Tech note umts

Technical Note

UMTS Technical Note By NetTest

ABSTRACT UMTS (Universal Mobile Telecommunication System) or 3G represents a major leap forward with expectations of faster communication and the capability of combining voice and data in new ways, to facilitate multi-media and end-to-end broadband services. At the same time, UMTS represents a major challenge to vendors and mobile operators because of the technical complexity and the immense costs involved in the infrastructure.

The UMTS Technical Note is the latest in the NetTest series of technical notes. Our aim in publishing the technical notes is to provide our customers with clear and accurate information on the most relevant technologies. At the same, this technical note is intended to serve as quick reference guide for the many complex issues surrounding UMTS.

Apart from serving as a quick reference guide and important tool in the day-to-day work, the UMTS technical note also forms part of the material used in the NetTest training programs.

Chapter 1 through 3 dives into the UMTS technology and describes in details the structure, the network interfaces and protocols, as well as the network functionality, and the signaling procedures.

Chapter 4 and 5 cover two key aspects in UMTS: security and Quality of Service.

Chapter 6 briefly outlines NetTest’s offerings within UMTS network monitoring and optimization to aid our customers face the increasing challenges in a highly competitive market place, allowing mobile operators troubleshoot and optimize network and service performance.

UMTS Technical Note Page 2 of 83

TABLE OF CONTENTS 1. UMTS Network Overview................................................................................................................... 5 1.1 Introduction .......................................................................................................................................... 5 1.2 Standardization .................................................................................................................................... 7 1.3 The UMTS Releases............................................................................................................................ 7 1.4 The Services on a UMTS Network ...................................................................................................... 8 1.5 The Network Components of a UMTS Network................................................................................. 10 2. UMTS Network Interfaces and Protocols ...................................................................................... 20 2.1 Overview ............................................................................................................................................ 20 2.2 General UTRAN Interface Protocols Architecture ............................................................................. 20 2.3 The UTRAN Interfaces....................................................................................................................... 24 2.4 Core Network (CN) Protocols ............................................................................................................ 33 3. UMTS Network Functionality .......................................................................................................... 37 3.1 User Equipment (UE) and Network States ........................................................................................ 37 3.2 Elementary Procedures ..................................................................................................................... 41 3.3 Mobility Management......................................................................................................................... 48 3.4 Radio Resource Management (RRM) ............................................................................................... 53 3.5 CS Service Example: Mobile Terminating (MT) Voice Call................................................................ 59 3.6 PS Service Example: MT Data Connection (Interactive) ................................................................... 60 4. UMTS Security and Ciphering ........................................................................................................ 61 4.1 Security .............................................................................................................................................. 61 4.2 Ciphering............................................................................................................................................ 62 5. Mobile Quality of Service (QoS) ..................................................................................................... 65 5.1 Introduction ........................................................................................................................................ 65 5.2 What is Quality of Service (QoS)? ..................................................................................................... 65 5.3 Mechanisms for Delivering QoS ........................................................................................................ 66 6. UMTS Testing ................................................................................................................................... 70 6.1 Hot Spot Expert Analysis Tools .......................................................................................................... 71 6.2 End-to-End Network Monitoring......................................................................................................... 73 7. Terms and Abbreviations ................................................................................................................ 75 8. Websites ........................................................................................................................................... 81 9. References........................................................................................................................................ 82


TABLE OF FIGURES Figure 1.1 The evolution of mobile telephony............................................................................................... 5 Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks. ...................... 6 Figure 1.3 The 3GPP organizations. ............................................................................................................ 7 Figure 1.4 GSM/GPRS/UMTS network architecture. ................................................................................. 10 Figure 1.5 GERAN architecture...................................................................................................................11 Figure 1.6 UTRAN architecture. ................................................................................................................. 12 Figure 1.7 Serving RNC. ............................................................................................................................ 13 Figure 1.9 UMTS network architecture....................................................................................................... 14 Figure 1.10 Core network elements - CS domain. ..................................................................................... 15 Figure 1.11 The signaling gateway function. .............................................................................................. 16 Figure 1.12 Core network elements - PS domain. ..................................................................................... 16 Figure 1.13 The HSS is a superset of the HLR. ......................................................................................... 17 Figure 1.14 The IP Multimedia Subsystem................................................................................................. 18 Figure 2.1 Simplified UMTS structure showing three significant parts....................................................... 20 Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN..................................... 21 Figure 2.3 Control plane UE to PS Core Network (3G-SGSN). ................................................................. 22 Figure 2.4 Control plane UE to CS Core Network (MSC). ......................................................................... 22 Figure 2.5 Circuit and Packet Switched Mobility Management. ................................................................. 23 Figure 2.6 User plane UE to PS Core Network. ......................................................................................... 24 Figure 2.7 User plane UE to CS Core Network.......................................................................................... 24 Figure 2.8 General structure of the UTRAN interfaces. ............................................................................. 25 Figure 2.9 The Iu interface connects the UTRAN to the CN. ..................................................................... 25 Figure 2.10 The Iu-CS control plane protocol stack. .................................................................................. 26 Figure 2.11 The Iu-PS protocol stack. ........................................................................................................ 28 Figure 2.12 The Iub protocol stack. ............................................................................................................ 29 Figure 2.13 The Iur protocol stack.............................................................................................................. 30 Figure 2.14 Radio interface protocol architecture (service access points marked by circles). .................. 31 Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR................................ 33 Figure 2.16 MAP services as defined in 3G TS 29.002. ............................................................................ 34 Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces. ............................................... 35 Figure 2.18 Control plane SGSN-MSC/VLR. ............................................................................................. 35 Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces. ................................................... 36 Figure 3.1 UE and CN MM states............................................................................................................... 37 Figure 3.2 UE and CN PMM states. ........................................................................................................... 38 Figure 3.3 RRC states. ............................................................................................................................... 39 Figure 3.4 UE state overview...................................................................................................................... 40 Figure 3.5 PDP states................................................................................................................................. 40 Figure 3.6 CS Paging Procedure in Iu mode.............................................................................................. 41


Figure 3.7 CS signaling connection establishment. ................................................................................... 42 Figure 3.8 Signaling connection Release................................................................................................... 43 Figure 3.9 Authentication and security procedure. ..................................................................................... 43 Figure 3.10 CS Service Request and RAB Allocation. ............................................................................... 44 Figure 3.11 PS Service Request and RAB Allocation. ............................................................................... 44 Figure 3.12 PS Service and RAB Release................................................................................................. 45 Figure 3.13 CS Service and Iu Release. .................................................................................................... 45 Figure 3.14 CS RAB Allocation................................................................................................................... 46 Figure 3.15 PS RAB Allocation................................................................................................................... 47 Figure 3.16 RAB Release procedure.......................................................................................................... 47 Figure 3.17 Combined GPRS/IMSI Attach procedure with LU................................................................... 49 Figure 3.18 UE initiated combined GPRS/IMSI Detach procedure............................................................ 50 Figure 3.19 LA containing RAs and cells within URA................................................................................. 50 Figure 3.20 UMTS LA/RAU procedure....................................................................................................... 52 Figure 3.21 URA Update. ........................................................................................................................... 53 Figure 3.22 Cell update. ............................................................................................................................. 53 Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs.54 Figure 3.24 Soft handover. ......................................................................................................................... 54 Figure 3.25 Before and after hard handover/SRNS relocation and RAU................................................... 55 Figure 3.26 Hard handover and SRNS relocation...................................................................................... 56 Figure 3.27 UMTS to GSM Handover......................................................................................................... 56 Figure 3.28 UMTS to GPRS cell relocation................................................................................................ 57 Figure 3.29 CS service: MT voice call. ....................................................................................................... 59 Figure 3.30 PS service: MT data connection (interactive).......................................................................... 60 Figure 4.1 Overview of the security architecture in Rel-4........................................................................... 61 Figure 4.2 Security between networks. ...................................................................................................... 63 Figure 5.1 QoS segments........................................................................................................................... 65 Figure 5.2 UMTS QoS architecture. ........................................................................................................... 67 Figure 5.3 QoS attributes and their usage. ................................................................................................ 67 Figure 5.4 Using traffic classes to achieve required QoS. ......................................................................... 68 Figure 5.5 UMTS QoS classes. .................................................................................................................. 69 Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics............... 70 Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools................................................ 71 Figure 6.3 The InterQuest is a powerful tool with the ability to capture large amounts of data from multiple

links in both access and core network. ................................................................................... 71

Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most complete surveillance solution available today. MasterQuest UMTS builds on this platform. 73

Figure 6.7 MasterQuest performs network-wide correlation and monitors end-to-end service delivery performance ............................................................................................................................ 73


1. UMTS Network Overview 1.1 Introduction Communication has always been essential to mankind. When two people meet, they only need their voice to communicate, but as the distance increases the need for tools arises. When Alexander Graham Bell invented the telephone in 1876, a significant step was taken to enable two people to talk together, however far apart they may be – that is, as long as they are near a telephone set! For more than a century wire line telephony has been the solution for voice communication over distance for most people. Radio based communication systems not depending on a wire for network access were developed for special purposes (e.g. military, police, naval and closed car radio nets), and eventually systems emerged allowing people to communicate via telephones with radio rather than wire line access. They were primarily intended for people driving in cars and were known as mobile telephony systems. During the early 1980s, the first generation (1G) of mobile telephone systems based on analog technology was experiencing rapid growth in many European countries. Each country developed its own system, each incompatible with the others in terms of equipment and operation. This led to a wish and a need for a common European mobile communication system with high capacity and pan-European coverage. The latter implied that the same mobile telephones could be used in all European countries and that incoming calls would automatically be routed to the mobile phone independent of location (automatic roaming). In addition it was expected that one single European market with common standards would lead to cheaper user equipment and vendor-independent network elements. Finally, the use of modern digital technology would result in smaller hand-held devices coupled with improved functionality and quality. In 1982 the CEPT (Conference of European Posts and Telegraphs) formed a study group called the Groupe Spécial Mobile (GSM) to study and develop a pan-European public land mobile system – the second generation of cellular telephony (2G). The name of the study group - GSM - was also used for the mobile system. In 1989, GSM responsibility was transferred from CEPT to the ETSI (European Telecommunication Standards Institute). Originally GSM was only intended for the ETSI member countries. However, many other countries have also implemented GSM – e.g. Eastern Europe, the Middle East, Asia, Africa, the Pacific Basin and North America (with a derivative of GSM called PCS1900). The name GSM – now meaning the Global System for Mobile communication – is thus very appropriate.

Figure 1.1 The evolution of mobile telephony. GSM has been around for a decade and has turned into an overwhelming success, being very widely deployed in most parts of the world. The system is well suited for voice communication and is also extensively used for Short Message Service (SMS) information transfer. Circuit switched data services were also covered by the GSM specification, as the integrated wireless access to voice and data services was one of the goals for the system. However, the offered access speed (max. 9600 baud) has limited the use of the GSM system for data applications. ETSI have defined several solutions to improve the data access of the mobile network often referred to as 2.5G. This is to indicate that they represent a step forward compared to GSM, but these systems are still quite tightly connected to GSM: HSCSD (High Speed Circuit Switched Data), GPRS (General Packet Radio System) and EDGE (Enhanced Data rates for Global/GSM Evolution). HSCSD is the simplest enhancement of the GSM system for data: Like GSM it is based on circuit switched connections, but a better utilization of the available bandwidth and allocation of more than one time slot per connection allows higher data rates – theoretically up to 57.6 kbps. However, the circuit switched nature of HSCSD makes it inefficient for data traffic, as this is packet oriented.


GPRS is designed as a packet data service with a theoretical maximum data rate of approx. 170 kbps. GPRS co-exists with the GSM network, reusing the basic structure of the access network. GPRS is an extension of GSM networks with data services carried on the existing radio infrastructure, while the core network is enhanced by a packet overlay with new components and interfaces. GPRS supports combined voice and data services and enables multimedia services. EDGE is an enhancement of the GSM/GPRS system using a new air interface modulation technique that allows the bit rate on the air interface to be increased considerably. EDGE will increase the theoretical maximum data rate to 384 kbps.

Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks. The UMTS (Universal Mobile Telecommunication System) – third generation cellular telephony (3G) – is expected to do more than merely provide better and faster mobile communication. UMTS will also enable combination of voice and data services in a new way, for example facilitating multimedia and end-to-end broadband services. In summary, UMTS will mean the following for operators and their customers: UMTS for customers: • Worldwide wireless access using a single handset

• A wide range of multimedia services with appropriate quality levels

• The third generation mobile standard enables mobile users to harness the full power of the Internet through efficient high-speed radio transmission, optimized for multimedia communications

• UMTS will make the dream of anywhere, anytime communications a reality

UMTS for the operator: • Unification of the diverse wireless access systems we see today into a flexible radio infrastructure

• Evolution from earlier "legacy" systems, ensuring global economies of scale and supply while allowing:

- Plenty of scope for product and service differentiation

- Choice of radio access methods and core networks in order to flexibly implement and evolve their systems based on the regulatory, market or business requirements for each region or country

For operators there is a huge difference in the investment required to provide a 2.5G (GPRS) compared to a 3G system. 2.5G requires relatively small investments for the necessary modifications of the radio access network and add-on equipment (a packet switched core network) on top of existing GSM networks, while UMTS requires a very large investment, as most of the network must be created from the ground up. EDGE will also require huge investments, as a new radio access network will be needed.


For existing GSM operators, 2.5G technologies will be attractive as they can be implemented based on the operation licenses operators already have, while UMTS requires new (and in several countries expensive) licenses. For users GPRS will be a major step forward with new services, while UMTS is mainly an extension of these services. Thus the success of GPRS and the services it offers will be an important indicator of which services will drive the success of coming 3G UMTS networks.

1.2 Standardization One of the driving forces behind UMTS is the desire to create a truly universal system. This is why the standardization work has been moved from ETSI to a new organization: “Third Generation Partnership Project” (3GPP) with the participation of a number of regional and national standardization organizations. Market considerations are handled by an additional partnership – the “Market Representation Partners” (MRP).

