The combination of mobile and fixed communications: how it works from the inside out

Now we will consider the aspects of the implementation of the IN-protocol of the CAMEL mobile network and how the FMC fixed-mobile convergence service functions on its basis. Useful for those who are pragmatically interested in telephony in the office or more theoretically - the work of some aspects of mobile communications in principle.
What does it mean?
- Simple numbers: no longer need to memorize or record long DEF numbers. Any employee can get through knowing his very short office number.
- With FMC, you can simply dial the number and immediately connects to the desired fixed phone without dialing any additional ones on the PBX. Connection time is reduced by about a minute.
- You can create individual rules for incoming and outgoing calls: for example, there are no more "extra" calls outside working hours.
Let's start with the implementation aspects of the CAMEL mobile network's IN protocol.
How it works?
If we recall the basics of building a GSM network, then in principle its structure can be represented as follows.

- BTS (Base Transceiver Station) - a base station. Its functions include the formation of a radio signal, encryption, installation and maintenance of the signal at a physical level.
- BSC (Base Station Controller) - a base station controller. This node is responsible for managing a group of base stations, adjusting the signal level and conducting a handover (transferring a call from one base station to another in talk mode).
- MSC (Mobile Switching Center) is a mobile switching center. Its functions include directly switching calls between two (or more) subscribers. In practice, this node is often combined with VLR (Visitor Location Register) - a guest location register, a database responsible for storing all user information about subscribers registered in the coverage area of this switch.
- HLR (Home Location Register) - home (reference) register of locations. A distributed database that stores all the information about the subscribers of the mobile operator: their services, settings and current status.
- AuC - (Authentication Center) - an authentication center responsible for authenticating a subscriber during his registration in the network.
If we consider their interaction from the point of view of signaling, then initially the interaction of the elements was built on the basis of the signaling protocol OKS7 (Channel-wide Alarm No. 7).

Then, in the light of the development of IP networks, this protocol was finalized and turned into SigTRAN (Signaling Transport, a transport signaling protocol based on TCP \ IP networks). You
can find more detailed information on the structure of the GSM network and OKS7 signaling in this and this post (separate Thank you for a couple of pictures taken from the authors).
And now we will pass directly to the features of the implementation of intelligent services protocols INAP / CAMEL. Inap(Intellectual Network Application Part) is Ericsson’s protocol, which came to mobile networks from fixed networks; CAMEL (Customized Applications for Mobile Enhanced Logic) is a protocol developed exclusively for mobile networks that extends their functionality. The specifications (primarily 3GPP TS 23.078) currently describe 4 versions of this protocol.
If we touch on the technical side of the implementation, in a simplified form it looks as follows:

When connecting to a subscriber in a billing system of any CAMEL services, O-CSI (Originating CAMEL Subscription Information, information about CAMEL subscriptions for outgoing calls) and / or Tsi(Terminating CAMEL Subscription Information, CAMEL subscription information for incoming calls) subscriptions that are responsible for the processing logic of outgoing and incoming calls, respectively. The parameters of the subscription indicate the gsmSCF platform address, which contains the logic for further processing of the call, service key - a unique identifier for each of the available CAMEL services and Default call handling (call processing script “by default”) - the action to be performed with the call in case triggered bypass. The value can be adjusted depending on the functionality and logic of the service. For example, if it is necessary that if the CAMEL platform hangs or is overloaded, the call still passes, then you need to set the value of this parameter to “Continue”. And if you need to stop processing this call - "Release".
A classic example is disabling billing for prepaid subscribers in cases of overloads. In this case, Default call handling has the value “Continue”, i.e. a connection is established without generating CDRs (Call Data Records) in billing.
This feature was successfully used by students of a Rostov University who came from some banana republic of Central Africa. At the moment the bypass was triggered (they were determined by constant balance requests - when pre-order billing falls, an error begins to return to * 102 # requests), students started calling home, relatives and friends. And since the phenomenon of falling billing is a rare event (New Year, March 8 and a couple of similar holidays), they tried to communicate with a margin.
CSE - CAMEL service environment. An IN platform that stores all the logic of services.
SSF - Service Switching Function. This functionality is activated on the switches and its main task is to “trigger” calls in all cases of activity of mobile subscribers. Simply put, if the switch “sees” that the caller has an O-CSI subscription, he initiates a call to the IN platform.
SCF - Service Control Function. Functionality on the side of the IN platform that handles request processing, response to it, and correct completion of dialogs between nodes.
When an incoming call arrives at a CAMEL subscriber, the network initiates a sequence of actions called Two step HLR interrogation . Schematically, it is shown in the picture below.

