controlplane +protocol+interac.ons+ in+cellular+networks+ghtu/sigcomm14-slide.pdf · circuit...
TRANSCRIPT
![Page 1: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/1.jpg)
Control-‐Plane Protocol Interac.ons in Cellular Networks
Guan-‐Hua Tu*1, Yuanjie Li*1, Chunyi Peng 2, Chi-‐Yu Li 1, Hongyi Wang 1, Songwu Lu 1
* The first two authors contribute equally to this work.
1: University of California, Los Angeles; 2: The Ohio State University
![Page 2: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/2.jpg)
Cellular Services are Ubiquitous
¨ Large-‐scale wireless infrastructure ¨ Offer data and voice services to anyone, anywhere, any+me
2
Source: hGp://www.4gamericas.org/
6.8+ billion
![Page 3: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/3.jpg)
Cellular Network Architecture 3
3G Gateways 3G Base stations
Mobile Switching Center
Circuit Switching (CS)
Packet Switching (PS)
3G (PS + CS)
Mobility Management Entity (Control Node)
4G (PS only)
![Page 4: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/4.jpg)
Control Plane in Cellular Network
Radio Resource Control (RRC)
Mobility Management (MM)
Connec.vity Management (CM)
4
3G Gateways
Mobile Switching Center
Circuit Switching (CS)
Packet Switching (PS)
3G
Mobility Management Entity (Control Node)
4G
¨ Layered protocol stack
![Page 5: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/5.jpg)
Control Plane in Cellular Network 5
3G Gateways
Mobile Switching Center
Circuit Switching (CS)
Packet Switching (PS)
3G
Mobility Management Entity (Control Node)
4G
Radio Resource Control (RRC)
CS Domain
MM
CM
PS Domain
MM
CM
¨ Layered protocol stack ¨ Domains separated for voice (CS) and data (PS)
![Page 6: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/6.jpg)
Control Plane in Cellular Network 6
3G Gateways
Mobile Switching Center
Circuit Switching (CS)
Packet Switching (PS)
3G
Mobility Management Entity (Control Node)
4G
Radio Resource Control (RRC)
CS Domain
MM
CM
PS Domain
MM
CM
PS Domain
MM
CM
RRC
4G 3G
¨ Layered protocol stack ¨ Domains separated for voice (CS) and data (PS)
¨ Hybrid 3G/4G systems
![Page 7: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/7.jpg)
Complex Interactions
¨ Protocols work together to offer vital 3G/4G uTliTes ¨ Rich paGerns along three dimensions
7
Radio Resource Control
MM
CM
PS Domain
MM
CM
PS Domain
MM
CM
RRC
CS Domain
3G 4G
cross-layer
cross-domain cross-system
![Page 8: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/8.jpg)
Complex Interactions
¨ Protocols work together to offer vital 3G/4G uTliTes ¨ Rich paGerns along three dimensions
8
Radio Resource Control
MM
CM
PS Domain
MM
CM
PS Domain
MM
CM
RRC
CS Domain
3G 4G
cross-layer
cross-domain cross-system
Problem: Each individual protocol may be well designed.
How about protocol interacTons?
![Page 9: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/9.jpg)
Rich Protocol Interactions
¨ Complex interacTons in common scenarios ¤ Inevitable interplay between radio, mobility, data/voice ¤ Concurrent voice and data use ¤ 3G/4G switch due to hybrid deployment, mobility, voice
¨ Two causes of problemaTc interacTons ¤ Design defects ¤ Operation/Implementation slips
9
3G Gateways
MSC
Circuit Switching (CS)
Packet Switching (PS)
3G
MME
4G
![Page 10: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/10.jpg)
Rich Protocol Interactions
¨ Complex interacTons in common scenarios ¤ Inevitable interplay between radio, mobility, data/voice ¤ Concurrent voice and data use ¤ 3G/4G switch due to hybrid deployment, mobility, voice
¨ Two causes of problemaTc interacTons ¤ Design defects ¤ Operation/Implementation slips
10
3G Gateways
MSC
Circuit Switching (CS)
Packet Switching (PS)
3G
MME
4G
Diagnosis over one layer/domain/system is insufficient
Single-‐type test fails to unveil both issues
Closed Core Network
![Page 11: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/11.jpg)
Our SoluTon: CNetVerifier
¨ Cellular-‐specific model checking ¤ Extract full-stack cellular model from 3GPP standards ¤ Create a variety of usage scenarios ¤ Define desirable user-perspective properties ¤ Discover counterexamples for possible design defects
11
Model Checker
Violated property Counterexamples
Protocol Stacks
Usage Se[ngs
Desirable ProperTes
![Page 12: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/12.jpg)
Our SoluTon: CNetVerifier
¨ Cellular-‐specific model checking ¨ Phone-‐based experimental validaTon