Figure 1.3 The 3GPP organizations. The 3GPP creates a common standard based on the inputs from the participating organizations. The Operator Harmonization Group (OHG) has been set up to find necessary compromises in the event that the 3GPP is unable to reach agreement. In addition to these bodies, the Third Generation Partnership Project Number 2 (3GPP-2) ensures that North American IS-95 radio technology based systems are taken into account. Even though it is based on existing GSM/GPRS networks, UMTS adds several new components and interfaces to the core network. The radio access network is also entirely new, based on a new technology, Wideband Code Division Multiple Access (WCDMA) with better usage of the spectrum than today’s GSM, resulting in support for higher data rates, more capacity and subsequently, more subscribers. Eventually UMTS will cause a complete rearrangement of the GSM/GPRS/UMTS core network, as all-IP technology will emerge.

1.3 The UMTS Releases In the standardization of UMTS within the 3GPP, UMTS has been defined in a set of phases – or releases. So far three releases have been defined: UMTS Release 1999 (R99 – sometimes also referred to as Release 3/Rel-3), UMTS Release 4 (Rel-4) and UMTS Release 5 (Rel-5). The network architectures figure in section 1.5 indicates how the releases affect the network. The UMTS releases are the three main deliverables of approved specifications from 3GPP. The major headlines for each release are: R99 • Defines the UMTS Universal Terrestrial Radio Access Network (UTRAN)

• The Radio Network Subsystem (RNS) is added to the existing GSM/GPRS network

• The Core Network (CN) is the existing GSM/GPRS network with some enhancements

Rel-4 • Rel-4 introduces Media Gateway (MGW), the Mobile Switching Center (MSC) server and the Signaling Gateway (SGW).

This allows user data and signaling to be logically separated in the MSC

• UTRAN enhancements that include support of even higher data rates, in local areas up to 2 Mbps


Rel-5 • IP Multimedia (IM) Subsystem (IMS) is added

• The Home Location Register (HLR) is replaced by/extended to a Home Subscriber Server (HSS)

• UTRAN improvements to enable efficient IP-based multimedia services in UMTS

• Introduction of IubFlex (allows Radio Network Controllers (RNCs) to connect to more than one set of Node Bs)

• Enhancements of Location Services (LCS)

• all-IP network will eventually become a reality

• Rel-5 will be based on IPv6

The above releases are in the "Frozen" state, which means that revisions are allowed if a correction is needed (i.e. new features are no longer added). A release 6 is planned and more releases are likely to follow: They may cover areas like IMS enhancements, Wireless LAN Integration (WLANI), Internet convergence (regarding protocols and services), Multimedia Broadcast/Multicast Service (MBMS) and evolution to the network within the Packet Switched (PS) domain only. This note will for the most part be based on Rel-4. Other releases will however be mentioned in some cases to highlight major differences to Rel-4.

1.4 The Services on a UMTS Network As the UMTS network evolves, more and more services will be supported. With UMTS Rel-5 the mobile network will support services like those known from the Internet today, e.g. video streaming, Voice over IP (VoIP), video conferencing and interactive services. The circuit switched part of the network will change and be put on top of a packet-oriented technology (most likely IP), to support higher data rates and to increase flexibility in the network. The packet switched part of the network will not change much, but a new packet domain will be added: the IP Multimedia Subsystem (IMS).

1.4.1 General Services The basic services provided by UMTS are similar to those known from GSM and ISDN (Integrated Services Digital Network). Using the ITU-T definitions, telecommunication services can be divided into bearer services, teleservices, and supplementary services. The most basic teleservice supported by UMTS is voice telephony. As with all other communications, speech is digitally encoded and transmitted through the network as a digital stream. A variety of data services are offered implemented as packet switched data communication. The Short Message Service (SMS), introduced together with GSM will also be available. Supplementary services are provided on top of teleservices e.g.: • Call Forwarding/Barring/Waiting/Hold

• Three Party Service

• Advice of Charge

• Caller identification

• Closed user groups

1.4.2 Quality of Service One of the enhancements of 2.5G and 3G networks is the improved support of data communication. To facilitate this, both GPRS and UMTS have introduced the concept of Quality of Service (QoS) as an integrated part of the system. Having an effective QoS mechanism in place enables mobile operators to cost-effectively deliver high-value, differentiated, IP-based applications and services. QoS is discussed in detail in chapter 5.

1.4.3 UMTS Service Capabilities The way UMTS is defined separates as far as possible the part of the network that makes actual connections from the part that maintains services. This facilitates more openness and potential in the market and allows a concept of separate providers of contents, service and carriers. Some of these services are listed below.


1.4.3.1 Location Based Services The geographic position of the User Equipment (UE) can be given by measuring radio signals. There are many different possible applications for positioning information. The positioning functions may be used internally by the UTRAN for radio system performance optimization, by value-added network services, by the UE itself or through the network, and by "third party" services. Typical commercial services are: • Traffic information

• Fleet management

• “Follow me”

• “Nearest service”

• Emergency services

UMTS network planners can also use this information. Location based services can also be implemented in GSM/GPRS networks where they are based on the signaling between the network and the Mobile Station (MS – the GSM/GPRS equivalent of the UE). 1.4.3.2 WAP Service WAP (Wireless Application Protocol) is Internet access optimized for mobile telephony. It will allow the mobile user to gain access to Internet information and services anywhere anytime, for example e-mail, flight schedules etc. The WAP service capability provides the user with a web-browser that uses a Wireless Markup Language (WML) instead of the HyperText Markup Language (HTML) normally used on the Internet. WML is designed for use with mobile terminals. Gateways in the system will take care of the conversion between the WAP format and the normal Internet format. 1.4.3.3 Multimedia Messaging Service (MMS) The Multimedia Messaging Service (MMS) is used for delivering multimedia messages to a UE, from either another UE, a fixed point on the Internet or a Value Added Service (VAS) provider. Value-added services could be news, weather broadcasts, stock exchange information etc. Multimedia messages can contain all types of media in addition to text, e.g. speech, video, audio and still images. 1.4.3.4 CAMEL The Customized Applications for Mobile networks Enhanced Logic (CAMEL) is a common platform for a number of services for customers. It provides the UMTS network with Intelligent Network (IN) features like: • Prepaid

• Call screening

• Supervision

CAMEL allows the necessary information to be exchanged between networks (IN features are normally network specific). Traditional IN solutions create circuit switched services. CAMEL will do this and also interact with packet switched connections.

1.4.4 Virtual Home Environment (VHE) The VHE is a service concept within UMTS that enables the user to have the same personalized interface to the network regardless of the network accessed. It requires that networks transfer information on user profiles, charging, services and number portability, which considering the complexity of the networks is not a trivial task. Where the VHE requires network-network communication, the CAMEL will be used.


1.5 The Network Components of a UMTS Network

Figure 1.4 GSM/GPRS/UMTS network architecture. The figure above shows some of the subsystems in GSM/GPRS/UMTS networks, as they will evolve with the UMTS releases. On the access network side there is the Base Station Subsystem (the GERAN) for GSM/GPRS and the RNS (the UTRAN) for UMTS. The CN is based on the GSM/GPRS core network, but as indicated, UMTS Rel-4 and Rel-5 will modify some subsystems and components and add others. This allows existing GSM/GPRS network operators to benefit from the improved cost-efficiency of UMTS while protecting their 2G investments and reducing the risks of implementation. There are also other entities in the network such as the location services entities, which are used for location calculation. The GSM/GPRS/UMTS network interfaces with other Public Land Mobile Networks (PLMNs) including pre Rel-4 networks, the PSTN and other IP-based multimedia networks.

1.5.1 Access Network Elements Two types of access network are defined for GSM/GPRS/UMTS network; the BSS used for GSM, GPRS and EDGE access (the GERAN), and the RNS (the UTRAN) used for WCDMA access.


1.5.2 The GSM/EDGE Radio Access Network (GERAN) Architecture The GERAN is the access network defined for GSM, GPRS and EDGE. The GERAN is connected to the GSM Phase 2+ CN either via two legacy interfaces (the A-interface and the Gb interface), or through the Iu interfaces. The interface between the GERAN and the PS domain of the CN (the Iu-PS or the legacy Gb interface) is used for packet switched data, and the interface between the GERAN and the Circuit Switched (CS) domain of the CN (Iu–CS or the legacy A interface) is used for circuit switched voice or data.

Figure 1.5 GERAN architecture.

1.5.2.1 Base Station Subsystem (BSS) The BSS or the GERAN is the system of base station equipment (transceivers, controllers, etc.), which is responsible for communicating with mobile stations in a certain area. The BSS is connected to the MSC through a single A or Iu-CS interface. Similarly, in PLMNs supporting GPRS, the BSS is connected to the Serving GPRS Support Node (SGSN) through a single Gb or Iu-PS interface. The radio equipment of a BSS may support one or more cells. A BSS may consist of one or more base stations. Where an Abis-interface is implemented, the BSS consists of one Base Station Controller (BSC) and one or more Base Transceiver Station (BTS). The BTS and the BSC communicate across the Abis interface. 1.5.2.2 Base Transceiver Station (BTS) The BTS contains the radio transmitters and receivers (transceivers – TRX) covering a certain geographical area of the GSM network (a base station area consisting of one or more radio cells). The BTS handles the radio link protocols with the MS. 1.5.2.3 Base Station Controller (BSC) The BSC controls a group of BTSs regarding radio channel setup, power control, frequency hopping, and handovers - the transfer of a call in progress from one radio channel to another, typically as a result of an MS moving from one base station area to another. The BSC is the connection between the mobile station and the MSC.


1.5.2.4 GSM Mobile Station (MS) The GSM MS consists of the mobile equipment (the terminal) and the Subscriber Identity Module (SIM) card. The SIM provides personal mobility, providing user access to subscribed services irrespective of a specific terminal. The International Mobile Equipment Identity (IMEI) uniquely identifies the mobile equipment. The SIM card contains the International Mobile Subscriber Identity (IMSI) used to identify the subscriber to the system, a secret key for authentication, and other information. The IMEI and the IMSI are independent, thereby allowing personal mobility. The MS communicates with the GSM network via the radio interface (Um Interface). In relation to UMTS the MS must operate in one of the following two modes: • A mode based on A/Gb interfaces between BSS and CN e.g. for:

- pre-Release 4 terminals

- Rel-4 terminals when connected to a BSS with no Iu interface towards the CN

• A mode based on Iu-CS and Iu-PS between BSS and CN for:

- Rel-4 terminals when connected to a BSS with Iu interfaces towards the CN

1.5.3 Universal Terrestrial Radio Access Network (UTRAN) Architecture UMTS R99 saw the introduction of a new radio access network, the UTRAN. The UTRAN is based on WCDMA technology, introduced in order to achieve a better bandwidth efficiency compared to the techniques used in GSM/GPRS. The UTRAN is connected via the Iu to the GSM Phase 2+ CN; the interface between UTRAN and the PS domain of the CN (Iu–PS) is used for packet switched data, and the interface between UTRAN and the CS domain of the CN (Iu–CS) is used for circuit switched data. There is actually a third domain, the BroadCast (BC) domain, which can used to broadcast a short message to a given geographical area (“service area”, being one or more cells). The interface to the BC domain is called Iu-BC. It is not shown in the figure in section 1.5.2 and will not be described further here. 1.5.3.1 Radio Network Subsystem (RNS) The UTRAN consists of one or more RNSs connected to the CN via the Iu interfaces. Each RNS consists of a RNC and one or more Node Bs. The Node Bs are connected to the RNCs via the Iub interface. The Node Bs provide radio access (i.e. antennas) to the network. The RNCs of each RNS can be interconnected via the Iur interface

Figure 1.6 UTRAN architecture.


1.5.3.2 The Radio Network Controller (RNC) Each RNC has responsibility for and control over the radio resources of a set of cells. The RNC is equivalent to a GSM/GPRS BSC but is more self-controlled. A RNC may have different roles in the UTRAN network: • Controlling RNC

- Each RNC is responsible for the resources of its set of cells and the Node Bs in its RNS. In this role the RNC is called the Controlling RNC (CRNC)

• Serving RNC

- For each connected UE the RNCs may have an additional role: A Serving RNC (SRNC) providing radio resources to the connected UE. The SRNC terminates the Iu towards the CN

Figure 1.7 Serving RNC.

• Drift RNC

- In order to minimize the effect of handovers, RNCs may have a third role: A Drift RNC (DRNC). A DRNC provides (“lends”) resources to a SRNC for a specific UE. The DRNC will normally also act as a SRNC (or DRNC) for other UEs

Figure 1.8 Drift RNC.


1.5.3.3 The Node B The Node B handles the transmission and reception of signals in one or more cells, similar to GSM BTS. The Node B is also responsible for the inner loop power control. Please refer to section 3.5 for more information on power control. 1.5.3.4 User Equipment (UE) The UE is equivalent to the GSM MS, i.e. it is the terminal through which the users access the network. The UE consists of the mobile equipment (the terminal) and a Universal Service Identity Module (USIM). The mobile equipment is uniquely identified by the IMEI. In order to allow future enhancements, the terminal equipment should have an Application Programming Interface (API). The USIM provides personal mobility, providing the user with access to subscribed services. Unlike the GSM SIM card, the USIM card may hold a number of profiles. Each profile will have a specific purpose. It can be used to adjust the available services to the capabilities of the terminal into which the USIM card is installed. Both the user and the network can adjust the profiles.

1.5.4 Core Network Elements

Figure 1.9 UMTS network architecture. The CN is logically divided into a CS domain and a PS domain. In addition, a set of databases (“Registers”) is used for storage of information needed by the system. The different entities in the domains are described below.


