Wired N Wireless completes 2 years

With over 160,000 hits, this blog completes 2 years. Thank you for the support and wish you all a very happy new year.

Cheers, Santosh 

Verizon 3G to LTE Handover Delay

This is purely my thought and may not be entirely true.

I read news that users of Verizon network are experiencing a delay of 2 minutes when moving from 3G to LTE network. Users are experiencing this when they are continuously transmitting the data. I also read that in few instances subscribers are forced to unplug their dongles and plug them back to get LTE access. I was wondering what could be the reasons and below is what I think!

Frist Reason:-

Verizon network is CDMA based. LTE is GSM based. Since both technologies are entirely different it gives an impression that handovers are not going to be smooth. However 3GPP specs does provide solutions for smooth handovers. So why the delay? The places where LTE is deployed would have had 3G coverage. When a 3G network detects that UE is receiving stronger 4G signal it has to handover the UE to 4G network. But not complete 3G network would have been converged to 4G, so in few cases the 3G network would simply ignore 4G networks presence and make the UE to hook on to it. In this case users should stop transmitting data for a while so the UE may go into idle mode. Once UE is in idle mode and if it wants to send some data, it will perform cell re-selection and choose LTE network instead of 3G thus bringing subscribers back to LTE. This could be one reason why few subscribers had to plug out their dongles and place them back to get 4G access.

Second Reason:-

Next, assume that 3G network is converged to 4G. In this case moving from 3G to 4G should be smooth. But if the network elements are far away then the delay in the core network might result in higher handover time.  However movement from 4G to 3G should be smooth, because where there is 4G network, 3G network would have been present and 4G network would have had complete information about it.

The fixes could go in several places. But I am assuming that first reason is what bothering the most and network should be fixed soon. Those who are interested to know more can refer to 3GPP Spec 23.402 for detailed call flows.

Vodafone launches LTE in Germany

On Dec 1st 2010 Vodafone D2 in Germany has gone live their LTE network. The porject was towards offering high speed boradband in rural areas of Germany. Hope fully everything is going smooth for them.

Link here

Is anyone experiencing the LTE network in Germany? How is it working? Any comments.

LTE - Indirect Tunnel during Handover

LTE is a high speed network with an assumption of always on connectivity to packet data network even when UE is moving at high speeds. So during the handovers it is assumed there is no packet loss. But when UE is moving from source network to target network, there is definitely a connection break and make. While the connection is broken and again made at target network, the data to UE is buffered at the source eNB and forwarded to target eNB once the handover is complete. If there is a direct link between source and target eNB then data buffered at the source eNB will sent over it to target eNB. Else indirect tunnel will be used . Below figure shows S1 Handover with SGW Relocation when Indirect Tunnel is used.
 

 This post specifically concentrates on how the buffered data will flow in case of indirect tunnel. Cristina in her blog has very clearly written about this, but I would like to make rather simple explanation

The links in “orange” are normal links and links in “black” form a indirect tunnel. The source eNB decides whether direct tunnel is present or not. If direct tunnel is not present, source eNB SHALL NOT include “Direct Path Forwarding Availability” IE in Handover Required message. To make things a bit simple I am assuming that MME has NOT been re-located, but considered that SGW is relocated. Once MME receives the “Handover Required” message it sees that target eNB is being served by another SGW. So MME will create a new session with target SGW and sends “Handover Request” message to target eNB. Target eNB shall respond with “Handover Request Success” and includes “indirect tunnel DL TEID” that is to be used by target SGW for indirect tunnel, along with normal S1-U DL TEID.  Once MME receives this message it shall forward “indirect tunnel DL TEID” to target SGW in “Create Indirect Tunnel Request message”. Now the target SGW gets to know the TEID which it should use for sending data over indirect tunnel and also gets ready to receive the data from source SGW. In Create Indirect Tunnel Response target SGW sends the “DL TEID” that source SGW should use to send data over indirect tunnel towards target SGW. This information is conveyed to source SGW by MME in “Create Indirect tunnel Request”. Now source SGW gets to know that indirect tunnel is created, so it sends a “UL TEID” that source eNB should use to buffered data over indirect tunnel to it. This TEID is sent to source eNB in handover command. This completes the indirect tunnel.

