Access Control

Closed access limits the network to subscribers in the HLR. A handset that is not a subscriber is refused at registration and cannot place calls, send SMS or start a data session. Open access, the default, serves every handset.

Access control decides who is served. Authentication decides whether a subscriber’s handset proves its A-key. The two settings are independent, and both apply when both are on.

Turn on closed access

Merge this into config/msc.local.json, then restart the MSC. For a combined stack, restart cdma-nib.

{
  "access": {
    "mode": "closed"
  }
}

register_policy applies in closed mode only. subscriber_only refuses the registration of a handset that is not a subscriber. any accepts it as Registration only, which keeps the handset camped without granting any service.

A change takes effect at each handset’s next registration, call or SMS. Calls and data sessions already in progress continue.

Closed access refuses every call from a handset that is not a subscriber, including emergency calls.

What each handset gets

The MSC assigns every handset an access class.

A refused registration sends the handset back to system selection. Most handsets look for another system and return after a power cycle or a roaming-list rescan.

When the HLR cannot be reached, closed access refuses the handset.

Stage a handset for OTASP

A new handset usually reports a default or carrier IMSI, not the one the subscriber is configured with. Closed access still lets it register and dial *228 when its hardware identity is already on file.

1. In Subscribers, add the subscriber with the IMSI to program and the handset’s MEID, or its ESN when the handset has no MEID.
2. Power on the handset. It registers as Provisioning.
3. Dial *228, or start OTASP from the subscriber page.
4. After the commit, the handset reports the configured IMSI and is Admitted at its next registration.

A pseudo-ESN, one starting with 80, is shared by many handsets and does not stage a handset on its own. Enter the MEID for those handsets.

OTASP and the A-key

This rule applies in open and closed mode. Under monitor, OTASP for a subscriber with an A-key is refused when the handset’s signature is wrong or missing, even though ordinary calls proceed. A network-initiated OTASP page that arrives without a signature runs a challenge on the traffic channel first.

A subscriber with an A-key but no established shared secret data cannot run OTASP until an ordinary call completes the SSD update. To replace the A-key instead, clear it on the subscriber’s Authentication card.

Without authentication, closed access trusts the identity the handset reports. Identities can be copied from another handset. Use enforce with closed access where that matters.

Review refused handsets

The Mobiles page adds an Access column and an Access Denied & Provisioning card when access is closed.

• Current lists each handset whose latest access was refused or restricted, with its reason, base station, time and number of denials.
• History lists every handset with a recorded denial, including ones admitted since.
• Create subscriber opens a new subscriber form filled with the identity the handset reported. The handset is admitted at its next registration.
• Start OTASP opens the matched subscriber of a staged handset.

The dashboard Access card shows the policy, the number of denied, provisioning and limited handsets, and the latest refusals. The mobile and subscriber pages show the latest access decision.

Handsets that report no IMSI appear in the activity list until the MSC restarts but are not stored in the HLR.

Limits