The Short Message Service is realised by the use of the Mobile Application Part (MAP) of the SS7 protocol, with Short Message protocol elements being transported across the network as fields within the MAP messages.[1] These MAP messages may be transported using "traditional" TDM based signalling, or over IP using SIGTRAN and an appropriate adaptation layer.
The Short Message protocol itself is defined by 3GPP TS 23.040 for the Short Message Service - Point to Point (SMS-PP),[2] and 3GPP TS 23.041 for the Cell Broadcast Service (CBS).[3]
Four MAP procedures are defined for the control of the Short Message Service:[1]
Mobile Originated (MO) short message service transfer;
Mobile Terminated (MT) short message service transfer;
Short message alert procedure;
Short message waiting data set procedure.
MO Short Message Service transfer
Call flow for the mobile-originated Short Message Service
The diagram to the right depicts a simplified call flow for a successful submission of a mobile-originated Short Message (SM).[1]
When the subscriber sends a Short Message, the handset sends the text message over the air interface to the Mobile Switching Center (MSC)/Serving GPRS Support Node (SGSN). Along with the actual text of the Short Message, the destination address of the SM and the address of the Short Message service center (SMSC) are included, the latter taken from the handset's configuration stored on the SIM card.[4]
Regardless of the air interface technology, the VMSC/SGSN invokes the MAP service package MAP_MO_FORWARD_SHORT_MESSAGE to send the text to the Interworking MSC of the Service Centre whose address was provided by the handset. This service sends the mo-ForwardSM[Note 1] MAP operation to the SMSC identified in the SM Submission from the handset, embedded within a Transaction Capabilities Application Part (TCAP) message, and transported over the core network using the Signalling Connection Control Part (SCCP).[1]
The Interworking MSC of the SMSC, on receipt of the MAP mo-ForwardSM message, passes the SMS-PP[2]Application Protocol Data Unit (APDU) containing the text message to the actual Service Centre (SC) of the SMSC for storing, and subsequent "forwarding" (delivery) to the destination address and the SC returns an acknowledgement indicating success or failure. On receipt of this submission status from the Service Centre, the Interworking MSC will send an appropriate indication back to the VMSC/SGSN of the sending subscriber. The message submission status is then forwarded, over the air interface, to the subscriber's handset.[4][Note 2]
MT Short Message Service transfer
Call flow for the mobile terminated Short Message Service
The figure to the right depicts a call flow for mobile-terminated Short Message delivery.[1] For the sake of simplicity, some of the interactions between the VMSC and VLR, and VMSC and Handset, have been omitted, and only the case when SMS home routing is not in use is shown.
When the SMSC determines it needs to attempt to deliver a Short Message to its destination, it will send the SMS-PP APDU containing the text message, the "B-Party" (destination phone number) and other details to the Gateway MSC (GMSC) logical component on the SMSC.[2] The GMSC, on receipt of this Short Message, needs to discover the location of the B-Party in order to be able to correctly deliver the text to the recipient (the term Gateway MSC, in this context, indicating an MSC that is obtaining routing information from the Home Location Register (HLR)). To do this, the GMSC invokes the MAP service package MAP_SEND_ROUTING_INFO_FOR_SM, which sends a sendRoutingInfoForSM (SRI-for-SM) MAP message to the destination number's HLR, requesting their present location. This SRI-for-SM message may be sent to an HLR in the same network as the SMSC, or via an interconnect to an HLR in a foreign PLMN, depending on which network the destination subscriber belongs to.
The HLR performs a database lookup to retrieve the B-Party's current location, and returns it in an acknowledgement message to the SMSC's GMSC entity. The current location may be the MSC address the subscriber is currently roaming on, the SGSN address, or both. The HLR may also return a failure, if it considers the destination to be unavailable for short messaging; see the Failed Short Message delivery section below.
Having obtained the routing information from the HLR, the GMSC will attempt to deliver the Short Message to its recipient. This is done by invoking the MAP_MT_FORWARD_SHORT_MESSAGE service, which sends a MAP mt-ForwardSM[Note 3] message to the address returned by the HLR, regardless of whether it is an MSC (Circuit Switched SMS delivery) or an SGSN (Packet Switched SMS delivery).
