Professional Documents
Culture Documents
VLR
BTS
MS
GMSC
BSC
HLR
PCU
AuC
SGSN
EIR
BTS
IP
Backbone
GGSN
database
Internet
PSTN, ISDN
MSC
Iu CS
BS
UE
MSC
GMSC
VLR
HLR
Iur
Uu
Iub
RNC
BS
Iu PS
AuC
SGSN
EIR
Gn
IP
Backbone
GGSN
database
Internet
PSTN
Iub
RNC
BS
UE
Iur
Uu
Iub
BS
RNC
2G => 3G
MS => UE
(User Equipment), often
also called (user) terminal
New air (radio) interface
based on WCDMA access
technology
New RAN architecture
(Iur interface is available
for soft handover,
BSC => RNC)
MSC is upgraded to
3G MSC
MSC
GMSC
VLR
SGSN is upgraded to
3G SGSN
GMSC and GGSN
remain the same
AuC is upgraded
(more security
features in 3G)
HLR
Iu PS
AuC
SGSN
EIR
Gn
IP
Backbone
GGSN
Internet
PSTN
MGW
SGW
MGW
PS core as in Rel.99
PSTN
SGW
GMSC
Server
MSC
Server
RANAP / ISUP
SS7
MTP
IP
Sigtran
MGW
SGW
MGW
PS core as in Rel.99
PSTN
SGW
GMSC
Server
MGW
New core
network part:
IMS (IP
Multimedia
System)
SGSN
HSS
GGSN
PS core
Internet
GERAN
(GSM and EDGE
Radio Access
Network)
CS core
PSTN
UTRAN
(UMTS Terrestrial
Radio Access
Network)
MGW
IMS (IP
Multimedia
System)
SGSN
HSS
GGSN
PS core
Call/session control
using SIP (Session
Initiating Protocol)
CS core
PSTN
MT
UTRAN
CN Iu
edge node
UE
CN
gateway
TE
Core network
End-to-end service
Local b.s.
Radio Bearer
Iu b.s.
Ext. b.s.
CN b.s.
Backbone
What is a bearer?
Bearer: a bearer capability of defined capacity, delay
and bit error rate, etc. (as defined in 3GPP specs.)
Bearer is a flexible concept designating some kind of
bit pipe
at a certain network level (see previous slide)
between certain network entities
with certain QoS attributes, capacity, and traffic
flow characteristics
Four UMTS QoS Classes
Streaming
Interactive
Background
low delay
reasonably low
delay
low round-trip
delay
delay is not
critical
low delay
variation
speech
video
telephony/
conferencing
video streaming
audio streaming
www
applications
basic
applications
store-andforward
applications
(e-mail, SMS)
file transfer
Streaming
Interactive
Background
<=>
During the call,
the AMR bit rate
can be changed,
using the values
at the right
<=>
Codec negotiation
between transcoders
kbit/s
12.2 (= GSM EFR)
10.2
7.95
7.40 (= US TDMA)
6.70 (= PDC EFR)
5.90
EFR = Enhanced
5.15
Full Rate
4.75
Transcoding
UE
MSC
TC
GMSC
User B
(e.g. in PSTN)
Streaming
Interactive
Background
UE
Source
Buffer
Streaming
Interactive
Background
Streaming
Interactive
Background
UMTS protocols
Different protocol stacks for user and control plane
User plane (for transport of user data):
Circuit switched domain: data within bit pipes
Packet switched domain: protocols for implementing
various QoS or traffic engineering mechanisms
Control plane (for signalling):
Circuit switched domain: SS7 based (in core network)
Packet switched domain: IP based (in core network)
Radio access network: UTRAN protocols
Iu
Data streams
RLC
RLC
MAC
MAC
Phys.
Phys.
Gn
AAL2
AAL2
ATM
ATM
Phys.
Phys.
TDM
TDM
WCDMA
UE
UTRAN
3G MSC
GMSC
Uu
Iu
PDCP
PDCP
RLC
RLC
MAC
MAC
Phys.
Phys.
Gn
IP
GTP
GTP
GTP
GTP
UDP
UDP
UDP
UDP
IP
IP
IP
IP
AAL5
AAL5
ATM
ATM
L2
L2
Phys.
Phys.
L1
L1
WCDMA
UE
UTRAN
SGSN
GGSN
L3
RRC
PDCP
Signalling
radio bearers
L2
(User plane)
radio bearers
RLC
Logical channels
MAC
Transport channels
L1
PHY
Control Plane
User Plane
Application
Protocol
Data
Stream(s)
Transport
Network
Layer
Transport Netw.
User Plane
Transport Netw.
Control Plane
Transport Netw.
User Plane
Protocol
Signalling
Bearer(s)
Signalling
Bearer(s)
Physical Layer
Data
Bearer(s)
Control Plane
RRC
Data
RLC
NBAP
MAC
Frame Protocol
Transport
Network
Layer
Transport Netw.
User Plane
Convergence
Protocols
AAL 5
Transport Netw.
Control Plane
Transport Netw.
User Plane
Q.2630.1
Conv. Pr.
