MAP Protocol in GSM explained. 

The full form of MAP is the Mobile Application Part.  This is an application layer protocol of the SS7 protocol stack.  It uses the services of the TCAP layer.  Map Protocol provides the specifications for roaming, messaging, and data.

It has a set of messages which carry the gsm level signaling parameters for a mobile device to attach to the network and carries signaling required for roaming, voice, and SMS. Each map user is identified by an SSN over the SCCP layer. Following is the list of SSNs for the MAP layer users.

HLR have SSN 6.
VLR have SSN 7 
MSC have SSN 8
SGSN have SSN 9

There are other nodes in ss7 using MAP which have SSN from the above list. E.g GMSC and SMSC uses SSN 8.

Map protocol primitives mapping with the TCAP messages:

MAP uses the services of the TCAP layer.  Each MAP primitives has corresponding TCAP messages. In a similar way, each TCAP message provides indications to the MAP user.

List of primitives from map users to TCAP messages.

  1. MAP_OPEN_REQUEST is the primitive used by the MAP user to start a new dialogue. The parameters are Calling SCCP address, Called SCCP address, and Application context. Upon receiving MAP_OPEN_REQUEST, the TCAP layer creates a new dialogue locally.
  2. MAP_SERVICE_REQUEST is used to send the actual map protocol operation to the TCAP layer. Upon receiving MAP_SERVICE_REQUEST, TCAP stores the map operation locally against the opened dialogue.
  3. MAP_DELIMIT_REQUEST is used to send the message out to the network. Upon receiving MAP_DELIMIT_REQUEST, the TCAP layer sends the TCAP_BEGIN to the destination node, with the map operation. If this is received for an existing dialogue (no open), the TCAP_CONTINUE is sent to the network.
  4. MAP_CLOSE  from Map. Cleans the dialogue at the TCAP layer and sends the TCP_END to the remote node.

List of primitives from TCAP to map user messages.

  1. TCAP_BEGIN is the first message received from a remote node for an incoming new dialogue. MAP user gets MAP_OPEN_IND, MAP_SERVICE_INDICATION, and MAP_DELIMIT_IND from the map protocol layer.
  2. TCAP_CONTINUE is for sending a MAP operation in an already existing dialogue. The user gets MAP_SERVICE_INDICATION and MAP_DELIMIT_IND.
  3. TCAP_CLOSE to MAP. The user gets MAP_CLOSE_INDICATION.

Map protocol call flow:

Map message flow depends on nodes using MAP protocol.  We can divide the message flow based on the services.

Roaming Service:

Send Authentication Info or SAI :

This is the first message which is triggered by roaming VLR/SGSN towards the HLR in HPLMN. HLR passes the message to the AUC.  SAI map message has IMSI, requested number of vectors, and node type.  If AUC has a subscriber provisioned for IMSI,  AuC returns the authentication vectors. Upon receiving vectors, UE compares vectors locally, and if all successful then UE starts location update or GPRS location update. Depends on UE registering on VLR or SGSN for Voice Or Data respectively.

Location Update or LU :

VLR sends the map location update to the HLR. The location update message has IMSI, VLR Number, Supported Camel Phases, and other parameters.  If a subscriber is provisioned and allowed to roam under the received VLR number, HLR sends the IMSI subscription profile in Map ISD message to the VLR.  This subscription profile is for voice and SMS services. Details of the subscription profile can be checked in the HLR tutorial.

GPRS Location Update:

SGSN triggers the GPRS location update operation towards the HLR.  If the subscriber is allowed for data then HLR sends the GPRS subscription profile to the SGSN.  Map Insert Subscriber data or ISD carries the GPRS profile. GPRS information is for 2G or 3G services. It depends on the Quality of service provided to the subscriber.

Purge MS:

When the roaming VLR or SGSN detects that there is no activity for a long time for a subscriber. It deletes the subscriber data and sends the Purge MS to the HLR. HLR marks the subscriber as not active by setting a purge flag. Ant MT call or SMS events are not successful.  Once again on location update, the purge flag is cleared.

Messaging :

SMS or SMS full form is a short message service. It is the basic service provided by the GSM mobile operators. For SMS, a gsm map protocol is used between SMSC  and other GSM nodes. Other elements are HLR and visited MSC.  Two types of messaging services are provided.  One is the Mobile Originated Short Message service and the other is the Mobile Terminated short message service.

Mobile Originated SMS Call flow:

When a user sends an SMS.  The roaming MSC initiates the MO-ForwardSM map protocol message towards the SMSC in HPLMN. The SMSC address is stored on the mobile device. It is set when a sim card is inserted into the phone and the phone attaches to the mobile network.

Mobile operators may update the settings on the device over the network.  If the MO SMS does not work, then you need to call the customer care number to get the correct SMSC number.  SMSC stores the message and then tries to deliver it to the destination number.  A destination number may belong to the same mobile operator or it may be to another operator. SMSC starts a mobile terminated short message procedure, which is explained next.

Mobile Terminated SMS Call flow:

SMSC has the destination mobile number, for sending a message to the destination. But the location and IMSI should be known to the SMSC. For the location, SMSC does the send routing info procedure with the home location register.  It returns IMSI and Visiting MSC.  Smsc sends the MT Forwards short message to the visiting MSC. The message delivery result is sent to the SMSC.

Call Services :

The protocol has messages that are used for voice calls over the SS7 network.  When a subscriber dials another subscriber, there is a map level signaling to locate the dialed subscriber to terminate the call.

Send routing info :

Once the GMSC receives the IAM ISUP message. GMSC sends the send routing info message to the HLR.   The send routing info response contains the MSRN number of the subscriber and roaming VLR/MSC information. GSMSC connects the call to the subscriber via roaming MSC/VLR. If there is an error GMSC gets an error in response.

Other protocols similar to MAP protocol :

IS41/ANSI-41

MAP protocol is standardized by the 3GPP for gsm. But there are other bodies, having other protocols for similar functionalities. One is IS-41 or ANSI-41. IS-41 means US Telecoms Industry Association Interim Standard 41.   IS-41 has nodes like HLR and VLR in the network. It provides location registration and other services, similar to a gsm map.  This brings a new interworking function requirement. When a gsm map subscriber moves to IS-41 or an IS-41 subscriber moves to the GSM network. The inter-working function does the conversion from IS-41 to gsm map and vice versa.

GSUP :

GSUP stands for generic subscriber update protocol, which is an Osmocom-specific protocol.   Osmocom specific MSC/VLR/HLR/SGSN uses GSUP to communicate with each other. Similar to IS-41, here an interworking function is also required if a subscriber moves between gsm map and Osmo-based networks.