The data flow will be:-
- Source eNB buffered packets to Source SGW over UL TEID that source SGW sent.
- Source SGW sends packets to target SGW over DL TEID that target SGW has sent to MME, which was forwarded to source SGW.
- Target SGW sends packets to target eNB over DL TEID that target eNB has been sent to MME which was sent to target SGW.
 

I know this is bit confusing, but here it is.

Policies and Rules

With LTE ready for deployment, it is becoming increasingly important for operators to provide dedicated bearers. I had a chance to look at 3G demo, here in India, by one of the operators, and I was not pleased. There was an attempt to stream live TV over 3G supported mobile and stream was pretty bad. I was just wondering how far the base station was and if there was any secondary PDP context in place for enforcing a proper quality of service. Well that’s 3G.

In LTE PCRF is responsible for charging and triggering flow rules. PCRF is an intelligent device which based on the ongoing traffic or existing configuration triggers events towards PGW. There sits PCEF on PGW which is responsible for enforcing the rules triggered by PCRF. The interface between PCRF and PCEF is Gx.  Based on the triggers PCEF can go ahead and ask PGW to create a dedicated bearer or modify an existing bearer.  UE can request for a bearer creation or modification based on its need. But final decision is with PCEF. On other note I was wondering if LTE UE manufacturers would present any piece of code to mobile application developers for requesting a dedicated bearer for their app?

LTE is supposed to be a high speed network. Will creation of dedicated really matter at such high speeds? Will streaming video all of sudden get better once a dedicated bearer is created for it? Has any operator tested this? How does the result look?

S4 SGSN

As the LTE deployments are nearing it is becoming increasingly important to bring in smooth handover support between 3G/2G and LTE networks.  The networks are on expansion and are becoming complex. In amidst of all, different solutions for same problem is making life a bit more difficult. 

While we have a initial solution in place for migrating from 3G to LTE without changing much in the existing 3G network, it has been noticed that the service providers are now thrusting for a more smoother solution. Identifying few pockets of areas service providers are now willing to upgrade their exiting 3G network to be compliant with Release 8. I pity the SGSN for the burden it has to take to not only perform the existing functions but should also start processing LTE related calls. 

If the SGSN is migrated to Rel 8, then it has to support two new interfaces. S3 and S4. S3 is between MME and SGSN analogous to Gn interface. But S4 is totally new interface to SGSN analogous to S11 interface. The question is whether a S4 interface is needed at all. When a UE moves from 4G to 3G, SGSN requests for Context Information from MME over S3 interface. If the interface is Gn then protocol would have been GTPv1 which doest create any trouble for SGSN. As S3 is GTPv2 based, SGSN should implement the new protocol. So far so good. Anyway UE is in 3G network, SGSN has pulled the UE information from MME over S3, then what is the need for S4 interface. SGSN can as well simply go and talk to GGSN. Instead of this 3GPP has decide to route the SGSN to SGW over S4 interface. This is mainly done to remove the GGSN node as such. 

We know that LTE APNs are configured in PGW.  The idea is to reach the same APN in the PGW when UE is either connected from 4G or 3G or 2G. Which means in 3G and 2G it will become the responsibility of SGSN to talk to PGW through SGW. This will simply need no GGSN at all for LTE APNs and more over everything is Rel 8 compliant. The compliance will ensure smoother handovers and continuous data flow. So when a UE directly switches on in 3G network, SGSN will contact SGW for the establishing a session. When there is a handover involved again, SGSN will contact MME over S3 and SGW over S4. Ultimately for 4G APNs there wont be a need for GGSN and PGW to co-exist. Another important thing here will be support for IPv4IPv6 PDN types. This PDN type is not supported in 3G and is a feature of LTE. To ensure that this PDN type is supported over 3G the SGSNs should be Rel 8 compliant. 

Hence, SGSNs are overloaded. 

SDF, QCI and Dedicated bearers

I had an interesting discussion with one of my friends regarding the dedicated bearers and QCI and thought of posting the same.

SDF- Service Data Flow- An aggregate set of packet flows that matches a set of filters.
QCI – QoS Class Identifier – A parameter that is typically associated to packet forwarding/scheduling etc treatments.

