CSFB主被叫信令流程介绍

1、CS Fallback基本信令介绍基本信令介绍2015.May.26郑州郑州p 联合联合注册流程注册流程p CSFB主被叫流程主被叫流程p 联合跟踪区更新流程联合跟踪区更新流程SIM2G4GBTSBSCMSSeNodeBMMEBTS/NODEBBSC/RNCMSSeNodeBMMESIM2G4GHLRHLR单卡双待手机CSFB手机在2/3G及4G网络同时注册数据业务用4G网络语音业务用2/3G网络，接续时延短2/3G与LTE无需互操作仅在4G网络注册进行主被叫时回落到GSM/TDS网络，结束后再返回4G网络。接续时延稍长单卡双待与单卡双待与CSFB手机的注册手机的注册联合联合EPS/IMSI附

2、着流程附着流程Attach request (Combined EPS/IMSI attach,GUTI,UE capacity,TAI,LAI)S6a-Update Location Request (MME name, IMSI) S6a-Update Location Accept (NAM =PACKET_AND_CIRCUIT)Create Session req (IMSI, MSISDN, QoS, APN)SGsAP-Update Location Request (LAI，IMSI, MME address) Location Update in CS domainSGsAP

3、-Update Location Accept (VLR Num, TMSI) InitialContextSetupRequest+Attach Accept (combined EPS/IMSI attach,TAI,GUTI,LAI,TMSI,)+ActivateDefault EPS Bearer Context Request(QCI,APN,PDN ADDRESS,QOS,APN-AMBR)Attach CompleteCreate Session resp (PDN add, TEID-C, TEID-U, EBI)eNBUEMMEMSC/VLRS/P-GWHSSInitialU

4、Emessage + AttachRequest+PDN connectivity RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC连接建立Identity request/responseTAI- LAI -MSC/VLRSecurityModeCommandUE CapabilityEnquirySecurityModeCompleteUE CapabilityInformationRRC Connection Rec

5、onfiguration+ Attach Accept(combined EPS/IMSI attach,TAI,GUTI,LAI,TMSI)RRC Connection Reconfiguration CompleteInitialContextSetupResponseUE CapabilityInformationIndicationActivateDefault EPS Bearer Context AcceptSecurityModeCommandSecurityModeCompleteSGsAP-TMSI-REALLOCATION-COMPLETE 如果在Attach Accept

6、包含新的TMSI如果NAM=ONLY_PACKET，MME不再向MSS发起LU流程，直接给UE回送TAU Accept 如果UE支持CSFB功能，会发起附着类型”Combined EPS/IMSI Attach”的附着请求。如果不支持CSFB功能，附着类型为”EPS Attach”。 UE是否具有GERAN/UTRAN重定向能力，通知给eNodeB及MME MME代替UE向MSS执行LU过程。 如果LU过程成功，SGs的状态为SGs-ASSOCIATED。为用户建立了SGs关联，就是在VLR中存储了用户的MME地址，同时也在MME中保存了用户的VLR的地址。 如在联合注册过程中，MSS给用户分

7、配了新的TMSI，却未收到SGsAP-TMSI-REALLOCATION-COMPLETE，不影响该用户SGs的状态。CS Paging时用IMSI代替TMSI。 如果UE驻留在GERAN/UTRAN时，MSS通过A/Iu正在Paging该UE。此时UE发起联合注册，MSS会停止Paging，给MME返回SGsAP-LOCATION-UPDATE-ACCEPT 。 LU过程不成功，MSS发SGsAP-LOCATION-UPDATE-REJECT给MME。VLR将该用户的SGs状态置为SGs-NULL。在下一次联合注册成功之前，所有的CSFB被叫被拒绝。p 联合注册流程联合注册流程p CSFB主

8、被叫流程主被叫流程p 联合跟踪区更新流程联合跟踪区更新流程联合联合TAU流程流程Tracking Area Update (TAU) Request (Active Flag: No Bearerestablished Req,Combined TA/LA Update,GUTI,UE capacity,TAI,LAI)S6a-Update Location Request (MME name, IMSI) S6a-Update Location Accept(NAM =PACKET_AND_CIRCUIT) SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI, M