1.5.5 Core Network Elements – Circuit Switched (CS) Domain

Figure 1.10 Core network elements - CS domain. 1.5.5.1 Mobile Switching Center/Gateway Mobile Switching Center (MSC/GMSC) The central component of the CS domain in the CN is the MSC. The MSC is an exchange, which performs all the switching and signaling functions for MSs located in a geographical area designated as the MSC area. The main difference between an MSC and an exchange in a fixed network is that the MSC has to take into account the impact of the allocation of radio resources and the mobile nature of the subscribers, which means it performs procedures such as: • Procedures required for the location registration

• Procedures required for handover

The MSC/GMSC constitutes the interface between the radio system and the fixed networks. The MSC performs all necessary functions in order to handle the circuit switched services to and from the mobile stations. The MSC is responsible for call control (setup, routing, control and termination of the calls), management of inter-MSC handover and supplementary services, and for collecting charging/accounting information. The MSC is connected to the location and equipment registers and to other MSCs in the same network. The GMSC acts as the gateway to other mobile networks and the public-switched networks (telephone network, ISDN and data networks). In order to obtain radio coverage of a given geographical area, a number of base stations are normally required; i.e. each MSC would thus have to interface several base stations. In addition several MSCs may be required to cover a country. 1.5.5.2 Media Gateway/Mobile Switching Center (MGW/MSC) Server To enable bearer-independent (and thus enabling all-IP based networks) CS network architecture in Rel-4, the MSC is split into an MGW for transport of user data and an MSC server for signaling. The MSC server mainly comprises the Call Control (CC) and mobility control parts of an MSC. The split into MGW and MSC server also results in a more independent environment for service creation. The new CAMEL features benefit from this concept when the service control gets independent from the switching fabric.


MGW is the PSTN/PLMN transport termination point and interfaces UTRAN with the CN over Iu. The MGW may terminate bearer channels from a circuit switched network and media streams from a packet network (e.g. RTP (Real-time Transport Protocol) streams in an IP network). 1.5.5.3 Signaling Gateway (SGW) A SGW converts signaling (both ways) at transport level between the SS7 based transport of signaling used in pre-Rel 4 networks, and the IP based transport of signaling possibly used in post-R99 networks (i.e. between Sigtran SCTP/IP and SS7 MTP). The SGW does not interpret the application layer (e.g. MAP, CAP, BICC, ISUP) messages but may have to interpret the underlying SCCP (Signaling Connection Control Part) or SCTP (Stream Control Transmission Protocol) layer to ensure the correct routing of the signaling. The SGW will be necessary to obtain an all-IP UMTS network. The signaling gateway function may be implemented as a stand-alone entity or inside another entity.

Figure 1.11 The signaling gateway function.

1.5.6 Core Network (CN) Elements – Packet Switched (PS) Domain

Figure 1.12 Core network elements - PS domain.


1.5.6.1 Serving GPRS Support Node (SGSN) The SGSN acts as a packet switch and router in the PS domain of the CN. The SGSN controls the access of the MS to the network and routes packets to the right BSC/RNC. It performs Mobility Management (MM) functions similar to the MSC in the CS domain of the CN such as location registration, Routing Area Updates (RAUs) and paging. The SGSN also handles security functions such as authentication and ciphering (between the MS/UE and the SGSN). 1.5.6.2 Gateway GPRS Support Node (GGSN) The GGSN acts as a packet router in the PS domain of the CN and is the gateway between the mobile IP packet routing of the GPRS/UMTS network and the fixed IP routing of the Internet. It transfers packets between the IP multimedia networks and the appropriate SGSN, which currently serves the MS/UE. If the MS changes the SGSN during ready mode, the GGSN is used as a data packet buffer. The GGSN stores subscriber data for active MSs/UEs and performs security functions such as firewall and screening.

1.5.7 Core Network (CN) Elements – Registers 1.5.7.1 Home Location Register (HLR) The HLR is an independent core network element up to and including Rel-4. In Rel-5 the HLR is replaced by the HSS (Home Subscriber Server – see next section), which is a superset of the HLR. The HLR contains all the administrative information of each subscriber registered in the particular network, information on permitted services, and the current location of the mobile. The location of the mobile is typically in the form of the signaling address of the Visitor Location Register (VLR) associated with the MS. There is logically one HLR per network, although it may be implemented as a distributed database. The HLR provides functionality like: • Support to PS domain entities such as the SGSN and GGSN, through the Gr and Gc interfaces. It is needed to enable

subscriber access to the PS domain services

• Support to CS domain entities such as the MSC/MSC server and GMSC/GMSC server, through the C and D interfaces. It is needed to enable subscriber access to the CS domain services and to support roaming to legacy GSM/UMTS CS domain networks

1.5.7.2 Home Subscriber Server (HSS)

Figure 1.13 The HSS is a superset of the HLR. In UMTS Rel-5 the HSS replaces the HLR. The HSS is a superset of the HLR and contains all the functionality of the HLR plus additional functionality to support the IM functionality of the IMS (please refer to section 1.5.8). The HSS is an entity common to the PS and CS domains. The HSS is the master database for a given user and contains the subscription related information to support the network components handling calls/sessions, for example support to the call control servers in order to complete routing/roaming procedures by solving authentication, authorization, naming/addressing resolution and location dependencies. A UMTS Network may contain one or several HSSs, depending on the number of mobile subscribers, the capacity of the equipment, and the organization of the network.


The HSS consists of the following functionalities: • IM functionality to provide support to control functions of the IMS such as the Call State Control Function (CSCF). It is

needed to enable subscriber access to the IM CN subsystem services

• The subset of the HLR functionality required by the PS domain

• The subset of the HLR functionality required by the CS domain, if it is desired to enable subscriber access to the CS domain or to support roaming to legacy GSM/UMTS CS domain networks

The HSS contains the following user-related information: • User identification, numbering and addressing information

• User security information

- Network access control information for authentication and authorization

• User location information at inter-system level

- The HSS supports the user registration, and stores inter-system location information, etc.

• User profile information (i.e. parameter settings for specific purposes)

1.5.7.3 Visitor Location Register (VLR) The VLR contains selected administrative information from the HLR, necessary for call control and provision of the subscribed services, for each mobile currently located in a Location Area (LA) controlled by the VLR. Each time an MS performs roaming in a new LA, the VLR covering that LA informs the HLR about the new location of the subscriber. The HLR subsequently informs the VLR about the services to which the subscriber has access. The VLR also controls the assignment of TMSI. The HLR and the VLR, together with the MSC, provide the call routing and roaming capabilities of the network. In most implementations the VLR is integrated with the MSC, and with UMTS Rel-4 it will be a part of the MSC server. 1.5.7.4 Authentication Center (AuC) The AuC is a protected database that contains the individual subscriber-identification keys (also contained in SIM), and provides the subscriber data to HLR and VLR (via HLR) used for authentication and encryption of calls. 1.5.7.5 Equipment Identity Register (EIR) The EIR is a database that contains a list of all valid mobile equipment on the network, and in which each MS is identified by its IMEI. An IMEI is marked as invalid if the mobile has been reported stolen or is not type approved.

1.5.8 IP Multimedia Subsystem (IMS)

Figure 1.14 The IP Multimedia Subsystem.


The IMS is the major difference between UMTS Rel-4 and Rel-5. The IMS comprises all CN elements for provision of multimedia services. IM services are based on a session control capability defined by the Internet Engineering Task Force (IETF). IM services, along with multimedia bearers, utilize the PS domain - possibly including an equivalent set of services to the relevant subset of CS Services. The IMS enables PLMN operators to offer multimedia services to their subscribers based on and built upon Internet applications, services and protocols. 3GPP has no intention of standardizing such services within the IMS. The intention is that these services will be developed by PLMN operators and third party suppliers, including those in the Internet space, using the mechanisms provided by the Internet and the IMS. The IMS should enable the convergence of, and access to, voice, video, messaging, data and web-based technologies for the wireless user, and combine the growth of the Internet with the growth in mobile communications. The specific functional elements of the IMS are described below. • The CSCF which can have three roles:

- Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IMS. The Policy Control Function (PCF) is a logical entity of the P-CSCF

- Interrogating-CSCF (I-CSCF) is the contact point within an operator’s network for all IMS connections destined to a user of that particular network operator

- Serving-CSCF (S-CSCF) performs the session control services for the UE

• The Media Gateway Control Function (MGCF) performs protocol conversion between ISUP (ISDN User Part) and the IMS call control protocols (e.g. ISUP/SIP (Session Initiation Protocol) conversion)

• The Multi Resource Function (MRF) performs multiparty call and multimedia conferencing functions

• The IP Multimedia Media Gateway (IM-MGW) terminates bearer channels from a switched circuit network and media streams from a packet network. The IM-MGW may support media conversion, bearer control and payload processing (e.g. codec, echo canceller, conference bridge)


2. UMTS Network Interfaces and Protocols 2.1 Overview The figure below gives a simplified view of the UMTS architecture. It splits UMTS in 3 significant parts: The UE, the access network (UTRAN) and the CN.

Figure 2.1 Simplified UMTS structure showing three significant parts. The information that flows through the UTRAN is logically split into two parts: • The access stratum - being information required for the interaction between the UE and the UTRAN

• The Non Access Stratum (NAS) - being information transferred between the CN and the UE across the UTRAN

The reason for this split is a desire to make the information transfer between CN and UE independent of the radio handling in the UTRAN.

2.2 General UTRAN Interface Protocols Architecture The UTRAN interface protocols consists of 3 parallel protocol stacks: • The control plane which amongst other things conducts the signaling that enables the transport of user data

• The user plane is where the user data are actually transported

• The Transport Network Control Plane (TNCP)

- The transport channels in the user plane are dynamic. The TNCP makes it possible to establish and remove transport channels on a given UTRAN interface


Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN.

2.2.1 Control Plane The control plane is used for signaling between the UE and the network. The control plane includes an (upper layer) application protocol (RANAP/RNSAP/NBAP) and a (lower layer) signaling bearer for transporting the application protocol messages. The application protocol is used for things like setting up bearers (i.e. Radio Access Bearer (RAB) or radio link) in the radio network layer, controlling different transmission resources and handover). In the three-plane structure the bearer parameters in the application protocol are not directly tied to the user plane technology; they are general bearer parameters. The control plane protocols include a mechanism for transparent transfer of NAS messages. The lower layer – the signaling bearers - for application protocol, is a part of the transport network user plane. The control actions required for setting up the signaling bearers are Operations & Maintenance (O&M) actions.

2.2.2 User Plane The user plane includes the data streams and the data bearers for the data streams. The data streams are characterized by one or more frame protocols specified for that interface. The user plane protocols implement the radio access bearer service, i.e. carries the user data through the access stratum. The lower layer – the data bearers - in the user plane is a part of the transport network user plane. The transport network control plane directly controls the data bearers in transport network user plane during real-time operation.

2.2.3 Transport Network Control Plane (TNCP) Many of the bearers in the UTRAN network are dynamically created as required (in the form of an ATM virtual circuit), and closed afterwards. The TNCP handles this. The TNCP does not have a radio network layer. It includes the ALCAP protocols needed to set up the transport bearers (data bearer) for the user plane and the signaling bearer for the ALCAP protocols. The TNCP allows the application protocol in the radio network control plane to be independent of the data bearer technology in the user plane. When the TNCP is used, a control plane application protocol signaling transaction triggers the ALCAP protocol to set up of the data bearer. The ALCAP protocol is specific for the user plane technology used. ALCAP is however not used for all types of data bearers. If there is no ALCAP signaling transaction, the TNCP is not needed at all. This is the case when pre-configured data bearers are used.


The signaling bearer for ALCAP is always set up by O&M actions and it may or may not be of the same type as the signaling bearer for the application protocol.

2.2.4 End-to-End View of UTRAN Protocols

Figure 2.3 Control plane UE to PS Core Network (3G-SGSN).

Figure 2.4 Control plane UE to CS Core Network (MSC).


At the top of the control plane, NAS control messages are carried. These messages are used for GPRS Mobility Management/Session Management and Mobility Management/Call Control (GMM/SM, respective MM/CC): GMM/SM and MM/CC are described in 3GPP TS 24.008. Figure 2.5 summarizes the MM/GMM/SM/CC functionality:

Circuit Switched Packet Switched Mobility Management (MM) GPRS Mobility Management (GMM)

Registration • IMSI detach indication • Location updating Security • Authentication • Identity • TMSI reallocation Connection management • CM service • Abort Miscellaneous • MM information/status

• Attach and Detach • P-TMSI reallocation • Authentication and ciphering • Identity request/ response • Routing area update • GMM Status/ Information • Service Request/Accept/Reject

Circuit-mode connections Call Control (CC) GPRS Session Management (SM)

Call establishment • Alerting • Call proceeding/confirmed • Connect/ connect acknowledge • Progress • Setup Call information phase • Modify • User information • Call clearing • Disconnect • Release/ release complete Supplementary service control • Facility • Hold • Retrieve Miscellaneous • Congestion control • Notify • DTMF handling • Status

• Activate Packet Data Protocol (PDP) context • Activate Secondary PDP Context • Request PDP context activation • Modify PDP context request • Deactivate PDP context • SM Status

Figure 2.5 Circuit and Packet Switched Mobility Management. SMS supports the mobile-originated and mobile-terminated Short Message Service (SMS) as described in 3GPP TS 23.040. Information on the access stratum protocol layers is given in the description of protocols for the specific interfaces.


Figure 2.6 User plane UE to PS Core Network.

Figure 2.7 User plane UE to CS Core Network.

2.3 The UTRAN Interfaces For the UTRAN, four interfaces are defined: two internal (Iur and Iub) and two external (Iu and Uu). Each interface carries both user data and signaling. This document focuses on the control plane protocols (signaling).


2.3.1 General UTRAN Interface Protocols Architecture The protocols on each of the UTRAN interfaces have a general structure as shown below.

Figure 2.8 General structure of the UTRAN interfaces. Each protocol stack is divided into an upper layer (the radio network layer) and a lower layer (the transport network layer). The upper layers are used for applications and information that go beyond a particular interface, while the lower layer ensures and conducts the transport of information on a particular interface.

2.3.2 Iu Interface The Iu interface connects the UTRAN to the CN. The Iu interface is split up in three functional types of interfaces. The Iu interface towards the CS domain is called Iu-CS. The Iu interface towards the PS domain is called Iu-PS. The last core network domain is the BC domain and the interface towards that is the Iu-BC. The Iu-BC is not covered by this document. The UTRAN is responsible for all radio-related aspects including mobility of a UE in connected mode on cell level.

Figure 2.9 The Iu interface connects the UTRAN to the CN.


The CN is responsible for the end user service related aspects, including keeping track of the UE in idle mode on location/routing area level. The Iu interface supports a common set of RAB services that are offered by UTRAN to the CN nodes, regardless of their type.

