Mobility Workshop 2G/3G Network Architecture
October 5th, 2010
2 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
2G GSM
2G GSM Network Architecture
Abis interface is comprised of multiple T1s (TDM).
Signaling between elements is carried out over an SS7 or SIGTRAN (SS7oIP) network.
Slide # 3 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Abis
BSS (TDM)
A
E
B
F
D
D
E
H
C
E
C
MS
RAN
BTS BSC
MSC
VLR
MSC
GMSC
EIR
B
F
VLR
EIR
AuC
HLR
SMSG
PSTN
NSS
Um
GSM Node Definitions
MS: Mobile Subscriber
The subscriber and the mobile device.
BTS: Base Station Transceiver
Mobile wireless transceiver used to aggregate discrete mobile systems in the BSS.
BSC: Base Station Controller
BTS aggregator and controller. Termination point for the Abis interface.
BSS: Base Station Subsystem
The MS, BTS and BSC.
MSC: Mobile Switching Center
Main call processing element in the mobile wireless network. Equivalent to a Class 5 switch.
VLR: Visitor Location Register
A database that stores information related to the MSs associated with the MSC to which it is attached.
HLR: Home Location Register
A central database that stores the subscriber information for all mobile subscribers authorized to use a given GSM network.
EIR: Equipment Identity Register
A database that stores information regarding specific mobile subscriber equipment (used for blocking access and tracking stolen equipment, etc.).
AuC: Authentication Center
A central database used to authenticate each SIM that attempts network access.
Slide # 4 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GSM Interface Definitions
A Interface TDM interface connecting BSC to MSC. Carries all bearer and signaling traffic associated with GSM mobile
services.
Abis Interface The BSS-based TDM interface connecting the BTS to the BSC.
B Interface TDM signaling interface between the MSC and VLR. Used to access subscriber account information.
C Interface Interface between the HLR and a GMSC or SMSG. Every call originating from the PSTN has to go through
a gateway to obtain routing information using the MAP/C protocol.
D Interface TDM signaling interface between the VLR and HLR. Used to pass master subscriber account information
from the HLR to the VLR
E Interface TDM bearer interface connecting MSCs or MSC gateways (GMSC, SMS Gateway). Used to transport voice
bearer traffic.
F Interface TDM signaling interface between the MSC and EIR. Used to access equipment registration information.
G Interface Interconnects two VLRs that belong to different MSCs and uses the MAP/G protocol to transfer subscriber
information (such as during a location update procedure).
H Interface TDM signaling interface between the HLR and AuC. Used to authenticate subscribers.
Um Interface The air interface used for communication between the MS and a BSS. LAPDm (modified version of ISDN
LAPD), is used for signaling.
Slide # 5 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GPRS Overview
General Packet Radio Service (GPRS)
Generally referred to as 2G
Developed specifically for the transmission of data in mobile wireless
networks
Maximum theoretical data rate of 171.2 kbps
Uses the same underlying RF technology as GSM
Core Services
Point-to-point IP applications
Point-to-multipoint IP applications (relatively uncommon)
Internet applications for smart devices through WAP and IP
SMS
MMS
Push-to-talk over Cellular (PTT/PoC)
Copyright © 2009 Juniper Networks, Inc. www.juniper.net
EDGE Overview
Enhanced Data rates for GSM Evolution (EDGE)
Also known as EGPRS
Generally referred to as 2.5G
Characteristics:
Uses the same base RF attributes as GPRS
Enhances data rates by applying enhancement to carrier modulation
– GMSK used by GSM/GPRS
– GMSK + 8PSK used by EDGE
– EDGE produces 3-bit words for every change in phase
– Effectively triples the gross data rate
– Theoretical maximum data rates:
- 2 timeslots == 118.8 kbps
- 4 timeslots == 236.8 kbps
- 8 timeslots == 473.6 kbps
– Most carriers deploy 2 or 4 timeslots and reserve the remainder for voice
Slide # 7 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GPRS vs. EDGE Comparison
GPRS EDGE
Modulation GMSK 8PSK/GMSK
Symbol Rate 270 ksym/s 270 ksym/s
Modulation Bitrate 270 kbps 810 kbps
Radio Data Rate Per Timeslot 22.8 kbps 69.2 kbps
User Data Rate Per Timeslot 20 kbps (CS4) 59.2 (MCS9)
User Data Rate (8 Timeslots) 160 kbps
(182.4 kbps) 473.6 kbps
(553.6 kbps)
Slide # 8 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
2.5G GPRS/EDGE Network Architecture
Abis
BSS (TDM)
A
D
E
H
C
MS
RAN
BTS BSC MSC
GMSC
B
F
VLR
EIR
AuC
PSTN
Um
SGSN
PSN Gn
Internet
GGSN
Gi
PCU
Gb
GGSN
Gp
GRX
Gi
Internet
GTP
GTP
Local
PLMN
Remote
PLMN
HLR
Gr
Gs
Slide # 9 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Serving GPRS Support Node (SGSN)
The SGSN is responsible for delivery of packets to and from mobile
stations within a geographical service area.
