Académique Documents
Professionnel Documents
Culture Documents
By NetTest
ABSTRACT
UMTS (Universal Mobile Telecommunication System) or 3G represents a major leap
forward with expectations of faster communication and the capability of combining voice
and data in new ways, to facilitate multi-media and end-to-end broadband services. At
the same time, UMTS represents a major challenge to vendors and mobile operators
because of the technical complexity and the immense costs involved in the
infrastructure.
The UMTS Technical Note is the latest in the NetTest series of technical notes. Our aim
in publishing the technical notes is to provide our customers with clear and accurate
information on the most relevant technologies. At the same, this technical note is
intended to serve as quick reference guide for the many complex issues surrounding
UMTS.
Apart from serving as a quick reference guide and important tool in the day-to-day work,
the UMTS technical note also forms part of the material used in the NetTest training
programs.
Chapter 1 through 3 dives into the UMTS technology and describes in details the
structure, the network interfaces and protocols, as well as the network functionality, and
the signaling procedures.
Chapter 4 and 5 cover two key aspects in UMTS: security and Quality of Service.
Chapter 6 briefly outlines NetTests offerings within UMTS network monitoring and
optimization to aid our customers face the increasing challenges in a highly competitive
market place, allowing mobile operators troubleshoot and optimize network and service
performance.
Technical Note
TABLE OF CONTENTS
1.
1.1
Introduction .......................................................................................................................................... 5
1.2
Standardization .................................................................................................................................... 7
1.3
1.4
1.5
2.
2.1
Overview ............................................................................................................................................ 20
2.2
2.3
2.4
3.
3.1
3.2
3.3
Mobility Management......................................................................................................................... 48
3.4
3.5
3.6
4.
4.1
Security .............................................................................................................................................. 61
4.2
Ciphering............................................................................................................................................ 62
5.
5.1
Introduction ........................................................................................................................................ 65
5.2
5.3
6.
6.1
6.2
7.
8.
Websites ........................................................................................................................................... 81
9.
References........................................................................................................................................ 82
Page 2 of 83
TABLE OF FIGURES
Figure 1.1 The evolution of mobile telephony............................................................................................... 5
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks. ...................... 6
Figure 1.3 The 3GPP organizations. ............................................................................................................ 7
Figure 1.4 GSM/GPRS/UMTS network architecture. ................................................................................. 10
Figure 1.5 GERAN architecture...................................................................................................................11
Figure 1.6 UTRAN architecture. ................................................................................................................. 12
Figure 1.7 Serving RNC. ............................................................................................................................ 13
Figure 1.9 UMTS network architecture....................................................................................................... 14
Figure 1.10 Core network elements - CS domain. ..................................................................................... 15
Figure 1.11 The signaling gateway function. .............................................................................................. 16
Figure 1.12 Core network elements - PS domain. ..................................................................................... 16
Figure 1.13 The HSS is a superset of the HLR. ......................................................................................... 17
Figure 1.14 The IP Multimedia Subsystem................................................................................................. 18
Figure 2.1 Simplified UMTS structure showing three significant parts....................................................... 20
Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN..................................... 21
Figure 2.3 Control plane UE to PS Core Network (3G-SGSN). ................................................................. 22
Figure 2.4 Control plane UE to CS Core Network (MSC). ......................................................................... 22
Figure 2.5 Circuit and Packet Switched Mobility Management. ................................................................. 23
Figure 2.6 User plane UE to PS Core Network. ......................................................................................... 24
Figure 2.7 User plane UE to CS Core Network.......................................................................................... 24
Figure 2.8 General structure of the UTRAN interfaces. ............................................................................. 25
Figure 2.9 The Iu interface connects the UTRAN to the CN. ..................................................................... 25
Figure 2.10 The Iu-CS control plane protocol stack. .................................................................................. 26
Figure 2.11 The Iu-PS protocol stack. ........................................................................................................ 28
Figure 2.12 The Iub protocol stack. ............................................................................................................ 29
Figure 2.13 The Iur protocol stack.............................................................................................................. 30
Figure 2.14 Radio interface protocol architecture (service access points marked by circles). .................. 31
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR................................ 33
Figure 2.16 MAP services as defined in 3G TS 29.002. ............................................................................ 34
Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces. ............................................... 35
Figure 2.18 Control plane SGSN-MSC/VLR. ............................................................................................. 35
Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces. ................................................... 36
Figure 3.1 UE and CN MM states............................................................................................................... 37
Figure 3.2 UE and CN PMM states. ........................................................................................................... 38
Figure 3.3 RRC states. ............................................................................................................................... 39
Figure 3.4 UE state overview...................................................................................................................... 40
Figure 3.5 PDP states................................................................................................................................. 40
Figure 3.6 CS Paging Procedure in Iu mode.............................................................................................. 41
Page 3 of 83
Page 4 of 83
1.
1.1
Introduction
Communication has always been essential to mankind. When two people meet, they only need their voice to
communicate, but as the distance increases the need for tools arises. When Alexander Graham Bell invented the
telephone in 1876, a significant step was taken to enable two people to talk together, however far apart they may be
that is, as long as they are near a telephone set! For more than a century wire line telephony has been the solution
for voice communication over distance for most people. Radio based communication systems not depending on a
wire for network access were developed for special purposes (e.g. military, police, naval and closed car radio nets),
and eventually systems emerged allowing people to communicate via telephones with radio rather than wire line
access. They were primarily intended for people driving in cars and were known as mobile telephony systems.
During the early 1980s, the first generation (1G) of mobile telephone systems based on analog technology was
experiencing rapid growth in many European countries. Each country developed its own system, each incompatible
with the others in terms of equipment and operation. This led to a wish and a need for a common European mobile
communication system with high capacity and pan-European coverage. The latter implied that the same mobile
telephones could be used in all European countries and that incoming calls would automatically be routed to the
mobile phone independent of location (automatic roaming). In addition it was expected that one single European
market with common standards would lead to cheaper user equipment and vendor-independent network elements.
Finally, the use of modern digital technology would result in smaller hand-held devices coupled with improved
functionality and quality.
In 1982 the CEPT (Conference of European Posts and Telegraphs) formed a study group called the Groupe Spcial
Mobile (GSM) to study and develop a pan-European public land mobile system the second generation of cellular
telephony (2G). The name of the study group - GSM - was also used for the mobile system. In 1989, GSM
responsibility was transferred from CEPT to the ETSI (European Telecommunication Standards Institute).
Originally GSM was only intended for the ETSI member countries. However, many other countries have also
implemented GSM e.g. Eastern Europe, the Middle East, Asia, Africa, the Pacific Basin and North America (with
a derivative of GSM called PCS1900). The name GSM now meaning the Global System for Mobile
communication is thus very appropriate.
GSM has been around for a decade and has turned into an overwhelming success, being very widely deployed in
most parts of the world. The system is well suited for voice communication and is also extensively used for Short
Message Service (SMS) information transfer. Circuit switched data services were also covered by the GSM
specification, as the integrated wireless access to voice and data services was one of the goals for the system.
However, the offered access speed (max. 9600 baud) has limited the use of the GSM system for data applications.
ETSI have defined several solutions to improve the data access of the mobile network often referred to as 2.5G. This
is to indicate that they represent a step forward compared to GSM, but these systems are still quite tightly connected
to GSM: HSCSD (High Speed Circuit Switched Data), GPRS (General Packet Radio System) and EDGE (Enhanced
Data rates for Global/GSM Evolution).
HSCSD is the simplest enhancement of the GSM system for data: Like GSM it is based on circuit switched
connections, but a better utilization of the available bandwidth and allocation of more than one time slot per
connection allows higher data rates theoretically up to 57.6 kbps. However, the circuit switched nature of HSCSD
makes it inefficient for data traffic, as this is packet oriented.
Page 5 of 83
GPRS is designed as a packet data service with a theoretical maximum data rate of approx. 170 kbps. GPRS coexists with the GSM network, reusing the basic structure of the access network. GPRS is an extension of GSM
networks with data services carried on the existing radio infrastructure, while the core network is enhanced by a
packet overlay with new components and interfaces. GPRS supports combined voice and data services and enables
multimedia services.
EDGE is an enhancement of the GSM/GPRS system using a new air interface modulation technique that allows the
bit rate on the air interface to be increased considerably. EDGE will increase the theoretical maximum data rate to
384 kbps.
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks.
The UMTS (Universal Mobile Telecommunication System) third generation cellular telephony (3G) is expected
to do more than merely provide better and faster mobile communication. UMTS will also enable combination of
voice and data services in a new way, for example facilitating multimedia and end-to-end broadband services. In
summary, UMTS will mean the following for operators and their customers:
UMTS for customers:
Worldwide wireless access using a single handset
A wide range of multimedia services with appropriate quality levels
The third generation mobile standard enables mobile users to harness the full power of the Internet through efficient
high-speed radio transmission, optimized for multimedia communications
UMTS will make the dream of anywhere, anytime communications a reality
For operators there is a huge difference in the investment required to provide a 2.5G (GPRS) compared to a 3G
system. 2.5G requires relatively small investments for the necessary modifications of the radio access network and
add-on equipment (a packet switched core network) on top of existing GSM networks, while UMTS requires a very
large investment, as most of the network must be created from the ground up. EDGE will also require huge
investments, as a new radio access network will be needed.
Page 6 of 83
For existing GSM operators, 2.5G technologies will be attractive as they can be implemented based on the operation
licenses operators already have, while UMTS requires new (and in several countries expensive) licenses. For users
GPRS will be a major step forward with new services, while UMTS is mainly an extension of these services. Thus
the success of GPRS and the services it offers will be an important indicator of which services will drive the success
of coming 3G UMTS networks.
1.2
Standardization
One of the driving forces behind UMTS is the desire to create a truly universal system. This is why the
standardization work has been moved from ETSI to a new organization: Third Generation Partnership Project
(3GPP) with the participation of a number of regional and national standardization organizations. Market
considerations are handled by an additional partnership the Market Representation Partners (MRP).
The 3GPP creates a common standard based on the inputs from the participating organizations. The Operator
Harmonization Group (OHG) has been set up to find necessary compromises in the event that the 3GPP is unable to
reach agreement. In addition to these bodies, the Third Generation Partnership Project Number 2 (3GPP-2) ensures
that North American IS-95 radio technology based systems are taken into account.
Even though it is based on existing GSM/GPRS networks, UMTS adds several new components and interfaces to
the core network. The radio access network is also entirely new, based on a new technology, Wideband Code
Division Multiple Access (WCDMA) with better usage of the spectrum than todays GSM, resulting in support for
higher data rates, more capacity and subsequently, more subscribers. Eventually UMTS will cause a complete
rearrangement of the GSM/GPRS/UMTS core network, as all-IP technology will emerge.
1.3
The UMTS Releases
In the standardization of UMTS within the 3GPP, UMTS has been defined in a set of phases or releases. So far
three releases have been defined: UMTS Release 1999 (R99 sometimes also referred to as Release 3/Rel-3),
UMTS Release 4 (Rel-4) and UMTS Release 5 (Rel-5). The network architectures figure in section 1.5 indicates
how the releases affect the network. The UMTS releases are the three main deliverables of approved specifications
from 3GPP.
