5G Technology Overview

Jun. 2019

1 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 Rel-15 & Rel-16 Milestones
RAN RAN RAN RAN RAN RAN RAN RAN RAN RAN
#79 #80 #81 #82 #83 #84 #85 #86 #87 #88

2018 2019 2020

Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2

Rel-15 Rel-16
NSA ASN.1 package approval

RAN#79 endorsed the

freeze of NSA ASN.1
and approved the
Rel-16 SI/WI phase
corresponding CRs

Rel-15 Rel-15 Rel-15 Rel-16 Rel-16

late drop freeze
freeze late drop freeze freeze freeze

Until June WGs shall prioritize

Opthon-3 stabilization (only
Rel-15 Rel-15 Rel-16
essential corrections allowed),
and Option-2 specification work
ASN.1 late ASN.1 drop ASN.1

Architecture Option 2& • 5G Industrial IoT

5(LTE): ASN.1 Freeze September • 5G for Unlicensed spectrum operation
2018
The late drop including • 5G above 52.5GHz
option 4 ,option 7 and
NR-NR DC(syn) were
completed

3 ZTE confidential
 Scope of 3GPP NR Rel-15 & Rel-16

Rel-15 Rel-16

5G Expansion 5G Efficiency
• Acceleration of eMBB Non- • 5G Vehicle to X(V2X)
Standalone mode by December 2017 • Interference Mitigation
• 5G Industrial IoT
• Standalone standardization June 2018 • 5G MIMO enhancements
• 5G for Unlicensed spectrum
• Use cases: • 5G Power Consumption
operation
ü Enhanced Mobile improvements
• 5G for Satellite
broadband(eMBB) • Dual Connectivity
• 5G above 52.5GHz
ü Ultra Reliable Low Latency enhancements
Communication (URLLC) • 5G Integrated access backhaul
• Enhancement for URLLC service
• Carrier aggregation operation • 5G Location and positioning
• Non-orthogonal Multiple
• Inter-RAT mobility between NR and E- enhancements
Access(NOMA)
UTRAN • 5G SON & Big Data

4 ZTE confidential
 Network Architecture-R15
Early Drop
Option 3 series
• Completed in Dec. 2017
• ASN.1 was ready in March 2018
5 ZTE confidential
Full Version
Option 2 series
• Stage3 completed in June 2018
• ASN.1 frozen in September 2018
Option 5 series
• ASN.1 frozen in September 2018
(only impacts LTE)
Late Drop
Option 4, Option 7
• NR-NR DC (syn) are part of the
late drop
• Completed in June 2019
• ASN.1 frozen in June 2019
 5G Network Interfaces
Integrated CU-DU CU-DU Split

Interface Definition Standardization in R15

F1 Between gNB-CU and gNB-DU of gNB within an NG-RAN, or Completed, use OPTION2 solution in Release 15,
Between gNB-CU and gNB-DU of en-gNB within an E-UTRAN PCDP/RRC are process in CU and RLC/MAC/PHY are process in DU.
eCPRI demarcation point between AAU and DU not be standardized, it depends on vendors
TR approved, but no consensus on how and whether to continue the work
E1 interconnecting of a gNB-CU-CP and a gNB-CU-UP completed
NG interconnecting gNB and NGC completed

Xn interconnecting the NG-RAN nodes completed

6 ZTE confidential
 5G Overview and Key Challenges

Gigabytes in a second Smart Home

Industry Autonomous
automation Driving

3D/UHD
Video VR/AR

Intelligent
Transportation

Mission
HD Voice critical App
Cloud Game
Smart City

Cloud Office M2M E-Health Services

7 ZTE confidential
 Overview of 5G Use Cases

Enhanced Mobile
Enhanced Mobile
Smart
Home
Broadband
Augmented • Capacity for future
Broadband
/VR
broadband requirements
• Intelligence network Smart Augmented
Smart Home /VR Mobile UHD
resource management Building

5G
Mobile UHD

mMTC
Transport Work/Play

5G
• Deep coverage & density & Logistics Cloud
• 10+ year battery life
Work/Play
Cloud • Low data rate
optimization Smart Robots &
Agriculture Drones

Mission Critical
Smart Autonomous
Apps
Cities Industry Digital Vehicles • Ultra-high mobile
Automation Health
reliability
5G will start by addressing enhanced broadband • Substantial security
use cases, but in the end, industry will be the • Ultra-low latency
chief 5G driver.

Source: HIS “5G Strategies & Opportunities”

8 ZTE confidential
 Exploration of 5G Industrial Applications for Major Operators

Operator Time Use Case exploration

AT&T End of 2018 FWA, 4K VR video

Verizon 2018-2019 FWA, UHD video
Docomo Early 2020 8K video, VR
Softbank Early 2020 8K video, Connected robots
5G live broadcast, Drone
KT Early 2019 5G face recognition
SKT Early 2019 5G connected cars
Telefonica 2020 V2X, VR sightseeing
5G FWA Big video 5G Immersive live
Connected cars video for the Tokyo Orange 2020 Autonomous driving, Big
Olympics video
TIM 2019 AR 3D modeling, Intelligent
transportation
V2X, Autonomous driving,
Ooredoo 2019
AR/VR, Drone

9 ZTE confidential
 Network Slicing has Become a Core Capability of 5G
…

1
ce … lice lice
S
2
S
n
Sli
Terminal Sliced network

On-demand Slice Operation Resource Sharing

• Allocate resources on demand
• Flexible combination of capabilities
to meet different scenarios
10 ZTE confidential
• Deep integration with industry • One physical network to
applications support multiple network
• Provide capability exposure to services
maximize 5G network values • Resource sharing to reduce
CAPEX and OPEX
 CloudStudio – ZTE Orchestration and Management Solution
CloudStudio
GSO (Global Service Orchestrator)
l Provide the service domain orchestration and
management functions, provide CSMF
functions

SLICEO (Slice Orchestrator)

l Provides slice, sub-slice lifecycle management,
providing NSMF and NSSMF functions

NFVO & VNFM

l Provide lifecycle management and resource
management for NS (Network Service) and VNF

VIM VIM EMS

l Traditional network element management
RAN BN CN system, UMS+SLICEO+NFVO+VNFM forms UME
in 5G system

11 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 3GPP Definition on 5G Spectrum
Designation Frequency range • Defined in 38.104 table 5.1-1
FR1 450MHz-6000MHz • Frequency range 1 (FR1): 5G low frequency, 450MHz ~ 6.0 GHz

FR2 24250MHz-52600MHz • Frequency range 2 (FR2): 5G high frequency (mmWave), 24.25 ~ 52.6GHz

Difference with 4G spectrum

• 5G band name starts with “n”
• SUL and SDL bands added on top of TDD and FDD bands
• Bandwidth much larger than 4G
• mmWave introduced to have more spectrum resource