An incoming call arrives at the MSC.
First of all, MSC sends a MAP (Mobile Application Part) request for Routing Info (request for routing information) towards HLR. The response message should provide information about the current status of the subscriber (on, off, in talk mode, etc.), which the HLR, in turn, requests to the MSC / VLR with the message Provide Subscriber Info (providing user information), and also information on available T-CSI subscriptions.
After that, at the level of the CAP protocol (CAMEL Application Part, the application part of the CAMEL protocol), the session is initiated towards the IN platform. Below is one of the possible scenarios of such a dialogue between the MSC and the IN platform.

The UDT BEGIN initialDP (DP - Detection Points) message describes the initial request process towards the IN platform. The input parameters are called (called) (2) and calling (calling) (3) numbers, as well as information from the T-CSI subscription: global title (address) of the platform and service key (1). In addition to this, the type of dialogue is indicated - incoming connection (4). Post UDT CONTINUE requestReportBCSMEvent connect
--- INITIAL DP ---
--- SERV KEY ---
SERV KEY : 51 (1)
--- CALLED NO ---
--- CALLED NO ---
NOA : .0000011 = National (significant) number (national use)
INN IND : 1....... = Routing to internal network number not allowed
NUMB PLAN : .001.... = ISDN (Telephony) numbering plan (Rec. E.164)
ADDRESS : 903041ХХХХ (2)
--- CALLING NO ---
--- CALLING NO ---
NOA : .0000011 = National (significant) number (national use)
NI : 0....... = Complete
NUMB PLAN : .001.... = ISDN (Telephony) numbering plan (Rec. E.164)
PRESENT IN : ....00.. = Presentation allowed
SCREENING : ......11 = Network provided
ADDRESS : 906361УУУУ (3)
--- CLG PTY C ---
--- CLG PTY C ---
CATEGORY : 10 = Ordinary Calling Subscriber
--- LOC NO ---
--- LOC NO ---
NOA : 04h = International number
INN IND : 0....... = Routing to internal network number allowed
NUMB PLAN : .001.... = ISDN (Telephony) numbering plan (Rec. E.164)
PRESENT IN : ....00.. = Presentation allowed
SCREENING : ......11 = Network provided
ADDRESS : 7962ZZZZZZZ
--- BEARER CAP ---
--- BEARER CAP ---
--- BEARER CAP ---
CODING STD : .00..... = CCITT standardized coding
INFO TC : ...00000 = Speech
TRANS MODE : .00..... = Circuit mode
INFO TR : ...10000 = 64 kbit/s
LAYER ID : .01.....
USRINFO L1 : ...00011 = Recommendation G.711 A-law
--- E TYP BCSM ---
E TYP BCSM : 12 = termAttemptAuthorized (4)(BCSM - Basic Call State Model) describes all the possible events that may occur when trying to establish a voice connection: the subscriber is busy, unavailable, not answering. They are those “Detection points” that were initiated by the previous message. At the very end, the Connect message indicates the number to which the call should be connected. This can be either the DEF number of the subscriber directly, or various technological numbers used to implement additional functionality. At the same stage, if the subscriber has restrictions on incoming communication, call processing will be interrupted with cause = ReleaseCall. The following UDT CONTINUE eventReportBCSM message indicates which of the described events ultimately occurred
--- OPERATION ---
OPERATION : 23 = requestReportBCSMEvent
--- RQ RP BCSM ---
--- BCSM EVTS ---
--- BCSM EVENT ---
--- E TYP BCSM ---
E TYP BCSM : 17 = tDisconnect
--- MONIT MODE ---
MONIT MODE : 0 = interrupted
--- LEG ID ---
--- SEND SD ID ---
LEG TYPE : 02h = leg2
--- BCSM EVENT ---
--- E TYP BCSM ---
E TYP BCSM : 15 = tAnswer
--- MONIT MODE ---
MONIT MODE : 1 = notifyAndContinue
--- LEG ID ---
--- SEND SD ID ---
LEG TYPE : 02h = leg2
--- BCSM EVENT ---
--- E TYP BCSM ---
E TYP BCSM : 13 = tBusy
--- MONIT MODE ---
MONIT MODE : 0 = interrupted
--- LEG ID ---
--- SEND SD ID ---
LEG TYPE : 02h = leg2
--- BCSM EVENT ---
--- E TYP BCSM ---
E TYP BCSM : 14 = tNoAnswer
--- MONIT MODE ---
MONIT MODE : 0 = interrupted
--- LEG ID ---
--- SEND SD ID ---
LEG TYPE : 02h = leg2
--- DP SP CRIT ---
--- APP TIMER ---
APP TIMER : 60
--- INVOKE ---
--- INVOKE ID ---
INVOKE ID : 1
=== CAP ===
--- INVOKE ---
--- OPERATION ---
OPERATION : 20 = connect
--- CONNECT ---
--- DST RT ADR ---
--- CALLED NO ---
--- CALLED NO ---
NOA : .0000010 = Unknown (national use)
INN IND : 0....... = Routing to internal network number allowed
NUMB PLAN : .001.... = ISDN (Telephony) numbering plan (Rec. E.164)
ADDRESS : 9031234567 === CAP ===
--- INVOKE ---
--- OPERATION ---
OPERATION : 24 = eventReportBCSM
--- EV RP BCSM ---
--- E TYP BCSM ---
E TYP BCSM : 13 = tBusy
--- E S I BCSM ---
--- T BSY ---
--- BUSY CAUSE ---
--- CAUSE ---
CODING STD : .00..... = CCITT standardized coding
LOCATION : ....0000 = User
CAUSE VAL : .0010001 = User busy
--- REC SIDEID ---
--- REC SIDEID ---
LEG TYPE : 02h = leg2
--- MISC C INF ---
--- MSG TYPE ---
MSG TYPE : 0 = request
After the UDT CONTINUE requestReportBCSMEvent connect message receives the number to which the call must be connected, Second Interrogation (second call to HLR) is initiated, and then the call is made to MSC / VLR to allocate MSRN (Mobile Station Roaming Number, temporary number , used exclusively to make a call to the incoming switch). Then this number in the response message is returned to the MSC and a call is initiated at the ISUP protocol level.
Call scripts
If we consider the CAMEL functionality directly in the context of FMC services, then call scenarios can be divided into 3 main categories:
1. Calls from a mobile phone to a mobile phone.

