![Telcom 2720 47
UMTS Architecture: Control Plane
RLC
RRC
L1
GMM /
SM / SMS
RRC
MAC
ATM
RANAP
AAL5
Relay
ATM
AAL5
3G SGSNRNSMS
Iu-PsUu
RLC SCCP
Signalling
Bearer
MAC
L1
Signalling
Bearer
RANAP
SCCP
GMM /
SM / SMS
[2]
Telcom 2720 48
RRC: Functions and Signaling
Procedures
• Broadcast of information related to the non-access
stratum (Core Network)
• Broadcast of information related to the access stratum
• Establishment, maintenance and release of an RRC
connection between the UE and UTRAN
• Establishment, reconfiguration and release of Radio
Bearers
• Assignment, reconfiguration and release of radio
resources for the RRC connection
• RRC connection mobility functions
• Control of requested QoS](https://image.slidesharecdn.com/2720slides12-160227151733/85/overview-for-umts-21-320.jpg)
overview for umts
- 1. UMTS overviewUMTS overview David Tipper Associate ProfessorAssociate Professor Graduate Telecommunications and Networking Program University of Pittsburgh 2720 Slides 122720 Slides 12 Telcom 2720 2 UMTS • ETSI proposed GSM/NA-TDMA /GPRS evolution under name Universal Mobile Telecom. Services (UMTS) • Most of 3G licenses in Europe required operator to deploy a UMTS system covering x% of population by a specific date y – Germany: 25% of population by 12/03, 50% by 12/05 – Norway: 80% of population by 12/04 – In most countries operators have asked for and received deployment delay due to dot.com bust and equipment delays • Estimate 2.5 Billion euros to deploy a 5000 base station UMTS system • According to UMTS Forum – More than 90 million UMTS users as of 10/06 on operating networks in more than 50 countries – Most deployments of UMTS in Europe (~40% of market) and Pacific Rim (~38% market)
- 2. Telcom 2720 3 UMTS • UMTS is a complete system architecture – As in GSM emphasis on standardized interfaces • mix and match equipment from various vendors – Simple evolution from GPRS – allows one to reuse/upgrade some of the GPRS backhaul equipment – Backward compatible handsets and signaling to support intermode and intersystem handoffs • Intermode; TDD to FDD, FDD to TDD • Intersystem: UMTS to GSM or UMTS to GPRS – UMTS supports a variety of user data rates and both packet and circuit switched services – System composed of three main subsystems Telcom 2720 4 UMTS System Architecture • UE (User Equipment) that interfaces with the user • UTRAN (UMTS Terrestrial Radio Access Network) handles all radio related functionality – WCDMA is radio interface standard here. • CN (Core Network) is responsible for transport functions such as switching and routing calls and data, tracking users USIM ME Node B Node B Node B Node B RNC RNC MSC/VLR SGSN HLR GGSN GMSC PSTN Internet UE UTRAN CN External Networks
- 3. Telcom 2720 5 UMTS System Architecture • UE – ME (Mobile Equipment) • is the single or multimode terminal used for radio communication – USIM (UMTS Subscriber Identity Module) • is a smart card that holds the subscriber identity, subscribed services, authentication and encryption keys • UTRAN – Node B (equivalent to BTS in GSM/GPRS) • performs the air interface processing (channel coding, rate adaptation, spreading, synchronization, power control). • Can operate a group of antennas/radios – RNC (Radio Network Controller) (equivalent to GSM BSC) • Responsible for radio resource management and control of the Node Bs. • Handoff decisions, congestion control, power control, encryption, admission control, protocol conversion, etc. Telcom 2720 6 UTRAN architecture • UTRAN contains several RNSs • Node B can support FDD or TDD or both • RNC is responsible for handover decisions requiring signalingto the UE • Cell offers FDD or TDD RNC: Radio Network Controller RNS: Radio Network SubsystemNode B Node B RNC Iub Node B UE1 RNS CN Node B Node B RNC Iub Node B RNS Iur Node B UE2 UE3 Iu
