Handoff and Roaming

Every mobile subscriber has a home network—the operator with whom they signed their contract, who issued their SIM card, and who maintains their subscriber records. But what happens when a subscriber travels beyond their home network's coverage area?

Roaming is the capability that allows a mobile subscriber to automatically obtain service from a visited network (also called a serving network) that is different from their home network. This seemingly simple capability requires extensive technical mechanisms and business agreements to function.

Consider the complexity:

When you land in a foreign country and turn on your phone, within seconds you receive a text message: "Welcome to [Country]. Your carrier has partnered with [Local Operator] to provide you service." In that moment, your phone has:

1. Detected available networks
2. Selected an appropriate partner network
3. Authenticated you to a network that has never seen you before
4. Established your profile and service capabilities
5. Registered your location with your home network
6. Enabled incoming calls to find you in a new country

All of this happens automatically, transparently, and within seconds.

Types of Roaming

National Roaming:

National roaming occurs when a subscriber uses a different network within their home country. This typically happens when:

• The home network lacks coverage in certain areas (rural regions, specific buildings)
• Regulatory requirements mandate national roaming for new entrants
• Business agreements allow subscribers to access partner networks

National roaming is often transparent to users and may have different (often preferential) charging compared to international roaming.

International Roaming:

International roaming occurs when a subscriber travels to a different country and uses a local network. This requires:

• Roaming agreements between the home and visited network operators
• Inter-network signaling connections (via GRX/IPX networks)
• Real-time or near-real-time charging and billing reconciliation
• Regulatory compliance in both countries

Permanent Roaming:

A subscriber permanently uses a network different from their home network. This is typically against commercial agreements but may occur in:

• IoT/M2M devices deployed in foreign countries
• Special cases with explicit business agreements

Key Roaming Entities

Home Network (HPLMN - Home Public Land Mobile Network):

• The network that issued the SIM/USIM
• Maintains the subscriber's permanent profile (HLR/HSS)
• Defines which services the subscriber can use
• Ultimately responsible for billing the subscriber
• Pays the visited network for services provided

Visited Network (VPLMN - Visited Public Land Mobile Network):

• The network providing service to the roaming subscriber
• Must authenticate the subscriber (with home network assistance)
• Provides radio access and local connectivity
• May limit services based on roaming agreements
• Generates Charging Data Records (CDRs) for home network

Roaming Hub/Clearing House:

• Intermediary between many operators
• Provides connectivity (GRX/IPX) for inter-operator signaling
• May perform billing clearing and settlement
• Simplifies many-to-many relationships to hub-and-spoke

The GSM/UMTS roaming architecture established the foundational model that continues to influence modern network designs.

Core Roaming Entities

Home Location Register (HLR):

The HLR is the master database of subscriber information in the home network. For each subscriber, the HLR stores:

• International Mobile Subscriber Identity (IMSI) — Unique subscriber identifier
• MSISDN — Phone number(s) assigned to the subscriber
• Subscription Data — Services subscribed, restrictions, supplementary services
• Authentication Data — Keys for generating authentication vectors
• Current VLR Address — Location of the subscriber (which VLR is currently serving)

Visitor Location Register (VLR):

The VLR is a database in the visited network that temporarily stores information about roaming subscribers:

• Copy of relevant HLR data for serving the subscriber
• Current location (serving MSC/BSC area)
• Temporary Mobile Subscriber Identity (TMSI) for privacy
• Authentication state

The VLR allows the visited network to serve the subscriber without constantly querying the home network's HLR.

Roaming Registration Process

When a roaming subscriber attaches to a visited network:

Step 1: Initial Contact

1. Mobile scans available networks and selects one with roaming agreement
2. Mobile sends IMSI ATTACH or LOCATION UPDATE to the visited network's MSC/VLR
3. VLR examines the IMSI to identify the home network (from MCC/MNC digits)

Step 2: Location Update to HLR 4. VLR sends MAP (Mobile Application Part) UPDATE LOCATION message to HLR 5. Message travels via SS7 network (or SIGTRAN over IP) through international gateways 6. HLR receives the update and records the new VLR address

Step 3: Subscriber Data Download 7. HLR sends INSERT SUBSCRIBER DATA message to the VLR 8. Contains subscription profile (services, call barring, supplementary services) 9. VLR stores this data locally

Step 4: Previous VLR Notification 10. HLR sends CANCEL LOCATION to the previous VLR (if any) 11. Previous VLR deletes the subscriber's temporary data

Step 5: Authentication 12. VLR requests authentication vectors from HLR (or AuC) 13. VLR performs local authentication with mobile using received vectors 14. Upon success, subscriber is registered and can receive service

One of the most impressive aspects of roaming is the ability for calls to find a subscriber anywhere in the world. The caller simply dials the subscriber's phone number—they don't need to know where the subscriber is.

