| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 1 | |
| 2 | GPRS Subscriber Update Protocol |
| 3 | |
| 4 | 1. General |
| 5 | |
| 6 | This document describes the remote protocol that is used by the SGSN to update |
| 7 | and manage the local subscriber list. The protocol and the messages are |
| 8 | designed after the corresponding MAP messages (see GSM 09.02) with the |
| 9 | following differences: |
| 10 | |
| 11 | - The encoding uses TLV structures instead of ASN.1 encodings |
| 12 | - Segmentation is not used |
| 13 | |
| 14 | See the specification of the Gr interface (GSM 03.60). |
| 15 | |
| 16 | 2. Connection |
| 17 | |
| 18 | The protocol expects that a reliable, ordered, packet boundaries preserving |
| 19 | connection is used (e.g. IPA over TCP). The remote peer is either a service |
| 20 | that understands the protocol natively or a wrapper service that maps the |
| 21 | messages to/from real MAP messages that can be used to directly communicate |
| 22 | with an HLR. |
| 23 | |
| Jacob Erlbeck | 46684dc | 2014-12-15 10:16:02 +0100 | [diff] [blame] | 24 | 2.1. Using IPA |
| 25 | |
| 26 | By default, the following identifiers should be used: |
| 27 | - IPA protocol: 0xee (OSMO) |
| 28 | - IPA OSMO protocol extension: 0x05 |
| 29 | |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 30 | 2. Procedures |
| 31 | |
| 32 | 2.1. Authentication management |
| 33 | |
| 34 | The SGSN sends a SEND_AUTHENTICATION_INFO_REQ message containing the MS's IMSI |
| 35 | to the peer. On errors, especially if authentication info is not availabe for |
| 36 | that IMSI, the peer returns a SEND_AUTHENTICATION_INFO_ERR message. Otherwise |
| 37 | the peer returns a SEND_AUTHENTICATION_INFO_RES message. If this message |
| 38 | contains at least one authentication tuple, the SGSN replaces all tuples that |
| 39 | are assigned to the subscriber. If the message doesn't contain any tuple the |
| 40 | SGSN may reject the Attach Request. (see GSM 09.02, 25.5.6) |
| 41 | |
| 42 | 2.2. Location Updating |
| 43 | |
| 44 | The SGSN sends a UPDATE_LOCATION_REQ to the peer. If the request is denied by |
| 45 | the network, the peer returns an UPDATE_LOCATION_ERR message to the SGSN. |
| 46 | Otherwise the peer returns an UPDATE_LOCATION_RES message containing all |
| 47 | information fields that shall be inserted into the subscriber record. If |
| 48 | the 'PDP info complete' information element is set in the message, the SGSN |
| 49 | clears existing PDP information fields in the subscriber record first. |
| 50 | (see GSM 09.02, 19.1.1.8) |
| 51 | |
| 52 | [...] |
| 53 | |
| 54 | 3. Message Format |
| 55 | |
| 56 | 3.1. General |
| 57 | |
| 58 | Every message is based on the following message format |
| 59 | |
| 60 | IEI Info Element Type Pres. Format Length |
| 61 | Message type 4.2.1 M V 1 |
| 62 | 01 IMSI 4.2.9 M TLV 2-10 |
| 63 | |
| 64 | If a numeric range is indicated in the 'presence' column, multiple information |
| 65 | elements with the same tag may be used in sequence. The information elements |