- 4. Telcom 2720 7 UMTS System Architecture • Core Networks (CN) – HLR (Home Location Register) • database located in the user’s home system that stores the master copy of the user’s service profile. The HLR also stores the UE location on the level of MSC and SGSN, – 3G MSC / VLR • Switch and database that serves the UE in its current location for Circuit Switched (CS) services. The MSC function is used to switch the CS transactions, and VLR function holds a copy of the visiting user’s service profile, as well as more precise information on the UE’s location within the serving system. – 3G GMSC (Gateway MSC) • Switch at the point where UMTS is connected to external CS networks. All incoming and outgoing CS connections go through GMSC. – 3G SGSN (Serving GPRS Support Node) • Similar to that of MSC / VLR but is used for Packet Switched (PS) services. The part of the network that is accessed via the SGSN is often referred to as the PS domain. Upgrade version of serving GPRS support node. – 3G GGSN (Gateway GPRS Support Node) • Functionality is close to that of GMSC but is in the relation to PS services. Upgraded version of gateway GPRS support Node Telcom 2720 9 Core network • The Core Network (CN) and the Interface Iu are separated into two logical domains: • Circuit Switched Domain (CSD) – Circuit switched service including signaling – Resource reservation at connection setup – 3G versions of GSM components (MSC, GMSC, VLR, HLR) – IuCS • Packet Switched Domain (PSD) – Handles all packet data services – 3G versions of GPRS components (SGSN, GGSN) – IuPS • General approach of building on GSM/GPRS infrastructure ,helps to saves $ and faster deployment
- 5. Telcom 2720 10 Core network: architecture BTS Node B BSC Abis BTS BSS MSC Node B Node B RNC Iub Node B RNS Node B SGSN GGSN GMSC HLR VLR IuPS IuCS Iu CN EIR Gn Gi PSTN AuC GR Telcom 2720 11 Core Network GSM GPRS Evolution Visitor Location register Mobile Switching Center Home Location register Gateway MSC SGSN GGSNPCU GSMGSM GPRSGPRS Base Station Controller Voice data
- 6. Telcom 2720 12 Core Network GSM GPRS UMTS Evolution Visitor Location Register Mobile Switching Center Home Location Register Gateway MSC 3G SGSN 3G GGSN UMTSUMTSGSMGSM GPRSGPRS Radio Network Controller Radio Network Controller Voice data Telcom 2720 13 WCDMA • Wideband Code Division Multiple Access (WCDMA) – The air radio interface standard for UMTS – Wideband direct sequence spread spectrum – Variable orthogonal spreading for multiple access (OVSF) • Three types of interface : – FDD: separate uplink/downlink frequency bands with constant frequency offset between them – TDD: uplink/downlink in same band but time-shares transmissions in each direction – Dual mode :supports FDD and TDD • Wide range of data rates due to CDMA with variable spreading, coding and modes – Varying user bit rate is mapped to variable power and spreading – Different services can be mixed on a single carrier for a user
- 7. Telcom 2720 14 WCDMA • 5-MHz Channel (25 GSM channels) – Each service provider can deploy multiple 5MHz carriers at same cell site – Each 5 MHz shared by multiple subscribers using CDMA – Maximum chip rate = 3.84 Mchips/sec • Standard advantages of CDMA – Soft handoff – Frequency reuse cluster size of 1, – Better quality in multipath environment – RAKE receiver • QPSK modulation Telcom 2720 15 Scrambling and Channelization • Channelization codes are orthogonal codes – Separates transmissions from the same source – Uplink: used to separate different physical channels from the same UE – voice and data session – Downlink: used to separate transmissions to different physical channels and different UEs – UMTS uses orthogonal variable spreading codes • Scrambling (pseudonoise scrambling) – Applied on top of channelization spreading – Separates transmissions from different sources – Uplink effect: separate mobiles from each other – Downlink effect: separate base stations from each other