The major headlines for each release are:
R99
Defines the UMTS Universal Terrestrial Radio Access Network (UTRAN)
The Radio Network Subsystem (RNS) is added to the existing GSM/GPRS network
The Core Network (CN) is the existing GSM/GPRS network with some enhancements
Rel-4
Rel-4 introduces Media Gateway (MGW), the Mobile Switching Center (MSC) server and the Signaling Gateway (SGW).
This allows user data and signaling to be logically separated in the MSC
UTRAN enhancements that include support of even higher data rates, in local areas up to 2 Mbps
Page 7 of 83
Rel-5
IP Multimedia (IM) Subsystem (IMS) is added
The Home Location Register (HLR) is replaced by/extended to a Home Subscriber Server (HSS)
UTRAN improvements to enable efficient IP-based multimedia services in UMTS
Introduction of IubFlex (allows Radio Network Controllers (RNCs) to connect to more than one set of Node Bs)
Enhancements of Location Services (LCS)
all-IP network will eventually become a reality
Rel-5 will be based on IPv6
The above releases are in the "Frozen" state, which means that revisions are allowed if a correction is needed (i.e.
new features are no longer added). A release 6 is planned and more releases are likely to follow: They may cover
areas like IMS enhancements, Wireless LAN Integration (WLANI), Internet convergence (regarding protocols and
services), Multimedia Broadcast/Multicast Service (MBMS) and evolution to the network within the Packet
Switched (PS) domain only.
This note will for the most part be based on Rel-4. Other releases will however be mentioned in some cases to
highlight major differences to Rel-4.
1.4
The Services on a UMTS Network
As the UMTS network evolves, more and more services will be supported. With UMTS Rel-5 the mobile network
will support services like those known from the Internet today, e.g. video streaming, Voice over IP (VoIP), video
conferencing and interactive services. The circuit switched part of the network will change and be put on top of a
packet-oriented technology (most likely IP), to support higher data rates and to increase flexibility in the network.
The packet switched part of the network will not change much, but a new packet domain will be added: the IP
Multimedia Subsystem (IMS).
1.4.1
General Services
The basic services provided by UMTS are similar to those known from GSM and ISDN (Integrated Services Digital
Network). Using the ITU-T definitions, telecommunication services can be divided into bearer services,
teleservices, and supplementary services. The most basic teleservice supported by UMTS is voice telephony. As
with all other communications, speech is digitally encoded and transmitted through the network as a digital stream.
A variety of data services are offered implemented as packet switched data communication. The Short Message
Service (SMS), introduced together with GSM will also be available. Supplementary services are provided on top of
teleservices e.g.:
Call Forwarding/Barring/Waiting/Hold
Three Party Service
Advice of Charge
Caller identification
Closed user groups
1.4.2
Quality of Service
One of the enhancements of 2.5G and 3G networks is the improved support of data communication. To facilitate
this, both GPRS and UMTS have introduced the concept of Quality of Service (QoS) as an integrated part of the
system. Having an effective QoS mechanism in place enables mobile operators to cost-effectively deliver highvalue, differentiated, IP-based applications and services. QoS is discussed in detail in chapter 5.
1.4.3
The way UMTS is defined separates as far as possible the part of the network that makes actual connections from
the part that maintains services. This facilitates more openness and potential in the market and allows a concept of
separate providers of contents, service and carriers. Some of these services are listed below.
Page 8 of 83
1.4.3.1
The geographic position of the User Equipment (UE) can be given by measuring radio signals. There are many
different possible applications for positioning information. The positioning functions may be used internally by the
UTRAN for radio system performance optimization, by value-added network services, by the UE itself or through
the network, and by "third party" services. Typical commercial services are:
Traffic information
Fleet management
Follow me
Nearest service
Emergency services
WAP Service
WAP (Wireless Application Protocol) is Internet access optimized for mobile telephony. It will allow the mobile
user to gain access to Internet information and services anywhere anytime, for example e-mail, flight schedules etc.
The WAP service capability provides the user with a web-browser that uses a Wireless Markup Language (WML)
instead of the HyperText Markup Language (HTML) normally used on the Internet. WML is designed for use with
mobile terminals. Gateways in the system will take care of the conversion between the WAP format and the normal
Internet format.
1.4.3.3
The Multimedia Messaging Service (MMS) is used for delivering multimedia messages to a UE, from either another
UE, a fixed point on the Internet or a Value Added Service (VAS) provider. Value-added services could be news,
weather broadcasts, stock exchange information etc. Multimedia messages can contain all types of media in addition
to text, e.g. speech, video, audio and still images.
1.4.3.4
CAMEL
The Customized Applications for Mobile networks Enhanced Logic (CAMEL) is a common platform for a number
of services for customers. It provides the UMTS network with Intelligent Network (IN) features like:
Prepaid
Call screening
Supervision
CAMEL allows the necessary information to be exchanged between networks (IN features are normally network
specific). Traditional IN solutions create circuit switched services. CAMEL will do this and also interact with packet
switched connections.
1.4.4
The VHE is a service concept within UMTS that enables the user to have the same personalized interface to the
network regardless of the network accessed. It requires that networks transfer information on user profiles, charging,
services and number portability, which considering the complexity of the networks is not a trivial task. Where the
VHE requires network-network communication, the CAMEL will be used.
Page 9 of 83
1.5
The figure above shows some of the subsystems in GSM/GPRS/UMTS networks, as they will evolve with the
UMTS releases. On the access network side there is the Base Station Subsystem (the GERAN) for GSM/GPRS and
the RNS (the UTRAN) for UMTS. The CN is based on the GSM/GPRS core network, but as indicated, UMTS Rel4 and Rel-5 will modify some subsystems and components and add others. This allows existing GSM/GPRS
network operators to benefit from the improved cost-efficiency of UMTS while protecting their 2G investments and
reducing the risks of implementation. There are also other entities in the network such as the location services
entities, which are used for location calculation.
The GSM/GPRS/UMTS network interfaces with other Public Land Mobile Networks (PLMNs) including pre Rel-4
networks, the PSTN and other IP-based multimedia networks.
1.5.1
Two types of access network are defined for GSM/GPRS/UMTS network; the BSS used for GSM, GPRS and
EDGE access (the GERAN), and the RNS (the UTRAN) used for WCDMA access.
Page 10 of 83
1.5.2
The GERAN is the access network defined for GSM, GPRS and EDGE. The GERAN is connected to the GSM
Phase 2+ CN either via two legacy interfaces (the A-interface and the Gb interface), or through the Iu interfaces.
The interface between the GERAN and the PS domain of the CN (the Iu-PS or the legacy Gb interface) is used for
packet switched data, and the interface between the GERAN and the Circuit Switched (CS) domain of the CN (Iu
CS or the legacy A interface) is used for circuit switched voice or data.
1.5.2.1
The BSS or the GERAN is the system of base station equipment (transceivers, controllers, etc.), which is
responsible for communicating with mobile stations in a certain area. The BSS is connected to the MSC through a
single A or Iu-CS interface. Similarly, in PLMNs supporting GPRS, the BSS is connected to the Serving GPRS
Support Node (SGSN) through a single Gb or Iu-PS interface.
The radio equipment of a BSS may support one or more cells. A BSS may consist of one or more base stations.
Where an Abis-interface is implemented, the BSS consists of one Base Station Controller (BSC) and one or more
Base Transceiver Station (BTS). The BTS and the BSC communicate across the Abis interface.
1.5.2.2
The BTS contains the radio transmitters and receivers (transceivers TRX) covering a certain geographical area of
the GSM network (a base station area consisting of one or more radio cells). The BTS handles the radio link
protocols with the MS.
1.5.2.3
The BSC controls a group of BTSs regarding radio channel setup, power control, frequency hopping, and handovers
- the transfer of a call in progress from one radio channel to another, typically as a result of an MS moving from one
base station area to another. The BSC is the connection between the mobile station and the MSC.
Page 11 of 83
1.5.2.4
The GSM MS consists of the mobile equipment (the terminal) and the Subscriber Identity Module (SIM) card. The
SIM provides personal mobility, providing user access to subscribed services irrespective of a specific terminal. The
International Mobile Equipment Identity (IMEI) uniquely identifies the mobile equipment. The SIM card contains
the International Mobile Subscriber Identity (IMSI) used to identify the subscriber to the system, a secret key for
authentication, and other information. The IMEI and the IMSI are independent, thereby allowing personal mobility.
The MS communicates with the GSM network via the radio interface (Um Interface).
In relation to UMTS the MS must operate in one of the following two modes:
A mode based on A/Gb interfaces between BSS and CN e.g. for:
- pre-Release 4 terminals
- Rel-4 terminals when connected to a BSS with no Iu interface towards the CN
A mode based on Iu-CS and Iu-PS between BSS and CN for:
- Rel-4 terminals when connected to a BSS with Iu interfaces towards the CN
1.5.3
UMTS R99 saw the introduction of a new radio access network, the UTRAN. The UTRAN is based on WCDMA
technology, introduced in order to achieve a better bandwidth efficiency compared to the techniques used in
GSM/GPRS. The UTRAN is connected via the Iu to the GSM Phase 2+ CN; the interface between UTRAN and the
PS domain of the CN (IuPS) is used for packet switched data, and the interface between UTRAN and the CS
domain of the CN (IuCS) is used for circuit switched data. There is actually a third domain, the BroadCast (BC)
domain, which can used to broadcast a short message to a given geographical area (service area, being one or
more cells). The interface to the BC domain is called Iu-BC. It is not shown in the figure in section 1.5.2 and will
not be described further here.
1.5.3.1
The UTRAN consists of one or more RNSs connected to the CN via the Iu interfaces. Each RNS consists of a RNC
and one or more Node Bs. The Node Bs are connected to the RNCs via the Iub interface. The Node Bs provide radio
access (i.e. antennas) to the network. The RNCs of each RNS can be interconnected via the Iur interface
Page 12 of 83
1.5.3.2
Each RNC has responsibility for and control over the radio resources of a set of cells. The RNC is equivalent to a
GSM/GPRS BSC but is more self-controlled. A RNC may have different roles in the UTRAN network:
Controlling RNC
- Each RNC is responsible for the resources of its set of cells and the Node Bs in its RNS. In this role the RNC is called
the Controlling RNC (CRNC)
Serving RNC
- For each connected UE the RNCs may have an additional role: A Serving RNC (SRNC) providing radio resources to
the connected UE. The SRNC terminates the Iu towards the CN
Drift RNC
- In order to minimize the effect of handovers, RNCs may have a third role: A Drift RNC (DRNC). A DRNC provides
(lends) resources to a SRNC for a specific UE. The DRNC will normally also act as a SRNC (or DRNC) for other UEs
Page 13 of 83
1.5.3.3
The Node B
The Node B handles the transmission and reception of signals in one or more cells, similar to GSM BTS. The Node
B is also responsible for the inner loop power control. Please refer to section 3.5 for more information on power
control.
1.5.3.4
The UE is equivalent to the GSM MS, i.e. it is the terminal through which the users access the network. The UE
consists of the mobile equipment (the terminal) and a Universal Service Identity Module (USIM). The mobile
equipment is uniquely identified by the IMEI. In order to allow future enhancements, the terminal equipment should
have an Application Programming Interface (API). The USIM provides personal mobility, providing the user with
access to subscribed services. Unlike the GSM SIM card, the USIM card may hold a number of profiles. Each
profile will have a specific purpose. It can be used to adjust the available services to the capabilities of the terminal
into which the USIM card is installed. Both the user and the network can adjust the profiles.