| 66 | shall be sent in the given order. Nevertheless after the generic part the |
| 67 | receiver shall be able to received them in any order. Unknown IE shall be |
| 68 | ignored. |
| 69 | |
| 70 | 3.2.1. Send Authentication Info Request |
| 71 | |
| 72 | SGSN -> Network peer |
| 73 | |
| 74 | IEI Info Element Type Pres. Format Length |
| 75 | Message type 4.2.1 M V 1 |
| 76 | 01 IMSI 4.2.9 M TLV 2-10 |
| 77 | |
| 78 | 3.2.2. Send Authentication Info Error |
| 79 | |
| 80 | Network peer -> SGSN |
| 81 | |
| 82 | IEI Info Element Type Pres. Format Length |
| 83 | Message type 4.2.1 M V 1 |
| 84 | 01 IMSI 4.2.9 M TLV 2-10 |
| 85 | 02 Cause GMM cause, M TLV 3 |
| 86 | 04.08: 10.5.5.14 |
| 87 | |
| 88 | 3.2.3. Send Authentication Info Response |
| 89 | |
| 90 | Network peer -> SGSN |
| 91 | |
| 92 | IEI Info Element Type Pres. Format Length |
| 93 | Message type 4.2.1 M V 1 |
| 94 | 01 IMSI 4.2.9 M TLV 2-10 |
| 95 | 03 Auth tuple 4.2.5 0-5 TLV 36 |
| 96 | |
| 97 | 3.2.4. Update Location Request |
| 98 | |
| 99 | SGSN -> Network peer |
| 100 | |
| 101 | IEI Info Element Type Pres. Format Length |
| 102 | Message type 4.2.1 M V 1 |
| 103 | 01 IMSI 4.2.9 M TLV 2-10 |
| 104 | |
| 105 | 3.2.5. Update Location Error |
| 106 | |
| 107 | Network peer -> SGSN |
| 108 | |
| 109 | IEI Info Element Type Pres. Format Length |
| 110 | Message type 4.2.1 M V 1 |
| 111 | 01 IMSI 4.2.9 M TLV 2-10 |
| 112 | 02 Cause GMM cause, M TLV 3 |
| 113 | 04.08: 10.5.5.14 |
| 114 | |
| 115 | 3.2.6. Update Location Result |
| 116 | |
| 117 | Network peer -> SGSN |
| 118 | |
| 119 | IEI Info Element Type Pres. Format Length |
| 120 | Message type 4.2.1 M V 1 |
| 121 | 01 IMSI 4.2.9 M TLV 2-10 |
| 122 | 04 PDP info complete 4.2.8 O TLV 2 |
| 123 | 05 PDP info 4.2.3 1-10 TLV |
| 124 | |
| 125 | If the PDP info complete IE is present, the old PDP info list shall be cleared. |
| 126 | |
| 127 | 3.2.7. Location Cancellation Request |
| 128 | |
| 129 | Network peer -> SGSN |
| 130 | |
| 131 | IEI Info Element Type Pres. Format Length |
| 132 | Message type 4.2.1 M V 1 |
| 133 | 01 IMSI 4.2.9 M TLV 2-10 |
| 134 | 06 Cancellation type 4.2.6 M TLV 3 |
| 135 | |
| 136 | 3.2.8. Location Cancellation Result |
| 137 | |
| 138 | SGSN -> Network peer |
| 139 | |
| 140 | IEI Info Element Type Pres. Format Length |
| 141 | Message type 4.2.1 M V 1 |
| 142 | 01 IMSI 4.2.9 M TLV 2-10 |
| 143 | |
| 144 | 3.2.9. Purge MS Request |
| 145 | |
| 146 | SGSN -> Network peer |
| 147 | |
| 148 | IEI Info Element Type Pres. Format Length |
| 149 | Message type 4.2.1 M V 1 |
| 150 | 01 IMSI 4.2.9 M TLV 2-10 |
| 151 | |
| 152 | 3.2.10. Purge MS Error |
| 153 | |
| 154 | Network peer -> SGSN |
| 155 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame^] | 156 | IEI Info Element Type Pres. Format Length |
| 157 | Message type 4.2.1 M V 1 |
| 158 | 01 IMSI 4.2.9 M TLV 2-10 |
| 159 | 02 Cause GMM cause, M TLV 3 |
| 160 | 04.08: 10.5.5.14 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 161 | |
| 162 | 3.2.11. Purge MS Result |
| 163 | |
| 164 | Network peer -> SGSN |
