intro: cellular systems - department of electronic systems

Hans Peter SchwefelWireless Networks II, Lecture 1, Spring 05

Wireless Networks II: Performance & Cross-Layer Aspects

by Hans Peter Schwefel

• Mm1 Cellular Networks: GSM, GPRS, and UMTS

• Mm2 Network Performance: Methodology

• Mm3 Quality of Service, content & header compression

• Mm4 Security aspects of wireless networks

• Mm5 Reliability aspects

www.kom.auc.dk/~hps/WirelessNetworksII_Sp05/

Page 2 Hans Peter SchwefelWireless Networks II, Lecture 1, Spring 05

Intro: Cellular systems

• Geographic region subdivided in radio cells

• Base Station provides radio connectivity to Mobile Station within cell

• Handover to neighbouring base station when necessary

• Base Stations connected by some networking infrastructure


Cellular systems: technologies & subscribers

0

200

400

600

800

1000

1200

1996 1997 1998 1999 2000 2001 2002 year

Subs

crib

ers

[mill

ion] GSM total

TDMA totalCDMA totalPDC totalAnalogue totalTotal wirelessPrediction (1998)


Content

1. Introduction• Cellular Concepts & Technologies

2. GSM• Network Architecture, Air Interface• Signalling/Call Setup, Mobility Support• Data Services, HSCSD

3. GPRS & UMTS• GPRS: Architecture, Air-Interface, Core-Network Modifications• UMTS domains and architecture

4. IP transport in Packet Switched UMTS/GPRS Networks• PDP contexts, APNs, TFTs• Bearers• ’full’ network architecture

Exercise


GSM: Global System for Mobile Communication

• 2nd Generation of Mobile Telephony Networks• 1982: Groupe Spèciale Mobile (GSM) founded• 1987: First Standards defined• 1991: Global System for Mobile Communication,

Standardisation by ETSI (European Telecommunications Standardisation Institute) - First European Standard

• 1995: Fully in Operation

• Deployed in more than 184 countries in Asia, Africa, Europe, Australia, America)

• more than 747 million subscribers• more than 70% of all digital mobile phones use GSM• over 10 billion SMS per month in Germany, > 360 billion/year

worldwide

History:

Today:


GSM – Architecture

Components:• BTS: Base Transceiver Station• BSC: Base Station Controller• MSC: Mobile Switching Center• HLR/VLR: Home/Visitor Location

Register• AuC: Authentication Center• EIR: Equipment Identity Register• OMC: Operation and

Maintenance Center

Transmission: • Circuit switched transfer• Radio link capacity: 9.6 kb/s

(FDMA/TDMA)• Duration based charging

BSC

BSC

MS

BTS

BTS

BTS

MS

MS

MSC

HLR

VLR

OMC

EIR

AuC

O

Abis AUm

Radio Link

Base StationSubsystem

Network andSwitchung Subsystem

OperationSubsystem

Connection toISDN, PDNPSTN

Radio Subsystem (RSS)


GSM Services‘Traditional’ voice services

– voice telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz

– emergency numbercommon number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible)

– Multinumberingseveral ISDN phone numbers per user possible

– voice mailbox (implemented in the fixed network supporting the mobile terminals)– Supplementary services, e.g.: identification, call forwarding, number suppression,

conferencing

‘Non-Voice’ Services (examples)• Fax Transmissions• electronic mail (MHS, Message Handling System, implemented in the fixed network)• Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS


possible radio coverage of the cell

idealized shape of the cell

cell

GSM: Radio TechnologyCellular Concept:• segmentation of geographical area into cells

– Cell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc.

– hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)

• use of several carrier frequencies– avoid same frequency in adjoining cells

• if a mobile user changes cellshandover of the connection to the neighbor cell


1 2 3 124

890 915Uplink Downlink

MHz 935 960

Kanäle:

200 kHz

Frequenzband derMobilstation

Frequenzband derBasisstation

GSM: Air Interface IFrequency Division Multiple Access (FDMA)• Separate up-link (MT BTS) and down-link (BTS MT) traffic

– Two 25MHZ bands • Distinguish 124 adjacent channels within each band

– Each channel 200kHz

Radio Network Planning:• Determine location of BTS• Determine number of TRX per BTS

– Multiple transceivers (TRX) per BTS (e.g. 1,4 ,or 12)simultaneous use of different FDMA channels

• Assign subsets of 124 channels to BTSs


0 1 2 3 4 5 6 7

4,615 ms

data bits data bitstraining

57 26 57

time slot:

3 tail bits 3 tail bits1 togglebit

1 togglebit

burst 148 bit

time slot 156,25 bit

0,577 ms

GSM: Air Interface IITime Division Multiple

Access (TDMA)• Within each channel: sequence

of TDMA frames• TDMA frames subdivided into

8 time-slots

TDMA Frame


GSM: TDMA hierarchy of frames0 1 2 2045 2046 2047...

hyperframe

0 1 2 48 49 50...

0 1 24 25...

superframe

0 1 24 25...

0 1 2 48 49 50...

0 1 6 7...

multiframe

frame

burstslot

577 µs

4.615 ms

120 ms

235.4 ms

6.12 s

3 h 28 min 53.76 s


1 2 3 4 5 6 7 8

higher GSM frame structures

935-960 MHz124 channels (200 kHz)downlink

890-915 MHz124 channels (200 kHz)uplink

frequ

ency

time

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3

GSM Air Interface: Combination of TDMA & FDMA


GSM: Logical Channels


Functionalities in Radio Subsystem• BTS comprises radio specific functions• BSC is the switching center for radio channels

Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X


Overview: GSM protocol layers for signaling

CM

MM

RR

MM

LAPDm

radio

LAPDm

radio

LAPD

PCM

RR’ BTSM

CM

LAPD

PCM

RR’BTSM

16/64 kbit/s

Um Abis A

SS7

PCM

SS7

PCM

64 kbit/s /2.048 Mbit/s

MS BTS BSC MSC

BSSAP BSSAP

• Layer 1, Um: Radio– Creation & multiplexing of bursts, synchronisation,

modulation, en/decryption, channel coding, error detection/correction

• LAPDm: variant ofLink Access Procedure for the D-Channel• RR: Radio Resource Management• BTSM: BTS Management

• MM: Mobility Management• CM: Call Management:

– Call control– Short Message Service (SDCCH, SACCH)– Supplementary service

• PCM: Pulse Code Modulation


Example: Mobile Terminated Call1. calling a GSM subscriber2. forwarding call to GMSC3. signal call setup to HLR4. 5. request MSRN from VLR6. forward responsible

MSC to GMSC7. forward call to current MSC8, 9. get current status of MS10, 11. paging of MS12, 13. MS answers14, 15. security checks16, 17. set up connection

PSTNcallingstation GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

45

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17


Example: Message flow between MS and BTS for Mobile Terminated Call

BTSMS

paging request

channel request

immediate assignment

paging responseauthentication request

authentication response

ciphering command

ciphering complete

setupcall confirmed

assignment command

assignment complete

alerting

connectconnect acknowledge

data/speech exchange

MTC


Mobility Support I: Types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

1

23 4


Mobility Support II: Handover decisionreceive level

BTSold

receive levelBTSold

MS MS

HO_MARGIN

BTSold BTSnew


Mobility support III: Handover procedure

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMS

measurementreport

HO decisionHO required

BTSnew

HO request

resource allocationch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete


0

200

400

600

800

1000

1200

1400

1600

1800

1995 2000 2005 2010

Subscriptions worldwide (millions)

Mobile InternetSubscribers

MobileSubscribersMobile

FixedMobile InternetFixed Internet

• The future Internet will mainly be accessed by mobile devices

Mobile Communication & Data Traffic


Data services in GSM• Data transmission standardized with only 9.6 kbit/s

– advanced coding allows 14,4 kbit/s– not enough for Internet and multimedia applications

• HSCSD (High-Speed Circuit Switched Data)– mainly software update– bundling of several time-slots to get higher