13 ZTE confidential
 Global 5G Spectrum Allocation Status

Sub1GHz Sub6GHz mmWave

700MHz 3.4-3.8GHz 24.25-27.5GHz 31.8-33.4GHz 40.5-43.5GHz

2.6GHz 3.4-3.6GHz 4.8-4.99GHz 24.25-27.5GHz 37-42.5GHz

3.6-4.2GHz 4.4-4.9GHz 27.5-29.5GHz

3.4-3.7GHz 26.5-29.5GHz

600MHz 2.5GHz 27.5-28.35GHz 37-40GHz 64-71GHz

Confirmed TBD

14 ZTE confidential
 5G Spectrum Adopted By 5G Commercial Networks
Distribution of 5G commercial network globally

mid-band mmWave

• Mid-band adopted by majority of 5G operators globally

• N78 is the prime band for initial 5G deployments

15 ZTE confidential
 5G Chipset and Terminal Eco-System

2018 2019 2020

Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2

SDX50 CS SDX50 SDX55 CS

SA Trials NSA/SA
NSA
700/900/1800/2.6/ Sub6G:700/900/1800/2.6/3.5/4.9
2.6/3.5/4.9
3.5/4.9/mmWave mmWave: 28GHz/39GHz

NSA/SA
700/900/1800/2.6/3.5/4.9

SmartPhone ES
(Engineer Sample)
Sub6G, NSA Axon 5G Commercial
SDM855+SDX50 Sub6G, NSA/SA
SDM855+SDX55

Terminals Indoor CPE ES Outdoor CPE ES

Sub6G, NSA NSA, Sub6G+mmW
SDM855+SDX50 SDM855+SDX50

16 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 Frame Structure for NR 3.5GHz
2ms (single period) 2.5ms (single period) 2.5ms (dual period)

18 ZTE confidential
 Latency of Each Frame Structure

2.5ms+2.5ms (dual period)

Latency 2.5ms Dual 2ms Single 2.5ms Single

DL latency 3～4.5ms 3～4ms 3～4ms

Longest
2ms (single period)
UL latency 3～5ms 3～5ms 3～5.5ms
Longest

• DL HARQ latency:
2ms single is shortest
最长

2.5ms (single period)

• UL HARQ latency:
2.5ms single is shortest
• PDCP latency
2ms single period has more advantage
19 ZTE confidential
 Comprehensive Analysis of Frame Structure
Parameter 2.5ms (dual period) 2ms (single period) 2.5ms (single period)
Uplink Ratio 32.9% 28.6% 22.9%

Coverage +1.8dB +1 dB X (Baseline)

Coverage
Uplink Capacity +50% +25% X (Baseline)
ability
Downlink Capacity -13% -8.8% X (Baseline)

UL latency Reduced by 0.5ms Reduced by 0.5ms X (Baseline)

Atmospheric Waveguide Has little effect Has little effect Has little effect

Proportion of Overhead X (Equivalent) X (Equivalent) X (Baseline)

• Comprehensive ranking: 2.5ms dual period > 2ms single period > 2.5ms single period
• 2.5ms dual period has obvious advantages in UL coverage and capacity
• 2ms single period has advantages in latency.
• 2.5ms single period performs poorly in all dimensions and is not recommended.

20 ZTE confidential
 Frame Structure Selection in Different Countries

Country Frequency Band Frame Structure

2.6GHz 5ms single period

China Mobile
4.9GHz 2.5ms dual period

China Telecom 3.5GHz 2.5ms dual period / 2ms single period

Japan 3.5GHz 5ms single period

Germany 3.5GHz 2ms single period

Switzerland 3.5GHz 2ms single period

Australia 3.5GHz 2ms single period

Korea 3.5GHz 2.5ms single period

21 ZTE confidential
 Typical Fixed Slots Used in a 5G NR Frame Structure
μ, (subcarrier spacing) symbols/slot Slots/sub-frame Slots/frame Slot duration

0 (15 KHz) 14 1 10 1 ms

1 (30 KHz) 14 2 20 500 µs

2 (60 KHz), normal CP 14 4 40 250 µs

2 (60 KHz), Extended CP 12 4 40 250 µs

3 (120 KHz) 14 8 80 125 µs

4 (240 KHz) 14 16 160 62.5 µs

Difference between slot and mini-slot
• Normal slot occupies either 14 (normal CP) or 12 (extended CP) OFDM symbols, it enables slot based scheduling
• Mini-slot occupies 2, 4 or 7 OFDM symbols, it enables non-slot based scheduling
• Mini-slots can occupy as little as 2 OFDM symbols. They can be positioned asynchronously with respect to the
beginning of a standard slot

22 ZTE confidential
 Reference Signal for NR

Physical Channel Reference Signal

PUSCH PT-RS for PUSCH • No CRS in NR, which save resources

PUCCH DMRS for PUCCH • CSI-RS will play an more important role
Uplink 1. RSRP measurement
PRACH DMRS for PUSCH 2. SINR measurement
3. PMI/CQI/RI measurement
SRS

PDSCH PT-RS for PDSCH

PDCCH DMRS for PDCCH • Both DL and UL can use DMRS to demodulate data, and
DMRS belongs to the UE-specific reference signal.
PBCH DMRS for PDSCH Downlink • SRS can be used to estimated UL channel, and can help do
PSS DMRS for PBCH DL beamforming according to reciprocity of TDD.

SSS CSI-RS

23 ZTE confidential
 DM-RS and SRS in NR
DM-RS SRS

• NR DM-RS supports flexible configuration according to UE
speed (1 Front-loaded DMRS + additional DMRS)
• Additional DMRS allows more accurate estimation for the
various channel, so the performance can be improved
effectively
• NR has smaller SRS period than LTE
• Faster SRS can make measurement in shorter periodic to
provide better accuracy of channel estimation
• Faster SRS can also better adapt to the high speed user

24 ZTE confidential
 Design Criteria of 5G Waveform
Basic waveform needs to meet the flexible requirements for different scenarios.

Key Design Target Detail Description

Higher spectrum efficiency Support MIMO and resist multipath fading

Lower in-band/out-of-band Tx power Reduce the interference of adjacent users and operators
Adopt asynchronous operation and support more small packet by
Support asynchronous multiple access
using least overhead.
Low power consumption Need the lower PA fallback to improve PA efficiency
Low complexity Reasonable complexity requirements for transceivers
Maximize the spectrum efficiency between gNB and UE, and
Higher spectrum efficiency of network
support MU-MIMO
Keep balance between link budget and
Balance the capacity and coverage based on UE and scenarios
capacity
Minimize protocol overhead, reduce power consumption and
Low overhead
increase capacity
25 ZTE confidential
 Selected Waveform by 3GPP

NR(Sub 52.6) eMBB, URLLC LTE • DFT-S-OFDM is based on CP-OFDM，and DFT operation is used to
reduce PARP, which can reduce the requirements of transmitter.
Downlink CP-OFDM CP-OFDM
• DFT-S-OFDM is only employed for link budget limited single stream.
Uplink CP-OFDM, DFT-S-OFDM DFT-S-OFDM

FB-OFDM Wave previously proposed by ZTE for 5G NR

IFFT for each Polyphase Pluse Function

Subframe Data Filter Selection
Symbol
• Adopt poly-phase filter to shape for all of subcarriers
Per Sub-Carrier Shaping 1 Subframe

