1

3.5 Mobility
3.5.1 RA
A PLMN network supporting GPRS is divided into RAs. Each RA is defined by the operator of the PLMN
network and may contain one or several cells. A LA is a group of one or several RAs. The RA defines a
paging area for GPRS, while the LA defines a paging area for incoming circuit-switched calls. Actually, when
the network receives an incoming call for a mobile not localized at cell level but localized at RA level, it
broadcasts a paging on every cell belonging to this RA. The RA concept is illustrated in Figure 3.19.

Figure 3.19: RA concept.

If the MS moves to a new LA, it also moves to a new RA. Each RA is identified by a routing area
identifier (RAI). This is made up of a location area identifier (LAI) and a routing area code(RAC). Figure 3.20
gives the structure of the RAI.

Figure 3.20: Structure of RAI.

The LAI identifies the LA, with the mobile country code (MCC) indicating the PLMN country, themobile
network code (MNC) identifying the PLMN network in this country, and the location area code (LAC)
identifying the LA.
The RAI of each RA is broadcast on all cells belonging to this RA. This way, the MS is able to detect a new
RA by comparing the RAI it had previously saved with the one broadcast in the new cell, and then to signal to
the network its RA change.
The MS may also signal to the network the RA in which it is located upon expiry of a periodic timer. This
procedure allows the network to check that the MS is within coverage of its RA. Owing to this procedure, the
network knows if it may continue to route incoming calls for this MS toward this RA.
When an MS attached for circuit and packet services detects a new LA on the serving cell after having
changed the cell, it will signal to the network its LA and RA change.

3.5.2 GMM States

Three global states are defined for GPRS mobility at the GMM layer level. These global states, GMM IDLE,
STANDBY, and READY allow for characterization of the GMM activity of a GPRS mobile. They are managed

2
in the MS and in the SGSN for each MS, and the transitions between states are slightly different on the MS
and SGSN sides. A GPRS mobile is in GMM IDLE state when it is not attached for GPRS service. In this
state, there is no GPRS mobility context established between the MS and the SGSN; this means that no
information related to the MS is stored at SGSN level. In GMM STANDBY and READY states, a GPRS
mobility context is established between the MS and the SGSN. A GPRS mobile is in GMM STANDBY state
when it is attached for GPRS services and its location is known by the network at the RA level. A GPRS
mobile is in GMM READY state when it is attached for GPRS services and its location is known by the
network at the cell level.
A GPRS mobile goes to GMM IDLE state when it has just detached from GPRS. The SGSN goes to GMM
IDLE state for a given MS upon receipt of the GPRS detach message, upon implicit detach when no MS
activity is detected, or upon receipt of cancel location from HLR for operator purposes.
A GPRS mobile goes to GMM READY state when it has just sent a packet to the network. For each packet
sent to the network, the MS reinitializes a READY timer. The SGSN goes to GMM READY state for a given
MS when it receives an LLC PDU from it. For each LLC PDU received from the MS, the SGSN reinitializes a
READY timer related to the MS.
A GPRS mobile goes to GMM STANDBY state from GMM READY state either upon expiry of the READY
timer, or upon the receipt of an explicit request from the SGSN to force the GMM STANDBY state. The SGSN
goes to GMM STANDBY state for one given MS either upon expiry of the READY timer, or upon explicit
request from the network to force the GMM STANDBY state, or on an irrecoverable disruption of a radio
transmission found at RLC layer level.

Note The network may force the GMM STANDBY state in order to reduce the signaling load in the
network. In fact, as explained below, the MS has to perform several procedures in GMM READY
state that are not authorized in GMM STANDBY state, such as notification of cell change.
Furthermore, the GMM STANDBY state enables optimization of MS autonomy, since the MS need
not send as much signaling over the air interface as compared with the GMM READY state.
Figure 3.21 shows the transitions between the three GMM states.

Figure 3.21: Global states of GPRS mobility. (From [1].)

Table 3.4 summarizes the list of authorized procedures relative to GMM states.

Table 3.4: Authorized Procedures Relative to GMM States

IDLE

STANDBY

READY

PLMN selection

Yes

Yes

Yes

GPRS cell (re)selection

No

Yes

Yes

GPRS packet transfer

No

Yes

Yes

Paging

No

Yes

No

Routing area update procedure

No

Yes

Yes

Notification of cell change

No

No

Yes

Radio link measurement reporting

No

No

Yes

The three global states lead to different behaviors of the MS at the radio interface level. They are therefore
sent to the RR management layer of the MS.