AIUR (Air Interface User Rate)(e.g., 57.6 kbit/s using 4 slots, 14.4 each)

– advantage: ready to use, constant quality, simple– disadvantage: channels blocked for voice transmission

AIUR [kbit/s] TCH/F4.8 TCH/F9.6 TCH/F14.44.8 19.6 2 1

14.4 3 119.2 4 228.8 3 238.4 443.2 357.6 4


Content





Exercise


GPRS: General Packet Radio Service

• Packet Switched Extension of GSM• 1996: new standard developed by ETSI• Components integrated in GSM architecture• Improvements:

– Packet-switched transmission– Higher transmission rates on radio link (multiple

time-slots)– Volume based charging ‚Always ON‘ mode

possible• Operation started in 2001 (Germany)


GPRS - Architecture

PDN

Other

PLMN

GSM GPRS

BTS

CCU

MSC

BSC

PCU

HLR GR

GGSN

Components

A Abis Gb Gp

Gs

Gn

G Gr

Gi

UmBSS

SGSN

MS

Components:• CCU: Channel Coding Unit• PCU: Packet Control Unit• SGSN: Serving GPRS Support Node • GGSN: Gateway GPRS Support Node• GR: GPRS Register

Transmission: • Packet Based Transmission• Radio link:

– Radio transmission identical to GSM– Different coding schemes (CS1-4)– Use of Multiple Time Slots – On-demand allocation of time-slots

• Volume Based Charging


GPRS: Channel Coding and Multiplexing

9,05 kbit/s

.....

Time Slot (MS-> BTS)

Coding Scheme 1

72.4.......171,2 kbit/s

9,05 kbit/s

13,4 kbit/s

9,05 kbit/s

1 2 8

13,4 kbit/s 13,4 kbit/s

15,6 kbit/s 15,6 kbit/s 15,6 kbit/s

.....

.....21,4 kbit/s .....21,4 kbit/s 21,4 kbit/s

9,05 kbit/s

3

Coding Scheme 2

Coding Scheme 3

Coding Scheme 4

.....

‚optimal‘ radio quality: no interference, etc.

Selection of Codingdepending on qualityof radio connection

Overall transmission rate


Examples for GPRS device classes

54412

52410

5148

4225

3223

3122

2111

Maximum number of slotsSending slotsReceiving slotsClass


GPRS user data rates in kbit/s

171.2149.8128.410785.664.242.821.4CS-4

124.8109.293.67862.446.831.215.6CS-3

107.293.880.46753.640.226.813.4CS-2

72.463.3554.345.2536.227.1518.29.05CS-1

8 slots7 slots6 slots5 slots4 slots3 slots2 slots1 slotCoding scheme


GPRS: channel types


Example: Channel Assignment

• 4 TRX 4 FDMA channels32 time slots

• 3 Signalling Channels– 1TS: FCCH, SCH, BCCH (PBCCH),

PAGCH, RACH (PRACH)– 2 TS: SDCCH

• 29 Tracffic Channels (TCH/PDTCH)– GSM calls only– GPRS calls only– Common channels


Performance Measurements in BSS (examples)

User data throughputSignalling Data ThroughputTransmitted PDUsRetransmitted PDUsTransmitted LLC FramesService Upgrade/Downgrade MeasurementsNumber of discarded LLC PDUNumber of Successful GPRS Paging ProceduresNumber of available and assigned PDCH/cellNumber of used PDCH per CellAttempted, Rejected Packet Ressource ReassignmentsSuccessful Packet Ressource Reassignements

.

.

.