… • Reduce the adjacent frequency interference

Same shaping
for all subcarriers
• Reduce the requirements of time and frequency
Rect(.) for LTE
synchronization effectively
Symbol 1 Symbol 1 Symbol 1
Symbol 1
Symbol 2 Symbol 2 Symbol 2 Symbol 2
Symbol 3 Symbol 3 Symbol 3 Symbol 3
Symbol
Interval
Symbol n Symbol n Symbol n

Frequency domain Time domain Symbol

Duration

26 ZTE confidential
 Common Multiple Access Technology for 5G
Technology Full Name Proposer

MUSA Multi User Shared Access ZTE

SCMA Sparse Code Multiple Access Huawei

NOMA Non-Orthogonal Multiple Access NTT DOCOM

RSMA Resource Spread Multiple Access Qualcomm

PDMA Pattern Defined Multiple Access DT

Applying to three scenarios of 5G Proposing MUSA creatively

• Massive connective, low latency, high 04 01 • Key technology of NOMA
spectrum • Grant-free scheduling, high overload (600%+,
2Rx, 300%+, 1Rx)
Key advantages
Leading 3GPP standard intellectual Excellent test performance
property of MUSA
• Excellent test results in China MIIT Phase II
• Leading 3GPP NOMA research
03 02 • NTT DoCoMo speaks highly of ZTE MUSA
• more than 60 proposal and 40 patents

27 ZTE confidential
 Principle of MUSA
User1 User1
If MUSA is NOT adopted

User2 User2
RB1 RB2 RB3 RB4

User3 User3

For system scheduling, each user occupies one RB

User4 in order to avoid interference User4

Complex domain short Spreading Code

User12
Assume spreading code length =4

…
User1 UserN
User2

…
User3 李楠制作
Transmission Simultaneously 李楠制作

User7
sharing 4 RB resources
User4
User3
User5

User6 L李楠制作

SIC Algorithm
User7 李楠制作 Overload Ratio:
12Users/4Users=300%
• With an SIC receiver, user data with large power will be decoded
…
…
…

24Users/4Users=600%

User12 firstly, and then deducted from hybrid signals

4 Users Transmitted in 4 RBs as Basic Situation • Above process will be repeated until all user data are decoded
28 ZTE confidential
 Highlights of ZTE MUSA

I
1

…
…
-1 0 1 R

-1

Low Correlation with Big Low Complexity Advanced

Grant-free Transmission Low power consumption
Multiple Access Signature Pool Receiver

29 ZTE confidential
 Channel Coding, NR vs. LTE
Table 1

Control Channel Data Channel UCI length (including CRC) Channel coding scheme
1 bit Repetition code
LTE TBCC code Turbo code
2 bits Simple code
3-11 bits Reed Muller code
NR DCI (Polar code), UCI (table 1) LDPC code
>11 bits Polar code

LDPC: low density parity check code Polar code

• a kind of linear of block code • utilizes polarization theory which divide the channel into ideal channel and
• adopts iterative method to decode with low decoding complexity non-ideal channel.
and flexible structure. • The bits which carry much information can be put into the ideal channel,
the other bits can be transmitted into the non-ideal channel

Advantages of LDPC Code Advantages of Polar Code

• lower decoding complexity than Turbo, which is fit for eMBB • Encoding and decoding both have low complexity
• adopts parallel processing which is fit for low latency applications • Flexible design and low latency
• LDCP supports very high peak rate which is fit for eMBB • Polar code is fit for control channel

30 ZTE confidential
 Interaction of SSBLOCK Beam with UE

mechanism by which UE measure and identifies the

best beam for a UE.

• Multiple SSBs are being transmitted with a certain interval.

• Each SSB can be identified by a unique number called SSB index

• Each SSB is transmitted via a specific beam radiated in a certain direction

• Multiple UEs are located at various places around a gNB.

• UE measures the signal strength of each SSB it detected for a certain

period (a period of one SSB Set).

• From the measurement result, UE can identifies the SSB index with the
strongest signal strength. This SSB with the strongest signal strength is the
best beam for the UE 1. (For example, Beam #1 is the best beam(the
selected beam for UE1 and Beam#7 is the best beam for the UE 2)

31 ZTE confidential
 SSBLOCK Beam in R15 Protocol
The R15 protocol indicates: • In sub-6GHz, max 4 or 8 different beams can be used and they sweep in one dimension

• If frequency < 3GHz,maximum number of SSBLOCK beam is 4 (horizontal only or vertical only).

• If 3GHz < frequency < 6GHz,maximum number of SSBLOCK beam is 8 • In mmWave max 64 different beams can be used and they can sweep in two dimensions

• If frequency > 6GHz,maximum number of SSBLOCK beam is 64 (horizontal and vertical directions).

Time domain position of SSBLOCK beam

10 ms radio frame

5 ms time window • SCS=30KHz

0.5ms • Length of one slot=0.5ms

• Symbol number per slot=14

For 3.5GHz, SCS=30KHz, the time domain position of SSBLOCK are

SSB 0 SSB 1
symbols 2-5, symbols 8-11

32 ZTE confidential
 5G Uplink and Downlink Transmission Mode
Downlink
TM Optimal Beam Mode BF Mode PMI Feedback Mode
Scenario Initial access, SRS limited, single stream SRS unlimited SRS limited, but PUCCH unlimited

Calculating maximum L1-RSRP to choose

Principle Utilizing SRS to calculate BF weight Utilizing PMI feedback to calculate weight
optimal beam

Advantage Simple, Saving resource Better performance Good performance

SRS has an impact on the Need CSI-RS resource

Disadvantage Wider beam, poor performance
performance Measurement is a little complex

Uplink
UE type Optimal Beam Mode
• For DCI0_1 scheduling, the Tx mode based on codebook is supported. The gNB uses SRS to measure uplink PMI, and selects
2T4R the suitable codebook for UE, then indicates to UE by DCI.
• For DCI0_0 scheduling, UE uses the first port fixedly, and doesn't select codebook.

1T2R UE cannot use precoding due to single transmitting port.

33 ZTE confidential
 Basic Concept of Spectrum Sharing
Objective
• Re-farming existing 4G spectrum to accelerate 5G deployment with reduced network investment
• Improve the spectrum utilization in initial phase of 5G, where low penetration of 5G device leads to underutilization of the 5G spectrum.

Two allocation scenarios

Fully overlap Partially overlap

NR

LTE NR NR LTE
LTE
10/15/20MHz 10/15/20MHz
10/15/20MHz 20~100MHz 20~100MHz

• LTE and NR co-exist and share whole spectrum
• LTE and NR must avoid conflict on whole spectrum in a semi-static or real-time way
• Typical spectrum bandwidth: 10, 15, 20MHz
• LTE and NR co-exist and share partial spectrum
• NR has dedicated spectrum to configure its regular common channel, to partially reduce
conflict with LTE
• For overlapped spectrum, LTE and NR must avoid conflict in real-time
• Typical spectrum bandwidth: 20~100MHz

34 ZTE confidential
 Spectrum Sharing Methods

Carrier Level Spectrum Sharing PRB / TTI level Spectrum Sharing

NR NR

NR LTE LTE/NR LTE/NR

Without overlapped spectrum (PRB resource) With overlapped spectrum (PRB resource)

Outer power Outer power

NR LTE LTE/NR

Frequency Frequency

35 ZTE confidential
 Anchor/non-anchor mobility management solution
• NSA users always add NR after accessing LTE. The dual connection
LTE Non-Anchor Cell LTE Anchor Cell NR f1 process is more time-consuming than the normal LTE connection
f3 f2
process.

