Mobile Internet

4.- Cellular Networks:

2G (GSM & GPRS), 3G(UMTS &
HSPA), 4G (LTE)

IM, Jorge García Vidal, 2020-21

Cellular networks: basic concepts &
medium sharing techniques
 Wireless Nets
Multihop: Small & low throughput nets

Infrastructured networks
Base station

Wired Net
 Wireless Nets
Infraestructure Networks

Wired Net

GSM (2G), GPRS (2.5G), UMTS (3G), HSPA (3.5G), LTE (4G)
LoRa/LoRaWAN
WiFi Hotspots

IM, Jorge García Vidal

 Comm: Wireless technologies
Data rate
Coverage
Wi-Fi
200 802.11n
Cellular
54 802.11a,g
All IP
Data rate (Mbps)

5-11 802.11b LTE, 802.16 (WiMAX) 4G

4 802.11ah UMTS/WCDMA-HSPDA
3G cellular
1 enhanced
UMTS/WCDMA
Bluetooth,
.384 802.14.4 GSM, GPRS 3G

.056 RFID 2G, 2.5G

NFC
Indoor Outdoor Mid-range Long-range
10-30m 50-200m outdoor outdoor
Near zero-power Low power (<100mW) 200m – 4 Km 5Km – 20 Km

(passive tag)
 Cellular networks
Cell: Area covered
by a Base Station

Handover
Real cells are
not hexagons
• Real shapes can be very
complicated
• Different sizes:
– Urban (x500 m)
– Suburban
– Rural (x 5 Km)
• Sectorization

e.g. 120 degrees sectors

 Small cells => Cell size Large cells =>
Higher capacity Cheaper coverage
tradeoffs

Small cells => More users per km2, but more handovers,
more towers and more connections to the backbone
Network (more expensive to install and maintain)
LTE (Evolved Packet Core)

MME HSS
UE
eNodeB
SGW

SGW Core Internet

Voice network
E-UTRAN
PGW

Serving Gateway (SGW) (SGSN) IP network:

Packet Data Network Gateway (PGW), (GGSN)
Mobility Management Entity (MME) (VLR)
Data and VoLTE
Home Subscriber Server (HSS) (HLR, AuC) (Voice over LTE)
 Cellular net evolution
-GSM (2G), GPRS (2,5 G)
– 3G, HSPA (3.5G)
– LTE (4G)
Voz iPhone! Estándar global

Tech 2G 2.5 G 3G 3.5 G 4G (LTE)

(GSM) (GPRS/ (WCDMA/ (HSPA/
EDGE) Cdma2000) EV-DO)
Max 15.2 170 Kbps/ 2 Mbps/ 10 Mbps/ 100, 300/ 50 Mbps
R Kbps 473 Kbps 307 Kbps 2.4 Mbps

Source: “WCDMA and WLAN for 3G and Beyond”, H. Hokansalo et al.. IEEE Wireless Comm ‘02
 5G
• Tecnologicamente parecido a 4G (OFDM, etc)
• >1 Gbps
• Servicios de bajo throughput pero masivo en #
dispositivo
• IPv6 (IoT)
• Latencia (algunas aplicaciones vehículos
autónomos, robotica, etc, sobre <1 ms) =>
Edge computing
 5G
• Red basada en cloud (capacidad elástica) basada
en SDN, NFV, ONAN, OpenStack, cloud and
virtualization
• IoT
• AI para operar la red
• Espectro compartido
• mmWave (20+GHz), MidBand (2-6 GHz)
• CBRS
• Agregacion dinámica de espectro
• LEO, WiFi6, Loon
 Cellular net evolution
• To increase the overall capacity of celular networks,
there are three main possibilities:
– Networks with small cells
– Use wide bandwidth available at higher
frequencies
– Use multiantenna transmissions or other
techniques that increase spectral efficiency

Source: David López-Pérez, Ming Ding, Holger Claussen, Amir H. Jafari, “Towards 1
Gbps/UE in Cellular Systems: Understanding Ultra-Dense Small Cell Deployments”
Cellular networks:
Multiple access
 Time Division Multiple Access (TDMA)
Synchronous TDMA
Frame

