UNCLASSIFIED

UNCLASSIFIED

4G Small Cell Big Gains: Increased Cellular

Capacity in an LTE Environment (July 2015) Michael L. Pulos, Masters in Cyber Security Management

School of Engineering, Washington University St. Louis l.pulos@wustl.edu

ABSTRACT— With the volatile expansion in mobile data traffic,

small cell/femtocell is regarded as an effective enhancement to

mobile QoS and system capacity of existing cellular networks. I

give a detailed description behind deployment challenges,

including topics as radio interference, scalable security test bed

solutions, backhaul concerns, spectral efficiency guarantees,

scalability impacts and RF propagation control.

I. INTRODUCTION

The rapid proliferation of mobile devices has caused

a significant traffic increase on the wireless infrastructure

that originally was designed to support telephony

operations. This paradigm shift towards smartphones,

tablets, laptops, and IoT (Internet of Things) has caused a

distinct traffic expansion in mobile networks. This

data/traffic expansion has been growing at a rate that

exceeds current deployment capacity of the major carriers

in the United States. In 2014 the total smartphone

subscriptions grew to 2.8 billion [1]. According to the

report by

Cisco [2], smartphones generate 49 times larger

traffic, and tablets generate 127 times compared to

conventional feature phones. Moreover, application

consumption by the use of streaming video, music, P2P

file transfer, and cloud storage has added to the network

congestion in the current wireless infrastructure. The

“Internet of Things (IoT)” and new devices will continue

to increase data and network consumption in the future.

Japan is a great example of an over saturated wireless

network and a window into our very own future in the

United States. In Japan, yearly growth rate of traffic from

2011 to 2013 are about 2.2, 1.8 and 1.6-fold [3]. In

contrast, the United is not far behind; please see charts

below: Fig. 1-5

Fig. 1

Fig. 2

UNCLASSIFIED

UNCLASSIFIED

Fig. 3

Fig. 4

A new forecast from Ericsson suggest in its latest mobility

report that in the next three years by 2018, there would be 4.5

billion smartphone subscribers worldwide, with 6- percent of

world’s population covered by LTE (Long Term Evolution).

Other findings include the growth of video traffic by 60

percent annually and traffic volume will grow 12-fold [6].

Given the above statistical information, it is acceptable to

fathom that processing this much traffic/data with the scarce

wireless spectrum will become an increasingly challenging

issue in cellular networks [7].

According to Chandrasekhar et al. [8], more than 60% of

mobile voice traffic and 90% of mobile data traffic originate

in indoor environments. Moreover, for the sake of this

discussion I will use femtocell and small cell interchangeably.

We will focus more on Enterprise Deployment vice home use

but I will occasionally reference some of the home use

deployments as some of the methodology for deployment may

be the same. In general small cell service is provided by low

power, low cost, limited-coverage access points (AP), also

known as NodeB or eNodeB or eNodeB in 3GPP/LTE [9].

In the enterprise deployment, the use of small cells can be a

way to enhance current BYOD programs while providing

better signal quality and a more secure posture within your

workspace. Lastly, I will also touch on the following

concerns/topics of small cell implementation:

Deployment challenges of small cells in an existing IT

Infrastructure?

Deployment options of small cell architecture

Co-channel assignments of small cell and macro network

deployments

What are the interoperability concerns of small cells?

II. ASSUMPTIONS

Access control mechanism that mobile operators and

users are willing to adopt is crucial to the sustaining and

implementation of small cells. Corporate policies and

procedures will help solidify agreements between

employee and employer.

Deployment in the Enterprise will utilize a closed access

mode managed by corporate IT infrastructure.

Closed access mode is needed to insure QoS in the

corporate environment.

Because the licensed spectrum is limited, it is necessary to

implement co-channel assignment in small cell systems

[10].

Co-channel assignment needs to address the problems

caused by cross-tier

(macrocell with femtocell) interference and co-tier

(femtocell with femtocell) interference [11], [12].

Heterogeneous architectures based on nested tiers of more

and more dense small cells operating at higher and higher

frequencies are expected not only to improve the overall

area spectral efficiency of the cellular network but also to

increase coverage and user signal-to-interference-plus-

noise ratio (SINR) in most deployment scenarios [13].

Radio-Interface-Based Synchronization is paramount in

hand-off operations from Macrocell cell to small

cell/femtocell.

