LTE SG SMS

This tutorial shows how to test SMS over SG with Amari Callbox.  In this tutorial, it is assumed that you are already familiar with basic operations of the Callbox software and I would point out the only important parts of the operation specific to this test.

We have been using SMS in every radio technology (i.e, 3G, 4G, 5G) and user interface on commercial mobile phone would look same whatever radio technology is used, but the detailed protocol behind the SMS differs with the radio access technology being used.

• 3G : SMS go through NAS messages carried by CS(Circuit Switch) channel
• LTE : Two different ways are used
• SG SMS : SMS go through NAS message  // this is the topic for this tutorial.
• SM over IMS : SMS go through IMS  // check out this tutorial for this
• 5G : SMS goes through IMS

One common thing regardless of the method listed above is that the way SMS message is being encoded and protocols at the level of session menagement (i.e, CP-DATA, CP-ACK etc).  Putting it other way, same format of SMS and session layer protocol is encapsulated in different way (i.e, NAS message or IMS) depending on different radio technology.

NOTE :  In most of the cases, the user interface on commericial phone would look same regardless of what kind of technology is used. Usually the UI on mobile phone select what type of technology to use depending on protocols status at the specific moment. So when you want to test a specific type of SMS, you need to know how to configure your UE(DUT) to apply the specific SMS technology you want to test.

NOTE : For some additional / summarized tips on SG SMS testing, refer to this wiki.

Table of Contents

• LTE SG SMS
• Introduction
• Summary of the Tutorial
• Test Setup
• PreConditions
• Key Configuration Parameters
• Test 1 : MO SG-SMS
• Configuration
• Perform the test
• Log Analysis
• Test 2 : MT SG-SMS
• Configuration
• Perform the test
• Log Analysis
• RRC / NAS Signaling
• Uplink NAS transport
• Downlink NAS transport

Introduction

Short Message Service (SMS) remains a fundamental communication feature across all generations of mobile networks, including 3G, LTE, and 5G. Despite its consistent user interface across devices, the underlying mechanisms for SMS delivery differ significantly depending on the radio access technology and core network architecture in use. In LTE networks, SMS delivery can be achieved through two primary methods: via the SGs interface (commonly referred to as SMS over SG), where SMS messages are transported over NAS (Non-Access Stratum) signaling between the Mobile Switching Center (MSC) and the Mobility Management Entity (MME), or via IMS (IP Multimedia Subsystem), where SMS is delivered as an application-level message over an IP connection. The SGs interface enables LTE networks to support legacy SMS services in scenarios where IMS is not available or not preferred, ensuring backward compatibility and seamless user experience. Amari Callbox, a versatile radio testing platform, facilitates comprehensive testing of SMS over SG by emulating network elements and providing controlled environments to validate device behavior, signaling procedures, and protocol compliance. Understanding the architectural principles, protocol encapsulation techniques, and configuration requirements is crucial for engineers and testers aiming to validate SMS functionality over the SGs interface, as well as for troubleshooting interoperability across heterogeneous network deployments. This tutorial focuses on the practical aspects of testing SMS over SG with Amari Callbox, highlighting the specific configuration steps and operational nuances distinct to this scenario, while assuming familiarity with the basic operation of the Callbox software.

• Context and Background
  • SMS delivery mechanisms vary based on the radio access technology (3G, LTE, 5G), with core network signaling adapting accordingly.
  • In LTE, SMS can be delivered via:
    • SMS over SG (SGs interface): Uses NAS signaling between the MME and MSC to support SMS without IMS.
    • SM over IMS: Leverages the IP Multimedia Subsystem for SMS delivery over IP networks.
  • The SGs interface is essential for maintaining SMS service continuity as networks transition from circuit-switched to packet-switched domains.
  • Amari Callbox provides a controlled testbed for simulating and validating SMS over SG procedures on user equipment (UE).
• Relevance and Importance
  • Ensures compatibility and compliance of mobile devices with legacy SMS delivery in LTE environments where IMS may not be available.
  • Supports operators and device manufacturers in verifying correct protocol implementation, session management (e.g., CP-DATA, CP-ACK), and message encapsulation.
  • Facilitates troubleshooting and optimization of SMS services across multi-generation network deployments.
  • Enhances quality assurance processes by enabling reproducible test scenarios using Amari Callbox.
• Learner Outcomes
  • Develop an in-depth understanding of SMS over SG architecture and signaling flows in LTE networks.
  • Gain hands-on experience configuring Amari Callbox for SMS over SG test scenarios.
  • Acquire the ability to analyze and interpret protocol exchanges specific to SMS over SG delivery.
  • Learn best practices for device configuration and network parameter selection impacting SMS routing.
• Prerequisites
  • Familiarity with Amari Callbox basic operations and interface navigation.
  • Understanding of LTE network architecture, especially NAS signaling and core network elements (MME, MSC).
  • Basic knowledge of SMS protocol structure and session management concepts.
  • Access to a device under test (UE) and Amari Callbox test environment.

