USSD (Unstructured Supplementary Service Data)
USSD is a kind of protocol (Supplementary Service protocol) that is designed for a UE to communicate with the service provider's computer. It was originally designed for GSM cellular communication and now is being used in WCDMA network as well.
In terms of base protocol, it is very similar to SMS. Like SMS, it is using control channel to carry the data. In WCDMA, it use DCCH to carry the data and in GSM it use SDCCH to carry the data.
However, there is minor difference in terms of managing a session. (According to Wikipedia )Unlike Short Message Service (SMS) messages, USSD messages create a real-time connection during a USSD session. The connection remains open, allowing a two-way exchange of a sequence of data. This makes USSD more responsive than services that use SMS.
< Example 1 > : MT USSD during Voice Call
1) RRC : RRC Connection Request
2) RRC : RRC Connection Setup
3) RRC : RRC Connection Setup Complete
4) RRC: initialDirectTransfer + MM : CM Service Request
5) RRC : downlinkDirectTransfer + MM:Authentication Request
6) RRC : uplinkDirectTransfer + MM:Authentication Response
7) RRC : Security Mode Command
8) RRC : Security Mode Complete
9) RRC : uplinkDirectTransfer + CC : Setup
10) RRC : downlinkDirectTransfer + CC : Call Proceeding
11) RRC : Radio Bearer Setup
12) RRC : Radio Bearer Setup Complete
13) RRC : downlinkDirectTransfer + CC : Alerting
14) RRC : uplinkDirectTransfer + CC : Connect
15) RRC : downlinkDirectTransfer + CC : Connect Acknowledge
16) < Voice Traffic >
17) NW --> UE : SS : Register (USSD : send 'Register')
18) NW <-- UE : SS : Facility (USSD : recieve 'Facility')
19) NW --> UE : SS : Release Complete (USSD : send 'Release Complete')
DL-DCCH-Message
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 0
cn-DomainIdentity: cs-domain (0)
nas-Message: 0b3b1c23a12102010002013d301904010004144d2aa83a9d...
GSM A-I/F DTAP - Register
Protocol Discriminator: Non call related SS messages
.... 1011 = Protocol discriminator: Non call related SS messages (0x0b)
0... .... = TI flag: allocated by sender
.000 .... = TIO: 0
..11 1011 = DTAP Non call Supplementary Service Message Type: Register (0x3b)
Facility
Element ID: 0x1c
Length: 35
GSM Mobile Application
Component: invoke (1)
invoke
invokeID: 0
opCode: localValue (0)
localValue: unstructuredSS-Notify (61)
ussd-DataCodingScheme: 00
0000 .... = Coding Group: Coding Group 0 - GSM 7 bit
.... 0000 = Language: German (0)
ussd-String: 4d2aa83a9d12413ad0d35e96838653d030cc6603
USSD String: MT USSD : Over CS Call
UL-DCCH-Message
message: uplinkDirectTransfer (27)
uplinkDirectTransfer
cn-DomainIdentity: cs-domain (0)
nas-Message: 8b3a05a203020100
GSM A-I/F DTAP - Facility
Protocol Discriminator: Non call related SS messages
.... 1011 = Protocol discriminator: Non call related SS messages (0x0b)
1... .... = TI flag: allocated by receiver
.000 .... = TIO: 0
..11 1010 = DTAP Non call Supplementary Service Message Type: Facility (0x3a)
Facility
Length: 5
GSM Mobile Application
Component: returnResultLast (2)
returnResultLast
invokeID: 0
DL-DCCH-Message
integrityCheckInfo
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 0
cn-DomainIdentity: cs-domain (0)
nas-Message: 0b2a1c05a203020100
GSM A-I/F DTAP - Release Complete
Protocol Discriminator: Non call related SS messages
.... 1011 = Protocol discriminator: Non call related SS messages (0x0b)
0... .... = TI flag: allocated by sender
.000 .... = TIO: 0
..10 1010 = DTAP Non call Supplementary Service Message Type:
Release Complete (0x2a)
Facility
Element ID: 0x1c
Length: 5
GSM Mobile Application
Component: returnResultLast (2)
returnResultLast
invokeID: 0
< Example 2 > : MT USSD during Idle - Notify
1) Paging Type 1
2) RRC : RRC Connection Request
2) RRC : RRC Connection Setup
3) RRC : RRC Connection Setup Complete
4) RRC: initialDirectTransfer + MM : CM Service Request
5) RRC : downlinkDirectTransfer + MM:Authentication Request
6) RRC : uplinkDirectTransfer + MM:Authentication Response
7) RRC : Security Mode Command
8) RRC : Security Mode Complete
9) SS : Register (USSD : send 'Register')
10) SS : Facility (USSD : recieve 'Facility')
11) SS : Release Complete (USSD : send 'Release Complete')
12) RRC : RRC Connection Release
13) RRC : RRC Connection Release Complete
Example Contents of Step 1)
PCCH-Message
message: pagingType1 (0)
pagingType1
pagingRecordList: 1 item
Item 0
PagingRecord: cn-Identity (0)
cn-Identity
pagingCause: terminatingHighPrioritySignalling (4)
cn-DomainIdentity: cs-domain (0)
cn-pagedUE-Identity: tmsi-GSM-MAP (1)
tmsi-GSM-MAP: 00000001
Normally we send or receive one USSD message in one RRC session, but there case be a case where UE or NW want to send multiple USSDs consecutively. We can think of following two cases for this consecutive USSD.
< Case 1 >
1) < Make a call (CS or PS) >
2) SS : Register (USSD : send 'Register') - First USSD String
3) SS : Facility (USSD : recieve 'Facility')
4) SS : Release Complete (USSD : send 'Release Complete')
5) SS : Register (USSD : send 'Register') - Second USSD String
6) SS : Facility (USSD : recieve 'Facility')
7) SS : Release Complete (USSD : send 'Release Complete')
< Case 2 >
1) < Make a call (CS or PS) >
2) SS : Register (USSD : send 'Register') - First USSD String
3) SS : Facility (USSD : recieve 'Facility')
4) SS : Register (USSD : send 'Register') - Second USSD String
5) SS : Facility (USSD : recieve 'Facility')
6) SS : Release Complete (USSD : send 'Release Complete')
Somehow when I tested these two cases with some of commerical UE, < Case 2 > work as expected but < Case 1 > does not work as expected. UE send 'Release Complete with 'ussd-busy' error at step 6). I am not sure yet.. if this is because 3GPP spec does not allow it or any UE issues. In terms of 3GPP spec, I see conflicting statements as follows. It will be appreciated if any expert in this area provide some advice on this.
TS 24.080 4.3.2.22 ussd-Busy
This error is returned by the MS to the network when the MS is not able to process the unstructured supplementary service data operation due to an on-going MMI input of the user or an already existing call independent supplementary service transaction.
TS 24.090 5.1.1 Normal Operation
When the MS receives an USSD operation in parallel to any call independent supplementary service transaction, it shall respond with a return error component in a RELEASE COMPLETE message, containing the "USSD-Busy" error as specified in 3GPP TS 24.080, to indicate the failure in handling a parallel USSD operation. However, the network is allowed to initiated USSD operations in parallel to call related transactions.
On-line tool for decoding/ecoding USSD text with GSM 7 Bit
When you want to encode USSD Hex string from a text string, I would recommend you to try with the following tool from http://smstools3.kekekasvi.com/topic.php?id=288