9、ME FQDN) Location Update in CS domainSGsA-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRS/P-GWHSSInitialUEmessage + TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection R

10、equestRRC连接建立TAI- LAI -MSC/VLRTAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEVLR 存储存储MME FQDN如果MSS/VLR收到Detach Request或从A/Iu发起的LU，则将用户数据中的MME FQDN删除。在下一次联合TAU或联合注册之前，VLR不

11、再通过SGS接口进行Paging。如果在SGsAP-Update Location Accept包含新的TMSI如果NAM=ONLY_PACKET，MME不再向MSS发起LU流程，直接给UE回送TAU AcceptModify Bearer RequestModify Bearer Responsep 联合注册流程联合注册流程p CSFB主被叫流程主被叫流程p 联合跟踪区更新流程联合跟踪区更新流程eNodeBMMEUEBTSBSCMSS/VLRUEHLR/HSSLTE-UuS1-MMEA-bisACS6aUmSGsCSFB主叫在主叫在4G，被叫，被叫在在2/3G被叫路由主叫路由CSFB主叫流程

12、主叫流程UEeNBMMEMSSRRCConnectionSetupComplete+ExtendedServiceRequest(MO CS fallback,M-TMSI)Random Access SequenceRRCConnectionSetupRequestRRCConnectionSetupRRC连接建立ExtendedServiceRequestInitialContextSetupRequest(CS Fallback Required)InitialContextSetupResponseRRCConnectionReleaseUEContextReleaseRequest(

13、CS fallback triggered)UEContextReleaseCommand(CS fallback triggered)UEContextReleaseCompleteRedirect consists of 3 phases: Redirection decision phase (generation trigger for redirect) Selection of redirect target based on UE capabilities and redirect priorities Redirect execution 主叫流程中主叫流程中没有任何没有任何S

14、Gs接口信接口信令消息令消息Return to 2GCSFB-MO回落至回落至2/3G后后UEBTSBSCMSSCamp on BTSSystem Infromation Type 3 (LAC = xxxx)Location Update Request (Follow-on Request,CSMO Flag)Location Update Accept回落前后LAC有变化CM Service Request(CSMO)CM Service Accept。在CSFB流程中，如果在2/3G网络中需要重新发起位置更新，手机终端需要在位置更新请求消息中加入CSMO标志，提示当前信令连接可以同时服

15、务于后续的呼叫接续；当MSC收到终端发起的位置更新请求时，MSC需要检查请求消息中是CSMO标志：MSS会更新相应的统计计数器。eNodeBMMEUEBTSBSCMSS/VLRUEHLR/HSSLTE-UuS1-MMEA-bisACS6aUmSGs主叫在主叫在2/3G，CSFB被叫被叫在在4G主叫路由被叫路由MSSMMEeNBUERRCConnectionSetupComplete+ExtendedServiceRequest(MT CS fallback,M-TMSI,CSFB response:Accept)S1AP-InitialUEMessage+Extended service re

16、quest(MT CS fallback,M-TMSI,CSFB response:Accept,ECGI,TAI)S1AP-InitialContextSetupRequest (cs-fallback-required,LAI)S1AP-InitialContextSetupResponseS1AP-Paging(UEIdentityIndexValue : 1101101110B,s-TMSI,cnDomain:cs,TAI )Paging Response(CS-TMSI)CSFB-MT(UE:ECM-IDLE)RRC connection release(RedirectedCarr

17、ierInfo)SGsAP-PAGING-REQUEST(IMSI,MME Name,CS CALL Indicator,TMSI,new LAI, Global CN-ID)SGsAP-SERVICE-REQUEST(IMSI,CS CALL INDICATOR,TAI,ECGI,UE ECM MODE:ECM-IDLE)Paging(s-TMSI,cnDomain:cs)S1AP-UEContextReleaseRequest(cs-fallback-triggered)S1AP-UEContextReleaseCommand(cs-fallback-triggered)S1AP-UECo