AAL 5
ATM
Physical Layer
AAL 2
Control Plane
RRC
Data
RLC
RNSAP
MAC
Frame Protocol
Transport
Network
Layer
Transport Netw.
User Plane
Convergence
Protocols
AAL 5
Transport Netw.
Control Plane
Transport Netw.
User Plane
Q.2630.1
Conv. Pr.
AAL 5
ATM
Physical Layer
AAL 2
Control Plane
User Plane
RANAP
CS Channel
Iu UP
Transport
Network
Layer
Transport Netw.
User Plane
Convergence
Protocols
AAL 5
Transport Netw.
Control Plane
Transport Netw.
User Plane
Q.2630.1
Conv. Pr.
AAL 5
ATM
Physical Layer
AAL 2
Control Plane
User Plane
RANAP
IP Application
Iu UP
Transport
Network
Layer
Transport Netw.
User Plane
Transport Netw.
Control Plane
GTP
UDP
Convergence
Protocols
IP
AAL 5
AAL 5
ATM
Physical Layer
Iub
UE
RNC
Iur
BS
Iub
Iu
Core
network
RNC
DRNC
Iub
UE
RNC
Iu
Core
network
Iur
BS
Iub
RNC
Iu
DRNC
SRNC
Leg 1
UE
Leg 3
BS
Iub
BS
Leg 2
BS
Iub
RNC
Iur
RNC
DRNC
Iu
Core
network
Signal
combining
point is in
SRNC
(downlink:
in UE)
Iub
RNC
Iu
Core
network
Iur
UE
Rake
receiver
Multipath
propagation
Iub
RNC
DRNC
Macrodiversity
combining point
in SRNC
BS
BS
RNC
Core network
(RANAP signaling)
RAB assignment request
(RRC signaling)
RAB assignment complete
RANAP
RRC
UE
BS
RNC
MSC or
SGSN
Security in UMTS
GSM
UMTS
SIM authentication
(PIN code)
USIM authentication
(PIN code)
User authentication
User authentication
Network authentication
Authentication
Authentication: Procedure of verifying the authenticity
of an entity (user, terminal, network, network element).
In other words, is the entity the one it claims to be?
SIM authentication is local (network is not involved)
In GSM, only user is authenticated
In UMTS, both user and network are authenticated
User/network is authenticated at the beginning of
each user-network transaction (e.g. location updating
or connection set-up) and always before ciphering
starts.
See Security in GSM
for more details
Integrity
Data integrity: The property that data has not been
altered in an unauthorised manner.
Man-in-the-middle security attack, e.g. false BS
Data integrity checking is not done in GSM
In UMTS, signalling messages are appended with a
32 bit security field (MAC-I) at the terminal or RNC
before transmission and checked at the receiving end
In UMTS, also volume of user data (not the user data
itself) is integrity protected
MAC-I generation
UE
MAC-I checking
Algorithm f 9
MAC-I
MAC-I checking
RNC
MAC-I generation
Confidentiality
Confidentiality: The property that information is not
made available to unauthorised individuals, entities or
processes.
Example 1: Ciphering (encryption) over the air interface
Example 2: Preventing unencrypted transmission of
user ID information such as IMSI number over the air
interface
=> Temporary Mobile Subscriber Identity (TMSI) is
generated (at the end of each MM or CM transaction)
and is used at the beginning of the next transaction
instead of IMSI.
BTS
BSC
Core Network
GPRS
MS
BTS
BSC
SGSN
UMTS
UE
BS
Air interface
RNC
Core Network
Integrity
WCDMA Technology
just some basic issues
RLC
RLC
Logical channels
MAC
MAC
Transport channels
Phy
WCDMA
Phy
Physical channels
UE
FP
FP
AAL 2
AAL 2
Base station
RNC
Downlink
DCCH
PCCH
DTCH
BCCH
CCCH
CTCH
Logical channels
DCCH
DTCH
Transport channels
RACH
CPCH
DCH
PCH
BCH
FACH
DSCH
DCH
CPCH
Downlink
PCH
FACH
BCH
DSCH
DCH
Transport channels
PRACH
PCPCH
AICH
CSICH
PICH
CD/CAICH
SCCPCH
PCCPCH
Physical channels
CPICH
SCH
DCH
PDSCH
DPDCH
DPCCH
DPCH
QPSK modulation,
time multiplexed data and control information:
2560 chips
TFCI
Data
TPC
Data
Pilot
14
10 ms radio frame
Data
Pilot
TFCI
FBI
TPC
DPCCH (Q-branch)
0
14
10 ms radio frame (38400 chips)
Spreading in WCDMA
Channelization
code
Channel
data
Channel
bit rate
Usage of code
Chip rate
Chip rate
(always 3.84 million chips/s)
Uplink
Channelization code
Scrambling code
Scrambling
code
Downlink
User separation
User separation
Cell separation
Spreading in WCDMA
Chip rate after spreading = 3.84 Mchips/s
Spreading factor (SF) is important in WCDMA
Chip rate = SF x channel bit rate
Uplink: DPCCH SF = 256, DPDCH SF = 4 - 256
Downlink: DPCH SF = 4 - 256 (512)
One bit consists
of 4 chips
256
15
approx. 7.5
128
30
approx. 15
64
60
approx. 30
32
120
approx. 60
16
240
approx. 120
480
approx. 240
960
approx. 480
512
15
approx. 1-3
256
30
approx. 6-12
128
60
approx. 20-24
64
120
approx. 45
32
240
approx. 105
16
480
approx. 215
960
approx. 456
1920
approx. 936
Interesting
for user
Channel coding
Interleaving
Bit rate matching
Channel bit rate (kb/s)
Important
for system
Content provider
Content provider
Service provider
Service provider
Carrier provider
End user
End user
all want to
make profit
API
3G network
API
API =
Application
Programming
Interface
(Standardised)
CAMEL Phase 1
Circuit switched call-related IN procedures
Protocol: CAP instead of MAP
2.