2.3.3 Iu-CS Protocol Stack

Figure 2.10 The Iu-CS control plane protocol stack. The Iu-CS control plane protocol stack consists of a signaling bearer layer, the transport network layer, and an application protocol on the radio network layer. The broadband Signaling System No. 7 is used as signaling bearer for the Radio Access Network Application Protocol (RANAP). This means that SCCP is used by RANAP. Both connectionless and connection oriented procedures are used. Message Transfer Part 3b (MTP3b) is used by SCCP. SSCF-NNI and SSCOP and AAL5 are interface protocols between ATM and SS7 protocols. 2.3.3.1 The Radio Access Network Application Protocol (RANAP) Layer The RANAP encapsulates and carries higher-layer signaling, handles signaling between the 3G-SGSN and UTRAN, and manages the GTP connections on the Iu interface.


RANAP provides UTRAN specific control/signaling including: • The overall management of the RAB such as setup, release and maintenance

• Transport of NAS information between UE and CN, like MM and broadcast information

• Paging requests to the UE

• UE location information

• Error handling

• Overload handling

• Iu connection management

The RANAP is specified in 3G TS 25.413. 2.3.3.2 The Signaling Bearer Layer The signaling bearer layer consists of several protocol layers: • The SCCP provides connectionless and connection oriented services for the higher layer. Connections are made on a

mobile-by-mobile basis. SCCP is defined in ITU-T Recommendation Q.716

• MTP3b provides functions like message routing, signaling link management, load sharing, changeover and changeback between links. MTP3b is defined in ITU-T Recommendation Q.2210

• Service Specific Co-ordination Function (SSCF-NNI). SSCF maps the requirements of the layer above to the requirements of SSCOP. SSCF-NNI is defined in ITU-T Recommendation Q.2140

• Service Specific Connection Oriented Protocol (SSCOP) provides mechanisms for the establishment and release of connections and the reliable exchange of information between signaling entities. SSCOP is defined in ITU-T Recommendation Q.2110

• ATM Adaptation Layer (AAL5) adapts the upper layer protocol to the requirements of the lower ATM cells. AAL5 is defined in ITU-T Recommendation I.363.5

Together the SSCF, the SSCOP and the AAL5 are also known as the Signaling ATM Adaptation Layer – Network Node Interface (SAAL-NNI). The signaling bearer layers below RANAP are defined in 3G TS 25.412.

2.3.4 Iu-PS Protocol Stack The Iu-PS protocol stack is slightly different from the Iu-CS protocol stack. The operator has two stacks to choose from for signaling: The operator can use the same stack as for Iu-CS, or the alternative IP over ATM based stack, using M3UA (a special MTP3 adaptation protocol for use over IP), the SCTP and IP.


Figure 2.11 The Iu-PS protocol stack. The figures in section 2.2.4 show the relation between the Iu-PS protocol stacks and the protocol stacks on other UMTS interfaces. 2.3.4.1 The GPRS Tunneling Protocol for the User Plane (GTP-U) This protocol tunnels user data between UTRAN and the 3G-SGSN, and between the GPRS Support Nodes (GSNs) in the backbone network. GTP must encapsulate all PDP Protocol Data Units (PDUs). GTP is specified in 3G TS 29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer mentioned in section 2.4.2. However, different messages defined in the recommendation are used for the control plane (GTP-C) and the user plane (GTP-U) applications. 2.3.4.2 The User Datagram Protocol/Internet Protocol (UDP/IP) UDP/IP are the backbone network protocols used for routing user data and control signaling.

2.3.5 Iub Interface The Iub interface is used by the CRNCs (or DRNCs) to request the setting up, adding or deleting of radio links in the Node Bs. It is also used by the DRNC to perform radio resource admission control and hardware resource control.


2.3.6 Iub Protocol Stack

Figure 2.12 The Iub protocol stack. The signaling bearer used by Node B Application Part (NBAP) comprises of SSCF-UNI on top of SCCOP and AAL5. Together the three signaling bearer layers are called the Signaling ATM Adaptation Layer (SAAL). The figures in section 2.2.4 show the relation between the Iub protocol stacks and the protocol stacks on other UMTS interfaces. 2.3.6.1 The Node B Application Part (NBAP) Protocol Layer The NBAP protocol, specified in 3G TS 25.433, is used on the Iub interface. Here it provides UTRAN specific control/signaling e.g.: • Handling and control of the measurements, performed by the UE

• Management of radio links and of common channel and resources

• Synchronization

• Error handling

2.3.6.2 User Plane Radio Network Layer Protocols The user plane radio network layer on the Iub interface consists of a number of protocols. The structure reflects the way the information is organized on the air interface, i.e. the data streams that are carried across the Uu interface. These protocols are listed on the following page.


Detailed information on these channels is, however, outside the scope of this document: • Common Packet CHannel Framing Protocol (CPCH FP)

• Uplink Shared CHannel Framing Protocol (USCH FP)

• Downlink Shared CHannel Framing Protocol (DSCH FP)

• Paging CHannel Framing Protocol (PCH FP)

• Forward Access CHannel Framing Protocol (FACH FP)

• Random Access CHannel Framing Protocol (RACH FP)

• Dedicated Transport CHannel Framing Protocol (DCH FP)

2.3.7 Iur Interface The Iur interface is used by the SRNCs to request the setting up, adding or deleting of radio links in the DRNCs. It also supports handover and synchronization. In order to minimize the equivalent of the inter-BSC handovers known from GSM/GPRS, the Iur is used to enable inter-RNC soft handover. This is again to hide radio network functions from the CN and in particular to avoid ping-pong effects, for example, UEs frequently changing back and forth between two cells, on the CN.

2.3.8 Iur Protocol Stack

Figure 2.13 The Iur protocol stack. The transport network layer part of the control plane protocols for the Iur are the same as those for Iu-PS. Again the operator has a choice between two stacks. The radio network layer in the Iur protocol stack consists of the Radio Network Subsystem Application Part (RNSAP) protocol.


2.3.8.1 The Radio Network Subsystem Application Part (RNSAP) Protocol Layer The RNSAP protocol is used on the Iur interface, where it provides UTRAN specific control/signaling e.g.: • Relocation of SRNC

• Transport of NAS information between the UE and the CN, like MM and broadcast information

• Paging requests to the UE

• Management of transport channel resources (radio and physical links)

• Soft handovers

The RNSAP is specified in 3G TS 25.423.

2.3.9 Uu Interface

Figure 2.14 Radio interface protocol architecture (service access points marked by circles). The Uu interface is the air interface between the UE and the UMTS network. The figures in section 2.2.4 show the relation between the Iub protocol stacks and the protocol stacks on other UMTS interfaces.


2.3.9.1 The Radio Resource Control (RRC) Protocol Layer The RRC protocol, specified in 3G TS 25.331, is used between the UTRAN (the RNC) and the UE. It provides functionality including: • Broadcast of information

• Management of:

- RRC connection between the UE and UTRAN (establishment, release, maintenance)

- Radio Bearers (establishment, release, reconfiguration)

- RRC connection radio resources (assignment, release, reconfiguration)

• Mobility functions for the RRC connection

• Control of requested QoS

• Handling of UE measurement reports

• Outer loop power control (please refer to section 3.4.3.2)

• Control of ciphering

• Paging

• RRC message integrity protection

• Timing advance (Timing Division Duplex (TDD) mode)

2.3.9.2 The Packet Data Convergence Protocol (PDCP) Layer The PDCP specified in 3G TS 25.323 is used in the user plane between the UTRAN (the RNC) and the UE. It provides functionality including: • Compression and decompression of header in IP data streams (e.g. TCP/IP and RTP/UDP/IP headers for IPv4 and IPv6)

• Transfer of user data between PDCP service users

2.3.9.3 The Radio Link Control (RLC) Protocol Layer The RLC protocol is used for RLC connections between the UTRAN (the RNC) and the UE. There is one RLC connection for each Radio Bearer (RB). The RLC protocol provides functionality including: • Segmentation and reassembly of long upper layer PDUs

• Concatenation of short upper layer PDUs

• Transfer of user data including error correction and flow control

• In-sequence delivery of upper layer PDUs

• Sequence number checking

• Detection and recovery of protocol errors

• Ciphering

The RLC protocol is specified in 3G TS 25.322. 2.3.9.4 The Medium Access Control (MAC) Protocol Layer The MAC protocol is just above the physical layer. It is used between the UTRAN (the RNC) and the UE. It provides functionality including: • Mapping between logical channels and transport channels

• Selection of appropriate transport format for each transport channel depending on instantaneous source rate

• Handling of priority between data flows of one UE and between UEs

• Multiplexing/demultiplexing of upper layer PDUs to and from the actual physical layer transport channels

The MAC protocol is specified in 3G TS 25.321.


2.4 Core Network (CN) Protocols This section discusses protocol stacks for all relevant interfaces in the CN, both the CS domain and the PS domain. Again the focus will be on the control plan protocols (signaling).

2.4.1 The Mobile Application Part (MAP) Protocol

Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR. The MAP protocol (or a fraction of it) is used on a number of interfaces in the CN. TCAP, SCCP, MTP3, and MTP2 are transport protocol layers defined in Signaling System No. 7. The same protocols are used to support MAP in CS PLMNs. Figure 2.16 on the following page shows the services and functionality supported by the MAP protocol.


Services and Functionality Supported by the MAP Protocol Mobility • Location management services • Paging and search • Access management services • Handover services • Authentication management services • Security management services • International mobile equipment identities

management services • Subscriber management services • Identity management • Fault recovery services • Subscriber information services

Call Handling • Send routing information service • Provide roaming number service • Resume call handling service • Group call service • Provide SIWFS number • SIWFS signaling modify • Set reporting state service • Status report service • Remote user free service • Immediate Service Termination (IST) services

Supplementary Services Related • Register/erase/activate/deactivate/interrogate/invoke

supplementary services • Password services • Unstructured supplementary services support • Register/erase CC entry service

Short Message Service Management • Send-routing-info-for-SMS service • Forward SMS • Report SM delivery status service • Ready for SM service • Alert service center service • Inform service center service • Send info for SMS service

Network-Requested PDP Context Activation

• Send routing info for GPRS service • Failure report service • Note MS present for GPRS service

Location Service Management (LCS) • Send routing info for LCS service • Provide subscriber location service • Subscriber location report service

Operation and Maintenance • Subscriber tracing services • Other operation and maintenance services

Figure 2.16 MAP services as defined in 3G TS 29.002. 2.4.1.1 Interfaces using the MAP Protocol SGSN – HLR (the Gr interface): • The MAP protocol supports signaling exchange with the HLR, as defined in 3G TS 29.002, with enhancements for GPRS,

see 3G TS 23.060

SGSN– EIR (the Gf interface): • The MAP protocol supports signaling between the SGSN and the EIR, as described in sub clause "Identity Check

Procedures" 3G TS 23.060

SGSN - SMS-GMSC or SMS-IWMSC (the Gd interface): • The MAP protocol supports signaling between the SGSN and SMS-GMSC or SMS-IWMSC, as described in sub clause

"Point-to-point Short Message Service" 3G TS 23.060

GGSN– HLR (the Gc interface): This optional signaling path allows a GGSN to exchange signaling information with an HLR. There are two alternative ways of implementing this signaling path: • If an SS7 interface is installed in the GGSN, the MAP protocol can be used between the GGSN and an HLR

• If an SS7 interface is not installed in the GGSN, any GSN with an SS7 interface installed in the same PLMN as the GGSN, can be used as a GTP-to-MAP protocol converter to allow signaling between the GGSN and an HLR


2.4.2 GSN – GSN Control Plane

Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces. • GTP-C

- This protocol tunnels signaling messages between SGSNs and GGSNs (Gn), and between SGSNs in the backbone network (Gp). GTP-C is used for location management and MM and is specified in 3G TS 29.060

• UDP

- This protocol transfers signaling messages between GSNs

2.4.3 SGSN - MSC/VLR

Figure 2.18 Control plane SGSN-MSC/VLR.


• Base Station System Application Part+ (BSSAP+)

- A subset of BSSAP procedures supports signaling between the SGSN and MSC/VLR, as described in 3G TS 29.018. The requirements for the lower layers are specified in 3G TS 29.016

2.4.4 GSN – GSN User Plane

Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces. • GTP-U

- This protocol tunnels user data between SGSNs and GGSNs (Gn), and between SGSNs in the backbone network (Gp). GTP is specified in 3G TS 29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer mentioned in section 2.4.2. However, different messages defined in the recommendation are used for the control plane (GTP-C) and the user plane (GTP-U) applications

• UDP

- This protocol transfers user data between GSNs


3. UMTS Network Functionality This chapter provides an overview of the basic control signaling and node interworking. The UE, the UTRAN and the CN operate in a number of states. Each state is characterized by the activity level and thereby the resource requirements. In UMTS the changing resource requirements are supported by dynamic allocation of resources. This gives better utilization of resources, reduced interference and extended battery life for mobiles. The states also define the CN behavior towards the UE, for example terminate or reject an incoming call if the UE is turned off, idle or already active. A set of elementary procedures controls the state changes and allocation of resources as required. Mobility Management (MM) and Radio Resource Management (RRM) such as handovers enable the UE to move seamlessly around in the network. One of the characteristics of UMTS is that elementary procedures can be combined in different ways to implement a complete service. The specifications also enable the same thing to be done in several ways. In addition to describing the elementary procedures, MM and RRM, examples are used to explain the general signaling procedures for a number of services. The detail level is selected to provide a functional overview.

3.1 User Equipment (UE) and Network States When the UMTS UE is turned on, it will enter IDLE mode. It will start the cell search mechanism scanning the UMTS band for a cell with broadcast information matching the list of allowed PLMNs. When a suitable cell is found, the UE will camp on this cell and request initial access to the UTRAN to attach to the network and enter the CONNECTED state. Once attached the UE will be known/registered to the network and can access the services offered. This mode of operation is also known as Camping on UTRAN Cell. Multimode UEs are able to operate on existing GSM/GPRS networks in addition to the UMTS network. When no UMTS network is available, the UE may operate on a GSM/GPRS cell. This mode of operation is also known as Camping on GSM/GPRS Cell. The UE may also feature intersystem handovers and Location Updates (LUs). The following state descriptions apply when the UE is camping on UTRAN cell.

3.1.1 Circuit Switched (CS) Mobility Management (MM) States In CS mode the UE and CN operate in three states as shown below, similar to GSM behavior.