- 8. Telcom 2720 16 Physical Layer: Spreading • Spreading of the low-bandwidth data signal to produce the wideband CDMA signal consists of two steps: – Channelization or spreading code to reach channel rate of 3.84 Mchips/s – Scrambling – to provide separation of transmissions Telcom 2720 17 Channelization Spreading UMTS uses variable spreading and power levels to provide different user data rates. In FDD mode 10 msec frames are used The number of chips per bits is called the Spreading Factor (SF) and define the data service required for the user: Tbit = SF x Tchip For UMTS: Bit Rate x SF = 3.84 Mchips/s (Chip Rate) SF can change in every 10 msec frame Service Bearer Date Rate (kbps) SF Modulation Rate (Mchips/s) Speech 30 128 3.84 Packet 64 kbps 120 32 3.84 Packet 384 kbps 960 4 3.84
- 9. Telcom 2720 19 The channelization codes are Orthogonal Variable Spreading Factor codes that preserves the orthogonality between a user’s different physical channels. The OVSF codes can be defined using a code tree. In the code tree the channelization codes are uniquely described as CCH,SF,k where SF is the Spreading Factor of the code and k is the code number, 0 <= k <= SF – 1 CCH,4,0 = 1 1 1 1 CCH,2,0 = 1 1 CCH,4,1 = 1 1 –1 –1 CCH,1,0 = 1 CCH,4,2 = 1 –1 1 –1 CCH,2,1 = 1 –1 CCH,4,3 = 1 –1 –1 1 SF = 1 SF – 2 SF = 4 SF between 4 and 512 on DL between 4 and 256 on UL WCDMA Variable Spreading Telcom 2720 20 Scrambling and Channelization Codes Downlink: Separation of sectors (cells) Downlink: Separation of downlink connections of different users within one cell No, it does not affect transmission bandwidth Yes, increases transmission bandwidthSpreading Long: Gold code Short: Extended S(2) family Orthogonal Variable Spreading Factor (OVSF)Code family Uplink: Several millions Downlink: 512 Number of codes under one scrambling code = spreading factor Number of codes Uplink: 10 ms 38400 chips or 66.7 μs = 256 chips Downlink: 10 ms = 38400 chips 4-256 chips (1.0-66.7 μs) Downlink also 512 chips Length Uplink: Separation of terminals Uplink: Separation of physical data and control channels from same terminal Usage Scrambling codeChannelization code
- 10. Telcom 2720 21 WCDMA QPSK Modulator Telcom 2720 22 • Used in 3G cellular (UMTS) standard • TurboCode: Concatenation of codes with interleaving - followed by an iterative algorithm for decoding • Use soft decisions to make the decoding powerful. • Instead of counting differences in bit positions, distance probabilities are used. Turbocodes
- 11. Telcom 2720 23 Concatenated Code System Outer Code Encoder Inner Code Encoder Modulator Source Decoder Inner Code Decoder Demod -ulator RadioChannel Data R= K/N code r=k/n Overall Code rate = Rr Concatenation makes coding more powerful Turbocodes adds an interleaving step Telcom 2720 26 WCDMA Forward Error Control • Convolutional Coding: for voice and control info – ½ rate and 1/3 rate codes with constraint length 8 • Block Interleave over 10, 20, 40, or 80 ms • Turbo Coding for data and some control info – Two parallel rate 1/3 convolutional codes constraint length 3 with interleaving – block length 320 – 5120 bits – Iterative decoding to improve BER in poor channel environments.