¤ Instrument end devices to collect traces for verification ¤ Discover operational slips in real networks
12
Model Checker
Violated property Counterexamples
Protocol Stacks
Usage Se[ngs
Desirable ProperTes
Scenario Setup
Opera.onal slips
Design Flaws “Black-‐box”
![Page 13: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/13.jpg)
Finding Overview 13
II. Independent operaTons
I. Necessary cooperaTon
![Page 14: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/14.jpg)
Finding Overview 14
cross-layer cross-domain cross-system
II. Independent operaTons
I. Necessary cooperaTon
![Page 15: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/15.jpg)
Improper coopera.on: Cross-‐System
¨ Scenario: run data services during 4Gà3Gà4G 15
1. Setup 4G connecTvity to access internet
RRC MM CM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
þ
4G
4G Conn. Context
131.179.176.1
![Page 16: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/16.jpg)
Improper coopera.on: Cross-‐System
¨ Scenario: run data services during 4Gà3Gà4G 16
3G
1. Setup 4G connecTvity to access internet 2. 4Gà3G: 4G conn. context is converted to 3G for seamless switch
RRC MM CM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
þ
4G
3G Conn. Context
131.179.176.1
![Page 17: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/17.jpg)
Improper coopera.on: Cross-‐System
¨ Scenario: run data services during 4Gà3Gà4G 17
3G
1. Setup 4G connecTvity to access internet 2. 4Gà3G: 4G conn. context is converted to 3G for seamless switch
RRC MM CM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
þ
4G
4G Conn. Context
131.179.176.1
3. 3Gà4G: 3G conn. context is converted back to 4G
![Page 18: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/18.jpg)
¨ ProblemaTc scenario: 3G context is deleted before returning to 4G
18
3G
1. 3G conn. context is deleted.
þ
4G
3G Conn. Context
131.179.176.1 Causes of dele.on (in 3GPP)
¤ Low layer failures ¤ User disables data services ¤ No enough resources ¤ ….
Improper coopera.on: Cross-‐System How and why?
![Page 19: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/19.jpg)
¨ ProblemaTc scenario: 3G context is deleted before returning to 4G
19
3G
1. 3G conn. context is deleted.
þ
4G
3G Conn. Context
131.179.176.1
2. 3G-‐>4G: No 3G context transferred to 4G context
“Out-‐of-‐Service”
Improper coopera.on: Cross-‐System How and why?
![Page 20: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/20.jpg)
¨ ProblemaTc scenario: 3G context is deleted before returning to 4G
20
3G
1. 3G conn. context is deleted.
þ
4G
3G Conn. Context
131.179.176.1
2. 3G-‐>4G: No 3G context transferred to 4G context
“Out-‐of-‐Service”
PS conn context is not mandatory in 3G (PS+CS), but mandatory in 4G (PS only)
Shared context for 4G and 3G is not well protected in 3G
Improper coopera.on: Cross-‐System How and why?
![Page 21: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/21.jpg)
¨ Real-‐world impact ¤ Occurs 3.1% in user study ¤ “out-of-service” for up to 25s
¨ Lessons: a design defect ¤ Different demands of packet switching in 3G & 4G ¤ Desirable but not enforced: shared context should be
consistently protected in 4G & 3G
¨ Proposed remedies ¤ Avoid unnecessary 3G PS context deactivation ¤ Immediately enable 4G PS context reactivation
21
þ Improper coopera.on: Cross-‐System
![Page 22: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/22.jpg)
¨ Scenario: 4G users make calls via 3G CS Fallback 22
1. To make a call, 4G user à3G
þ þ
RRC MM CM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
4G
3G
Improper coopera.on: cross-‐domain+system
![Page 23: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/23.jpg)
¨ Scenario: 4G users make calls via 3G CS Fallback 23
1. To make a call, 4G user à3G
þ
2. When the call ends, 3Gà4G
þ
RRC MM CM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
4G
3G
Improper coopera.on: cross-‐domain+system
![Page 24: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/24.jpg)
¨ ProblemaTc Scenario: Call with background data 24
1. A call makes 4G à 3G; Data is migrated to 3G, too
þ þ
4G
3G
Improper coopera.on: cross-‐domain+system
How and Why?
![Page 25: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/25.jpg)
¨ ProblemaTc Scenario: Call with background data 25
1. A call makes 4G à 3G; Data is migrated to 3G, too
þ
2. When the call ends, No 3Gà4G (data is sTll on)
þ
4G
3G
User gets stuck in 3G, losing 4G.
