Mobile 2G/3G Workshop

Mobility Workshop 2G/3G Network Architecture

October 5th, 2010

2 Copyright © 2009 Juniper Networks, Inc. www.juniper.net

2G GSM

2G GSM Network Architecture

Abis interface is comprised of multiple T1s (TDM).

Signaling between elements is carried out over an SS7 or SIGTRAN (SS7oIP) network.

Slide # 3 Copyright © 2009 Juniper Networks, Inc. www.juniper.net

Abis

BSS (TDM)

A

E

B

F

D

D

E

H

C

E

C

MS

RAN

BTS BSC

MSC

VLR

MSC

GMSC

EIR

B

F

VLR

EIR

AuC

HLR

SMSG

PSTN

NSS

Um

GSM Node Definitions

MS: Mobile Subscriber

The subscriber and the mobile device.

BTS: Base Station Transceiver

Mobile wireless transceiver used to aggregate discrete mobile systems in the BSS.

BSC: Base Station Controller

BTS aggregator and controller. Termination point for the Abis interface.

BSS: Base Station Subsystem

The MS, BTS and BSC.

MSC: Mobile Switching Center

Main call processing element in the mobile wireless network. Equivalent to a Class 5 switch.

VLR: Visitor Location Register

A database that stores information related to the MSs associated with the MSC to which it is attached.

HLR: Home Location Register

A central database that stores the subscriber information for all mobile subscribers authorized to use a given GSM network.

EIR: Equipment Identity Register

A database that stores information regarding specific mobile subscriber equipment (used for blocking access and tracking stolen equipment, etc.).

AuC: Authentication Center

A central database used to authenticate each SIM that attempts network access.


GSM Interface Definitions

A Interface TDM interface connecting BSC to MSC. Carries all bearer and signaling traffic associated with GSM mobile

services.

Abis Interface The BSS-based TDM interface connecting the BTS to the BSC.

B Interface TDM signaling interface between the MSC and VLR. Used to access subscriber account information.

C Interface Interface between the HLR and a GMSC or SMSG. Every call originating from the PSTN has to go through

a gateway to obtain routing information using the MAP/C protocol.

D Interface TDM signaling interface between the VLR and HLR. Used to pass master subscriber account information

from the HLR to the VLR

E Interface TDM bearer interface connecting MSCs or MSC gateways (GMSC, SMS Gateway). Used to transport voice

bearer traffic.

F Interface TDM signaling interface between the MSC and EIR. Used to access equipment registration information.

G Interface Interconnects two VLRs that belong to different MSCs and uses the MAP/G protocol to transfer subscriber

information (such as during a location update procedure).

H Interface TDM signaling interface between the HLR and AuC. Used to authenticate subscribers.

Um Interface The air interface used for communication between the MS and a BSS. LAPDm (modified version of ISDN

LAPD), is used for signaling.


GPRS Overview

General Packet Radio Service (GPRS)

Generally referred to as 2G

Developed specifically for the transmission of data in mobile wireless

networks

Maximum theoretical data rate of 171.2 kbps

Uses the same underlying RF technology as GSM

Core Services

Point-to-point IP applications

Point-to-multipoint IP applications (relatively uncommon)

Internet applications for smart devices through WAP and IP

SMS

MMS

Push-to-talk over Cellular (PTT/PoC)

Copyright © 2009 Juniper Networks, Inc. www.juniper.net

EDGE Overview

Enhanced Data rates for GSM Evolution (EDGE)

Also known as EGPRS

Generally referred to as 2.5G

Characteristics:

Uses the same base RF attributes as GPRS

Enhances data rates by applying enhancement to carrier modulation

– GMSK used by GSM/GPRS

– GMSK + 8PSK used by EDGE

– EDGE produces 3-bit words for every change in phase

– Effectively triples the gross data rate

– Theoretical maximum data rates:

- 2 timeslots == 118.8 kbps



– Most carriers deploy 2 or 4 timeslots and reserve the remainder for voice


GPRS vs. EDGE Comparison

GPRS EDGE

Modulation GMSK 8PSK/GMSK

Symbol Rate 270 ksym/s 270 ksym/s

Modulation Bitrate 270 kbps 810 kbps

Radio Data Rate Per Timeslot 22.8 kbps 69.2 kbps

User Data Rate Per Timeslot 20 kbps (CS4) 59.2 (MCS9)

User Data Rate (8 Timeslots) 160 kbps

(182.4 kbps) 473.6 kbps

(553.6 kbps)


2.5G GPRS/EDGE Network Architecture

Abis

BSS (TDM)

A

D

E

H

C

MS

RAN

BTS BSC MSC

GMSC

B

F

VLR

EIR

AuC

PSTN

Um

SGSN

PSN Gn

Internet

GGSN

Gi

PCU

Gb

GGSN

Gp

GRX

Gi

Internet

GTP

GTP

Local

PLMN

Remote

PLMN

HLR

Gr

Gs


Serving GPRS Support Node (SGSN)

The SGSN is responsible for delivery of packets to and from mobile

stations within a geographical service area.

Common SGSN Functions:

Detunnel GTP Packets from the GGSN (downlink).

Tunnel IP Packets in GTP towards the GGSN (uplink).

Carry out Mobility Management as standby mode mobile moves from

one Routing Area to another Routing Area.

Billing user data.

Lawful intercept.

Encrypt down-link data, decrypt up-link data to/from mobiles.

Logical Link management

Authentication

Stores temporary data such as location information and user profiles

in the serving Visiting Location Registrar (VLR).


Gateway GPRS Support Node (GGSN)

The GGSN is the main component of the GPRS core network.

GGSN is the IP anchor point for mobile data traffic

Responsible for interworking between the mobile network and

external networks such as the Internet.

From the external network’s point of view, the GGSN is a router to a

subnetwork.

Common GGSN Functions:

Tunnels/de-tunnels GTP protocol packets from the SGSN.

Manages PDP Contexts.

Responsible for IP address assignment.

Responsible for quality of service.

Acts as default gateway for the mobile.


GPRS/EDGE Node Definitions

PCU: Packet Control Unit

An addition to the BSC that provides packet processing capabilities between the RAN and the SGSN.

SGSN: Serving GPRS Support Node

An interworking element responsible for providing packet access between the RAN and the Packet Switched Network (PSN). Encapsulates subscriber traffic in GTP for transmission across the Gn interface.

GGSN: Gateway GPRS Support Node

An IP element responsible for de-encapsulating GTP traffic from the Gn interface and interfacing with external networks (such as the Internet).

GTP: GPRS Tunneling Protocol

The protocol used to tunnel user traffic across the PSN on the Gn interface.

AP: Access Point

A distinct closed user group or VPN. Represents a group of users with some common criteria.

APN: Access Point Name

The name used to designate a particular AP.

PDP Context: Packet Data Protocol Context

The PDP Context describes the active session of an MS connected to a particular APN. The PDP Context is active on the SGSN and the GGSN.


GPRS/EDGE interface definitions

Gb Interface A Frame Relay interface between the BSC and the SGSN.

Gn Interface IP-based interface between the SGSN and internal GGSNs. Uses GTP protocol.

Gp Interface IP-based interface between the SGSN and external GGSNs. Also uses GTP protocol.

Ga Interface (not shown) Interface that serves the Call Data Records (CDRs) which are written in the SGSN and sent to

the Charging Gateway (CG). This interface uses a subset of the GTP protocol called GTP’ (GTP Prime).

Gr Interface Interface between the SGSN and the HLR. Messages going through this interface use the MAP3

Protocol.

Gd Interface (not shown) Interface between the SGSN and the SMS Gateway (SMSG). Can use either MAP1, MAP2 or

MAP3.