1.5.4
The CN is logically divided into a CS domain and a PS domain. In addition, a set of databases (Registers) is used
for storage of information needed by the system. The different entities in the domains are described below.
Page 14 of 83
1.5.5
1.5.5.1
The central component of the CS domain in the CN is the MSC. The MSC is an exchange, which performs all the
switching and signaling functions for MSs located in a geographical area designated as the MSC area. The main
difference between an MSC and an exchange in a fixed network is that the MSC has to take into account the impact
of the allocation of radio resources and the mobile nature of the subscribers, which means it performs procedures
such as:
Procedures required for the location registration
Procedures required for handover
The MSC/GMSC constitutes the interface between the radio system and the fixed networks. The MSC performs all
necessary functions in order to handle the circuit switched services to and from the mobile stations. The MSC is
responsible for call control (setup, routing, control and termination of the calls), management of inter-MSC
handover and supplementary services, and for collecting charging/accounting information. The MSC is connected to
the location and equipment registers and to other MSCs in the same network.
The GMSC acts as the gateway to other mobile networks and the public-switched networks (telephone network,
ISDN and data networks).
In order to obtain radio coverage of a given geographical area, a number of base stations are normally required; i.e.
each MSC would thus have to interface several base stations. In addition several MSCs may be required to cover a
country.
1.5.5.2
To enable bearer-independent (and thus enabling all-IP based networks) CS network architecture in Rel-4, the MSC
is split into an MGW for transport of user data and an MSC server for signaling. The MSC server mainly comprises
the Call Control (CC) and mobility control parts of an MSC. The split into MGW and MSC server also results in a
more independent environment for service creation. The new CAMEL features benefit from this concept when the
service control gets independent from the switching fabric.
Page 15 of 83
MGW is the PSTN/PLMN transport termination point and interfaces UTRAN with the CN over Iu. The MGW may
terminate bearer channels from a circuit switched network and media streams from a packet network (e.g. RTP
(Real-time Transport Protocol) streams in an IP network).
1.5.5.3
A SGW converts signaling (both ways) at transport level between the SS7 based transport of signaling used in preRel 4 networks, and the IP based transport of signaling possibly used in post-R99 networks (i.e. between Sigtran
SCTP/IP and SS7 MTP). The SGW does not interpret the application layer (e.g. MAP, CAP, BICC, ISUP) messages
but may have to interpret the underlying SCCP (Signaling Connection Control Part) or SCTP (Stream Control
Transmission Protocol) layer to ensure the correct routing of the signaling. The SGW will be necessary to obtain an
all-IP UMTS network.
The signaling gateway function may be implemented as a stand-alone entity or inside another entity.
1.5.6
Page 16 of 83
1.5.6.1
The SGSN acts as a packet switch and router in the PS domain of the CN. The SGSN controls the access of the MS
to the network and routes packets to the right BSC/RNC. It performs Mobility Management (MM) functions similar
to the MSC in the CS domain of the CN such as location registration, Routing Area Updates (RAUs) and paging.
The SGSN also handles security functions such as authentication and ciphering (between the MS/UE and the
SGSN).
1.5.6.2
The GGSN acts as a packet router in the PS domain of the CN and is the gateway between the mobile IP packet
routing of the GPRS/UMTS network and the fixed IP routing of the Internet. It transfers packets between the IP
multimedia networks and the appropriate SGSN, which currently serves the MS/UE. If the MS changes the SGSN
during ready mode, the GGSN is used as a data packet buffer. The GGSN stores subscriber data for active MSs/UEs
and performs security functions such as firewall and screening.
1.5.7
1.5.7.1
The HLR is an independent core network element up to and including Rel-4. In Rel-5 the HLR is replaced by the
HSS (Home Subscriber Server see next section), which is a superset of the HLR. The HLR contains all the
administrative information of each subscriber registered in the particular network, information on permitted
services, and the current location of the mobile. The location of the mobile is typically in the form of the signaling
address of the Visitor Location Register (VLR) associated with the MS. There is logically one HLR per network,
although it may be implemented as a distributed database.
The HLR provides functionality like:
Support to PS domain entities such as the SGSN and GGSN, through the Gr and Gc interfaces. It is needed to enable
subscriber access to the PS domain services
Support to CS domain entities such as the MSC/MSC server and GMSC/GMSC server, through the C and D interfaces. It
is needed to enable subscriber access to the CS domain services and to support roaming to legacy GSM/UMTS CS
domain networks
1.5.7.2
In UMTS Rel-5 the HSS replaces the HLR. The HSS is a superset of the HLR and contains all the functionality of
the HLR plus additional functionality to support the IM functionality of the IMS (please refer to section 1.5.8).
The HSS is an entity common to the PS and CS domains. The HSS is the master database for a given user and
contains the subscription related information to support the network components handling calls/sessions, for
example support to the call control servers in order to complete routing/roaming procedures by solving
authentication, authorization, naming/addressing resolution and location dependencies.
A UMTS Network may contain one or several HSSs, depending on the number of mobile subscribers, the capacity
of the equipment, and the organization of the network.
Page 17 of 83
1.5.7.3
The VLR contains selected administrative information from the HLR, necessary for call control and provision of the
subscribed services, for each mobile currently located in a Location Area (LA) controlled by the VLR. Each time an
MS performs roaming in a new LA, the VLR covering that LA informs the HLR about the new location of the
subscriber. The HLR subsequently informs the VLR about the services to which the subscriber has access. The VLR
also controls the assignment of TMSI.
The HLR and the VLR, together with the MSC, provide the call routing and roaming capabilities of the network. In
most implementations the VLR is integrated with the MSC, and with UMTS Rel-4 it will be a part of the MSC
server.
1.5.7.4
The AuC is a protected database that contains the individual subscriber-identification keys (also contained in SIM),
and provides the subscriber data to HLR and VLR (via HLR) used for authentication and encryption of calls.
1.5.7.5
The EIR is a database that contains a list of all valid mobile equipment on the network, and in which each MS is
identified by its IMEI. An IMEI is marked as invalid if the mobile has been reported stolen or is not type approved.
1.5.8
Page 18 of 83
The IMS is the major difference between UMTS Rel-4 and Rel-5. The IMS comprises all CN elements for provision
of multimedia services. IM services are based on a session control capability defined by the Internet Engineering
Task Force (IETF). IM services, along with multimedia bearers, utilize the PS domain - possibly including an
equivalent set of services to the relevant subset of CS Services.
The IMS enables PLMN operators to offer multimedia services to their subscribers based on and built upon Internet
applications, services and protocols. 3GPP has no intention of standardizing such services within the IMS. The
intention is that these services will be developed by PLMN operators and third party suppliers, including those in
the Internet space, using the mechanisms provided by the Internet and the IMS. The IMS should enable the
convergence of, and access to, voice, video, messaging, data and web-based technologies for the wireless user, and
combine the growth of the Internet with the growth in mobile communications.
The specific functional elements of the IMS are described below.
The CSCF which can have three roles:
- Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IMS. The Policy Control Function (PCF) is a
logical entity of the P-CSCF
- Interrogating-CSCF (I-CSCF) is the contact point within an operators network for all IMS connections destined to a
user of that particular network operator
- Serving-CSCF (S-CSCF) performs the session control services for the UE
The Media Gateway Control Function (MGCF) performs protocol conversion between ISUP (ISDN User Part) and the IMS
call control protocols (e.g. ISUP/SIP (Session Initiation Protocol) conversion)
The Multi Resource Function (MRF) performs multiparty call and multimedia conferencing functions
The IP Multimedia Media Gateway (IM-MGW) terminates bearer channels from a switched circuit network and media
streams from a packet network. The IM-MGW may support media conversion, bearer control and payload processing
(e.g. codec, echo canceller, conference bridge)
Page 19 of 83
2.
2.1
Overview
The figure below gives a simplified view of the UMTS architecture. It splits UMTS in 3 significant parts: The UE,
the access network (UTRAN) and the CN.
The information that flows through the UTRAN is logically split into two parts:
The access stratum - being information required for the interaction between the UE and the UTRAN
The Non Access Stratum (NAS) - being information transferred between the CN and the UE across the UTRAN
The reason for this split is a desire to make the information transfer between CN and UE independent of the radio
handling in the UTRAN.
2.2
General UTRAN Interface Protocols Architecture
The UTRAN interface protocols consists of 3 parallel protocol stacks:
The control plane which amongst other things conducts the signaling that enables the transport of user data
The user plane is where the user data are actually transported
The Transport Network Control Plane (TNCP)
- The transport channels in the user plane are dynamic. The TNCP makes it possible to establish and remove transport
channels on a given UTRAN interface
Page 20 of 83
Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN.
2.2.1
Control Plane
The control plane is used for signaling between the UE and the network. The control plane includes an (upper layer)
application protocol (RANAP/RNSAP/NBAP) and a (lower layer) signaling bearer for transporting the application
protocol messages.
The application protocol is used for things like setting up bearers (i.e. Radio Access Bearer (RAB) or radio link) in
the radio network layer, controlling different transmission resources and handover). In the three-plane structure the
bearer parameters in the application protocol are not directly tied to the user plane technology; they are general
bearer parameters. The control plane protocols include a mechanism for transparent transfer of NAS messages.
The lower layer the signaling bearers - for application protocol, is a part of the transport network user plane. The
control actions required for setting up the signaling bearers are Operations & Maintenance (O&M) actions.
2.2.2
User Plane
The user plane includes the data streams and the data bearers for the data streams. The data streams are
characterized by one or more frame protocols specified for that interface. The user plane protocols implement the
radio access bearer service, i.e. carries the user data through the access stratum.
The lower layer the data bearers - in the user plane is a part of the transport network user plane. The transport
network control plane directly controls the data bearers in transport network user plane during real-time operation.
2.2.3
Many of the bearers in the UTRAN network are dynamically created as required (in the form of an ATM virtual
circuit), and closed afterwards. The TNCP handles this.
The TNCP does not have a radio network layer. It includes the ALCAP protocols needed to set up the transport
bearers (data bearer) for the user plane and the signaling bearer for the ALCAP protocols. The TNCP allows the
application protocol in the radio network control plane to be independent of the data bearer technology in the user
plane.
When the TNCP is used, a control plane application protocol signaling transaction triggers the ALCAP protocol to
set up of the data bearer. The ALCAP protocol is specific for the user plane technology used. ALCAP is however
not used for all types of data bearers. If there is no ALCAP signaling transaction, the TNCP is not needed at all. This
is the case when pre-configured data bearers are used.
Page 21 of 83
The signaling bearer for ALCAP is always set up by O&M actions and it may or may not be of the same type as the
signaling bearer for the application protocol.
2.2.4
Page 22 of 83
At the top of the control plane, NAS control messages are carried. These messages are used for GPRS Mobility
Management/Session Management and Mobility Management/Call Control (GMM/SM, respective MM/CC):
GMM/SM and MM/CC are described in 3GPP TS 24.008. Figure 2.5 summarizes the MM/GMM/SM/CC
functionality:
Circuit Switched
Packet Switched
Registration
P-TMSI reallocation
Location updating
Security
Authentication
Identity
TMSI reallocation
Service Request/Accept/Reject
Connection management
CM service
Abort
Miscellaneous
MM information/status
Circuit-mode connections Call Control (CC)
Call establishment
Alerting
Call proceeding/confirmed
Progress
Setup
SM Status
SMS supports the mobile-originated and mobile-terminated Short Message Service (SMS) as described in 3GPP TS
23.040. Information on the access stratum protocol layers is given in the description of protocols for the specific
interfaces.
