CSFB主被叫信令流程介紹

1、CS Fallback基本信令介紹基本信令介紹2015.May.26鄭州鄭州p 聯(lián)合聯(lián)合注冊流程注冊流程p CSFB主被叫流程主被叫流程p 聯(lián)合跟蹤區(qū)更新流程聯(lián)合跟蹤區(qū)更新流程SIM2G4GBTSBSCMSSeNodeBMMEBTS/NODEBBSC/RNCMSSeNodeBMMESIM2G4GHLRHLR單卡雙待手機(jī)CSFB手機(jī)在2/3G及4G網(wǎng)絡(luò)同時(shí)注冊數(shù)據(jù)業(yè)務(wù)用4G網(wǎng)絡(luò)語音業(yè)務(wù)用2/3G網(wǎng)絡(luò)，接續(xù)時(shí)延短2/3G與LTE無需互操作僅在4G網(wǎng)絡(luò)注冊進(jìn)行主被叫時(shí)回落到GSM/TDS網(wǎng)絡(luò)，結(jié)束后再返回4G網(wǎng)絡(luò)。接續(xù)時(shí)延稍長單卡雙待與單卡雙待與CSFB手機(jī)的注冊手機(jī)的注冊聯(lián)合聯(lián)合EPS/IMSI附

2、著流程附著流程Attach request (Combined EPS/IMSI attach,GUTI,UE capacity,TAI,LAI)S6a-Update Location Request (MME name, IMSI) S6a-Update Location Accept (NAM =PACKET_AND_CIRCUIT)Create Session req (IMSI, MSISDN, QoS, APN)SGsAP-Update Location Request (LAI，IMSI, MME address) Location Update in CS domainSGsAP

3、-Update Location Accept (VLR Num, TMSI) InitialContextSetupRequest+Attach Accept (combined EPS/IMSI attach,TAI,GUTI,LAI,TMSI,)+ActivateDefault EPS Bearer Context Request(QCI,APN,PDN ADDRESS,QOS,APN-AMBR)Attach CompleteCreate Session resp (PDN add, TEID-C, TEID-U, EBI)eNBUEMMEMSC/VLRS/P-GWHSSInitialU

4、Emessage + AttachRequest+PDN connectivity RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC連接建立Identity request/responseTAI- LAI -MSC/VLRSecurityModeCommandUE CapabilityEnquirySecurityModeCompleteUE CapabilityInformationRRC Connection Rec

5、onfiguration+ Attach Accept(combined EPS/IMSI attach,TAI,GUTI,LAI,TMSI)RRC Connection Reconfiguration CompleteInitialContextSetupResponseUE CapabilityInformationIndicationActivateDefault EPS Bearer Context AcceptSecurityModeCommandSecurityModeCompleteSGsAP-TMSI-REALLOCATION-COMPLETE 如果在Attach Accept

6、包含新的TMSI如果NAM=ONLY_PACKET，MME不再向MSS發(fā)起LU流程，直接給UE回送TAU Accept 如果UE支持CSFB功能，會發(fā)起附著類型”Combined EPS/IMSI Attach”的附著請求。如果不支持CSFB功能，附著類型為”EPS Attach”。 UE是否具有GERAN/UTRAN重定向能力，通知給eNodeB及MME MME代替UE向MSS執(zhí)行LU過程。 如果LU過程成功，SGs的狀態(tài)為SGs-ASSOCIATED。為用戶建立了SGs關(guān)聯(lián)，就是在VLR中存儲了用戶的MME地址，同時(shí)也在MME中保存了用戶的VLR的地址。 如在聯(lián)合注冊過程中，MSS給用戶分

7、配了新的TMSI，卻未收到SGsAP-TMSI-REALLOCATION-COMPLETE，不影響該用戶SGs的狀態(tài)。CS Paging時(shí)用IMSI代替TMSI。 如果UE駐留在GERAN/UTRAN時(shí)，MSS通過A/Iu正在Paging該UE。此時(shí)UE發(fā)起聯(lián)合注冊，MSS會停止Paging，給MME返回SGsAP-LOCATION-UPDATE-ACCEPT 。 LU過程不成功，MSS發(fā)SGsAP-LOCATION-UPDATE-REJECT給MME。VLR將該用戶的SGs狀態(tài)置為SGs-NULL。在下一次聯(lián)合注冊成功之前，所有的CSFB被叫被拒絕。p 聯(lián)合注冊流程聯(lián)合注冊流程p CSFB主