1 2 3 1 2 3
1
2G Time-slot Time
Same carrier
2 3 Statistical TDMA frequency

1 1 2 3 3

WiFi (distributed), Time

2.5G (centralized)
 Frequency Division Multiple Access
(FDMA)
Different
carrier
Simultaneous Tx frequencies
1 3 fc3

2 3 2 fc2

1 fc1

Time
2G, 2.5G: FDMA+TDMA
4G: OFDMA, SC-FDMA
 TDMA fc
T
time frequency
…
1 … N
NxT Bwtot

Rtot= NxR = N(1/NxT)=1/T Bwtot=1/T

FDMA
fc1 fcN
N
… time frequency
…
1
NxT Bw=1/NT

Rtot= NxR = N(1/NxT)=1/T Bwtot=Nx(1/NT)=1/T

 Code Division Multiple Access (CDMA)
Same
carrier
Orthogonal codes frequencies

1 3 fc

2 3 2 fc

1 fc

Time
3G: WCDMA
 R = (2,2,2,-2)

R = s1 c1 + s2 c2 + s3 c3 + s4 c4

C1= (1, 1, 1, 1) <R,c3>= s1 <c1,c3> + s2 <c2,c3> + s3 <c3,c3> + s4 <c4,c3>

C2= (1, 1, -1 ,-1)
C3= (1, -1, 1, -1) <R,c3> = 2 -2 +2 +2=4
C4= (1, -1, -1 ,1 ) <c1,c3>=0 <c2,c3>=0 <c3,c3>=4 <c4,c3>=0

4 = 0 +0 + s3 4 +0 => S3 = 1
 CDMA: scalar product
• Reminder
Assume x and y are two vectors of N
components x=(x1,x2,…,xN) and y=(y1,y2,…,yN)
Scalar product: <x,y>=x1y1+x2y2+…+xNyN

Fundamental properties:
• <x,y+z>=<x,y>+<x,z>
• <x,ay>= <ax,y>= a<x,y>
• If x and y are orthogonal, <x,y>=0
 CDMA: scalar product
• E.g. Check that these 3 vectors are mutually
ortogonal (we will call them “codes”)
c1=<1,1,1,1>, c2=<1,-1,1,-1>, c3=<1,1,-1,-1>
• Try to find c4 which is ortogonal to c1, c2, and c3
(Note, as N=4, we cannot find more tan N mutually
orthogonal codes)
 Scalar product, trick
• Check that c4=(1,-1,-1,1) is a solution of the question
in previous slide
• Think on 4 numbers, a,b,c,d (restrict to values +1 or -
1, although the trick will work in general)
• Find now x=ac1+bc2+cc3+dc4
• For instance, if we choose a=1, b=-1, c=1, d=-1, we
have: x = 1c1+(-1)c2+1c3+(-1)c4 = c1-c2+c3-c4 =
(0,4,0,0)
• Question: how to find a,b,c and d if you only know x?
• E.g. find a,b,c, and d if x=(0,0,0,-4)
 Answer
If you can find a,b,c,and d solving a 4x4 linear system of
equation, but we can use a trick that makes things much easier:
find the scalar product between one of the codes and the
vector x:
x= ac1+bc2+cc3+dc4
<c1,x>=a<c1,c1>+b<c1,c2>+c<c1,c3>+d<c1,c4>=
a<c1,c1>+0+0+0= a<c1,c1>
e.g. x=(0,0,0,-4) => <c1,x>=-4, <c1,c1>=4 => a= -1

Correct! The same trick can be used to find b,c and d if we

multiply x by c2, c3 and c4. Check this, you should obtain b=1,
c=1, d=-1
 Rc (Chip rate)= number of chips/second = NxR
“chip”
CDMA a = -1
-1 -1 -1 -1

1 -1 1 -1
This trick can be used by a
b=1
base station in a multiaccess
channel, assuming it knows 1 1 -1 -1
the codes used by each user: c=1

