The HSS is the master database for a given user. It is the entity containing the subscription-related information to support the network entities actually handling calls/sessions. A Home Network may contain one or several HSSs: it depends on the number of mobile subscribers, on the capacity of the equipment and on the organisation of the network. As an example, the HSS provides support to the call control servers in order to complete the routing/roaming procedures by solving authentication, authorisation, naming/addressing resolution, location dependencies, etc. The HSS is responsible for holding the following user related information:

• User Identification, Numbering and addressing information;
• User Security information: Network access control information for authentication and authorization;
• User Location information at inter-system level: the HSS supports the user registration, and stores inter-system location information, etc.;
• User profile information.

The HSS also generates User Security information for mutual authentication, communication integrity check and ciphering. Based on this information, the HSS also is responsible to support the call control and session management entities of the different Domains and Subsystems (defined in clause 3.3 and clause 3.3a) of the operator as shown in Figure 0-a.

The HSS may integrate heterogeneous information, and enable enhanced features in the core network to be offered to the application & services domain, at the same time hiding the heterogeneity. The HSS consists of the following functionalities:

• IP multimedia functionality to provide support to control functions of the IM subsystem such as the CSCF. It is needed to enable subscriber usage of the IM CN subsystem services. This IP multimedia functionality is independent of the access network used to access the IM CN subsystem.
• The subset of the HLR/AUC functionality required by the PS Domain (GPRS and EPC).
• The subset of the HLR/AUC functionality required by the CS Domain, if it is desired to enable subscriber access to the CS Domain or to support roaming to legacy GSM/UMTS CS Domain networks.

The organisation of the subscriber data is outlined in TS 23.008. It also indicates which numbers, addresses and identifiers specified in TS 23.003 are stored in HSS.

A mobile station roaming in an MSC area or within a GERAN/UTRAN pool-area is controlled by a Visitor Location Register. When a Mobile Station (MS) enters a new location area it starts a registration procedure. An MSC in charge of that area notices this registration and transfers to a Visitor Location Register the identity of the location area where the MS is situated. If this MS is not yet registered in the VLR, the VLR and the HLR exchange information to allow the proper handling of CS calls involving the MS. A VLR may be in charge of one or several MSC areas. The VLR contains also the information needed to handle the calls set-up or received by the MSs registered in its data base (for some supplementary services the VLR may have to obtain additional information from the HLR). The following elements are included:

• the International Mobile Subscriber Identity (IMSI);
• the Mobile Station International ISDN number (MSISDN);
• the Mobile Station Roaming Number (MSRN), see TS 23.003 for allocation principles;
• the Temporary Mobile Station Identity (TMSI), if applicable;
• the Local Mobile Station Identity (LMSI), if used;
• the location area where the mobile station has been registered;
• the identity of the SGSN where the MS has been registered. Only applicable to PLMNs supporting GPRS and which have a Gs interface between MSC/VLR and SGSN;
• the last known location and the initial location of the MS;
• the identity of the MME where the MS has been registered. Only applicable to PLMNs supporting EPC and CS Fallback and which have a SGs interface between MSC/VLR and MME.

The VLR also contains supplementary service parameters attached to the mobile subscriber and received from the HLR. The organisation of the subscriber data is outlined in TS 23.008.

The Equipment Identity Register (EIR) in the GSM system is the logical entity which is responsible for storing in the network the International Mobile Equipment Identities (IMEIs), used in the GERAN/UTRAN/E-UTRAN system. The equipment is classified as "allowed", "tracked", "prohibited" or it may be unknown as specified in TS 22.016 and TS 29.002. This functional entity contains one or several databases which store(s) the IMEIs used in the system. The mobile equipment may be classified as "allowed", "tracked" and "prohibited" and therefore may be stored in three separate lists. An IMEI may also be unknown to the EIR. An EIR shall as a minimum contain an "allowed list" (Equipment classified as "allowed").

The SMS Gateway MSC (SMS-GMSC) acts as an interface between a Short Message Service Centre and the PLMN, to allow short messages to be delivered to mobile stations from the Service Centre (SC). The choice of which MSCs can act as SMS Gateway MSCs is a network operator matter (e.g. all MSCs or some designated MSCs).

The SMS Interworking MSC acts as an interface between the PLMN and a Short Message Service Centre (SC) to allow short messages to be submitted from Mobile Stations to the SC. The choice of which MSCs can act as SMS Interworking MSCs is a network operator matter (e.g. all MSCs or some designated MSCs).

The SLF:

• Is queried by the I CSCF during the Registration and Session Setup to get the name of the HSS containing the required subscriber specific data. Furthermore the SLF is also queried by the S CSCF during the Registration.
• Is queried by the AS in conjunction with the Sh interface operation to get the name of the HSS containing the required subscriber specific data.
• Is queried by the 3GPP AAA server to get the name of the HSS containing the required subscriber specific data.
• Is accessed via the Dx interface by the CSCF, via the Dh interface by the AS, and via the Dw interface by the 3GPP AAA Server.