Figure 3.1 UE and CN MM states.


When the UE is turned on and performs an IMSI Attach it goes from MM-DETACHED to MM-CONNECTED and then to MM-IDLE, when the IMSI Attach is successfully completed. In MM-IDLE state the UE is registered in the CN by Location Area (LA) but not registered in the UTRAN. When a call is started or when performing location updating the UE goes back to MM-CONNECTED until completion of the call/transaction. When the IMSI Detach is performed the state is changed to MM-DETACHED. In MM-CONNECTED state the UE will be registered in the UTRAN by cell ID and in the CN by the Iu connection ID.

3.1.2 Packet Switched Mobility Management (PMM) States In PS mode the UE and CN operate in three states as shown below.

Figure 3.2 UE and CN PMM states. When the UE performs a GPRS Attach, it goes from PMM-DETACHED to PMM-CONNECTED, and then to PMM-IDLE when the GPRS Attach is successfully completed and the signaling connection is released. In PMM-IDLE state the UE is registered in CN by Routing Area (RA) but not registered in the UTRAN. When a new service is requested or when performing Routing Area Updates (RAUs) it goes back to PMM-CONNECTED until completion of the service/transaction. In PMM-CONNECTED state the UE will be registered in the UTRAN by cell ID and in the CN by the Iu connection ID. When the PS Detach is performed the state is changed to PMM-DETACHED.


3.1.3 Radio Resource Control (RRC) Service States

Figure 3.3 RRC states. Depending on the type of connection and the traveling speed, the UE may be in one of several different states. This is handled by the RRC states, controlled by the RNC. In Idle mode the UE has no active connections. In Connected mode the UE may be in one of four RRC states:

• The Cell_ FACH (Forward Access CHannel) state is used for communication over common channels with limited bandwidth, e.g. IMSI Attach and LU

• The Cell_DCH (Dedicated CHannel) state is used for communication over allocated dedicated channels like voice call and data transmission. In this state the UTRAN will perform handovers for CS QoS and Cell Update for PS QoS

• The Cell_PCH (Paging CHannel) and URA_PCH states are used when there is no data to send. The UE will only listen to the Paging Channel thus minimizing battery load. In the Cell PCH state the UE will perform Cell Updates whereas in the URA_PCH state the UE performs the less frequent UTRAN Registration Area (URA) Updates. (Refer to section 3.3.3 for descriptions of locations.) The advantage of the latter is increased power savings and the sacrifice is that paging is required. E.g. URA_PCH is preferred to Cell_PCH when the UE is moving at high speed to minimize frequency of location updating procedures

3.1.4 UE State Overview Figure 3.4 summarizes the UE and RRC states. The location of the UE will be known by the network in varying resolution. Depending on the actual state the UE will be registered in different databases and with different accuracy. Based on the state and the type of active connection either the UE or the UTRAN will select which cell to camp on. Refer to section 3.3.3 for descriptions of locations.


UE State RRC State UE Known in UE Registered in UE Registration Accuracy

Cell Selected by

PMM-DETACHED - HLR IMSI, last LA/RA -

PMM-IDLE LA/RA CN LA/RA, UE, LA/RA Update

PMM-CONNECTED Cell_FACH Cell CN, UTRAN

Iu connection URA

UE, Cell Update

Cell_DCH Cell CN, UTRAN

Iu connection Cell

UE, Cell Update (PS) or UTRAN Handover (CS)

Cell_PCH Cell CN, UTRAN

Iu connection URA

UE, Cell Update

URA_PCH URA UTRAN URA UE, URA Update Figure 3.4 UE state overview.

3.1.5 Packet Data Protocol (PDP) States A PS subscription contains the subscription of one or more PDP addresses. Each PDP address is described by one or more PDP contexts in the UE, the SGSN, and the GGSN. Every PDP context exists independently in one of two PDP states. The PDP state indicates whether data transfer is enabled for that PDP address or not. All PDP contexts of a subscriber follow the same PMM state for the IMSI of that subscriber.

Figure 3.5 PDP states. 3.1.5.1 INACTIVE State In the INACTIVE state the data service for a certain PDP address of the subscriber is not active. The PDP context contains no routing or mapping information to process PDP data transfer related to that PDP address. No data can be transferred. A change in location of a UE causes no update for the PDP context in INACTIVE state even if the subscriber is PS Attached.

The UE initiates the movement from INACTIVE to ACTIVE state by initiating the service request procedure with PDP Context Activation.


3.1.5.2 ACTIVE State In ACTIVE state, the PDP context for the PDP address in use is activated in the UE, SGSN and GGSN. The PDP context contains mapping and routing information for transferring PDP PDUs for that particular PDP address between the UE and the GGSN. An active PDP context for a UE is moved to INACTIVE state by initiating the service release procedure with PDP Context Deactivation. All active PDP contexts for a UE are moved to INACTIVE state when the PMM state changes to IDLE or PMM-DETACHED.

3.2 Elementary Procedures Signaling and transport resources are established and released dynamically on request based on the required QoS for optimal utilization of resources. In UMTS different services with different QoS will share the radio resources. Thus, all procedures are usually wrapped in signaling connection and RAB establishment, modifications and release.

3.2.1 Paging The paging procedure is used by the CN to indicate to the UE that it needs to terminate a transaction, e.g. an incoming call or data. UMTS uses two different types of paging procedures depending on whether a connection to the same CN domain exists or not. Paging Type I is the “normal” way to use paging. It is used to a UE in IDLE mode to establish a signaling connection for termination of the new transaction. It is sent to those LAs/RAs where the UE has last reported its location. Paging Type II is used when the UE already has a connection to one CN domain and another connection has to be established to the same CN domain. As it is sent to mobiles with an active connection only, it is sent directly to one UE. When a UE is both IMSI- and GPRS-attached in a network that operates in mode I, the MSC/VLR executes paging for circuit switched services via the SGSN.

Figure 3.6 CS Paging Procedure in Iu mode.

3.2.2 Signaling Connection Establishment To establish a signaling connection from the UE to the CN, an RRC connection needs to be established from the UE to the UTRAN (RNC), and an Iu connection from the UTRAN to the CN. Separate signaling connections are established from the UE to each of the CN domains as required. The RRC connection establishment procedure is initiated by the UE creating an AAL2 link connection between the RNC and the Node B, and then a WCDMA Physical Dedicated Channel between the Node B and the UE, and is completed using this combined Signaling Radio Bearer (S-RB) to establish the RRC connection.


When the RRC connection has been established, the transaction reasoning procedure is performed. The transaction reasoning procedure is used by the UE to indicate to the CN what type of transaction is requested. The Iu connection is initiated by the UE establishing the Iu signaling bearer and the Iu control plane connection. The signaling connection can subsequently be used for transparent NAS signaling between the UE and the CN.

Figure 3.7 CS signaling connection establishment.

3.2.3 Signaling Connection Release When the transaction is completed and the signaling connection is no longer required, it will be released by the RNC. The release procedure is initiated by releasing RRC connection starting with the WCDMA Physical Dedicated Channel and the S-RB. Then releasing the Iu control plane connection and the Iu signaling bearer completes the release.


Figure 3.8 Signaling connection Release.

3.2.4 Authorization and Security The authorization procedure performs authorization of the UMTS user to the CN and vice versa. The procedure includes authorization of the USIM in the UE. When the transaction requires encrypted communication, the CN use the security procedure to send security parameters (selection of the ciphering algorithm and the synchronization of the start of ciphering, or both) to the UE, which in turn acknowledges that encryption is turned on.

Figure 3.9 Authentication and security procedure.


3.2.5 Service Request The service request is used to negotiate the QoS parameters for the requested service and allocate the communications resources. The QoS is negotiated by the UE and the CN using the already established signaling connection. The signaling procedure is slightly different for transactions with each of the CN domains. The transaction setup usually includes a RAB allocation as shown in figure 3.10.

Figure 3.10 CS Service Request and RAB Allocation.

Figure 3.11 PS Service Request and RAB Allocation.


3.2.6 Service Release The service release is used to release all resources associated with the particular service on completion, and may be started by the CN or the UE depending on the user action. Clearing of a particular transaction on completion of a service will include the release of the RAB and any connections made through the DRNC. The clearing does not affect any other connections for other services. RABs for other services as well the signaling connection will remain established.

Figure 3.12 PS Service and RAB Release. If all services are completed at once, the transaction clearing will use the Iu release command. This will release all radio resources and Iu user plane connections as well as the signaling connection.

Figure 3.13 CS Service and Iu Release.


3.2.7 Radio Access Bearer (RAB) Allocation The RAB is allocated to carry speech (CS) or data (PS) between the CN and the UE. To allocate a RAB it is required to establish an Iu user plane connection from the CN to the UTRAN and an RB from the UTRAN (RNC) to the UE. The RAB is characterized by the parameters required by the requested QoS. The Iu user plane connection is established by creating the Iu bearer as required by the QoS class. CS connections require an AAL2 link between the MSC and the UTRAN, whereas PS requires a tunneled connection over ALL5 between the SGSN and the UTRAN. The RB is established by creating an AAL2 link connection between the RNC and the Node B and then a WCDMA Physical Dedicated Channel between the Node B and the UE. Before establishing any bearers the RNC performs admission control. Admission control is performed as an evaluation of whether a new call can have access without sacrificing performance of existing calls in the radio and terrestrial sections. The RAB can subsequently be used for transparent data transport between the UE and the CN. Allocation of an RAB will change the state of the UE from Cell_FACH to Cell_DCH.

Figure 3.14 CS RAB Allocation.


Figure 3.15 PS RAB Allocation.

3.2.8 Radio Access Bearer (RAB) Release RABs will be released when not in use in order to save resources, even though the transactions may not be completed. For example, an e-mail service will remain ACTIVE even though the radio and user plane resources are released. RABs will be re-established and released on request when there are data to send. The RAB release for a particular transaction does not affect any other connections for other services. RABs for other services as well the signaling connection will remain established.

Figure 3.16 RAB Release procedure.


For PS, the release procedure allows the active PDP contexts associated with the released RABs to be preserved without modification in the CN, and the RABs can then be re-established at a later stage. Release of RAB will change the state of the UE from Cell_DCH to Cell_PCH or URA_PCH.

3.3 Mobility Management 3.3.1 Attach Procedure In order to access services, the UE must first be registered in the network by performing an attach. For example, the GPRS Attach operation establishes a logical link between the UE and the SGSN, and makes the UE available for SMS over PS, paging via SGSN, and notification of incoming PS data. The UE is attached separately to each of the CN domains. However, the UE may perform combined or separate GPRS or IMSI Attach procedures, depending on the capabilities of the UE and the network and the current connection state of the UE. The GPRS Attach procedures only register the UE in the SGSN, whereas the combined GPRS/IMSI Attach registers the UE in the SGSN for PS service(s) as well as in the MSC for CS services. The Attach procedure is in reality performed as a LU procedure with the type parameter set to Attach. The IMSI Attach procedure is only used in case the UE is re-activated in the same LA (identical Location Area Indicator (LAI) broadcasted and stored in USIM) as where it was last registered. Note that the signaling connection establishment precedes the attach procedure in order to acquire a signaling connection via which the Attach message can be sent.


Figure 3.17 Combined GPRS/IMSI Attach procedure with LU.

3.3.2 Detach Procedure The Detach function is used when the UE is switched off, or when a UE informs the network that it does not want to access the services any longer using a GPRS and/or IMSI Detach. Similarly, it enables the network to inform a UE that it does not have to access the SGSN/MSC based services any longer. The different types of Detach are: • IMSI Detach, marking the UE as inactive in the CS CN domain

• GPRS Detach, marking the UE as inactive in the PS CN domain; and

• Combined GPRS/IMSI Detach (UE-initiated only), marking the UE as inactive in the CS and PS CN domains


The Detach procedures exist in 3 different versions, based on point of origin, i.e. UE, SGSN or HLR initiated. The figure below shows the combined GPRS/IMSI Detach procedure.

Figure 3.18 UE initiated combined GPRS/IMSI Detach procedure.

3.3.3 Location Management Procedures

Figure 3.19 LA containing RAs and cells within URA.


3.3.3.1 Location Update (LU) The LA is defined as the cluster of cells where the UE can move without performing LUs within the CS CN domain. A UE in MM-IDLE state performs an LA update when it enters a new LA and also performs a periodic LA update to keep the registration of the UEs state up to date in the VLR and HLR. An LA update is either an intra-MSC or inter-MSC LA update. For the inter-MSC LA update the MSC will inform the HLR about the new location of the UE. For the intra-MSC LA update there is no need to inform the HLR. A periodic LA update is always an intra-MSC LA update. 3.3.3.2 Routing Area (RA) Update Procedure The RA is defined as the cluster of cells where the UE can move without performing routing location updates within the PS CN domain. One or more RAs can exist within a LA, but a RA cannot exist in more than one LA. A UE in PMM-IDLE state performs an RA update when it enters a new RA and also performs a periodic RA update to keep the registration of the UEs state up to date in the SGSN and GGSN. An RA update is either an intra-SGSN or inter-SGSN RA update. For the inter-SGSN RA update the SGSN will inform the GGSNs and the HLR about the new location of the UE. For the intra-SGSN RA update there is no need to inform the GGSNs and the HLR. A periodic RA update is always an intra-SGSN RA update. If the network supports the Gs connection between the SGSN and the MSC, a UE that is both GPRS-attached and IMSI-attached will perform the combined RA/LA update procedures.


Figure 3.20 UMTS LA/RAU procedure. 3.3.3.3 UMTS Registration Area (URA) Update The URA consists of a number of cells belonging to one or more RNCs, where the UE can move without performing URA updates. The URA is used to register the UE in the UTRAN, and is used for the MM and RRM handled by the UTRAN.


The UE performs an URA update when it enters a new URA and also performs a periodic URA update to keep the registration of the UEs state up to date in the UTRAN. The URA is only known within the UTRAN.

Figure 3.21 URA Update. 3.3.3.4 Cell Update During a transaction the RNC needs to know the location of the UE with the accuracy of a cell. Due to the discontinuous nature of a PS connection, this information may be inaccurate if the UE has moved when transmission resumes. In this case, the cell update is performed by the UE. The cell update is also used by the UE at the start of a new transaction, for periodic cell update, and as response to a PS Paging Type I.