Improper coopera.on: cross-‐domain+system
How and Why?
![Page 26: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/26.jpg)
Improper coopera.on: cross-‐domain+system
How and Why?
¨ Unexpected loop in RRC state machine 26
þ þ
User gets stuck in 3G, losing 4G.
RRC
3G PS 3G CS
RRC
4G PS
CONN-‐ED
IDLE
CONN-‐ED
IDLE Voice only
![Page 27: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/27.jpg)
Improper coopera.on: cross-‐domain+system
How and Why?
¨ Unexpected loop in RRC state machine 27
þ þ
User gets stuck in 3G, losing 4G.
RRC
3G PS 3G CS
RRC
4G PS
CONN-‐ED
IDLE
CONN-‐ED
IDLE
Voice + Data (certain seZng)
![Page 28: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/28.jpg)
Improper coopera.on: cross-‐domain+system
How and Why?
¨ Unexpected loop in RRC state machine 28
þ þ
User gets stuck in 3G, losing 4G.
RRC
3G PS 3G CS
RRC
4G PS
CONN-‐ED
IDLE
CONN-‐ED
IDLE
Voice + Data (certain seZng)
RRC state transiTon is inconsistent with dual-‐domain, inter-‐system se[ngs
![Page 29: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/29.jpg)
¨ Real-‐world impact ¤ 62.1% 4G users being stuck in 3G afer the call ¤ Stuck in 3G for 39.6s in average
¨ Lessons: a design defect ¤ 3G CS and 3G PS are indirectly coupled in RRC ¤ Inconsistent state transition with all 3Gà4G options
¨ Proposed remedies ¤ Revise the RRC state transition for possible settings
29
þ þ Improper coopera.on: cross-‐domain+system
![Page 30: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/30.jpg)
30
þ
¨ Problem Scenario: Signaling loss for registraTon
MM
3G PS
MM CM
3G CS 4G PS
CM
RRC
CM MM RRC
Improper coopera.on: Cross-‐Layer How and why?
Attach request
Attach accept Attach complete
Deregistered Deregistered
Registered Registered Deregistered
![Page 31: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/31.jpg)
31
þ
¨ Problem Scenario: Signaling loss for registraTon
Attach complete
Location update Location update response (error)
MM
3G PS
MM CM
3G CS 4G PS
CM
RRC
CM MM RRC
Improper coopera.on: Cross-‐Layer How and why?
Attach request
Attach accept
Deregistered Deregistered
Registered Registered Deregistered
“out-‐of-‐service” right afer being aGached
Deregistered
![Page 32: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/32.jpg)
32
þ
¨ Problem Scenario: Signaling loss for registraTon
Attach complete
Location update Location update response (error)
MM
3G PS
MM CM
3G CS 4G PS
CM
RRC
CM MM RRC
Improper coopera.on: Cross-‐Layer How and why?
Attach request
Attach accept
Attach complete
Deregistered Deregistered
Registered Registered Deregistered
“out-‐of-‐service” right afer being aGached
Deregistered
Upper-‐layer (MM) assumes underlying reliable in-‐sequence signal transfer, but lower-‐layer (RRC)
cannot offer this guarantee
![Page 33: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/33.jpg)
33
MSC
¨ Scenario: voice/data request with locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
1. LocaTon update is triggered by MM (e.g., user moves)
Unnecessary Coupling: Cross-‐layer þ
![Page 34: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/34.jpg)
34
MSC
¨ Scenario: voice/data request with locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
1. LocaTon update is triggered by MM (e.g., user moves) 2. Afer locaTon update, user can send/receive voice and data
Unnecessary Coupling: Cross-‐layer þ
Dial out
![Page 35: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/35.jpg)
35
3G Gateways 3G Base stations
MSC
¨ ProblemaTc Scenario: voice/data request during the locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
2. User dials out 1. LocaTon is triggered by MM (e.g., user moves)
þ Unnecessary Coupling: Cross-‐layer
How and why?
![Page 36: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/36.jpg)
36
3G Gateways 3G Base stations
MSC
¨ ProblemaTc Scenario: voice/data request during the locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
2. User dials out
Dial out
Outgoing call is delayed
“Updating the location”
þ Unnecessary Coupling: Cross-‐layer
How and why?
![Page 37: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/37.jpg)
37
3G Gateways 3G Base stations
MSC
¨ ProblemaTc Scenario: voice/data request during the locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
2. User dials out
Dial out
Outgoing call is delayed
1. LocaTon is triggered by MM (e.g., user moves)
“Updating the location”
“Without user loca+on, the cellular network cannot route user voice/data.”