Gs Interface Interface between the SGSN and the MSC/VLR. Uses BSSAP+ Protocol. This interface allows

paging and station availability when it performs data transfer. When the station is attached to the GPRS network, the SGSN keeps track of which Routing Area (RA) and Location Area (LA) to which the station is attached. When a station is paged this information is used to conserve network resources. When the MS initiates a PDP Context, the SGSN knows which BTS the MS is attached to.

Gi Interface The IP-based interface between the GPRS/EDGE network and the Internet.


GPRS Tunneling Protocol (GTP)

GPRS Tunneling Protocol (GTP) is a group of IP-based protocols

used to carry data traffic within GSM and UMTS networks.

GTP is really composed of 3 separate protocols:

GTP-C

– The control portion of the GTP standard. When a subscriber requests a PDP Context, the

SGSN sends a Create PDP Context Request message to the GGSN. The GGSN will

respond with a Create PDP Context Response message.

– UDP port 2123

GTP-U

– The user portion of the GTP standard that is used to tunnel IP traffic within and between

mobile operator networks. Each subscriber may have one or more tunnels to support

different connections or different quality of service requirements.

– UDP port 2152

GTP’ (pronounced GTP Prime)

– The charging data portion of the GTP standard. Used to transfer charging data from the

SGSNs and GGSNs to the Charging Gateway Function (CGF).

– TCP or UDP port 3386


PDP Context

The Packet Data Protocol (PDP) Context is a data structure which contains

the subscriber’s session information when an active session exists on the

network. It usually contains the following:

Subscriber’s IP address

Subscriber’s IMSI (International Mobile Subscriber Identity)

Subscriber’s Tunnel Endpoint ID (TEID) at the SGSN

Subscriber’s Tunnel Endpoint ID (TEID) at the GGSN

The TEID is a random number allocated by the SGSN/GGSN which identifies

the tunneled data related to a particular PDP Context.

2 kinds of PDP Contexts:

Primary

– Has a unique IP address associated with it.

Secondary

– Shares an IP address with the Primary Context.

– Created based on the Primary Context.

– Secondary PDP contexts may have different quality of service settings.


Access point Name (APN)

3GPP has the concept of virtual private networks that represent

communities of interest. These VPNs are called Access Points

(APs) and are identified by Access Point Names (APNs).

An APN defines a service description and routing for

GPRS/EDGE/UMTS data.

All traffic within and APN is routed in a similar manner.

When an SGSN sends user traffic in a GTP tunnel, it sends that

traffic to a GGSN that services the APN the subscriber’s traffic

belongs to.

Examples of APNs:

wap.cingular

epc.tmobile.com

blackberry.net

pp.vodafone.co.uk


SGSN-to-GGSN Routing

How does an SGSN know which GGSN serves a particular APN?

APN names look suspiciously like DNS name… and this is precisely

what it is.

When an SGSN wants to connect a subscriber to an APN, it performs a DNS

lookup on the APN name (e.g. wap.cingular)

This query is sent to a special DNS infrastructure called Gn DNS.

The IP address returned by the Gn DNS is the destination address of the

nearest serving GGSN.

– Note that in order to scale the network and provide geo-redundancy, the Gn DNS

may return different results depending on the source IP address of the SGSN.

– Examples:

- SGSNs from Region 1 have source IP addresses in the 172.16.1.0/24 range.

- SGSNs from Region 2 have source IP addresses in the 172.16.2.0/24 range.

Gn DNS is a globally-connected infrastructure.

– More details on this will be covered in the section on Data Roaming.


