Yi-Bing Lin

liny @csie.nctu. edu. tw

Dept. Comp. Sci. & Info. Engr., National Chaio Tung University, Hsinchu, Taiwan, R.O.C.

GSM is a wireless digital signaling network standard designed by standardization committees from
the major European telecommunications operators and mant~'acturers. This article introduces the
software plat/brm /br GSM network signaling protocol called Mobile Application Part (MAP). We
describe the MAP services, the MAP protocol machine, the MAP dialog model, and then illustrate
the MAP specific service primitives by an example.

Databases
I. Introduction
A mobile communication system (e.g., a cellular phone sys-
tem) provides communication (voice and data) services to the
nomadic users or mobile users independent of time and lo-
cation. Standards are required to support mobile communi-
cation (radio link maintenance, mobility management, and so
on). The standard commonly used in North America is the
Electronics Industry Association/Telecommunications Indus-
Radio Systems J
try Association (EIA/TIA) Interim Standard 41 [2], and in Eu-
rope the GSM (Global System for Mobile Communications).
This article provides an overview to the standard and software
platform for GSM network signaling.
GSM is a wireless digital signaling network standard de-
BSC: Base Station Controller BTS: Base Transceiver Station
signed by standardization committees from the major Euro- HLR: Home Location Register MS: Mobile Station
pean telecommunications operators and manufacturers. The SSP: Switching Service Point MSC: Mobile Switching Center
GMSC: Gateway MSC VLR: Visitor Location Register
GSM standard provides a common set of compatible services
EIR: Equipment Identity Register
and capabilities to all mobile users worldwide. PSTN: Public Switched Telephone Network
Figure 1 illustrates the GSM architecture. Different network
signaling protocols are used by the entity interfaces in this ar- Figure 1: The GSM Architecture
chitecture. We will focus on the software platform for imple-
menting GSM network signaling protocol called GSM MAP
care with the HLR.
(Mobile Application Part) [11]. GSM is used in the interfaces
B,C,D,E,F, and G illustrated in Figure 1. In terms of network Switches. The GSM switches are called Mobile Switching
signaling, the GSM architecture can be partitioned into three Centers (MSCs). The MSC performs necessary switch-
parts: ing functions for mobile stations within the geographical
area controlled by this MSC (the area is called an MSC
Databases. There are three types of GSM databases. Home area). An MSC area is partitioned into several Location
Location Register (HLR) maintains the user profiles as Areas (LAs). Every LA consists of several base station
well as the user location information (i.e., the addresses controllers. The LAs are not shown in Figure 1.
of visitor location register and the mobile switching cen-
ter where the user currently resides). Visitor Location To originate a call from a mobile station to a wireline user,
Register (VLR) maintains parts of the user profile (nec- the MSC communicates with a Switching Service Point
essary to set up the calls) as well as the user location in- (SSP) in the Public Switched Telephone Network (PSTN)
formation (i.e., the addresses of mobile switching center using the Signaling System Number 7 (SS7) ISDN User
and the location area of the user). Equipment Identity Part (ISUP) protocol [13]. To deliver a call from a
Register (EIR) maintains a list of legitimate, fraudulent, PSTN user to a mobile station, the originating SSP of the
or faulty mobile stations (i.e. the mobile phones). PSTN communicates with a Gateway MSC (GMSC) us-
ing SS7/ISUP (the call delivery procedure will be briefly
A major function of the HLR and the VLR is mobil- discussed later). During the inter-system handover proce-
ity management. The readers are referred to [12] for dure [14], two MSCs are required to communicate with
the details. In the mobility management procedures, the each other through the E-interface. To achieve the mobil-
HLR communicates with VLRs through the D-interface, ity management and call handling tasks, the MSC needs
and the VLRs communicate to each other through the G- to communicate with HLR (using the C-interface) and
interface. with VLR (using the B-interface). To prevent the fraud
Another type of database called Authentication Center service usage, the MSC communicates with the EIR us-
(AuC) is not illustrated in Figure 1. The AuC may collo- ing the F-interface.