QCI values can be from 1 to 9. Since QCI is an 8 bit field it can have 255 values. Values 10 to 255 are operator specific. A bearer is always associated with a QCI. A UE can have a max of 11 bearers but QCI are from 1 to 9. Which means the QCI can be repeated for the bearers.

Each bearer is also associated with TFT. Yes, even the default bearer can be assigned a TFT after the recent spec changes. TFT can have multiple packet filters resulting in multiple SDFs. Now the confusion is with this statement - “Each Service Data Flow (SDF) is associated with one and only one QoS Class Identifier (QCI).”

Since two dedicated bearers can have same QCI the above statement leads to confusion. Reading the statement again makes sense. A bearer is associated with QCI and set of packet filters that will lead to multiple SDF’s. This means multiple SDF’s can be treated with same type of service but one SDF cannot be given multiple treatments. This also means that you cannot assign same packet filter to two dedicated bearers. Hence the above statement!

Roaming trouble

What makes cellular communication standout from other wireless technologies is its roaming ability. No matter in which country you are just dial the number and talk. This makes mobile communication truly mobile.  But the technology behind is not that simple.

I was wondering how difficult will it get for an operator to maintain so many roaming agreements. A given operator may have to maintain like, say, 100 roaming agreements. Well considering LTE a given MME will have to talk to 100 different HSSs and SGW will have to communicate to 100 different PGWs.  Whoa!

There is a nice way to maintain the list of PGWs based on the various APNs. MME informs the SGW which PGW it has to contact for which IMSI. The S8 interface is UDP based and DNS maintains detailed records of APN to PGW mappings. So its relatively easy to fetch a PGW and establish a tunnel for the user. But for HSS its little complicated. Now that HSS runs on diameter, there are several solutions proposed to reach home hss from visiting network. Also diameter runs on tcp or sctp which means there is always a connection established. This is quite difficult as the MME has to reach several HSS across the world. Looking forward to some interesting solutions here. Diameter relays, proxies ?

CS Fallback - A Study

We know that LTE doesn’t have basic voice and SMS support. To mitigate this 3GPP proposes fall back to CS network for voice and SMS. Though the industry pundits frown, I believe CS fallback has to be launched by operators deploying LTE, at-least for initial stages. Let’s look at how this works. In EPS a new interface is required to connect to the CS network. It’s called SGs, based on Gs interface, and runs SGsAP protocol. This interface is between MME and MSC Server. Next requirement is overlapping networks. It is expected to have a GERAN/UTRAN network along with EUTRAN for UE to fallback to CS. The concept is simple. UE will attach to the network through EUTRAN, MME will ask MSC to update UE location in its database, when a call is made or received UE is simply asked to fall back to CS network to answer/make the call. However note that sending and receiving SMS doesn’t need UE to fall back to CS network.

Few more details! When UE is attaching to EUTRAN, UE will perform a combined attached. That is a new IE, mobile class mark, will be sent in Attach Request asking MME to perform a combined attach. Once Attach request is received, MME will send a location update request informing MSC of UE’s location. This way UE is now known to LTE as well as CS network. When a UE has to make a call, it will simply send an extended service request to MME. MME will inform eNB that UE has to now move to GERAN/UTRAN network. If inter RAT handovers are supported, UE will be handed-over to GERAN/UTRAN network else UE’s EUTRAN connection is released and is asked to connect to GERAN/UTRAN. Because of this LTE services on UE will be disrupted.

UE attaching to EUTRAN & CS Networks

SMS is delivered over signaling channel. This means there will be no data path established to deliver or receive SMS. SMS will be sent over a signaling message. Exactly for this reason, SMS delivery or reception doesn’t need UE to fall back to CS network. Once the UE is attached to both MSC and EUTRAN and if MSC wants to deliver a SMS to UE, it will simply send a downlink unit data to MME with SMS content. MME will dump this message in NAS message and send it to UE. In the same way if UE wants to send a SMS it will dump the message in NAS message and send it to MME. MME will extract SMS content and send it to MSC over Sgs interface. This operation doesn’t need UE to fall back to CS network thus ensuring smooth delivery of SMS.