• When LTE has multiple frequency bands, NSA users directly access
from the LTE anchor cell, which can reduce the inter-frequency
handover from LTE non-anchor cell to LTE anchor cell.

• During the user mobility process, it is preferred to handover to LTE

anchor cell, which can also reduce intra-LTE inter-frequency
handover.

NSA user LTE access process optimization NSA user LTE handover process optimization

The 5G NSA user preferably handover to the neighboring NSA

Configure 5G NSA users with dedicated frequency selection
anchor cells when moving, and the handover request to carry the
priorities, and choose LTE anchor frequency cell preferably.
NR information (the X2 interface needs to be extended)

Step 1 Step 2 Step 3 Step 1 Step 2 Step 3

Access to LTE Measure NR Add NR Choose anchor New anchor add Anchor HO and
anchor Cell signal connection cells SN SN change

36 ZTE confidential
 Dual-anchor/Multi-anchor Switching solution
LTE Anchor Cell LTE Anchor Cell
LTE Anchor f1 LTE Anchor f2 LTE Anchor f3
f1 f2

NSA user dual-anchor handover scheme NSA user multi-anchor handover scheme

Multiple LTE anchor cells are set under the same coverage. When
User resides on the LTE cells with better coverage one of the anchor fails, the user can move into the fault-free anchor
cell, thereby avoiding the situation that the NR cell cannot be
accessed due to the anchor cell failure.

Step 1 Step 2 Step 1 Step 2

Step 3 Step 3
Access to LTE Measure LTE Access LTE Measure LTE
LTE cell handover LTE cell handover
Anchor Cell signal Anchor Cell signal

37 ZTE confidential
 Introduction on SUL (Supplementary Uplink)
• Purpose of SUL: To solve 5G uplink coverage issue on higher bands by switching to SUL on cell edge, as lower frequency band (SUL) has advantage in
propagation.
• Concept of SUL: To allocate a range of LTE spectrum for supplementary uplink access on top of regular NR uplink spectrum. For example, NR N78(3.4-3.8GHz)
can be combined with a chunk from N80(1710-1785MHz), the latter serves as a supplementary uplink.
• Terminal can activate only one UL connection at a time, either NR UL or SUL

SUL Bands
Band Frequency Range Remark

n80 1710 – 1785 MHz LTE band 3 UL

n81 880 – 915 MHz LTE band 8 UL

n82 832 – 862 MHz LTE band 20 UL

n83 703 – 748 MHz LTE band 28 UL

n84 1920 – 1980 MHz LTE band 1 UL

n86 1710-1780 MHz LTE band 3 UL

38 ZTE confidential
 Difficulties/Risks on SUL Implementation
Negative impact on LTE system
• Existing LTE network will work in DL/UL unbalanced mode (less UL spectrum, requires tight coupling of LTE scheduler ad SUL scheduler
• Important LTE upgrade is necessary

Require DL and UL Overlapped of LTE and NR

• Per 3GPP definition, one 5G NR cell can be configured with only one SUL carrier
• Due to large difference between bands, it is difficult to keep NR and SUL band strictly overlapped in commercial networks
NR site LTE site

NR DL Carrier 2 LTE site

NR SUL NR DL Carrier 2
Carrier 1
C
A NR SUL Carrier 2

B NR DL Carrier 1 UE-3
UE-1 UE-2
NR DL Carrier 1 NR SUL Carrier 2
NR SUL Carrier 1
LTE/NR co-located LTE/NR not co-located

• Terminal moves within 5G NR cell, required to switch SUL carriers for • When NR and SUL are not co-located, due to coverage difference and X2
coverage purpose[1], 3GPP does not support delay, SUL cannot work.
• Terminal moves across 5G NR cell, required to keep SUL carrier for
coverage purpose[2], 3GPP does not support
[1] reason for switch SUL carrier: 1) to obtain better performance from new carrier; 2) reduce UL interference for target cell
[2] reason for keep SUL carrier: 1): no new SUL carrier has been detected; 2): new SUL carrier performance not meet requirements

39 ZTE confidential
 5G CA Solution
• Technically no difference between LTE and 5G for carrier aggregation
• Actual implementation and release date to support each combination depends on
ü NR/LTE spectrum allocation
ü Chipset support of particular carrier combination

Band combination Release time

Mode Band

Intra-band FR2 2CC (n258 & n258, n257 & n257) 2018Q2

Inter-band FR1 2CC (n78 & n28) 2019Q1

Intra-band FR2 4CC (n257/n258) 2019Q2

Inter-band FR1 (n41&n79) 2019Q4

Intra-band FR1 (n41/n78) 2019Q4

Inter-band FR1&FR2 2CC (n78 & n258, n78 & n257) 2020Q2

40 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 Key Differences 4G vs. 5G in RAN Topology

• 5G can achieve E2E network slice

• Realize network function formulation and orchestration based on service scenario and
Diversified traffic model for diversified demands
Service

• 5G network support CP/UP separation

Cloudificatio • Allow multi-connection and improve performance with centralized deployment for
n
high layer functions

Flexible • 5G network allows RAN split

Deployment
• Reduce transport bandwidth requirement, especially for fronthaul
• Provides scalability and flexibility for deployment and management

42 ZTE confidential
 Network Architecture Evolution: D-RAN->Cloud CU
DU
... Cloud CU

DU

DU/DU+CU
Cloud CU
... • Cloud CU/ CU virtualization are
same terminology
DU/DU+CU
• CU/MEC/UPF could share same
DU/DU+CU hardware platform (COTS or
customized server) with
CU+DU C-RAN
virtualization

D-RAN • Centralized management and

• Traditional architecture with
CU&DU integrated, widely used
in existing network
• 5G Initial stage, fast deployment
• Low latency scenario
• C-RAN stands for centralized RAN
• Focus on centralized baseband
deployment (DU or DU+CU)
• Dedicated baseband resource for
sites
• Rich fiber resources requirement
coordination of Cloud CU with
network slicing and
orchestration
• Scalable cloud CU deployment
based on service requirements
and application scenario

43 ZTE confidential
 Multiple Options for Operator Flexible Deployments

D-RAN C-RAN Cloud CU

Case 1 Case 2 Case 3 Case 4 Case 5

Integrated CU/DU Integrated CU/DU/AAU Centralized DU/CU Cloud CU, Centralized DU Cloud CU, Integrated DU/AAU