| 165 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame^] | 166 | IEI Info Element Type Pres. Format Length |
| 167 | Message type 4.2.1 M V 1 |
| 168 | 01 IMSI 4.2.9 M TLV 2-10 |
| 169 | 07 Freeze P-TMSI 4.2.8 O TLV 2 |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 170 | |
| 171 | 3.2.12. Insert Subscriber Data Request |
| 172 | |
| 173 | Network peer -> SGSN |
| 174 | |
| 175 | IEI Info Element Type Pres. Format Length |
| 176 | Message type 4.2.1 M V 1 |
| 177 | 01 IMSI 4.2.9 M TLV 2-10 |
| 178 | 04 PDP info complete 4.2.8 O TLV 2 |
| 179 | 05 PDP info 4.2.3 0-10 TLV |
| 180 | |
| 181 | If the PDP info complete IE is present, the old PDP info list shall be cleared. |
| 182 | |
| 183 | 3.2.13. Insert Subscriber Data Error |
| 184 | |
| 185 | SGSN -> Network peer |
| 186 | |
| 187 | IEI Info Element Type Pres. Format Length |
| 188 | Message type 4.2.1 M V 1 |
| 189 | 01 IMSI 4.2.9 M TLV 2-10 |
| 190 | 02 Cause GMM cause, M TLV 3 |
| 191 | 04.08: 10.5.5.14 |
| 192 | |
| 193 | 3.2.14. Insert Subscriber Data Result |
| 194 | |
| 195 | SGSN -> Network peer |
| 196 | |
| 197 | IEI Info Element Type Pres. Format Length |
| 198 | Message type 4.2.1 M V 1 |
| 199 | 01 IMSI 4.2.9 M TLV 2-10 |
| 200 | |
| 201 | 3.2.15. Delete Subscriber Data Request |
| 202 | |
| 203 | Network peer -> SGSN |
| 204 | |
| 205 | IEI Info Element Type Pres. Format Length |
| 206 | Message type 4.2.1 M V 1 |
| 207 | 01 IMSI 4.2.9 M TLV 2-10 |
| 208 | 10 PDP context id 4.2.3 0-10 TLV |
| 209 | (no conditional IE) |
| 210 | |
| 211 | 3.2.16. Delete Subscriber Data Error |
| 212 | |
| 213 | SGSN -> Network peer |
| 214 | |
| 215 | IEI Info Element Type Pres. Format Length |
| 216 | Message type 4.2.1 M V 1 |
| 217 | 01 IMSI 4.2.9 M TLV 2-10 |
| 218 | 02 Cause GMM cause, M TLV 3 |
| 219 | 04.08: 10.5.5.14 |
| 220 | |
| 221 | 3.2.17. Delete Subscriber Data Result |
| 222 | |
| 223 | Network peer -> SGSN |
| 224 | |
| 225 | IEI Info Element Type Pres. Format Length |
| 226 | Message type 4.2.1 M V 1 |
| 227 | 01 IMSI 4.2.9 M TLV 2-10 |
| 228 | |
| 229 | 4. Information Elements |
| 230 | |
| 231 | 4.1. General |
| 232 | |
| 233 | [...] |
| 234 | |
| 235 | 4.2.1. Message Type |
| 236 | |
| 237 | +---------------------------------------------------+ |
| 238 | | 8 7 6 5 4 3 2 1 | |
| 239 | | | |
| 240 | | 0 0 0 0 0 1 0 0 - Update Location Request | |
| 241 | | 0 0 0 0 0 1 0 1 - Update Location Error | |
| 242 | | 0 0 0 0 0 1 1 0 - Update Location Result | |
| 243 | | | |
| 244 | | 0 0 0 0 1 0 0 0 - Send Auth Info Request | |
| 245 | | 0 0 0 0 1 0 0 1 - Send Auth Info Error | |
| 246 | | 0 0 0 0 1 0 1 0 - Send Auth Info Result | |
| 247 | | | |
| 248 | | 0 0 0 0 1 1 0 0 - Purge MS Request | |
| 249 | | 0 0 0 0 1 1 0 1 - Purge MS Error | |
| 250 | | 0 0 0 0 1 1 1 0 - Purge MS Result | |
| 251 | | | |
| 252 | | 0 0 0 1 0 0 0 0 - Insert Subscr. Data Request | |
| 253 | | 0 0 0 1 0 0 0 1 - Insert Subscr. Data Error | |
| 254 | | 0 0 0 1 0 0 1 0 - Insert Subscr. Data Result | |
| 255 | | | |
| 256 | | 0 0 0 1 0 1 0 0 - Delete Subscr. Data Request | |
| 257 | | 0 0 0 1 0 1 0 1 - Delete Subscr. Data Error | |
