TSP Lab	Sga8NKeyServer - The GPRS Key Server	Sga8NKeyServer

The GPRS Key Server module

Features

Receives authentication information from Gr-monitor (NIMonitor) (SS7 messages)
Receives authentication information from Gn-monitor (GTPMonitor) (GTP messages)
Collects and stores IMSI and ciphering data in a dynamic table
Receives requests from GPRSMonitors
Collects and stores TLLI and other data in a dynamic table
Sends corresponding data for the requests from information tables

User interface

The main menu

Menu	Menuitem	Shortcut(s)	Meaning
[Actions]
	Reload GPRS monitor units' data from INI/[GPRSMonitors]		Reload GPRS monitor list from INI/[GPRSMonitors]
	Reload SGSN GT's from INI/[SGSN GTs]		Read GT list from the configuration file (`Sga8NKeyServer.ini`)
	Accept (GPRS & NI & IP) monitors	(Ctrl-A, or )	Allows the Monitor units connecting to the KeyServer
	Disconnect SS7_Gr(NI) Monitor from KeyServer gracefully		Disconnects the NI monitor unit from the KeyServer in the normal way `(gracefully)`
	Disconnect SS7_Gr(NI) Monitor from KeyServer immediately		Disconnects the NI monitor unit from the KeyServer immediately by breaking low layer sockets `(immediately)`
	Disconnect GTP_Gn(IP) Monitor from KeyServer gracefully		Disconnects the GTPMonitor from the KeyServer in the normal way `(gracefully)`
	Disconnect GTP_Gn(IP) Monitor from KeyServer immediately		Disconnects the GTPMonitor immediately by breaking low layer sockets `(immediately)`
	Backup IMSI & TLLI CipherKey entries		Dumps the content of IMSI and TLLI tables into the backup files
[Log]
	Find line containing...	(Ctrl-F)	Finds text in log window
	Find next matching line	(F3)	Finds next occurrence of text in log window
	Details		Detail level of logging (Off, Normal, Detailed, or Debug)
	Flush status-line counters		Writes status counters into the log These counters have been flushed once a day automatically.
[Options]
	Auto scroll	(ScrollLock, or )	Allows automatic scrolling of the log screen
	Show log	(Ctrl-Tab)	Shows the log screen
	Show GPRS monitor status	(Ctrl-Tab)	Shows the monitor status screen
	Save settings		Saves actual settings into the configuration file
[Mass Test]			This section is for test purpose
	Insert IMSI ...		Inserts some IMSI's into IMSI tables
	Query IMSI ...		Queries some IMSI's from the table
	Insert TLLI ...		Inserts some TLLI's into TLLI table
	Query TLLI ...		Queries some TLLI's from table

The popup menu of the monitor status screen

Right-click on the monitor status screen window to access this menu!

	Menuitem	Shortcut(s)	Meaning
	Disconnect this GPRS Monitor from KeyServer...		Disconnects the selected GPRS Monitor unit from the KeyServer in the normal way `(gracefully)` or immediately by breaking low layer sockets `(immediately)`
	Acknowledge previous problem of this GPRS Monitor :-)		When there is a problem with a monitor (request or answer is lost) a ':-)' sign will be shown in the monitor row. With this menuitem this sign can be removed.
	Acknowledge all previous problems :-) :-) :-)		All problems can be removed
	Remove hilite (no selection)		Remove selection from all row of the list