Page 23 of 83
2.3
The UTRAN Interfaces
For the UTRAN, four interfaces are defined: two internal (Iur and Iub) and two external (Iu and Uu). Each interface
carries both user data and signaling. This document focuses on the control plane protocols (signaling).
Page 24 of 83
2.3.1
The protocols on each of the UTRAN interfaces have a general structure as shown below.
Each protocol stack is divided into an upper layer (the radio network layer) and a lower layer (the transport network
layer). The upper layers are used for applications and information that go beyond a particular interface, while the
lower layer ensures and conducts the transport of information on a particular interface.
2.3.2
Iu Interface
The Iu interface connects the UTRAN to the CN. The Iu interface is split up in three functional types of interfaces.
The Iu interface towards the CS domain is called Iu-CS. The Iu interface towards the PS domain is called Iu-PS.
The last core network domain is the BC domain and the interface towards that is the Iu-BC. The Iu-BC is not
covered by this document. The UTRAN is responsible for all radio-related aspects including mobility of a UE in
connected mode on cell level.
Page 25 of 83
The CN is responsible for the end user service related aspects, including keeping track of the UE in idle mode on
location/routing area level.
The Iu interface supports a common set of RAB services that are offered by UTRAN to the CN nodes, regardless of
their type.
2.3.3
The Iu-CS control plane protocol stack consists of a signaling bearer layer, the transport network layer, and an
application protocol on the radio network layer.
The broadband Signaling System No. 7 is used as signaling bearer for the Radio Access Network Application
Protocol (RANAP). This means that SCCP is used by RANAP. Both connectionless and connection oriented
procedures are used. Message Transfer Part 3b (MTP3b) is used by SCCP. SSCF-NNI and SSCOP and AAL5 are
interface protocols between ATM and SS7 protocols.
2.3.3.1
The RANAP encapsulates and carries higher-layer signaling, handles signaling between the 3G-SGSN and UTRAN,
and manages the GTP connections on the Iu interface.
Page 26 of 83
Together the SSCF, the SSCOP and the AAL5 are also known as the Signaling ATM Adaptation Layer Network
Node Interface (SAAL-NNI).
The signaling bearer layers below RANAP are defined in 3G TS 25.412.
2.3.4
The Iu-PS protocol stack is slightly different from the Iu-CS protocol stack. The operator has two stacks to choose
from for signaling: The operator can use the same stack as for Iu-CS, or the alternative IP over ATM based stack,
using M3UA (a special MTP3 adaptation protocol for use over IP), the SCTP and IP.
Page 27 of 83
The figures in section 2.2.4 show the relation between the Iu-PS protocol stacks and the protocol stacks on other
UMTS interfaces.
2.3.4.1
This protocol tunnels user data between UTRAN and the 3G-SGSN, and between the GPRS Support Nodes (GSNs)
in the backbone network. GTP must encapsulate all PDP Protocol Data Units (PDUs). GTP is specified in 3G TS
29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer mentioned in section
2.4.2. However, different messages defined in the recommendation are used for the control plane (GTP-C) and the
user plane (GTP-U) applications.
2.3.4.2
UDP/IP are the backbone network protocols used for routing user data and control signaling.
2.3.5
Iub Interface
The Iub interface is used by the CRNCs (or DRNCs) to request the setting up, adding or deleting of radio links in
the Node Bs. It is also used by the DRNC to perform radio resource admission control and hardware resource
control.
Page 28 of 83
2.3.6
The signaling bearer used by Node B Application Part (NBAP) comprises of SSCF-UNI on top of SCCOP and
AAL5. Together the three signaling bearer layers are called the Signaling ATM Adaptation Layer (SAAL). The
figures in section 2.2.4 show the relation between the Iub protocol stacks and the protocol stacks on other UMTS
interfaces.
2.3.6.1
The NBAP protocol, specified in 3G TS 25.433, is used on the Iub interface. Here it provides UTRAN specific
control/signaling e.g.:
Handling and control of the measurements, performed by the UE
Management of radio links and of common channel and resources
Synchronization
Error handling
2.3.6.2
The user plane radio network layer on the Iub interface consists of a number of protocols. The structure reflects the
way the information is organized on the air interface, i.e. the data streams that are carried across the Uu interface.
These protocols are listed on the following page.
Page 29 of 83
Detailed information on these channels is, however, outside the scope of this document:
Common Packet CHannel Framing Protocol (CPCH FP)
Uplink Shared CHannel Framing Protocol (USCH FP)
Downlink Shared CHannel Framing Protocol (DSCH FP)
Paging CHannel Framing Protocol (PCH FP)
Forward Access CHannel Framing Protocol (FACH FP)
Random Access CHannel Framing Protocol (RACH FP)
Dedicated Transport CHannel Framing Protocol (DCH FP)
2.3.7
Iur Interface
The Iur interface is used by the SRNCs to request the setting up, adding or deleting of radio links in the DRNCs. It
also supports handover and synchronization. In order to minimize the equivalent of the inter-BSC handovers known
from GSM/GPRS, the Iur is used to enable inter-RNC soft handover. This is again to hide radio network functions
from the CN and in particular to avoid ping-pong effects, for example, UEs frequently changing back and forth
between two cells, on the CN.
2.3.8
The transport network layer part of the control plane protocols for the Iur are the same as those for Iu-PS. Again the
operator has a choice between two stacks. The radio network layer in the Iur protocol stack consists of the Radio
Network Subsystem Application Part (RNSAP) protocol.
Page 30 of 83
2.3.8.1
The RNSAP protocol is used on the Iur interface, where it provides UTRAN specific control/signaling e.g.:
Relocation of SRNC
Transport of NAS information between the UE and the CN, like MM and broadcast information
Paging requests to the UE
Management of transport channel resources (radio and physical links)
Soft handovers
Uu Interface
Figure 2.14 Radio interface protocol architecture (service access points marked by circles).
The Uu interface is the air interface between the UE and the UMTS network. The figures in section 2.2.4 show the
relation between the Iub protocol stacks and the protocol stacks on other UMTS interfaces.
Page 31 of 83
2.3.9.1
The RRC protocol, specified in 3G TS 25.331, is used between the UTRAN (the RNC) and the UE. It provides
functionality including:
Broadcast of information
Management of:
- RRC connection between the UE and UTRAN (establishment, release, maintenance)
- Radio Bearers (establishment, release, reconfiguration)
- RRC connection radio resources (assignment, release, reconfiguration)
Mobility functions for the RRC connection
Control of requested QoS
Handling of UE measurement reports
Outer loop power control (please refer to section 3.4.3.2)
Control of ciphering
Paging
RRC message integrity protection
Timing advance (Timing Division Duplex (TDD) mode)
2.3.9.2
The PDCP specified in 3G TS 25.323 is used in the user plane between the UTRAN (the RNC) and the UE. It
provides functionality including:
Compression and decompression of header in IP data streams (e.g. TCP/IP and RTP/UDP/IP headers for IPv4 and IPv6)
Transfer of user data between PDCP service users
2.3.9.3
The RLC protocol is used for RLC connections between the UTRAN (the RNC) and the UE. There is one RLC
connection for each Radio Bearer (RB). The RLC protocol provides functionality including:
Segmentation and reassembly of long upper layer PDUs
Concatenation of short upper layer PDUs
Transfer of user data including error correction and flow control
In-sequence delivery of upper layer PDUs
Sequence number checking
Detection and recovery of protocol errors
Ciphering
The MAC protocol is just above the physical layer. It is used between the UTRAN (the RNC) and the UE. It
provides functionality including:
Mapping between logical channels and transport channels
Selection of appropriate transport format for each transport channel depending on instantaneous source rate
Handling of priority between data flows of one UE and between UEs
Multiplexing/demultiplexing of upper layer PDUs to and from the actual physical layer transport channels
Page 32 of 83
2.4
Core Network (CN) Protocols
This section discusses protocol stacks for all relevant interfaces in the CN, both the CS domain and the PS domain.
Again the focus will be on the control plan protocols (signaling).
2.4.1
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR.
The MAP protocol (or a fraction of it) is used on a number of interfaces in the CN. TCAP, SCCP, MTP3, and MTP2
are transport protocol layers defined in Signaling System No. 7. The same protocols are used to support MAP in CS
PLMNs.
Figure 2.16 on the following page shows the services and functionality supported by the MAP protocol.
Page 33 of 83
Register/erase/activate/deactivate/interrogate/invoke
supplementary services
Password services
Unstructured supplementary services support
Register/erase CC entry service
Short Message Service Management
Send-routing-info-for-SMS service
Forward SMS
Report SM delivery status service
Ready for SM service
Alert service center service
Inform service center service
Send info for SMS service
2.4.1.1
Page 34 of 83
2.4.2
GTP-C
- This protocol tunnels signaling messages between SGSNs and GGSNs (Gn), and between SGSNs in the backbone
network (Gp). GTP-C is used for location management and MM and is specified in 3G TS 29.060
UDP
- This protocol transfers signaling messages between GSNs
2.4.3
SGSN - MSC/VLR
Page 35 of 83
2.4.4
GTP-U
- This protocol tunnels user data between SGSNs and GGSNs (Gn), and between SGSNs in the backbone network (Gp).
GTP is specified in 3G TS 29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer
mentioned in section 2.4.2. However, different messages defined in the recommendation are used for the control
plane (GTP-C) and the user plane (GTP-U) applications
UDP
- This protocol transfers user data between GSNs
Page 36 of 83
3.
This chapter provides an overview of the basic control signaling and node interworking.
The UE, the UTRAN and the CN operate in a number of states. Each state is characterized by the activity level and
thereby the resource requirements. In UMTS the changing resource requirements are supported by dynamic
allocation of resources. This gives better utilization of resources, reduced interference and extended battery life for
mobiles. The states also define the CN behavior towards the UE, for example terminate or reject an incoming call if
the UE is turned off, idle or already active.
A set of elementary procedures controls the state changes and allocation of resources as required. Mobility
Management (MM) and Radio Resource Management (RRM) such as handovers enable the UE to move seamlessly
around in the network.
One of the characteristics of UMTS is that elementary procedures can be combined in different ways to implement a
complete service. The specifications also enable the same thing to be done in several ways.
In addition to describing the elementary procedures, MM and RRM, examples are used to explain the general
signaling procedures for a number of services. The detail level is selected to provide a functional overview.
3.1
User Equipment (UE) and Network States
When the UMTS UE is turned on, it will enter IDLE mode. It will start the cell search mechanism scanning the
UMTS band for a cell with broadcast information matching the list of allowed PLMNs. When a suitable cell is
found, the UE will camp on this cell and request initial access to the UTRAN to attach to the network and enter the
CONNECTED state. Once attached the UE will be known/registered to the network and can access the services
offered. This mode of operation is also known as Camping on UTRAN Cell.
Multimode UEs are able to operate on existing GSM/GPRS networks in addition to the UMTS network. When no
UMTS network is available, the UE may operate on a GSM/GPRS cell. This mode of operation is also known as
Camping on GSM/GPRS Cell.
The UE may also feature intersystem handovers and Location Updates (LUs).
The following state descriptions apply when the UE is camping on UTRAN cell.
3.1.1
In CS mode the UE and CN operate in three states as shown below, similar to GSM behavior.
