Various types of handover

Handover decision

1 MS

2 MS

3 MS

4 MS receive level BTSold receive level BTSnew

BTS

BTS BSC

BTS BSC MSC

BTS BSC MSC MS BTSold

HO_MARGIN MS BTSnew

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/41

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/42

Handover procedure
MS BTSold BSCold measurement measurement report result HO decision HO required HO request resource allocation ch. activation HO command HO command HO request ack ch. activation ack MSC BSCnew BTSnew

Security in GSM
Security services
access control/authentication
user ! SIM (Subscriber Identity Module): secret PIN (personal identification number) SIM ! network: challenge response method

confidentiality
voice and signaling encrypted on the wireless link (after successful authentication)

anonymity
temporary identity TMSI (Temporary Mobile Subscriber Identity) newly assigned at each new location update (LUP) encrypted transmission
secret A3 and A8 available via the Internet network providers can use stronger mechanisms

HO command

HO access
Link establishment clear command clear command clear complete clear complete HO complete HO complete

3 algorithms specified in GSM

A3 for authentication (secret, open interface) A5 for encryption (standardized) A8 for key generation (secret, open interface)

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/43

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/44

GSM - authentication

GSM - key generation and encryption

mobile network Ki AuC 128 bit A3 SRES* 32 bit RAND 128 bit RAND

SIM RAND 128 bit A3 SIM SRES 32 bit cipher key Ki 128 bit AuC

mobile network (BTS) Ki 128 bit A8 Kc 64 bit data A5 encrypted data RAND 128 bit RAND

MS with SIM RAND 128 bit A8 Ki 128 bit SIM

MSC

SRES* =? SRES

SRES 32 bit

Kc 64 bit SRES data MS A5

SRES

BTS

Ki: individual subscriber authentication key

SRES: signed response

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/45

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/46

Data services in GSM: HSCSD

Data transmission standardized with only 9.6 kbit/s
advanced coding allows 14,4 kbit/s not enough for Internet and multimedia applications

Data services in GSM: GPRS

GPRS (General Packet Radio Service)
packet switching using free slots only if data packets ready to send (e.g., 115 kbit/s using 8 slots temporarily) standardization 1998, introduced 2000

HSCSD (High-Speed Circuit Switched Data)

already standardized bundling of several time-slots to get higher AIUR (Air Interface User Rate) (e.g., 57.6 kbit/s using 4 slots, 14.4 each) advantage: ready to use, constant quality, simple disadvantage: channels blocked for voice transmission
AIUR [kbit/s] 4.8 9.6 14.4 19.2 28.8 38.4 43.2 57.6 TCH/F4.8 1 2 3 4 TCH/F9.6 1 1 2 3 4 2 3 4 TCH/F14.4

GPRS network elements GSN (GPRS Support Nodes)

GGSN (Gateway GSN)
interworking unit between GPRS and PDN (Packet Data Network)

SGSN (Serving GSN)

supports the MS (location, billing, security)

GR (GPRS Register)
user addresses

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/47

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/48

GPRS quality of service

Reliability class Lost SDU probability 10-9 10-4 10-2 Duplicate SDU probability 10-9 10-5 10-5 Out of sequence SDU probability 10-9 10-5 10-5 Corrupt SDU probability 10-9 10-6 10-2

GPRS architecture and interfaces

SGSN Gn

1 2 3

MS

BSS

SGSN

GGSN

PDN

Delay class 1 2 3 4

SDU size 128 byte SDU size 1024 byte mean 95 percentile mean 95 percentile < 0.5 s < 1.5 s <2s <7s <5s < 25 s < 15 s < 75 s < 50 s < 250 s < 75 s < 375 s unspecified

Um

Gb

Gn

Gi

MSC

HLR/ GR EIR

[J. Schiller]

VLR

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/49

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/50

GPRS protocol architecture

MS
apps. IP/X.25 SNDCP LLC RLC MAC radio RLC MAC FR radio FR L1/L2 L1/L2
BSSGP SNDCP

UMTS and IMT-2000

Proposals for IMT-2000 (International Mobile Telecommunications)
UWC-136, cdma2000, WP-CDMA UMTS (Universal Mobile Telecommunications System) from ETSI