The VMSC will request the information needed for it to deliver the Short Message to its recipient by sending a Send_Info_for_MT_SMS message to the VLR. The VLR will then instigate a page request, or subscriber search, for the destination subscribers Mobile Subscriber ISDN Number (MSISDN), and return the result to the VMSC. Since a typical deployment sees the VLR being co-located with the MSC, this message flow is usually internal to the platform.[Note 4] Should the page or search for the subscriber fail, the VLR will indicate the failure cause to the VMSC, which will abort the Short Message delivery procedure and return the failure to the SMSC (see the Failed Short Message delivery section below). If the page of the handset was successful, the VMSC will then send to the SMSC indicating successful delivery. The GMSC component of the SMSC passes the result of the delivery attempt to the Service Centre. In the case of successful delivery, the delivered text message will be removed from the Store and Forward Engine (SFE) and, if requested, a delivery report sent to the text originator.[2] If the delivery failed, the SMSC invokes a retry procedure to periodically make further attempts at delivery; additionally, it may register with the HLR to receive a notification when the B-Party becomes available for Short Message delivery in the future (see the Failed Short Message delivery section below).
Failed Short Message delivery
When the VMSC/SGSN indicates a Short Message delivery failure, the SMSC may send a message to the HLR, using the MAP_REPORT_SM_DELIVERY_STATUS procedure, indicating the reason for the delivery failure and requesting that the SMSC be put on a list of service centres wanting to be notified when the destination party becomes available again. The HLR will set a flag against the destination account, indicating that it is unavailable for short message delivery, and store the SMSC's address in the Message Waiting Data (MWD) list for the destination party. Valid flags are Mobile Not Reachable Flag (MNRF), Memory Capacity Exceeded Flag (MCEF) and Mobile Not Reachable for GPRS (MNRG). The HLR will now start responding to SRI-for-SM requests with a failure, indicating the failure reason, and will automatically add the requesting SMSC's address to the MWD list for the destination party. (However, if the SRI-for-SM message has priority flag set then the HLR will reply with VLR address if available)
The HLR may be informed of a subscriber becoming available for Short Message delivery in several ways:
Where the subscriber has been detached from the network, a reattach will trigger a Location Update to the HLR.
Where the subscriber has been out of coverage, but not fully detached from the network, on coming back into coverage it will respond to page requests from the Visitor Location Register (VLR). The VLR will then send a Ready-for-SM (mobile present) message to the HLR.
Where the MS has had its memory full, and the subscriber deletes some texts, a Ready-for-SM (memory available) message is sent from the VMSC/VLR to the HLR.
Upon receipt of an indication that the destination party is now ready to receive short messages, the HLR sends an AlertSC MAP message to each of the SMSCs registered in the MWD list for the subscriber, causing the SMSC to start the Short Message delivery process again, from the beginning.[1]
Additionally, the SMSC will go into a retry schedule, attempting to periodically deliver the SM without getting an alert. The retry schedule interval will depend on the original failure cause - transient network failures will result in short retry schedule, whereas out of coverage will typically result in a longer schedule.
MAP operations
The MAP operations related to Short Message transfer are summarized in the following table:
Operation
Code
Source → Target
MAP
1
2
3
MT-ForwardSM
44
GMSC → MSC/SGSN
−
−
+
MO-ForwardSM
46
MSC/SGSN → IWMSC
−
−
+
SendRoutingInfoForSM
45
GMSC → HLR
+
+
+
ForwardSM
46
GMSC → MSC/SGSN
+
+
−
ForwardSM
46
MSC/SGSN → IWMSC
+
+
−
ReportSM-DeliveryStatus
47
GMSC → HLR
+
+
+
AlertServiceCentreWithoutRes
49
HLR → IWMSC
+
−
−
InformServiceCentre
63
HLR → GMSC
−
+
+
AlertServiceCentreWithResult
64
HLR → IWMSC
−
+
+
InformServiceCentre
InformServiceCentre is a message that HLR may supply to sendRoutingInfoForSM or reportSM-DeliveryStatus response. The message is usually used to transfer MWD flags to Short Message service center.[1]
MAP Transport Protocols
While the MAP 3GPP specifications make some effort to divorce MAP from the layer that transports it, the typical transport is via TCAP which in turn is via SCCP/MTP[1-3] and/or SIGTRAN protocols (SUA, M3UA etc.).