8、被叫流程主被叫流程p 聯(lián)合跟蹤區(qū)更新流程聯(lián)合跟蹤區(qū)更新流程聯(lián)合聯(lián)合TAU流程流程Tracking Area Update (TAU) Request (Active Flag: No Bearerestablished Req,Combined TA/LA Update,GUTI,UE capacity,TAI,LAI)S6a-Update Location Request (MME name, IMSI) S6a-Update Location Accept(NAM =PACKET_AND_CIRCUIT) SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI, M

9、ME FQDN) Location Update in CS domainSGsA-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRS/P-GWHSSInitialUEmessage + TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection R

10、equestRRC連接建立TAI- LAI -MSC/VLRTAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEVLR 存儲存儲MME FQDN如果MSS/VLR收到Detach Request或從A/Iu發(fā)起的LU，則將用戶數(shù)據(jù)中的MME FQDN刪除。在下一次聯(lián)合TAU或聯(lián)合注冊之前，VLR不

11、再通過SGS接口進(jìn)行Paging。如果在SGsAP-Update Location Accept包含新的TMSI如果NAM=ONLY_PACKET，MME不再向MSS發(fā)起LU流程，直接給UE回送TAU AcceptModify Bearer RequestModify Bearer Responsep 聯(lián)合注冊流程聯(lián)合注冊流程p CSFB主被叫流程主被叫流程p 聯(lián)合跟蹤區(qū)更新流程聯(lián)合跟蹤區(qū)更新流程eNodeBMMEUEBTSBSCMSS/VLRUEHLR/HSSLTE-UuS1-MMEA-bisACS6aUmSGsCSFB主叫在主叫在4G，被叫，被叫在在2/3G被叫路由主叫路由CSFB主叫流程

12、主叫流程UEeNBMMEMSSRRCConnectionSetupComplete+ExtendedServiceRequest(MO CS fallback,M-TMSI)Random Access SequenceRRCConnectionSetupRequestRRCConnectionSetupRRC連接建立ExtendedServiceRequestInitialContextSetupRequest(CS Fallback Required)InitialContextSetupResponseRRCConnectionReleaseUEContextReleaseRequest(

13、CS fallback triggered)UEContextReleaseCommand(CS fallback triggered)UEContextReleaseCompleteRedirect consists of 3 phases: Redirection decision phase (generation trigger for redirect) Selection of redirect target based on UE capabilities and redirect priorities Redirect execution 主叫流程中主叫流程中沒有任何沒有任何S

14、Gs接口信接口信令消息令消息Return to 2GCSFB-MO回落至回落至2/3G后后UEBTSBSCMSSCamp on BTSSystem Infromation Type 3 (LAC = xxxx)Location Update Request (Follow-on Request,CSMO Flag)Location Update Accept回落前后LAC有變化CM Service Request(CSMO)CM Service Accept。在CSFB流程中，如果在2/3G網(wǎng)絡(luò)中需要重新發(fā)起位置更新，手機(jī)終端需要在位置更新請求消息中加入CSMO標(biāo)志，提示當(dāng)前信令連接可以同時(shí)服

15、務(wù)于后續(xù)的呼叫接續(xù)；當(dāng)MSC收到終端發(fā)起的位置更新請求時(shí)，MSC需要檢查請求消息中是CSMO標(biāo)志：MSS會更新相應(yīng)的統(tǒng)計(jì)計(jì)數(shù)器。eNodeBMMEUEBTSBSCMSS/VLRUEHLR/HSSLTE-UuS1-MMEA-bisACS6aUmSGs主叫在主叫在2/3G，CSFB被叫被叫在在4G主叫路由被叫路由MSSMMEeNBUERRCConnectionSetupComplete+ExtendedServiceRequest(MT CS fallback,M-TMSI,CSFB response:Accept)S1AP-InitialUEMessage+Extended service re

16、quest(MT CS fallback,M-TMSI,CSFB response:Accept,ECGI,TAI)S1AP-InitialContextSetupRequest (cs-fallback-required,LAI)S1AP-InitialContextSetupResponseS1AP-Paging(UEIdentityIndexValue : 1101101110B,s-TMSI,cnDomain:cs,TAI )Paging Response(CS-TMSI)CSFB-MT(UE:ECM-IDLE)RRC connection release(RedirectedCarr

17、ierInfo)SGsAP-PAGING-REQUEST(IMSI,MME Name,CS CALL Indicator,TMSI,new LAI, Global CN-ID)SGsAP-SERVICE-REQUEST(IMSI,CS CALL INDICATOR,TAI,ECGI,UE ECM MODE:ECM-IDLE)Paging(s-TMSI,cnDomain:cs)S1AP-UEContextReleaseRequest(cs-fallback-triggered)S1AP-UEContextReleaseCommand(cs-fallback-triggered)S1AP-UECo