- 12. Telcom 2720 27 Turbocode Performance Telcom 2720 28 WCDMA Parameters Softer handover, soft handover and interfrequency handover Handover 10ms/20ms (optional TDD mode) Frame length 3.84 McpsChip rate Direct spread spectrum QPSK modulation Downlink RF channel structure 5.MHzChannel bandwidth
- 13. Telcom 2720 29 UMTS FDD frame structure 0 1 2 12 13 14... Radio frame Pilot FBI TPC Time slot 666.7 µs 10 ms Data Data1 uplink DPDCH uplink DPCCH downlink DPCHTPC TFCI Pilot 666.7 µs 666.7 µs DPCCH DPDCH 2560 chips, 10 bits 2560 chips, 10*2k bits (k = 0...6) TFCI 2560 chips, 10*2k bits (k = 0...7) Data2 DPDCH DPCCH FBI: Feedback Information TPC: Transmit Power Control TFCI: Transport Format Combination Indicator DPCCH: Dedicated Physical Control Channel DPDCH: Dedicated Physical Data Channel DPCH: Dedicated Physical ChannelSlot structure NOT for user separation but synchronisation for periodic functions! Telcom 2720 30 UMTS • Data rate adjusted every 10 msec by variable spreading and power
- 14. Telcom 2720 32 UMTS • Protocol Stack – User Plane • Radio Link Control (RLC) – Presents a reliable channel to higher layers by retransmitting erroneous packets • Medium Access Control (MAC) – Channel access, multiplexing traffic streams, scheduling priority flows • Physical Layer – Measurements, power control algorithms – Control Plane • Radio Resource Control (RRC) – Connection and QoS management • Radio Resource Management (RRM) – Algorithms for admission control, handovers Telcom 2720 34 UMTS protocol stacks (user plane) apps. & protocols MAC radio MAC radio PDCP GTP Uu IuPSUE UTRAN 3G SGSN RRM/RLC AAL5 ATM AAL5 ATM UDP/IP PDCP RRM/RLCUDP/IP UDP/IP Gn GTP GTP L2 L1 UDP/IP L2 L1 GTP 3G GGSN IP, PPP, … IP, PPP, … IP tunnel Circuit Uses same protocols as GSM Switched Domain Packet Switched Domain Builds on GPRS Stack
- 15. Telcom 2720 35 RLC Functions • Segmentation and reassembly • Concatenation • Padding • Transfer of user data • Error correction • In-sequence delivery • Duplicate detection • Flow control • Sequence number check (UM) • Protocol error detection and recovery • Ciphering • Suspend/resume function for data transfer Telcom 2720 36 Air Interface/Physical Layer Radio Resource Control (RRC) Medium Access Control Transport channels Physical layer Control/Measurements Layer 3 Logical channels Layer 2 Layer 1 • Radio interface protocol architecture around the physical layer
- 16. Telcom 2720 37 MAC Architecture MAC-d FACH RACH DCCH DTCHDTCH DSCH DCH DCH MAC Control USCH ( TDD only ) CPCH ( FDD only ) CTCHBCCH CCCH SHCCH ( TDD only ) PCCH PCH FACH MAC-c/sh USCH ( TDD only ) DSCH MAC-b BCCH Telcom 2720 38 MAC Functions • Mapping of logical channels onto transport channels • Selection of transport format for each transport channel • Priority handling between data flows of one MS • Priority handling between MSs by means of dynamic scheduling • Identification of MSs on common transport channels • Multiplexing/demultiplexing of higher layer PDUs into/from transport blocks to/from the physical layer • Traffic volume monitoring • Dynamic transport channel type switching • Ciphering • Access service class selection for RACH transmissions
- 17. Telcom 2720 39 MAC: Logical Channels • Control channels: – Broadcast control channel (BCCH) – Paging control channel (PCCH) – Dedicated control channel (DCCH) – Common control channel (CCCH) • Traffic channels: – Dedicated traffic channel (DTCH) – Common traffic channel (CTCH) Telcom 2720 40 MAC Entities • MAC-b handles the following transport channels: – broadcast channel (BCH) • MAC-c/sh handles the following transport channels: – paging channel (PCH) – forward access channel (FACH) – random access channel (RACH) – common packet channel (UL CPCH). The CPCH exists only in FDD mode. – downlink shared channel (DSCH) • MAC-d handles the following transport channels: – dedicated transport channels (DCH)