Um

BSS

Gb

SGSN

Gn GGSN

Gi

IP/X.25 GTP UDP/TCP IP GTP UDP/TCP IP

UMTS
UTRA (was: UMTS, now: Universal Terrestrial Radio Access) enhancements of GSM
EDGE (Enhanced Data rates for GSM Evolution): GSM up to 384 kbit/s CAMEL (Customized Application for Mobile Enhanced Logic) VHE (virtual Home Environment)

LLC
BSSGP

fits into GMM (Global Multimedia Mobility) initiative from ETSI requirements
min. 144 kbit/s rural (goal: 384 kbit/s) min. 384 kbit/s suburban (goal: 512 kbit/s) up to 2 Mbit/s urban

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/51

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/52

Frequencies for IMT-2000

1850 ITU allocation (WRC 1992) Europe GSM DE 1800 CT GSM 1800 1900 1950 2000
MSS
T D D

IMT-2000 family
2050 2100 2150 2200 MHz Interface for Internetworking

IMT-2000
T D D

MSS IMT-2000

UTRA MSS FDD

MSS

UTRA MSS FDD

IMT-2000 MSS

IMT-2000 Core Network ITU-T Initial UMTS (R99 w/ FDD)

GSM (MAP)

ANSI-41 (IS-634)

IP-Network

China Japan

IMT-2000

cdma2000 MSS PHS W-CDMA

cdma2000 MSS W-CDMA rsv. MSS

Flexible assignment of Core Network and Radio Access

North America 1850

PCS 1900 1950

MSS

IMT-DS IMT-2000 Radio Access ITU-R

(Direct Spread)

IMT-TC
(Time Code)

IMT-MC
(Multi Carrier)

IMT-SC
(Single Carrier)

IMT-FT
(Freq. Time)

2000

2050

2100 2150

2200

MHz

UTRA FDD (W-CDMA) 3GPP

UTRA TDD (TD-CDMA); TD-SCDMA 3GPP

cdma2000 3GPP2

UWC-136 (EDGE) UWCC/3GPP

DECT ETSI

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/53

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/54

Licensing Example: UMTS in Germany, 18. August 2000

UTRA-FDD: Uplink 1920-1980 MHz Downlink 2110-2170 MHz duplex spacing 190 MHz 12 channels, each 5 MHz UTRA-TDD: 1900-1920 MHz, 2010-2025 MHz; 5 MHz channels Coverage: 25% of the population until 12/2003, 50% until 12/2005
Sum: 50.81 billion

UMTS architecture (Release 99 used here!)

UTRAN (UTRA Network)
Cell level mobility Radio Network Subsystem (RNS) Encapsulation of all radio specific tasks

UE (User Equipment) CN (Core Network)

Inter system handover Location management if there is no dedicated connection between UE and UTRAN
Uu UE UTRAN Iu CN

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/55

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/56

UMTS domains and interfaces I

Home Network Domain Zu Cu USIM Domain Mobile Equipment Domain Uu Access Network Domain Iu Serving Network Domain Yu Transit Network Domain

UMTS domains and interfaces II

Universal Subscriber Identity Module (USIM)
Functions for encryption and authentication of users Located on a SIM inserted into a mobile device

Mobile Equipment Domain

Functions for radio transmission User interface for establishing/maintaining end-to-end connections

Core Network Domain User Equipment Domain Infrastructure Domain

Access Network Domain

Access network dependent functions

User Equipment Domain

Assigned to a single user in order to access UMTS services

Core Network Domain

Access network independent functions Serving Network Domain
Network currently responsible for communication

Infrastructure Domain
Shared among all users Offers UMTS services to all accepted users

Home Network Domain

Location and access network independent functions

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/57

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/58

Spreading and scrambling of user data

Constant chipping rate of 3.84 Mchip/s Different user data rates supported via different spreading factors
higher data rate: less chips per bit and vice versa

OSVF coding

1,1,1,1,1,1,1,1 1,1,1,1 1,1 X,X X X,-X SF=n SF=2n 1,-1 1,-1,-1,1 1 1,-1,1,-1 1,-1,1,-1,-1,1,-1,1 1,-1,-1,1,1,-1,-1,1 ... 1,-1,-1,1,-1,1,1,-1 SF=1 SF=2 SF=4 SF=8 1,1,-1,-1 1,1,-1,-1,-1,-1,1,1 1,-1,1,-1,1,-1,1,-1 ... 1,1,1,1,-1,-1,-1,-1 1,1,-1,-1,1,1,-1,-1 ... ...