A MAP_OPEN construct therefore is directly related to a TCAP_BEGIN with a MAP application context, a MAP_CLOSE is a TCAP_END.
If a message is being delivered using MAP phase 2 or higher, and over MTP rather than SIGTRAN then the maximum MTP PDU size may cause the sender to instigate segmented message sending. This process is not related to concatenation, but simply means that the transaction with the MSC/SMSC/SGSN involves more steps than usual. The recommended way[1] is an empty TCAP_BEGIN, followed by the MAP content within a TCAP_CONTINUE, and completing with a TCAP_END. The TCAP_BEGIN has TCAP related information that would otherwise cause the limit to be exceeded due to the additional fields added by MAP phase 2. The exact point that segmentation is required is dependent on factors such as the length of the addresses but is mainly dependent on the message length itself. 7 bit alphabet messages that are 140 characters or greater are typically subject to the MAP segmentation procedure.
This segmentation procedure is also increasingly followed, and optionally enforced, by carriers to avoid SMS spoofing impacting their customers. This works because the sending party must receive the responses in order to send a message and so their originating address must be correct.[5]
Notes
↑ In MAP Phase 1, there was no segregation of operation code for Mobile Originated and Mobile Terminated SMS messages, just a generic ForwardSM operation.
↑ A success indication in these contexts is only a notification that the SM has been submitted to the Service Centre, and does not mean successful delivery to the ultimate destination of the text message.
↑ Although MAP (phase 2 onwards) specifies a separate operation for mobile terminated Short Message delivery, often the mo-ForwardSM operation is used instead. Where this is the case, mobile originated and terminated messages are distinguished by the inclusion, in the TCAP dialogue portion, of an appropriate Application Context (AC). The relevant ACs are shortMessageMO-RelayContext and shortMessageMT-RelayContext. This use of a single operation code enables simple backwards compatibility with MAP phase 1 networks, which do not have separate operations for MO and MT Short Messages.
Short Message/Messaging Service, commonly abbreviated as SMS, is a text messaging service component of most telephone, Internet and mobile device systems. It uses standardized communication protocols that let mobile devices exchange short text messages. An intermediary service can facilitate a text-to-voice conversion to be sent to landlines.
Roaming is a wireless telecommunication term typically used with mobile devices, such as mobile phones. It refers to a mobile phone being used outside the range of its native network and connecting to another available cell network.
Multimedia Messaging Service (MMS) is a standard way to send messages that include multimedia content to and from a mobile phone over a cellular network. Users and providers may refer to such a message as a PXT, a picture message, or a multimedia message. The MMS standard extends the core SMS capability, allowing the exchange of text messages greater than 160 characters in length. Unlike text-only SMS, MMS can deliver a variety of media, including up to forty seconds of video, one image, a slideshow of multiple images, or audio.
The GPRS core network is the central part of the general packet radio service (GPRS) which allows 2G, 3G and WCDMA mobile networks to transmit IP packets to external networks such as the Internet. The GPRS system is an integrated part of the GSM network switching subsystem.
Mobility management is one of the major functions of a GSM or a UMTS network that allows mobile phones to work. The aim of mobility management is to track where the subscribers are, allowing calls, SMS and other mobile phone services to be delivered to them.
Network switching subsystem (NSS) is the component of a GSM system that carries out call out and mobility management functions for mobile phones roaming on the network of base stations. It is owned and deployed by mobile phone operators and allows mobile devices to communicate with each other and telephones in the wider public switched telephone network (PSTN). The architecture contains specific features and functions which are needed because the phones are not fixed in one location.
Unstructured Supplementary Service Data (USSD), sometimes referred to as "quick codes" or "feature codes", is a communications protocol used by GSM cellular telephones to communicate with the mobile network operator's computers. USSD can be used for WAP browsing, prepaid callback service, mobile-money services, location-based content services, menu-based information services, and as part of configuring the phone on the network.
GSM services are a standard collection of applications and features available over the Global System for Mobile Communications (GSM) to mobile phone subscribers all over the world. The GSM standards are defined by the 3GPP collaboration and implemented in hardware and software by equipment manufacturers and mobile phone operators. The common standard makes it possible to use the same phones with different companies' services, or even roam into different countries. GSM is the world's most dominant mobile phone standard.
Signalling Connection Control Part (SCCP) subsystem numbers are used to identify applications within network entities which use SCCP signalling.