- 18. Telcom 2720 41 MAC: Mapping Between Logical Channels and Transport Channels Telcom 2720 42 Physical Channels • Primary Common Control Physical Channel (PCCPCH) • Secondary Common Control Physical Channel (SCCPCH) • Physical Random Access Channel (PRACH) • Dedicated Physical Data Channel (DPDCH) • Physical Downlink Shared Channel (PDSCH) • Physical Common Packet Channel (PCPCH) • Synchronization Channel (SCH) • Common Pilot Channel (CPICH) • Acquisition Indicator Channel (AICH) • Paging Indication Channel (PICH) • CPCH Status Indication Channel (CSICH) • Collision Detection/Channel Assignment Indicator Channel (CD/CA- ICH)
- 19. Telcom 2720 43 Physical Channels – Physical Random Access Channel (PRACH) Telcom 2720 44 Physical Channels – Dedicated Uplink Physical Channel
- 20. Telcom 2720 45 Physical Channels – Physical Common Packet Channel (PCPCH) 4096 chips P0 P1 Pj Pj Collision Detection Preamble Access Preamble Control Part Data part 0 or 8 slots N*10 msec Message Part Telcom 2720 46 UTRAN Procedures • Fast closed-loop power control • Open-loop power control • Paging • Random-access channel procedure • CPCH operation • Cell search • Transmit diversity • Handover measurements • Soft Handoff
- 21. Telcom 2720 47 UMTS Architecture: Control Plane RLC RRC L1 GMM / SM / SMS RRC MAC ATM RANAP AAL5 Relay ATM AAL5 3G SGSNRNSMS Iu-PsUu RLC SCCP Signalling Bearer MAC L1 Signalling Bearer RANAP SCCP GMM / SM / SMS [2] Telcom 2720 48 RRC: Functions and Signaling Procedures • Broadcast of information related to the non-access stratum (Core Network) • Broadcast of information related to the access stratum • Establishment, maintenance and release of an RRC connection between the UE and UTRAN • Establishment, reconfiguration and release of Radio Bearers • Assignment, reconfiguration and release of radio resources for the RRC connection • RRC connection mobility functions • Control of requested QoS
- 22. Telcom 2720 49 RRC: Functions and Signaling Procedures (cont.) • UE measurement reporting and control of the reporting • Outer loop power control • Control of ciphering • Slow DCA (TDD mode) • Paging • Initial cell selection and cell re-selection • Arbitration of radio resources on uplink DCH • Timing advance (TDD mode) • CBS control. Telcom 2720 50 UMTS Diversity • UMTS – DS- CDMA support multi-path diversity – Note can tolerate a wider range of multi-path delay spread than IS-95 due to greater spreading • UMTS supports macro-diversity. – Allows UE to transmit the same signal via 2 or more cells, in order to counteract interference problems. • When macro-diversity is used, and when 2 cells are belonging to 2 Node Bs, that are belonging to 2 different RNCs, these RNCs have a specific functionality: – Serving RNC (SRNC): a role a RNC can take with respect to a specific connection between a UE and UTRAN. There is one SRNC for each UE that has a connection to UTRAN. The SRNC is in charge of the radio connection between the UE and UTRAN. – Drift RNC (DRNC): a role a RNC can take with respect to a specific connection between a UE and UTRAN. A RNC, that supports the SRNC with radio resources when the connection between the UTRAN and the UE needs to use cell(s) controlled by this RNC, is referred to a Drift RNC.