Mobile Orginated SMS delivery in Idle mode

One important thing to note here is that MME should keep a proper mapping of Tracking Area and Location Area. This is because MME needs to know to which MSC the UE should be connected to, based on the tracking area received in attach request. MME will map the tracking area to the corresponding location area and will pick the MSC based on the location area. All the details regarding CS Fallback are present in 3GPP TS 23.272. Refer to same for all the call flows.

Mandate CS Fallback

There is so much debate going on about voice technology that should be used over LTE. I have my view here. Before a proper voice technology is figured out, I would assume that CS fallback will become a mandatory feature on all LTE phones. Though VoLGA and IMS seem to be good solutions, but they don’t solve many other issues, like roaming for e.g.

Its obvious that LTE phones will support 3G/2G technologies. Also with release 8 SGSN’s coming in the packet handovers to 3G/2G technologies from LTE and vice versa would be smooth. This means LTE phones are already equipped with 3G/2G chipsets. If so then why cant  CS fallback be made mandatory?

Yes, agreed that to access a voice call one should be cut out of LTE. But at least I am able to make a voice call even if I am not in my home network. Analyzing how the voice call can disrupt the packet service for individual users can be a separate case study. For e.g corporate users are heavily dependent on emails. So if voice call lands on their mobile the LTE service will switched off for couple of minutes which is very acceptable for an email user. Rest may not be convinced, but it does solve the problem.

One more point is SMS. I heard that SMS is mandatory in Europe, that is if a user is roaming then the roaming charges(?) should be informed to the subscriber by an SMS. If that is the case the CS fall back does help with smooth delivery of SMS over Sgs interface. However this may not be a permanent solution. As the technologies mature we can find a better way to deal with voice and data co-existence without breaking each others connection. Untill then operators please give us CS fall back support and also do not mess up your networks with putting many additional nodes.

Must Read!

A book that explains SAE packet core in a nice way! A must read for engineers working in mobile packet core.

Amazon link: http://amzn.com/0123748267

UE NAS and MME NAS

Quick thought regarding the NAS layers between UE and MME. Since UE and MME directly cannot talk to each there could be a disconnect between the both. Consider this. When UE goes into idle mode, it is not known to the network until the network receives a TAU. In the mean time imagine that network initiated a bearer deletion procedure. If eNB doesn’t find the UE then bearer is implicitly detached on MME and eNB, but the bearer information is still present with the UE. At this point there could be a disconnect between UE NAS layer and MME NAS layer.

Assume another scenario where handover is in progress. Because of some reason the target eNB has not accepted a particular bearer. The same is conveyed to network in S1AP message and to UE in RRC messages. But NAS layers in MME and UE still have the bearer information. There could be several cases like this where there can be different NAS states in UE and MME. The question here is will RRC and NAS layers in UE be in sync. That is if a Data radio bearer for a particular bearer is not established, will the NAS layer be intimated the same by RRC and UE will delete the bearer from its NAS layer?

Anybody?

3G to 4G

Its interesting to look at how operators would be migrating from 3G/2G to 4G. 3G/2G networks are here to stay for a long time. 4G is the one which is supposed to co-exist with the existing 3G/2G networks. 3G/2G inter-working with 4G might need few tweaks on the packet core of exiting 3G/2G networks and also of-course the whole new 4G network deployment itself. Below are few such change I can think of from packet core network perspective. (I am assuming here that there are no major upgrades done on 3G network, which means 3G network is still pre Rel 8)

GGSN & PGW integration:- This will be a big change but shouldn't be that complicated to an operator. I am assuming that LTE subscribers will be given a new APN that can be accessed over a 3G or 4G network. This would need GGSN and PGW to co-exist as there is need to share the APN along with user context
HLR/HSS:- HLR is database from 2G/3G. HSS is the new database in 4G. I would like these two entities to co-exist and share the data. We dont want to SGSN to contact one database and MME to contact other for authenticating the same imsi.

DNS integrations:- The same dns servers in 3G network should help MME in selecting SGW and PGW. Few entries need to be added and MME should be pointed to that DNS
SGSN configuration changes:- SGSN shoud be configured to point to new GGSN if users from LTE are moving to 3G network. This should not be a big problem as new subscribers mean new imsi and imsi can be mapped to a APN in SGSN (?) which in turn identifies the GGSN

Gn interface:- There is need for Gn interface between MME and SGSN to provision inter RAT handovers. If UE is moving from 4G to 3G then the Gn SGSN should be able to contact MME and pull out the UE context and vice versa.