EPC/5GC EPC/5GC EPC/5GC EPC/5GC EPC/5GC

Cloud CU Cloud CU

Centralized Centralized
CU+DU DU

CU+DU

AAU AAU+CU+DU AAU AAU AAU+DU

44 ZTE confidential
 RAN Split Network Architecture
BBU
RRU 4G

Low layer DU/AAU split High layer CU/DU split

Low-
RF PHY High- Low- High- Low- High- PDCP RRC
PHY Mac MAC RLC RLC

Option8 Option7 Option6 Option5 Option4 Option3 Option2 Option1 Data

Low- High-
RF PHY High- Low- High- Low- PDCP RRC
PHY MAC MAC RLC RLC

Data

Fronthaul (eCPRI) Midhaul 5G

5G RRU/AAU DU CU
• In order to save RRU/AAU and DU • Focus on the physical layer and L2 real-time • Focus on the non real-time services, part of the

bandwidth, part of the physical layer application functions core network function and MEC function
function down to the RRU/AAU. • For special or based on IT platform development • To the direction of development based on

trend cloud IT platform

45 ZTE confidential
 5G RAN Split Solution--- AAU/DU with ZTE eCPRI
Split Interface between AAU & DU

Low-
RF PHY High- Low- High- Low- High- PDCP RRC
PHY Mac MAC RLC RLC

Option8 Option7 Option6 Option5 Option4 Option3 Option2 Option1 Data

Low- High-
RF PHY High- Low- High- Low- PDCP RRC
PHY MAC MAC RLC RLC

RAN Split Data

Split Option Bandwidth (MHz) Ant. Port Layers Fronthaul Requirements

Option 8 100 64 16 208 Gbps

Option 7
(Layer mapping)
100 64 16 25 Gbps

46 ZTE confidential
 5G RAN Split Solution--- CU/DU Split with F1

Split Interface between CU & DU

Low- High- Low- High- Low- High-

RF PDCP RRC
PHY PHY Mac MAC RLC RLC

Option8 Option7 Option6 Option5 Option4 Option3 Option2 Option1 Data

Low- High- Low- High- Low- High-

RF PDCP RRC
PHY PHY MAC MAC RLC RLC

RAN Split Data

HARQ Loop, 4ms for LTE, 200us for NR • Real time Processing- Close
related to low layer, eg., the
better wireless channel status,
the larger size of packet
Critical Latency Requirement segmentation.
• Relaxed Latency Requirement. The
computing overhead is about 10%
of RAN processing.

47 ZTE confidential
 Series Radio Units for Diversified Scenarios

Main Stream Cost Effective

mmWave
64T64R 16T16R

200MHz 200MHz 800MHz

200W 200W 4T4R

@Macro Coverage @Macro Coverage @Hotspot, FWA

Sub1GHz Small Cell

Outdoor Indoor
20MHz
200MHz 800MHz 400MHz LTE 20M + NR 100M
2T4R 2*80W
4T4R 4T4R 4T4R 2T2R + 4T4R

@Wide Coverage, @Outdoor Hotspot @Indoor

URLLC Coverage

48 ZTE confidential
 New Business Needs Re-organization of Cloud Computing
Traditional network

Distance to DC:
100~ km Cloud
AR/VR apps depends on MEC to
provide real-time rendering and Regional DC
accelerate performance

Next generation network

Automated driving needs real time
edge
processing, such as data analysis and computing
model training, system updates. Distance to DC:
1~10 km edge Cloud
computing
Industrial Internet, relying on real-time Regional DC
edge computing, all wired connections edge
are replaced by wireless, accelerates the computing
pace of Industry 4.0 Edge DC

49 ZTE confidential
 MEC Solution Overview

Enterprise
/Intranet

LTE(eMTC)

MEC Server
Backhaul Internet
NB-IoT

Edge
Applications Core
Network
Other Access Modes

Massive Equipment Multiple Access ZTE MEC Edge Applications Core Network

50 ZTE confidential
 ZTE MEC Architecture for Differentiated Edge Computing
Wide coverage, distributed MEC
MEC MEC
ME APP1 ME APP2 ME APP3 ME APP n Management Zone
Application l Multiple hardware to fit different site environment
Zone MEC Portal l Light virtualization, match different hardware

Seamless coordination of
Offloading Orchestration Cloud/Network/Edge
RNIS Open capability engine
Data engine management
MEC Plane l Unified resource scheduling with one-stop service
Business chain
Capability LBS engine IoT engine AI engine
engine Service strategy l Network capacity openness to coordinate
Zone management
seamlessly with computing
MEC edge business platform capability l FMC to ensure unified experience
FCAPS
management Embedded edge intelligence
Heterogeneous virtualization environment
MEC l Rich AI algorithm models, to enhance intelligence
Virtual Life cycle
Resource Container Bare metal monitoring at edge computing
machine
Zone l High performance hardware, GPU, intelligent NIC
General Customized Embedded Virtual resource
HW HW HW management On-demand MEC resource scheduling

l Multi-level MEC resource, unified management and

scheduling
l Convergence of open capability and application

Cloud deployment Dedicate hardware Multiple system Open platform

Unified management Heterogeneous acceleration Converged access Jointly constructed
environment

51 ZTE confidential
 3GPP Standard 5G Voice Solution Voice
Idle/Data Registration/SMS

NSA (Option3) SA (Option 2)

VoLTE/CSFB EPS Fallback VoNR

IMS IMS
IMS

CS EPC CS EPC 5GC

Sv/SGs CS EPC 5GC Sv/SGs N26
Sv/SGs N26

2G/3G LTE 5G NR 2G/3G LTE 5G NR

2G/3G LTE 5G NR

VoLTE + SRVCC or CSFB

VoLTE + SRVCC or CSFB EPS Fallback SRVCC VoNR and Handover

IMS Core + EPC, supports VoLTE & CSFB to 2G/3G IMS Core + 5GC, supports EPS Fallback to 4G IMS Core + 5GC+ 4G EPC
voice continuity guaranteed by PS domain.

• 5G NSA directly uses VoLTE/CSFB as voice solution

• 5G SA uses VoNR or EPS Fallback.

52 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 Complete 5G Commercial Networking Solution

• 5G low cost coverage • 5G indoor coverage • 5G outdoor hotspot • 5G ultra high

• 5G macro coverage
and low capacity • High capacity and or blind spot capacity area
• 5G macro capacity requirement high value areas coverage • FWA or backhaul for
• Quick deployment small cells

mmWave (5G NR)

3.5GHz (5G NR)

1.8GHz / 2.1GHz (4G FDD)

900MHz (4G FDD)

54 ZTE confidential
 Network Design Objectives in Mobile Internet Era

2G 3G 4G 5G Strategy and Principle

Focus on mobile video stream
Text Smart phone Video services
• Definition of main stream smart phone
1080p~2K
• iPhone 8/x/xs font camera 700M pixels, video
definition 720~1080p, UL 2~5Mbps

Focus on high valued scenarios

• Ensure UL cell edge of 2Mbps to
support 720p realtime video broadcast,
challenge 5Mbps for HD (1080p)
realtime video broadcast
• Ensure DL cell edge of 50Mbps for 4K
video
• Challenge 100Mbps DL cell edge speed
for high valued area (8K/AR/VR)

55 ZTE confidential
 7D for 4G Value Area Identification for 5G Deployment Area
Lock Down

56 ZTE confidential
 5G NR Coverage for Typical Scenarios (Link Budget)
Observations

• UL MALP smaller than DL MALP, UL limited

• Compare to 1.8 GHz FDD with 2T2R
MU v With larger BW, enhanced UE capability and Massive MIMO,
3.5GHz has benefit of 1.5dB
• For 5Mbps UL in DU and MU, ISD is 300 and 500
respectively for 3.5GHz, could consider continuous
coverage in key areas
• For 2Mbps UL in DU and MU, ISD is 400 and 600
DU
respectively for 3.5GHz, similar to 4G network could
consider 4G/5G co-site deployment

