| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 1 | |
| 2 | GPRS Subscriber Update Protocol |
| 3 | |
| 4 | 1. General |
| 5 | |
| 6 | This document describes the remote protocol that is used by the SGSN to update |
| 7 | and manage the local subscriber list. The protocol and the messages are |
| 8 | designed after the corresponding MAP messages (see GSM 09.02) with the |
| 9 | following differences: |
| 10 | |
| 11 | - The encoding uses TLV structures instead of ASN.1 encodings |
| 12 | - Segmentation is not used |
| 13 | |
| 14 | See the specification of the Gr interface (GSM 03.60). |
| 15 | |
| 16 | 2. Connection |
| 17 | |
| 18 | The protocol expects that a reliable, ordered, packet boundaries preserving |
| 19 | connection is used (e.g. IPA over TCP). The remote peer is either a service |
| 20 | that understands the protocol natively or a wrapper service that maps the |
| 21 | messages to/from real MAP messages that can be used to directly communicate |
| 22 | with an HLR. |
| 23 | |
| Jacob Erlbeck | 46684dc | 2014-12-15 10:16:02 +0100 | [diff] [blame] | 24 | 2.1. Using IPA |
| 25 | |
| 26 | By default, the following identifiers should be used: |
| 27 | - IPA protocol: 0xee (OSMO) |
| 28 | - IPA OSMO protocol extension: 0x05 |
| 29 | |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 30 | 2. Procedures |
| 31 | |
| 32 | 2.1. Authentication management |
| 33 | |
| 34 | The SGSN sends a SEND_AUTHENTICATION_INFO_REQ message containing the MS's IMSI |
| 35 | to the peer. On errors, especially if authentication info is not availabe for |
| 36 | that IMSI, the peer returns a SEND_AUTHENTICATION_INFO_ERR message. Otherwise |
| 37 | the peer returns a SEND_AUTHENTICATION_INFO_RES message. If this message |
| 38 | contains at least one authentication tuple, the SGSN replaces all tuples that |
| 39 | are assigned to the subscriber. If the message doesn't contain any tuple the |
| 40 | SGSN may reject the Attach Request. (see GSM 09.02, 25.5.6) |
| 41 | |
| 42 | 2.2. Location Updating |
| 43 | |
| 44 | The SGSN sends a UPDATE_LOCATION_REQ to the peer. If the request is denied by |
| 45 | the network, the peer returns an UPDATE_LOCATION_ERR message to the SGSN. |
| 46 | Otherwise the peer returns an UPDATE_LOCATION_RES message containing all |
| 47 | information fields that shall be inserted into the subscriber record. If |
| 48 | the 'PDP info complete' information element is set in the message, the SGSN |
| 49 | clears existing PDP information fields in the subscriber record first. |
| 50 | (see GSM 09.02, 19.1.1.8) |
| 51 | |
| 52 | [...] |
| 53 | |
| 54 | 3. Message Format |
| 55 | |
| 56 | 3.1. General |
| 57 | |
| 58 | Every message is based on the following message format |
| 59 | |
| 60 | IEI Info Element Type Pres. Format Length |
| 61 | Message type 4.2.1 M V 1 |
| 62 | 01 IMSI 4.2.9 M TLV 2-10 |
| 63 | |
| 64 | If a numeric range is indicated in the 'presence' column, multiple information |
| 65 | elements with the same tag may be used in sequence. The information elements |
| 66 | shall be sent in the given order. Nevertheless after the generic part the |
| 67 | receiver shall be able to received them in any order. Unknown IE shall be |
| 68 | ignored. |
| 69 | |
| 70 | 3.2.1. Send Authentication Info Request |
| 71 | |
| 72 | SGSN -> Network peer |
| 73 | |
| 74 | IEI Info Element Type Pres. Format Length |
| 75 | Message type 4.2.1 M V 1 |
| 76 | 01 IMSI 4.2.9 M TLV 2-10 |
| 77 | |
| 78 | 3.2.2. Send Authentication Info Error |
| 79 | |
| 80 | Network peer -> SGSN |
| 81 | |
| 82 | IEI Info Element Type Pres. Format Length |
| 83 | Message type 4.2.1 M V 1 |