Each point can taken up for discussion. Any more scenarios you can think of?

Idle Mode Signaling Reduction

When ever a UE moves to a new tracking area or routing area it triggers a tracking area update (LTE) or Routing area update (3G) procedure to inform the network about its current location. Note that these procedures are triggered while UE is in Idle mode or Connected Mode. Read below considering UE in Idle mode.

With the LTE systems coming in, both the network antennas (3G and LTE) might remain close to each other. This means a UE can be in a tracking area of a MME at one point and it can immediately move to routing area of SGSN at another. If both coverage areas are pretty close and UE is lingering at the border of both networks, it could result in ping-pong effect. That is a UE may get into a loop where it sends RAU to 3G system de-registering itself from LTE and vice versa by continuously doing cell reselection.

Solution to this is proposed in Annex J of 3GPP TS 23.401, which is ISR.

The solution assumes that SGSN is S4 SGSN. Also it is a requirement that both UE and network should understand ISR. ISR support is mandatory for E-UTRAN UEs that support GERAN and/or UTRAN and optional for the network.

Assume that UE is registered to the network through EUTRAN. Now UE re-selects a GERAN/UTRAN network and initiates a Routing Area Update. SGSN will send context request to MME asking for the UE context. Here MME may reply with context response along with ISR activate indication. Network shall switch on the ISR once it realizes the UE context is being pulled from a different RAT. Once the context response is received, RAU accept along with ISR active indication is sent to UE. Once UE receives the RAU accept along with ISR active, it shall store the GUTI from EUTRAN and also the newly received P-TMSI from GERAN/UTRAN. MME will also keep the UE context. SGW is informed about ISR activation by SGSN in Modify bearer request (ISR flag set). At this point UE is registered in both EUTRAN and GERAN/UTRAN, has both the network identifiers (P-TMSI and GUTI) and UE may not initiate a TAU or RAU (until the UE has identified a new TA/RA that is not in its list).

When data for UE arrives from network, SGW will send downlink data notification to both SGSN and MME. Both MME and SGSN will initiate paging. UE may respond to which ever paging message it has received and initiate a normal service request procedure later.

Thus the ping pong effect of TAU and RAU is minimized at the expense of paging the both networks.

Spec Ambiguity

Could somebody kindly tell me if a SGW could be relocated by a TAU request in connected mode? I think not? Interested in a debate? 3GPP TS 23.401 Chapter:- 5.3.3 Cheers, Santosh

LTE Tidbits IV

Continuation to LTE Tidbits I, II, III


There have been several questions on how RRC and EMM/ECM states are in sync. To begin with, RRC and EMM/ECM states are two seperate layers, each layer provides service to other but doesnt have authority to modify each other. eNB, acts as a relay between UE and MME, i.e it will receives RRC messages from UE and puts them in S1AP messages towards MME. This means eNB will simple pass the NAS pdu's from UE to MME without modifying them. SO at UE, there are two layers to maintain, RRC state and NAS state. We cannot have a state where there no radio bearers for dedicated bearer, but the NAS layer has the EBI for dedicated bearer.

S1AP Initial UE message holds an extereme importance. It is sent only when UE first establishes an RRC connection with eNB. This message is what makes UE move from ECM idle to connected mode.

FAQ's:-

1. In a normal TAU procedure, when MME decides to change the SGW, how does the new SGW come to know about the IP and TEID of eNB for data downlink flow and how does the eNB come to know about SGW IP and TEID?

[S] When a SGW has changed during TAU, MME will send a create session request towards the new SGW. This CSReq is for establishing the control plane.Now in CSRes the new SGW will respond with its own user plane IP and TEID that is used by eNB for uplink. This info is propagated to eNB in Initial context setup message. Now eNB will create radio bearers and once the radio bearers are created it will send downlink user plane IP and TEID in intial context setup response message to MME. This info is send to SGW in modify bearer request.

2. In Initial Attach procedure, how does the eNB comes to know about the SGW IP and TEID?
[S] Same philosophy as above applies. The trick here is radio bearers will be created only once the network has setup the EPS bearers. Once EPS bearer is created using CSReq/Res, only then then eNB creates the radio bearers and this info is sent to SGW by MME in Modify bearer req/resp

3. If OI=0 in both CSR during initial attach and S1 based HO, why does the SGW not send CSR towards the PGW in S1 based HO?