þ Unnecessary Coupling: Cross-‐layer
How and why?
![Page 38: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/38.jpg)
38
3G Gateways 3G Base stations
MSC
¨ ProblemaTc Scenario: voice/data request during the locaTon update
RRC MM CM
MM CM
3G-‐CS
MM CM
RRC
3G-‐PS 4G-‐PS
Location Update
2. User dials out
Dial out
Outgoing call is delayed
1. LocaTon is triggered by MM (e.g., user moves)
“Updating the location”
“Without user loca+on, the cellular network cannot route user voice/data.”
Outgoing voice/data requests can be routed without user locaTon
Unnecessary prioriTzaTon of locaTon update over outgoing call/data
þ Unnecessary Coupling: Cross-‐layer
How and why?
![Page 39: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/39.jpg)
¨ Real-‐world Impact ¤ up to 8.3s call delay and 4.1s data delay ¤ 7.6% of outgoing calls occur during locaTon update
¨ Lessons: a design defect ¤ outgoing data/voice requests and location update are
independent, but they are artificially correlated ¨ Proposed remedies
¤ Decouple location update and outgoing data/voice requests
¤ E.g., two parallel MM threads for different purposes
39
þ Unnecessary Coupling: Cross-‐layer
![Page 40: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/40.jpg)
MM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
CM
RRC
¨ Scenario: dial a call during data service in 3G 40
Circuit Switching (CS)
Packet Switching (PS)
3G 10Mbps 10Mbps
1. Access internet at full rate 2. Dials a call
þ Unnecessary Coupling: Cross-‐domain
![Page 41: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/41.jpg)
MM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
CM
RRC
¨ Scenario: dial a call during data service in 3G 41
Circuit Switching (CS)
Packet Switching (PS)
3G 2.5Mbps 2.5Mbps
12.2Kbps
12.2Kbps
1. Access internet at full rate 2. Dials a call
Data service rate declines up to 74%
þ Unnecessary Coupling: Cross-‐domain
![Page 42: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/42.jpg)
MM
3G PS
MM CM
3G CS
MM CM
RRC
4G PS
CM
RRC
¨ Scenario: dial a call during data service in 3G 42
Circuit Switching (CS)
Packet Switching (PS)
3G 12.2Kbps
12.2Kbps
1. Access internet at full rate 2. Dials a call
Data service rate declines up to 74% Voice and data have compeTng demands on the channel, but they have to share the radio channel
þ Unnecessary Coupling: Cross-‐domain
Voice: low rate, low loss (e.g., 16QAM) Data: high rate, loss tolerant (e.g., 64QAM)
2.5Mbps 2.5Mbps
![Page 43: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/43.jpg)
¨ Scenario: LocaTon update in 3G and 4G 43
3G
3G PS
MM CM
3G CS
CM
RRC
4G PS
CM
RRC MM MM
4G
þ Unnecessary Coupling: Cross-‐system
1. Update 4G locaTon, and noTfy 3G MSC
![Page 44: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/44.jpg)
¨ Scenario: LocaTon update in 3G and 4G 44
3G
3G PS
MM CM
3G CS
CM
RRC
4G PS
CM
RRC MM MM
4G
þ Unnecessary Coupling: Cross-‐system
2. 3G locaTon update fails, so 4G deregisters the network
Detach
MSC unavailable
![Page 45: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/45.jpg)
¨ Scenario: LocaTon update in 3G and 4G 45
3G
3G PS
MM CM
3G CS
CM
RRC
4G PS
CM
RRC MM MM
4G
þ Unnecessary Coupling: Cross-‐system
2. 3G locaTon update fails, so 4G deregisters the network
Detach
MSC unavailable
3G internal failures are exposed to 4G devices
![Page 46: ControlPlane +Protocol+Interac.ons+ in+Cellular+Networks+ghtu/sigcomm14-slide.pdf · Circuit Switching (CS) Packet Switching (PS) 3G MME 4G . Rich Protocol Interactions ! Complex!interacTons!in!common!scenarios!!](https://reader031.vdocuments.site/reader031/viewer/2022030506/5ab46f487f8b9a1a048bd9c8/html5/thumbnails/46.jpg)
Conclusion
¨ Uncover problems in signaling protocol interacTons in cellular networks
¨ Three Lessons ¤ The layering rule should be fully honored (optimistic
assumptions, coupled actions) ¤ Inter-domain difference should be well recognized
(coupling independent services) ¤ Hybrid systems are not properly coordinated (context
sharing, fault isolation) ¨ More rigorous efforts are needed
46