The Call Delivery Challenge

The Problem:

• Caller dials MSISDN (phone number): +1-555-123-4567
• This number routes to the home network (USA, in this case)
• But the subscriber is roaming in France
• How does the call reach them?

The Solution: HLR Query + MSRN

The home network queries its HLR to find where the subscriber is, obtains a temporary routable number in the visited network, and routes the call there.

Call Delivery Process

Phase 1: Call Arrival at Home Network

1. Caller dials +1-555-123-4567
2. PSTN routes call to subscriber's home network (based on number)
3. Home network's GMSC (Gateway MSC) receives the call
4. GMSC queries HLR: "Where is subscriber with MSISDN +1-555-123-4567?"

Phase 2: HLR Query and MSRN Assignment 5. HLR looks up the current VLR address (France, in this example) 6. HLR sends SEND ROUTING INFORMATION to the serving VLR 7. VLR/MSC in France allocates an MSRN (Mobile Station Roaming Number) 8. MSRN is a temporary number in the visited network's numbering range 9. MSRN is returned to HLR, which returns it to GMSC

Phase 3: Call Routing to Visited Network 10. GMSC routes call to the MSRN (which looks like a French number) 11. International call routing delivers the call to France 12. Visited MSC receives call on MSRN, maps to TMSI/IMSI 13. Visited MSC pages the mobile and delivers the call

The Key Insight: MSRN

The Mobile Station Roaming Number (MSRN) is a temporary number that makes the roaming subscriber "reachable" via standard telephony routing. It's allocated for each call and released after call setup.

LTE introduces a new core network architecture (EPC - Evolved Packet Core) with different roaming mechanisms, though the fundamental concepts remain similar.

LTE Roaming Entities

HSS (Home Subscriber Server):

The HSS is the evolution of the HLR, serving as the central subscriber database in the home network:

• Stores subscriber profiles and authentication data
• Supports Diameter protocol (replacing MAP)
• Tracks current serving network (MME address)

MME (Mobility Management Entity):

The MME in the visited network is analogous to the VLR:

• Handles mobility management for roaming subscribers
• Obtains subscriber data from HSS
• Manages bearer setup and paging

PGW (PDN Gateway):

The PGW is the anchor point for the subscriber's IP address and is key to roaming architecture decisions.

LTE Roaming Architectures

Home Routed Architecture:

In home routed roaming, all user data traffic is routed back to the home network:

UE → eNodeB → SGW (VPLMN) → PGW (HPLMN) → Internet

Characteristics:

• PGW is in home network
• Subscriber gets IP address from home network
• All traffic traverses international links
• Home network has full visibility and control
• Higher latency, potentially higher cost
• Simple for visited network (only signaling/radio)

Local Breakout Architecture:

In local breakout, user data traffic exits to the internet in the visited network:

UE → eNodeB → SGW (VPLMN) → PGW (VPLMN) → Internet

Characteristics:

• PGW is in visited network
• Subscriber gets IP address from visited network
• Traffic uses local internet breakout
• Lower latency, potentially lower backhaul cost
• Visited network must support policy (PCRF interworking)
• Complex charging and policy coordination

Roaming presents unique security challenges: the home network must trust the visited network to authenticate its subscribers, while the visited network must trust that the subscriber is genuinely authorized by the home network. This mutual trust is established through cryptographic mechanisms and business agreements.

GSM/UMTS Authentication for Roaming

Authentication Vector (AV) Distribution:

1. Home network's AuC (Authentication Center) generates Authentication Vectors
2. Each AV contains: RAND (challenge), XRES (expected response), Kc (cipher key), AUTN (3G)
3. AVs are sent to the VLR in the visited network
4. VLR uses AVs to authenticate the subscriber locally
5. VLR doesn't have the master key (Ki)—only the home network has it

Why This Works:

• The visited network can authenticate the subscriber without knowing the secret key
• The home network doesn't need to be online during authentication (AVs pre-distributed)
• Subscriber privacy is maintained (IMSI not sent repeatedly over air)

Limitation:

Once AVs are distributed to a visited network, that network could theoretically reuse them for fraud. Modern networks address this with mutual authentication and one-time-use AVs.