[S]CSReq is used to create EPS bearers. In S1 HO case the EPS bearers are already created, so CSReq will not be sent to PGW. BUt since the SGW has changed, PGW should be informed of new SGW, so a modify bearer request is sent to PGW.

Summer Break! Wedding bells are ringing!

Hands are trembling, feet are cold. Yes, I am getting married. Will be off from blog and email untill June.

See you all then!

Cheers, Santosh

EMM, ECM, RRC States, TAU and Handovers

Its very interesting to observe the connection between 5 terms mentioned in the subject line.

Refer here and here for details on EMM, ECM and RRC states.

EMM has two states:- EMM Registered and EMM De-registered. When a UE is connected to the network it moves from EMM De-registered to EMM Registered. Also the ECM state moves to ECM connected from ECM idle. Before these two happening the RRC state in UE is moved from RRC idle to RRC connected. So when UE is actively connected to the network the states in UE/network are RRC Connected, ECM Connected and EMM Registered.

When UE moves to Idle mode first the RRC connection is released. That is RRC state moves from RRC connected to idle. Then ECM state moves to ECM idle from connected. This mean eNB has released the RRC connection and network has released the UE bearer context information but EMM state is Registered. This is termed as S1 release in 3GPP TS 23.401. It would be interesting to know that ECM idle state is valid only on S1 and S11 interface. The UE information is actively maintained in PGW but is released in eNB and MME. Also the behavior of network in ECM idle mode is different in different cases. (future posts). The basic idea of idle mode is UE is not know to the network and in connected mode UE is known to the network. The term "known" refers to UE location, bearer information etc.

TAU - Tracking Area Update. A tracking area is a group of cells that are being tracked by a SGW. When UE is connected to the network, a list of tracking areas are sent to it. When a UE moves to new tracking area it will trigger a tracking area update procedure as defined in 3GPP TS 23.401. A TAU can be triggered when UE is in idle mode or connected mode.

Now at any given point of time UE can be in idle or connected mode. If UE is in connected mode and moving from one place to other then handovers take place. Note that handovers are transparent to UE except that UE now camps on to a new eNB. Also handovers are network initiated. This means a handover can happen when the UE is known to the network, i.e when UE is in connected state. Also after the handover if UE finds that it is present in new tracking area then it can initiate a tracking area update.

But a UE need not be in a connected state all the time. What happens when a UE is in idle mode and is moving from one place to other? When UE is in idle mode, MME will have the UE's last know location. So if some data arrives to UE, while it is in idle mode, MME will initiate paging process to find UE. Now if UE has moved from the last know location how will the MME know the UE's new location. This is where TAU becomes extremely important. In this case it is the responsibility of UE to inform about its location to network. This is done by sending TAU. As I said when UE is attached to the network MME sends a list of tracking areas. So if MME wants to find UE i.e is in idle mode, it will simply send paging message to the eNB and eNB will page for the UE. But if UE is in new tracking area, that is not in the list received during initial attach, it will initiate a TAU. Once network receives TAU it will store the UE's location info.

To initiate a TAU UE should have a RRC connection. First thing it does is it camps on to a nearest eNB by doing cell re-selection process. After RRC connection is established UE may send TAU to network. Note that ECM state in network is still idle for that UE. But TAU may move the ECM state in network from idle to connected. (future post)

Thus if we look at overall picture a handover can happen when UE is in EMM Registered, ECM connected and RRC connected state. A TAU may be initiated by UE when it is in EMM Registered, ECM idle and RRC idle state. Both the procedures help UE in its movement from one place to other.

TAU and RAU

This is in continuation to what I wrote some time back. (here)
TAU corresponds to Tracking Area Update in LTE and RAU corresponds to Routing Area Update in GERAN/UTRAN. A TAU or RAU is initiated by UE when it detects a new tracking area or routing area. Below call flows show how a UE performs RAU in GERAN and TAU in LTE when both GERAN/UTRAN and LTE networks are converged using Gn interfaces.
LTE UE's are expected to operate in dual mode, i.e support both LTE and UTRAN and more over both the radios are expected to be turned on all the time. Below call flows are with reference to Annex D of 23.401. SGSN is considered to be Gn based and MME is expected to support GTPv1. This means no changes to the existing 3G network (SGSN) is required to support below.