Firecycle Model and simulations will be used during

deployment, focusing on its capabilities and ability to

scale up simulations and to model itself over multiple

VMs in a corporate cloud environment.

Firecycle has been designed, implemented, and coded

from scratch using OPNET Modeler [14] as the

underlying platform and simulation engine. All the nodes

and elements of the model are custom coded and

assemble together to run as a network simulation on

OPNET. Set of libraries and definition files provide the

means to run the realistic traffic models.

III. CURRENT LTE DEPLOYEMENT SITUATION

To accommodate the increasing mobile traffic,

network upgrading from HSPA to LTE is one of the most

effective solutions for mobile operators. Compared to

HSPA, LTE can perform 10 times higher in transmission

rate, 3 times higher in spectrum efficiency, and

approximately 1/4 in transmit latency. World’s first LTE

service was launched by TeliaSonera on December 2009.

After that, as of September 17, 2014, more than 331 LTE

UNCLASSIFIED

UNCLASSIFIED

networks have been launched in 112 countries with

accommodating 280.4 million subscribers in the world

[5].

Fig. 6 HetNet structure of LTE-A [13]

Fig. 7 2014 Verizon 4G LTE Map

Fig. 8 2014 AT&T 4G LTE Map

Fig. 9 2014 Sprint 4G LTE Map

Fig. 10 Global LTE MAP

IV. SCALABLE SECURITY TEST BED FOR LARGE-

SCALE LTE DEPLOYMENTS

As most of us know cyber security research has grown in an

exponential rate over the last few years, resulting in many

successful mitigation strategies focused on threat elimination

and containment. In the wireless community the majority of

the work focused on the old GSM (Global System for Mobile

Communications) and UMTS (Universal Mobile

Telecommunications System). Today the LTE networks

UNCLASSIFIED

UNCLASSIFIED

remains behind the times in focused security research which

could combat potential breaches in the LTE networks if

additional research is done.

In the future the LTE landscape will encapsulate certain

critical applications with very strict security guidelines and

requirements. Moreover, the next generation EMS

(Emergency Response Systems) planned by the US

Department of Homeland Security: the Nationwide

Interoperable Public Safety Broadband Network [16]. LTE is

also considered as the underlying technology for advanced

military tactical networks [17].

Parallel to the capital security requirements of LTE

networks, the cyber security backdrop has substantially

advanced over the last few years. In the age of massive DDoS

attacks, Botnet armies for hire, mobile malware and fraud and

the advent of the Advanced Persistent Threat, the importance

of enhancing the security of LTE networks against security

attacks is clear [18]. During the implementation of small cells

at the enterprise level there will need to be extensive security

testing and simulations to offer the benefits of off-loading

traffic from the local macro tower to the corporate owned

small cell providing enhanced security awareness/posture.

The enterprise can gain many benefits from integrating Firecycle modeler methodologies into the current enterprise

architecture and is required in order to maintain a heighten

security posture. Firecycle would be an added item that would

be utilized during standard deployments/upgrades of

infrastructure, transport, application upgrades and would

follow the engineering V in the lifecycle of the project.

Firecycle is designed and built to be compliant with LTE/3PP

utilizing a standard test bed framework. Please see figure (a)

and (b):

(a)

Fig. 11 (b)

Firecycle will be used to assess the impact of large-scale

security attacks against the enterprise LTE and small cell

corporate environment. Statistical data from the modeling

simulations will analyze QoS, load, frequency, and time

occurrence of simulated attack vectors. Quantitative statistical

analysis will help the CSO and CISO determine applicable

corporate security posture for the enterprise environment.

V. ACCESS AND HAND-OFFS

As discussed before in this deployment, access will utilize

a Closed Mode method.