The bottom status-line

IMSI used/max: Actual/maximum size of the IMSI table (Size of this table is defined by [Advanced]/dwCypherKeyIMSIMaxCount key in Sga8NKeyServer.ini configuration file)
InfoUpdate: Number of updates related to IMSI table from SS7 and IP monitors
Overflow: if the size of IMSI table is reached the maximum then new IMSI's will be dropped and counted here
Forget_normal: an IMSI is forgotten when CancelLocation/purgeMS has been seen for it. Twenty SGSN GT's can be set, for which CancelLocation and PurgeMS MSU's are expected. (INI/[SGSN GTs]/sGTnn)
Forget_T/O: IMSI's which are getting older than [Advanced]/dwCypherKeyIMSILifeSec key defined in configuration file will be forgotten and counted here
Query hit/miss: Counts TLLI requests from GPRS monitors whose IMSI is/ is not in the IMSI table
GTP hit/miss: New authentication information (IMSI-Kc pairs) from GTP Monitor ('miss' is reserved and set to 0)
TCAP Allocated: number of pending TCAP transactions (of INI/[Advanced]/dwPendingTCAPMaxCount),
Overflow: More TCAP/BEGINs are arrived than INI/[Advanced]/dwPendingTCAPMaxCount and the new ones are dropped and counted here
Reuse: If the transaction ID of a pending TCAP transaction is seen in a new TCAP/BEGIN with different IMSI
T/O: Counts timeout-ed Results and Invocations (END's without corresponding BEGIN's / BEGIN's without their END's )
Rx'ed on SS7_Gr (byte/MSU/CRC): General counters for SS7 monitoring they give number of received bytes and MSU's and MSU's with CRC problem
Rx'ed on GTP_Gn (byte/pair/CRC): Counter about GTP traffic. Number of received bytes and IMSI-Kc pairs and GTP messages with CRC error
BEGIN (OK/bad): number of seen TCAP/BEGIN messages (correct/badly formatted)
CONT (trip/quint/bad): number of TCAP/Continue's containing triplets/quintets or in bad format
END (trip/quint/notOK/bad/Abort): TCAP/END messages containing triplets/quintets or error code or badly formatted in addition the Abort messages
UpdateLoc(OK/bad): Shows how many UpdateLocation have been seen. The latter also counts unexpected SGSN GT's in CadPA field of UpdateLocation MSU's.
CancelLoc (OK/bad): Shows how many CancelLocation have been seen. The latter also counts unexpected SGSN GT's in CadPA field of CancelLocation MSU's.
PurgeMS (OK/bad): Shows how many PurgeMS have been seen. The latter also counts unexpected SGSN GT's in CadPA field of PurgeMS MSU's.

TLLI used/max: Actual/maximum size of the TLLI table (Size of this table is defined by [Advanced]/dwCypherKeyTLLIMaxCount key
InfoUpdate: received updates for TLLI's from GPRSMonitors
Overflow: if the number of TLLI's is reached the maximum then new TLLI's will be dropped and counted here
Forget_T/O: If a TLLI is getting older than [Advanced]/dwCypherKeyTLLILifeSec it will be forgotten and this counter is increased
Query hit(reuse)/miss: Number of CipherInfo/ReUse/NoCipherInfo answers for requests of GPRS Monitors
Attach: Number of Attach's seen on Gb links
Detach: Detach's seen on Gb links
Update (IMSI/SRes/IOVI/IOVUI/TLLI/FC(all/1)/IMEI): Updates received from GPRS Monitors

Uptime: time elapsed since module has been started up
SS7 Gr: When it is grey NIMonitor is connected and when it is red the connection is down.
GTP Gn: It shows status of connection from GTPMonitor.

Configuration (`Sga8NKeyServer.ini`) file settings

Section	Entry	Example	Meaning
[Position]
	iLeft	140	Position of the program module on the display screen
	iTop	72	Position of the program module on the display screen
	iWidth	995	Position of the program module on the display screen
	iHeight	694	Position of the program module on the display screen
[Options]
	bAutoQuery	True	(Refer to the `[Options]/Auto-query monitors` menu item!)
	bAutoScroll	True	(Refer to the `[Options]/Auto scroll` menu item!)
[Advanced]
	wLogDetailLevel	3	(Equals to the listed order; refer to the `[Log]/Details` menu item!)
	sNIMonitorIPAddress	127.0.0.1	IP address of NIMonitor where SS7 messages are received from
	sIPMonitorIPAddress	127.0.0.2	IP address of GTPMon from where GTP messages are received from
	dwMaxLinesInLogWindow	1000	Number of lines in the log window on screen
	dwCypherKeyIMSIMaxCount	1000000	Size of IMSI table
	dwCypherKeyIMSILifeSec	604800	When an element of IMSI table reaches this time it will be dropped from table
	sCipherKeyIMSIBackupFile	c:\CipherKeyIMSIBackupFile.bin	Backup file for IMSI table
	bCipherKeyIMSIBackupPeriodic	True	Periodic (daily) backup of IMSI-table can be prohibited with the value "False"
	dwCypherKeyTLLIMaxCount	1000000	Size of TLLI table
	dwCypherKeyTLLILifeSec	604800	Elements of TLLI table are stored for this time
	sCipherKeyTLLIBackupFile	c:\CipherKeyTLLIBackupFile.bin	Backup file for TLLI table
	bCipherKeyTLLIBackupPeriodic	True	Periodic (daily) backup of TLLI-table can be prohibited with the value "False"
	dwPendingTCAPMaxCount	125	Number of concurrent TCAP transactions
	dwPendingTCAPLifeSec	3	TCAP transaction time-out, the program waits for END or ABORT for this time
	sLogFilesPath	d:\GPRS\Logfiles	Path for the LOG files
	sTrapFilesPath	d:\GPRS\LogFiles\Traps	Path for the SNMP Trap files to be sent
	sKcSourceStatisticsFilesPath	d:\GPRS\LogFiles\	Kc source statistics will be saved into *.csv files in this folder (defaults to ""; empty content results in no Kc-Source statistics dumped)
[GPRS Monitors]
	GM1	11.22.33.44	Symbolic name and IP address of GPRS monitors
[SGSN GTs]			Twenty (20) SGSN GT's can be set, for which CancelLocation MSU's are expected.
	sGTnn	36309123456	SGSN GT's, "nn" runs from 00 to 19.