- 23. Telcom 2720 51 Power Control In order to maximize the cell capacity, it has to equalize the received power per bit of all mobile stations at all times. Open loop power control The initial power control is Open Loop. The MS (UE) estimates the power level based on the received level of the pilot from the BTS (Node B). If no response is received the MS waits a defined time and retransmits with a higher power level. The MS continues to do this until it receives a response. MS (UE) BTS (Node B) MS Access 1 with estimated power MS Access 2 with increased power . . . MS Access n with increased power Response with power control Telcom 2720 52 Power ControlPower Control Closed loop power control When communication is established, power is controlled by the Closed Loop Power Control. MS (UE) BTS (Node B) BTS sends power control bits To MS (UE) (1500 times/sec) MS transmits (Tx) Continues poser control Inner Loop Outer Loop RNC RNC sets SIR target for service RNC calculates BLER for Tx RNC sends new SIR target
- 24. Telcom 2720 53 Power Control • The RNC sets the target BLER (Block Error Rate) level for the service. – RNC derives SIR (Signal to Interference Ratio) target from BLER, and sends it to the BTS. • Uplink RNC performs frequent estimations of the received SIR and compares it to a target SIR. – If measured SIR is higher than the target SIR, – the base station will command the MS to lower the power: – If it is too low, it will command the mobile station to increase its power: – The measured-command-react cycle is executed a rate of 1500 times per second (1.5 KHz) for each mobile station (Inner Loop). • The RNC calculates the SIR target once every 10 ms (or more depending on services) and adjusts the SIR target (Outer Loop). • Downlink, same closed-loop power control technique is used but the motivation is different: it is desirable to provide a marginal amount of additional power to mobile stations at the cell edge, as they suffer increased adjacent cell interference. Telcom 2720 54 QoS Classes/Services Background download of e- mail, electronic postcard Web browsing, network games Streaming multimedia Voice, video telephony, video games Application examples Destination is not expecting the data within a certain time Preserve data integrity Request response pattern Preserve data integrity Asymmetric applications More tolerant to jitter than conversational class. Use of buffer to smooth out jitter Preserve time relation (variation) between information entities of the stream Conversational pattern (stringent and low delay) Characteristics BackgroundInteractiveStreamingConversationalTraffic class
- 25. Telcom 2720 55 Conversational ClassesConversational Classes Speech service • Speech codec in UMTS employs a Adaptive Multi-rate (AMR) technique. The multi-rate speech coder is a single integrated speech codec with eight source rates: 12.2 (GSM-EFR), 10.2, 7.95, 7.40, 6.70, 5.90, 5.15, 4.75 kbps and 0 kbps. • The AMR bit rates are controlled by the radio access network and not depend on the speech activity. • For interoperability with existing cellular networks, some modes are the same as in existing cellular networks: 12.2 kbps = GSM EFR codec 7.4 kbps = North American TDMA speech codec 6.7 kbps = Japanese PDC • The AMR speech coder is capable of switching its rate every 20 ms speech frame upon command. Telcom 2720 56 Admission Control • Accepts or rejects requests to establish a radio access bearer • Located at the RNC • Estimates the load increase that the establishment of the radio access bearer would cause to the radio network • Check is applied separately for uplink and downlink directions • Radio access bearer will be accepted if admission control admits both uplink and downlink • Example: Wideband power-based admission control
- 26. Telcom 2720 57 Comm. Tower Comm. Tower Comm. Tower Comm. Tower Comm. Tower Comm. Tower Comm. Tower Comm. Tower Node B Node B BTS RNS iu Core Network Handover in UMTS 1 2 3 4 Soft handoff When stay on same frequency in adjacent sectors or cells Telcom 2720 58 Types of UMTS Handoffs 1. Intra RNC: between Node B’s or sector of same Node B’s attached to same RNC 2. Inter RNC: between Node B’s attached to different RNC’s, can be rerouted between RNC’s locally if link , or rerouted by 3GMSC/SGSN, if RNC’s in same service area 3. Inter 3GMSC/SGSN between Node B’s attached to different 4. Inter System Handoff – between Node B and BTS along with a change of mode (WCDMA, GSM), (WCDMA, GPRS) Note types 1,2, and 3 can be a Soft/Softer or Hard handoff, whereas, type 4 is always a Hard handoff
