CS Core Secrets: Mastering 2G, 3G Voice Networks

Introduce cs core across 2g, 3g, and 4g, detailing core networks, signaling messages, and the evolution from msc to msc server and media gateway.

Explore how 2G/3G core networks use circuit switching and packet switching, with NSC and edge (home location register), and contrast 4G's evolved packet core and IMS-based voice options.

Compare vertical and horizontal integrated networks, highlighting independent control, connectivity, and application layers that enable multiple services, with signaling in the control plane and 2G call traffic.

Understand how the core network provides central processing and management for signaling and traffic, interfaces with external networks across TDM and CDMA, and uses MSI server, HLR, and media gateway.

Explain the split architecture in 3G networks by separating signaling to an MSC-S and traffic to a media gateway, contrasting with legacy MSC/NSC monolithic setups.

Explore the 2g and 3g radio access network structure, from Jira and BTS to BSC, RNC, Node B, and how the access network connects to CS and PS core networks.

Discover how the media gateway handles user plane traffic in the core network, interfaces between access and external networks, and allocates resources for calls, including echo cancellation and media streaming.

The home location register is a network-wide subscriber database that stores imsi numbers, location area identities, and supplementary services, and supports authentication, location updates, and call management during calls.

Explore how the sms center handles subscriber sms via the gateway msc, may store messages for later delivery, and prioritizes calls when resources are limited.

The equipment identity register (EIR) stores IMEI-linked device identities for authentication, enabling blacklist, whitelist, or graylist statuses and supporting the flexible number registered to trace stolen phones across operators.

Explore how the IMSI, a unique SIM identifier, divides into MCC, MNC, and MSIN to form the PLMN address.

Understand how the msisdn, the mobile number, is formed from country code, network destination code (or national destination code), and the subscriber number.

Understand IMEI and IMEI SV identities to verify device status, blacklisted, whitelisted, stolen, or valid, and identify software versions like iOS 13.2 for carrier connectivity.

Follow the IMEI check call flow from the MSC server to the user equipment, covering identity request and response, database checks, and authentication handling for blacklist and whitelist by MSI.

Tmsi, or temporary mobile subscriber identity, protects subscriber data and prevents tracking as the device attaches to network with authentication and location updates, while network rotates tmsi during msc relocation.

Learn how the mobile global title (MGT or GT) handles location updates by converting subscriber information through the MSC to a global title for edge networks.

Understand how the mobile station roaming number (MSRN) helps the HLR locate a subscriber in an MSC and route calls and messages between MSCs to establish a connection.

Navigate location identities in cs core, including PLMN, MCC/MNC, LAI, CGI, and SAC, and understand how location area and cell identities define service areas.

Master basic procedures in cs core networks for a mobile connecting to a network. The lecture details attach, authentication, device identity checks, location update, and registration within the network.

Explore how a mobile subscriber sends an IMSI attach to the network, detailing the attach message flow through BSE and NFC, authentication, location update, and sleep mode.

Explain how networks authenticate users using IMSI, secret keys, and A3/A8 algorithms to generate triplets (RAND, SRES, KC) and verify via MSC, HLR, and authentication center.

Explain how ciphering procedures secure 2G/3G/4G voice networks. Show how the MSC issues a cipher mode command, selects the E5 algorithm, and encrypts data with KC.

Purging mobile station sends a message from MSC server to ALR when subscriber has no activity, deleting subscriber data from MSI server and marking mobile as not reachable until re-attachment.

Explain how a subscriber triggers location updates when moving between location areas or nfc areas, and outline normal, periodic, nz touch, detach, combined, independent, and roaming updates.

Trigger a location update when a mobile station moves between location areas or after an attach, as MSC, NSC, and Echelon exchange update location messages via the map protocol.

Explain IMSI attach signaling and location update: the mobile station sends an attach to the MSI server, updates subscriber status to idle, and the HLR inserts subscriber data with acknowledgement.

Describe the IMSI detach signaling process where a switched-off mobile sends an SMS to the network, prompting the MSC to mark the subscriber as detached.

Initiate periodic location updates by using a timer to send location update requests to the MSC server after defined intervals, detaching the user if they remain inactive.

Learn the combined attach procedure for voice and data networks, where the msc authenticates, updates location, and attaches the subscriber across css, ps, nsc, and sgc.

Explore the independent location update process: a call request prompts the MSC server to check the subscriber profile, and if incomplete, triggers normal location updates and service data.

Describe the data recovery procedure for mobile calls in an MSC, detailing how roaming number provisioning, restore data requests, and location updates enable calls between subscribers on MFCCs.

Explore how roaming triggers location updates, including network identity checks, IMSI ranges, AFC, HLR data, operator agreements, and roaming restrictions for visitor or temporary subscribers.

Explains the end-to-end 2g/3g voice call flow, from service request and authentication to call setup, radio access, roaming-number allocation, and paging between MSC, NSC, and HLR.

Follow how a cm service request triggers an sms service and authenticates the subscriber. The message then routes through the sms center to deliver a forward short message.

Explore MSC pooling, where multiple MSCs share bases in a pool to balance load, improve resilience, and support capacity expansion through cap values and the network resource identifier (NRI).