3.5.3 Overview of GMM Procedures

3.5.3.1 Paging
The network may page an MS for circuit-switched and packet-switched services. These two services are
managed in the backbone network by two different nodes: the MSC for routing of circuit-switched calls and
the SGSN for routing of packet-switched calls. If there is no paging coordination between the circuit-switched
and packet-switched services, the paging for circuit-switched and packet-switched services will not
necessarily arrive at the MS on the same logical channel over the radio interface. This implies that the MS has
to simultaneously monitor several logical channels for paging detection, a difficult task for MS receivers. In
order to ease the MS behavior with respect to paging detection, paging coordination between circuit-switched
and packet-switched services may be implemented in the network by adding a new interface, called the Gs
interface, between the MSC and SGSN. This interface enables an incoming circuit-switched call to be routed
from the MSC to the SGSN; this will allow the mobile to detect the circuit-switched and packet-switched
services in the same logical channel.
Paging modes are defined by the recommendations to allow different paging implementations in the network.
These paging modes take into account parameters such as the paging coordination method between circuitswitched and packet-switched services and the presence or absence of PCCCH paging channels. The paging
mode is broadcast by the network on each GPRS cell.
Three network modes of operation (NMOs) are defined for paging:

Mode I. Circuit-switched paging messages are sent on the same PCHs as packet-switched paging,
since paging coordination is supported (i.e., on PCCCH paging channels if allocated in the cell, or
otherwise on CCCH paging channels).

Mode II. Packet-switched paging messages are sent on CCCH paging channels.

Mode III. Circuit-switched paging messages are sent on CCCH paging channels and packet-switched
paging messages are sent on PCCCH paging channels if they exist in the cell, or on CCCH paging
channels otherwise. Mode III is thus equivalent to mode II if the PCCCH paging channels are not
present in the cell.

Mode I
The network operates in mode I when the Gs interface is present between the MSC and the SGSN. In this
mode, the network sends the paging messages on the same logical channels for circuit-switched and packetswitched services. When an MS both IMSI- and GPRS-attached is in idle mode, it monitors for any kind of
incoming calls (circuit-switched and GPRS) the PCCCH channels if they are present, and the CCCH channels
otherwise. Figure 3.22 illustrates a paging in idle mode when the network operates in mode I.

Figure 3.22: Paging in idle mode with CCCH/PCCCH for network operation mode I.
In mode I, when an MS both IMSI- and GPRS-attached is in packet transfer mode, the circuit-switched paging
occurs on the PACCH of the TBF in progress. Figure 3.23 illustrates a paging in packet transfer mode when
the network operates in mode I.

Figure 3.23: CS paging in packet transfer mode for network operation mode I.
Mode II
In network operation mode II, the Gs interface is not present between the MSC and the SGSN, and the
PPCHs are not present in the cell. In this mode the network sends paging messages for circuit-switched and
packet-switched services on CCCH paging channels.
In the case of a packet transfer in progress, the MS may receive a circuit-switched paging on the CCCH
paging channels. The MS then has the choice either to regularly suspend its packet transfer for listening to the
CCCH paging channel or ignore the circuit-switched paging. The network may also send the circuit-switched
paging on the PACCH; in this case the MS need not suspend its packet transfer for the paging decoding.
Figure 3.24 illustrates a paging in idle mode when the network operates in mode II.

Figure 3.24: Paging in idle mode for network operation mode II.
Mode III
In network operation mode III, the network sends circuit-switched paging messages on CCCH channels and
packet-switched paging messages on PCCCH channels if they are present, or otherwise on CCCH channels.
The Gs interface is not present.
In the case of a packet transfer in progress, the MS may receive a circuit-switched paging either on the CCCH
paging channels or on PACCH. The MS behavior is the same as that defined in mode II during a packet
transfer.
In the case of a circuit-switched call in progress, the MS is not able to monitor PCCCH paging channels if they
are present, or otherwise CCCH paging channels for a packet-switched paging. The MS is not authorized to
suspend its circuit-switched call for listening PCHs. Figure 3.25 illustrates a paging in idle mode when the
network operates in mode III.

Figure 3.25: Paging in idle mode for network operation mode III.

3.5.3.2 GPRS Attach

In order to access GPRS services, an MS performs an IMSI attach for GPRS services to signal its presence
to the network. During the attach procedure, the MS provides its identity, either a temporary identifier
or packet temporary mobile station identity (P-TMSI) previously allocated by the SGSN, or an IMSI identifier
when P-TMSI is not valid. When the MS is GPRS-attached, an MM context is established between the MS
and the SGSN. This means that information related to this MS (i.e., IMSI, P-TMSI, cell identity, and RA) is
stored in the SGSN. A GPRS-attached mobile is localized by the network at least at RA level and may be
paged at any moment in GMM STANDBY state.
In network operation modes II or III, the MS both IMSI- and GPRS-attached is obliged to initiate separate
attach procedures for circuit-switched and packet-switched services with MSC/VLR and SGSN entities.
In network operation mode I, there is a combined IMSI and GPRS attach procedure for MSs wishing to be
configured in class A or in class B. In this case, the MS initiates an attach procedure for circuit-switched and
packet-switched services with the SGSN. As the Gs interface is present between the MSC/VLR and SGSN,
the latter is able to forward the IMSI attach request to the MSC/VLR.