Figure 3.22 Cell update.

3.4 Radio Resource Management (RRM) When the UE has an active connection with the UTRAN, it continuously performs measurement on the radio connection and sends reports to the SRNC. When the UE is moving from the SRNC towards the DRNC, the SRNC will decide to perform a handover based on the received measurement reports.

3.4.1 Soft Handovers Soft handover is the handover of radio resources internally in the UTRAN in-between two Node Bs with the same frequency. This is basically a modification of the RAB using a radio link reconfiguration/setup and a radio link deletion procedure.


Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs. Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another RNC. It then establishes a new RRC connection via the Iur interface to the DRNC and further to the new Node B. During the soft handover the SRNC will transmit on just one channel but listen on several channels, either directly controlled by the SRNC or by DRNCs. The signal will be combined in the SRNC. When the measurement reports from the moving UE indicate that the old radio connection is no longer valid, the SRNC then deletes the previous radio connection.

Figure 3.24 Soft handover. 3.4.1.1 Softer Handover Softer handover is the addition or deletion of radio resources from the active set within the same Node B. The Node B will transmit on one channel while it listens on more than one channel. The signal will be combined in the Node B.


3.4.2 Hard Handovers A hard handover is a physical reconfiguration of the radio link. It can happen internally in UMTS, if the UE moves from one SRNC to another via the CN, i.e. the two RNCs are not interconnected via the Iur. This also happens when the UE moves from one Radio Access Technology (RAT) to another, for example from GSM to UMTS. There will be no disconnection of the data or voice transfer during the hard handover. The several types of hard handovers can be divided into intra-RAT hard handovers, and inter-RAT handovers. 3.4.2.1 Intra-RAT Hard Handovers Intra-RAT hard handovers are handovers within one RAT, e.g. UTRAN. The difference between hard and soft handovers is that with hard handovers there is a physical change in frequency connections or a change in mode from TDD (Time Division Duplex) to FDD (Frequency Division Duplex) and vice versa, or a change of cell without macro diversity support, i.e. handover from one SRNC to another. The handover from one SRNC to another involves the CN and thus relocation of the Iu interface. This type of handover is also known as Serving Radio Network Subsystem (SRNS) relocation, and is used to switch SRNCs.

Figure 3.25 Before and after hard handover/SRNS relocation and RAU. The hard handover involves a reconfiguration of the physical channel as well as a relocation of the Iu connection. Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another RNS. It then starts the relocation of the Iu connection to the other RNS with the CN. The new physical channel is established, and the UE completes the reconfiguration of the physical channel and the old Iu connection and radio link are released.


Figure 3.26 Hard handover and SRNS relocation. 3.4.2.2 Inter-RAT Handovers Inter-RAT handovers are handovers between different types of Radio Access Networks (RANs). In the CS domain this means GSM to UMTS and UMTS to GSM, and in the PS domain it means GPRS to UMTS and UMTS to GPRS. In the case of the PS domain, this is called cell reselection, not handover. 3.4.2.2.1 UMTS to GSM Handover

Figure 3.27 UMTS to GSM Handover.


The UTRAN initiates the UMTS to GSM handover on the basis of measurement reports from the UE • The SRNC sends a RELOCATION REQUIRED message to the MSC

• The MSC makes a HANDOVER REQUEST to the GSM BSS

• The GSM BSS responds with a HANDOVER REQUEST ACKNOWLEDGE if the resources are available

• The MSC sends the RELOCATION COMMAND message to the SRNC, which tells the UE to make the handover to the GSM

• The GSM BSS sends the HANDOVER DETECT message after the UE makes the handover access

• When the UE reports that the handover is complete, the GSM BSS sends the HANDOVER COMPLETE message to the MSC, which releases the Iu connection

3.4.2.2.2 UMTS to GPRS Cell Relocation

Figure 3.28 UMTS to GPRS cell relocation. In this case it is also the UE that initiates the cell relocation: • The UE obtains system information about the neighboring cells from the UTRAN, sets up a connection to the

GSM/GPRS BSS and releases the UTRAN resources

• It then makes a ROUTING AREA UPDATE REQUEST to the SGSN

• The SGSN sends a SRNS CONTEXT REQUEST to get the packet information including sequence numbers for synchronization from the SRNC

• The SRNC responds with the SRNS CONTEXT RESPONSE containing the relevant information

• Security mode is set up in the GSM/GPRS network, and the SGSN tells the SRNC to forward all buffered data with the SRNS FORWARD DATA COMMAND

• The SRNC forwards the data and releases the Iu connection

• The SGSN completes the cell relocation procedure with the ROUTING AREA UPDATE ACCEPT and COMPLETE messages


3.4.3 Power Control In UMTS, all UEs transmit on the same frequency band. In FDD the UEs will even receive on the same frequency band. To avoid a remote UE from being masked by the signal of a closer UE, the output of each UE is controlled so that the received power at the Node B is constant from all UEs. The following is a description of power control for FDD: As all UEs will create a certain level of interference, only a limited number of UEs are allowed to be active simultaneously in order to ensure that an acceptable Signal to Interference Ratio (SIR) can be maintained. SIR is also often referred to as Carrier to Interference ratio (C/I). In order to maximize the number of UEs in a network, it is necessary to control the SIR of each connection and even to lower output power as new UEs enter the network. The Node B notifies all UEs in its area about the required SIR by transmitting this parameter as a part of the cell broadcast information. 3.4.3.1 Open Loop Power Control Before transmitting an access burst, the UE must calculate the required output power (Pout). This can be determined from the Node B to UE path loss and the required SIR at the Node B. The Node B broadcasts information about its Pout and SIR. The path loss can be calculated by comparing this to the received power of the downlink to the Pout at the node B. 3.4.3.2 Outer Loop Power Control The outer loop power control is used to adjust the SIR target value used by the inner loop power control independently for each connection based on the QoS requirements for the connection. 3.4.3.3 Inner Loop Power Control The inner loop power control is used to dynamically adjust the output power of the active channel in order to maintain received SIR at a given SIR target. The Node B and the UE each measure received power and the total received interference. Based on this, Transmit Power Control (TPC) commands are sent up and down link 1,500 times per second to account for the near-far interference as well as multi-path fading.


3.5 CS Service Example: Mobile Terminating (MT) Voice Call In the example shown in figure 3.29, the UE is turned on, performs an IMSI Attach, and enters the MM-IDLE state. The UE receives an incoming call and responds to the Paging by establishing a CS Signaling Connection to the MSC. The UE sends a CS Service Request to the MSC, which initiates the authentication and security procedures before RAB Allocation. After the transaction (conversation) the RAB and the CS Signaling Connection is released.

Figure 3.29 CS service: MT voice call.


3.6 PS Service Example: MT Data Connection (Interactive) In the PS example the UE then performs a PS IMSI Attach and enters the PMM-IDLE state. The SGSN receives a downlink PDU and sends a Paging over the existing RRC connection as a Paging Type II from the UTRAN to the UE. The UE performs a cell update, establishes a new PS Signaling Connection to the SGSN, sends a Service Request with PDP Context Activation and RAB Allocation, and receives a PDP Context Activation Accept. After the data transmission has been completed the service is released with PDP Context Deactivation and RAB Release. The UE finally performs a PS Detach with release of the PS Signaling Connection.

Figure 3.30 PS service: MT data connection (interactive).


4. UMTS Security and Ciphering 4.1 Security Security has always been an important issue in mobile telephony systems. Users want privacy and will not accept anyone listening in on their communication, while operators want to prevent fraud and other actions that impact their revenues. This leads to precautions regarding the airborne communication in the access network part. However, as several different parties may be involved in the service offering for a user (as in the case of location based services), sensitive data may have to be sent between different parties/networks, giving rise to vulnerability to other security risks. UMTS security is based on the security mechanisms developed for 2G networks. The main security features are: • User authentication

• Encryption of the air interface communication

• Temporary identities

There are, however, important changes in UMTS, for example: • A sequence number ensures that the mobile can identify the network to defeat “false base station attack”

• Longer “Key” enables stronger algorithms for integrity and encryption

• Mechanisms are included to support security within and between networks

• Security is based in the CN instead of the BSS (as in 2G). Therefore links are protected from the UE to the CN

• Integrity mechanisms for the terminal identity (IMEI) have been designed in from the start – IMEI was introduced rather late in 2G networks

The work on defining UMTS security in 3GPP is ongoing and there are different views on the level of security that should be applied. One suggestion is that ciphering must protect almost all interfaces (signaling and user data). Another suggestion is only to cipher some critical user data (e.g. ciphering keys) when roaming between different networks. The figure below gives an overview of the 3G-security architecture as defined for Rel-4.

Figure 4.1 Overview of the security architecture in Rel-4.


Five security feature groups are defined. Each of these feature groups meets certain threats and accomplishes certain security objectives:

• Network access security (I): security features providing users a secure access to 3G services, and which in particular protect against attacks on the (radio) access link. Examples of group I features are:

- Protection against listening in to get information on the IMSI number

- User and network authentication

- Cipher agreement confidentiality

• Network domain security (II): security features enabling nodes in the provider domain to securely exchange signaling data, and protect against attacks on the wireline network. An example of a group II feature is:

- Fraud information gathering

• User domain security (III): security features that secure the access to UEs. An example of a group III feature is:

- User-to-USIM (e.g. PIN code) authentication

• Application domain security (IV): security features enabling applications in the user and in the provider domain to exchange information securely. An example of a group IV feature is:

- Secure messaging between the USIM and the network

• Visibility and configuration of security (V): features enabling the user to find out if a security feature is in operation and whether the use and provision of services should depend on the security feature

The registration and connection principles within UMTS with a CS service domain and a PS service domain are equivalent to GSM/GPRS – user (temporary) identification, authentication, and key agreement – which take place independently in each service domain. User plane traffic will be ciphered using the cipher key (CK) agreed for the corresponding service domain, while control plane data will be ciphered and integrity protected using the cipher and integrity keys from either one of the service domains.

4.2 Ciphering 4.2.1 Universal Terrestrial Radio Access Network (UTRAN In the UTRAN, information between the UE and the RNC can be ciphered. This is done at either the MAC or the RLC protocol layers. A CK, which is shared by the CN and the UE after authentication, is sent from the CN to the RAN. The RNC can then enable the ciphering.

4.2.2 Core Network (CN) In R99 only access network (UTRAN) ciphering is defined. Subsequent releases also specify ciphering in the CN. For this two techniques are defined at present: MAPsec and IPsec. MAPsec, which is defined for Rel-4, is a protocol used to cipher control plane information (signaling), i.e. MAP operations. IPsec, which is defined for Rel-5, is a protocol used to cipher user plane information, i.e. IP data. In addition to the ciphering protocols, new network elements – Key Administration Centers (KAC) and Security Gateways (SEG) – are needed to allow the transfer of ciphering keys between networks (refer to figure 4.2).


Figure 4.2 Security between networks. 4.2.2.1 Ipsec The UMTS network control plane is sectioned into security domains, which typically coincide with operator borders. The border between the security domains is protected by SEGs. The SEGs are responsible for enforcing the security policy of a security domain towards other SEGs in the destination security domain. The network operator may have several SEGs in the network for redundancy or performance reasons. The UMTS network domain security does not extend to the user plane and consequently the security domains and the associated SEGs towards other domains do not include the user plane Gi-interface towards other IP networks. In UMTS Network Domain Security (NDS) architecture, the key management and distribution between SEGs is handled by the protocol Internet Key Exchange (IKE). The main purpose of IKE is to negotiate, establish and maintain Security Associations (SA) between parties requiring secure connections. The concept of SA is central to IPsec and IKE. The SA defines which security protocol to be used, the SA mode and the endpoints of the SA. In UMTS NDS, the IPsec security protocol must always be Encapsulating Security Payload (ESP) and the SA mode shall always be a tunnel mode. In NDS it is further required that integrity protection/message authentication together with anti-replay protection is used. The security services provided by NDS/IP are: • Data integrity

• Data origin authentication

• Anti-replay protection

• Confidentiality (optional)

• Limited protection against traffic flow analysis when confidentiality is applied

4.2.2.2 MAPsec MAPsec provides security for the MAP protocol on the application layer. This is done by adding a security header to MAP operations. MAPsec is independent of the network and transport protocols used. Before protection can be applied, SA are established between the involved MAP network elements. SA define the keys, algorithms, and protection profiles etc. to be used to protect the MAP signaling. The necessary MAP-SAs between networks are negotiated between the respective network operators. The negotiated SA will be effective PLMN-wide and distributed to all network elements that implement MAP application layer security within the PLMN. However, automated key management and key distribution (to set up the SA) is not part of Rel-4. This must therefore be carried out by other means (see 3GPP TS 33.200 Annex A).


MAPsec provides for three different protection modes: • Protection mode 0: No protection

• Protection mode 1: Integrity, Authenticity

• Protection mode 2: Confidentiality, Integrity and Authenticity (ciphered)


5. Mobile Quality of Service (QoS) 5.1 Introduction The way to success for mobile IP network operators is to shift their focus from transmission speed or best technology to creating innovative service packages and delivering them with high quality. Mobile IP offers a huge potential for innovative services, but at the same time it is the most complex environment in which to achieve high QoS. To deliver IP-based applications and services, mobile network operators have to design IP-based wireless networks using radio access technologies and packet-based core networks. The wired IP world and the mobile wireless world are two fundamentally different networks, and they require different strategies for providing QoS. To achieve an end-to-end QoS, policies must be in place that span between the wired and wireless worlds. Radio access networks have limited bandwidth that must be shared between customers. Together with customer mobility, this results in highly variable quality levels. Mobile QoS techniques must ensure fair access to limited radio bandwidth and use mobility management to optimize the mobile IP transport. In the fixed line IP world, QoS mechanisms deal mostly with bandwidth availability and prioritized treatment of traffic to handle random traffic patterns with frequent data bursts.

Figure 5.1 QoS segments. In addition, as the above figure shows, end-to-end QoS requires QoS interworking between the mobile part and the IP-based Internet.