Page 37 of 83
When the UE is turned on and performs an IMSI Attach it goes from MM-DETACHED to MM-CONNECTED and
then to MM-IDLE, when the IMSI Attach is successfully completed. In MM-IDLE state the UE is registered in the
CN by Location Area (LA) but not registered in the UTRAN.
When a call is started or when performing location updating the UE goes back to MM-CONNECTED until
completion of the call/transaction.
When the IMSI Detach is performed the state is changed to MM-DETACHED. In MM-CONNECTED state the UE
will be registered in the UTRAN by cell ID and in the CN by the Iu connection ID.
3.1.2
When the UE performs a GPRS Attach, it goes from PMM-DETACHED to PMM-CONNECTED, and then to
PMM-IDLE when the GPRS Attach is successfully completed and the signaling connection is released.
In PMM-IDLE state the UE is registered in CN by Routing Area (RA) but not registered in the UTRAN.
When a new service is requested or when performing Routing Area Updates (RAUs) it goes back to PMMCONNECTED until completion of the service/transaction. In PMM-CONNECTED state the UE will be registered
in the UTRAN by cell ID and in the CN by the Iu connection ID.
When the PS Detach is performed the state is changed to PMM-DETACHED.
Page 38 of 83
3.1.3
Depending on the type of connection and the traveling speed, the UE may be in one of several different states. This
is handled by the RRC states, controlled by the RNC. In Idle mode the UE has no active connections. In Connected
mode the UE may be in one of four RRC states:
The Cell_ FACH (Forward Access CHannel) state is used for communication over common channels with limited
bandwidth, e.g. IMSI Attach and LU
The Cell_DCH (Dedicated CHannel) state is used for communication over allocated dedicated channels like voice
call and data transmission. In this state the UTRAN will perform handovers for CS QoS and Cell Update for PS
QoS
The Cell_PCH (Paging CHannel) and URA_PCH states are used when there is no data to send. The UE will only
listen to the Paging Channel thus minimizing battery load. In the Cell PCH state the UE will perform Cell
Updates whereas in the URA_PCH state the UE performs the less frequent UTRAN Registration Area (URA)
Updates. (Refer to section 3.3.3 for descriptions of locations.) The advantage of the latter is increased power
savings and the sacrifice is that paging is required. E.g. URA_PCH is preferred to Cell_PCH when the UE is
moving at high speed to minimize frequency of location updating procedures
3.1.4
UE State Overview
Figure 3.4 summarizes the UE and RRC states. The location of the UE will be known by the network in varying
resolution. Depending on the actual state the UE will be registered in different databases and with different
accuracy. Based on the state and the type of active connection either the UE or the UTRAN will select which cell to
camp on. Refer to section 3.3.3 for descriptions of locations.
Page 39 of 83
UE State
UE Known in
UE Registered in
UE Registration
Accuracy
Cell Selected by
PMM-DETACHED
HLR
PMM-IDLE
LA/RA
CN
LA/RA,
Cell
CN,
Iu connection
UTRAN
URA
CN,
Iu connection
UTRAN
Cell
CN,
Iu connection
UTRAN
URA
UTRAN
URA
PMM-CONNECTED
RRC State
Cell_FACH
Cell_DCH
Cell_PCH
URA_PCH
Cell
Cell
URA
3.1.5
A PS subscription contains the subscription of one or more PDP addresses. Each PDP address is described by one or
more PDP contexts in the UE, the SGSN, and the GGSN. Every PDP context exists independently in one of two
PDP states. The PDP state indicates whether data transfer is enabled for that PDP address or not. All PDP contexts
of a subscriber follow the same PMM state for the IMSI of that subscriber.
3.1.5.1
INACTIVE State
In the INACTIVE state the data service for a certain PDP address of the subscriber is not active. The PDP context
contains no routing or mapping information to process PDP data transfer related to that PDP address. No data can be
transferred. A change in location of a UE causes no update for the PDP context in INACTIVE state even if the
subscriber is PS Attached.
The UE initiates the movement from INACTIVE to ACTIVE state by initiating the service request procedure with
PDP Context Activation.
Page 40 of 83
3.1.5.2
ACTIVE State
In ACTIVE state, the PDP context for the PDP address in use is activated in the UE, SGSN and GGSN. The PDP
context contains mapping and routing information for transferring PDP PDUs for that particular PDP address
between the UE and the GGSN.
An active PDP context for a UE is moved to INACTIVE state by initiating the service release procedure with PDP
Context Deactivation. All active PDP contexts for a UE are moved to INACTIVE state when the PMM state
changes to IDLE or PMM-DETACHED.
3.2
Elementary Procedures
Signaling and transport resources are established and released dynamically on request based on the required QoS for
optimal utilization of resources. In UMTS different services with different QoS will share the radio resources. Thus,
all procedures are usually wrapped in signaling connection and RAB establishment, modifications and release.
3.2.1
Paging
The paging procedure is used by the CN to indicate to the UE that it needs to terminate a transaction, e.g. an
incoming call or data.
UMTS uses two different types of paging procedures depending on whether a connection to the same CN domain
exists or not. Paging Type I is the normal way to use paging. It is used to a UE in IDLE mode to establish a
signaling connection for termination of the new transaction. It is sent to those LAs/RAs where the UE has last
reported its location. Paging Type II is used when the UE already has a connection to one CN domain and another
connection has to be established to the same CN domain. As it is sent to mobiles with an active connection only, it is
sent directly to one UE.
When a UE is both IMSI- and GPRS-attached in a network that operates in mode I, the MSC/VLR executes paging
for circuit switched services via the SGSN.
3.2.2
To establish a signaling connection from the UE to the CN, an RRC connection needs to be established from the UE
to the UTRAN (RNC), and an Iu connection from the UTRAN to the CN. Separate signaling connections are
established from the UE to each of the CN domains as required.
The RRC connection establishment procedure is initiated by the UE creating an AAL2 link connection between the
RNC and the Node B, and then a WCDMA Physical Dedicated Channel between the Node B and the UE, and is
completed using this combined Signaling Radio Bearer (S-RB) to establish the RRC connection.
Page 41 of 83
When the RRC connection has been established, the transaction reasoning procedure is performed.
The transaction reasoning procedure is used by the UE to indicate to the CN what type of transaction is requested.
The Iu connection is initiated by the UE establishing the Iu signaling bearer and the Iu control plane connection.
The signaling connection can subsequently be used for transparent NAS signaling between the UE and the CN.
3.2.3
When the transaction is completed and the signaling connection is no longer required, it will be released by the
RNC.
The release procedure is initiated by releasing RRC connection starting with the WCDMA Physical Dedicated
Channel and the S-RB. Then releasing the Iu control plane connection and the Iu signaling bearer completes the
release.
Page 42 of 83
3.2.4
The authorization procedure performs authorization of the UMTS user to the CN and vice versa. The procedure
includes authorization of the USIM in the UE.
When the transaction requires encrypted communication, the CN use the security procedure to send security
parameters (selection of the ciphering algorithm and the synchronization of the start of ciphering, or both) to the
UE, which in turn acknowledges that encryption is turned on.
Page 43 of 83
3.2.5
Service Request
The service request is used to negotiate the QoS parameters for the requested service and allocate the
communications resources. The QoS is negotiated by the UE and the CN using the already established signaling
connection. The signaling procedure is slightly different for transactions with each of the CN domains. The
transaction setup usually includes a RAB allocation as shown in figure 3.10.
Page 44 of 83
3.2.6
Service Release
The service release is used to release all resources associated with the particular service on completion, and may be
started by the CN or the UE depending on the user action.
Clearing of a particular transaction on completion of a service will include the release of the RAB and any
connections made through the DRNC. The clearing does not affect any other connections for other services. RABs
for other services as well the signaling connection will remain established.
If all services are completed at once, the transaction clearing will use the Iu release command. This will release all
radio resources and Iu user plane connections as well as the signaling connection.
Page 45 of 83
3.2.7
The RAB is allocated to carry speech (CS) or data (PS) between the CN and the UE. To allocate a RAB it is
required to establish an Iu user plane connection from the CN to the UTRAN and an RB from the UTRAN (RNC)
to the UE. The RAB is characterized by the parameters required by the requested QoS.
The Iu user plane connection is established by creating the Iu bearer as required by the QoS class. CS connections
require an AAL2 link between the MSC and the UTRAN, whereas PS requires a tunneled connection over ALL5
between the SGSN and the UTRAN.
The RB is established by creating an AAL2 link connection between the RNC and the Node B and then a WCDMA
Physical Dedicated Channel between the Node B and the UE.
Before establishing any bearers the RNC performs admission control. Admission control is performed as an
evaluation of whether a new call can have access without sacrificing performance of existing calls in the radio and
terrestrial sections.
The RAB can subsequently be used for transparent data transport between the UE and the CN. Allocation of an
RAB will change the state of the UE from Cell_FACH to Cell_DCH.
Page 46 of 83
3.2.8
RABs will be released when not in use in order to save resources, even though the transactions may not be
completed. For example, an e-mail service will remain ACTIVE even though the radio and user plane resources are
released. RABs will be re-established and released on request when there are data to send.
The RAB release for a particular transaction does not affect any other connections for other services. RABs for
other services as well the signaling connection will remain established.
Page 47 of 83
For PS, the release procedure allows the active PDP contexts associated with the released RABs to be preserved
without modification in the CN, and the RABs can then be re-established at a later stage. Release of RAB will
change the state of the UE from Cell_DCH to Cell_PCH or URA_PCH.
3.3
Mobility Management
3.3.1
Attach Procedure
In order to access services, the UE must first be registered in the network by performing an attach. For example, the
GPRS Attach operation establishes a logical link between the UE and the SGSN, and makes the UE available for
SMS over PS, paging via SGSN, and notification of incoming PS data.
The UE is attached separately to each of the CN domains. However, the UE may perform combined or separate
GPRS or IMSI Attach procedures, depending on the capabilities of the UE and the network and the current
connection state of the UE.
The GPRS Attach procedures only register the UE in the SGSN, whereas the combined GPRS/IMSI Attach registers
the UE in the SGSN for PS service(s) as well as in the MSC for CS services.
The Attach procedure is in reality performed as a LU procedure with the type parameter set to Attach. The IMSI
Attach procedure is only used in case the UE is re-activated in the same LA (identical Location Area Indicator (LAI)
broadcasted and stored in USIM) as where it was last registered.
Note that the signaling connection establishment precedes the attach procedure in order to acquire a signaling
connection via which the Attach message can be sent.
Page 48 of 83
3.3.2
Detach Procedure
The Detach function is used when the UE is switched off, or when a UE informs the network that it does not want to
access the services any longer using a GPRS and/or IMSI Detach. Similarly, it enables the network to inform a UE
that it does not have to access the SGSN/MSC based services any longer.
The different types of Detach are:
IMSI Detach, marking the UE as inactive in the CS CN domain
GPRS Detach, marking the UE as inactive in the PS CN domain; and
Combined GPRS/IMSI Detach (UE-initiated only), marking the UE as inactive in the CS and PS CN domains
Page 49 of 83
The Detach procedures exist in 3 different versions, based on point of origin, i.e. UE, SGSN or HLR initiated. The
figure below shows the combined GPRS/IMSI Detach procedure.
3.3.3
Page 50 of 83
3.3.3.1
The LA is defined as the cluster of cells where the UE can move without performing LUs within the CS CN domain.