| 84 | 01 IMSI 4.2.9 M TLV 2-10 |
| 85 | 02 Cause GMM cause, M TLV 3 |
| 86 | 04.08: 10.5.5.14 |
| 87 | |
| 88 | 3.2.3. Send Authentication Info Response |
| 89 | |
| 90 | Network peer -> SGSN |
| 91 | |
| 92 | IEI Info Element Type Pres. Format Length |
| 93 | Message type 4.2.1 M V 1 |
| 94 | 01 IMSI 4.2.9 M TLV 2-10 |
| 95 | 03 Auth tuple 4.2.5 0-5 TLV 36 |
| 96 | |
| 97 | 3.2.4. Update Location Request |
| 98 | |
| 99 | SGSN -> Network peer |
| 100 | |
| 101 | IEI Info Element Type Pres. Format Length |
| 102 | Message type 4.2.1 M V 1 |
| 103 | 01 IMSI 4.2.9 M TLV 2-10 |
| 104 | |
| 105 | 3.2.5. Update Location Error |
| 106 | |
| 107 | Network peer -> SGSN |
| 108 | |
| 109 | IEI Info Element Type Pres. Format Length |
| 110 | Message type 4.2.1 M V 1 |
| 111 | 01 IMSI 4.2.9 M TLV 2-10 |
| 112 | 02 Cause GMM cause, M TLV 3 |
| 113 | 04.08: 10.5.5.14 |
| 114 | |
| 115 | 3.2.6. Update Location Result |
| 116 | |
| 117 | Network peer -> SGSN |
| 118 | |
| 119 | IEI Info Element Type Pres. Format Length |
| 120 | Message type 4.2.1 M V 1 |
| 121 | 01 IMSI 4.2.9 M TLV 2-10 |
| Holger Hans Peter Freyther | e448554 | 2015-04-22 22:10:44 -0400 | [diff] [blame] | 122 | 08 MSISDN 4.2.10 O TLV 0-9 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 123 | 04 PDP info complete 4.2.8 O TLV 2 |
| 124 | 05 PDP info 4.2.3 1-10 TLV |
| 125 | |
| 126 | If the PDP info complete IE is present, the old PDP info list shall be cleared. |
| 127 | |
| 128 | 3.2.7. Location Cancellation Request |
| 129 | |
| 130 | Network peer -> SGSN |
| 131 | |
| 132 | IEI Info Element Type Pres. Format Length |
| 133 | Message type 4.2.1 M V 1 |
| 134 | 01 IMSI 4.2.9 M TLV 2-10 |
| 135 | 06 Cancellation type 4.2.6 M TLV 3 |
| 136 | |
| 137 | 3.2.8. Location Cancellation Result |
| 138 | |
| 139 | SGSN -> Network peer |
| 140 | |
| 141 | IEI Info Element Type Pres. Format Length |
| 142 | Message type 4.2.1 M V 1 |
| 143 | 01 IMSI 4.2.9 M TLV 2-10 |
| 144 | |
| 145 | 3.2.9. Purge MS Request |
| 146 | |
| 147 | SGSN -> Network peer |
| 148 | |
| 149 | IEI Info Element Type Pres. Format Length |
| 150 | Message type 4.2.1 M V 1 |
| 151 | 01 IMSI 4.2.9 M TLV 2-10 |
| 152 | |
| 153 | 3.2.10. Purge MS Error |
| 154 | |
| 155 | Network peer -> SGSN |
| 156 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame] | 157 | IEI Info Element Type Pres. Format Length |
| 158 | Message type 4.2.1 M V 1 |
| 159 | 01 IMSI 4.2.9 M TLV 2-10 |
| 160 | 02 Cause GMM cause, M TLV 3 |
| 161 | 04.08: 10.5.5.14 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 162 | |
| 163 | 3.2.11. Purge MS Result |
| 164 | |
| 165 | Network peer -> SGSN |
| 166 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame] | 167 | IEI Info Element Type Pres. Format Length |
| 168 | Message type 4.2.1 M V 1 |
| 169 | 01 IMSI 4.2.9 M TLV 2-10 |
| 170 | 07 Freeze P-TMSI 4.2.8 O TLV 2 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 171 | |
| 172 | 3.2.12. Insert Subscriber Data Request |
| 173 | |
| 174 | Network peer -> SGSN |
| 175 | |
| 176 | IEI Info Element Type Pres. Format Length |
| 177 | Message type 4.2.1 M V 1 |
| 178 | 01 IMSI 4.2.9 M TLV 2-10 |
| 179 | 04 PDP info complete 4.2.8 O TLV 2 |
| 180 | 05 PDP info 4.2.3 0-10 TLV |
| 181 | |
| 182 | If the PDP info complete IE is present, the old PDP info list shall be cleared. |
| 183 | |
| 184 | 3.2.13. Insert Subscriber Data Error |
| 185 | |
| 186 | SGSN -> Network peer |
| 187 | |
| 188 | IEI Info Element Type Pres. Format Length |
| 189 | Message type 4.2.1 M V 1 |
| 190 | 01 IMSI 4.2.9 M TLV 2-10 |
| 191 | 02 Cause GMM cause, M TLV 3 |
| 192 | 04.08: 10.5.5.14 |
| 193 | |