-1 1 1 -1
d = -1
1 2
c1=(1,1,1,1)
c2=(1,-1,1,-1) 0 0 0 -4
Received signal
c4=(1,-1,-1,1)
3
c3=(1,1,-1,-1)
4
 CDMA fc
N N N
… … … time frequency
…
1 1 1
NxT Bwtot

Rtot= NxR = N(1/NxT)=1/T Bwtot=1/T

 Cellular networks:
Cellular networks standards
 Forecast global subscriptions

5G

4G

3G
2G

Source: https://www.ericsson.com/en/mobility-report/reports/
november-2019/mobile-subscriptions-outlook
Radio access
2G (GSM), 2.5 G (GPRS)
• FDMA + TDMA
• Voice: Frames of 8 time
slots/200 Khz
• GSM: Voice (13 Kbps)
• GPRS: Data (< 170 Kbps)
3G (UMTS), 3.5 G (HSPA)
• WCDMA
• Bw= 5 Mhz, Rchip =3.84 Mcps
• UMTS: R < 2/0.3 Mbps,
• HSDPA/HSUPA, R< 10/2.4 Mbps

Orthogonal
codes

Voice channel (GSM)

These networks (in special 3G) will probably be turned off during
the next years to free spectrum for 4G and 5G
 Transmission techniques and multiplexing
of users & channels
• Traffic Channel (U/D)
– Data from/to users: Traffic channel (TCH)
• Dedicated Control Channel (U/D)
– Signaling info specific for each user
• Common Control Channel (D)
– Signaling info common to all users in the cell
e.g. Access Grant Channel (AGCH)
• Paging Control Channel (D) Questions:
– Paging channel PCH, Signal new communication to • Multiplexing of
mobile
• Random Access Channel (U) channels for a
– Random Access channel to communicate with given user
network, RACH
• Broadcast Control Channel (D) • Multiplexing of
– Identifies cellular network, Network, BS id, users
synchronization, Broadcast Channel (BCCH), SCH,
FACCH, etc
 Channels

• Traffic channel (TCH, UD): user info

• Random Access channel (RACH, U), the user request
use of channel, (ALOHA)
• Access Grant channel (AGCH, D): The network assigns
channel to user
• Paging channel (PCH, D): The network signals the user
about a new call
• Broadcast Control Channel (BCCH, D, broadcast):
Identifies cellular network, Network, BS id, etc
 2G (GSM)
frequency Uplink

8 time slots frame

200 KHz Downlink

time
f0, Broadcast carrier
 2G (GSM)
Frequency
TCH, SACCH Downlink
8 time slots frame

SI
M

BCCH, SCH, FCCH, time f0, Broadcast carrier

PCH, AGCH

8 time slots frame

Frequency
Uplink

SI
M

TCH, SACCH
RACH
time
 2,5G (GPRS)
Uses Slotted ALOHA in the PRACH
channel in order to obtain
access to a PDTCH and send
one or more data packets

Packet (Radio Block)

Frequency
PDTCH, PACCH

PRACH

time
 2G/2.5G: Frequency reuse
Cell: Area covered
by a Base Station

Handover
 3G (UMTS)
• Europe: WCDMA (UMTS FDD)
• 1900-1980, 2100-2170 and 2110-2170 MHz
• Bw= 5 Mhz
• Chip Rate 3.84 Mcps
• Data rates: <= 2/0.3 Mbps
 3G (UMTS)
• Uses CDMA (same frequency & time, spreading code)
• Uplink and Downlink in different frequency bands
Physical channels:
Frequency same time, same
frequency, different
code

5 MHz Downlink
(e.g.)
10 ms time
 3G, spreading and scrambling codes
User data
X X X

Spreading Scrambling
~
Carrier
(per channel) (per user) (e.g. 2,1 GHz)

No frequency reuse!,
orthogonal scrambling codes
 3.5G (HSPA)
• New physical channel for high data rate
(10/2.4 Mbps)
– Higher order modulation (16-QAM)
– Fast scheduling (users with more favourable
channel conditions)
– Improved ARQ (soft and hybrid ARQ)