User separation via unique, quasi orthogonal scrambling codes

users are not separated via orthogonal spreading codes much simpler management of codes: each station can use the same orthogonal spreading codes precise synchronisation not necessary as the scrambling codes stay quasiorthogonal
data1 spr. code1 data2 spr. code2 data3 spr. code3 data4 spr. code1 data5 spr. code4

scrambling code1

scrambling code2

sender1
Distributed Computing Group

sender2
MOBILE COMPUTING R. Wattenhofer 9/59

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/60

UMTS FDD frame structure

Radio frame 10 ms 0 1 2 ... 12 13 14

Typical UTRA-FDD uplink data rates

W-CDMA 1920-1980 MHz uplink 2110-2170 MHz downlink chipping rate: 3.840 Mchip/s soft handover QPSK complex power control (1500 power control cycles/s) spreading: UL: 4-256; DL:4-512

Time slot 666.7 s Pilot TFCI FBI TPC uplink DPCCH

2560 chips, 10 bits 666.7 s Data 2560 chips, 10*2k bits (k = 0...6) 666.7 s Data1 TPC TFCI Data2 Pilot downlink DPCH uplink DPDCH

User data rate [kbit/s] DPDCH [kbit/s] DPCCH [kbit/s] Spreading

12.2 (voice) 60 15 64

64

144

384

240 15 16

480 15 8

960 15 4

DPDCH DPCCH DPDCH DPCCH 2560 chips, 10*2k bits (k = 0...7)

Slot structure NOT for user separation but synchronisation for periodic functions!

FBI: Feedback Information TPC: Transmit Power Control TFCI: Transport Format Combination Indicator DPCCH: Dedicated Physical Control Channel DPDCH: Dedicated Physical Data Channel DPCH: Dedicated Physical Channel

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/61

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/62

UMTS TDD frame structure (burst type 2)

Radio frame 10 ms 0 1 2 ... 12 13 14

UTRAN architecture
RNS

RNC: Radio Network Controller RNS: Radio Network Subsystem

Iu

UE1

Node B

Iub
RNC

Time slot 666.7 s Data 1104 chips Midample 256 chips 2560 chips Data GP 1104 chips Traffic burst GP: guard period 96 chips UE3 UE2 Node B

CN

Iur

TD-CDMA 2560 chips per slot spreading: 1-16 symmetric or asymmetric slot assignment to UL/DL (min. 1 per direction) tight synchronisation needed simpler power control (100-800 power control cycles/s)

Node B

Iub
Node B RNC

UTRAN comprises several RNSs Node B can support FDD or TDD or both RNC is responsible for handover decisions requiring signalingto the UE Cell offers FDD or TDD

Node B RNS

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/63

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/64

UTRAN architecture
RNS UE Node B

UTRAN functions
RNC: Radio Network Controller RNS: Radio Network Subsystem

RNC

Iub Iu

Node B

UTRAN comprises several RNSs Node B can support FDD or TDD or both
CN

Iur
Node B

Iub
Node B RNC

Node B RNS

RNC is responsible for handover decisions requiring signaling to the UE Cell offers FDD or TDD

Admission control Congestion control System information broadcasting Radio channel encryption Handover SRNS moving Radio network configuration Channel quality measurements Macro diversity Radio carrier control Radio resource control Data transmission over the radio interface Outer loop power control (FDD and TDD) Channel coding Access control
Distributed Computing Group MOBILE COMPUTING R. Wattenhofer 9/66