| 194 | 3.2.14. Insert Subscriber Data Result |
| 195 | |
| 196 | SGSN -> Network peer |
| 197 | |
| 198 | IEI Info Element Type Pres. Format Length |
| 199 | Message type 4.2.1 M V 1 |
| 200 | 01 IMSI 4.2.9 M TLV 2-10 |
| 201 | |
| 202 | 3.2.15. Delete Subscriber Data Request |
| 203 | |
| 204 | Network peer -> SGSN |
| 205 | |
| 206 | IEI Info Element Type Pres. Format Length |
| 207 | Message type 4.2.1 M V 1 |
| 208 | 01 IMSI 4.2.9 M TLV 2-10 |
| 209 | 10 PDP context id 4.2.3 0-10 TLV |
| 210 | (no conditional IE) |
| 211 | |
| 212 | 3.2.16. Delete Subscriber Data Error |
| 213 | |
| 214 | SGSN -> Network peer |
| 215 | |
| 216 | IEI Info Element Type Pres. Format Length |
| 217 | Message type 4.2.1 M V 1 |
| 218 | 01 IMSI 4.2.9 M TLV 2-10 |
| 219 | 02 Cause GMM cause, M TLV 3 |
| 220 | 04.08: 10.5.5.14 |
| 221 | |
| 222 | 3.2.17. Delete Subscriber Data Result |
| 223 | |
| 224 | Network peer -> SGSN |
| 225 | |
| 226 | IEI Info Element Type Pres. Format Length |
| 227 | Message type 4.2.1 M V 1 |
| 228 | 01 IMSI 4.2.9 M TLV 2-10 |
| 229 | |
| 230 | 4. Information Elements |
| 231 | |
| 232 | 4.1. General |
| 233 | |
| 234 | [...] |
| 235 | |
| 236 | 4.2.1. Message Type |
| 237 | |
| 238 | +---------------------------------------------------+ |
| 239 | | 8 7 6 5 4 3 2 1 | |
| 240 | | | |
| 241 | | 0 0 0 0 0 1 0 0 - Update Location Request | |
| 242 | | 0 0 0 0 0 1 0 1 - Update Location Error | |
| 243 | | 0 0 0 0 0 1 1 0 - Update Location Result | |
| 244 | | | |
| 245 | | 0 0 0 0 1 0 0 0 - Send Auth Info Request | |
| 246 | | 0 0 0 0 1 0 0 1 - Send Auth Info Error | |
| 247 | | 0 0 0 0 1 0 1 0 - Send Auth Info Result | |
| 248 | | | |
| 249 | | 0 0 0 0 1 1 0 0 - Purge MS Request | |
| 250 | | 0 0 0 0 1 1 0 1 - Purge MS Error | |
| 251 | | 0 0 0 0 1 1 1 0 - Purge MS Result | |
| 252 | | | |
| 253 | | 0 0 0 1 0 0 0 0 - Insert Subscr. Data Request | |
| 254 | | 0 0 0 1 0 0 0 1 - Insert Subscr. Data Error | |
| 255 | | 0 0 0 1 0 0 1 0 - Insert Subscr. Data Result | |
| 256 | | | |
| 257 | | 0 0 0 1 0 1 0 0 - Delete Subscr. Data Request | |
| 258 | | 0 0 0 1 0 1 0 1 - Delete Subscr. Data Error | |
| 259 | | 0 0 0 1 0 1 1 0 - Delete Subscr. Data Result | |
| 260 | | | |
| 261 | | 0 0 0 1 1 1 0 0 - Location Cancellation Request | |
| 262 | | 0 0 0 1 1 1 0 1 - Location Cancellation Error | |
| 263 | | 0 0 0 1 1 1 1 0 - Location Cancellation Result | |
| 264 | | | |
| 265 | +---------------------------------------------------+ |
| 266 | |
| 267 | 4.2.2. IP Address |
| 268 | |
| 269 | The value part is encoded like in the Packet data protocol address IE defined |
| 270 | in GSM 04.08, 10.5.6.4. PDP type organization must be set to 'IETF allocated |
| 271 | address'. |
| 272 | |
| 273 | 4.2.3. PDP Info |
| 274 | |
| 275 | This is a container for information elements describing a single PDP. |
| 276 | |
| 277 | IEI Info Element Type Pres. Format Length |
| 278 | PDP Info IEI M V 1 |
| 279 | Length of PDP Info IE length, no ext M V 1 |
| 280 | 10 PDP context id big endian int, 1-N C TLV 3 |
| 281 | 11 PDP type 4.2.4 C TLV 4 |
| 282 | 12 Access point name 04.08, 10.5.6.1 C TLV 3-102 |
| Holger Hans Peter Freyther | 02d8c47 | 2015-04-22 22:42:23 -0400 | [diff] [blame^] | 283 | 13 Quality of Service 4.2.11 O TLV 1-20 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 284 | |
| 285 | The conditional IE are mandantory unless mentioned otherwise. |
| 286 | |
| 287 | 4.2.4. PDP Type |
| 288 | |
| 289 | The PDP type value consists of 2 octets that are encoded like octet 4-5 of the |
| 290 | End User Address defined in GSM 09.60, 7.9.18. |
| 291 | |
| 292 | 8 7 6 5 4 3 2 1 |