- 27. Telcom 2720 59 UMTS Intersystem Handoff • Hard Handover – If the UE is obliged to hand over to a different frequency (on another system like GSM or GPRS, or not), this is know as a hard handover. UMSC MSC Serving RNC BSS 1. Decision to perform HO to GSM 1. Relocation required 2. Prepare HO request 3. HO request 3. Allocate radio resources 4. HO request ACK 5. Prepare HO response 8. Relocation command 9. HO command UE 6. IAM 7. ACM IAM: Initial Address Message ACM: Address Complete Message UMTS to GSM Handover Telcom 2720 60 UMTS Intersystem Handoff UMTS to GSM Handover … continued UMSC MSC Serving RNC BSS 16. Release command 11. Process access signaling request 14. HO complete 10. HO detect 12. ANIM 17. Release complete 15. SEND END signal request UE 10. HO Access 13. HO complete
- 28. Telcom 2720 63 Location Management Three types of location updating 1. Location Area (LA)- zone registration as in GSM, plus can require periodic registration of users 2. Routing Areas (RA) – zone registration as in GPRS for packet based services 3. UTRAN Registration Areas (URA) – zone registration for certain types of services Telcom 2720 64 UMTS Security • UMTS Security Functions • Main security elements from GSM • Authentication of subscribers using challenge/response • Subscriber identity confidentiality (TMSI) • SIM card (call USIM) • Authentication of user to USIM by use of a PIN • Radio interface encryption • UMTS enhancements/new features • Mutual authentication to protect against false base stations • New encrpytion/key generation/authentication algorithms with greater security • Encryption extended farther back into wired network (prevents eavesdropping on microwave relays)
- 29. Telcom 2720 65 UMTS Security Architecture Telcom 2720 66 UMTS Security • UMTS authenticates and encrypts circuit switched and packet switched connections separately (even from same MS) • AUC and USIM have 128 bit shared secret data • When authentication requested AUC generates a vector of 128 bit integrity keys (IK) using algorithm f4 with a 128 bit random number input RAND • Authetication challenge is created using algorithm f9 with inputs: • Integrity Key • Direction of transmission (up or downlink) • 32 bit random number: FRESH • Hyperframe count (32 bits) – prevents replay attacks • Only RAND and FRESH and the correct response are transmitted over the air
- 30. Telcom 2720 67 UMTS Security Security architecture at AUC Telcom 2720 68 UMTS Security • After authentication encryption provided using algorithm f8, with inputs • 128 bit cipher key CK, Hyperframe count (32 bits), direction, etc. • CK is created by algorithm f3 using 128 bit random number RAND and 128 bit shared secret data of USIM/AUC • The encryption algorithms allow for future improvement • User specifies protocol version (algorithm used) in set up message along with times for length of using IKs • Currently Kasumi algorithm or Advanced Encryption Standard are used for f8 and f9 • May eventually move to using IP level encryption and authentication
- 31. Telcom 2720 69 UMTS System Architecture HLR RNS GGSN 3GMSC Internet/ Data networks PSTN/ISDN Other PLMN GGSN RNC Node B Node B Radio access network RNS VLR 3G SGSN The UMTS system architecture Telcom 2720 70 HIGH SPEED DOWLINK PACKET ACCESS (HSDPA) • HSDPA ≈ 3.5G system upgrade of UMTS • Standardised in 3GPP Release 5 • Objective is to support delay-tolerant services in low mobility scenarios with with enhanced resource efficiency and service quality – support for background, interactive and (to some extent) streaming services – low mobility – enable downlink peak rates of 8-10 Mbits/s >> 3G requirements – lower resource consumption per transferred delay-tolerant bit
