Wireless Communication Protocols and Technologies

Wireless Communication Protocols and Technologies by Tatiana Madsen & Hans Peter Schwefel • Mm1 Introduction. Wireless LANs (TKM) • Mm2 Wireless Personal Area Networks and Bluetooth (TKM) • Mm3 IP Mobility Support (HPS) • Mm4 Ad hoc Networks (TKM) • Mm5 Overview of GSM, GPRS, UMTS (HPS) www.kom.auc.dk/~tatiana/ www.kom.auc.dk/~hps/

Geographic region subdivided in radio cells • Base Station provides radio connectivity to Mobile Station within cell • Handover to neighbouring base station when necessary • Base Stations connected by some networking infrastructure Intro: Cellular systems

1200 1000 GSM total 800 TDMA total CDMA total 600 PDC total Subscribers [million] Analogue total Total wireless 400 Prediction (1998) 200 0 year 1996 1997 1998 1999 2000 2001 2002 Cellular systems: technologies & subscribers

Introduction • Cellular Concepts & Technologies • GSM • Network Architecture, Air Interface • Signalling/Call Setup, Mobility Support • Data Services, HSCSD • GPRS & UMTS • GPRS: Architecture, Air-Interface, Core-Network Modifications • UMTS domains and architecture • IP transport in Packet Switched UMTS/GPRS Networks • PDP contexts, APNs, TFTs • Bearers • ’full’ network architecture Exercise Content

2nd Generation of Mobile Telephony Networks • 1982: Groupe Spèciale Mobile (GSM) founded • 1987: First Standards defined • 1991: Global System for Mobile Communication, Standardisation by ETSI (European Telecommunications Standardisation Institute) - First European Standard • 1995: Fully in Operation • Deployed in more than 184 countries in Asia, Africa, Europe, Australia, America) • more than 747 million subscribers • more than 70% of all digital mobile phones use GSM • over 10 billion SMS per month in Germany, > 360 billion/year worldwide GSM: Global System for Mobile Communication History: Today:

Components: BTS: Base Transceiver Station BSC: Base Station Controller MSC: Mobile Switching Center HLR/VLR: Home/Visitor Location Register AuC: Authentication Center EIR: Equipment Identity Register OMC: Operation and Maintenance Center Transmission: Circuit switched transfer Radio link capacity: 9.6 kb/s (FDMA/TDMA) Duration based charging Network and Operation Radio Subsystem (RSS) Switchung Subsystem Subsystem Base StationSubsystem U A A m bis VLR MS BTS BSC HLR AuC O MS BTS OMC BSC MSC EIR MS Connection to BTS ISDN, PDN PSTN Radio Link GSM – Architecture

‘Traditional’ voice services • voice telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz • emergency numbercommon number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible) • Multinumberingseveral ISDN phone numbers per user possible • voice mailbox (implemented in the fixed network supporting the mobile terminals) • Supplementary services, e.g.: identification, call forwarding, number suppression, conferencing ‘Non-Voice’ Services (examples) • Fax Transmissions • electronic mail (MHS, Message Handling System, implemented in the fixed network) • Short Message Service (SMS)alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS GSM Services

GSM: Radio Technology Cellular Concept: • segmentation of geographical area into cells • Cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc. • hexagonal shape of cells is idealized (cells overlap, shapes depend on geography) • use of several carrier frequencies • avoid same frequency in adjoining cells • if a mobile user changes cells handover of the connection to the neighbor cell cell possible radio coverage of the cell idealized shape of the cell

GSM: Air Interface I Frequency Division Multiple Access (FDMA) • Separate up-link (MTBTS) and down-link (BTSMT) traffic • Two 25MHZ bands • Distinguish 124 adjacent channels within each band • Each channel 200kHz Radio Network Planning: • Determine location of BTS • Determine number of TRX per BTS • Multiple transceivers (TRX) per BTS (e.g. 1,4 ,or 12) simultaneous use of different FDMA channels • Assign subsets of 124 channels to BTSs

GSM: Air Interface II TDMA Frame Time Division Multiple Access (TDMA) • Within each channel: sequence of TDMA frames • TDMA frames subdivided into 8 time-sots

