Virtual Roaming Systems for GSM, GPRS and UMTS

Professor Arnaud Henry-Labordere, Ecole Nationale des Ponts et Chaussées, France Arnaud Henry-Labordere received his Engineering degree from école Centrale de Paris in 1966 and his Ph.D in Mathematics in 1968. He is currently Professor Emeritus of Operations Research at the Ecole Nationale des Ponts et Chaussées, Paris, where he started his teaching career as Associate Professor in Optimization and Mathematical Programming.

Preface xiii

By the Same Author xviii

Abbreviations and Acronyms xix

1 ‘Virtual Roaming’ Purpose and Principles 1

1.1 Mobile Services Affected by Virtual Roaming 1

1.2 Virtual Roaming Hub for Inbound Visitors’ Service (Single IMSI) 2

1.3 Virtual Roaming Hub for Outbound Subscribers: Multi-IMSI 7

1.4 Brief Introduction to Standard Bilateral Roaming Procedures 9

1.5 Principles of the SS7 Protocol Layers Used in Roaming Procedures 10

2 Architecture of Virtual Roaming Systems 15

2.1 SCCP, MAP, CAP and GTP Transformation Principle in the Roaming Hub 15

2.2 Procedures for the Virtual Roaming Visitors’ Service (Single IMSI) 16

2.3 Restriction of Virtual Roaming by the Roaming Hub 29

2.4 Procedures for the Virtual Roaming Visitors’ Service (Multi-IMSI) 31

2.5 IS 41 ↔ƒnMAP GSM Inter-standard Roaming Hubs 37

2.6 Various MAP and CAMEL Transformation Methods 39

2.7 Appendix of Chapter 2 41

References and Further Reading 48

3 Connecting the VPLMN MNOs to a Virtual Roaming Supplier 51

3.1 MNO Configuration vs Roaming Hub Supplier Configuration 51

3.2 Connection to the Roaming Hub Service, MNO Point of View: Using the ‘Alias GT’ Method 51

3.3 Details of E212 →ƒnE214 MNO Configuration with the GT Translation Methods 53

3.4 Connection to the Roaming Hub Service, MNO Point of View: Using the ‘MTP Transparent Tunnelling’ Method 54

3.5 Roaming Hub Supplier Point of View: Different Modes of Connection of the MNO Clients 54

3.6 Implementation of a Roaming Hub with Several Point Codes 57

3.7 SS7 Stack Architecture for a Robust Integrated System with Several Point Codes 61

3.8 SIGTRAN Introduction and Practical Configuration 63

3.9 Standard MTP3 Load Distribution Algorithm 66

3.10 SCCP Class 1 (Sequenced Connectionless Protocol) 68

References and Further Reading 69

4 Networks of Roaming Hubs and SMSeXchanges 71

4.1 Cooperation of Several Roaming Hubs 71

4.2 Problem Raised by Mobile Number Portability (MNP) 71

4.3 Use of the TCAP Dialogue Part to Provide an End-To-End Routing Capability 74

References and Further Reading 77

5 Hosted Roaming Hubs with Virtual GTs 79

5.1 Purpose 79

5.2 TCAP Dialogue Implementation Constraints 79

References and Further Reading 84

6 Location-based Services and Virtual Roaming 85

6.1 Traces Show How an SMLC Really Works 85

6.2 ‘Spyware Measurements’ in the Handset 86

6.3 Network MAP-based Location Obtaining Methods: Prerequisites 91

6.4 Simple BSS-based SMLC Architecture Using the Mobile TA and Measurements 100

6.5 Details of a More Accurate Positioning Method: A-GPS 106

6.6 The Enhanced Time Difference (E-OTD) Method: Hyperbola Intersections 110

6.7 Annex: Execution of the Algorithm for Position Computation with the ‘Measurement Reports’ or E-OTD 112

References and Further Reading 115

7 Roaming Costs or Inter-operator Traffic Charge Suppression Systems, and Other Service Improvements 117

7.1 VMS Anti-tromboning: Large Financial Savings in GSM and UMTS 117

7.2 Call Back and Local Calls Optimization 124

7.3 Dialled Number Correction with CAMEL 128

References and Further Reading 129

8 SIM Cards ‘Over The Air’ Provisioning 131

8.1 Principles of SIM OTA Using SMS: Download and Upload 131

8.2 OTA SIM Provisioning Interface Examples 137

8.3 Coding the Binary Payload to Download (Write) and Upload (Read) Files of

8.4 Coding the Binary Payload to Download (Write) and Upload (Read) Data of the SIM Card (Access with Applet File Manager) 154

8.5 Coding a Binary Payload Which Triggers the Execution of a Remote SIM Tool Kit (Using the Applet File Manager) 154

8.6 More Details on OTA Formats 155

8.7 Details for the Upload of a Big SIM Address Book (Multiple Entries) Using Concatenated SMS 160

8.8 Security Keys, How to Use the Card Vendor Provided Data 163

References and Further Reading 164

9 Handset ‘Over The Air’ Provisioning of GPRS Profiles, Automatic Device Management 167

9.1 The Data Access Path in GSM: Purpose of GPRS Profile Settings 167

9.2 Obtaining the IMEI of a Handset for Device Management 168

9.3 Method to Remotely Check that a Loaded GPRS Profile Works 172

9.4 Architecture of a Classical OTA GPRS Server 173

9.5 Stochastic Automatic GPRS Profile Type Learning OTA Server 174

9.6 Stochastic Convergence 176

9.7 Best Order to Try an Unknown Handset GPRS Profile Type 177

References and Further Reading 178

10 Current Developments and Directions: GSM-UMTS ↔ƒnVoIP Roaming 179

10.1 Pirate Techniques? 179

10.2 Seamless ‘Free Roaming’? GSM-UMTS with SS7 ↔ƒnVoIP Gateways 180

10.3 Attracting the Visitors and Forcing Them to Roam Immediately in a Given VPLMN 184

10.4 IMS, the all IP Network Architecture 186

10.5 Making a 4G ‘IP Call’ to a Mobile 187

References and Further Reading 189

11 Worked-out Examples 191

11.1 Examples of Chapter 1 191

11.2 Examples of Chapter 3: Roaming Hub with Several Point Codes 215

11.3 Examples of Chapter 4 221

Index 303