LTE/5G Authentication for Roaming

LTE and 5G use enhanced authentication (EPS-AKA, 5G-AKA) with stronger security:

Key Improvements:

1. Mutual Authentication: The network proves its identity to the subscriber, not just the reverse
2. Key Hierarchy: Multiple derived keys for different purposes (NAS encryption, AS encryption, integrity)
3. Home Network Authentication: The home network's authentication server participates in key generation
4. SUPI Concealment (5G): The permanent subscriber ID is encrypted to prevent tracking

5G Roaming Security Enhancement:

5G introduces SEPP (Security Edge Protection Proxy) at the network boundary:

• All roaming signaling passes through SEPP
• End-to-end confidentiality and integrity protection
• Message filtering to prevent attacks
• Topology hiding to protect internal network structure

Technical capabilities alone don't enable roaming—business agreements between operators are essential. These agreements define which services are available, how much they cost, and how money flows between operators.

Roaming Agreements

Bilateral Agreements:

Traditionally, operators negotiated bilateral roaming agreements with each international partner:

• Service scope (voice, SMS, data, VoLTE)
• Quality of service guarantees
• Wholesale rates (what home operator pays visited operator)
• Fraud management and dispute resolution
• Technical parameters (steering, preferred roaming Lists)

Disadvantages of Bilateral:

• An operator with N roaming relationships needs N agreements
• Slow to establish new relationships
• Complex management

Hub/Clearing House Model:

Roaming hubs like BICS, Syniverse, and Comfone simplify the ecosystem:

• Operators sign a single agreement with the hub
• Hub provides connectivity to all its member operators (200+)
• Hub handles billing clearing and settlement
• Reduces N×N relationships to N×1

Data Exchange Network Evolution

GRX (GPRS Roaming Exchange):

GRX networks were established for 2G/3G data roaming:

• Private IP network connecting operators
• Carries GPRS/3G data traffic for roaming subscribers
• GTP (GPRS Tunneling Protocol) tunnels between operators
• Only for user plane data

IPX (IP Packet Exchange):

IPX is the evolution of GRX for modern networks:

• Carries all roaming traffic: signaling, voice, data, IMS
• Supports QoS for real-time services (VoLTE, video)
• End-to-end SLA visibility
• Diameter signaling for LTE roaming
• Used by 800+ operators globally

Roaming Charging

Wholesale Rates:

The home operator pays the visited operator for services provided:

• Voice: per-minute rate
• SMS: per-message rate
• Data: per-MB rate (historically very high, declining with regulation)

Retail Rates:

The subscriber pays the home operator:

• May include markup over wholesale
• Historically very expensive, leading to "bill shock"
• Increasingly regulated (EU "Roam Like at Home")

Home operators don't want their subscribers randomly connecting to any available network abroad. Steering of Roaming (SoR) allows home operators to influence which visited network their subscribers use.

Why Steering Matters

Economic Reasons:

• Different visited networks have different wholesale rates
• Preferred partners may offer better rates or revenue share
• Avoiding high-cost operators reduces expenses

Quality Reasons:

• Some visited networks offer better coverage or quality
• Preferred partners may support more services (VoLTE, HD Voice)
• Known networks reduce support issues

Strategic Reasons:

• Promoting alliance members (T-Mobile, Orange, etc.)
• Avoiding competitors

Steering Mechanisms

SIM-Based Steering (Passive):

The SIM card contains a preferred roaming list (PRL) or equivalent:

1. SIM stores ranked list of preferred networks per country
2. Mobile scans for networks and matches against PRL
3. Mobile selects highest-priority available network
4. Home operator can update PRL via OTA (Over-the-Air)

Limitations: Mobile may connect to non-preferred network first; OTA update may fail.

Network-Based Steering (Active):

1. Mobile attaches to any available network
2. Visited network notifies home network of the attachment
3. Home network checks if this is the preferred VPLMN
4. If not preferred, home network can:
   • Reject the attachment with a redirect to preferred network
   • Send steering SMS with instructions to reselect
   • Use USSD to trigger network reselection

Limitations: Subscriber disruption during reselection; may fail if preferred network has no coverage at current location.

Roaming transforms individual mobile networks into a global interconnected system. The technical complexity behind this seamless experience—from authentication protocols to call delivery to billing settlement—represents decades of standardization and engineering effort.

What's Next:

Now that we understand roaming at the network level, the next page explores the mobile network protocols that underpin handoff and roaming operations. We'll examine MAP, Diameter, GTP, and other protocols that carry the signaling messages enabling mobility.