GSM: TDMA hierarchy of frames hyperframe 0 1 2 ... 2045 2046 2047 3 h 28 min 53.76 s superframe 0 1 2 ... 48 49 50 6.12 s 0 1 ... 24 25 multiframe 0 1 ... 24 25 120 ms 0 1 2 ... 48 49 50 235.4 ms frame 0 1 ... 6 7 4.615 ms slot burst 577 µs

higher GSM frame structures 4.615 ms 546.5 µs 577 µs GSM Air Interface: Combination of TDMA & FDMA 935-960 MHz 124 channels (200 kHz) downlink frequency 890-915 MHz 124 channels (200 kHz) uplink time GSM TDMA frame 5 7 8 1 2 4 6 3 GSM time-slot (normal burst) guard space guard space S user data tail tail user data S Training 1 3 1 57 bits 3 bits 57 bits 26 bits

BTS comprises radio specific functions • BSC is the switching center for radio channels Functionalities in Radio Subsystem

Overview: GSM protocol layers for signaling Um Abis A MS BTS BSC MSC CM CM MM MM RR’ BTSM BSSAP RR BSSAP RR’ BTSM SS7 SS7 LAPDm LAPDm LAPD LAPD radio radio PCM PCM PCM PCM 16/64 kbit/s 64 kbit/s / 2.048 Mbit/s

calling a GSM subscriber forwarding call to GMSC signal call setup to HLR 5. request MSRN from VLR 6. forward responsible MSC to GMSC 7. forward call to current MSC 8, 9. get current status of MS 10, 11. paging of MS 12, 13. MS answers 14, 15. security checks 16, 17. set up connection PSTN Example: Mobile Terminated Call 4 HLR VLR 5 8 9 3 6 14 15 7 calling station GMSC MSC 1 2 10 13 10 10 16 BSS BSS BSS 11 11 11 11 12 17 MS

Example: Message flow between MS and BTS for Mobile Terminated Call MS MTC BTS paging request channel request immediate assignment paging response authentication request authentication response ciphering command ciphering complete setup call confirmed assignment command assignment complete alerting connect connect acknowledge data/speech exchange

Mobility Support I: Types of handover 1 4 3 2 MS MS MS MS BTS BTS BTS BTS BSC BSC BSC MSC MSC

Mobility Support II: Handover decision receive level BTSold receive level BTSold HO_MARGIN MS MS BTSold BTSnew

Mobility support III: Handover procedure MSC MS BTSold BSCold BSCnew BTSnew measurement report measurement result HO decision HO required HO request resource allocation ch. activation ch. activation ack HO request ack HO command HO command HO command HO access Link establishment HO complete HO complete clear command clear command clear complete clear complete

Subscriptions worldwide (millions) 1800 Mobile Subscribers Mobile Fixed Mobile Internet Fixed Internet 1600 1400 1200 1000 Mobile Internet Subscribers 800 600 400 200 0 1995 2000 2005 2010 Mobile Communication & Data Traffic • The future Internet will mainly be accessed by mobile devices

Data transmission standardized with only 9.6 kbit/s • advanced coding allows 14,4 kbit/s • not enough for Internet and multimedia applications • HSCSD (High-Speed Circuit Switched Data) • mainly software update • bundling of several time-slots to get higher AIUR (Air Interface User Rate)(e.g., 57.6 kbit/s using 4 slots, 14.4 each) • advantage: ready to use, constant quality, simple • disadvantage: channels blocked for voice transmission Data services in GSM

Packet Switched Extension of GSM • 1996: new standard developed by ETSI • Components integrated in GSM architecture • Improvements: • Packet-switched transmission • Higher transmission rates on radio link (multiple time-slots) • Volume based charging  ‚Always ON‘ mode possible • Operation started in 2001 (Germany) GPRS: General Packet Radio Service

Components: CCU: Channel Coding Unit PCU: Packet Control Unit SGSN: Serving GPRS Support Node GGSN: Gateway GPRS Support Node GR: GPRS Register Transmission: Packet Based Transmission Radio link: Radio transmission identical to GSM Different coding schemes (CS1-4) Use of Multiple Time Slots Volume Based Charging GPRS - Architecture

13,4 kbit/s 13,4 kbit/s 13,4 kbit/s 15,6 kbit/s 15,6 kbit/s 15,6 kbit/s 21,4 kbit/s 21,4 kbit/s 21,4 kbit/s 9,05 kbit/s 9,05 kbit/s 9,05 kbit/s 9,05 kbit/s GPRS: Channel Coding and Multiplexing ..... Time Slot (MS-> BTS) 1 2 3 8 Coding Scheme 1 ..... Selection of Codingdepending on qualityof radio connection Coding Scheme 2 ..... Coding Scheme 3 ..... ‚optimal‘ radio quality: no interference, etc. Coding Scheme 4 ..... Overall transmission rate 72.4.......171,2 kbit/s