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/65

Core network: protocols

VLR

Core network: architecture

VLR

MSC RNS

GSM-CS backbone

GMSC

PSTN/ ISDN

BTS

Abis

BSS

Iu
MSC GMSC

BSC Node B BTS HLR

PSTN IuCS
AuC EIR RNS HLR GR

Layer 3: IP Layer 2: ATM Layer 1: PDH, SDH, SONET UTRAN

SGSN

GGSN

GPRS backbone (IP) SS 7

PDN (X.25), Internet (IP)

Node B

Iub
Node B RNC SGSN GGSN

Gn
Node B RNS

Gi
CN

IuPS

CN
MOBILE COMPUTING R. Wattenhofer 9/67 Distributed Computing Group MOBILE COMPUTING R. Wattenhofer 9/68

Distributed Computing Group

Core network
The Core Network (CN) and thus the Interface Iu, too, are separated into two logical domains: Circuit Switched Domain (CSD)
Circuit switched service incl. signaling Resource reservation at connection setup GSM components (MSC, GMSC, VLR) IuCS

UMTS protocol stacks (user plane)

UE
apps. & protocols

Uu

UTRAN

IuCS

3G MSC

Circuit switched

RLC MAC radio

RLC MAC radio

SAR AAL2 ATM

SAR AAL2 ATM

Packet Switched Domain (PSD)

GPRS components (SGSN, GGSN) IuPS

UE
apps. & protocols IP, PPP, PDCP RLC MAC radio

Uu

UTRAN

IuPS

3G SGSN

Gn

3G GGSN
IP, PPP, GTP UDP/IP L2 L1

IP tunnel
PDCP

Release 99 uses the GSM/GPRS network and adds a new radio access!
Helps to save a lot of money Much faster deployment Not as flexible as newer releases (5, 6)
Distributed Computing Group MOBILE COMPUTING R. Wattenhofer 9/69

Packet switched

RLC MAC radio

GTP UDP/IP AAL5 ATM

GTP

GTP UDP/IP UDP/IP AAL5 ATM L2 L1

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/70

Support of mobility: macro diversity

Multicasting of data via several physical channels
Enables soft handover FDD mode only

Support of mobility: handover

From and to other systems (e.g., UMTS to GSM)
This is a must as UMTS coverage will be poor in the beginning

UE Node B

Uplink
simultaneous reception of UE data at several Node Bs Reconstruction of data at Node B, SRNC or DRNC

RNS controlling the connection is called SRNS (Serving RNS) RNS offering additional resources (e.g., for soft handover) is called Drift RNS (DRNS) End-to-end connections between UE and CN only via Iu at the SRNS
Change of SRNS requires change of Iu Initiated by the SRNS Controlled by the RNC and CN
Node B UE Node B SRNC CN

Node B

RNC

CN

Downlink
Simultaneous transmission of data via different cells Different spreading codes in different cells

Iub
DRNC

Iur

Iu

Iub

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/71

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/72

Example handover types in UMTS/GSM

UMTS services (originally)

Data transmission service profiles
Bandwidth Transport mode Bidirectional, video telephone Low coverage, max. 6 km/h asymmetrical, MM, downloads SMS successor, E-Mail 128 kbit/s Circuit switched 2 Mbit/s Packet switched 384 kbit/s Circuit switched 14.4 kbit/s Circuit switched 14.4 kbit/s Packet switched 16 kbit/s Circuit switched

Service Profile High Interactive MM

UE1 Node B1 UE2 Node B2 Node B3 RNC1 3G MSC1

High MM Medium MM Switched Data Simple Messaging Voice

3G MSC2

Iu Iub
RNC2

Iur

UE3

UE4 BTS BSC 2G MSC3

Virtual Home Environment (VHE)

Enables access to personalized data independent of location, access network, and device Network operators may offer new services without changing the network Service providers may offer services based on components which allow the automatic adaptation to new networks and devices Integration of existing IN services

Abis

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/73

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

9/74

Future mobile telecommunication networks

terminal mobility

fast

MBS (Mobile Broadband System) UMTS

mobile

GSM DECT
slow

SAMBA

portable

WAND ISDN
10 kbit/s 2 Mbit/s 20 Mbit/s

MEDIAN B-ISDN
30 Mbit/s

fixed

150 Mbit/s

Distributed Computing Group

MOBILE COMPUTING

R. Wattenhofer

[J. Schiller]
9/75