5.2 What is Quality of Service (QoS)? QoS is a key parameter for the future mobile IP. QoS, however, is also subjective depending on the expectations of individual users. So how can it be quantified? QoS parameters attempt to quantify user experience based on measurements of the network’s ability to deliver specific services as described, for instance in IETF RFC 1224, RFC 2212 or RFC 2544 for IP. The user experience is related to the quality of the session and the response time of the network as well as the general availability of the service and the network.


The quality of the session is quantified by: • Jitter, i.e. the delay variation in the network

• Throughput, i.e. the rate at which packets can be transferred without packet loss

The response time is quantified by: • Round Trip Time (RTT), i.e. the time from sending a packet to receiving acknowledgement

• Uni-directional end-to-end delay, also called latency, i.e. the time needed to send a packet across the network)

• Throughput

The availability and reliability is quantified by • Ability to access network resources or (network utilization)

• 24/7 service level monitoring

Based on targets for these parameters, QoS can be designed into the network and during operation used as a reference for actual network performance. In mobile networks the critical factor for all parameters will be the radio link and customer mobility.

5.3 Mechanisms for Delivering QoS End-to-end QoS requires guaranteed service levels at the access points and in the backbone. To provide end-to-end QoS that bridges the wireless and terrestrial IP networks, each element along the data path must conform to a traffic contract. As shown above in Figure 5.1 the mobile network requires three QoS mechanisms: • Mobile QoS

• QoS interworking

• Fixed network QoS

Of the three it is considerably more difficult to bring QoS to the mobile access network than to the high-speed core networks. Wireless environments inherently have greater error rates, higher delays, and more limited access resources than fixed networks. Many of the techniques (for instance encoding) used to minimize error rates within the UTRAN increase end-to-end delay. At the same time, limitations in the available bandwidth often lead to congestion. Wireless QoS mechanisms focus on ensuring fair access to the available resources to avoid congestion. Bridging between mobile and IP core networks (in GPRS/UMTS the Gi interface) is also a great challenge. Operators must map IP-based network service classes (or specific IP applications) to wireless network QoS service classes to ensure that QoS is provided through access networks.

5.3.1 UMTS QoS Architecture To ensure mobile QoS in UMTS, a QoS service architecture has been defined based on a hierarchy of bearer services. A given QoS relies on bearer services with clearly defined characteristics to be set up from the source to the destination. Traffic has to pass different bearer services of the networks on its way from the source to the destination. The end-to-end service used by the mobile terminal will be realized through several different bearer services as illustrated in Figure 5.2: A Terminal Equipment (TE)/Mobile Terminal (MT) local bearer service, a UMTS bearer service and an external bearer service, for instance the Internet. Important to note is that the end-to-end service requires translation/mapping with external services like the Internet. Each bearer service offers its individual performance characteristics based on the services provided by the layers below (ATM or IP for example). For instance, the UMTS part of the network implements QoS, based on the RAB service and CN bearer services, which again use the radio interface or IP/ATM as the lower layer services.


When a user requests a service with a specific quality, e.g. during the PDP Context Activation procedure described in section 3.6, the application negotiates, via the CN, a RAB service with certain attributes. In that way UMTS allows a user to negotiate bearer characteristics that are most appropriate for carrying information. In addition it is possible to change bearer properties via a bearer re-negotiation procedure in the course of an active connection, e.g. in handover situations it might be necessary to handle customer mobility.

Figure 5.2 UMTS QoS architecture. The RAB service is achieved using the RB service and the lu bearer service. The RB service handles all the aspects of the radio interface transports and decides the QoS attributes of the session as given in the following during the PDP context activation.

QoS Attribute Usage Maximum bit rate The bit rate delivered to/from the user allows allocation of coding schemes

Delivery order Does the application require data in the right sequence e.g. buffering required?

Maximum Service Data Unit (SDU) size

SDU size in Octets. Used for admission control and policing

SDU format information Knowledge of SDU size enables better use of bearer service

SDU error ratio Allocation of UTRAN protocols, algorithms and error correction schemes

Residual bit error ratio Allocation of radio protocols, algorithms and error correction schemes

Delivery of erroneous SDUs Decides if errored SDU will be delivered

Transfer delay Provides the delay tolerance (in ms) of the application

Guaranteed bit rate Used to allow resource allocation and admission control

Traffic handling priority Relative importance of different SDU. Can be used instead of absolute guarantee

Allocation/Retention priority Used by network elements (not the mobile terminal) to allocate resources to bearers with high priority.

Figure 5.3 QoS attributes and their usage.


The Iu bearer service together with the physical bearer service provides the transport between UTRAN and CN. It is the option of the operator to use IP or ATM and the related QoS capabilities of the lu bearer service. Differentiated services defined by IETF must be used for IP-based Iu bearer services. If an operator chooses ATM-SVC as an internal dedicated transport bearer, interoperation with IP-based networks will be based on Differentiated Services. The operator will control the mapping from UMTS QoS classes to Diffserv codepoints. The CN bearer service controls the backbone UMTS so that the contracted UMTS bearer service is achieved. It is the option of the operator to decide which of the QoS capabilities in the IP layer or QoS capabilities in the ATM layer is used. For the IP-based backbone, differentiated services defined by IETF must be used. If the operator chooses ATM-SVC as an internal dedicated transport bearer, interoperation with IP based backbone networks will be based on differentiated services. The operator will control the mapping from UMTS QoS classes to Diffserv codepoints.

5.3.2 UMTS QoS Classes To enable differentiation of traffic flows in the network, four different application-related RAB service classes have been defined: Conversational, streaming, interactive and background. Each service class is intended to carry traffic flows of different kinds of applications. Speech and video are examples of conversational services, uni-directional audio- and video streaming are streaming services, web browsing is a typical interactive service while email and file transfer are background services. The figure below illustrates how different services use the traffic classes to achieve the QoS required.

Figure 5.4 Using traffic classes to achieve required QoS. The main distinguishing factor between these classes is how delay-sensitive the traffic is. The conversational class is meant for very delay-sensitive traffic, while the background class is the most delay-insensitive. The following table provides an overview of the four classes and the QoS attributes associated with each class.


Traffic Class Conversational Class Streaming Class Interactive Class Background Fundamental characteristics

• Preserve time relation (variation) between information entities of the stream

• Conversational pattern (stringent and low delay based on human perception)

• Preserve time relation (variation) between information entities of the stream

• Steady & continues stream

• Tolerates jitter (buffering)

• Usually asymmetric

• Request response pattern

• Preserve payload content

• Transaction

• Destination is not expecting the data within a certain time

• Preserve payload content

Example of the application

• Voice • Streaming video • Web browsing • Background download of emails

Traffic Class Conversational Class Streaming Class Interactive Class Background Class Maximum bit rate (kbps)

< 2 0481 2 < 2 0481 2 < 2 048 – overhead2 3 < 2 048 –overhead2 3

Delivery order Yes/No Yes/No Yes/No Yes/No

Maximum SDU size (octets)

<=1 500 or 1 5024 <=1 500 or 1 5024 <=1 500 or 1 5024 <=1 500 or 1 5024

SDU format information

5 5

Delivery of erroneous SDUs

Yes/No/-6 Yes/No/-6 Yes/No/-6 Yes/No/-6

Residual BER 5*10-2, 10-2, 5*10-3, 10-3, 10-4, 10-6

5*10-2, 10-2, 5*10-3, 10-3, 10-4, 10-6

5*10-2, 10-2, 5*10-3, 10-3, 10-4, 10-6

5*10-2, 10-2, 5*10-3, 10-3, 10-4, 10-6

SDU error ratio 10-2, 7*10-3, 10-3, 10-4, 10-5

10-2, 7*10-3, 10-3, 10-4, 10-5

10-2, 7*10-3, 10-3, 10-4, 10-57

10-2, 7*10-3, 10-3, 10-4, 10-57

Transfer delay (ms) 100 – maximum value 250 – maximum value

Guaranteed bit rate (kbps)

< 2 0481 2 < 2 0481 2

Traffic handling priority

1, 2, 38

Allocation/retention priority

1, 2, 38 1, 2, 38 1, 2, 38 1, 2, 38

Figure 5.5 UMTS QoS classes.

1 Bit rate of 2.048 kbps requires that UTRAN operates in transparent RLC protocol mode, in this case the overhead from layer 2 protocols is negligible 2 The granularity of the bit rate attributes must be studied. Although the UMTS network has the capability to support a large number of different bit rate values, the number of possible values must be limited in order not to unnecessarily increase the complexity of terminals, charging and interworking functions etc. An exact list of supported values must be defined together with S1, N1, N3 and R2 3 Impact from layer 2 protocols on maximum bit rate in non-transparent RLC protocol mode must be estimated 4 In case of PDP type = PPP, maximum SDU size is 1,502 octets. In other cases, maximum SDU size is 1,500 octets 5 Definition of possible values of exact SDU sizes, for which UTRAN can support transparent RLC protocol mode, is the task of RAN WG3 6 If Delivery of erroneous SDUs is set to 'Yes', error indications can only be provided on the MT/TE side of the UMTS bearer. On the CN gateway side error indications cannot be signaled outside of UMTS network in R99 7 Values are derived from CRC lengths of 8, 16 and 24 bits on layer 1 8 The number of priority levels must be further analyzed by S1, N1 and N3


6. UMTS Testing Test and Measurement is a critical enabler for running an efficient operation, especially for such a complex system as UMTS. Test and Measurement is the key to optimal usage of resources. Test and Measurement is also the fast track to detailed information on business metrics. No one can afford to enter a highly competitive market with a non-perfect service. The winners over the next few years are not going to be driven by the highest transmission speed or best technology. Companies that can create innovative service packages and deliver them with high quality are going to be the winners.

Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics. In today’s world, new network operators are emerging, networks are converging, and individual networks are growing in complexity. Test equipment must empower users to diagnose problems easily, even though they may be unfamiliar with the underlying network technology. This requires intelligent traffic analysis, and providing results in a concise manner that is easy to understand. The needs for testing UMTS networks can generally be divided into two phases: • Installation and provisioning

• Maintenance

Installation and provisioning testing includes: • Verification of the transport layers

• Verification of correct signaling between equipment in a multi-vendor network

• System upgrading and integration testing

• Functional testing/service presence verification

In the maintenance phase of a network, regular testing is necessary to ascertain that the quality of the network is at the required level and at that the network has sufficient capacity to handle the traffic. Examples of tests are: • Signaling analysis

• Troubleshooting

• QoS testing

• Handover performance

- UEs will perform soft handovers almost constantly during voice calls in areas with small cells

• Interconnect testing

NetTest offers a comprehensive set of solutions for UMTS network testing, ranging from hot spot expert analysis testing to end-to-end network monitoring of the UMTS network.


6.1 Hot Spot Expert Analysis Tools

Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools.

6.1.1 InterQuest Probe The InterQuest Probe is a scalable, high-density data collection capture tool, capable of collecting large volumes of network traffic for active service applications or post-analysis with expert tools in a cost-efficient manner. The InterQuest Probe is capable of collecting data from a large number of links over numerous E1, DS1 and OC3 interfaces simultaneously, allowing offline expert analysis tools such as Compass and Impact to analyze many different connections simultaneously, providing a more accurate picture of network performance. The more interfaces that can be monitored, the better the information provided by Compass and Impact, allowing a better statistical basis. The InterQuest Probe scales to the network, allowing more links to be monitored as the network grows. The InterQuest probe can be operated remotely over LAN or modem as well as locally with control of multiple units from the same workstation. Data from multiple units can be correlated. The multiple technologies supported allows data capture in the access as well as the core network.

Figure 6.3 The InterQuest is a powerful tool with the ability to capture large amounts of data from multiple links in both access and core network.


6.1.2 Impact The core network signaling is the foundation for the fundamental services in UMTS. Impact offers network analysis and performance documentation of: • Location management

• Roaming

• Authentication and security

• Message services QoS

6.1.3 Compass Compass is acknowledged in the mobile market as the most advanced solution for the troubleshooting and optimization of the access network. From statistical network overview to subscriber details and call tracing, Compass enables significant improvements to maintenance procedures: • Troubleshooting

• Functional testing

• Optimization

• QoS testing

• Call analysis and subscriber tracing

Figure 6.5 Compass is the most advanced solution for the optimization and troubleshooting of the access network.

Figure 6.4 Impact offers network analysis and performance documentation of roaming and SMS QoS.


6.2 End-to-End Network Monitoring

Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most complete surveillance solution available today. MasterQuest UMTS builds on this platform.

6.2.1 MasterQuest MasterQuest is NetTest's advanced network surveillance solution for next generation networks. MasterQuest is a highly scalable system based on a distributed architecture, utilizing non-intrusive network probes. Probes are located at the sites where the monitored links terminate, while a central server is located at the network surveillance center. Components of the system communicate through a standard LAN/WAN structure. Probes will transmit captured data back to the central server where it is being correlated and presented to the network operator. By virtue of its distributed architecture, MasterQuest data can also be assessed remotely from a field location. MasterQuest for UMTS is the centralized solution for: • Troubleshooting and network operations

• Planning and optimization

• Interconnect management

• Customer management

MasterQuest will perform network-wide correlation and focus on monitoring of end-to-end service delivery performance.

Technical Note

Figure 6.7 MasterQuest performs network-wide correlation and monitors end-to-end service delivery performance.