| 293 | +-----------------------------------------------------+ |
| 294 | | | PDP type IEI | octet 1 |
| 295 | +-----------------------------------------------------+ |
| 296 | | Length of PDP type IE contents (2) | octet 2 |
| 297 | +-----------------------------------------------------+ |
| 298 | | Spare | PDP type org. | octet 3 |
| 299 | +-----------------------------------------------------+ |
| 300 | | PDP type number | octet 4 |
| 301 | +-----------------------------------------------------+ |
| 302 | |
| 303 | The spare bits are left undefined. While 09.60 defines them as '1 1 1 1', there |
| 304 | are MAP traces where these bits are set to '0 0 0 0'. So the receiver shall |
| 305 | ignore these bits. |
| 306 | |
| 307 | Examples: |
| 308 | |
| 309 | IPv4: PDP type org: 1 (IETF), PDP type number: 0x21 |
| 310 | IPv6: PDP type org: 1 (IETF), PDP type number: 0x57 |
| 311 | |
| 312 | 4.2.5. Auth tuple |
| 313 | |
| 314 | This is a container for information elements describing a single authentication |
| 315 | tuple. |
| 316 | |
| 317 | IEI Info Element Type Pres. Format Length |
| 318 | Auth. Tuple IEI M V 1 |
| 319 | Length of Ath Tuple IE length, no ext M V 1 |
| 320 | 20 RAND octet string (16) M TLV 18 |
| 321 | 21 SRES octet string (4) M TLV 6 |
| 322 | 22 Kc octet string (8) M TLV 10 |
| 323 | |
| 324 | 4.2.6. Cancellation Type |
| 325 | |
| 326 | 8 7 6 5 4 3 2 1 |
| 327 | +-----------------------------------------------------+ |
| 328 | | | Cancellation type IEI | octet 1 |
| 329 | +-----------------------------------------------------+ |
| 330 | | Length of Cancellation Type IE contents (1) | octet 2 |
| 331 | +-----------------------------------------------------+ |
| 332 | | Cancellation type number | octet 4 |
| 333 | +-----------------------------------------------------+ |
| 334 | |
| 335 | Where the cancellation type number is: |
| 336 | |
| 337 | +---------------------------------------------------+ |
| 338 | | 8 7 6 5 4 3 2 1 | |
| 339 | | | |
| 340 | | 0 0 0 0 0 0 0 0 - Update Procedure | |
| 341 | | 0 0 0 0 0 0 0 1 - Subscription Withdraw | |
| 342 | +---------------------------------------------------+ |
| 343 | |
| 344 | 4.2.7. IE Identifier (informational) |
| 345 | |
| 346 | These are the standard values for the IEI. See the message definitions for the |
| 347 | IEI that shall be used for the encoding. |
| 348 | |
| 349 | +---------------------------------------------------------+ |
| 350 | | IEI Info Element Type | |
| 351 | | | |
| 352 | | 0x01 IMSI Mobile identity, 04.08: 10.5.1.4 | |
| 353 | | 0x02 Cause GMM cause, 04.08: 10.5.5.14 | |
| 354 | | 0x03 Auth tuple 4.2.5 | |
| 355 | | 0x04 PDP info compl 4.2.8 | |
| 356 | | 0x05 PDP info 4.2.3 | |
| 357 | | 0x06 Cancel type 4.2.6 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame] | 358 | | 0x07 Freeze P-TMSI 4.2.8 | |
| Holger Hans Peter Freyther | e448554 | 2015-04-22 22:10:44 -0400 | [diff] [blame] | 359 | | 0x08 MSISDN ISDN-AddressString/octet, 4.2.10 | |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 360 | | 0x10 PDP context id big endian int | |
| 361 | | 0x11 PDP type 4.2.4 | |
| 362 | | 0x12 APN 04.08, 10.5.6.1 | |
| Holger Hans Peter Freyther | 02d8c47 | 2015-04-22 22:42:23 -0400 | [diff] [blame^] | 363 | | 0x13 QoS 4.2.11 | |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 364 | | 0x20 RAND octet string | |
| 365 | | 0x21 SRES octet string | |
| 366 | | 0x22 Kc octet string | |
| 367 | +---------------------------------------------------------+ |
| 368 | |
| 369 | |
| 370 | 4.2.8 Empty field |
| 371 | |
| 372 | This is used for flags, if and only if this IE is present, the flag is set. |