A Short Message Service Center (SMSC) is a network element in the mobile telephone network. Its purpose is to store, forward, convert and deliver Short Message Service (SMS) messages.
The Mobile Application Part (MAP) is an SS7 protocol that provides an application layer for the various nodes in GSM and UMTS mobile core networks and GPRS core networks to communicate with each other in order to provide services to users. The Mobile Application Part is the application-layer protocol used to access the Home Location Register, Visitor Location Register, Mobile Switching Center, Equipment Identity Register, Authentication Centre, Short message service center and Serving GPRS Support Node (SGSN).
SMS spoofing is a technology which uses the short message service (SMS), available on most mobile phones and personal digital assistants, to set who the message appears to come from by replacing the originating mobile number with alphanumeric text. Spoofing has both legitimate uses and illegitimate uses. This can also send "mysterious" messages that look like they are from legitimate numbers or contacts.
An SMS gateway or MMS gateway allows a computer to send or receive text messages in the form of Short Message Service (SMS) or Multimedia Messaging Service (MMS) transmissions between local and/or international telecommunications networks. In most cases, SMS and MMS are eventually routed to a mobile phone through a wireless carrier. SMS gateways are commonly used as a method for person-to-person to device-to-person communications. Many SMS gateways support content and media conversions from email, push, voice, and other formats.
GSM procedures are sets of steps performed by the GSM network and devices on it in order for the network to function. GSM is a set of standards for cell phone networks established by the European Telecommunications Standards Institute and first used in 1991. Its procedures refers to the steps a GSM network takes to communicate with cell phones and other mobile devices on the network. IMSI attach refers to the procedure used when a mobile device or mobile station joins a GSM network when it turns on and IMSI detach refers to the procedure used to leave or disconnect from a network when the device is turned off.
System Architecture Evolution (SAE) is the core network architecture of mobile communications protocol group 3GPP's LTE wireless communication standard.
Insert Subscriber Data is a Subscriber Data Handling procedure in LTE services. This procedure is used to manage the subscription data of subscriber in MME and SGSN over S6a/S6d interface. IDR is invoked by Home Subscriber Server for subscription data handling. IDR is MAP subscriber management service utilized in GSM/UMTS networks, standardized by 3GPP, and defined in the MAP specification, TS 29.002. This service is used to provide specific subscriber data in the following environments: by an HLR to update a VLR, by an HLR to update a SGSN, and by an HSS to update a MME via IWF in an EPS. This service is primarily used by the home subscriber management entity to update the serving subscriber management entity when there is either a change in a subscriber parameter, or upon a location updating of the subscriber.
The Gateway Mobile Location Centre (GMLC) contains functionality required to support location-based service (LBS). In one public land mobile network (PLMN), there may be more than one GMLC. The GMLC is the first node an external LBS client accesses in a GSM, UMTS or LTE network. The GMLC may request routing information from the home location register (HLR) or home subscriber server HSS). After performing registration authorization, it sends positioning requests to either the visited mobile switching centre (VMSC), SGSN serving GPRS support node (SGSN) or mobile switching centre (MSC) server and receives final location estimates from the corresponding entity.
The MMS Architecture is the set of standards used by the Multimedia Messaging Service in mobile networks. The standards are prepared by 3GPP.
GSM 03.40 or 3GPP TS 23.040 is a mobile telephony standard describing the format of the Transfer Protocol Data Units (TPDU) of the Short Message Transfer Protocol (SM-TP) used in the GSM networks to carry Short Messages. This format is used throughout the whole transfer of the message in the GSM mobile network. In contrast, application servers use different protocols, like Short Message Peer-to-Peer or Universal Computer Protocol, to exchange messages between them and the Short Message Service Center (SMSC).
References
1 2 3 4 5 6 7 8 Mobile Application Part specification, 3GPP TS 29.002, available here
1 2 3 4 SMS Point to Point specification, 3GPP TS 23.040, available here
↑ Cell Broadcast Service specification 3GPP TS 23.041, available here
1 2 Point-to-Point (PP) Short Message Service (SMS) support on mobile radio interface specification,3GPP TS 24.011, available here
↑ 3GPP TS 33.204 3rd Generation Partnership Project; Transaction Capabilities Application Part (TCAP) user security; Annex D: Using TCAP handshake for SMS transfer
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