Before a device transmits a signal of its own and during the

power on/up, a small cell base station searches for a primary

and secondary synchronization signal (PSSs/SSSs) of a

neighbor cell (on the downlink) [13]. Once detected, the base

station obtains the ID and timing of the neighboring cell. The

cell uses the acquired neighbor cell ID to determine the CRS

waveform of the cell, and use the timing to locate the cell

synchronization sub-frames where the cell synchronization

signal is present. This procedure is repeated until the small cell

finds the timing source with the lowest stratum. The

synchronization stratum for this cell is then determined based

on the detected source cell stratum, and its CRS signal is

transmitted on the corresponding radio frame determined by

its stratum. In addition to performing routine periodic

synchronization, once in a while, a small cell has to repeat the

UNCLASSIFIED

UNCLASSIFIED

above procedure to detect whether any change occurs that may

impact its own stratum [13]. For the deployment in the

enterprise the synchronization signal (CRS) will be established

near the immediate vicinity of the corporate building. The

corporate enterprise management office will negotiate with the

local carrier to establish cell radio boundaries to insure the

QoS and minimal radio interference if possible. This

arrangement will be crucial for successful hand-offs when

entering the corporate environment. It is possible to entertain a

hybrid access mode but was omitted due to security liability

and is not recommended in an enterprise deployment.

Fig. 12 a) Illustration of multi-hop synchronization in a small cell network,

where cells M and Q are macrocells, and cells A to K are small cells. A small

cell always looks for and synchronizes to the cell with the lowest stratum level

within its detection range. In this example, cell K neighbors cell E, cell H, and cell D. It synchronizes to cell E that has the lowest stratum (2) in its range.

Cell K thus has a synchronization stratum 3 derived from cell E. The arrow in

the diagram indicates where the synchronization source from which a small cell receives its synchronization signals; b) illustration of unsynchronized

cells in multi-hop synchronization due to the limit of the maximum number of

synchronization hops. In this example, the maximum number of synchronization hops per synchronization chain is three, which leaves cell D

unsynchronized; that is; cell D is not able to synchronize to the required

accuracy [13].

Fig. 13 Macrocell Coverage and Congestion

VI. IMPLEMENTATION

In the design of Wireless Mesh Networks (WMN) for

small cell/femtocell, radio interference, spectral

efficiency, RF propagation control and backhaul concerns

pose the most challenging items when integrating small

cell technology into the corporate enterprise environment.

Another consideration is the cost and reliability which can

dictate network topology. The integration into existing IT

infrastructure will have to also take into account the

lifecycle of the current architecture. Some technologies

may not integrate so well into aging and outdated

infrastructure.

We can assume the use of the above methodologies

and a couple of WMN optimization formulas indicated in

this paper will increase the success rate during

implementation and reduce costs during deployment. The

use of spanning tree (MST) and shortest path (TSP) will

provide a reliable backhaul infrastructure to integrate into

the existing network topology of the corporate enterprise.

The following algorithms will be used to evaluate

network topology and efficiency: Prim’s Algorithm

(Minimum Spanning Tree), Floyd Algorithm (Shortest

Path). The aforementioned algorithms have very fast

reproduction velocity and state-of-the-art principles when

dealing with mesh network in total cost, delay or latency,

accessibility and outages [19].

The deployment options for small cell architecture is

limited; however, during the implementation and design

phases of the project radio interference, spectral

efficiency guaranties and RF propagation controls should

be establish with the local carrier/provider. The enterprise

carrier will insure de-confliction of radio signals and

proper RF propagation within the local area of the

corporate environment /building. If de-confliction cannot

be agreed upon with the carrier proper shielding/radio

jamming equipment can be deployed to protect the

corporate interest. This equipment will not be authorized

to effective EMS signals and must comply with FCC

regulations and guidelines. Co- channel assignment of

small cell and macro network cell deployments in the area

with is orchestrated in conjunction with the local carrier

and the organic corporate IT Department. This marriage

between the two organizations will also entertain all

interoperability concerns. Below are diagrams/charts for

additional considerations during implementation.

UNCLASSIFIED

UNCLASSIFIED

Fig. 14 Macrocell, Femtocells (Small Cell), and Picocell

Synchronization

Fig. 15 3GPP standard schedule for LTE/LTE-A[4]

VII. CONCLUSION

With the rapid expansion of mobile data traffic and the

need to have secure wireless transmissions in the corporate

environment, the use of small cell technology is an attractive

solution for an enterprise environment. When implementing

and engineering a solution for the corporate environment

many things need to be taken into consideration radio

interference, spectral efficiencies, RF propagation and scalable

security test bed solutions are a must before integration into

the current corporate IT infrastructure. Additional, concerns

need to address existing IT infrastructure to ensure capability

with existing 4G LTE technologies and the possibility of 5G

future wireless technologies. In conclusion, the

aforementioned algorithms and software/hardware deployment

methodologies can be used for solid bases to be incorporated

into a deployment strategy for an enterprise solution.

