message data to determine which call control processor should receive said message.

6. The method of claim 3 wherein said translation comprises translating an identification number to determine which control processor shouldreceive said message.

7. The method of claim 6 wherein said translation comprises translating a Temporary Mobile Subscriber Identification (TMSI) to determine which control processor should receive said message, while maintaining randomness of the TMSI required by standards.

8. The method of claim 7 wherein said translation comprises translation of a subfield of said TMSI for identifying said control processor.

9. The method of claim 3 wherein said translation comprises translating an International Mobile Subscriber Identification (IMSI) to determine which control processor should receive said message.

10. The method of claim 4 wherein said data base is a visitor location register (VLR) data base.