Common SGSN Functions:
Detunnel GTP Packets from the GGSN (downlink).
Tunnel IP Packets in GTP towards the GGSN (uplink).
Carry out Mobility Management as standby mode mobile moves from
one Routing Area to another Routing Area.
Billing user data.
Lawful intercept.
Encrypt down-link data, decrypt up-link data to/from mobiles.
Logical Link management
Authentication
Stores temporary data such as location information and user profiles
in the serving Visiting Location Registrar (VLR).
Slide # 10 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Gateway GPRS Support Node (GGSN)
The GGSN is the main component of the GPRS core network.
GGSN is the IP anchor point for mobile data traffic
Responsible for interworking between the mobile network and
external networks such as the Internet.
From the external network’s point of view, the GGSN is a router to a
subnetwork.
Common GGSN Functions:
Tunnels/de-tunnels GTP protocol packets from the SGSN.
Manages PDP Contexts.
Responsible for IP address assignment.
Responsible for quality of service.
Acts as default gateway for the mobile.
Slide # 11 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GPRS/EDGE Node Definitions
PCU: Packet Control Unit
An addition to the BSC that provides packet processing capabilities between the RAN and the SGSN.
SGSN: Serving GPRS Support Node
An interworking element responsible for providing packet access between the RAN and the Packet Switched Network (PSN). Encapsulates subscriber traffic in GTP for transmission across the Gn interface.
GGSN: Gateway GPRS Support Node
An IP element responsible for de-encapsulating GTP traffic from the Gn interface and interfacing with external networks (such as the Internet).
GTP: GPRS Tunneling Protocol
The protocol used to tunnel user traffic across the PSN on the Gn interface.
AP: Access Point
A distinct closed user group or VPN. Represents a group of users with some common criteria.
APN: Access Point Name
The name used to designate a particular AP.
PDP Context: Packet Data Protocol Context
The PDP Context describes the active session of an MS connected to a particular APN. The PDP Context is active on the SGSN and the GGSN.
Slide # 12 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GPRS/EDGE interface definitions
Gb Interface A Frame Relay interface between the BSC and the SGSN.
Gn Interface IP-based interface between the SGSN and internal GGSNs. Uses GTP protocol.
Gp Interface IP-based interface between the SGSN and external GGSNs. Also uses GTP protocol.
Ga Interface (not shown) Interface that serves the Call Data Records (CDRs) which are written in the SGSN and sent to
the Charging Gateway (CG). This interface uses a subset of the GTP protocol called GTP’ (GTP Prime).
Gr Interface Interface between the SGSN and the HLR. Messages going through this interface use the MAP3
Protocol.
Gd Interface (not shown) Interface between the SGSN and the SMS Gateway (SMSG). Can use either MAP1, MAP2 or
MAP3.
