MAP Protocol in GSM explained. 

The full form of MAP is the Mobile Application Part. This is an application layer protocol of the SS7 protocol suit. It uses the services of the TCAP layer. Map Protocol provides the specifications for roaming, messaging, and data.

It has a set of messages which carry the gsm level signaling parameters for a mobile device to attach to the network and carries signaling required for roaming, voice, and SMS. An SSN identifies each map user over the SCCP layer. Following is the list of SSNs for the MAP layer users.

HLR have SSN 6.
VLR have SSN 7 
MSC have SSN 8
SGSN have SSN 9

There are other nodes in ss7 using MAP which have SSN from the above list. E.g GMSC and SMSC uses SSN 8.

Map protocol primitives mapping with the TCAP messages:

MAP uses the services of the TCAP layer. Each MAP primitive has a corresponding TCAP message. Similarly, each TCAP message from the network indicates to the MAP user. The following paragraphs explain the mapping of primitives.

List of primitives from map users to TCAP messages.

  1. MAP_OPEN_REQUEST is the primitive used by the MAP user to start a new dialogue. The parameters are Calling SCCP address, Called SCCP address, and Application context. Upon receiving MAP_OPEN_REQUEST, the TCAP layer creates a new dialogue locally.
  2. MAP_SERVICE_REQUEST sends the actual map protocol operation to the TCAP layer. Upon receiving MAP_SERVICE_REQUEST, TCAP stores the map operation locally against the opened dialogue.
  3. MAP_DELIMIT_REQUEST primitive sends the message to the network; after receiving MAP_DELIMIT_REQUEST, the TCAP layer sends the TCAP_BEGIN to the destination node with the map operation. If this is received for an existing dialogue (no open), the TCAP_CONTINUE is sent to the network.
  4. MAP_CLOSE  from Map. Cleans the dialogue at the TCAP layer and sends the TCP_END to the remote node.

List of primitives from TCAP to map user messages.

  1. TCAP_BEGIN is the first message received from a remote node for an incoming new dialogue. MAP user gets MAP_OPEN_IND, MAP_SERVICE_INDICATION, and MAP_DELIMIT_IND from the map protocol layer.
  2. TCAP_CONTINUE is for sending a MAP operation in an already existing dialogue. The user gets MAP_SERVICE_INDICATION and MAP_DELIMIT_IND.
  3. TCAP_CLOSE to MAP. The user gets MAP_CLOSE_INDICATION.

Map protocol call flow:

Map message flow depends on nodes using MAP protocol. We can divide the message flow based on the services.

Roaming Service:

Map Protocol enables a GSM mobile user to roam all the places and have access to data, sms, and voice. Following is a list of messages for roaming.

Send Authentication Info (SAI) :

This is the first message the roaming network node (VLR/SGSN) triggers towards the HLR in HPLMN to get authentication data. HLR passes the message to the AUC. SAI message having IMSI, requested-number-of-vectors, and source node type. If AUC finds the subscriber provisioned for the received IMSI,  AuC drives and returns the authentication vectors in the SAI response.

Upon receiving vectors, UE drives them locally and compares them with vectors obtained from HLR. If it matches, then UE starts location update or GPRS location update. It depends on UE registering on VLR or SGSN for Voice or Data, respectively.

Location Update or LU :

VLR sends the map location update to the HLR. The location update message has IMSI, VLR Number, Supported Camel Phases, and other parameters. If a subscriber is provisioned and allowed to roam under the received VLR number, HLR sends the IMSI subscription profile in Map ISD message to the VLR. This subscription profile is for voice and SMS services. Details of the subscription profile can be checked in the HLR tutorial.

GPRS Location Update:

SGSN triggers the GPRS location update operation towards the HLR. If the subscriber is allowed for data, then HLR sends the GPRS subscription profile to the SGSN. Map Insert Subscriber data or ISD carries the GPRS profile. GPRS information is for 2G or 3G services. It depends on the Quality of service provided to the subscriber.

Purge MS:

When the roaming VLR or SGSN detects that there has been no activity for a long time for a subscriber. It deletes the subscriber data and sends the Purge MS to the HLR. HLR marks the subscriber as not active by setting a purge flag. Ant MT call or SMS events are not successful. Once again, on location update, the purge flag is cleared.

Messaging :

The SMS full form is a short message service. It is the primary service provided by the GSM mobile operators. For SMS, a gsm map protocol is used between SMSC  and other GSM nodes. Other elements are HLR and visited MSC. Two types of messaging services are provided. One is the Mobile Originated Short Message service, and the other is the Mobile Terminated short message service.

Mobile Originated SMS Call flow:

When a user sends an SMS, the roaming MSC initiates the MO-ForwardSM map protocol message toward the SMSC in HPLMN. The SMSC address is stored on the mobile device. It is set when a sim card is inserted into the phone, and the phone attaches to the mobile network.

Mobile operators may update the settings on the device over the network. If the MO SMS does not work, you must call the customer care number to get the correct SMSC number. SMSC stores the message and then tries to deliver it to the destination number. A destination number may belong to the same mobile operator, or it may be to another operator. SMSC starts a mobile terminated short message procedure, which is explained next.

Mobile Terminated SMS Call flow:

SMSC has the destination mobile number for sending a message to the destination. But the location and IMSI should be known to the SMSC. SMSC does the send routing info procedure for the location with the home location register. It returns IMSI and Visiting MSC. Smsc sends the MT Forwards short message to the visiting MSC. The message delivery result is sent to the SMSC.

Call Services :

The protocol has messages for voice calls over the SS7 network. When a subscriber dials another subscriber, there is a map-level signaling to locate the dialed subscriber to terminate the call.

Send routing info :

Once the GMSC receives the IAM ISUP message, GMSC sends the send routing info message to the HLR.   The send routing info response contains the MSRN number of the subscriber and roaming VLR/MSC information. GSMSC connects the call to the subscriber via roaming MSC/VLR. If there is an error, GMSC gets an error in response.

Other protocols similar to MAP protocol :

IS41/ANSI-41

MAP protocol is standardized by the 3GPP for gsm. But other bodies have other protocols for similar functionalities. One is IS-41 or ANSI-41. IS-41 means US Telecoms Industry Association Interim Standard 41.   IS-41 has nodes like HLR and VLR in the network. It provides location registration and other services similar to a gsm map. This brings a new interworking function requirement. When a gsm map subscriber moves to IS-41 or an IS-41 subscriber moves to the GSM network. The inter-working function converts from IS-41 to the gsm map and vice versa.

GSUP :

GSUP stands for generic subscriber update protocol, which is an Osmocom-specific protocol.   Osmocom-specific MSC/VLR/HLR/SGSN uses GSUP to communicate with each other. Similar to IS-41, an interworking function is also required if a subscriber moves between the gsm map and Osmo-based networks.