The SLF is not required in a single HSS environment. An example for a single HSS environment is a server farm architecture. Use of SLF is not required when AS are configured/managed to use pre-defined HSS.

The Mobile-services Switching Centre (MSC) constitutes the interface between the radio system and the fixed networks. The MSC performs all necessary functions in order to handle the circuit switched services to and from the mobile stations. In order to obtain radio coverage of a given geographical area, a number of BSS and/or RNS are normally required; i.e. each MSC would thus have to interface to one or more BSS(s) and/or RNS(s). In addition several MSCs may be required to cover a country. When Intra Domain Connection of RAN Nodes to Multiple CN Nodes is applied, all the MSCs serving a pool-area share the responsibility to serve the MSs located in the pool-area. All these MSCs interface to all the BSS(s) and/or RNS(s) forming the pool-area. The Mobile-services Switching Centre is an exchange, which performs all the switching and signalling functions for mobile stations located in a geographical area designated as the MSC area. When Intra Domain Connection of RAN Nodes to Multiple CN Nodes is applied, one or more MSCs serve a pool-area, but each individual MS is served by only one out of these MSCs, as described in TS 23.236. The main difference between a MSC and an exchange in a fixed network is that the MSC has to take into account the impact of the allocation of radio resources and the mobile nature of the subscribers and has to perform in addition, at least the following procedures:

• procedures required for the location registration (see TS 23.012);
• procedures required for handover (see TS 23.009).

When needed, the MSC can be implemented in two different entities: the MSC Server, handling only signalling, and the CS-MGW, handling user's data. A MSC Server and a CS-MGW make up the full functionality of a MSC. The CS fallback enabled MSC supports the following additional functions according to TS 23.272:

• Maintaining SGs association towards MME for EPS/IMSI attached UE;
• Supporting SMS procedures according to CS Fallback.

If a network delivering a call to the PLMN cannot interrogate the HLR, the call is routed to an MSC. This MSC will interrogate the appropriate HLR and then route the call to the MSC where the mobile station is located. The MSC which performs the routing function to the actual location of the MS is called the Gateway MSC (GMSC). The acceptance of an interrogation to an HLR is the decision of the operator. The choice of which MSCs can act as Gateway MSCs is for the operator to decide (i.e. all MSCs or some designated MSCs). If the call is a voice group/broadcast call, it is routed directly from the GMSC to the VBS/VGCS Anchor MSC, based on information (VBS/VGCS call reference) contained in the dialled number (see also TS 43.068 and TS 43.069). When needed, the GMSC can be implemented in two different entities: the GMSC Server, handling only signalling, as defined below, and the CS-MGW, defined above. A GMSC Server and a CS-MGW make up the full functionality of a GMSC.

The Interworking Function (IWF) is a functional entity associated with the MSC. The IWF provides the functionality necessary to allow interworking between a PLMN and the fixed networks (ISDN, PSTN and PDNs). The functions of the IWF depend on the services and the type of fixed network. The IWF is required to convert the protocols used in the PLMN to those used in the appropriate fixed network. The IWF may have no functionality where the service implementation in the PLMN is directly compatible with that at the fixed network. The interworking functions are described in TS 29.007.

The location register function in the SGSN stores two types of subscriber data needed to handle originating and terminating packet data transfer:

• subscription information:
  • the IMSI;
  • one or more temporary identities;
  • zero or more PDP addresses.
• location information:
  • depending on the operating mode of the MS, the cell or the routeing area where the MS is registered;
  • the VLR number of the associated VLR (if the Gs interface is implemented);
  • the GGSN address of each GGSN for which an active PDP context exists.

The SGSN .provide support for Direct Tunnel functions as specified in TS 23.060. The organisation of the subscriber data in the SGSN is defined in TS 23.008 and TS 23.060. The procedures for information transfer between the SGSN, the GGSN, the VLR and the HLR are defined in TS 23.016 and TS 23.060. The SGSN provides support for SRVCC functions as specified in TS 23.216.

The location register function in the GGSN stores subscriber data received from the HLR and the SGSN. There are two types of subscriber data needed to handle originating and terminating packet data transfer:

• subscription information:
  • the IMSI;
  • zero or more PDP addresses.
• location information:
  • the SGSN address for the SGSN where the MS is registered.

The organisation of the subscriber data in the GGSN is defined in TS 23.008 and TS 23.060. The procedures for information transfer between the GGSN, the SGSN and the HLR are defined in TS 23.016 and TS 23.060.

MME is the control plane entity within EPS supporting functions as listed below. For detailed functional role of MME, see specifications TS 23.401, TS 23.402 and TS 36.300. Mobility Management,

• NAS signalling and security;
• Inter CN node signalling for mobility between 3GPP access networks;
• Tracking Area list management;
• PDN GW and Serving GW selection;
• SGSN selection for handovers to 2G or 3G 3GPP access networks;
• Roaming ;
• Authentication;
• Bearer management functions including dedicated bearer establishment.
• Lawful Interception of signalling traffic.