LTE - Routing Area Update

Looking at the call flow we can see that GGSN is missing. It is believed that to implement above both GGSN and PGW must reside on single box. So PGW is acting as GGSN for 3G world and it remains itself for LTE. PGW shall again speak both GTPv1 and v2 and will be responsible to map the contexts and qos (of 3G and 4G).

Once UE detects that it is in 3G world it immediately triggers a Routing Area Update. We are assuming that UE is registered in LTE domain now. Once SGSN gets the RAU it looks for the old SGSN information to pull the UE context from (P-TMSI ?).To a Gn SGSN MME just acts as an another Gn SGSN. So the Gn SGSN sends SGSN context request to MME to which MME replies with the UE context. Later an Update PDP context is sent to GGSN(i.e PGW) to inform the change in the data path. At this point PGW shall map the LTE bearers to 3G PDP;s

LTE - Tracking Area Update

Similarly when UE moves from 3G to LTE it triggers a tracking area update.

Clearly the above are not handovers. Both TAU and RAU are triggered by UE which means UE is responsible for choosing the corresponding technology. Also this method might not be seamless too.

More thoughts on this?

Piggybacking in LTE

I observed an interesting feature in 3GPP TS 23.401. Feature is defined in Annex F. Now I wonder are Annexes really that important?

In LTE we always have a default bearer. Dedicated bearer may be created on need basis. Looking at the way industry is moving it is pretty evident that VOIP will be mainly used for voice over LTE. Operators would like to provide a good QoS for a voip call so they would want a dedicated bearer to handle the same. Also with LTE phones VOIP will be a very basic feature and would become a must on every LTE device. This means the network infrastructure should be capable enough to support dedicated bearer for every LTE phone and a dedicated bearer has to be activated as soon as the UE connects to the network to provision VOIP.

A dedicated bearer may be requested by UE or can be triggered by network based on rules and charging functions. Considering the above it would be nice to have both default and dedicated bearer established while UE is being attached to the network. Annex F exactly defines the same.

During the LTE UE initial attach, a create session request is sent to PGW. PGW responds with create session response. Note that dedicated bearer creation is initiated by PGW by sending create bearer request to SGW. Now 3GPP TS 29.274 provisions a method where a GTP message can be piggybacked to other. During initial attach, PGW can send a create bearer request piggybacked to the create session response indicating that it has initiated a dedicated bearer creation. Just a flag needs to be set in the GTP-C header of create session response (Octect 1 bit 5 from LSB) and create bearer request can be appended. There will be only one UDP header though. Once MME receives the create session response with piggybacked create bearer request it will initiate both default and dedicated bearer activation in single shot.

I find this mechanism very cool as lot of processing in PGW can be avoided with respect to PCRF interaction for dedicated bearer creation. This piggybacking can be enabled based on a IMSI or based on APN that is UE connecting to. Interesting!

Any thoughts?

LTE Tidbits III

Gn/GP handovers:

LTE will not be fully functional from day 1. We will need the legacy systems to support major number of customers. LTE specs describe the inter RAT handovers, but they do insist to upgrade the existing SGSNs and GGSNs. Now no operator wants to touch their existing fully functional system untill the new system is working without any problems. This means for some point of time both legacy and LTE systems should work together. This also means that operators would still want their legacy systems to talk to the LTE and vice versa.

To provision this 3GPP Ts 23.401 Annex D provides the call flows. According to the Annex existing SGSNs need not be touched.LTE functional elements such as MME and PGW will also support legacy protocols (GTPv1) so that both networks can communicate. To a SGSN, MME will just behave as another SGSN.

But these handovers are hard handovers which means there could be a connection loss. Also GGSNs from the existing networks should be replaced with LTE PGW, as the whole conecpt is based on LTE PGW as the comman anchor between the two networks. This shouldnt be much of a problem as PGWs are written keeping this mind and I personally believe that GGSN replacement will not be that much of a problem. The dissected call flows shall be posted soon.

