Mobile Network Protocols

Every handoff, every roaming registration, every call delivered to a mobile subscriber in a foreign country—all of these operations depend on specialized signaling protocols that carry control messages between network elements. These protocols form the nervous system of mobile networks, orchestrating the complex dance of mobility management.

Understanding these protocols is essential for:

• Network Engineers who design, deploy, and troubleshoot mobile infrastructure
• Protocol Developers who implement mobility functions in network equipment
• Security Analysts who identify and mitigate vulnerabilities in mobile signaling
• System Architects who design inter-operator interfaces and roaming solutions

The evolution of mobile network protocols mirrors the evolution of mobile networks themselves—from the circuit-switched, SS7-based world of 2G/3G to the all-IP, Diameter-based architecture of 4G/5G.

Signaling System 7 (SS7) is the signaling protocol stack that has underpinned global telecommunications since the 1980s. Originally designed for PSTN (Public Switched Telephone Network) call setup, SS7 was extended to support mobile network functions through the Mobile Application Part (MAP).

SS7 Protocol Stack

SS7 is a layered protocol stack optimized for reliable signaling:

Level 1: MTP1 (Message Transfer Part 1) - Physical Layer

• Defines physical, electrical characteristics of signaling links
• Typically 64 kbps DS0 channels or SDH transport

Level 2: MTP2 - Data Link Layer

• Reliable, sequenced message delivery
• Error detection and correction
• Link status monitoring

Level 3: MTP3 - Network Layer

• Message routing between signaling points
• Network management functions
• Load sharing across links

Level 4: SCCP (Signaling Connection Control Part)

• Connection-oriented and connectionless services
• Global Title Translation (GTT) for routing
• Used by MAP and other upper layer protocols

Application Parts:

• ISUP (ISDN User Part) - Call setup/teardown
• MAP (Mobile Application Part) - GSM/UMTS mobility functions
• CAP (CAMEL Application Part) - Intelligent network services

Mobile Application Part (MAP)

MAP is the SS7 application protocol that provides mobility management functions for GSM and UMTS networks. It defines the procedures for:

Location Management:

• Location Update (subscriber moves to new VLR area)
• Send Routing Information (find subscriber for incoming call)
• Provide Subscriber Info (subscriber location query)

Handoff (Handover) Support:

• Prepare Handover (request handover resources)
• Send End Signal (handover completion)
• Process Access Signaling (BSSAP/RANAP relay)

Authentication:

• Send Authentication Info (fetch authentication vectors)
• Authentication Failure Report

Subscriber Management:

• Insert Subscriber Data (provision subscriber to VLR)
• Delete Subscriber Data
• Cancel Location (subscriber deregistration)

Supplementary Services:

• Register SS / Erase SS / Activate SS
• Interrogate SS

As networks evolved toward IP, the need arose to carry SS7 signaling over IP networks rather than dedicated TDM signaling links. SIGTRAN is the IETF framework for SS7 over IP.

SIGTRAN Architecture

SIGTRAN provides a set of adaptation layers that carry SS7 protocols over SCTP (Stream Control Transmission Protocol), an IP transport protocol designed for signaling:

M2UA (MTP2 User Adaptation):

• Carries MTP2 user traffic (MTP3) over IP
• Used between Signaling Gateway and Media Gateway Controller
• Provides nodal interworking

M2PA (MTP2 Peer-to-Peer Adaptation):

• Provides equivalent of MTP2 functionality over IP
• Peer-to-peer SS7 links over IP
• Full SS7 node can be IP-based

M3UA (MTP3 User Adaptation):

• Carries MTP3 user traffic (SCCP, ISUP) over IP
• Most common SIGTRAN adaptation for mobile
• Signaling Gateway terminates MTP3, forwards SCCP over M3UA

SUA (SCCP User Adaptation):

• Carries SCCP user traffic (MAP, CAP) over IP
• Higher level adaptation than M3UA
• Signaling Gateway terminates SCCP