Data Roaming

MS BTS BSC

HLR

SGSN PCU

GGSN

Root

Gn DNS

Visited PLMN

Home PLMN

SS7/SIGTRAN

GRX

Gn DNS

Gn DNS

GTP

1 2

3

Notice that

•IP Anchor (GGSN) is in the home network

•SGSN is in the visited network

•LI and Charging can be done in both networks


Service

Center Internet

Copyright © 2009 Juniper Networks, Inc. www.juniper.net

3G UMTS


UMTS Family Air Interface Technologies UMTS - Universal Mobile Telecommunications System

Wideband Code Division Multiple Access (W-CDMA)

Introduced in 3GPP R99

Max theoretical data rate of 1.92 Mbit/s in the downlink

High-Speed Downlink Packet Access (HSDPA)

Based on 3GPP R5

Improves downlink data rate to speeds up to 14Mbit/s

Majority of deployments provide up to 7.2 Mbit/s in the downlink

High-Speed Uplink Packet Access (HSUPA)

Based on 3GPP R6

Enhanced to increase the uplink data rate up to 5.8 Mbit/s

Evolved High Speed Packet Access (HSPA+)

Based on 3GPP R7 & R8

Data rates up to 42 Mbit/s in the downlink and 11 Mbit/s in the uplink (per

5 MHz carrier)

Supports Multiple Input, Multiple Output (MIMO) technologies


3G UMTS network architecture (R4)

IuB IuCS(S)

MS

UTRAN

NodeB RNC MSCS

MGW

VLR

EIR

AuC

PSTN

Uu

SGSN

PSN Gn

Internet

GGSN

Gi

IuPS

GGSN

Gp

GRX

Gi

Internet

GTP

GTP

Local

PLMN

Remote

PLMN

HLR

Gs

MGW PSN

IuCS(B)

IuX Interfaces are ATM-based:

IuPS = AAL5

IuCS = AAL2

NxT1 ATM IMA


3G UMTS network architecture (R5+)

IuB IuCS(S)

MS

UTRAN

NodeB RNC MSCS

MGW

VLR

EIR

AuC

PSTN

Uu

SGSN

PSN Gn

Internet

GGSN

Gi

IuPS

GGSN

Gp

GRX

Gi

Internet

GTP

GTP

Local

PLMN

Remote

PLMN

HLR

Gs

MGW PSN

IuCS(B)

IuX Interfaces are IP-based • Changes the Backhaul Routing and

Aggregation requirements

• MX supports ethernet but not the (older)

ATM interfaces


3G UMTS network architecture

IuB IuCS(S)

MS

UTRAN

NodeB RNC MSCS

MGW

VLR

EIR

AuC

PSTN

Uu

SGSN

PSN Gn

Internet

GGSN

Gi

IuPS

GGSN

Gp

GRX

Gi

Internet

GTP

GTP

Local

PLMN

Remote

PLMN

HLR

Gs

MGW PSN

IuCS(B)

Notes

1. The IP anchor can be either in the home

or visited network. • Pay attention this will come up again in LTE

• Multiple concurrent APNs are generally not used in 3G

2. Later releases support “direct tunnel” which

allows the bearer traffic to bypass the SGSN • Greatly reduces SGSN bearer load

• Some bearer (e.g. LI and Roaming) still

must go through the SGSN.

NxT1 ATM IMA

GTP

Gn


UMTS Node Definitions

UE

User Equipment (the mobile device).

NodeB

Analogous to the BTS in the GSM/GPRS BSS, the NodeB is responsible for Ue

aggregation. Uses W-CDMA for the air interface.

Radio Access Controller (RNC)

Analogous to the BSC in the GSM/GPRS BSS, the RNC aggregates Iub traffic from

the NodeBs in a particular region of the RAN.

Responsible for air encryption, mobility management (handover), and voice/data

transmission to the circuit-switched and packet-switched core.

Call Server

A cut-down version of the MSC that is disassociated with the bearer path to reduce

size and cost. Responsible for all voice signaling functions.

Media Gateway (MGW)

The element responsible for interworking voice traffic between and among formats

(e.g. ATM AAL2 RTP/IP).


UMTS Interface definitions

Uu

Air interface connecting the UE to the NodeB.