Mobile Computing and Communications Review, Volume 1, Number 11

 OSI GSM MAP Code (DPC) that can be used by the MTP for direct routing.
For Inter-GSM network message delivery, the originating
Service User Mobile
Application node does not have enough knowledge to identify the actual
Application
Presentation address of the destination. In this case, the actual destination
Service Provider Part (MAP)
Session address is translated by a table lookup technique called Global
Transport Title Translation (GTT) performed by the SCCP [ 16].

Transaction Capabilities (TC) Transaction Capabilities (TC) provides protocol functions

between the network layer and the application layer, which
Network Signaling Connection consists of common application service elements that support
Control Part (SCCP) MAP.

Mobile Application Part (MAP) is an application of TC. The

MAP consists of service user and service provider. This user-
Data link Message Transfer Part (MTP) provider model will be elaborated later.
Physical
II. Acronym
Figure 2: MAP Protocol Hierarchy
This section list all abbreviations used in this article.
Application Sub-system ASE Application Service Element
Service Element Number
Reserved 00000101 AuC Authentication Center
HLR 00000110
BSC Base Station Controller
VLR 00000111
MSC 00001000 BTS Base Transceiver Station
EIR 00001001
(Possible) AuC 00001010 CUG Closed User Group

DSM Dialog State Machine

Table 1: MAP SCCP Sub-system Numbers DPC Destination Point Code

EIR Equipment Identity Register

Radio System. The GSM radio system consists of Base
Station Controllers (BSCs), Base Transceiver Stations GMSC Gateway MSC
(BTSs), and Mobile Stations (MSs). The BSC connects
to an MSC through the A interface that follows a signal- G T T Global Title Translation
ing protocol used in the telephone network. The BSC also H L R Home Location Register
connects to one or more BTSs through the A-bis interface
using the ISDN Link Access Protocol for the D Channel IMSI International Mobile Subscriber Identity
(LAPD). A BTS communicates with the MSs through the
radio interface U,~. ISUP ISDN User Part

This article describes the software platform for implementing LA Location Area
GSM MAP that supports interfaces B, C, D, E, and E The LAPD Link Access Protocol for the D Channel
MAP is an application of the SS7 protocol, which consists
of four layers (see Figure 2): Message Transfer Part (MTP) LMSI Local Mobile Station Identity
consists of three levels. The first two levels are equivalent
to the physical and the data link layers in the OSI layered MAP Mobile Application Part
protocol. MTP level 3 carries out the basic routing functions MAP PM MAP Protocol Machine
of the OSI network layer.
MSRN Mobile Subscriber Roaming Number
Signaling Connection Control Part (SCCP) supports addi-
tional network functions. GSM MAP uses SCCP Classes 0 MS Mobile Station
and 1 connectionless services [ 1] that provide efficient routing MSC Mobile Switching Center
with or without maintaining message sequencing between two
or more messages. The network entities may consist of several M T P Message Transfer Part
Application Service Elements (ASEs). The SCCP addresses
PSM Performing Service State Machine
these ASEs with sub-system numbers (SSNs). The SSNs for
GSM MAP ASEs are listed in Table 1. PSTN Public Switched Telephone Network
For Intra-GSM network message delivery, the destination
address of the message may be a simple Destination Point RSM Requesting Service State Machine

12 Mobile Computing and Communications Review, Volume 1, Number 2

 Dialog Initiator Dialog Responder M A P P R O V I D E R (MAP PM)

IMAPSo iceU er I fMaPServiceUer I

Service [ ~ Service_ack(Response) [ I
iRequest) ( ' ~ ( ~ @(~
"~'~ | " ~ Service
t Service ack (Confirm) ;~.,;^.~

/ t . . . . . . . F . . . . . . 7-1 . . . . . .