Summary of the Tutorial

This tutorial demonstrates the procedures for configuring and testing both Mobile Originated (MO) and Mobile Terminated (MT) SMS over SG (NAS message) in an LTE network using Amarisoft Callbox and a test UE.

• Test Setup:
  • Uses the default SIM card delivered with the system.
  • Configuration can be customized via the Configuration Guide if required.
• Preconditions:
  • Ensure the UE supports SMS over SG by confirming the relevant Information Elements (IE) in NAS messages during the attach procedure.
  • Check the "Voice domain preference and UE's usage setting" and "Additional update type" IEs to verify SMS over SG capabilities.
• Key Configuration Parameters:
  • Set force_sms_over_sg parameter to enforce SMS over SG.

• Test 1: MO SG-SMS (Mobile Originated SMS over SG)
  • Configuration Steps:
    • Use the default enb.default.cfg (LTE eNB config) and mme-ims.cfg (MME config) without modification.
    • Ensure ue_db-ims.cfg is referenced as the UE database in mme-ims.cfg.
    • Use the Anritsu Test USIM and note the 'tel' number for SMS testing.
    • On the UE, use the default APN. Remove IMS APN (if present) and optionally disable VoLTE to ensure SMS is sent over SG rather than IMS.
  • Test Procedure:
    • Start LTE service and confirm basic cell configuration.
    • Power on the UE and verify successful registration to the LTE cell.
    • Ensure UE is not assigned an IMS PDN; otherwise, SMS may be sent over IMS.
    • Send an SMS from the UE using the configured 'tel' number as the destination.
    • Verify SMS delivery and receipt of delivery notice from the SMS server.
  • Log Analysis:
    • Enable NAS, SIP, and IMS logs in the WebGUI for analysis.
    • Filter logs to display NAS, SIP, and IMS messages for clarity.
    • Observe the sequence of message transactions, noting that even though the SMS is carried by NAS, the IMS server acts as the SMS center.
    • Review Uplink and Downlink NAS transport messages for SMS transactions. For actual SMS contents, refer to IMS logs as NAS logs may not show decoded SMS payloads.
• Test 2: MT SG-SMS (Mobile Terminated SMS over SG)
  • Configuration Steps:
    • Use the default enb.default.cfg for eNB configuration.
    • Use ims.default-sg-sms.cfg (copied from ims.default.cfg), mme-ims-sg-sms.cfg (from mme-ims.cfg), and ue_db-ims-sg-sms.cfg (from ue_db-ims.cfg) for MME and IMS configuration.
    • Set force_sms_over_sg : true in the configuration to ensure SG SMS is used regardless of IMS registration status.
    • No need to disable IMS/VoLTE on the UE, as force_sms_over_sg enforces SG SMS mode on the callbox.
  • Test Procedure:
    • Start LTE service and verify cell configuration.
    • Power on the UE and confirm successful registration.
    • Check registered users in IMS to ensure IMPI and binding information are present (IMS registration is optional for SG SMS).
    • Send an SMS from the IMS interface and confirm receipt on the UE.
    • Repeat the test using IMPI as the destination and verify successful SMS delivery to the UE.
    • To confirm that SMS was transmitted over SG, inspect relevant logs.
  • Log Analysis:
    • Enable NAS, SIP, and IMS logging in the WebGUI.
    • Filter logs for NAS, SIP, and IMS messages.
    • Analyze the logs to confirm SMS delivery and that SG SMS path was utilized.

General Notes on Log Analysis:

• For both MO and MT SG-SMS tests, Amarisoft IMS server functions as the SMS center, even though the actual SMS is carried in NAS messages.
• SMS message contents can be verified in IMS logs, as NAS logs may not display the decoded SMS payload.
• Both uplink and downlink NAS transport messages should be inspected to confirm SMS transmission and delivery notifications.

Test Setup

Test setup for this tutorial is as shown below.  

• SIM Card used in this tutorial is the one delivered with the system as it is.
• If you want to change the configuration, The tutorial Configuration Guide would help

PreConditions

To to this test, you should confirm that UE support SMS over SG.  You may check on this from NAS message during the attach.

First thing you may check is to check if the following IE is configured.

ESM message container:     Protocol discriminator = 0x2 (EPS Session Management)     EPS bearer identity = 0     Procedure transaction identity = 94     Message type = 0xd0 (PDN connectivity request)     Request type = 1 (initial request)     ...   Last visited registered TAI:     ...   Voice domain preference and UE's usage setting = 0x07 (IMS PS voice preferred, CS Voice as secondary, Data centric)   ...

If the UE only supports EPS service and not non EPS service (combined mode) it can also indicate the SMS support with the Additional update type IE lower bit

< 24.301-Figure 9.9.3.0B.1: Additional update type information element >

< 24.301-Table 9.9.3.0B.1: Additional update type information element >

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

• force_sms_over_sg

Test 1 : MO SG-SMS

This is to show how to configure and test MO (Mobile Originated) SMS over SG (NAS message).