A UE in MM-IDLE state performs an LA update when it enters a new LA and also performs a periodic LA update to
keep the registration of the UEs state up to date in the VLR and HLR.
An LA update is either an intra-MSC or inter-MSC LA update. For the inter-MSC LA update the MSC will inform
the HLR about the new location of the UE. For the intra-MSC LA update there is no need to inform the HLR. A
periodic LA update is always an intra-MSC LA update.
3.3.3.2
The RA is defined as the cluster of cells where the UE can move without performing routing location updates within
the PS CN domain. One or more RAs can exist within a LA, but a RA cannot exist in more than one LA.
A UE in PMM-IDLE state performs an RA update when it enters a new RA and also performs a periodic RA update
to keep the registration of the UEs state up to date in the SGSN and GGSN.
An RA update is either an intra-SGSN or inter-SGSN RA update. For the inter-SGSN RA update the SGSN will
inform the GGSNs and the HLR about the new location of the UE. For the intra-SGSN RA update there is no need
to inform the GGSNs and the HLR. A periodic RA update is always an intra-SGSN RA update.
If the network supports the Gs connection between the SGSN and the MSC, a UE that is both GPRS-attached and
IMSI-attached will perform the combined RA/LA update procedures.
Page 51 of 83
3.3.3.3
The URA consists of a number of cells belonging to one or more RNCs, where the UE can move without
performing URA updates. The URA is used to register the UE in the UTRAN, and is used for the MM and RRM
handled by the UTRAN.
Page 52 of 83
The UE performs an URA update when it enters a new URA and also performs a periodic URA update to keep the
registration of the UEs state up to date in the UTRAN. The URA is only known within the UTRAN.
3.3.3.4
Cell Update
During a transaction the RNC needs to know the location of the UE with the accuracy of a cell. Due to the
discontinuous nature of a PS connection, this information may be inaccurate if the UE has moved when
transmission resumes. In this case, the cell update is performed by the UE.
The cell update is also used by the UE at the start of a new transaction, for periodic cell update, and as response to a
PS Paging Type I.
3.4
Radio Resource Management (RRM)
When the UE has an active connection with the UTRAN, it continuously performs measurement on the radio
connection and sends reports to the SRNC. When the UE is moving from the SRNC towards the DRNC, the SRNC
will decide to perform a handover based on the received measurement reports.
3.4.1
Soft Handovers
Soft handover is the handover of radio resources internally in the UTRAN in-between two Node Bs with the same
frequency.
This is basically a modification of the RAB using a radio link reconfiguration/setup and a radio link deletion
procedure.
Page 53 of 83
Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs.
Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another
RNC. It then establishes a new RRC connection via the Iur interface to the DRNC and further to the new Node B.
During the soft handover the SRNC will transmit on just one channel but listen on several channels, either directly
controlled by the SRNC or by DRNCs. The signal will be combined in the SRNC.
When the measurement reports from the moving UE indicate that the old radio connection is no longer valid, the
SRNC then deletes the previous radio connection.
3.4.1.1
Softer Handover
Softer handover is the addition or deletion of radio resources from the active set within the same Node B. The Node
B will transmit on one channel while it listens on more than one channel. The signal will be combined in the Node
B.
Page 54 of 83
3.4.2
Hard Handovers
A hard handover is a physical reconfiguration of the radio link. It can happen internally in UMTS, if the UE moves
from one SRNC to another via the CN, i.e. the two RNCs are not interconnected via the Iur. This also happens when
the UE moves from one Radio Access Technology (RAT) to another, for example from GSM to UMTS. There will
be no disconnection of the data or voice transfer during the hard handover.
The several types of hard handovers can be divided into intra-RAT hard handovers, and inter-RAT handovers.
3.4.2.1
Intra-RAT hard handovers are handovers within one RAT, e.g. UTRAN. The difference between hard and soft
handovers is that with hard handovers there is a physical change in frequency connections or a change in mode from
TDD (Time Division Duplex) to FDD (Frequency Division Duplex) and vice versa, or a change of cell without
macro diversity support, i.e. handover from one SRNC to another.
The handover from one SRNC to another involves the CN and thus relocation of the Iu interface. This type of
handover is also known as Serving Radio Network Subsystem (SRNS) relocation, and is used to switch SRNCs.
Figure 3.25 Before and after hard handover/SRNS relocation and RAU.
The hard handover involves a reconfiguration of the physical channel as well as a relocation of the Iu connection.
Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another
RNS. It then starts the relocation of the Iu connection to the other RNS with the CN. The new physical channel is
established, and the UE completes the reconfiguration of the physical channel and the old Iu connection and radio
link are released.
Page 55 of 83
3.4.2.2
Inter-RAT Handovers
Inter-RAT handovers are handovers between different types of Radio Access Networks (RANs). In the CS domain
this means GSM to UMTS and UMTS to GSM, and in the PS domain it means GPRS to UMTS and UMTS to
GPRS. In the case of the PS domain, this is called cell reselection, not handover.
Page 56 of 83
The UTRAN initiates the UMTS to GSM handover on the basis of measurement reports from the UE
The SRNC sends a RELOCATION REQUIRED message to the MSC
The MSC makes a HANDOVER REQUEST to the GSM BSS
The GSM BSS responds with a HANDOVER REQUEST ACKNOWLEDGE if the resources are available
The MSC sends the RELOCATION COMMAND message to the SRNC, which tells the UE to make the handover to the
GSM
The GSM BSS sends the HANDOVER DETECT message after the UE makes the handover access
When the UE reports that the handover is complete, the GSM BSS sends the HANDOVER COMPLETE message to the
MSC, which releases the Iu connection
Page 57 of 83
3.4.3
Power Control
In UMTS, all UEs transmit on the same frequency band. In FDD the UEs will even receive on the same frequency
band. To avoid a remote UE from being masked by the signal of a closer UE, the output of each UE is controlled so
that the received power at the Node B is constant from all UEs.
The following is a description of power control for FDD:
As all UEs will create a certain level of interference, only a limited number of UEs are allowed to be active
simultaneously in order to ensure that an acceptable Signal to Interference Ratio (SIR) can be maintained. SIR is
also often referred to as Carrier to Interference ratio (C/I). In order to maximize the number of UEs in a network, it
is necessary to control the SIR of each connection and even to lower output power as new UEs enter the network.
The Node B notifies all UEs in its area about the required SIR by transmitting this parameter as a part of the cell
broadcast information.
3.4.3.1
Before transmitting an access burst, the UE must calculate the required output power (Pout). This can be determined
from the Node B to UE path loss and the required SIR at the Node B. The Node B broadcasts information about its
Pout and SIR. The path loss can be calculated by comparing this to the received power of the downlink to the Pout at
the node B.
3.4.3.2
The outer loop power control is used to adjust the SIR target value used by the inner loop power control
independently for each connection based on the QoS requirements for the connection.
3.4.3.3
The inner loop power control is used to dynamically adjust the output power of the active channel in order to
maintain received SIR at a given SIR target. The Node B and the UE each measure received power and the total
received interference. Based on this, Transmit Power Control (TPC) commands are sent up and down link 1,500
times per second to account for the near-far interference as well as multi-path fading.
Page 58 of 83
3.5
CS Service Example: Mobile Terminating (MT) Voice Call
In the example shown in figure 3.29, the UE is turned on, performs an IMSI Attach, and enters the MM-IDLE state.
The UE receives an incoming call and responds to the Paging by establishing a CS Signaling Connection to the
MSC.
The UE sends a CS Service Request to the MSC, which initiates the authentication and security procedures before
RAB Allocation.
After the transaction (conversation) the RAB and the CS Signaling Connection is released.
Page 59 of 83
3.6
PS Service Example: MT Data Connection (Interactive)
In the PS example the UE then performs a PS IMSI Attach and enters the PMM-IDLE state. The SGSN receives a
downlink PDU and sends a Paging over the existing RRC connection as a Paging Type II from the UTRAN to the
UE.
The UE performs a cell update, establishes a new PS Signaling Connection to the SGSN, sends a Service Request
with PDP Context Activation and RAB Allocation, and receives a PDP Context Activation Accept. After the data
transmission has been completed the service is released with PDP Context Deactivation and RAB Release.
The UE finally performs a PS Detach with release of the PS Signaling Connection.
Page 60 of 83
4.
4.1
Security
Security has always been an important issue in mobile telephony systems. Users want privacy and will not accept
anyone listening in on their communication, while operators want to prevent fraud and other actions that impact
their revenues.
This leads to precautions regarding the airborne communication in the access network part. However, as several
different parties may be involved in the service offering for a user (as in the case of location based services),
sensitive data may have to be sent between different parties/networks, giving rise to vulnerability to other security
risks.
UMTS security is based on the security mechanisms developed for 2G networks. The main security features are:
User authentication
Encryption of the air interface communication
Temporary identities
The work on defining UMTS security in 3GPP is ongoing and there are different views on the level of security that
should be applied. One suggestion is that ciphering must protect almost all interfaces (signaling and user data).
Another suggestion is only to cipher some critical user data (e.g. ciphering keys) when roaming between different
networks.
The figure below gives an overview of the 3G-security architecture as defined for Rel-4.
Page 61 of 83
Five security feature groups are defined. Each of these feature groups meets certain threats and accomplishes certain
security objectives:
Network access security (I): security features providing users a secure access to 3G services, and which in
particular protect against attacks on the (radio) access link. Examples of group I features are:
-
Network domain security (II): security features enabling nodes in the provider domain to securely exchange
signaling data, and protect against attacks on the wireline network. An example of a group II feature is:
-
User domain security (III): security features that secure the access to UEs. An example of a group III feature is:
-
Application domain security (IV): security features enabling applications in the user and in the provider domain
to exchange information securely. An example of a group IV feature is:
-
Visibility and configuration of security (V): features enabling the user to find out if a security feature is in
operation and whether the use and provision of services should depend on the security feature
The registration and connection principles within UMTS with a CS service domain and a PS service domain are
equivalent to GSM/GPRS user (temporary) identification, authentication, and key agreement which take place
independently in each service domain. User plane traffic will be ciphered using the cipher key (CK) agreed for the
corresponding service domain, while control plane data will be ciphered and integrity protected using the cipher and
integrity keys from either one of the service domains.
4.2
Ciphering
4.2.1
In the UTRAN, information between the UE and the RNC can be ciphered. This is done at either the MAC or the
RLC protocol layers. A CK, which is shared by the CN and the UE after authentication, is sent from the CN to the
RAN. The RNC can then enable the ciphering.
4.2.2
In R99 only access network (UTRAN) ciphering is defined. Subsequent releases also specify ciphering in the CN.
For this two techniques are defined at present: MAPsec and IPsec. MAPsec, which is defined for Rel-4, is a protocol
used to cipher control plane information (signaling), i.e. MAP operations. IPsec, which is defined for Rel-5, is a
protocol used to cipher user plane information, i.e. IP data. In addition to the ciphering protocols, new network
elements Key Administration Centers (KAC) and Security Gateways (SEG) are needed to allow the transfer of
ciphering keys between networks (refer to figure 4.2).
Page 62 of 83
4.2.2.1
Ipsec
The UMTS network control plane is sectioned into security domains, which typically coincide with operator
borders. The border between the security domains is protected by SEGs. The SEGs are responsible for enforcing the
security policy of a security domain towards other SEGs in the destination security domain. The network operator
may have several SEGs in the network for redundancy or performance reasons. The UMTS network domain
security does not extend to the user plane and consequently the security domains and the associated SEGs towards
other domains do not include the user plane Gi-interface towards other IP networks.