[ MAP ServiceProviderI [ MAP ServiceProvider '

Figure 3: MAP service model MAP PM: MAP Protocol Machine

MAP DSM: MAP Dialog State Machine
PSM: Performing MAP Service State Machine
SCCP Signaling Connection Control Part RSM: Requesting MAP Service State Machine

SS7 Signaling System Number 7 Figure 4: The MAP Protocol Machine

SSM Service State Machine

SSN sub-system number The common MAP services are used to establish and clear
MAP dialog between peer MAP service users. They invoke
SSP Switching Service Point functions supported by the TC and report abnormal situations.
Six common MAP services are defined in MAP.
TC Transaction Capabilities
MAP-OPEN is used to establish a MAP dialog. This ser-
VLR Visitor Location Register vice is confirmed by the service provider (i.e., this service
primitive has the Response and the Confirm types).
III. ~ Service Framework
MAP-CLOSE is used to clear a MAP dialog, This service is
The GSM network entities (such as HLR, VLR, and MSC) not confirmed by the service provider (i.e., this service
communicate with each other through MAP dialogue by in- primitive does not have the Response and the Confirm
voking MAP service primitives. A service primitive can be types).
one of four types. The service primitive is initiated by a MAP
service user of a network entity (called the dialog initiator) as MAP-DELIMITER is used to explicitly request the TC to
shown in Figure 3. The service type is "Request". This service transfer the MAP protocol data units to the peer entities.
request is sent to the MAP service provider of the network en- This service does not have any parameters and is not con-
tity. The service provider delivers the request to the peer net- firmed by the service provider.
work entity (the dialog responder) by using the lower layer
protocol (i.e., TC). When the MAP service provider of the MAP-U-ABORT is used by the service user to abort a dialog.
peer network entity receives the request, it invokes the same This service is not confirmed by the service provider. The
service primitive with type "Indication" to inform the destina- reason for aborting the dialog can be resource limitation
tion MAP service user. The information (parameters) of the (congestion), application procedure error, and so on.
service with type Indication is identical to the type Request in
MAP-P-ABORT is used by the service provider to abort a di-
most cases. The primitive is typically a query to ask the dialog
alog. This service primitive only has the Indication type.
responder to perform some operations.
The reason for aborting the dialog can be provider mal-
A corresponding service acknowledgement (with or without
function, resource limitation, maintenance activity, and
results) may be sent from the dialog responder to the dialog
SO o n .
initiator. The same service primitive with type "Response" is
invoked by the MAP service user of the dialog responder. Af- MAP-NOTICE is used by the service proVider to inform the
ter the MAP service provider of the dialog initiator receives service user of protocol problems (such as abnormal
this response, it invokes the same service primitive with type event detected by the peer and response rejected by the
"Confirm". The parameters of the Confirm and the Response peer). This service primitive only has the Indication type.
services are identical in most cases except that the Confirm
service may include an extra provider error parameter to indi-
cate a protocol error. A MAP dialog consists of several MAP IV. The MAP Protocol Machine
services to perform a common task. The services are either
specific or common. The specific services include 28 mobil- When a MAP user issues a service request, the request is pro-
ity services, 4 operation and maintenance services, 6 call han- cessed by the MAP Protocol Machine (MAP PM) of the ser-
dling services, 11 supplementary services related services, and vice provider. The MAP PM is illustrated in Figure 4. The
8 short message service management services. MAP PM consists of four components:

Mobile Computing and Communications Review, Volume 1, Number 2 ~..,~L3~

Dialog State Machine (DSM) coordinates the Service State Step 4. When the MAP PM of the dialog responder receives
Machines (SSMs; to be described next). For every MAP TC-BEGIN Indication, a DSM is invoked. If the DSM
dialog, there is an instance of DSM to handle the dialog. identifies any error from the received TC-BEGIN Indica-
tion, a TC-U-ABORT Request is sent back to the dialog
Requesting Service State Machine (RSM) handles a MAP
initiator to terminate the dialog. The DSM also checks if
specific service requested during a dialog. This SSM is the system is overloaded. If so, TC-BEGIN will not be
created by the DSM for each requested service.
processed. Otherwise (the normal case), the DSM issues
Performing Service State Machine (PSM) handles a MAP the MAP-OPEN Indication primitive to its MAP service
service performed during a dialog. This SSM is created user. The DSM then encounters the TC-INVOKE Indi-
by the DSM for each service to be performed. cation primitive, which results in the creation of a PSM.
The PSM checks the following.
Load Control controls the traffic generated by the service ac-
tivities. There is only one instance of this process in each • If the received arguments are not correct, a TC-
system. If overload situation is detected, low priority U-REJECT (with problem code "mistyped param-
MAP operations may be ignored. The suggested priority eter") is sent to the dialog initiator.
levels (from high to low) for the MAP service primitives o If the service (Service1 in our example) cannot be
are handover, mobility management, short message ser- identified, then a TC-U-ERROR (with error code
vices, and subscriber controlled inputs (i,e., for supple- "unexpected data value") is sent to the dialog ini-
mentary services such as call waiting and call forward- tiator.
ing).
• If the service parameters are not available, then a
When the service provider receives a MAP-OPEN Request TC-U-ERROR (with error code "data missing") is
(from the service user) or a TC-BEGIN Indication (from the sent to the dialog initiator.
TC; to be described), the MAP PM is invoked and an instance
If any of the above events occurs, the PSM sends a MAP-
of D S M is created. For every service primitive issued during
NOTICE to its MAP service user.
the MAP dialog, an instance of PSM is created by the DSM at
the performer's side, and an instance of RSM is created by the Assume that no error occurs, then the PSM issues a MAP-
DSM at the initiator's side. Servicel Indication primitive (to be passed to its service
user), and the control is passed back to the DSM.
V. The MAP D i a l o g After the DSM has processed all received components, it
informs its MAP service user by the MAP-DELIMITER
Figure 5 illustrates an example of MAP dialog. The details of Indication primitive.
the steps are described below. The MAP PM then waits for a MAP-OPEN Response
Step 1. A service user initiates a MAP dialog by invoking primitive from its MAP service user. During the waiting
the MAP-OPEN Request service primitive followed by period, the MAP PM will not accept any primitive from
one or more specific service (user request) primitives, and the dialog initiator except for a TC-P-ABO RT Indication.
then the MAP-DELIMITER Request service (in Figure 5
Step 5. The MAP service user processes the Indication primi-
MAP- 0 P E N is followed by one specific service primitive
tives received from the MAP service provider, and returns
MAP_Service1).
the results with the MAP-OPEN and the MAP-Servicel
Step 2. The MAP PM creates an instance of DSM to han- Response primitives, followed by the MAP-DELIMITER
dle the MAP-OPEN Request primitive. For every of Request primitive.
the following user request primitives (in our exam-
Step 6. When the MAP service provider receives the MAP-
ple, MAP_Service1 represents a GSM service primitive
OPEN Response primitive, the DSM first checks if
such as MAP_SEND_ROUTING_INFORMATION [11]),
the response is negative. If so, it generates a
a RSM is created. The RSM uses the TC-INVOKE pro-
MAP_Refuse_PDU (protocol data unit) to be delivered by
cedure to set the operation code and TC parameters for
the Indication primitive TC- E N D.
the service request. Then the control is passed back to
the DSM. The DSM continues to process the user request Assume that the response is positive, a
primitives until the MAP-DELIMITER request primitive MAP_Accept_PDU is generated. The DSM pro-
is encountered. The MAP PM enables the TC-BEGIN ceeds to receive MAP-Service1 Response primitive and
primitive at the TC layer, and waits for a response from passes the control to the PSM. The PSM checks if any
TC. user error is present. If so, depending on the type of error,
either a TC-U-ERROR or a TC-U-REJECT Indication
Before the MAP PM receives the response from TC, it
primitive is issued. Otherwise (the normal case), the
refuses to accept any new request from its service user
PSM issues a TC-RESULT-L or a TC-RESULT-NL (if
except for a MAP-U-ABORT or a pre-arranged release
the user specific parameters of the Response primitives
MAP-CLOSE.
cannot be transferred in a single signaling frame)
Step 3. The TC-* Request primitives will be delivered by the Request primitive, and passes the control back to the
TC and the lower layer protocols of SS7 to the peer MAP DSM. The DSM continues to process the specific service
PM (and the primitives are now of type Indication). primitives until the MAP-DELIMITER request primitive