7. Terms and Abbreviations 1G The first generation of mobile telephone systems

2.5G Enhanced second generation of mobile telephone systems

2G The second generation of mobile telephone systems

3G The third generation of mobile telephone systems

3GPP Third Generation Partnership Project

3GPP-2 Third Generation Partnership Project Number 2

AAL2 ATM Adaptation Layer 2

AAL5 ATM Adaptation Layer 5

AH Authentication Header

ALCAP Access Link Control Application Part

AN Access Network

API Application Programming Interface

APN Access Point Name

ARIB Association of Radio Industries and Business (Japan)

ATM Asynchronous Transfer Mode

AuC Authentication Center

BCF Bearer Control Function

BG Border Gateway. Logical box that connects two (or more) operators together via Inter-PLMN backbone. BG protects operator’s intra-PLMN network against intruders

BICC Bearer Independent Call Control protocol

BSC Base Station Controller

BSS Base Station Subsystem

BSSAP+ Base Station System Application Part+ Protocol between SGSN and MSC/VLR

BSSGP Base Station System GPRS Protocol. Protocol between SGSN and BSS

BTS Base Transceiver Station

BVCI BSSGP Virtual Connection Identifier

CAP CAMEL Application Part

CC Call Control

CCF Call Control Function

CDMA Code Division Multiple Access

CDMA-2000 North American CDMA standard, likely to be used for UMTS in North America

CEPT Conference of European Posts and Telegraphs

CGI Cell Global Identification

C/I Carrier to Interference Ratio, equal to SIR

CK Cipher Key

CM Call Management

CN Core Network

CRNC Controlling Radio Network Controller (RNC)

CS Circuit Switched

CSCF Call State Control Function

CS-MGW Circuit Switched Media Gateway

CWTS China Wireless Telecommunications Standard Group (China)

DRNC Drift Radio Network Controller (RNC)


EDGE Enhanced Data rates for Global/GSM Evolution

EGPRS Enhanced GPRS

EIR Equipment Identity Register

ESP Encapsulating Security Payload

ETSI European Telecommunication Standard Institute

FDD Frequency Division Duplex

GEA GPRS Encryption Algorithm

GERAN GSM/EDGE Radio Access Network

GGSN Gateway GPRS Support Node

GMLC Gateway Mobile Location Center

GMM/SM GPRS Mobility Management and Session Management. Protocol stack between MS and SGSN that handles GPRS attach/detach, PDP context activation/deactivation, etc.

GMSC Gateway MSC

GPRS General Packet Radio Service

GPRS-CSI GPRS CAMEL Subscription Information

GPRS-SSF GPRS Service Switching Function

GSIM GSM Service Identity Module

GSM Global System for Mobile communication. Original meaning: Groupe Spécial Mobile

GSM 1800 GSM system operating at 1800 MHz

GSM 1900 GSM system operating at 1900 MHz (North America)

GSM 900 GSM system operating at 900 MHz

GSM-SCF GSM Service Control Function

GSN GPRS Support Node

GTP GPRS Tunneling Protocol. Protocol between the UTRAN and the SGSN and between the SGSN and the GGSN to encapsulate user data and to carry GPRS signaling

GTP-C GPRS Tunneling Protocol for the Control plane

GTP-U GPRS Tunneling Protocol for the User plane

HE Home Environment

HLR Home Location Register

HSCSD High Speed Circuit Switched Data

HSS Home Subscriber Server

HTML HyperText Markup Language

HTTP HyperText Transfer Protocol

IAM Initial Address Message

ICMP Internet Control Message Protocol

IESG Internet Engineering Steering Group

IETF Internet Engineering Task Force

IK Integrity Key

IKE Internet Key Exchange

IM IP Multimedia

IMEI International Mobile Equipment Identity

IM-MGW IM Media Gateway

IMS IP Multimedia (IM) Subsystem

IMSI International Mobile Subscriber Identity

IN Intelligent Network


IP Internet Protocol

IPsec IP security

IPv4 Internet Protocol version 4

IPv6 Internet Protocol version 6

IPX Internet Packet eXchange

IS-95 North American cellular telephony system

ISDN Integrated Services Digital Network

ISP Internet Service Provider

ISUP ISDN User Part

ITU-T International Telecommunication Union, Telecommunication Standardization Sector

Iu Interface between CMS/SGSN and the RNC

Iub Interface between RNC and the Node B

Iur Interface between two RNCs

IWU Inter Working Unit

KAC Key Administration Center

KSI Key Set Identifier

L2TP Layer-2 Tunneling Protocol

LA Location Area

LAI Location Area Indicator

LAN Local Area Network

LLC LLC Logical Link Control. Protocol layer between MS and SGSN

LMU Location Measurement Unit

LU Location Update

M3UA MTP3 User Adaptation Layer

MAC Medium Access Control. Protocol in the radio level that is used to allocated the radio channel

MAP Mobile Application Part

MAPsec MAP security

MBMS Multimedia Broadcast/Multicast Service

ME Mobile Equipment

MEGACO MEdia GAteway COntrol protocol

MGC Media Gateway Controller, same functions as MSC-Server

MGCF Media Gateway Control Function

MGW Media Gateway

MIP Mobile IP

MM Mobility Management

MMS Multimedia Messaging Service

MMSE Multimedia Messaging Service Environment

MRFC Multimedia Resource Function Controller

MRFP Multimedia Resource Function Processor

MS Mobile Station (GSM/GPRS) equal to UE in UMTS

MSC Mobile Switching Center

MSC-S MSC Server, Same functions as MGC

MT Mobile Terminal, the MT together with the TE and the USIM forms the UE

MTP2 Message Transfer Part layer 2


MTP3 Message Transfer Part layer 3

MTP3b Message Transfer Part 3b

NAS Non Access Stratum

NBAP Node B Application Part

NDS Network Domain Security

NDS/IP NDS for IP based protocols

NNI Network-Network interface

Node B The “BTS” of the UMTS network

NS Network Service. Protocol layer between BSS and SGSN

NSAPI Network layer Service Access Point Identifier. Identifier that specifies the PDP context in MS and in SGSN

NSS Network SubSystem. Network part of the network (in GPRS it means SGSN and GGSN)

OHG Operator Harmonization Group

PCF Policy Control Function

PCS1900 Personal Communication system – another name for the North American version of the GSM system (GSM 1900)

P-CSCF Proxy CSCF

PCU Packet Control Unit

PDA Personal Digital Assistants

PDCH Packet Data Channel

PDCP Packet Data Convergence Protocol

PDN Packet Data Network

PDP Packet Data Protocol (e.g. IP and X.25)

PDU Protocol Data Unit

PLMN Public Land Mobile Network

PMM Packet Mobility Management

PPF Paging Proceed Flag

PPP Point-to-Point Protocol

PS Packet Switched

P-TMSI Packet Temporary Mobile Subscriber Identity

PTP Point To Point

PVC Permanent Virtual Circuit

R99 UMTS Release 1999

RA Routing Area. A set of cells that belongs to one group. RA is always a subset of a LA (location Area)

RAB Radio Access Bearer

RAC Routing Area Code

RAI Routing Area Identity

RAN Radio Access Network

RANAP Radio Access Network Application Part

RAT Radio Access Technology

RAU Routing Area Update

RB Radio Bearer

Rel-4 UMTS Release 4


Rel-5 UMTS Release 5

RLC Radio Link Control. A protocol between MS and BSS to handled retransmission and other radio related issues

RNC Radio Network Controller

RNS Radio Network Subsystem

RNSAP Radio Network Subsystem Application Part

RNTI Radio Network Temporary Identity

RRC Radio Resource Control

RRM Radio Resource Management. Algorithms and procedures for establishing and maintaining radio path quality between the UE and the RNC

RTP Real-time Transport Protocol

SA Security Associations

SCCP Signaling Connection Control Part

SCTP Stream Control Transmission Protocol

SEG SEcurity Gateway

SGSN Serving GPRS Support Node

SGW Signaling Gateway

SIM Subscriber Identity Module

SIP Session Initiation Protocol

SIR Signal to Interference Ratio, equal to C/I

SM Short Message

SMS Short Message Service

SM-SC Short Message service Service Center

SMS-GMSC Short Message Service Gateway MSC

SMS-IWMSC Short Message Service Interworking MSC

SN Serving Network

SNDC SubNetwork Dependent Convergence

SNDCP SubNetwork Dependent Convergence Protocol

SN-PDU SNDCP PDU

SPI Security Parameter Index

S-RB Signaling Radio Bearer

SRD Software Requirements Document

SRNC Serving Radio Network Controller (RNC)

SRNC Serving Radio Network Subsystem (RNS)

SS7 Signaling System No. 7

SSCF-NNI Service Specific Co-ordination Function - Network Node Interface

SSCF-UNI Service Specific Co-ordination Function - User Network Interface

SSCOP Service Specific Connection Oriented Protocol

STP Signaling Transfer Point

T1 North American primary rate (1.5 Mbps) specified by Standardization Committee T1 Telecommunications (USA)

TCAP Transaction Capabilities Application Part

TCP Transmission Control Protocol

TCP/IP Transmission Control Protocol/Internet Protocol

TDD Time Division Duplex

TDMA Time Division Multiple Access


TE Terminal Equipment, the TE together with the MT and the USIM forms the UE

TEID Tunnel Endpoint Identifier

TFT Traffic Flow Template

TLLI TLLI Temporary Logical Link Identity. Identifier of the mobile used between MS and SGSN

TMSI Temporary Mobile Subscriber Identity

TNCP Transport Network Control Plane

TOS Type of Service

TRAU Transcoder and Rate Adaptor Unit

TTA Telecommunications Technology Association (Korea)

TTC Telecommunications Technology Committee (Japan)

UDP User Datagram Protocol

UE User Equipment (i.e. the UMTS wireless terminal)

UEA UMTS Encryption Algorithm

UIA UMTS Integrity Algorithm

UMTS Universal Mobile Telecommunications System

URA UTRAN Registration Area

USIM Universal Service Identity Module

USSD Unstructured Supplementary Service Data

UTRAN Universal Terrestrial Radio Access Network

UUS User-to-User signaling

VAS Value Added Service

VHE Virtual Home Environment

VLR Visitor Location Register

WAP Wireless Application Protocol

WCDMA Wideband Code Division Multiple Access

WML Wireless Markup Language

For more terms, refer to 3GPP TR 21.905: "3G Vocabulary" (http://www.3gpp.org)


8. Websites

3GPP Third Generation Partnership Project http://www.3gpp.org/

3GPP-2 Third Generation Partnership Project Number 2 http://www.3gpp2.org/

3G.IP http://www.3gip.org/

ARIB Association of Radio Industries and Business http://www.arib.or.jp/

CWTS China Wireless Telecommunications Standard Group

http://www.cwts.org/

ETSI European Telecommunication Standard Institute http://www.etsi.org/

GSA Global mobile Suppliers Association http://www.gsacom.com/

GSM Association http://www.gsmworld.com/

IETF The Internet Engineering Task Force http://www.ietf.org/

IPV6 Forum http://www.ipv6forum.com/

MWIF Mobile Wireless Internet Forum http://www.mwif.org/

T1 Standardisation Committee T1 Telecommunications http://www.t1.org/

TTA Telecommunications Technology Association http://www.tta.or.kr/

TTC Telecommunications Technology Committee http://www.ttc.or.jp/

UMTS Forum http://www.umts-forum.org/

UWCC Universal Wireless Communications Consortium http://www.uwcc.org/

WMF Wireless Multimedia Forum http://www.wmmforum.com/


9. References

Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS); Network architecture (3GPP TS 23.002 Release 5)

Service Requirements for the IP Multimedia Core Network Subsystem (Stage 1), (3GPP TS 22.228)

IP Multimedia (IM) Subsystem – Stage 2 (Release 5), (3GPP TS 23.228)

Multimedia Messaging Service (MMS); Functional description; Stage 2, (3GPP TS 23.140)

Universal Mobile Telecommunications System (UMTS); UTRAN Overall Description (3GPP TS 25.401)

UTRAN Iu Interface: General Aspects and Principles (3GPP TS 25.410)

UTRAN Iu interface signaling transport (3GPP TS 25.412)

Universal Mobile Telecommunications System (UMTS); UTRAN Iu Interface RANAP Signaling (3GPP TS 25.413)

UTRAN Iur Interface: General Aspects and Principles (3GPP TS 25.420)

Universal Mobile Telecommunications System (UMTS); UTRAN Iur Interface RNSAP Signaling (3GPP TS 25.423)

UTRAN Iub Interface: General Aspects and Principles (3GPP TS 25.430)

Universal Mobile Telecommunications System (UMTS); UTRAN Iub Interface NBAP Signaling (3GPP TS 25.433)

Radio Interface Protocol Architecture (3GPP TS 25.301)

Radio Resource Control (RRC) protocol specification (3GPP TS 25.331)

Medium Access Control (MAC) protocol specification (3GPP TS 25.321)

Radio Link Control (RLC) protocol specification (3GPP TS 25.322)

Packet Data Convergence Protocol (PDCP) specification (3GPP TS 25.323)

Technical realization of Short Message Service (SMS) (3G TS 23.040)

B-ISDN ATM layer specification (I.361)

B-ISDN ATM Adaptation Layer specification: Type 2 AAL (I.363.2)

Type 5 AAL (I.363.5)

General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface (3GPP TS 29.060)

Mobile Application Part (MAP) specification (3GPP TS 29.002)

General Packet Radio Service (GPRS) Service description (3GPP TS 23.060)

Serving GPRS Support Node SGSN - Visitors Location Register (VLR); Gs Interface Network Service Specification (3GPP TS 29.016)

General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) - Visitors Location Register (VLR); Gs interface layer 3 specification (3GPP TS 29.018)

Control protocol for multimedia communication (H.245)

Gateway control protocol (H.248)

3G Security; Security Architecture (3GPP TS 33.102)

3G Security; Network Domain Security; MAP application layer security (3GPP TS 33.200)

3G Security; Network Domain Security; IP network layer security (3GPP TS 33.210)

3G Security; A Guide to 3rd Generation Security (3GPP TR 33.900)


NetTest A/S Kirkebjerg Allé 90 DK-2605 Brøndby Denmark Tel: +45 72 11 22 00 Fax: +45 72 11 22 10 E-mail: [email protected] web: www.nettest.com

NetTest Sales Offices Brazil +55 11 5505 6688 Italy +39 02 95 12 621China +86 10 6467 9888 Singapore +65 6220 9575 France +33 1 49 80 47 48 Spain +1 91 372 92 27 Germany +49 89 99 89 01-0 USA +1 315 797 4449

NetTest is a leading industry specialist devoted to providing test andmeasurement instruments and network management solutions designed toempower global telecommunication leaders in optimizing their businessperformance. NetTest's solutions enable customers to gain vital insightsinto the function and performance of their networks, allowing them to makeinformed decisions that drive profitability by enhancing quality andminimizing infrastructure investments. NetTest is focused on servicing twoareas of the telecommunications network, namely Installation andMaintenance and Network Monitoring and Optimization.

ISO

900

0 ce

rtifie

d. S

UM

TS-T

N02

-030

4-A4

. 20

02 N

etTe

st. A

ll R

igts

Res

erve

d. S

peci

ficat

ions

sub

ject

to c

hang

e w

ithou

t not

ice.

E&E

O.

Documents

Tech note umts