IuB

An ATM interface (R4) or IP interface (R5+) between the NodeB and RNC

carrying all voice and data bearer and signaling traffic.

IuR

An ATM interface (R4) or IP interface (R5+) connecting RNCs to one another.

AN RNC may operate as an S-RNC (Serving RNC), D-RNC (Drift RNC), or C-

RNC (Controlling RNC)

Iu-PS

An ATM interface (R4) or IP interface (R5+) connecting the RNC with the SGSN.

Used to transmit UE data traffic to the packet core.

Iu-CS

An ATM interface (R4) or IP interface (R5+) connecting the RNC with the Call

Server (Iu-cs(S)) and MGW (Iu-cs(B)). Used to transmit UE voice traffic

(signaling and bearer) to the circuit core.


Introduction to Handoff in 2G and 3G Target cells and all that fun stuff…

Dang! These guys keep moving on me!

Why don't they stand still and take their calls

like a man!?


Internet

GGSN

SGSN MSC

PSTN

Rnc

The Simple Stuff- User is moving but not connected Re-selection (Packet Example)

1. Mobile is “camped” on cell 1

2. Mobile device collects data on signal

strength of nearby cells.

3. Mobile sees that cell 2 has a better signal

and meets reselection criteria.

4. Mobile tells network it is relocating.

5. Network accepts (or rejects)

6. SGSN is updated for paging if needed (if the

paging area changes).

7. If SGSN needs to change with the cell this

there is a proceedure.

8. IF needed HLR is updated so the user can

be found for paging. (I.E. if SGSN is

changes).

9. If this causes a change of SGSNs then the

old SGSN tells the new SGSN and the HLR

For more detail see:

3GPP TS 23.060 V10.0.0 Section 6.9 Page 80

HLR

j

k l j k

m

n

o

q

Cell Update Examples (23.060 section 6.9)

MS BSS new SGSN HLR GGSN old SGSN

2. SGSN Context Response

3. Security Functions

1. Routeing Area Update Request

2. SGSN Context Request

6. Update PDP Context Request

6. Update PDP Context Response

7. Update Location

10. Update Location Ack

11. Routeing Area Update Accept

8. Cancel Location

8. Cancel Location Ack

9. Insert Subscriber Data Ack

9. Insert Subscriber Data

12. Routeing Area Update Complete

5. Forward Packets

4. SGSN Context Acknowledge

C3

C2

C1

(B)

(A)

1. Routeing Area Update Request

3. Routeing Area Update Accept

2. Security Functions

MS BSS SGSN

4. Routeing Area Update Complete

C1

Intra SGSN Routing Area Update Procedure

Inter SGSN Routing Area Update Procedure

This slide for Reference only

3GPP TS 23.060 V10.0 Section 6.9

Internet

GGSN

SGSN MSC

PSTN

BSC

Hard Handoff 2G Example

Internet

GGSN

SGSN MSC

PSTN

BSC

1. Mobile device collects data on signal strength

of nearby Cells

2. BSC sees current cell getting weak and target cell

getting strong.

3. BSC instructs mobile to retune to a new cell

4. Mobile breaks connection to old cell, retunes, and

announces its presence on the new cell.

5. Bearer stream is sent to new cell.

Connection is broken with original cell

and established to a new (target) cell.

• Short interruption in bearer occurs

• Generally not obvious to voice user

• Used for 2, 3 and 4G systems


Frame Selector

Internet

GGSN

SGSN MSC

PSTN

RNC

Soft Handoff 3G Example

Soft Handoff:

• UE may be able to communicate with two

cells

• Symbols (data) may be collected from both

cells

• Downlink data is sent to both cells

• Frame selector chooses best symbol on a

symbol by symbol basis

• Eventually one path becomes clearly better

and the other path is dropped.

• Used for most handoffs in 3G. Not used in

2G or 4G


Education

Mobile 2G/3G Workshop