In UMTS Network Domain Security (NDS) architecture, the key management and distribution between SEGs is
handled by the protocol Internet Key Exchange (IKE). The main purpose of IKE is to negotiate, establish and
maintain Security Associations (SA) between parties requiring secure connections. The concept of SA is central to
IPsec and IKE. The SA defines which security protocol to be used, the SA mode and the endpoints of the SA.
In UMTS NDS, the IPsec security protocol must always be Encapsulating Security Payload (ESP) and the SA mode
shall always be a tunnel mode. In NDS it is further required that integrity protection/message authentication
together with anti-replay protection is used.
The security services provided by NDS/IP are:
Data integrity
Data origin authentication
Anti-replay protection
Confidentiality (optional)
Limited protection against traffic flow analysis when confidentiality is applied
4.2.2.2
MAPsec
MAPsec provides security for the MAP protocol on the application layer. This is done by adding a security header to
MAP operations. MAPsec is independent of the network and transport protocols used.
Before protection can be applied, SA are established between the involved MAP network elements. SA define the
keys, algorithms, and protection profiles etc. to be used to protect the MAP signaling. The necessary MAP-SAs
between networks are negotiated between the respective network operators. The negotiated SA will be effective
PLMN-wide and distributed to all network elements that implement MAP application layer security within the
PLMN. However, automated key management and key distribution (to set up the SA) is not part of Rel-4. This must
therefore be carried out by other means (see 3GPP TS 33.200 Annex A).
Page 63 of 83
Page 64 of 83
5.
5.1
Introduction
The way to success for mobile IP network operators is to shift their focus from transmission speed or best
technology to creating innovative service packages and delivering them with high quality. Mobile IP offers a huge
potential for innovative services, but at the same time it is the most complex environment in which to achieve high
QoS.
To deliver IP-based applications and services, mobile network operators have to design IP-based wireless networks
using radio access technologies and packet-based core networks. The wired IP world and the mobile wireless world
are two fundamentally different networks, and they require different strategies for providing QoS. To achieve an
end-to-end QoS, policies must be in place that span between the wired and wireless worlds.
Radio access networks have limited bandwidth that must be shared between customers. Together with customer
mobility, this results in highly variable quality levels. Mobile QoS techniques must ensure fair access to limited
radio bandwidth and use mobility management to optimize the mobile IP transport. In the fixed line IP world, QoS
mechanisms deal mostly with bandwidth availability and prioritized treatment of traffic to handle random traffic
patterns with frequent data bursts.
In addition, as the above figure shows, end-to-end QoS requires QoS interworking between the mobile part and the
IP-based Internet.
5.2
What is Quality of Service (QoS)?
QoS is a key parameter for the future mobile IP. QoS, however, is also subjective depending on the expectations of
individual users. So how can it be quantified? QoS parameters attempt to quantify user experience based on
measurements of the networks ability to deliver specific services as described, for instance in IETF RFC 1224,
RFC 2212 or RFC 2544 for IP. The user experience is related to the quality of the session and the response time of
the network as well as the general availability of the service and the network.
Page 65 of 83
Based on targets for these parameters, QoS can be designed into the network and during operation used as a
reference for actual network performance. In mobile networks the critical factor for all parameters will be the radio
link and customer mobility.
5.3
Mechanisms for Delivering QoS
End-to-end QoS requires guaranteed service levels at the access points and in the backbone. To provide end-to-end
QoS that bridges the wireless and terrestrial IP networks, each element along the data path must conform to a traffic
contract. As shown above in Figure 5.1 the mobile network requires three QoS mechanisms:
Mobile QoS
QoS interworking
Fixed network QoS
Of the three it is considerably more difficult to bring QoS to the mobile access network than to the high-speed core
networks. Wireless environments inherently have greater error rates, higher delays, and more limited access
resources than fixed networks. Many of the techniques (for instance encoding) used to minimize error rates within
the UTRAN increase end-to-end delay. At the same time, limitations in the available bandwidth often lead to
congestion. Wireless QoS mechanisms focus on ensuring fair access to the available resources to avoid congestion.
Bridging between mobile and IP core networks (in GPRS/UMTS the Gi interface) is also a great challenge.
Operators must map IP-based network service classes (or specific IP applications) to wireless network QoS service
classes to ensure that QoS is provided through access networks.
5.3.1
To ensure mobile QoS in UMTS, a QoS service architecture has been defined based on a hierarchy of bearer
services. A given QoS relies on bearer services with clearly defined characteristics to be set up from the source to
the destination. Traffic has to pass different bearer services of the networks on its way from the source to the
destination.
The end-to-end service used by the mobile terminal will be realized through several different bearer services as
illustrated in Figure 5.2: A Terminal Equipment (TE)/Mobile Terminal (MT) local bearer service, a UMTS bearer
service and an external bearer service, for instance the Internet. Important to note is that the end-to-end service
requires translation/mapping with external services like the Internet. Each bearer service offers its individual
performance characteristics based on the services provided by the layers below (ATM or IP for example). For
instance, the UMTS part of the network implements QoS, based on the RAB service and CN bearer services, which
again use the radio interface or IP/ATM as the lower layer services.
Page 66 of 83
When a user requests a service with a specific quality, e.g. during the PDP Context Activation procedure described
in section 3.6, the application negotiates, via the CN, a RAB service with certain attributes. In that way UMTS
allows a user to negotiate bearer characteristics that are most appropriate for carrying information. In addition it is
possible to change bearer properties via a bearer re-negotiation procedure in the course of an active connection, e.g.
in handover situations it might be necessary to handle customer mobility.
The RAB service is achieved using the RB service and the lu bearer service. The RB service handles all the aspects
of the radio interface transports and decides the QoS attributes of the session as given in the following during the
PDP context activation.
QoS Attribute
Usage
The bit rate delivered to/from the user allows allocation of coding schemes
Delivery order
Does the application require data in the right sequence e.g. buffering required?
Transfer delay
Allocation/Retention priority
Used by network elements (not the mobile terminal) to allocate resources to bearers with
high priority.
Page 67 of 83
The Iu bearer service together with the physical bearer service provides the transport between UTRAN and CN. It is
the option of the operator to use IP or ATM and the related QoS capabilities of the lu bearer service. Differentiated
services defined by IETF must be used for IP-based Iu bearer services. If an operator chooses ATM-SVC as an
internal dedicated transport bearer, interoperation with IP-based networks will be based on Differentiated Services.
The operator will control the mapping from UMTS QoS classes to Diffserv codepoints.
The CN bearer service controls the backbone UMTS so that the contracted UMTS bearer service is achieved. It is
the option of the operator to decide which of the QoS capabilities in the IP layer or QoS capabilities in the ATM
layer is used. For the IP-based backbone, differentiated services defined by IETF must be used. If the operator
chooses ATM-SVC as an internal dedicated transport bearer, interoperation with IP based backbone networks will
be based on differentiated services. The operator will control the mapping from UMTS QoS classes to Diffserv
codepoints.
5.3.2
To enable differentiation of traffic flows in the network, four different application-related RAB service classes have
been defined: Conversational, streaming, interactive and background. Each service class is intended to carry traffic
flows of different kinds of applications. Speech and video are examples of conversational services, uni-directional
audio- and video streaming are streaming services, web browsing is a typical interactive service while email and file
transfer are background services.
The figure below illustrates how different services use the traffic classes to achieve the QoS required.
The main distinguishing factor between these classes is how delay-sensitive the traffic is. The conversational class is
meant for very delay-sensitive traffic, while the background class is the most delay-insensitive. The following table
provides an overview of the four classes and the QoS attributes associated with each class.
Page 68 of 83
Traffic Class
Conversational Class
Streaming Class
Interactive Class
Background
Fundamental
characteristics
Destination is not
expecting the data
within a certain time
Preserve payload
content
Usually asymmetric
Example of the
application
Voice
Streaming video
Web browsing
Traffic Class
Conversational Class
Streaming Class
Interactive Class
< 2 048
Delivery order
Yes/No
1 2
< 2 048
12
Yes/No
4
Background download
of emails
Background Class
23
Yes/No
4
23
Yes/No
4
SDU format
information
Delivery of
erroneous SDUs
Yes/No/-
Residual BER
10 , 7*10 , 10 , 10 ,
-5
10
10 , 7*10 , 10 , 10 ,
-5
10
-2
Yes/No/-2
-2
-3
< 2 048
12
-3
-3
-3
-4
-2
Yes/No/-2
-2
-3
-3
-3
-3
-4
-2
Yes/No/-2
-2
-3
-3
-3
-3
-4
10 , 7*10 , 10 , 10 ,
-57
10
-2
-2
-2
-3
-3
-3
-3
-4
10 , 7*10 , 10 , 10 ,
-57
10
12
1, 2, 3
1, 2, 3
< 2 048
Traffic handling
priority
Allocation/retention
priority
1, 2, 3
1, 2, 3
1, 2, 3
Bit rate of 2.048 kbps requires that UTRAN operates in transparent RLC protocol mode, in this case the overhead
from layer 2 protocols is negligible
2
The granularity of the bit rate attributes must be studied. Although the UMTS network has the capability to support
a large number of different bit rate values, the number of possible values must be limited in order not to
unnecessarily increase the complexity of terminals, charging and interworking functions etc. An exact list of
supported values must be defined together with S1, N1, N3 and R2
3
Impact from layer 2 protocols on maximum bit rate in non-transparent RLC protocol mode must be estimated
In case of PDP type = PPP, maximum SDU size is 1,502 octets. In other cases, maximum SDU size is 1,500 octets
Definition of possible values of exact SDU sizes, for which UTRAN can support transparent RLC protocol mode,
is the task of RAN WG3
6
If Delivery of erroneous SDUs is set to 'Yes', error indications can only be provided on the MT/TE side of the
UMTS bearer. On the CN gateway side error indications cannot be signaled outside of UMTS network in
R99
Page 69 of 83
6.
UMTS Testing
Test and Measurement is a critical enabler for running an efficient operation, especially for such a complex system
as UMTS. Test and Measurement is the key to optimal usage of resources. Test and Measurement is also the fast
track to detailed information on business metrics.
No one can afford to enter a highly competitive market with a non-perfect service. The winners over the next few
years are not going to be driven by the highest transmission speed or best technology. Companies that can create
innovative service packages and deliver them with high quality are going to be the winners.
Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics.
In todays world, new network operators are emerging, networks are converging, and individual networks are
growing in complexity. Test equipment must empower users to diagnose problems easily, even though they may be
unfamiliar with the underlying network technology. This requires intelligent traffic analysis, and providing results in
a concise manner that is easy to understand.
The needs for testing UMTS networks can generally be divided into two phases:
Installation and provisioning
Maintenance
In the maintenance phase of a network, regular testing is necessary to ascertain that the quality of the network is at
the required level and at that the network has sufficient capacity to handle the traffic.
Examples of tests are:
Signaling analysis
Troubleshooting
QoS testing
Handover performance
- UEs will perform soft handovers almost constantly during voice calls in areas with small cells
Interconnect testing
NetTest offers a comprehensive set of solutions for UMTS network testing, ranging from hot spot expert analysis
testing to end-to-end network monitoring of the UMTS network.
Page 70 of 83
6.1
Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools.