UNCLASSIFIED

UNCLASSIFIED

REFERENCES

[1] Ericsson: “Ericsson Mobility Report,” June 2014.

[2] Cisco: “Cisco Visual Networking Index: Global Mobile

Data Traffic Forecast Update, 2013-2018,” Cisco white paper,

Feb. 2014.

[3] MIC Japan: “The present status of mobile communication

traffic in Japan,”

http://www.soumu.go.jp/johotsusintokei/field/tsuushin06.html

(Japanese), June 2014.

[4] Hidetoshi KAYAMA and Huiling JIANG DOCOMO

Beijing Communications Laboratories Co. “Evolution of LTE

and new Radio Access Technologies for FRA (Future Radio

Access)” Ltd. 7/F, Raycom Infotech Park Tower A, No.2,

Kexueyuan South Road, Beijing, 100190, P. R. China

[5] GSA: “Global LTE network deployments, 331

commercially launched in 112 countries,”

http://www.gsacom.com/downloads/pdf/LTE_World_map_33

1_LTE_networks_launched_170914.php4, Sep. 2014.

[6] http://i2mag.com/ericsson-4-5-billion-smartphone-

subscribers-worldwide-by-2018/

[7] D. Kilper, G. Atkinson, S. Korotky, S. Goyal, P. Vetter, D.

Suvakovic, and O. Blume, “Power trends in communication

networks,” IEEE J.Sel. Topics Quantum Electron., vol. 17, no.

2, pp. 275–284, Mar. 2011.

[8] V. Chandrasekhar, J. G. Andrews, and A. Gatherer,

“Femtocell networks: a survey,” IEEE Commun. Mag., vol. 46,

no. 9, pp. 59–67, Sep. 2008.

[9] Evolved Universal Terrestrial Radio Access (E-UTRA) and

Evolved Universal Terrestrial Radio Access Network (E-

UTRAN); Overall description, 3GPP TS 36.300, 2008.

[10] J.S. Lin, and K.T. Feng, “Game Theoretical Model and

Existence of Win-Win Situation for Femtocell Networks,”

IEEE ICC,

[11] G. de la Roche, A. Valcarce, D. Lopez-Perez, and J. Zhang,

“Access control mechanisms for femtocells,” IEEE Commun.

Mag.,vol. 48, no. 1, pp. 33–39, Jan. 2010.

[12] D. Lopez-Perez , A. Valcarce , G. De La Roche , J. Zhang,

“OFDMA Femtocells:A Roadmap on Interference Avoidance,”

IEEE Commun. Mag., vol. 47, no. 9, pp. 41–48, Sep. 2009.

[13] Kingsley Jun Zou, Kristo Wenjie Yang, Mao Wang,

Bingyin Ren, Jingsong Hu, Jingjing Zhang, Min Hua, and

Xaohu You, “Network Synchronization for Dense Small Cell

Networks, IEEE Wireless Communications, April 2015.

[14] “OPNET Modeler,” http://goo.gl/oCMo0b, Jun. 2011.

[15] Jill Jermyn, Roger Piqueras Jover, Mikhail Istomin and

Ilona Murynets ∗Department of Computer Science, Columbia

University, New York, NY †AT&T Security Research Center,

NewYork,NY∗jill@cs.columbia.edu,{roger.jover,mikhail.isto

min,ilona}@att.com, “Firecycle: A scalable test bed for large-

scale LTE security research”

[16] “Nationwide Public Safety Broadband Network,” US

Department of Homeland Security: Office of Emergency

Communications, June 2012, http://goo.gl/AoF41.

[17] A. Thompson, “Army examines feasibility of integrating

4G LTE with tactical network,” The Official Homepage of the

United States Army, 2012, http://goo.gl/F60YNA.

[18]R. Piqueras Jover, “Security Attacks Against the

Availability of LTEMobility Networks: Overview and

Research Directions,” in IEEE GlobalWireless Summit -

Wireless Personal Multimedia Communications Symposium

(GWS - WPMC), Atlantic City, NJ, June 2013.

[19] E. W. Weisstein,"Floyd Warshall Algorithm." From Math

World—A Wolfram Web Resource,

http://mathworld.wolfram.com/Floyd-WarshallAlgorithm.html