SCP in home
network (CSE)
3.
4.
SSP
1.
MSC
5.
Typical
triggers:
Calling number
Called number
Cell ID
CAMEL Phase 2
Non-call-related procedures possible
1. Call control proceeds as normal
2. Call control is interrupted
(e.g. for announcement)
3. Call control resumes
Typical
application:
In prepaid service:
announcement
your prepaid
account is
approaching zero
CAMEL Phase 3
IN functionality is extended to include packet switched
sessions...
Home PLMN
Visited PLMN
UE
Certain subscriber
profile
Same subscriber
profile
Location
Positioning
SAT
UE
SMS
MMS
USSD
USAT
WAP
MExE
i-Mode
Transport
&
Content
UE
MSC
GMSC
PSTN
LCS External
Client
RNC &
SMLC
GMLC
BS
HLR/AuC/EIR
LMU
SGSN
GGSN
Internet
Positioning methods
Cell ID based location information
- no expensive positioning solutions required
- inexpensive (and will
therefore be widely used)
SMLC
BS
UE
LMU
BS
BS
Assisted GPS
- greatest precision, GPS receiver in UE
- network must assist in indoor environment
ME
SIM
MExE
Mobile Execution Environment (MExE) provides
standardized application execution environments for
UE, defined in classmarks:
MExE Classmark 1
MExE Classmark 2
MExE Classmark 3
UE is J2ME compatible
:
see: www.mexeforum.org
Micro Edition
Standard
Edition
USSD
182 ASCII characters (max)
in all GSM terminals
connection oriented
transactions (small delay)
transport of technical data
terminal or application in
network initiates session
not much used (yet)
MMS
MMS = Multimedia Messaging System
Offers the possibility to send messages to/from MMS
capable handsets comprising a combination of
- text
- sounds
- images
- video
GPRS or 3G packet domain can be used for transport.
When combined with LCS information and IN (CAMEL)
features, interesting new services can be implemented.
2G/3G
networ
k
WML
WAP protocols
2G/3G transport
WAP
Gateway
WML / HTML
translation
Internet
Server
WML / HTML
/ XML content
UE
2G/3G
networ
k
CAMEL
(CSE)
See:
Kaaranen et al:
UMTS Networks
WAP
Gateway
Internet
Server
GMLC
MExE
Example, Step 1
By use of his/her WAP browser in the UE, user contacts
(via WAP Gateway) the Internet Server containing
relevant information.
CAMEL
(CSE)
UE
WAP
browser
2G/3G
networ
k
WAP
Gateway
Internet
Server
GMLC
MExE
Example, Step 2
The 2G/3G network retrieves subscription information
(e.g. state of prepaid account) from the users CSE
(Camel Service Environment).
UE
2G/3G
networ
k
CAMEL
(CSE)
Charging
info
WAP
Gateway
Internet
Server
GMLC
MExE
Example, Step 3
Internet Server acts as a LCS client and requests the
2G/3G network to investigate where the user is located.
CAMEL
(CSE)
UE
2G/3G
networ
k
Where is UE located?
WAP
Gateway
Internet
Server
GMLC
MExE
Example, Step 4
The MExE compatible Internet Server prepares the
information according to the MExE capabilities of UE
(in this case MExE Classmark 1: WAP).
CAMEL
(CSE)
UE
2G/3G
networ
k
WAP
Gateway
GMLC
What can UE
display?
Internet
Server
MExE
Example, Step 5
Now the local restaurants information is downloaded to
the user and displayed in the appropriate form.
Menu on display:
Restaurant
Restaurant
Restaurant
Restaurant
UE
CAMEL
(CSE)
1
2
3
4
2G/3G
networ
k
WAP
Gateway
Internet
Server
GMLC
MExE
Books:
Kaaranen et al., UMTS Networks: Architecture, Mobility and
Services, Wiley, 2001, ISBN 0-471-48654-X
Korhonen, Introduction to 3G Mobile Communications, Artech
House, 2001, ISBN 1-58053-287-X
Web material:
e-learning course Introduction to 3G contains audio and
flash animations (you need loudspeakers; access to course
only within the HUT computer network)
http://130.233.158.46/eopetus/intro3g/start.htm
Required course material