SCTP: The Signaling Transport Protocol

SCTP (Stream Control Transmission Protocol) was designed specifically for signaling:

• Multi-homing: Single association can use multiple IP addresses for failover
• Multi-streaming: Multiple independent message streams avoid head-of-line blocking
• Message-oriented: Preserves message boundaries (unlike TCP's byte stream)
• Reliability: Guaranteed, ordered delivery with congestion control
• Enhanced Security: Resistant to certain TCP attacks (4-way handshake)

SCTP's features make it ideal for signaling transport where reliability and failover are critical but message structure must be preserved.

Diameter is the AAA (Authentication, Authorization, Accounting) protocol that replaced MAP for signaling in LTE and 5G networks. While Diameter was originally developed as an evolution of RADIUS for AAA, it was adapted for mobile network signaling.

Diameter Overview

Base Protocol (RFC 6733):

• Peer-to-peer protocol over TCP or SCTP
• Message-based with Request/Answer pairs
• Extensible through Applications and AVPs (Attribute-Value Pairs)
• Hop-by-hop and end-to-end identifiers for transaction matching

Key Diameter Properties:

1. Extensibility: New applications can be defined without changing the base protocol
2. Failover: Supports failover to backup servers, agent redundancy
3. Capability Negotiation: Nodes negotiate supported applications during connection setup
4. Application Multiplexing: Multiple applications can share a single connection
5. Transport Reliability: Uses TCP/SCTP for reliable delivery

Diameter Applications for Mobile Networks

S6a/S6d - MME to HSS Interface:

The primary mobility management interface in LTE:

• ULR/ULA (Update-Location-Request/Answer): Location registration
• AIR/AIA (Auth-Info-Request/Answer): Authentication vectors
• IDR/IDA (Insert-Subscriber-Data-Request/Answer): Profile download
• CLR/CLA (Cancel-Location-Request/Answer): Subscriber deregistration

S13 - MME to EIR Interface:

Device identity checking:

• ECR/ECA (ME-Identity-Check-Request/Answer): IMEI validation

Gx - PCRF to PGW Interface:

Policy and Charging Rules Function:

• CCR/CCA (Credit-Control-Request/Answer): Policy installation/update
• RAR/RAA (Re-Auth-Request/Answer): Policy push from network

Rx - AF to PCRF Interface:

Application Function to Policy:

• AAR/AAA (AA-Request/Answer): Application session setup
• Used for IMS/VoLTE QoS setup

Gy - OCS to PGW Interface:

Online Charging System:

• CCR/CCA (Credit-Control-Request/Answer): Real-time charging

GTP (GPRS Tunneling Protocol) is a family of protocols that provide tunneling for both signaling (GTP-C) and user data (GTP-U) in mobile networks. GTP is essential for maintaining session continuity during handoff and roaming.

The GTP Protocol Family

GTP-C (Control Plane):

• Signaling protocol for session/tunnel management
• Creates, modifies, deletes GTP tunnels (bearers)
• Handles mobility events (handoff, inter-RAT mobility)
• Two versions: GTPv1-C (2G/3G) and GTPv2-C (LTE)

GTP-U (User Plane):

• User data encapsulation and tunneling
• Carries user IP packets through the mobile network
• Simple protocol—minimal header, high efficiency
• Same format for all generations (GTPv1-U)

GTP' (GTP Prime):

• Charging data transport
• Carries CDRs from network elements to billing systems
• Uses GTP format for charging messages

GTP-U: User Plane Tunneling

Why Tunneling is Needed:

When a mobile device gets an IP address from the PGW, that address must remain valid as the device moves between eNodeBs and even between SGWs. GTP-U tunnels provide this mobility:

1. User IP packets enter the mobile network at the PGW
2. PGW encapsulates packets in GTP-U tunnel to the SGW
3. SGW encapsulates packets in GTP-U tunnel to the eNodeB
4. eNodeB delivers packets to the UE over radio