14 Mobile Computing and Communications Review, Volume 1, Number 2

 Dialog-initiator Dialog-responder

f
[ Service User I Service Provider ]
E [Service Provider I I Service User

( 1) MAP_OPEN (req)
MAP Servicel(req)
MAP_DELIMITER (req) (2) TC-BEGIN (req)
TC-INVOKE (req) (4) MAP OPEN (ind)
(3) TC-BEG1N (ind) MAP_Service 1(ind)
TC-INVOKE (ind) MAP_DELIMITER (ind)

(5) MAP_OPEN (rsp)

MAP Servicel(rsp)
(8) MAP_OPEN (cnf) (7) TC-CONTINUE(ind) (6) TC-CONTINUE (req) MAP_DELIMITER (req)
MAP Servicel(cnf) TC-RESULT-L(ind) TC-RESULT-L (req)
MAPDELIMITER (ind)

i
(8) MAP_Service2 (req) (9) TC-CONTINUE (req)
MAP_DELIMITER (req) TC-INVOKE (req)
(10) TC-CONTINUE (ind) ( 1 l)MAP_Service2 (ind)
TC-INVOKE (ind) i MAPDELIMITER (ind)

(13)TC-END (req) i ( 12)MAP_Service2 (rsp)

TC-RESULT-L (req) MAP_CLOSE (req)
( 14)TC-END (ind)
( 15)MAP_Service2 (cnf) TC-RESULT-L (ind) i 14
MAP_CLOSE (ind)

Figure 5: An Example of MAP Dialog

is encountered. The DSM issues a TC-CONTINUE VI. Conclusions

Request primitive with the MAP_Accept_PDU. At this
point, the MAP dialog is considered established at the This article provided an overview to the MAP protocol used
dialog responder's side. in the GSM interfaces B,C,D,E, and E The general platform
of the MAP service primitives were described and examples
Step 7. The TC-CONTINUE/TC-RESULT-L Indication were provided. Other GSM network signaling protocols and
primitives are received by the MAP service provider interfaces are out of the scope of this paper. The readers are
of the dialog initiator. When the DSM receives the referred to the GSM 09 series for the details [I 1, 10, 9, 5].
TC-CONTINUE, it performs tests as described in Step 4. Other PCS networking signaling protocols share the same
In the normal case, it accepts the dialog and passes the concepts as presented in this article. The protocols include
control to the RSM to handle the specific service primi- EIA/TIA IS-41 [2, 16, 14] and PACS Network Signaling [15].
tives. Our example assumes that the RSM processes the
TC-RESULT-L primitive. If the result parameter is not A c k n o w e d g e m e n t
defined for the specific service primitive, then the RSM
requests to transfer the TC-U-REJECT (with problem This work was supported in part by Microelectronics and In-
code "mistyped parameter") to the dialog responder, and formation Systems Research Center, NCTU, and National Sci-
also issues the MAP-Service1 Confirm primitive (to its ence Council, Contract No. NSC 86-2213-E-009-074.
MAP service user) with the provider-error parameter
code "invalid response received". References
In the normal case, the RSM maps the TC-RESULT-L
[1] ANSI. American National Standard for Telecommuni-
parameters to the MAP-Service1 Confirm primitive, and
cations - Signaling System Number 7: Signaling Con-
passes the control back to the DSM. After all components
nection Control Part (SCCP), Issue 2 Rev. 2. Technical
have been processed, the DSM informs the MAP service
Report ANSI T1.112, ANSI, 1992.
user. At this point, the dialog is considered established at
the dialog inifiator's side. [2] EIA/TIA. Cellular Intersystem Operations (Rev. C).
Technical Report IS-41, EIA/TIA, 1995.
Step 8. The MAP service user of the dialog initiator handles
the Confirm primitives, and may make new requests. [3] ETSI. Integrated Services Digital Network (ISDN):
Closed User Group (CUG) Supplementary Service Digi-
tal Subscriber Signalling System No. One (DSS 1) Proto-
Steps 9-11. These steps are similar to Steps 2-4. col. Technical Report ETS 300 138, ETSI, 1992.
Steps 12-15. These steps are similar to Steps 5-8 except that [4] ETSI. Integrated Services Digital Network (ISDN):
the dialog termination is driven by the MAP-CLOSE Closed User Group (CUG) Supplementary Service De-
primitives and the TC-EN D primitives. scription. Technical Report ETS 300 138, ETSI, 1992.