• HSDPA: Enhanced Downlink

• HSUPA: Enhanced Uplink
 4G (LTE)
• Increase cell capacity and user data rates
• Objectives: 100 Mbps(D), 50 Mbps (U), reduced
latency
• Larger and flexible frequency bands (e.g: Bw= 5,
10 or 20 MHz)
• OFDMA (DL), SC-FDMA (UL)
• Improve spectral efficiency:
– MIMO
– Scheduler to optimize transmission
Source: Fred Wright, Senior VP, Motorola, MWC’09,
 OFDMA

• Downlink channel in LTE uses OFDMA

• Long symbol times limits intersymbol interference
due to multipath
• Allows flexible utilization of frequency spectrum
• Increases spectral efficiency due to orthogonality
between sub-carriers
• Allow optimization od data rates for users by
transmitting on the sub-channels with lower
fading
 Problems with OFDMA
• The OFDMA signal has a high Peak to Average Power
Ratio (PAPR), meaning that the power amplifier
needs a high power consumption as it must be able
to amplify signals with high peaks

High PAPR
Signal amplitude Peak power

Power
Average power amplifier
time
 Problems with OFDMA
• In the uplink, the multiple carriers produced by
different phones are not perfectly alligned
(inestability in electronics, Doppler spread). Due to
this offset in carriers, there is some interference
among sub-channels.
Multiple carriers

frequency
 OFDMA and SC-FDMA
• Uplink transmission, and alternative technique called
Single Carrier- FDMA (SC-FDMA) is used.
• A number of adjacent subcarriers is allocated to each
user. The symbols are transmitted sequentially using
a single carrier per user
• The inter-symbol interference is solved by a more
complex receiver at the BS.
 OFDMA SC-FDMA
fc0 fc1 fc2 fc3 fc4 fc5 fc0 fc1 fc2

frequency frequency

fc5
fc2
fc4

fc3 fc1

fc2

fc1 fc0

fc0
time time
 OFDMA and SC-FDMA Less power
consumption

Downlink Uplink

More complex
receiver

OFDMA SC-FDMA

frequency frequency
Different users in the cell suffer
different multipath fading

frequency selective
multipath fading

frequency
 LTE PHY
frequency 1 ms

180 KHz 7 OFDM symbols

Resource Block
time
frequency

Sub-carrier,
15 KHz 12x Sub-carriers,
180 KHz
Resource
element
Subframe (2 slots), 1 ms
Frequency-selective fading
(different per user)
 RB scheduling
Scheduling of RBs is done on a subframe basis for both
the uplink (consecutive RBs for same user) and uplink
(non-consecutive RBs for user)
Downlink Uplink
frequency 1 ms frequency 1 ms

180 KHz

time time
Simultaneous transmission of Consequtive transmission of symbols
symbols with different sub-carriers with a single carrier frequencies
(OFDMA) (SC-FDMA)
Channels
BS
• Traffic Channel (U/D)
– Data from/to users
• Dedicated Control Channel (U/D)
– Signaling info specific for each user
• Common Control Channel (D)
– Signaling info common to all users in the cell
• Paging Control Channel (D)
– Signal new communication to mobile
• Random Access Channel (U)
– Random Access cannel to communicate with network
• Broadcast Control Channel (D)
– Identifies cellular network, Network, BS id, synchronization
Cellular networks:
Mobile Packet Core
 Roaming & Handovers
Location
Internet Register
Roaming:
(LR)
User changes its location
=> the system should be
informed of its current
location Base
Station
Handover: (BS)
User changes location
while engaged in a
conversation
User Equipment (UE)
 Roaming support
• The mobile node must know what it is its current
location (Discovery): Broadcast Channel, BCCH
• The mobile node must indicate so to the network
(Register)
– Use Location Areas in order to reduce the number of
register messages
• The data packets must reach current location of MS

HLR/VLR (2G, 3G)

HSS/MME (4G)
(3) How to reach Net
A
(1) Where am I?
host B?
(2) How can I register
B my location?
Mobile Packet
Core
• Session management
Establishing and managing information flow of a
particular service or application
• Mobility management
Track users as they move between cell site and
route traffic accordingly
• Security & privacy
Authentication, encryption and user provacy.
• Policy & charging
 2G/3G
architecture voice
MS
BTS
VLR
2G PSTN/
MSC GMSC RDSI
E-RAN BSC