GTP-U Header Structure:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| PT| E | S |PN|  Message Type |     Length (Octets)    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                     TEID (Tunnel Endpoint ID)                 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

TEID (Tunnel Endpoint Identifier):

The 32-bit TEID uniquely identifies a tunnel endpoint at a network element:

• Each bearer has separate uplink and downlink TEIDs
• TEIDs are allocated by the receiving endpoint
• TEID + IP address uniquely identifies a tunnel
• Multiple bearers (different QoS) have different TEIDs

GTPv2-C: Control Plane Signaling in LTE

Key GTPv2-C Interfaces:

• S11: MME to SGW (bearer management)
• S5/S8: SGW to PGW (roaming interface)
• S4: SGSN to SGW (2G/3G interworking)
• S10: MME to MME (inter-MME handoff)
• S3: MME to SGSN (inter-RAT handoff)

Key GTPv2-C Messages:

Roaming Considerations:

For roaming, the S8 interface between SGW (visited network) and PGW (home network) uses GTPv2-C for control and GTP-U for user plane. This interface carries the roaming subscriber's traffic across operator boundaries.

Handoff requires coordination between radio access network (RAN) elements, core network, and often between operators. Multiple protocols work together to execute handoffs.

X2 Application Protocol (X2AP) - LTE

X2AP is the protocol between LTE eNodeBs for direct handoff support:

X2 Interface Functions:

• Mobility management (handoff signaling)
• Load management (load balancing information)
• Error handling (handoff failure recovery)

Key X2AP Procedures:

1. Handover Preparation: Source eNodeB sends Handover Request to target
2. Handover Execution: Source commands UE to switch, target admits UE
3. Handover Completion: Target confirms handover complete to source
4. Handover Cancel: Abort handover if it cannot complete
5. SN Status Transfer: Transfer PDCP sequence number status for seamless data

X2AP Message Flow for Handover:

Source eNB          Target eNB           MME
    |                   |                  |
    |-- HO Request ---->|                  |
    |<-- HO Req Ack ----|                  |
    |   (RRC config)    |                  |
    |                   |                  |
    |==== UE moves ====>|                  |
    |                   |                  |
    |<--- SN Status ----|                  |
    |-- Data Fwding --->|                  |
    |                   |-- Path Switch -->|
    |                   |<- Path Sw Ack ---||
    |<-- UE Ctx Rel ----|                  |

S1 Application Protocol (S1AP) - LTE

S1AP is the control plane protocol between eNodeB and MME:

S1AP for Handover:

When X2 is not available (different vendors, no direct link), handoff signaling goes through the MME via S1:

1. Handover Required: Source eNodeB requests MME to perform handover
2. Handover Request: MME to target eNodeB (or target MME for inter-MME)
3. Handover Request Acknowledge: Target confirms resources allocated
4. Handover Command: MME to source eNodeB with target cell configuration
5. Handover Notify: Target eNodeB confirms UE arrival
6. UE Context Release: Source eNodeB releases resources

S1-based vs. X2-based Handover:

RANAP - UMTS

RANAP (Radio Access Network Application Part) provides similar functions for UMTS:

• Signaling between RNC (Radio Network Controller) and Core Network
• Relocation Request/Response for inter-RNC handoff
• RAB Assignment for bearer setup
• Iu Connection Release for resource cleanup

Roaming signaling requires interconnection between different operators' networks. This section covers the infrastructure that enables inter-operator signaling.

GSM/UMTS Roaming Signaling

SS7 International Network:

Traditionally, international SS7 signaling used dedicated circuits:

• International Signaling Points (ISPs) at gateway locations
• Dedicated international signaling links
• Global Title (GT) routing for addressing

GRX (GPRS Roaming Exchange):

GRX networks provide IP connectivity between operators:

• Private IP network (not public internet)
• Carries SIGTRAN (SS7 over IP) for signaling
• Carries GTP for user plane (data roaming)
• Operated by roaming hub providers (BICS, Syniverse, etc.)