18、ntextReleaseCompleteRandom Access SequenceIMSI mod 1024 S1AP连接建立S1AP连接释放RRCConnectionSetupRequestRRCConnectionSetupRRC连接建立RRC连接释放MSS:CSMT呼叫他局回落次数MSS/VLR收到来自HLR的MAP_CANCEL_LOCATION消息。Stop PagingReturn to 2GMME收到MSS发送的SGsAP-PAGING-REQUEST，首先在数据库里检查是否有此用户。如果可以找到该IMSI，将Paging消息通过eNodeB发送给UE，等待UE发送ESR。如果

19、MME收不到ESR，MME无需向MSS响应。MME可能会拒绝MSS发送的Paging Request：1、在数据库找不到该用户。2、UE设置Detach标志。3、UE拒绝MT-CSFB请求。MSSMMEeNBUEEMM-Extended service request(MT CS fallback,M-TMSI,CSFB response:Accept)S1AP-Extended service request(MT CS fallback,M-TMSI,CSFB response:Accept,ECGI,TAI)S1AP-UE-CONTEXT-MODIFICATION-REQUEST(cs-

20、fallback-required,LAI)S1AP-UE-CONTEXT-MODIFICATION-RESPONSES1AP-CS service notification(Paging Identity Value:TMSI)Paging ResponseCSFB-MT(UE:ECM-connected)RRC connection release(RedirectedCarrierInfo)SGsAP-PAGING-REQUEST(IMSI,MME Name,CS CALL Indicator,TMSI,new LAI, Global CN-ID)SGsAP-SERVICE-REQUES

21、T(IMSI,CS CALL INDICATOR,TAI,ECGI,UE ECM MODE:ECM-Connected)EMM-CS service notification(Paging Identity Value:TMSI)S1AP-UEContextReleaseRequest(cs-fallback-triggered)S1AP-UEContextReleaseCommand(cs-fallback-triggered)S1AP-UEContextReleaseComplete信令流程与信令流程与2G被叫信令流程相同被叫信令流程相同Stop PagingPAGING_ACCEPT_T

22、IMERReturn to 2GCSFB-MT回落至回落至2G后后UEBTSBSCMSSCamp on BTSSystem Infromation Type 3 (LAC = xxxx)LAC in UE=xxxxPaging ResponseYLocation Update Request (CSMT)NLocation Update AcceptSetupCall Confirm回落前后LAC有变化回落前后LAC无变化Assignment PrecedureAlertingConnectConnect Acknowledge在CSFB流程中，如果在2/3G网络中需要重新发起位置更新，手机终

23、端需要在位置更新请求消息中加入CSMT标志，提示当前信令连接可以同时服务于后续的呼叫接续；当MSC收到终端发起的位置更新请求时，MSC需要检查请求消息中是CSMT标志：如果CSMT标志位置位，则MSC将在完成位置更新流程后保留信令连接，启动定时器T3255以等待即将来临的呼叫接续。SGs-Paging寻呼策略 寻呼间隔和寻呼次数继承A/Iu的寻呼机制 可以配置SGs接口是否使用IMSI寻呼 可以配置SGs接口寻呼失败后是否继续A/Iu接口寻呼 可以配置SGs接口的EXTRA PAGING DELAY TIMER。PS寻呼共Paging5次，间隔为6秒CS寻呼共Paging3次，间隔为5.5秒寻

24、呼无响应寻呼无响应寻呼有响应寻呼有响应SGs接口接口S1AP接口接口TAU和和Paging流程冲突流程冲突处理机制加强处理机制加强Tracking Area Update (TAU) Request SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI, MME FQDN) SGsAP-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRInitialUEmessage +

25、TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC连接建立TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEUE正在

26、进行TAU，此时MSC发给MME寻呼消息，由于流程冲突，MME直接给MSC回送Paging Reject。MSC收到Paging Reject后，不会进行二次寻呼。寻呼失败。SGsAP-Paging Request SGsAP-Paging RejectMME检测到TAU和Paging流程冲突TAU和和Paging流程冲突流程冲突处理机制加强前的操作处理机制加强前的操作TAU和和Paging流程冲突流程冲突处理机制加强后的操作处理机制加强后的操作Tracking Area Update (TAU) Request SGsAP-LOCATION-UPDATE-REQUEST (LAI，IMSI,