- 32. Telcom 2720 71 HIGH SPEED DOWLINK PACKET ACCESS • HSDPA upgrade of UMTS similar to EDGE upgrade of GPRS – completely backwards compatible – no new spectrum needed – reuse existing infrastructure and 5MHz channels • primarily software and minor hardware upgrades – coexistence of HSDPA- and non-HSDPA-enabled terminals – coexistence of HSDPA- and non-HSDPA-enabled NODE-Bs • data flows on HS-DSCH moving from non-HSDPA-cell to HSDPA- cell are automatically switched to a supported transport channel, e.g. DCH • gradual hot-spot-based network upgrades possible – cost-effective Telcom 2720 72 HSDPA Architecture UE NODEB RNC • Upgrade UMTS downlink channels to a HS version: –higher-order modulation: QPSK and 16-QAM –fast link adaptation: adaptive modulation and coding –fast channel-aware scheduling: centered at the Node B –fast hybrid ARQ on downlink: combines FEC and selective ARQ –reduced TTI of 2 ms: to facilitate better tracking of channel variations – HS channels typically transmits at relatively fixed power channel quality indicator shared channel
- 33. Telcom 2720 73 HS-PDSCH NEW PHYSICAL CHANNELS HS-DPCCH DPCH DPCH HS-SCCHs •PHYSICAL CHANNELS –HS-PDSCH downlink SF 16 data only (up to 15 streams to a user) –HS-SCCH(s) downlink MAC-hs signalling, H-ARQ,etc. –HS-DPCCH uplink SF 256 CQI, (N)ACK Telcom 2720 74 HSPDA vs. UMTS
- 34. Telcom 2720 75 PHYSICAL LAYER PROCESSING other channels gain complex scrambling modulation Turbo encoding rate matching interleaving modulation (series → parallel) mapping on code tree spreading CRC information bit sequence • Physical Layer Processing ADAPTIVE Telcom 2720 76 ADAPTIVE MODULATION AND CODING MODULATION SPREADING FACTOR TURBO CODE RATE BITS/ BLOCK/CODE DATA RATE (15 CODES) 16 QPSK 16 16 1/4 1/2 3/4 240 470 711 1.8 Mbps 3.6 Mbps 5.3 Mbps 16-QAM 16 16 1/2 3/4 950 1440 7.2 Mbps 10.8 Mbps • LINK ADAPTATION: channel-dependent AMC • typically more efficient for services that tolerate short-term data rate variations • with only power-controlled channels, it is difficult to exploit all resoures • AMC can exploit resources better, at the cost of transfer rate jitter • Fixed spreading factor SF but variable number of streams and bits per channel symbol
- 35. Telcom 2720 77 PACKET SCHEDULING SCHEMES • Round robin – serve data flows cyclically • SNR-based scheduling – serve data flow with highest CQI → • Proportional fair scheduler – serve data flow with highest , with the instantaneous rate and the smoothed (α) assigned rate • Priority reduction scheduler – serve data flow with highest , with α the priority reduction parameter, and N(t) the number of times scheduled SNR time SNR time SNR time 2 ms efficiencyfairness ( ) ( )tRtR ~ / ( )tR ( ) ( )tRtN α Telcom 2720 78 HSDPA Upgrades • Infrastructure – NODE-B • a new MAC sublayer (MAC-hs) is standardised and needs to be implemented in the NODE-B • depending on the legacy NODE-B capabilities, this update may be done via remote software downloads or may possibly require hardware upgrades as well – RNC is largely maintains the UMTS Release ’99 functionality • a software-only upgrade is required, e.g. to enable assignment of data flows to the HS-DSCH (~ channel switching) – no substantial impact on the CORE network is expected – New Mobile Terminals • Support physical interface, higher data rates and H-ARQ • HSDPA deployments began 2006 in Europe, Canada, etc. Over 100 deployments
- 36. Telcom 2720 79 HSUPA • High Speed Uplink Packet Access • Similar to HSDPA – advanced coding and modulation techniques with hybrid ARQ to improve data rate on uplink channel in UMTS • Now called Enhanced Uplink (EUL) (3GPP) • Data rates from .73Mbps – 5.76Mbps, 11.5Mbps being tested • Uses new Enhanced versions of Signalling and physical channels • Focus of UMTS now on IP in the backhaul Telcom 2720 80 3GPP IP Reference Architecture HSS HLR RNS GGSN Gateway CSCF Internet/ IP networks PSTN SGSN PSTN gateway Other 3GPP PLMN GGSN Legacy (2G) mobile networks RNC Node B Node B Radio access network RNS Applications & services The 3GPP IP reference architecture – all traffic IP - with QoS Classes
- 37. Telcom 2720 81 UMTS • UMTS is most popular 3G technology – Upgrade path from GPRS/EDGE – primarily in air interface to WCDMA standard – WCDMA – variable power/spreading cdma – Provides standard benefits of cdma technology (frequency reuse factor 1, soft handoff, etc.) – Still in deployment stage in many places – Upgrade path to HSPDA and all IP defined