1.5dB

1.8G 2TR PUSCH

3.5G NR 64TR PUSCH

57 ZTE confidential
 Typical 5G NR Indoor Coverage (Trial Results)

• 5G UL coverage significantly affected at cell edge,

throughputs at far points drop quickly
• Similar UL cell edge throughput for NR and LTE

NR - 158/77Mbps NR
7 LTE - 51/28Mbps
NR - 27/18Mbps NR - 452/148Mbps
LTE - 17/10Mbps 3 LTE - 81/36Mbps
NR - 908Mbps
4 2
6 5 LTE - 103Mbps
1

58 ZTE confidential
 Planning on Massive MIMO Broadcast Weight and
Simulation Modeling of Beamforming
1 2
Broadcast channel 5G NR supports beamforming of broadcast channel based on “Beam Service channel
sweeping”, i.e., broadcasting of multiple narrow beams in rotation to
Beam Sweeping simulate beamforming. Beam Forming
5G supports multiple weight configurations to allow various beams for
different coverage scenarios.

Horizontal beam 65 Horizontal beam 65

Vertical beam 6 Vertical beam 30
• Precise and dynamic beam forming
Direction angle 0 Direction angle 0
Simulation software automatically tracks the user and
Digital tilting 6 Digital tilting 6
assigns the model according to the built-in assignment
algorithm.
Traffic map is generated by dispatching traffic, and Monte
Carlo simulation is carried out based on traffic map.

Horizontal beam 20 Horizontal beam 30 • 3D GOB static beam forming

Vertical beam 65 Vertical beam 12 Customize GOB antenna, and the simulation software

Direction angle 0 Direction angle 0 decides to cover the user's antenna according to the signal

Digital tilting -6 Digital tilting 3 intensity received by the user.

Without traffic map, throughput simulation is obtained by
59 ZTE confidential static simulation.
 ASP – Site Planning Process
Redundant coverage analysis < 50m

Prediction of Redundant cell

5G MR assessment

Traffic check
2 00m
I SD >
• Weak coverage grid cluster
• Site model selection
High
• ISD control > 15m
traffic?
• Coverage radius optimization
Y • Eliminate grid thresholds
N Reserve cell Topological Structure Evaluation
MR weak coverage
Delete cell analysis of Planning Results

MR-based 4G/5G Redundant cell removal 5G new site

difference forecast planning based on
4G DT/CQT • ISD filtering: macro sites with ISD > 200m are
4G RS: 15.2 ~ 20dBm complaints not in the scope of systematical evaluation
RS power config.
5G SSB: 17,8dBi 200W@100MHz • Confirmation of special coverage
• Weak coverage requirement for close short ISD (ex. building
4G: 65° large beam, 17~18 dBi
Broadcast beam analysis with DT obstruction)
5G: large beam/multiple beams • Antenna height filtering: 15m ~ 50 m
Compare to 1.8GHz, • CQT complain • Evaluate effective coverage, avoid over
Propagation coverage
+5.8 dB for 3.5GHz signal analysis
path loss • Verify if antenna height adjustable with site
(UMA model)
improvement
Penetration loss 3.5GHz signal (compare to 1.8GHz)
adjustment DU (+8), U (+5), SU (+4), RU (+3)

60 ZTE confidential
 3D Simulation
Use tool for actual network coverage simulation, verify site design and provide
reference for site location, broadcast and RF parameter configuration
• Mainstream ray-tracing model (Volcano, cross wave, P3M)
• 5m or less HD digital map (with building height information)

Ø With HD digital map, simulation tool

uses ray-tracing model calculates all
types of path loss due to reflection,
refraction, diffraction etc. between
TX and Rx.
Ø Results are highly close to actual
signal propagation characteristics,
especially for high frequency bands
(sub-6GHz and mmWave)
Ø Broadcast channel parameter
configuration, service channel 3D
beam forming all depend on ray-
tracing model.
Typical simulation tools

Atoll
61 ZTE confidential
 ACP – Cell Parameter Design Process
1 2
RF parameter Optimal broadcast
optimization pattern planning
• ACP automatically selects the best patterns
by using antenna patterns with various
broadcast patterns and 3D maps.
• Optimal broadcast pattern design is related
to site distance, coverage target, coverage
building height, site height and other factors.
• For high-rise coverage, vertical beam
Optimization Define optimization
area definition index and targets scanning coverage can greatly improve the
coverage effect of high-rise buildings.

Define adjustment
Calculation
scope and sites 2/3 Cell Vertical 4-beam 2/3 Cell Horizontal 4-Beam
Scanning Antenna Scanning Antenna

RSRP=-70dBm ↑5.5%
Configuration Configuration

RSRP=-80dBm ↑3%

62 ZTE confidential
 ACP – Cell Parameter Design Process
3 PCI
A NR system has a total of 1008 PCI
values (0-1007).
• No cell ID conflict, i.e., the IDs of
neighbor cells cannot be the same
• Cell ID cannot be confused, that is, a
cell’s neighbor cell ID cannot
duplicated.
• The PCI modulo 3 of neighbor cells is
different
• Maximize PCI multiplexing distance
• Maximize multiplexing distance of PCI
mod30
• Reserve certain PCI group
63 ZTE confidential
4 PRACH
Determines preamble format: format A3/B4...
Determines Ncs based on
coverage radius (zeroCorrelationZoneConfig)
Determines location in time domain
(Prach-configIndex)
Determine the preambles based on competition and non-
competition.
(competition:56 ; non-competition:8)
Determine the number of Ncs and root µ in each
preamble according to Ncs PRACH and velocity scenarios;
Each cell chooses continuous roots.
5 Neighbor Planning
SA networking scenarios
• Inter-system neighbor of 5G->5G
• Inter-system neighbor of 5G->4G
• Intra-system neighbor of 5G->5G
Initial configuration of the adjacent area is recommended
face to 2 layers and back to 1 layer. The number of
neighbors is about 20 each (including intra-frequency
and inter-frequency for all available frequencies)
NSA networking scenarios
• Inter-system neighbor of 4G->5G: only plan the NR
neighbor corresponding to anchor frequency
• Intra-system neighbor of 5G->5G: Include intra and inter-
frequency, for UE to move between cells in 5G system
It is suggested that the number of initial neighbors to be 20.
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 Comparison of 4G/5G QoS Architecture
4G QoS Architecture – Based on Bearer 5G QoS Architecture – Based on QoS Flow

• Bearer is the smallest granularity of QoS processing
• One-to-one relationship between EPS bearer and Radio bearer. When
there is a new demand for QoS, both wireless and wired bearers need to
be built simultaneously.
• Core network manages bearer
• RAN can only accept or reject bearer management requests from core
network, can’t manage bearer by itself
• QoS Flow is the finest granularity of QoS processing
• There is no bearer between 5GC and RAN anymore. When there is a new
QoS requirement, only a new wireless bearer is needed to be built.
• For each PDU session, there is a single tunnel between 5GC and RAN
• RAN manages data wireless bearer (DRB) and mapping of QoS Flow to DRB
by itself