Examples for GPRS device classes

GPRS user data rates in kbit/s

SGSN Gn PDN MS BSS SGSN GGSN Um Gb Gn Gi HLR/ GR MSC VLR EIR GPRS architecture and interfaces

GPRS Core Network Functions

RLC: Radio Link Control • Acknowledged mode (reliable) or unacked • LLC: Logical Link Control • Acknowledged mode (reliable) or unacked • BSSGRP: BSS GPRS Protocol GPRS: Protocol Stack • SNDCP: Sub-Network Dependent Convergence Protocol • GTP: GPRS Tunneling Protocol • Mobility Support

Data Units in GPRS

SGSN HLR Attach Complete (NSAPI,TI,PDP Type) Attach Request (NSAPI,TI,PDP Type) Authentication/Ciphering Insert Subscriber Data Ack (NSAPI,TI,PDP Type) Attach Accept (NSAPI,TI,PDP Type) Insert Subscriber Data (NSAPI,TI,PDP Type) GPRS: Obtaining IP Connectivity • GPRS attach • Authentication of MS • Establishment/Initialization of security functions • PDP Context Setup • Obtain IP address • Connect to ‚external‘ network [see later] BSS Gr Um Gb Authentication/Ciphering

48 kbit/s 48 kbit/s 48 kbit/s Enhanced Data rates for the GSM Evolution (EDGE) .... Time Slot (MS-> BTS) 1 2 8 Transmission Rate New Modulation Scheme 8 PSK .... 48.......384 kbit/s • Advantages • Increased Data Rate • No Modificatíons in Core Network (SGSN/GGSN) required • Disadvantages • New Modulationscheme(8 PSK), not compatible to GSMK • HW Changes in the BTS required

Proposals for IMT-2000 (International Mobile Telecommunications) • UWC-136, cdma2000, WP-CDMA • UMTS (Universal Mobile Telecommunications System) from ETSI • Frequencies 3rd Generation Systems: IMT-2000 1850 1900 1950 2000 2050 2100 2150 2200 MHz ITU allocation (WRC 1992) IMT-2000 MSS  IMT-2000 MSS  GSM 1800 DE CT T D D UTRA FDD  MSS  T D D UTRA FDD  MSS  Europe GSM 1800 IMT-2000 MSS  IMT-2000 MSS  China PHS cdma2000 W-CDMA MSS  cdma2000 W-CDMA MSS  Japan PCS MSS  rsv. MSS  North America MHz 1850 1900 1950 2000 2050 2100 2150 2200

Currently standardized by 3rd Generation Partnership Project (3GPP), see http://www.3GPP.org[North America: 3GPP2] • So far, four releases: R’99, R4, R5, R6 Modifications: • New methods & protocols on radio link  increased access bandwidth • Coexistence of two domains in the core network • Packets Switched (PS) • Circuit Switched (CS) • New Services • IP Service Infrastructure: IP Based Multimedia Subsystems (IMS) (R5) Universal Mobile Telecommunication System (UMTS)

UMTS Domains

Radio Access Network • Node B (Base station) • Radio Network Controller (RNC) • Mobile Core Network • Serving GPRS Support Node (SGSN) • Gateway GPRS Support Node (GGSN) • Mobile Switching Center (MSC) • Home/Visited Location Register (HLR/VLR) • Routers/Switches, DNS Server, DHCP Server, Radius Server, NTP Server, Firewalls/VPN Gateways • Application/Services • IP-Based Multimedia Subsystem (IMS) • [see 9th Semester] • Operation, Administration & Maintenance (OAM) • Charging Network • [Legal Interception] UMTS Network Domains

UMTS Radio Access Network (UTRAN): architecture • CDMA (Code Division Multiple Access) on Radio Link • transmission rate theoretically up to 2Mbit/s (realistic up to 300kb/s)

User IP (v4 or v6) Application Server UTRAN SGSN GGSN Terminal Radio Bearer GTP-U GTP-U Transport of IP packets IP tackets are tunnelled through the UMTS/GPRS network (GTP – GPRS tunneling protocol) Application IP v4 or v6 IP v4 or v6 IP v4 or v6 Relay Relay PDCP PDCP GTP‑U GTP‑U GTP‑U GTP‑U RLC RLC UDP/IP v4 or v6 UDP/IP v4 or v6 UDP/IP v4 or v6 UDP/IP v4 or v6 MAC MAC AAL5 AAL5 L2 L2 L2 [Source: 3GPP] L1 L1 L1 ATM ATM L1 L1 Uu Iu-PS Gn Gi