Configuration

I used the enb.default.cfg (LTE default configuration) as it is without changing any contents in it.

I also used the default configuration(mme-ims.cfg) for mme as shown below.

In mme-ims.cfg file, you would notice that ue_db-ims.cfg is used as ue db.

In this tutorial, I am using Anritsu Test USIM. Remember "tel" number since these will be used for SMS.

I did following configuration on UE side. For APN I am using the default APN. It would be recommended to remove IMS apn(if already added) to prevent UE to send SMS over IMS rather than SG(NAS message). Just for further confirm, I would suggest you to disable VoLTE as well.  

Perform the test

Start LTE service and check basic cell configuration. Any cell configuration is OK as long as it is LTE cell.

Power On UE and make it sure that UE get registerred.

Make it sure that UE is NOT assigned with IMS pdn. If UE is assigned with IMS PDN, it is likely for the UE to use IMS Message rather than SG SMS when you send SMS.

Send SMS from UE and you will get the result as follows. Note that I am using 'tel' number as 'to' address which is set in the configuration file. Once you send the sms and it is successfully delivered to SMS server, you will get the delivery notice.

Log Analysis

Sample Log

Enable at least NAS, SIP, IMS in WebGUI log. Filter it out with NAS, SIP, IMS for convenience (Even though we are not using IMS, we should enable IMS log since in Amari callbox IMS server is acting as SMS Center as well)

For each SMS you send, you will see a sequence of message transaction. Even if SMS message is carried by NAS message, Amarisoft IMS server works as SMS center. So you see a sequence of IMS log as well.

If you check on Uplink NAS transport message, you will see the contents of NAS message carrying the SMS message. (NOTE : The NAS log does not show the decoded SMS message. If you want to check on the decoded SMS message, check on the corresponding IMS log)

If you check on Downlink NAS transport message, you will see the contents of NAS message carrying the SMS message(SMS delivery notice from the server in this case). (NOTE : The NAS log does not show the decoded SMS message. If you want to check on the decoded SMS message, check on the corresponding IMS log)

Test 2 : MT SG-SMS

This is to show how to configure and test MT (Mobile Terminated) SMS over SG (NAS message).

Configuration

I used the enb.default.cfg (LTE default configuration) as it is without changing any contents in it.

I also used the ims.default-sg-sms.cfg that is copied and modified from ims.default.cfg, mme-ims-sg-sms.cfg that is copied from mme-ims.cfg and ue_db-ims-sg-sms.cfg that is copied from ue_db-ims.cfg.

In mme-ims-sg-sms.cfg file, you would notice that ue_db-ims-sg-sms.cfg is used as ue db.

In ims.default-sg-sms.cfg  file as well, you would notice that ue_db-ims-sg-sms.cfg is used as ue db.

In this tutorial, I am using Anritsu Test USIM. Remember tel number since these will be used for SMS. In this test, I set force_sms_over_sg : true to make it sure that the callbox uses SG SMS (Not IMS SMS) when I send SMS message.

NOTE : Unlike in MO SG SMS case, you don't need to disable IMS/VoLTE on UE side since force_sms_over_sg : true makes callbox SMS Center always use SG SMS regardless of whether UE is IMS registered or not..

Perform the test

Start LTE service and check basic cell configuration. Any cell configuration is OK as long as it is LTE cell.

Power On UE and make it sure that UE get registerred. (NOTE : In my device, you see two IPs are assigned. One for Internet and the other one for IMS, but it doesn't matter how many IPs/APN are assigned).

Check the registered user in (ims) screen. ( NOTE : With my phone, UE completed IMS result so you see here IMPI and SIB Binding Information here. But IMS registration in SG SMS is not mandatory. If you see IMPI only, it is enough for this test)

Send SMS from (ims) and confirm that you get the message on UE. (NOTE : Just getting the message on UE does not confirm whether the message is sent over SG or IMS. To verify this, you need to check out the log).

Now let's try again but using IMPI this time as shown below.

Log Analysis

Sample Log

Enable at least NAS, SIP, IMS in WebGUI log. Filter it out with NAS, SIP, IMS for convenience (Even though we are not using IMS, we should enable IMS log since in Amari callbox IMS server is acting as SMS Center as well)

RRC / NAS Signaling

Uplink NAS transport

: This is the Uplink NAS transport message sent by UE  to carry SMS message. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

 

Message: Uplink NAS transport

 

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x6cbb8aab

Sequence number = 0x0d

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x63 (Uplink NAS transport)

NAS message container:

  Length = 168

  Data = .... ( NOTE : This part carries the SMS message in SG SMS.  In Amari Callbox, this contents will be transferred to IMS server and processed/decoded there).

 

Downlink NAS transport

: This is the Uplink NAS transport message sent by Network  to carry SMS message. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

 

Downlink NAS transport

 

Data:

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x040c1d94

Sequence number = 0x0c

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x62 (Downlink NAS transport)

NAS message container:

  Length = 170

  Data = .... ( NOTE : This part carries the SMS message in SG SMS. ).