GPRS architecture and interfaces

MS BSS GGSNSGSN

MSC

Um

EIR

HLR/GR

VLR

PDN

Gb Gn Gi


Packet Handling

MobilityManagement

SessionManagement

InterceptionHandling

ConfigurationManagement

SMS HandlingProtocols

&Interfaces

PerformanceManagement

Fault & MaintenanceManagement

AccountingResourceManagement

Handover Controland

SGSN ChangeHandling

Functions in SGSN and GGSNFunctions in SGSN

GPRS Core Network Functions


GPRS: Protocol Stack

• RLC: Radio Link Control– Acknowledged mode (reliable) or unacked

• LLC: Logical Link Control– Acknowledged mode (reliable) or unacked

• BSSGRP: BSS GPRS Protocol

• SNDCP: Sub-Network Dependent Convergence Protocol

• GTP: GPRS Tunneling Protocol– Mobility Support– GTP-C and GTP-U


Data Units in GPRS


Coding Schemes

• USF = Uplink State Flag– ‘owner’ of time-slot in next uplink TDMA frame– Allows multiplexing of up to 8 MS on one time-slot

• Block header contains Temporary Flow Identifier (TFI)– TFI and direction identifies Temporary Block Flow (TBF)


Mapping TBFs to Timeslots


BSS

SGSN

Um GbGr

Insert Subscriber Data Ack(NSAPI,TI,PDP Type)

Insert Subscriber Data(NSAPI,TI,PDP Type)

Attach Request(NSAPI,TI,PDP Type)

Attach Accept(NSAPI,TI,PDP Type)

Attach Complete(NSAPI,TI,PDP Type)

HLR

Authentication/Ciphering Authentication/Ciphering

GPRS: Obtaining IP Connectivity• GPRS attach

– Authentication of MS

– Establishment/Initialization of security functions

• PDP Context Setup– Obtain IP

address– Connect to

‚external‘ network[see later]


Enhanced Data rates for the GSM Evolution (EDGE)

Time Slot (MS-> BTS) Transmission Rate

48.......384 kbit/s

1 2 8

48 kbit/s ....48 kbit/s 48 kbit/s8 PSK

....New Modulation

Scheme

• Advantages– Increased Data Rate– No Modificatíons in Core Network (SGSN/GGSN) required

• Disadvantages– New Modulationscheme(8 PSK), not compatible to GSMK– HW Changes in the BTS required


3rd Generation Systems: IMT-2000• Proposals for IMT-2000 (International Mobile Telecommunications)

– UWC-136, cdma2000, WP-CDMA– UMTS (Universal Mobile Telecommunications System) from ETSI

• Frequencies

IMT-2000

1850 1900 1950 2000 2050 2100 2150 2200 MHz

MSS↑

ITU allocation(WRC 1992) IMT-2000 MSS

↓

Europe

China

Japan

NorthAmerica

UTRAFDD ↑

UTRAFDD ↓

TDD

TDD

MSS↑

MSS↓

DECT

GSM1800

1850 1900 1950 2000 2050 2100 2150 2200 MHz

IMT-2000 MSS↑

IMT-2000 MSS↓

GSM1800

cdma2000W-CDMA

MSS↓

MSS↓

MSS↑

MSS↑

cdma2000W-CDMAPHS

PCS rsv.


Universal Mobile Telecommunication System (UMTS)• Currently standardized by 3rd Generation Partnership Project (3GPP),

see http://www.3GPP.org[North America: 3GPP2]

• So far, four releases: R’99, R4, R5, R6

Modifications:• New methods & protocols on radio link increased access bandwidth• Coexistence of two domains in the core network

– Packets Switched (PS)– Circuit Switched (CS)

• New Services• IP Service Infrastructure: IP Based Multimedia Subsystems (IMS) (R5)


UMTS Domains

B S C

B T S

B T S

B S S (R A N /G E R A N )

R N C

N o d e B

N o d e B

U T R A N

M E

S IM

U S IM

M S

S G S N

P S D o m a in

G G S N

C S M G W

C S D o m a in

H S S /A u C

R N C

M S C -S e rv ./V L RA b is

S IM - M E

Iu b is C u

U m

U u

Iu C s G b

A

Iu P S

CD

Iu r

G n

G r G c

G s

C S M G W M S C -S e rv ./V L R

C S M G W

G M S C -S e rv .