Mobile Computing and Communications Review, Volume 1, Number 2 15

 [5] ETSI/TC. Detailed Signalling Interworking within the Biography
PLMN And with the PSTN/ISDN. Technical Report
Recommendation GSM 09.09, ETSI, 1992. Yi-Bing Lin received his BSEE degree from National Cheng
Kung University in 1983, and his Ph.D. degree in Computer
[6] ETSI/TC. Numbering, Addressing And identification. Science from the University of Washington in 1990. From
Technical Report Recommendation GSM 03.03, ETSI, 1990 to 1995, he was with the Applied Research Area at
1993. Bell Communications Research (Bellcore), Morristown, NJ. In
1995, he was appointed as a professor of Department of Com-
[7] ETSI/TC. Restoration Procedures, Version 4.2.0. Tech-
puter Science and Information Engineering, National Chiao
nical Report Recommendation GSM 03.07, ETSI, 1993.
Tung University. In 1996, he was appointed as Deputy Di-
[8] ETSI/TC. European Digital Cellular Telecommunica- rector of Microelectronics and Information Systems Research
tions System (Phase 2); Call Forwarding Supplementary Center, NCTU. His current research interests include design
Services - Stage 1. Technical Report Recommendation and analysis of personal communications services network,
GSM 02.82, ETSI, 1994. mobile computing, distributed simulation, and performance
modeling.
[9] ETSI/TC. General Requirements on Interworking Be- Dr. Lin is a subject area editor of the Journal of Parallel and
tween the PLMN And the ISDN or PSTN, Version 4.6.0. Distributed Computing, an associate editor of the International
Technical Report Recommendation GSM 09.07, ETSI, Journal in Computer Simulation, an associate editor of IEEE
1994. Networks, an associate editor of SIMULATION magazine, an
area editor of ACM Mobile Computing and Communication
[10] ETSI/TC. Interworking Between the PLMN And the
Review, a columnist of ACM Simulation Digest, a member of
CSPDN, Version 4.0.2. Technical Report Recommen-
the editorial board of International Journal of Communications
dation GSM 09.04, ETSI, 1994.
Systems, a member of the editorial board of Computer Simula-
[11] ETSI/TC. Mobile Application Part (MAP) Specification, tion Modeling and Analysis, Program Chair for the 8th Work-
Version 4.8.0. Technical Report Recommendation GSM shop on Distributed and Parallel Simulation, General Chair for
09.02, ETSI, 1994. the 9th Workshop on Distributed and Parallel Simulation. Pro-
gram Chair for the 2nd International Mobile Computing Con-
[12] Lin, Y.-B. No Wires Attached: Reaching out with ference, the publicity chair of ACM Sigmobile, Guest Editor
GSM. IEEE Potentials, October/November 1995. See for the ACM/Baltzer WINET special issue on Personal Com-
http://liny.csie.nctu.edu.tw. munications, and Guest Editor for IEEE Transactions on Com-
puters special issue on Mobile Computing: Dr. Lin is a senior
[13] Lin, Y.-B. Signaling System Number 7. IEEE
member of IEEE. Lin's email address is liny @csie.nctu.edu.tw
Potentials, pages 5-8, Aug/Sept 1996. See Also
http://liny.csie.nctu.edu.tw.

[141 Lin, Y.-B. Mobility Management for Cellular Telephony

Networks. IEEE Parallel & Distributed Technology,
4(4):65-73, November 1997.

[151 Lin, Y.-B. PACS Network Signaling Using AIN/ISDN.

Accepted for publication in IEEE Personal Communi-
cations Magazine; See Also http://liny.csie.nctu.edu.tw,
1997.

[16] Lin, Y.-B. And DeVries S.K. PCS Network Signaling

Using SS7. IEEE Personal Commun. Mag., pages 44-
55, June 1995. see Also http://liny.csie.nctu.edu.tw.

16 Mobile Computing and Communications Review, Volume 1, Number 2