6.1.1
InterQuest Probe
The InterQuest Probe is a scalable, high-density data collection capture tool, capable of collecting large volumes of
network traffic for active service applications or post-analysis with expert tools in a cost-efficient manner.
The InterQuest Probe is capable of collecting data from a
large number of links over numerous E1, DS1 and OC3
interfaces simultaneously, allowing offline expert analysis
tools such as Compass and Impact to analyze many
different connections simultaneously, providing a more
accurate picture of network performance.
The more interfaces that can be monitored, the better the
information provided by Compass and Impact, allowing a
better statistical basis.
The InterQuest Probe scales to the network, allowing
Figure 6.3 The InterQuest is a powerful tool with the ability
more links to be monitored as the network grows. The
to capture large amounts of data from multiple links in both
InterQuest probe can be operated remotely over LAN or
access and core network.
modem as well as locally with control of multiple units
from the same workstation. Data from multiple units can be correlated. The multiple technologies supported allows
data capture in the access as well as the core network.
Page 71 of 83
6.1.2
Impact
The core network signaling is the foundation for the fundamental services in UMTS. Impact offers network analysis
and performance documentation of:
Location management
Roaming
Authentication and security
Message services QoS
6.1.3
Compass
Compass is acknowledged in the mobile market as the most advanced solution for the troubleshooting and
optimization of the access network.
From statistical network overview to subscriber details and call tracing, Compass enables significant improvements
to maintenance procedures:
Troubleshooting
Functional testing
Optimization
QoS testing
Call analysis and subscriber tracing
Figure 6.5 Compass is the most advanced solution for the optimization and
troubleshooting of the access network.
Page 72 of 83
6.2
Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most complete surveillance solution
available today. MasterQuest UMTS builds on this platform.
6.2.1
MasterQuest
MasterQuest is NetTest's advanced network surveillance solution for next generation networks. MasterQuest is a
highly scalable system based on a distributed architecture, utilizing non-intrusive network probes. Probes are
located at the sites where the monitored links terminate, while a central server is located at the network surveillance
center. Components of the system communicate through a standard LAN/WAN structure. Probes will transmit
captured data back to the central server where it is being correlated and presented to the network operator. By virtue
of its distributed architecture, MasterQuest data
can also be assessed remotely from a field
location.
MasterQuest for UMTS is the centralized
solution for:
Troubleshooting and network operations
Planning and optimization
Interconnect management
Customer management
Page 73 of 83
Figure 6.7 MasterQuest performs network-wide correlation and monitors endto-end service delivery performance.
Technical Note
7.
1G
2.5G
2G
3G
3GPP
3GPP-2
AAL2
AAL5
AH
Authentication Header
ALCAP
AN
Access Network
API
APN
ARIB
ATM
AuC
Authentication Center
BCF
BG
Border Gateway. Logical box that connects two (or more) operators together via Inter-PLMN
backbone. BG protects operators intra-PLMN network against intruders
BICC
BSC
BSS
BSSAP+
Base Station System Application Part+ Protocol between SGSN and MSC/VLR
BSSGP
Base Station System GPRS Protocol. Protocol between SGSN and BSS
BTS
BVCI
CAP
CC
Call Control
CCF
CDMA
CDMA-2000
North American CDMA standard, likely to be used for UMTS in North America
CEPT
CGI
C/I
CK
Cipher Key
CM
Call Management
CN
Core Network
CRNC
CS
Circuit Switched
CSCF
CS-MGW
CWTS
DRNC
Page 75 of 83
EDGE
EGPRS
Enhanced GPRS
EIR
ESP
ETSI
FDD
GEA
GERAN
GGSN
GMLC
GMM/SM
GPRS Mobility Management and Session Management. Protocol stack between MS and SGSN
that handles GPRS attach/detach, PDP context activation/deactivation, etc.
GMSC
Gateway MSC
GPRS
GPRS-CSI
GPRS-SSF
GSIM
GSM
Global System for Mobile communication. Original meaning: Groupe Spcial Mobile
GSM 1800
GSM 1900
GSM 900
GSM-SCF
GSN
GTP
GPRS Tunneling Protocol. Protocol between the UTRAN and the SGSN and between the SGSN
and the GGSN to encapsulate user data and to carry GPRS signaling
GTP-C
GTP-U
HE
Home Environment
HLR
HSCSD
HSS
HTML
HTTP
IAM
ICMP
IESG
IETF
IK
Integrity Key
IKE
IM
IP Multimedia
IMEI
IM-MGW
IM Media Gateway
IMS
IMSI
IN
Intelligent Network
Page 76 of 83
IP
Internet Protocol
IPsec
IP security
IPv4
IPv6
IPX
IS-95
ISDN
ISP
ISUP
ITU-T
Iu
Iub
Iur
IWU
KAC
KSI
L2TP
LA
Location Area
LAI
LAN
LLC
LMU
LU
Location Update
M3UA
MAC
Medium Access Control. Protocol in the radio level that is used to allocated the radio channel
MAP
MAPsec
MAP security
MBMS
ME
Mobile Equipment
MEGACO
MGC
MGCF
MGW
Media Gateway
MIP
Mobile IP
MM
Mobility Management
MMS
MMSE
MRFC
MRFP
MS
MSC
MSC-S
MT
Mobile Terminal, the MT together with the TE and the USIM forms the UE
MTP2
Page 77 of 83
MTP3
MTP3b
NAS
NBAP
NDS
NDS/IP
NNI
Network-Network interface
Node B
NS
NSAPI
Network layer Service Access Point Identifier. Identifier that specifies the PDP context in MS and in
SGSN
NSS
Network SubSystem. Network part of the network (in GPRS it means SGSN and GGSN)
OHG
PCF
PCS1900
Personal Communication system another name for the North American version of the GSM
system (GSM 1900)
P-CSCF
Proxy CSCF
PCU
PDA
PDCH
PDCP
PDN
PDP
PDU
PLMN
PMM
PPF
PPP
Point-to-Point Protocol
PS
Packet Switched
P-TMSI
PTP
Point To Point
PVC
R99
RA
Routing Area. A set of cells that belongs to one group. RA is always a subset of a LA (location
Area)
RAB
RAC
RAI
RAN
RANAP
RAT
RAU
RB
Radio Bearer
Rel-4
UMTS Release 4
Page 78 of 83
Rel-5
UMTS Release 5
RLC
Radio Link Control. A protocol between MS and BSS to handled retransmission and other radio
related issues
RNC
RNS
RNSAP
RNTI
RRC
RRM
Radio Resource Management. Algorithms and procedures for establishing and maintaining radio
path quality between the UE and the RNC
RTP
SA
Security Associations
SCCP
SCTP
SEG
SEcurity Gateway
SGSN
SGW
Signaling Gateway
SIM
SIP
SIR
SM
Short Message
SMS
SM-SC
SMS-GMSC
SMS-IWMSC
SN
Serving Network
SNDC
SNDCP
SN-PDU
SNDCP PDU
SPI
S-RB
SRD
SRNC
SRNC
SS7
SSCF-NNI
SSCF-UNI
SSCOP
STP
T1
TCAP
TCP
TCP/IP
TDD
TDMA
Page 79 of 83
TE
Terminal Equipment, the TE together with the MT and the USIM forms the UE
TEID
TFT
TLLI
TLLI Temporary Logical Link Identity. Identifier of the mobile used between MS and SGSN
TMSI
TNCP
TOS
Type of Service
TRAU
TTA
TTC
UDP
UE
UEA
UIA
UMTS
URA
USIM
USSD
UTRAN
UUS
User-to-User signaling
VAS
VHE
VLR
WAP
WCDMA
WML
Page 80 of 83
8.
Websites
http://www.3gpp.org/
http://www.3gpp2.org/
3G.IP
http://www.3gip.org/
http://www.arib.or.jp/
http://www.cwts.org/
http://www.etsi.org/
http://www.gsacom.com/
GSM Association
http://www.gsmworld.com/
http://www.ietf.org/
IPV6 Forum
http://www.ipv6forum.com/
http://www.mwif.org/
http://www.t1.org/
http://www.tta.or.kr/
http://www.ttc.or.jp/
UMTS Forum
http://www.umts-forum.org/
http://www.uwcc.org/
http://www.wmmforum.com/
Page 81 of 83
9.
References
Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS);
Network architecture (3GPP TS 23.002 Release 5)
Service Requirements for the IP Multimedia Core Network Subsystem (Stage 1), (3GPP TS 22.228)
IP Multimedia (IM) Subsystem Stage 2 (Release 5), (3GPP TS 23.228)
Multimedia Messaging Service (MMS); Functional description; Stage 2, (3GPP TS 23.140)
Universal Mobile Telecommunications System (UMTS); UTRAN Overall Description (3GPP TS 25.401)
UTRAN Iu Interface: General Aspects and Principles (3GPP TS 25.410)
UTRAN Iu interface signaling transport (3GPP TS 25.412)
Universal Mobile Telecommunications System (UMTS); UTRAN Iu Interface RANAP Signaling (3GPP TS 25.413)
UTRAN Iur Interface: General Aspects and Principles (3GPP TS 25.420)
Universal Mobile Telecommunications System (UMTS); UTRAN Iur Interface RNSAP Signaling (3GPP TS 25.423)
UTRAN Iub Interface: General Aspects and Principles (3GPP TS 25.430)
Universal Mobile Telecommunications System (UMTS); UTRAN Iub Interface NBAP Signaling (3GPP TS 25.433)
Radio Interface Protocol Architecture (3GPP TS 25.301)
Radio Resource Control (RRC) protocol specification (3GPP TS 25.331)
Medium Access Control (MAC) protocol specification (3GPP TS 25.321)
Radio Link Control (RLC) protocol specification (3GPP TS 25.322)
Packet Data Convergence Protocol (PDCP) specification (3GPP TS 25.323)
Technical realization of Short Message Service (SMS) (3G TS 23.040)
B-ISDN ATM layer specification (I.361)
B-ISDN ATM Adaptation Layer specification: Type 2 AAL (I.363.2)
Type 5 AAL (I.363.5)
General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface
(3GPP TS 29.060)
Mobile Application Part (MAP) specification (3GPP TS 29.002)
General Packet Radio Service (GPRS) Service description (3GPP TS 23.060)
Serving GPRS Support Node SGSN - Visitors Location Register (VLR); Gs Interface Network Service Specification
(3GPP TS 29.016)
General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) - Visitors Location Register (VLR); Gs
interface layer 3 specification (3GPP TS 29.018)
Control protocol for multimedia communication (H.245)
Gateway control protocol (H.248)
3G Security; Security Architecture (3GPP TS 33.102)
3G Security; Network Domain Security; MAP application layer security (3GPP TS 33.200)
3G Security; Network Domain Security; IP network layer security (3GPP TS 33.210)
3G Security; A Guide to 3rd Generation Security (3GPP TR 33.900)
Page 82 of 83
ISO 9000 certified. SUMTS-TN02-0304-A4. 2002 NetTest. All Rigts Reserved. Specifications subject to change without notice. E&EO.
NetTest A/S
Kirkebjerg All 90
DK-2605 Brndby
Denmark
Tel: +45 72 11 22 00
Fax: +45 72 11 22 10
E-mail: com@nettest.com
web: www.nettest.com
Italy
Singapore
Spain
USA
+39 02 95 12 621
+65 6220 9575
+1 91 372 92 27
+1 315 797 4449
Page 83 of 83