IM S D o m a in (R e le a s e 5 )

M b /G i

C x

M c

N b

N b

G /E /N c

N c

M c

U s e r E q u ip m e n t D o m a in

A c c e s s N e tw o rk D o m a in

C o re N e tw o rk D o m a in

In f ra s tru c tu r e D o m a in


User EquipmentDomain

User EquipmentDomain Access

NetworkDomain

AccessNetworkDomain

CoreNetworkDomain

CoreNetworkDomain

Service and ApplicationDomain

Service and ApplicationDomain

Charging/ Lawful Interception/ OAMCharging/ Lawful Interception/ OAM

Other Networks (IP/ ISDN)

Other Networks (IP/ ISDN)

• Radio Access Network– Node B (Base station)– Radio Network Controller (RNC)

• Mobile Core Network– Serving GPRS Support Node (SGSN)– Gateway GPRS Support Node (GGSN)– Mobile Switching Center (MSC)– Home/Visited Location Register (HLR/VLR)– Routers/Switches, DNS Server, DHCP Server,

Radius Server, NTP Server, Firewalls/VPN Gateways

• Application/Services• IP-Based Multimedia Subsystem (IMS)

– [see 9th Semester]• Operation, Administration & Maintenance (OAM)• Charging Network • [Legal Interception]

UMTS Network Domains


UMTS Radio Access Network (UTRAN): architecture

• CDMA (Code Division Multiple Access) on Radio Link

• transmission rate theoretically up to 2Mbit/s (realistic up to ≈300kb/s)


Content





Exercise


Transport of IP packets

ApplicationServerGGSNTerminal SGSNUTRAN

GTP-UGTP-U

User IP (v4 or v6)

Radio Bearer

IP tackets are tunnelled through the UMTS/GPRS network(GTP – GPRS tunneling protocol)

L1

RLC

PDCP

MAC

IPv4 or v6

Application

L1

RLC

PDCP

MAC

ATM

UDP/IPv4 or v6

GTP-U

AAL5

Relay

L1

UDP/IPv4 or v6

L2

GTP-U

IPv4 or v6

Iu-PSUu Gn Gi

ATM

UDP/IPv4 or v6

GTP-U

AAL5

L1

UDP/IPv4 or v6

GTP-U

L2

Relay

L1

L2

IPv4 or v6

[Source: 3GPP]


IP Transport: Concepts• PDP contexts (Packet Data Protocol) activation

• done by UE before data transmission• specification of APN and traffic parameters• GGSN delivers IP address to UE• set-up of bearers and mobility contexts in SGSN and GGSN• activation of multiple PDP contexts possible

•Access Point Names (APN)• APNs identify external networks (logical Gi interfaces of GGSN)• At PDP context activation, the SGSN performs a DNS query to find out the GGSN(s) serving the APN requested by the terminal.• The DNS response contains a list of GGSN addresses from which the SGSN selects one address in a round-robin fashion (for this APN).

•Traffic Flow Templates (TFTs)• set of packet filters (source address, subnet mask, destination port range, source port range, SPI, TOS (IPv4), Traffic Class (v6), Flow Label (v6)• used by GGSN to assign IP packets from external networks to proper PDP context

• GPRS tunneling protocol (GTP)•For every UE, one GTP-C tunnel is established for signalling and a number of GTP-U tunnels, one per PDP context (i.e. session), are established for user traffic.


GGSN

IP Transport: PDP Context & APNs

Terminal SGSNGGSN

PDP Context X2 (APN X, IP address X, QoS2)

PDP Context X1 (APN X, IP address X, QoS1)

ISP X

ISP Z

ISP Y

PDP Context Z (APN Z, IP address Z, QoS)

PDP Context Y (APN Y, IP address Y, QoS)

APN

YA

PN Z

APN

X

Same PDP (IP) address and APN

PDP Context selectionbased on TFT (downstream)

[Source: 3GPP]


UMTS Data Transport: Bearer Hierarchy

TE MT UTRAN/GERAN

CN IuEDGENODE

CNGateway

TE/AS

End-to-End Service(IP Bearer Service)