UE Auc HLR EIR

NodeB
SGSN

SGSN Core Internet

UTRAN
RNC 3G
GGSN
data
 Mobile Switching Center (MSC)
2G/3G Serving/Gateway GPRS Support Node (SGSN/GGSN)
Home Location Register (HLR)
architecture Visitor Location Register (VLR)
Authentication Center (AuC)
MS
BTS
VLR
2G PSTN/
MSC GMSC RDSI
E-RAN BSC

UE Auc HLR EIR

NodeB
SGSN

SGSN Core Internet

UTRAN
RNC 3G
GGSN
4G: Evolved Packet Core
Elimination of the circuit-switching domain to create
an end-to-end packet network, providing required
QoS (VoIP).

MME HSS
UE eNodeB
SGW
IP
net Internet
E-UTRAN Voice network
SGW PGW
IP network: Data + Voice over LTE
4G: Evolved Packet Core
Serving Gateway (SGW) (SGSN)
Packet Data Network Gateway (PGW), (GGSN)
Mobility Management Entity (MME) (VLR)
Home Subscriber Server (HSS) (HLR, AuC)

MME HSS
UE eNodeB
SGW
IP
net Internet
E-UTRAN Voice network
SGW PGW
 4G: Evolved Packet Core
• Serving Gateway (SGW):
– Manage user-plane mobility
– SGW maintains data paths between eNodeBs and
the PDN Gateway (PGW).
 4G: Evolved Packet Core
• Packet Data Network Gateway (PGW):
– Interface towards the Internet. Anchor point for
sessions towards the external Internet.
– Policy enforcement features (resource allocation
and usage), Packet filtering (deep packet
inspection) , Charging support
 4G: Evolved Packet Core
• The Mobility Management Entity (MME):
– Performs the signaling and control functions to
support tracking, paging, roaming and handovers.
• The Home Subscriber Server (HSS):
– Performs the functions of the HLR (Home location
register) and the AuC (Authentication center)
 Cellular networks:
User-plane, EPS bearers
 4G: Evolved Packet Core
Signalling (Control-plane)
MME

UE eNodeB
IP SGW Internet
net Telephone
network
PGW
Voide+data (User-plane)
 LTE EPS bearers
UE
eNodeB SGW PGW Internet
IP IP
Voice net
net net

GTP GTP
PDCP
tunnel tunnel

• Packet Data Convergence Protocol (PDCP): IP header

compression, encryption
• GPRS tunneling protocol (GTP): tunneling of IP packets,
tunnel management
 LTE EPS bearers
UE
eNodeB SGW PGW Internet
IP IP
Voice net
net net

GTP GTP
PDCP
tunnel tunnel

• EPS bearers need to be established via signalling

(tunnel management) using GTP signalling packets
• Tunnels are reconfigured to support mobility (mobility
management)
• QoS with different latency, PER, etc (conversational
voice, video, RT gaming, TCP-data, etc,)
 LTE EPS bearers
UE
eNodeB SGW PGW Internet
IP IP
Voice net
net net

GTP GTP
PDCP
tunnel tunnel

IP UDP GTP IP Payload

@src= eNodeB TEID= Assigned to UE @src= UE (Carrier grade NAT)

@dst=SGW (e.g., 0x12345678) @dst=Server
 LTE EPS bearers
UE
eNodeB SGW PGW Internet
IP IP
Voice net
net net

GTP GTP
PDCP
tunnel tunnel

IP UDP GTP IP Payload

@src= SGW TEID= Assigned to UE @src= UE (Carrier grade NAT)