| 258 | | 0 0 0 1 0 1 1 0 - Delete Subscr. Data Result | |
| 259 | | | |
| 260 | | 0 0 0 1 1 1 0 0 - Location Cancellation Request | |
| 261 | | 0 0 0 1 1 1 0 1 - Location Cancellation Error | |
| 262 | | 0 0 0 1 1 1 1 0 - Location Cancellation Result | |
| 263 | | | |
| 264 | +---------------------------------------------------+ |
| 265 | |
| 266 | 4.2.2. IP Address |
| 267 | |
| 268 | The value part is encoded like in the Packet data protocol address IE defined |
| 269 | in GSM 04.08, 10.5.6.4. PDP type organization must be set to 'IETF allocated |
| 270 | address'. |
| 271 | |
| 272 | 4.2.3. PDP Info |
| 273 | |
| 274 | This is a container for information elements describing a single PDP. |
| 275 | |
| 276 | IEI Info Element Type Pres. Format Length |
| 277 | PDP Info IEI M V 1 |
| 278 | Length of PDP Info IE length, no ext M V 1 |
| 279 | 10 PDP context id big endian int, 1-N C TLV 3 |
| 280 | 11 PDP type 4.2.4 C TLV 4 |
| 281 | 12 Access point name 04.08, 10.5.6.1 C TLV 3-102 |
| 282 | |
| 283 | The conditional IE are mandantory unless mentioned otherwise. |
| 284 | |
| 285 | 4.2.4. PDP Type |
| 286 | |
| 287 | The PDP type value consists of 2 octets that are encoded like octet 4-5 of the |
| 288 | End User Address defined in GSM 09.60, 7.9.18. |
| 289 | |
| 290 | 8 7 6 5 4 3 2 1 |
| 291 | +-----------------------------------------------------+ |
| 292 | | | PDP type IEI | octet 1 |
| 293 | +-----------------------------------------------------+ |
| 294 | | Length of PDP type IE contents (2) | octet 2 |
| 295 | +-----------------------------------------------------+ |
| 296 | | Spare | PDP type org. | octet 3 |
| 297 | +-----------------------------------------------------+ |
| 298 | | PDP type number | octet 4 |
| 299 | +-----------------------------------------------------+ |
| 300 | |
| 301 | The spare bits are left undefined. While 09.60 defines them as '1 1 1 1', there |
| 302 | are MAP traces where these bits are set to '0 0 0 0'. So the receiver shall |
| 303 | ignore these bits. |
| 304 | |
| 305 | Examples: |
| 306 | |
| 307 | IPv4: PDP type org: 1 (IETF), PDP type number: 0x21 |
| 308 | IPv6: PDP type org: 1 (IETF), PDP type number: 0x57 |
| 309 | |
| 310 | 4.2.5. Auth tuple |
| 311 | |
| 312 | This is a container for information elements describing a single authentication |
| 313 | tuple. |
| 314 | |
| 315 | IEI Info Element Type Pres. Format Length |
| 316 | Auth. Tuple IEI M V 1 |
| 317 | Length of Ath Tuple IE length, no ext M V 1 |
| 318 | 20 RAND octet string (16) M TLV 18 |
| 319 | 21 SRES octet string (4) M TLV 6 |
| 320 | 22 Kc octet string (8) M TLV 10 |
| 321 | |
| 322 | 4.2.6. Cancellation Type |
| 323 | |
| 324 | 8 7 6 5 4 3 2 1 |
| 325 | +-----------------------------------------------------+ |
| 326 | | | Cancellation type IEI | octet 1 |
| 327 | +-----------------------------------------------------+ |
| 328 | | Length of Cancellation Type IE contents (1) | octet 2 |
| 329 | +-----------------------------------------------------+ |
| 330 | | Cancellation type number | octet 4 |