Gs Interface Interface between the SGSN and the MSC/VLR. Uses BSSAP+ Protocol. This interface allows
paging and station availability when it performs data transfer. When the station is attached to the GPRS network, the SGSN keeps track of which Routing Area (RA) and Location Area (LA) to which the station is attached. When a station is paged this information is used to conserve network resources. When the MS initiates a PDP Context, the SGSN knows which BTS the MS is attached to.
Gi Interface The IP-based interface between the GPRS/EDGE network and the Internet.
Slide # 13 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
GPRS Tunneling Protocol (GTP)
GPRS Tunneling Protocol (GTP) is a group of IP-based protocols
used to carry data traffic within GSM and UMTS networks.
GTP is really composed of 3 separate protocols:
GTP-C
– The control portion of the GTP standard. When a subscriber requests a PDP Context, the
SGSN sends a Create PDP Context Request message to the GGSN. The GGSN will
respond with a Create PDP Context Response message.
– UDP port 2123
GTP-U
– The user portion of the GTP standard that is used to tunnel IP traffic within and between
mobile operator networks. Each subscriber may have one or more tunnels to support
different connections or different quality of service requirements.
– UDP port 2152
GTP’ (pronounced GTP Prime)
– The charging data portion of the GTP standard. Used to transfer charging data from the
SGSNs and GGSNs to the Charging Gateway Function (CGF).
– TCP or UDP port 3386
Slide # 14 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
PDP Context
The Packet Data Protocol (PDP) Context is a data structure which contains
the subscriber’s session information when an active session exists on the
network. It usually contains the following:
Subscriber’s IP address
Subscriber’s IMSI (International Mobile Subscriber Identity)
Subscriber’s Tunnel Endpoint ID (TEID) at the SGSN
Subscriber’s Tunnel Endpoint ID (TEID) at the GGSN
The TEID is a random number allocated by the SGSN/GGSN which identifies
the tunneled data related to a particular PDP Context.
2 kinds of PDP Contexts:
Primary
– Has a unique IP address associated with it.
Secondary
– Shares an IP address with the Primary Context.
– Created based on the Primary Context.
– Secondary PDP contexts may have different quality of service settings.
Slide # 15 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Access point Name (APN)
3GPP has the concept of virtual private networks that represent
communities of interest. These VPNs are called Access Points
(APs) and are identified by Access Point Names (APNs).
An APN defines a service description and routing for
GPRS/EDGE/UMTS data.
All traffic within and APN is routed in a similar manner.
When an SGSN sends user traffic in a GTP tunnel, it sends that
traffic to a GGSN that services the APN the subscriber’s traffic
belongs to.
Examples of APNs:
wap.cingular
epc.tmobile.com
blackberry.net
pp.vodafone.co.uk
Slide # 16 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
SGSN-to-GGSN Routing
How does an SGSN know which GGSN serves a particular APN?
APN names look suspiciously like DNS name… and this is precisely
what it is.
When an SGSN wants to connect a subscriber to an APN, it performs a DNS
lookup on the APN name (e.g. wap.cingular)
This query is sent to a special DNS infrastructure called Gn DNS.
The IP address returned by the Gn DNS is the destination address of the
nearest serving GGSN.
– Note that in order to scale the network and provide geo-redundancy, the Gn DNS
may return different results depending on the source IP address of the SGSN.
– Examples:
- SGSNs from Region 1 have source IP addresses in the 172.16.1.0/24 range.
- SGSNs from Region 2 have source IP addresses in the 172.16.2.0/24 range.
Gn DNS is a globally-connected infrastructure.
– More details on this will be covered in the section on Data Roaming.
