Request Access: Cipher Mode Command Message
Request Access: Cipher Mode Command Message
Request Access: Cipher Mode Command Message
Authentication
Before the network will provide any services to the MS, the network will require the MS to authenticate itself. The BSS
sends an Authentication Request (AUTH_REQ) message to the MS. The RAND serves as the "challenge" for
authentication.
The MS calculates the proper SRES based on the RAND that was given and sends the SRES to the BSS in
anAuthentication Response (AUTH_RESP) message.
The BSS verifies the SRES. If the SRES is correct then the MS is authenticated and allowed access to the network.
The BSS will send a Service Accept (CM_SERV_ACC) message letting the MS know that the service request was
received and processed.
Once authenticated, the BSS orders the MS to switch to cipher mode with the CIPH_MOD_CMD message.
During the ciphering procedure the ciphering key Kc is set between the network and the MS. Ciphering is initiated
after the ciphering key is set on the dedicated signalling channel (SDCCH or FACCH).
The GSM uses stream ciphering, which means that the data flow transmitted on the SDCCH/TCH is the binary bit by
bit addition of the user data flow to a ciphering bit stream.
If ciphering algorithm is changed during Assignment or Handover then BSC passes the cipher mode setting to the MS
in Assignment Command or Handover Command message.
In an MSC-controlled handover, the MSC tells the new BSS whether encryption is required in the HANDOVER
REQUEST message.
In a BSC-controlled handover, the BSC passes the encryption information to the target BTS on the activation of the
channels if the encryption information was received from the MSC.
The MSC sends the CIPHER MODE COMMAND message (a) to the BSC to indicate whether ciphering is required
and if so, to indicate the ciphering key.
The CIPHER MODE COMMAND message (from the MSC to the BSC) contains the following data:
message type
layer 3 header information
encryption information: permitted algorithms and ciphering key
cipher response mode.
The message contains the encryption instructions and the L3 header information for the MS.
When ciphering is required, the encryption information element contains information for the BTS to load the
encryption device with the appropriate key.
On receiving the CIPHER MODE COMMAND message, the BSC selects the algorithm to be used according to the
list of permitted algorithms included in the message and the algorithms that are supported by that particular BSS. See
Support for different ciphering algorithms for details.
Regardless of whether ciphering is to be activated, the BSC stores the encryption information, including the selected
algorithm for possible subsequent handovers, and passes the encryption information to the BTS in the ENCRYPTION
COMMAND message (b).
The BTS analyses the ENCRYPTION COMMAND message. If encryption is required, the BTS activates the
demodulator to decipher. Regardless of whether ciphering is required, the BTS sends the CIPHER MODE
COMMAND message (c) to the MS.
The MS starts to decipher and to encipher using its available ciphering key. It then returns to the BTS, in encrypted
form, the CIPHER MODE COMPLETE message (d) or the next message it is due to send. The message includes the
IMEI, if required by the MSC.
On receiving the CIPHER MODE COMPLETE message (or any correctly enciphered layer 2 frame), the BTS starts
enciphering and forwards the message via the BSC to the MSC.
If the ciphering procedure fails, the MSC takes the appropriate action.
The MSC may send a list of permitted ciphering algorithms to the BSC in the CIPHER MODE COMMAND message.
The BSC selects the algorithm to be used from this list according to the algorithms that are supported by the BSS. If
the BSS supports several algorithms, the BSC makes the selection according to the following preference:
1. A5/3
2. A5/1
3. A5/0 (no ciphering)
The MS then sends a Call Setup (SETUP) message to the BSS. The message includes the address information
(MSISDN) of the called party.
The BSS assigns a TCH to the MS by sending an Assignment Command (ASS_CMD) message. This message
includes which Transceiver (TRX) and which Time Slot (TS) to use.
The BSS does not actually assign a TCH to the MS until the MSC sends a Call Proceeding (CALL_PROC) message
to the BSS indicating that the IAM has been sent.
The MS immediately switches to the assigned TCH. The MS sends an Assignment Complete (ASS_COM) message
back to the BTS on the FACCH.
Remember that a FACCH is not a separate channel; it is simply a stolen time slot from the TCH that is used for
signaling data instead of voice traffic.
Call Setup
The MSC sends an Initial Address Message (IAM) to the GMSC. The IAM contains the MSISDN of the called party as
the MS dialed it.
The MSC will also send a Call Proceeding (CALL_PROC) message down to the BSS and this is when the BSS would
assign a TCH to the MS, as described in step 10 above.
Based on the dialed number, the GMSC decides where to route the IAM within the PSTN.
The PSTN will continue to route the IAM until it reaches the correct Switching Center and the call routing is complete.
The PSTN will then establish the call circuit and send an Address Complete Message (ACM) back to the GMSC.
The GMSC then forwards the ACM back to the responsible MSC indicating that the call circuit has been established
Call Establishment
Once the MSC receives the ACM, it sends an ALERT message to the MS indicating that the call is going through.
The BSS sends the ALERT message on the FACCH. Once the MS receives the ALERT, it will generate the ringing
sound in the earpiece. The BSS sends an alerting message the subscriber will hear the line ringing.
Once the called party answers the phone, the PSTN will send an Answer message to the MSC. The MSC forwards
this to the MS in a Connection (CON) message.
Once the MS receives the CON message, it switches over to voice and begins the call. All voice traffic occurs on the
assigned TCH.
Call Termination
When either the caller or the called party hangs up, the call will be disconnected. Either party can initiate the
disconnect. In this example, the MS initiates the disconnect. The MS sends a Disconnect (DISC) message to the BTS
on the FACCH.
The BSS forwards the DISC to the MSC. Once the MSC receives the DISC message, it sends a Release (REL)
message through the GMSC to the PSTN as well as down through the BSS to the MS.
The MS responds by sending a Release Complete (REL_COM) message to the BSS on the FACCH. The BSS
forwards the REL_COM message up to the MSC. Once the MSC receives the REL_COM message the call is
considered ended from the call control perspective.
Although the call has ended, the BSS still has a TCH allocated to the MS. The MSC sends a Channel Release
(CHAN_REL) message to the BSS. The BSS forwards the CHAN_REL message to the MS.
The MS responds with a DISC (LAPDm) message and returns to an idle mode. The BSS reallocates the channel for
other call or releases the TRX.
External Resource
Call Flow Mesage Details:-