LTE Roaming Signaling

Diameter Roaming:

LTE uses Diameter over IPX for roaming signaling:

• S6a proxy mode: Diameter proxy at network edge routes to home HSS
• S6a relay mode: DEA (Diameter Edge Agent) relays messages
• End-to-end Diameter between visited MME and home HSS

IPX (IP Packet Exchange):

IPX is the evolution of GRX:

• Carries all roaming traffic: Diameter signaling, voice (VoLTE), data
• End-to-end QoS for real-time services
• Interconnects 800+ operators globally
• Key providers: BICS, Syniverse, Comfone, PCCW Global

5G Roaming Signaling

Service-Based Architecture (SBA):

5G uses a service-based architecture with HTTP/2 APIs:

• Network functions expose RESTful APIs
• SEPP (Security Edge Protection Proxy) at operator boundaries
• N32 interface between SEPPs for inter-operator signaling

SEPP Functions:

1. Security Termination: TLS termination at network edge
2. Message Filtering: Validate and filter roaming messages
3. Topology Hiding: Conceal internal network structure
4. Anti-Fraud Protection: Detect and block malicious signaling

5G Roaming Interfaces:

PRINS (Protocol for N32 Interconnect Security):

PRINS provides application-layer security for N32:

• End-to-end encryption of sensitive IEs (information elements)
• Integrity protection of signaling messages
• Protection even through intermediate IPX networks

Mobile IP protocols provide IP-layer mobility, allowing devices to maintain IP connectivity while moving between networks without changing IP addresses.

Mobile IPv4 (RFC 5944)

Problem Statement:

In standard IP routing, packets are routed based on the IP address prefix. If a device moves to a different network, it gets a new IP address, breaking existing connections.

Mobile IPv4 Architecture:

• Mobile Node (MN): The moving device
• Home Agent (HA): Router on home network that intercepts packets for MN
• Foreign Agent (FA): Router on visited network that assists MN
• Home Address: Permanent IP address on home network
• Care-of Address (CoA): Temporary address on visited network

Mobile IPv4 Operation:

1. MN moves to foreign network and obtains CoA
2. MN registers CoA with HA (Registration Request/Reply)
3. HA creates binding: Home Address ↔ CoA
4. Packets for MN's home address arrive at HA
5. HA tunnels packets (IP-in-IP) to MN's CoA
6. MN receives tunneled packets and decapsulates
7. MN sends packets directly to correspondent (or via HA)

Mobile IPv6 (RFC 6275)

Improvements over Mobile IPv4:

• No Foreign Agent Required: MN can configure CoA itself (SLAAC)
• Route Optimization Built-in: Correspondent can send directly to MN
• Better Security: IPsec integration for registration security
• Return Routability: Procedure to verify MN reachability at both addresses

Mobile IPv6 Operation with Route Optimization:

1. MN moves to visited network, configures CoA
2. MN sends Binding Update to HA and correspondent nodes
3. Correspondent nodes send directly to MN's CoA using Routing Header
4. No triangle routing for route-optimized flows

Proxy Mobile IPv6 (PMIPv6 - RFC 5213)

Network-Based Mobility:

PMIPv6 provides Mobile IP functionality without mobile node involvement:

• Mobile Access Gateway (MAG): First-hop router that detects MN attachment
• Local Mobility Anchor (LMA): Network-side equivalent of HA

PMIPv6 Advantages:

• No changes required to mobile node
• Network handles all mobility signaling
• Simpler for devices with limited capabilities
• Used in some LTE deployments as alternative to GTP

Relationship to GTP:

PMIPv6 and GTP solve similar problems—maintaining IP continuity during mobility. LTE primarily uses GTP, but PMIPv6 was defined (S5/S8 PMIPv6 variant) as an alternative for operators preferring IETF protocols.