Slide # 17 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Data Roaming
MS BTS BSC
HLR
SGSN PCU
GGSN
Root
Gn DNS
Visited PLMN
Home PLMN
SS7/SIGTRAN
GRX
Gn DNS
Gn DNS
GTP
1 2
3
Notice that
•IP Anchor (GGSN) is in the home network
•SGSN is in the visited network
•LI and Charging can be done in both networks
Slide # 18 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Service
Center Internet
Copyright © 2009 Juniper Networks, Inc. www.juniper.net
3G UMTS
Slide # 19 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
UMTS Family Air Interface Technologies UMTS - Universal Mobile Telecommunications System
Wideband Code Division Multiple Access (W-CDMA)
Introduced in 3GPP R99
Max theoretical data rate of 1.92 Mbit/s in the downlink
High-Speed Downlink Packet Access (HSDPA)
Based on 3GPP R5
Improves downlink data rate to speeds up to 14Mbit/s
Majority of deployments provide up to 7.2 Mbit/s in the downlink
High-Speed Uplink Packet Access (HSUPA)
Based on 3GPP R6
Enhanced to increase the uplink data rate up to 5.8 Mbit/s
Evolved High Speed Packet Access (HSPA+)
Based on 3GPP R7 & R8
Data rates up to 42 Mbit/s in the downlink and 11 Mbit/s in the uplink (per
5 MHz carrier)
Supports Multiple Input, Multiple Output (MIMO) technologies
Slide # 20 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
3G UMTS network architecture (R4)
IuB IuCS(S)
MS
UTRAN
NodeB RNC MSCS
MGW
VLR
EIR
AuC
PSTN
Uu
SGSN
PSN Gn
Internet
GGSN
Gi
IuPS
GGSN
Gp
GRX
Gi
Internet
GTP
GTP
Local
PLMN
Remote
PLMN
HLR
Gs
MGW PSN
IuCS(B)
IuX Interfaces are ATM-based:
IuPS = AAL5
IuCS = AAL2
NxT1 ATM IMA
Slide # 21 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
3G UMTS network architecture (R5+)
IuB IuCS(S)
MS
UTRAN
NodeB RNC MSCS
MGW
VLR
EIR
AuC
PSTN
Uu
SGSN
PSN Gn
Internet
GGSN
Gi
IuPS
GGSN
Gp
GRX
Gi
Internet
GTP
GTP
Local
PLMN
Remote
PLMN
HLR
Gs
MGW PSN
IuCS(B)
IuX Interfaces are IP-based • Changes the Backhaul Routing and
Aggregation requirements
• MX supports ethernet but not the (older)
ATM interfaces
Slide # 22 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
3G UMTS network architecture
IuB IuCS(S)
MS
UTRAN
NodeB RNC MSCS
MGW
VLR
EIR
AuC
PSTN
Uu
SGSN
PSN Gn
Internet
GGSN
Gi
IuPS
GGSN
Gp
GRX
Gi
Internet
GTP
GTP
Local
PLMN
Remote
PLMN
HLR
Gs
MGW PSN
IuCS(B)
Notes
1. The IP anchor can be either in the home
or visited network. • Pay attention this will come up again in LTE
• Multiple concurrent APNs are generally not used in 3G
2. Later releases support “direct tunnel” which
allows the bearer traffic to bypass the SGSN • Greatly reduces SGSN bearer load
• Some bearer (e.g. LI and Roaming) still
must go through the SGSN.
NxT1 ATM IMA
GTP
Gn
Slide # 23 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
UMTS Node Definitions
UE
User Equipment (the mobile device).
NodeB
Analogous to the BTS in the GSM/GPRS BSS, the NodeB is responsible for Ue
aggregation. Uses W-CDMA for the air interface.
Radio Access Controller (RNC)
Analogous to the BSC in the GSM/GPRS BSS, the RNC aggregates Iub traffic from
the NodeBs in a particular region of the RAN.
Responsible for air encryption, mobility management (handover), and voice/data
transmission to the circuit-switched and packet-switched core.
Call Server
A cut-down version of the MSC that is disassociated with the bearer path to reduce
size and cost. Responsible for all voice signaling functions.
Media Gateway (MGW)
The element responsible for interworking voice traffic between and among formats
(e.g. ATM AAL2 RTP/IP).
Slide # 24 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
UMTS Interface definitions
Uu
Air interface connecting the UE to the NodeB.