5G QoS architecture based on QoS Flow is more flexible, and better match the complexity and flexibility of 5G QoS requirements
65 ZTE confidential
 Comparison of 4G/5G QoS System
5G QoS 4G EPS QoS Note
5QI extends QCI greatly and 5G QoS support
QoS Parameter 5QI, ARP, GFBR, MFBR QCI, ARP, GBR, MBR customized Priority Level, Averaging Window and
Maximum Data Burst Volume
5G cancels APN-AMBR and replaces it with
Set QoS Parameter Session-AMBR, UE-AMBR APN-AMBR, UE-AMBR
Session-AMBR

Subscribed UE-AMBR
Subscribed UE-AMBR
Subscribed Each subscribed APN: Subscribed APN-AMBR
Subscribed Session-AMBR
QoS Parameter EPS Subscribed QoS profile: QCI of default
Subscribed QoS profile: default 5QI, ARP
bearer, ARP

QoS Implementation
Based on QoS Flow Based on bearer
Mechanism

Reflective QoS is introduced in 5G. UE may derive

UL packet filter from DL data flow according to
Packet Filtering Use packet filter Use packet filter
the reflective QoS indication.
Ethernet packet filter is added in 5G

66 ZTE confidential
 Comparison of 4G/5G QoS Parameters
Level 5G QoS EPC QoS
UE UE AMBR UE AMBR
PDU Session Session AMBR (PDU Session level) APN-AMBR (APN level)
QoS Flow ID (QFI) EPS Bearer Identifier(EBI)
Resource Type
Priority Level
5QI QoS Class Identifier(QCI)
Packet Delay Budget
Packet Error Rate
QoS Flow
Allocation and Retention Priority (ARP) Allocation and Retention Priority (ARP)
Maximum Flow Bit Rate(MFBR) Maximum Bit Rate(MBR)
Guaranteed Flow Bit Rate(GFBR) Guaranteed Bit Rate(GBR)
Reflective QoS Indicator(RQI) N/A
Notification Control N/A

Compared with 4G, 5G adds two new parameters RQI and Notification Control.

67 ZTE confidential
 5G QoS Parameters
QoS Flow Level Parameters Description
GBR QoS Flow Parameters Flow Bits Rate 1) GFBR: guaranteed bit rate can be provided; 2) MFBR: maximum bit rate can be provided
Indicates whether notifications are requested from the NG-RAN when the GFBR can no longer (or
Notification control
can again) be guaranteed for a QoS Flow during the lifetime of the QoS Flow.
Maximum rate for lost packets of the QoS Flow that can be tolerated(can only be provided for a GBR
Maximum Packet Loss Rate
QoS Flow belonging to voice media in 3GPP R15 release)
Non-GBR QoS Flow
Reflective QoS Attribute (RQA) Indicates that certain traffic (not necessarily all) carried on this QoS Flow is subject to Reflective QoS
Parameters
Common Parameters Packet Delay Budget(PDB) Defines an upper bound for time that a packet may be delayed between the UE and the UPF
A scalar that is used as a reference to 5G QoS characteristics, a 5QI represents a set of QoS
5QI parameters. 5QI extends QCI greatly and 5G QoS supports customized Priority Level, Averaging
Window and Maximum Data Burst Volume, etc.

Priority level A priority in scheduling resources among QoS Flows, range from 1 to 15

ARP Pre-emption capability Indicate whether the QoS Flow can preempt the resource with lower priority

re-emption Indicate whether QoS Flow resource can be preempted by other QoS Flow with higher priority
Set Level QoS Parameters Description
PDU Session QoS Parameter PDU Session-AMBR Maximum aggregate bit rate expected to be provided across all Non-GBR QoS Flows for a specific PDU Session
UE QoS Parameter UE-AMBR Maximum aggregate bit rate expected to be provided across all Non-GBR QoS Flows of a UE
68 ZTE confidential
 New Features of 5G QoS
QoS Control Based on QoS Flow
• Based on the granularity of QoS Flow, multiple QoS Flows of the same
session use a unified tunnel between core network and RAN, and QFI
is added to the packet header to distinguish the QoS Flow.
• In RAN side, can use multiple or one DRB to transmit multiple QoS
Flows according to wireless resource status.
Reflective QoS
• According to the data packet header of received DL data, UE can
directly derive corresponding UL QoS rules without network
instructions, thus saving signaling interaction and supporting Internet
services more flexibly and rapidly
• Reflective QoS mechanism can be activated by RQI indication added to
packet header or by control plane activation.
69 ZTE confidential
Support Non-standardized 5QI
• Support standardized 5QI values
• Also support non-standardized 5QI values assigned dynamically. Core
network can flexibly define 5QI according to service requirements, and
send the characteristics of 5QI (PDB, PER, etc.)to RAN.
In-Band QoS Control
• Support RAN to establish corresponding wireless resources by signaling
when session establishment or service initiation
• Introduce wireless resource allocation triggered by user plane. In case
of non-GBR QoS Flow which uses standardized 5QI, without interaction
with core network, RAN can directly obtains the QoS requirements
according to the QFI in packet header and then can configure
corresponding wireless resources for it.
 QoS Flow
Default Radio Bearer, QFI=30 PDU Session 1

QoS Flow1

Dedicated Radio Bearer , QFI=20 PDU Session 2

UE QoS Flow1
UPF
QoS Flow2

Default Radio Bearer，QFI=10

• QoS Flow is the finest granularity of QoS differentiation in the PDU Session. The 5G QoS model is based on QoS Flows.
• 5G QoS model supports both GBR QoS Flow and Non-GBR QoS Flow
• A PDU session requires a QoS Flow associated with default QoS rules. The default QoS Flow is maintained throughout the lifetime of the PDU session
and the default QoS Flow must be a non-GBR QoS Flow. Its 5QI and QFI are initially acquired from UDM, and SMF can modify them according to local
policy and interaction with PCF.
• A QoS Flow ID (QFI) is used to identify a QoS Flow in 5G system. User plane data with same QFI in the same PDU session will get same forwarding
processing
• There may be multiple QoS Flows in one PDU session. QFI should be unique in a PDU session, but if one UE has more than one PDU session, QFI can be
repeated.