Version history

v1.22b

(n) Handles "Identification Response" from GTP monitoring as well (as "SGSN Context Response").
(f) Bug causing GPF (when a hashed TLLI table partition overflows right at an UpdateTLLI) fixed.

v1.22

(n) Handles "Identification Response" from GTP monitoring as well (as "SGSN Context Response").

v1.21

(n) Handles legacy RequestInfo and new RequestInfo-Ex requests, replies CipherInfo or CipherInfo-Ex (including all Kc's) answers, respectively.
(n) Handles new "Update Kc" requests; counts are shown is status line and also logged quarterly.

v1.20

(c)

v1.19

(n) Timing out from IMSI memory is logged for each record.
(n) New menuitem: "Actions / Backup IMSI & TLLI CipherKey entries".

v1.18

(c) Garbage collection in IMSI table is based on the entries' last access date (used to base on their last update date).
(c) IMSI table entries have an additional field of 4 bytes to store the last access date.
(c) New IMSI CipherKey backup file ('IMS5') for the last access date field per IMSI; use converter to upgrade.

v1.17bis (v1.17 to v1.18 upgrade)

(n) A "use-it-once" command line utility, for upgrading IMSI CipherKey backup file from 'IMS4' to 'IMS5'.

v1.17

(c) Garbage collection in TLLI table is based on the entries' last access date (used to base on their last update date).

v1.16

(c) ForgetTLLI is accepted even if its timestamp equals to the timestamp of the preceding UpdateTLLI command.

v1.15

(c) Upto 20 authentication records are handled for each IMSI (instead of the former limit of 10).
(c) New IMSI CipherKey backup file ('IMS4') for the 20 authentication records per IMSI; use converter to upgrade.
(c) Requires (10*13-2)=128 bytes more for each IMSI entry.

v1.14

(n) Size of pending outgoing CipherInfo answer buffer is increased from 1 MB to 2 MB for each Monitor; this results in a 15 MB increase of overall memory requirement.
(n) Periodic (daily) backup of IMSI- and TLLI-tables can be prohibited.
(n) INI/[Advanced]/bCipherKeyIMSIBackupPeriodic; can be set on-the-fly, defaults to "True".
(n) INI/[Advanced]/bCipherKeyTLLIBackupPeriodic; can be set on-the-fly, defaults to "True".
(c) Periodic (daily) backup of IMSI- and TLLI-tables is done at 3AM (in winter time) or 4AM (in summer time); used to be 2 hours earlier.

v1.13

(n) New detach notifications with CauseCode= 1, 2, and 3 are counted separately.

v1.12

(n) Kc-Source statistics are flushed in CSV format in every 15 minutes.
(n) Menuitem "Log / Flush Kc-Source statistics"
(n) INI/[Advanced]/sKcSourceStatisticsFilesPath (defaults to ""; empty content results in no Kc-Source statistics dumped).
(n) Source of triplets on SS7_Gr links (either real or faked from quintets) is derived.
(n) Uses Source-of-Kc info from GTP-Monitor.
(n) Source-of-Kc info is incorporated into the Kc/DateTime field in the CipherInfo answer for the GPRS-Monitors.
(c) New IMSI CipherKey backup file ('IMS3') contains KcSource info for each authentication record; use converter to upgrade.
(c) Requires 12 bytes more for each IMSI entry.
(c) SS7_Gr / Received MSU count contains MSU's only (used to include FISU's and LSSU's as well).
(f) Failed if no NI-Monitors were defined (theoretical case).

v1.11bis

(n) Brand-new command line utility; use it once only, for upgrading IMSI CipherKey backup file from 'IMS2' to 'IMS3'.