@dst=PGW (e.g., 0x12345678) @dst=Server
 UE’s view of the network

APN

PGW
IP subnet Internet
SIM

Firewall,
Carrier-grade NAT
 My phone…
• Sistema/Acerca del teléfono/estado
• Red: Tuenti
• Dirección IP: 100.67.42.10 (rango Carrier Grade-NAT)
• c:\adb\platform-tools_r27.0.1-windows\platform-tools>adb shell "ip
route show table 0“

default dev dummy0 table 1002 proto static scope link

default via 100.67.42.10 dev rmnet0 table 1003 proto static

local 100.67.42.10 dev rmnet0 table local proto kernel scope host src 100.67.42.10
broadcast 100.255.255.255 dev rmnet0 table local proto kernel scope link src 100.67.42.10

broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
 Cellular networks:
Signalling procedures. Mobility and
location management
 4G: Evolved Packet Core

Signalling (Control-plane) MME

HSS

UE eNodeB
IP Internet
net Telephone
SGW
network
PGW
Voide+data (User-plane)
 Signalling procedures
• Radio Resources Management
– Establish, modify, close Radio Session
– Handover (with/without change of SGW/MME)
• Mobility Management
– Attach/Deattach to/from network
– Tracking Area update
– Service request/Paging
• EPS bearer management
– Establish/modify/free EPS bearer
 Attach (Register in network)
(1) Listen to BCCH
(2) Use RACH to request use of a channel
(3) Use AGCH to grant use of a channel
(4) Attach request (userid)

(1)

(2) (3)
(4)
 Attach (Register in network)
(5) Authentication and key negotiation
(6) Update IMSI location, insert subscriber data
(7) Create default EPS bearer
(8) Attach accept
(6)
(5)

(8) (7)
 Authentication and key negotiation
(1) Attach request
(2) Obtain Authentication Vector (RAND, AUTN, XRES)
(3) Authentication request (RAND, AUTN). USIM verifies
AUTN (bidirectional authentication), and computes RES.
Derive keys.
(4) Authentication response (RES) => RES == XRES?
(2)
(1) (3)

(4)

Uses several integrity/

cyphering keys
 User initiated service request
(1) Use RACH to request use of a channel
(2) Use AGCH to grant use of a channel
(3) Service request
(4) Authentication and key negotiation
(5) Establishment request
(1) (2)
(4)
(3)
(5)
 Paging
(1) Data arrives from network
(2) Use PCH for paging user
(3) Random Access (RACH+AGCH)
(4) Authentication and key negotiation
(5) Establishment request + Data sent to UE
(3)
(4)

(5)
(2)
(1)
 Roaming & Handovers
Roaming: Internet
User changes its location MME/HSS
=> the system should be
PGW
informed of its current
location (Tracking area) EPS
SGW
bearer
eNodeB
Handover:
User changes location
Tracking
while engaged in a Area
conversation (change
eNodeB, SGW, and/or
MME) User Equipment (UE)
 Tracking Area Update
Tracking Area (3), (5)
(1) MME2
MME1 HSS
(2)
(6) (4)
S
I
M

UE
eNodeB SGW
PGW
(1) TA Update request
(2) Context request/response
(3) Update Location request
(4) Cancel Location, (5) Update Location ACK
(6) TAU accept
 Intra MME Handover
eNodeB2 MME1 HSS

S
I
M

(2,3)
UE
(1) eNodeB1 SGW
PGW
(1) UE takes measurements, and sends them to eNodeB1
(2) eNodeB1 requests HO to eNodeB2
(3) eNodeB2 HO request ACK, eNodeB1 sends packets
waiting to be sent to UE
 Intra MME Handover
(5) eNodeB2 (6) MME1 HSS

S
I
M

(2,3) (7)
UE
(1,4) eNodeB1 SGW
PGW
(4) eNodeB1 sends HO Command to UE
(5) UE sends HO confirm to eNodeB2
(6) eNodeB2 sends Path Request to MME
(7) MME modifies EPS bearer, eNodeB1 frees radio
resources
 Source: Virtual Operators in the mobile industry” T. Smura, A. Kiiski, H. Hammainen

Mobile Virtual Operators

Radio Intercom Switch+ Network Tariffing Customer Distribut Marketing

Access + roaming routing Services & billing Care

MNO Service Provider

MNO Mobile Virtual Network Operator

Mobile Virtual
MNO Service Provider
Network Operator