| 373 | The semantics depend on the IEI and the context. |
| 374 | |
| 375 | 8 7 6 5 4 3 2 1 |
| 376 | +-----------------------------------------------------+ |
| 377 | | | IEI | octet 1 |
| 378 | +-----------------------------------------------------+ |
| 379 | | Length of IE contents (0) | octet 2 |
| 380 | +-----------------------------------------------------+ |
| 381 | |
| 382 | 4.2.9. IMSI |
| 383 | |
| 384 | The IMSI is encoded like in octet 4-N of the Called Party BCD Number defined in GSM 04.08, 10.5.4.7. |
| 385 | |
| 386 | 8 7 6 5 4 3 2 1 |
| 387 | +-----------------------------------------------------+ |
| 388 | | | IMSI IEI | octet 1 |
| 389 | +-----------------------------------------------------+ |
| 390 | | Length of IMSI IE contents | octet 2 |
| 391 | +-----------------------------------------------------+ |
| 392 | | Number digit 2 | Number digit 1 | octet 3 |
| 393 | +-----------------------------------------------------+ |
| 394 | | Number digit 4 | Number digit 3 | octet 4 |
| 395 | +-----------------------------------------------------+ |
| 396 | : : : |
| 397 | +-----------------------------------------------------+ |
| 398 | | see note 1) | octet 2+(N+1)div2 |
| 399 | +-----------------------------------------------------+ |
| 400 | |
| 401 | Note 1) Either '1 1 1 1 | Number digit N' (N odd) or |
| 402 | 'Number digit N | Number digit N-1' (N even), |
| 403 | where N is the number of digits. |
| Holger Hans Peter Freyther | e448554 | 2015-04-22 22:10:44 -0400 | [diff] [blame] | 404 | |
| 405 | 4.2.10. ISDN-AddressString / MSISDN / Called Party BCD Number |
| 406 | |
| 407 | The MSISDN is encoded as an ISDN-AddressString in GSM 09.02 and Called Party |
| 408 | BCD Number in GSM 04.08. It will be stored by the SGSN and then passed as is |
| 409 | to the GGSN during the activation of the primary PDP Context. |
| 410 | |
| 411 | 8 7 6 5 4 3 2 1 |
| 412 | +-----------------------------------------------------+ |
| 413 | | | IEI | octet 1 |
| 414 | +-----------------------------------------------------+ |
| 415 | | Length of IE contents | octet 2 |
| 416 | +-----------------------------------------------------+ |
| 417 | | ext | Type of num | Numbering plan | octet 2 |
| 418 | +-----------------------------------------------------+ |
| 419 | | Number digit 2 | Number digit 1 | octet 3 |
| 420 | +-----------------------------------------------------+ |
| 421 | | Number digit 4 | Number digit 3 | octet 4 |
| 422 | +-----------------------------------------------------+ |
| 423 | : : : |
| 424 | +-----------------------------------------------------+ |
| Holger Hans Peter Freyther | 02d8c47 | 2015-04-22 22:42:23 -0400 | [diff] [blame^] | 425 | |
| 426 | |
| 427 | 4.2.11 Quality of Service Subscribed Service |
| 428 | |
| 429 | This encodes the subscribed QoS of a subscriber. It will be used by the |
| 430 | SGSN during the PDP Context activation. If the length of the QoS data |
| 431 | is 3 (three) octets it is assumed that these are octets 3-5 of the TS |
| 432 | 3GPP TS 24.008 Quality of Service Octets. If it is more than three then |
| 433 | then it is assumed that the first octet is the Allocation/Retention |
| 434 | Priority and the reset are encoded as octets 3-N of 24.008. |
| 435 | |
| 436 | |
| 437 | 8 7 6 5 4 3 2 1 |
| 438 | +-----------------------------------------------------+ |
| 439 | | | IEI | octet 1 |
| 440 | +-----------------------------------------------------+ |
| 441 | | Length of IE contents | octet 2 |
| 442 | +-----------------------------------------------------+ |
| 443 | : : : |
| 444 | +-----------------------------------------------------+ |