TE/MT LocalBearer Service

UMTS BearerService

External BearerService

UMTS Bearer Service

Radio Access BearerService

CN BearerService

BackboneBearer Service

Iu BearerService

Radio BearerService

PhysicalRadio

Service

PhysicalBearer Service

Air Interface

3G GGSN3G SGSNRAN

User Equipment


The ’full picture’ of the UMTS packet switched domain

G G SNSG SN

D HC P

R ADIU S

IM S D o m ain

H SS

H L R/AuC

RNC

Node B

Node B

N etw ork Services

SS7, G r

SS 7, G c

G RX Netw o rk

D N SG n-SEC

DN S G n-PRI

G n N etw ork

D N S E xt

B G

G i N etw ork

D M Z

D NSExt

E -m ail

HT T Pproxy

D N S NS

D N S IM S

P-C S C F

I/S -C S CF

MN O 1`s B ackbone

AS N etw o rk

M essages

FT P

V ideo

DN SAS

C orp. Network

VPN -G W Y

AS

B G

IDS

ID S

M N O 1`s N etw ork

B G

1 2 3 4 5 6 7 8 9 * 0 # U E1

BG

In ternetAS

M N O 3

UE3

M N O 2

UE2

IMS

Roaming Support: • UE attaches with SGSN in visited network• PDP context is set-up to GGSN in home network (via Gp interface, GRX network)


Message Flow: PDP Context Setup

…

…


Summary





Exercise


Acknowledgements/References

• Lecture notes: Mobile Communciations, Jochen Schiller, www.jochenschiller.de• Marco Hoffmann, Master Thesis, ‘Simulation of a flow-control algorithm between two nodes of

the GPRS network’, TU Munich and Siemens AG, 2001.• Tutorial: IP Technology in 3rd Generation mobile networks, Siemens AG (J. Kross, L. Smith, H.

Schwefel)• Various 3GPP Presentations. www.3gpp.org• J. Schiller: ’Mobile Communications’. Addison-Wesley, 2000.• GPRS books:

– T. Halonen, J. Romero, J. Melero: ‘GSM, GRPS, EDGE Performance: Evolution towards 3G/UMTS’, Wiley, 2003


Exercises I:1. Data Rates: A user wants to do an FTP download of a 8MB Power-Point Presentation.

Compute the duration of this download for the following access technologies• GSM data service• HSCSD, 4 timeslots• GPRS, 4 timeslots, CS-2 (downlink)• EDGE, 8 timeslots• Wired ISDN access (64kbit/s)Give at least two reasons why the actual download times are likely to be longer than the ones

just computed.Charging: The operator charges in GSM 15cent/min, in GPRS 0.1cent/kB. Compare the

costs of the GSM and GPRS download in the FTP case as well as for a Web-session with duration of 1hour and overall data volume of 150kB.

2. IP transport in GPRS networks: a mobile user has set-up a PDP context to an ISP which has assigned him the IP address 10.10.123.45 (private). The user now iniates a web access to the CNN server. Describe the header structure of the IP packet which is sent downstream from the GGSN to the SGSN (detailling the IP source and destination address).


Exercises II:3. Channel Assignment: In a certain radio cells, 2 channels are allocated resulting in 16

available timeslots. 3 timeslots are always used for control channels, 8 timeslots are reserved for voice-calls (GSM) and the remaining time-slots are freely given to either GSM or GPRS users.

Assume that there are no GSM users in the cell. GPRS users with two types of devices are considered: i) 30% are supporting and asking for 2 down-link slots, ii) 70% are supporting and asking for 4 down-link slots. GPRS sessions are started according to a Poisson process with rate λ=2/min and with an exponentially distributed session duration of on average 2min, during which they transmit with maximum data rate (CS-2).Use the given simulation program to obtain average cell throughput, average throughput per session, session blocking probability for the following strategies:• Newly starting sessions either obtain the number of time-slots which they are

asking for, or they get blocked. Existing sessions are never downgraded.• [If a session comes in newly, it obtains the remaining available time-slots up to the

number which it is asking for. If none are left, a station with the maximum number of allocated time-slots is downgraded by one slot which is given to the new session. ]

Define a fairness criterion and evaluate it in the simulation.

intro: cellular systems - department of electronic systems

Documents