In order to support 3GPP2 access, MME supports:

• HRPD access node selection and maintenance for handovers to HRPD;
• Transparent transfer of HRPD signalling messages and transfer of status information between E-UTRAN and HRPD access;
• Transparent transfer of RIM signalling messages between E-UTRAN and HRPD access;

The procedures for information transfer between the SGSN, the MME and the HSS are defined in TS 23.401 and TS 23.060. The CS fallback enabled MME supports the following additional functions according to TS 23.272:

• Deriving a VLR number and LAI out of the TAI
• Maintaining of SGs association towards MSC/VLR for EPS/IMSI attached UE
• Initiating IMSI detach at EPS detach
• Initiating paging procedure towards eNodeB when MSC pages the UE for CS services
• Supporting SMS procedures for CS Fallback.
• Support CS Fallback interface and related functions for 1xRTT CDMA access.

When the MME supports the interworking to 3GPP CS, the MME supports the following functions as specified in TS 23.216:

• Performing the PS bearer splitting function by separating the voice PS bearer from the non-voice PS bearers.
• Handling the non-voice PS bearers handover with the target cell as according to Inter RAT handover procedure as defined in TS 23.401.
• Initiating the SRVCC handover procedure for handover of the voice component to the target cell.
• Coordinating PS handover and SRVCC handover procedures when both procedures are performed,
• support interworking and SRVCC related functions for 1xRTT CDMA access.

In addition to the functions described for GPRS, for EPC SGSN functions include:

• Inter EPC node signalling for mobility between 2G/3G and E-UTRAN 3GPP access networks;
• PDN and Serving GW selection: the selection of S GW/PDN GW by the SGSN is as specified for the MME;
• MME selection for handovers to E-UTRAN 3GPP access network.

For details, see TS 23.401 and TS 23.060.

Trusted and Untrusted Non-3GPP Access Networks are IP access networks that use access technology whose specification is out of the scope of 3GPP. Whether a Non-3GPP IP access network is Trusted or Untrusted is not a characteristic of the access network. In non-roaming scenario it is the HPLMN's operator decision if a Non-3GPP IP access network is used as Trusted or Untrusted Non-3GPP Access Network. In roaming scenario, the HSS/3GPP AAA Server in HPLMN makes the final decision of whether a Non-3GPP IP access network is used as Trusted or Untrusted non-3GPP Access Network. The HSS/3GPP AAA Server may take the VPLMN's policy and capability returned from the 3GPP AAA Proxy or roaming agreement into account. For details, see TS 23.402.

The functionality of ePDG includes the following:

• Functionality defined for the PDG in TS 23.234 for the allocation of a remote IP address as an IP address local to the ePDG which is used as CoA when S2c is used;
• Functionality for transportation of a remote IP address as an IP address specific to a PDN when S2b is used;
• Routing of packets from/to PDN GW (and from/to Serving GW if it is used as local anchor in VPLMN) to/from UE; if GTP based S2b is used, this includes routing of uplink packets based on the uplink packet filters in the TFTs assigned to the S2b bearers of the PDN connection;
• Routing of downlink packets towards the SWu instance associated to the PDN connection;
• De-capsulation/Encapsulation of packets for IPSec and, if network based mobility (S2b) is used, for GTP or PMIP tunnels;
• Mobile Access Gateway (MAG) for PMIPv6 if PMIP based S2b is used;
• Tunnel authentication and authorization (termination of IKEv2 signalling and relay via AAA messages);
• Local mobility anchor within untrusted non-3GPP access networks using MOBIKE (if needed);
• Transport level packet marking in the uplink;
• Enforcement of QoS policies based on information received via AAA infrastructure;
• Lawful Interception.

For details, see TS 23.402.

The 3GPP AAA Server is located at the HPLMN and provides support for non-3GPP Access users with services like Authentication, Authorisation and location management services in order to get access to EPS. It also contains necessary user related information in order to grant access to non-3GPP access. It also coordinates the information needed to support mobility between 3GPP and non-3GPP accesses such as coordination of PDN GW information. It interacts with HSS to maintain consistent information for users supporting mobility and service continuity between 3GPP and non-3GPP access. For details, see TS 23.402.

The 3GPP AAA Proxy provides support for roaming non-3GPP Access users in the VPLMN necessary the Authentication, Authorisation and location management services in order to get access to EPS. It may also provide roaming related information for support of chaining scenarios as described in TS 23.402. If an S-GW is needed for non-3GPP access in the visited network, the 3GPP AAA proxy selects an S-GW for the UE during initial attach or handover attach.

The ANDSF (which is an optional element in the architecture) contains data management and control functionality necessary to provide network discovery and selection assistance data as per operators' policy. The ANDSF is able to initiate data transfer to the UE, based on network triggers, and respond to requests from the UE. It provides functions such as inter-system mobility policy, access network discovery information. The ANDSF in the subscriber's home operator network may interact with other databases such as the HSS user profile information residing in subscriber's home operator network. Details of such interaction with these databases are not described in this Release of the specifications. For details on ANDSF, see TS 23.402.