| 331 | +-----------------------------------------------------+ |
| 332 | |
| 333 | Where the cancellation type number is: |
| 334 | |
| 335 | +---------------------------------------------------+ |
| 336 | | 8 7 6 5 4 3 2 1 | |
| 337 | | | |
| 338 | | 0 0 0 0 0 0 0 0 - Update Procedure | |
| 339 | | 0 0 0 0 0 0 0 1 - Subscription Withdraw | |
| 340 | +---------------------------------------------------+ |
| 341 | |
| 342 | 4.2.7. IE Identifier (informational) |
| 343 | |
| 344 | These are the standard values for the IEI. See the message definitions for the |
| 345 | IEI that shall be used for the encoding. |
| 346 | |
| 347 | +---------------------------------------------------------+ |
| 348 | | IEI Info Element Type | |
| 349 | | | |
| 350 | | 0x01 IMSI Mobile identity, 04.08: 10.5.1.4 | |
| 351 | | 0x02 Cause GMM cause, 04.08: 10.5.5.14 | |
| 352 | | 0x03 Auth tuple 4.2.5 | |
| 353 | | 0x04 PDP info compl 4.2.8 | |
| 354 | | 0x05 PDP info 4.2.3 | |
| 355 | | 0x06 Cancel type 4.2.6 | |
| Jacob Erlbeck | cde0bb2 | 2015-01-09 09:46:43 +0100 | [diff] [blame^] | 356 | | 0x07 Freeze P-TMSI 4.2.8 | |
| Jacob Erlbeck | 0024cee | 2014-12-11 15:14:14 +0100 | [diff] [blame] | 357 | | 0x10 PDP context id big endian int | |
| 358 | | 0x11 PDP type 4.2.4 | |
| 359 | | 0x12 APN 04.08, 10.5.6.1 | |
| 360 | | 0x20 RAND octet string | |
| 361 | | 0x21 SRES octet string | |
| 362 | | 0x22 Kc octet string | |
| 363 | +---------------------------------------------------------+ |
| 364 | |
| 365 | |
| 366 | 4.2.8 Empty field |
| 367 | |
| 368 | This is used for flags, if and only if this IE is present, the flag is set. |
| 369 | The semantics depend on the IEI and the context. |
| 370 | |
| 371 | 8 7 6 5 4 3 2 1 |
| 372 | +-----------------------------------------------------+ |
| 373 | | | IEI | octet 1 |
| 374 | +-----------------------------------------------------+ |
| 375 | | Length of IE contents (0) | octet 2 |
| 376 | +-----------------------------------------------------+ |
| 377 | |
| 378 | 4.2.9. IMSI |
| 379 | |
| 380 | The IMSI is encoded like in octet 4-N of the Called Party BCD Number defined in GSM 04.08, 10.5.4.7. |
| 381 | |
| 382 | 8 7 6 5 4 3 2 1 |
| 383 | +-----------------------------------------------------+ |
| 384 | | | IMSI IEI | octet 1 |
| 385 | +-----------------------------------------------------+ |
| 386 | | Length of IMSI IE contents | octet 2 |
| 387 | +-----------------------------------------------------+ |
| 388 | | Number digit 2 | Number digit 1 | octet 3 |
| 389 | +-----------------------------------------------------+ |
| 390 | | Number digit 4 | Number digit 3 | octet 4 |
| 391 | +-----------------------------------------------------+ |
| 392 | : : : |
| 393 | +-----------------------------------------------------+ |
| 394 | | see note 1) | octet 2+(N+1)div2 |
| 395 | +-----------------------------------------------------+ |
| 396 | |
| 397 | Note 1) Either '1 1 1 1 | Number digit N' (N odd) or |
| 398 | 'Number digit N | Number digit N-1' (N even), |
| 399 | where N is the number of digits. |