27、 MME FQDN) SGsAP-LOCATION UPDATE ACCEPT(VLR Num, TMSI) TAU Accept (Combined TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)TAU CompleteeNBUEMMEMSC/VLRInitialUEmessage + TAU RequestRandom Access SequenceRRC Connection Setup CompleteRRC Connection Setup RequestRRC Connection RequestRRC连接建立TAU Accept (Combined

28、TA/LA Updated,T3412,TAI,GUTI,LAI,TMSI)UEContextReleaseCommand (Normal Release)RRC Connection ReleaseUEContextReleaseCompleteSGsAP-TMSI-REALLOCATION-COMPLETEUE正在进行TAU，此时MSC发给MME寻呼消息， 虽然流程依然冲突，但由于MME流程冲突的处理机制加强，MME不给MSC回送Service Request或Paging Reject。MSC在寻呼间隔(通常为3000ms)超时前，未收到Service Request或Paging Re

29、ject ，发起二次寻呼。因为TAU的处理周期很短，大约为3050ms，MME在收到二次寻呼时，TAU已经结束，MME可以正常给UE转发Paging Request。SGsAP-Paging Request MME检测到TAU和Paging流程冲突，不会给MSC回送Paging Reject。SGsAP-Paging Request Paging Request Paging Request 第一次位置更新：未收到SGsAP-tmsi-reallocation-complete，交换机等待40s在Wireshark里未找到该过程等待40s，仍未收到SGsAP-tmsi-reallocation

30、-complete，释放了第一次位置更新过程。第二次位置更新过程，交换机拒绝第二次位置更新过程，交换机拒绝第三次位置更新过程，交换机拒绝第三次位置更新过程，交换机拒绝第四次位置更新过程，交换机拒绝第四次位置更新过程，交换机拒绝第五次位置更新过程，交换机拒绝第五次位置更新过程，交换机拒绝MSS位置更新拒绝5.2.3.4 TMSI reallocation procedureIf the VLR decides to allocate a new TMSI to the UE, the VLR shall include the new TMSI in the SGsAP-LOCATIONUPDA

31、TE-ACCEPT message. After sending the SGsAP-LOCATION-UPDATE-ACCEPT message with a new TMSI the VLR shall start timer Ts6-2. If the VLR decides to deallocate the TMSI of the UE, the VLR shall include the IMSI of the UE in the SGsAP-LOCATION-UPDATE-ACCEPT message.Upon receipt of the SGsAP-TMSI-REALLOCA

32、TION-COMPLETE message, the VLR shall stop the timer Ts6-2 and consider the new TMSI as valid.If no SGsAP-TMSI-REALLOCATION-COMPLETE message is received by the VLR before the timer Ts6-2 expires, the VLR aborts the TMSI reallocation procedure. Pool边界边界被叫被叫UE回落至相邻回落至相邻PoolUENew BSC/BTSOld MSSENBMMESgs

33、-PagingExtended Service RequestCS Service NotificationRRC Connection Release(ARFCN:75,79,84.)System Information Type3(LAC:14338)UE根据收到的2G频点回落至2GLocation Update Request(old LAC:14129)New MSSAuthentication RequestAuthentication ResponseIdentity RequestIdentity Response因为回落到的LAC与联合位置更新的LAC(UE存储LAC)不一致，

34、UE需要发起携带CSMT字段的LULocation Update AcceptTMSI Reallocation Complete因为 New MSS未支持MTRF功能及CSFB功能，将该LU当做是正常的位置更新，而没有将其当做CSFB的被叫时的LU。导致被叫失败。为解决Pool边界的CSFB被叫失败，建议MSS上加装该功能。(Feature 2028)Old MSS 发起的Paging，LU回送给了New MSS。CSFB被叫失败。272013 Nokia Solutions and Networks. All rights reserved.被叫Pool1-MSC被叫Pool2-MSCMME被叫HLR主叫MSC被叫UEIAMPagingPagingLocation Update RequestSend IdentificationSend Identification AckUpdate LocationUpdate Loc