IP Transport: Concepts • PDP contexts (Packet Data Protocol) activation • done by UE before data transmission • specification of APN and traffic parameters • GGSN delivers IP address to UE • set-up of bearers and mobility contexts in SGSN and GGSN • activation of multiple PDP contexts possible • Access Point Names (APN) • APNs identify external networks (logical Gi interfaces of GGSN) • At PDP context activation, the SGSN performs a DNS query to find out the GGSN(s) serving the APN requested by the terminal. • The DNS response contains a list of GGSN addresses from which the SGSN selects one address in a round-robin fashion (for this APN). • Traffic Flow Templates (TFTs) • set of packet filters (source address, subnet mask, destination port range, source port range, SPI, TOS (IPv4), Traffic Class (v6), Flow Label (v6) • used by GGSN to assign IP packets from external networks to proper PDP context • GPRS tunneling protocol (GTP) • For every UE, one GTP-C tunnel is established for signalling and a number of GTP-U tunnels, one per PDP context (i.e. session), are established for user traffic.

PDP Context X1 (APN X, IP address X, QoS1) PDP Context X2 (APN X, IP address X, QoS2) GGSN GGSN SGSN Terminal IP Transport: PDP Context & APNs ISP X PDP Context Y (APN Y, IP address Y, QoS) PDP Context Z (APN Z, IP address Z, QoS) Same PDP (IP) address and APN ISP Y APN X PDP Context selectionbased on TFT (downstream) ISP Z APN Y APN Z [Source: 3GPP]

UMTS Data Transport: Bearer Hierarchy Air Interface CN TE MT UTRAN/ CN Iu TE/AS GERAN Gateway EDGE NODE End-to-End Service(IP Bearer Service) TE/MT Local External Bearer UMTS Bearer Service UMTS Bearer Bearer Service Service Service CN Bearer Radio Access Bearer Service Service Radio Bearer Iu Bearer Backbone Service Service Bearer Service Physical Physical Radio Bearer Service Service 3G GGSN RAN 3G SGSN User Equipment

Roaming Support: • UE attaches with SGSN in visited network • PDP context is set-up to GGSN in home network (via Gp interface, GRX network) The ’full picture’ of the UMTS packet switched domain

Message Flow: PDP Context Setup … …

Introduction • Cellular Concepts & Technologies • GSM • Network Architecture, Air Interface • Signalling/Call Setup, Mobility Support • Data Services, HSCSD • GPRS & UMTS • GPRS: Architecture, Air-Interface, Core-Network Modifications • UMTS domains and architecture • IP transport in Packet Switched UMTS/GPRS Networks • PDP contexts, APNs, TFTs • Bearers • ’full’ network architecture Exercise Summary

Lecture notes: Mobile Communciations, Jochen Schiller, www.jochenschiller.de • Marco Hoffmann, Master Thesis, ‘Simulation of a flow-control algorithm between two nodes of the GPRS network’, TU Munich and Siemens AG, 2001. • Tutorial: IP Technology in 3rd Generation mobile networks, Siemens AG (J. Kross, L. Smith, H. Schwefel) • Various 3GPP Presentations. www.3gpp.org • J. Schiller: ’Mobile Communications’. Addison-Wesley, 2000. • GPRS books: • T. Halonen, J. Romero, J. Melero: ‘GSM, GRPS, EDGE Performance: Evolution towards 3G/UMTS’, Wiley, 2003 Acknowledgements/References

Data Rates: A user wants to do an FTP download of a 8MB Power-Point Presentation. Compute the duration of this download for the following access technologies • GSM data service • HSCSD, 4 timeslots • GPRS, 4 timeslots (downlink) • EDGE, 8 timeslots • Wired ISDN access (64kbit/s) Give at least two reasons why the actual download times are likely to be longer than the ones just computed. Charging: The operator charges in GSM 15cent/min, in GPRS 0.1cent/kB. Compare the costs of the GSM and GPRS download in the FTP case as well as for a Web-session with duration of 1hour and overall data volume of 150kB. • IP transport in GPRS networks: a mobile user has set-up a PDP context to an ISP which has assigned him the IP address 10.10.123.45 (private). The user now iniates a web access to the CNN server. Describe the path of the IP packet through the mobile operator’s network, showing the header structure of the packet (detailling the IP source and destination address). Exercises:

Wireless Communication Protocols and Technologies