18、ntextReleaseCompleteRandom Access SequenceIMSI mod 1024 S1AP連接建立S1AP連接釋放RRCConnectionSetupRequestRRCConnectionSetupRRC連接建立RRC連接釋放MSS:CSMT呼叫他局回落次數(shù)MSS/VLR收到來自HLR的MAP_CANCEL_LOCATION消息。Stop PagingReturn to 2GMME收到MSS發(fā)送的SGsAP-PAGING-REQUEST，首先在數(shù)據(jù)庫里檢查是否有此用戶。如果可以找到該IMSI，將Paging消息通過eNodeB發(fā)送給UE，等待UE發(fā)送ESR。如果

19、MME收不到ESR，MME無需向MSS響應(yīng)。MME可能會拒絕MSS發(fā)送的Paging Request：1、在數(shù)據(jù)庫找不到該用戶。2、UE設(shè)置Detach標(biāo)志。3、UE拒絕MT-CSFB請求。MSSMMEeNBUEEMM-Extended service request(MT CS fallback,M-TMSI,CSFB response:Accept)S1AP-Extended service request(MT CS fallback,M-TMSI,CSFB response:Accept,ECGI,TAI)S1AP-UE-CONTEXT-MODIFICATION-REQUEST(cs-

20、fallback-required,LAI)S1AP-UE-CONTEXT-MODIFICATION-RESPONSES1AP-CS service notification(Paging Identity Value:TMSI)Paging ResponseCSFB-MT(UE:ECM-connected)RRC connection release(RedirectedCarrierInfo)SGsAP-PAGING-REQUEST(IMSI,MME Name,CS CALL Indicator,TMSI,new LAI, Global CN-ID)SGsAP-SERVICE-REQUES

21、T(IMSI,CS CALL INDICATOR,TAI,ECGI,UE ECM MODE:ECM-Connected)EMM-CS service notification(Paging Identity Value:TMSI)S1AP-UEContextReleaseRequest(cs-fallback-triggered)S1AP-UEContextReleaseCommand(cs-fallback-triggered)S1AP-UEContextReleaseComplete信令流程與信令流程與2G被叫信令流程相同被叫信令流程相同Stop PagingPAGING_ACCEPT_T

22、IMERReturn to 2GCSFB-MT回落至回落至2G后后UEBTSBSCMSSCamp on BTSSystem Infromation Type 3 (LAC = xxxx)LAC in UE=xxxxPaging ResponseYLocation Update Request (CSMT)NLocation Update AcceptSetupCall Confirm回落前后LAC有變化回落前后LAC無變化Assignment PrecedureAlertingConnectConnect Acknowledge在CSFB流程中，如果在2/3G網(wǎng)絡(luò)中需要重新發(fā)起位置更新，手機(jī)終

23、端需要在位置更新請求消息中加入CSMT標(biāo)志，提示當(dāng)前信令連接可以同時(shí)服務(wù)于后續(xù)的呼叫接續(xù)；當(dāng)MSC收到終端發(fā)起的位置更新請求時(shí)，MSC需要檢查請求消息中是CSMT標(biāo)志：如果CSMT標(biāo)志位置位，則MSC將在完成位置更新流程后保留信令連接，啟動(dòng)定時(shí)器T3255以等待即將來臨的呼叫接續(xù)。SGs-Paging尋呼策略 尋呼間隔和尋呼次數(shù)繼承A/Iu的尋呼機(jī)制 可以配置SGs接口是否使用IMSI尋呼 可以配置SGs接口尋呼失敗后是否繼續(xù)A/Iu接口尋呼 可以配置SGs接口的EXTRA PAGING DELAY TIMER。PS尋呼共Paging5次，間隔為6秒CS尋呼共Paging3次，間隔為5.5秒尋

24、呼無響應(yīng)尋呼無響應(yīng)尋呼有響應(yīng)尋呼有響應(yīng)SGs接口接口S1AP接口接口TAU和和Paging流程沖突流程沖突處理機(jī)制加強(qiáng)處理機(jī)制加強(qiáng)Tracking Area Update (TAU) Request SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI, MME FQDN) SGsAP-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRInitialUEmessage +

25、TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC連接建立TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEUE正在