This scenario cannot be fully attributed to convergent service, but, nevertheless, I propose to consider it. The caller dials a known short number corresponding to the B-party. During processing on the CAMEL platform, it is converted to a full DEF number, to which the call is connected.
2. Calls from a mobile phone to a fixed phone.

In this scenario, the mobile subscriber also dials a short number, and, during the analysis, it becomes clear that this is a number from a fixed network. In this case, a unique prefix is inserted at the beginning of the number, according to which routing to the joint of the MSC-PBX is registered. At the terminal MSC, the prefix is cut off and the number that was dialed directly reaches the PBX. And then, already inside the fixed network, the call is routed to the desired office phone.
A feature of these scenarios is that mobile numbers can be assigned short numbers, which will be similar in structure to office numbers.
Life example: an employee has an office phone number 5577 and a mobile phone number 15577. You can call him either the first number (the office phone rings) or the second (the mobile number will ring).
It is also worth adding that a fixed connection can be organized both as a classic TDM connection and through SIP / RTP.
3. Calls from a fixed phone to a mobile phone.

In this scenario, the call comes from the PBX towards the mobile switch, which initiates the session to the CAMEL platform and in the response message returns the DEF number of the called mobile subscriber.
Pricing Benefits
- Calls between mobiles by short numbering are made at the price of a call within a closed group.
- Calls from mobile to fixed are made at the price of a call within a closed group.
- Calls from intranet roaming are made at the price of a call within a closed group.
Additional savings can be obtained for the client, who have their own distributed telephone network and are ready to organize several joints with the switches on the Beeline network.