IuB
An ATM interface (R4) or IP interface (R5+) between the NodeB and RNC
carrying all voice and data bearer and signaling traffic.
IuR
An ATM interface (R4) or IP interface (R5+) connecting RNCs to one another.
AN RNC may operate as an S-RNC (Serving RNC), D-RNC (Drift RNC), or C-
RNC (Controlling RNC)
Iu-PS
An ATM interface (R4) or IP interface (R5+) connecting the RNC with the SGSN.
Used to transmit UE data traffic to the packet core.
Iu-CS
An ATM interface (R4) or IP interface (R5+) connecting the RNC with the Call
Server (Iu-cs(S)) and MGW (Iu-cs(B)). Used to transmit UE voice traffic
(signaling and bearer) to the circuit core.
Slide # 25 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Introduction to Handoff in 2G and 3G Target cells and all that fun stuff…
Dang! These guys keep moving on me!
Why don't they stand still and take their calls
like a man!?
Slide # 26 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Internet
GGSN
SGSN MSC
PSTN
Rnc
The Simple Stuff- User is moving but not connected Re-selection (Packet Example)
1. Mobile is “camped” on cell 1
2. Mobile device collects data on signal
strength of nearby cells.
3. Mobile sees that cell 2 has a better signal
and meets reselection criteria.
4. Mobile tells network it is relocating.
5. Network accepts (or rejects)
6. SGSN is updated for paging if needed (if the
paging area changes).
7. If SGSN needs to change with the cell this
there is a proceedure.
8. IF needed HLR is updated so the user can
be found for paging. (I.E. if SGSN is
changes).
9. If this causes a change of SGSNs then the
old SGSN tells the new SGSN and the HLR
For more detail see:
3GPP TS 23.060 V10.0.0 Section 6.9 Page 80
HLR
j
k l j k
m
n
o
q
Cell Update Examples (23.060 section 6.9)
MS BSS new SGSN HLR GGSN old SGSN
2. SGSN Context Response
3. Security Functions
1. Routeing Area Update Request
2. SGSN Context Request
6. Update PDP Context Request
6. Update PDP Context Response
7. Update Location
10. Update Location Ack
11. Routeing Area Update Accept
8. Cancel Location
8. Cancel Location Ack
9. Insert Subscriber Data Ack
9. Insert Subscriber Data
12. Routeing Area Update Complete
5. Forward Packets
4. SGSN Context Acknowledge
C3
C2
C1
(B)
(A)
1. Routeing Area Update Request
3. Routeing Area Update Accept
2. Security Functions
MS BSS SGSN
4. Routeing Area Update Complete
C1
Intra SGSN Routing Area Update Procedure
Inter SGSN Routing Area Update Procedure
This slide for Reference only
3GPP TS 23.060 V10.0 Section 6.9
Internet
GGSN
SGSN MSC
PSTN
BSC
Hard Handoff 2G Example
Internet
GGSN
SGSN MSC
PSTN
BSC
1. Mobile device collects data on signal strength
of nearby Cells
2. BSC sees current cell getting weak and target cell
getting strong.
3. BSC instructs mobile to retune to a new cell
4. Mobile breaks connection to old cell, retunes, and
announces its presence on the new cell.
5. Bearer stream is sent to new cell.
Connection is broken with original cell
and established to a new (target) cell.
• Short interruption in bearer occurs
• Generally not obvious to voice user
• Used for 2, 3 and 4G systems
Slide # 29 Copyright © 2009 Juniper Networks, Inc. www.juniper.net
Frame Selector
Internet
GGSN
SGSN MSC
PSTN
RNC
Soft Handoff 3G Example
Soft Handoff:
• UE may be able to communicate with two
cells
• Symbols (data) may be collected from both
cells
• Downlink data is sent to both cells
• Frame selector chooses best symbol on a
symbol by symbol basis
• Eventually one path becomes clearly better
and the other path is dropped.
• Used for most handoffs in 3G. Not used in
2G or 4G
Slide # 30 Copyright © 2009 Juniper Networks, Inc. www.juniper.net