3.5.3.3 GPRS Detach

A GPRS MS can no longer access GPRS service when it is GPRS-detached. The detach may be explicit or
implicit. It is explicit when signaling is exchanged between the MS and the network. The detach is implicit
when the network detaches the MS without any notification, and it may occur when the network does not
detect any activity related to the MS for a certain amount of time.
An MS both IMSI- and GPRS-attached (MS configured in class A or class B) in a network that operates in
network operation modes II or III is obliged to initiate separate procedures for IMSI detach and GPRS detach
with MSC/VLR and SGSN entities.
An MS both IMSI- and GPRS-attached (MS configured in class A or class B) in a network that operates in
network operation mode I may perform an IMSI and GPRS combined detach procedure. As Gs interface is
present in mode I between the MSC/VLR and SGSN entities, the request of IMSI detach included in the
request of combined detach is forwarded to the MSC/VLR entity by the SGSN entity.

3.5.3.4 Security Aspects

Principles of Authentication and Kc Key Establishment
The authentication procedure is equivalent to that existing in GSM, with the difference being that it is handled
by the SGSN entity. This procedure allows the LLC layer between the MS and the SGSN to be protected
against unauthorized GPRS calls. The GPRS authentication uses a nonpredictable number provided by
HLR/AUC. From this random number, the MS and the HLR/AUC calculate a number called the SRES by using
an algorithm A3 and a key Ki specific to the GPRS subscriber.
The establishment of ciphering key Kc for a GPRS subscriber is also performed during authentication
procedure from the random number provided by HLR/AUC. The ciphering key Kc is also computed from the
random number by using an algorithm A8 and a key Ki belonging to the GPRS subscriber. The principle of
GPRS authentication is illustrated in Figure 3.26.

Figure 3.26: Principle of GPRS authentication.

User Identity Confidentiality
The network guarantees user identity confidentiality while accessing GPRS radio resources. The user identity
confidentiality is ensured by identifiers such as the P-TMSI and temporary logical link identity (TLLI). These
identifiers are solely known between the MS and the SGSN, and are used on the radio interface to identify the
called or calling MS.
P-TMSI is locally allocated by the SGSN. As this attribute is handled locally at the SGSN level, the change of
P-TMSI may take place at every SGSN change. The P-TMSI reallocation can be performed during the attach

7
procedure, during the RA update procedure, or during the P-TMSI reallocation procedure requested by the
network.
TLLI allows for identification of a GPRS subscriber. This identifier is deduced from the P-TMSI structure. The
relation between TLLI and IMSI is only known by the MS and the SGSN. This identifier is calculated by the
GMM entity and is sent to the RLC/MAC entity in the MS and the BSS. The SGSN may send a P-TMSI
signature to the MS during the GPRS attach procedure or during the RA update procedure.
In this case, the MS must include this signature in the next attach procedure or in the next RA update
procedure. The P-TMSI signature conveys the proof that the P-TMSI returned by the MS is the one allocated
by the SGSN. The SGSN checks the signature sent by the MS and the one sent previously to the MS. If these
values do not match, then the SGSN initiates a MS authentication procedure.
Identity Verification
The SGSN may ask for MS identity if the Gf interface is present between the SGSN and the EIR entity. That
way, the SGSN may compare the IMEI identifier returned by the MS and the one saved in the EIR database.
Call Ciphering
The network provides the call confidentiality by ciphering it. The data ciphering for GPRS is performed at the
LLC frame level between the MS and the SGSN, unlike in GSM, where the ciphering is performed on the radio
interface between the MS and the BTS.
During GPRS ciphering, an XOR operation is performed between an LLC frame and a mask. This latter has
the same length as the LLC frame. During the GPRS deciphering, an XOR operation is performed between a
ciphered LLC frame and the same mask used for ciphering. The mask for the ciphering and deciphering
procedures is calculated from ciphering algorithm A5 with the following input parameters:

Key Kc, determined during authentication procedure;

Direction, indicating the transmission direction (uplink or downlink);

Input, which depends on the LLC frame type (acknowledged modeincremented value for each new
LLC frame; unacknowledged modevalue derived from the LLC header).

The ciphering and deciphering procedure is illustrated in Figure 3.27.

Figure 3.27: Ciphering and deciphering procedure.

3.5.3.5 Location Updating Procedures

When a GPRS MS camps on a new cell, it reads the cell identifier (CI), the RAI, and the LAI. If at least one of
these identifiers has changed, the MS may initiate one of the GPRS location procedures:

Notification of cell update;

Normal RA update;

Combined RA and LA update.

If a GPRS-attached MS detects a new cell within its current RA, it performs a cell update procedure when it is
in GMM READY state.
If a GPRS-attached MS detects a new RA, it performs an RA update procedure. This procedure may also
occur at the expiry of a periodic timer or at the end of a circuit-switched connection. In fact, during a circuitswitched connection, if the MS changes RA then the SGSN is not notified of this change.
If an MS that is both IMSI- and GPRS-attached has detected a new LA in a network that operates in network
operation mode I, then it performs a combined RA and LA update procedure.
If an MS both IMSI- and GPRS-attached has detected a new LA in a network that operates in network
operation modes II or III, then it first performs an LA update procedure, and then an RA update procedure.
The LA update is performed by the MM entity and requires the establishment of a dedicated connection.
If a GPRS MS detects a new cell in a new RA, then it performs an RA update procedure. This procedure may
also occur at expiry of a periodic timer or at the end of a dedicated connection.