70 ZTE confidential
 Characteristic of QoS Flow
AMF SMF

ule
Qo S R PD
R
o f ile
S Pr
Qo

UE

QoS Rule in UE RAN UPF

• Provided by SMF to UE via the AMF over the N1

interface during PDU Session Establishment QoS Profile in RAN PDR(Packet Detection Rule) in UPF
/Modification procedure or pre-configured in UE or
• Provided by SMF to RAN via the AMF over • Provided by SMF to UPF over the N4
implicitly derived by the UE by applying Reflective QoS
the N2 interface or pre-configured interface
• Include following QoS parameters:
• Include following QoS parameters: • Include following QoS parameters:
ü QoS rule ID(unique in one PDU session)
ü QFI for associated QoS Flow ü PDR packet filter
ü QFI for associated QoS Flow
ü 5QI(optional) ü PDR precendence value
ü QoS parameters corresponding to this QFI and
ü ARP (Allocation and Retention Priority) ü QoS-related information
UE-related
ü GBR QoS Flow related parameters ü Packet marking information (such as
ü Packet filter
ü Non-GBR QoS Flow related parameters QFI, DSCP value in IP packet header)
ü Precedence value

71 ZTE confidential
 Reflective QoS
• Reflective QoS is a new feature of 5G QoS. It refers to the mechanism that UE generates corresponding UL QoS Rule directly according to DL data
header without network instructions. It can be applied when no SMF provides QoS Rule through signaling. Meanwhile, it improves the efficiency of
Internet service support by reducing signaling interaction.
• Reflective QoS is only applicable to IP and Ethernet type PDU sessions; for the same PDU session, reflective and non-reflective QoS can coexist
simultaneously. If a UE supports Reflective QoS functionality, it should indicate support of Reflective QoS to the network for every PDU Session.
Reflective QoS enablement process is shown as following:
AMF SMF
When the 5GC SMF shall include an indication to use
determines Reflective SMF shall provide the RQA within the Reflective QoS for this SDF in the
QoS Flow's QoS profile to the NG-RAN corresponding SDF information provided
QoS has to be used for a on N2 interface to the UPF via N4 interface
specific SDF

When UE receives a DL UPF shall set the RQI in the

packet that complies with
Reflective Qos, processes it
accordingly.
encapsulation header on the
N3 interface for every DL
UE When an RQI is received by RAN in a DL packet on N3 packet corresponding to this
interface, the RAN shall indicate to the UE the QFI and the SDF
RAN RQI of that DL packet UPF

• If a UE derived QoS rule with a Packet Filter corresponding to the DL packet does not already exist
ü UE shall create a new UE derived QoS rule with a Packet Filter corresponding to the DL packet
ü UE shall start, for this UE derived QoS rule, a timer set to the RQ Timer value
• Otherwise
ü UE shall restart the timer associated to this UE derived QoS rule
ü If the QFI associated with the downlink packet is different from the QFI associated with the UE derived QoS rule, the UE shall update the UE
derived QoS rule identified by the UL packet filter derived from the DL packet with the new QFI
72 ZTE confidential
5G Technology Overview

01 5G Standard
02 5G Spectrum
03 5G Air Interface
04 5G RAN Solution
05 5G Network Planning
06 5G QoS
07 5G Security
 3GPP Security Architecture

• Network access security (I) • Application domain security (IV)

• Network domain security (II) • SBA domain security (V)
• User domain security (III)
74 ZTE confidential
 5G Enhances Security in Many Ways
Function 4G 5G
Access Authentication 3GPP and non-3GPP respectively use the independent
Unified authentication frame of 3GPP and non-3GPP
Frame authentication frame.
As the 3GPP access authentication solution is different from
Authentication the non-3GPP access authentication solution, EPS AKA’ is Two kinds of authentication solutions (5G AKA and EAP-AKA’) are applicable
Solution applicable to 3GPP access and EAP-AKA is applicable to non- to different access modes.
3GPP access.
The user plane has no integrity protection. The integrity protection support is added. Meanwhile, the integrity
User Plane Security Encryption protection is either enabled or disabled for all protection and encryption protection can be enabled based on the session
bearers, and the policy is not flexible granularity, so the policy is more flexible.
User Privacy IMSI is a plaintext when initiating Attach SUPI is protected upon initial registration.
The keys of SEAF (security anchoring point) are added for derivation, and
Key Hierarchy The MME key is not changed when UE is moving.
AMF key is changeable when UE is moving, so its security is higher.
The complete protection and encryption information of wireless and NAS is
Only the wireless encryption information is visible to APPs
Security Visualization on the terminal.
visible to all the APPs on the terminal. For APPS, a more flexible application-
layer policy can be stipulated.
Multi-access is enhanced, for example, two NASs can respectively
Multi-access
The multi-access is not supported. correspond to 3GPP and non-3GPP access, the security key is shared under
Capability the multi-NAS scenario, security context maintenance is defined.
As the key needs to be changed upon handover inside eNB, The wireless key can be remained unchanged upon handover inside gNB to
Wireless Security it influences the data interruption latency caused by reduce the data interruption latency upon handover and meet the demands
handover. of low-latency applications.

75 ZTE confidential
 Threat Analysis in 5G Network
RAN vulnerability analysis
eNB/gNB
Threats
Uu X2 3
destruction
1 OAM
EMS DB/LDAP corruption
X2
OMC removal
Vulnerability
disclosure
interruption

S1-C Attacks
F1 S1-U
4 Vulnerability
DU CU MME HSS/HLR
Access control
Data integrity 4 RAN interfaces have security
Authentication

2
Communication security
xGW
vulnerability exposure
Data confidentiality Internet
Availability 1. Air interface
Privacy
Non-Repudiation Core 2. RAN infrastructure
3. Operation and maintenance interface
4. Transmission interface
76 ZTE confidential
 RAN Air Interface Security
UE eNB/gNB Core

Uu S1-C
S1-U

NAS: Ciphering & integrity

NAS NAS
RRC RRC S1-C: IPSec MME
RRC: Ciphering & integrity
PDCP (actor) PDCP (actor)
RLC User data: Ciphering RLC S1-U: IPSec
MAC MAC SGW
AS security
PHY PHY

Scope of RAN air interface

security • Integrity applied only on PDCP layer and on control plane
• Security of communication between • MAC-I (from UE and attached to RRC signaling) and X-MAC (from eNB/gNB) are
UE and eNB/gNB compared for integrity check
Integrity and encryption
• Both integrity and encryption are • Integrity is mandatory and encryption is optional
applied on Uu interface to ensure • Encryption can be applied to both control and user planes
security
Mutuality Key derivation is based on
• Mutual authentication is applied • Pre-shared key stored on both USIM (UE side) and AuC (network side)
between UE and eNB/gNB • Key derivation mechanism
77 ZTE confidential
 RAN Transmission Security
Physical layer security
OMC 1 • Product design supports multi-port
eNB/gNB redundancy, data could be sent
through different ports
• Support encryption, data cannot be
2 EMS DB/LDAP
restored even being intercepted
2 Link layer security
• Link aggregation with static trunk or
MME/AMF HSS/HLR LACP, to achieve load balance and
1 redundancy in link layer
• Link status diagnostic to initiate link
Core handover if link failure detected. The
xGW/UPF
Protocols/Measures adopted for different Tx layers handover is transparent to upper layer
services
Layer Protocol/Measure Content
HTTPS Secure version of HTTP, with SSL layer added for encryption
SFTP A secure version of FTP for secure file transmission
Application
SSH A secure protocol for remote connection and other remote network service
NETCONF Established by IETF, to propose a new XML based network configuration protocol
Protocol for key authentication, text and signature integrity check to ensure encryption between browser and
SSL
Transmission server
TLS A generalization of SSL protocol by IEEE

Networking IPSec IETF standard, use IKE for key exchange between peers and data is transmitted with ESP format

Client/Server based access control and authentication protocol, capable to limit visit of unauthorized
IEEE 802.1x
user/equipment through access port
Link MACSec Defines secure data transmission methods for communication within IEEE 802.1x based LAN
Physical Isolation Different data planes are isolated with different VLAN
78 ZTE confidential
 Thank You

79 ZTE confidential