v1.11

(c)
(f)

v1.10

(c)
(f)

v1.09

(c)
(f)

v1.08

(c)
(f)

v1.07bis

(c)
(f)

v1.07

(c) Kc for "new" IMSI records received on the GTP (Gn) link are inserted into the IMSI table (with a fake RAND value).
(f) Filler bytes of CipherInfo replies are explicitly initialized.

v1.06

(c) IMSI entry is not removed if an UpdateGPRSLocation is seen on the SS7 (Gr) link in the former second preceding the CancelLocation operation.
(c) PurgeMS is handled from the SS7 (Gr) link; acts as if it was a CancelLocation.
(c) UpdateGPRSLocation and PurgeMS operations are counted in the status-bar (as well as in the daily log).

v1.05

(n) CancelLocation MSU's (MAP1, MAP2, MAP3; both "IMSI" and "IMSIwithLMSI") are handled to reduce IMSI storage requirement; IMSI's canceled are forgotten at the next (actually: second) subsequent purging.
(n) Twenty (20) SGSN GT's can be set, for which CancelLocation MSU's are expected.
(n) INI/[SGSN GTs]/sGTnn, where "nn" runs from 00 to 19.
(n) "Actions" menu has a new menu item: "Reload SGSN GT's from INI/[SGSN GTs]"; it is automatically invoked (and logged) at start-up.
(n) New fields in the status bar (and in the log as well): "CancelLoc (OK/bad)"; the latter also counts unexpected SGSN GT's in CadPA field of CancelLocation MSU's.
(c) "SCCPCagPA" in log text is changed to "SCCPClgPA" to keep coherency with ITU standards.
(f) TCAP's "Overflow" and "Reuse" counters were switched, both in the log and in the status bar.

v1.04c

(n) Handles IMSI-Kc pairs received via GTP from the Gn (IP) link.
(n) INI/[Advanced]/sIPMonitorIPAddress (IP address for GTP Monitor; defaults to empty string).
(c) Menu item "Accept (GPRS & NI) Monitors" becomes "Accept (GPRS & NI & IP) Monitors".
(n) Menu item "Disconnect GTP_Gn (IP) Monitor from KeyServer immediately" is introduced.
(n) Details about GTP-Gn monitoring are shown in status line.
(c) Handles authentication data in the result of SendParameters and SendAuthenticationInfo also if they reside in TCAP/CONT MSU's. (Used to handle TCAP/END only.)
(n) New item in Log menu: "Flush status-line counters". (Note: these counters have been flushed once a day automatically.)
(n) Decodes quintets (UMTS "quintuplet" secret keys) seen on the Gr (SS7) link; converts and uses them seamlessly, just as if they were GPRS triplets.

v1.03

(f) Handles nested indefinite-length ASN.1 encoded tags as well.

v1.02

(n) FrameCounters can be set independently for either directions and for any SAPI.
(n) Count of setting one or all FrameCounters are displayed separately.
(n) Counters for CipherInfoReuse and CipherInfoNA (Not Available) are installed (both in status bar and in the 15 minute log).

v1.00

(n) IMSI and TLLI tables are backed up once a day, at UTC midnight. (Formerly at every quarter hour.)

v0.90 [beta5]

(c) RAND values corresponding to an IMSI are saved when an UpdateTLLI requests an existing TLLI (as "new"), and the "old" one exists as well.
(c) CipherInfo is no longer zeroed when an UpdateTLLI requests an existing TLLI (as "new"), and the "old" one does not currently exist.
(f) Only the very first FrameCounter set (of the array) was updated.

v0.90 [beta4]

(c) UpdateTLLI request is no longer checked against the time-stamp of the last change.

v0.90 [beta3]

(n) Outgoing CipherInfo answers are buffered (up to 1 MB) if GPRS Monitor is slow (busy); pending outgoing byte count is displayed for each Monitor.
(c) Received/sent bytes from/to GPRS Monitors are displayed in kbytes (used to be in bytes).
(c) One KeyServer can handle up to 15 GPRS Monitor units simultaneously.
(n) Module start-up log contains section name along the INI entry names.
(c) Authentication triplets are kept until they shift out.

v0.90 [beta2]

(n) Quintuplet (UMTS?) authentication answers are handled and counted.
(n) IMEI is stored in the TLLI table, along with its respective timestamp.
(n) IMEI updates are also counted.
(c) Long status line is divided into two.
(n) Removes extra trailing "0" from bogus SCCP/CadPA fields.
(f) Used to hang for some quintuplet authentication answers.

v0.90 [beta1]

The very first release.