26、進(jìn)行TAU，此時(shí)MSC發(fā)給MME尋呼消息，由于流程沖突，MME直接給MSC回送Paging Reject。MSC收到Paging Reject后，不會進(jìn)行二次尋呼。尋呼失敗。SGsAP-Paging Request SGsAP-Paging RejectMME檢測到TAU和Paging流程沖突TAU和和Paging流程沖突流程沖突處理機(jī)制加強(qiáng)前的操作處理機(jī)制加強(qiáng)前的操作TAU和和Paging流程沖突流程沖突處理機(jī)制加強(qiáng)后的操作處理機(jī)制加強(qiáng)后的操作Tracking Area Update (TAU) Request SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI,

27、 MME FQDN) SGsAP-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRInitialUEmessage + TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC連接建立TAU Accept (Combined

28、TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEUE正在進(jìn)行TAU，此時(shí)MSC發(fā)給MME尋呼消息， 雖然流程依然沖突，但由于MME流程沖突的處理機(jī)制加強(qiáng)，MME不給MSC回送Service Request或Paging Reject。MSC在尋呼間隔(通常為3000ms)超時(shí)前，未收到Service Request或Paging Re

29、ject ，發(fā)起二次尋呼。因?yàn)門AU的處理周期很短，大約為3050ms，MME在收到二次尋呼時(shí)，TAU已經(jīng)結(jié)束，MME可以正常給UE轉(zhuǎn)發(fā)Paging Request。SGsAP-Paging Request MME檢測到TAU和Paging流程沖突，不會給MSC回送Paging Reject。SGsAP-Paging Request Paging Request Paging Request 第一次位置更新：未收到SGsAP-tmsi-reallocation-complete，交換機(jī)等待40s在Wireshark里未找到該過程等待40s，仍未收到SGsAP-tmsi-reallocation

30、-complete，釋放了第一次位置更新過程。第二次位置更新過程，交換機(jī)拒絕第二次位置更新過程，交換機(jī)拒絕第三次位置更新過程，交換機(jī)拒絕第三次位置更新過程，交換機(jī)拒絕第四次位置更新過程，交換機(jī)拒絕第四次位置更新過程，交換機(jī)拒絕第五次位置更新過程，交換機(jī)拒絕第五次位置更新過程，交換機(jī)拒絕MSS位置更新拒絕5.2.3.4 TMSI reallocation procedureIf the VLR decides to allocate a new TMSI to the UE, the VLR shall include the new TMSI in the SGsAP-LOCATIONUPDA

31、TE-ACCEPT message. After sending the SGsAP-LOCATION-UPDATE-ACCEPT message with a new TMSI the VLR shall start timer Ts6-2. If the VLR decides to deallocate the TMSI of the UE, the VLR shall include the IMSI of the UE in the SGsAP-LOCATION-UPDATE-ACCEPT message.Upon receipt of the SGsAP-TMSI-REALLOCA

32、TION-COMPLETE message, the VLR shall stop the timer Ts6-2 and consider the new TMSI as valid.If no SGsAP-TMSI-REALLOCATION-COMPLETE message is received by the VLR before the timer Ts6-2 expires, the VLR aborts the TMSI reallocation procedure. Pool邊界被叫邊界被叫UE回落至相鄰回落至相鄰PoolUENew BSC/BTSOld MSSENBMMESgs

33、-PagingExtended Service RequestCS Service NotificationRRC Connection Release(ARFCN:75,79,84.)System Information Type3(LAC:14338)UE根據(jù)收到的2G頻點(diǎn)回落至2GLocation Update Request(old LAC:14129)New MSSAuthentication RequestAuthentication ResponseIdentity RequestIdentity Response因?yàn)榛芈涞降腖AC與聯(lián)合位置更新的LAC(UE存儲LAC)不一致，

34、UE需要發(fā)起攜帶CSMT字段的LULocation Update AcceptTMSI Reallocation Complete因?yàn)?New MSS未支持MTRF功能及CSFB功能，將該LU當(dāng)做是正常的位置更新，而沒有將其當(dāng)做CSFB的被叫時(shí)的LU。導(dǎo)致被叫失敗。為解決Pool邊界的CSFB被叫失敗，建議MSS上加裝該功能。(Feature 2028)Old MSS 發(fā)起的Paging，LU回送給了New MSS。CSFB被叫失敗。272013 Nokia Solutions and Networks. All rights reserved.被叫Pool1-MSC被叫Pool2-MSCMME被叫HLR主叫MSC被叫UEIAMPagingPagingLocation Update RequestSend IdentificationSend Identification AckUpdate LocationUpdate Loc