ISR/TAU/RAU:-

When ever a UE moves to a new tracking area or routing area it triggers a tracking area update (LTE) or Routing area update(3G) procedures to inform the network about its current location. Note that these procedures can be triggered while UE is in Idle mode or Connected Mode. Read below considering UE in Idle mode.

With the LTE systems coming in, both the network antennas (3G and LTE) might remain close to each other. This means a UE can be in a tracking area of a MME at one point and it can immediately move to a routing area of SGSN at another. If both coverage areas are pretty close then it could result in ping-pong effect. That is a UE may get into a loop where it sends TAU to LTE network and next moment it sends RAU to 3G systems de-registering itself from LTE and vice versa.

Solution to this is proposed in Annex J of 3GPP TS 23.401. ISR - Idle-mode singalling Reduction.

The soultion suggests that UE be registered with both networks while it is in Idle mode. That is UE is registered to a tracking area of a MME and also to a routing area of a SGSN. This needs UE to explicitly support ISR and also both the networks should be capable enough to support the ISR. The common achor point between the networks is considered to be SGW, this also means that SGSNs and GGSNs should be upgraded to support Rel 8. This way ping pong effect is avoided. But this comes at an expense. As the UE is registered to both networks both the SGSN and MME will have to initiate a paging process to make UE move to connected state. However UE will initiate serivice request to network that it is currently camped on, i.e either LTE or 3G.

More to follow.

LTE, Wimax and WIFI

I observed this particular trend in India with regards to household. People typically have a PSTN phone at their home provided by the local govt operator (BSNL). Then they use mobile phones from various operators. Though mobile phones are extensively used for communication I observed that people prefer wired telephones to convey important information to the other party whenever possible. Many are very comfortable with using a PSTN line. Though mobile communication is exploding PSTNs are doing very good business too. I was thinking if we could offer more services over wired line it would be big hit in India. At-least my mom would be very happy to talk to her sister over a video phone. VOIP phones?

On a same note I still dont find the wireless internet in India to be great. I recently got a Wimax connection and its kinda bad. First, the connection is costly and next the speeds are bad. More over the webauth makes it worse when there are multiple computers at home. The basic connection setup takes forever and it is really frustrating sometimes. Though companies have been pushing for wimax, end users are really not happy with it, at-least me and my friends are not happy with it. Now I always think how my fixed line (DSL) used to work. Its been a downgrade for me. Similar is the experience with the 3G modems. Worst uplink speeds and during peak hours you hardly get anything. The point here is Wimax and 3G are still not proving to be perfect replacement for the wired connections.

Recently I came across a service provider providing wifi services. The adds display 4G enabled technology and gives away words like MIMO and OFDM. It caught my interest and was wondering for a while what the underlying technology could be. Guess what its our humble Wifi. I was always a fan of WIFI and with latest 802.11n its time to explore the wifi mesh networks. About 3 years back, when I was in college, I happened to listen to a lecture from a professor who came all the way from Israel. The lecture was on Wifi mesh networks and various routing algorithms involved in it. Typically a wifi mesh is formed of multiple adhoc networks. The lecture was quite interesting and we did some experiments with our laptops and could route packets through multiple laptops. It was fun but I never thought it would be commercially launched (college kid, lack of experience :-)) Now when I see the add, it reminds me of the lecture and experiments. 802.11n on the backhaul and supported 802.11a/b/g towards the customer end seems great. Backhaul is powered with MIMO and OFDM which provide high speeds between the nodes can help boost the network performance. But again the network has to be carefully designed and routes to the main node are to be optimally configured. I quite dont know how the network is really performing, should talk to someone who is using the mesh, but I am quite happy to see wifi growing. Imagine if these networks grow then wimax and mobile networks can get in trouble. More over this wifi mesh is seeming to be a lot cheaper than what other technologies are offering.

Just a thought!

3GPP Specs

As we know there are hundreds of 3GPP specs. But when coming to the implementation will all that is written in the spec will be implemented. Of-course not. I think the specs give an detailed view of the architecture and how things should work . But there are some many things that are outside the specifications scope and mind you they can happen in the real world.

Ambiguous scenarios, negative scenarios, collision scenarios and what not. When coming to LTE I pity eNB and MME. They are most vulnerable to take a beating from various handsets. More over the interpretation of specifications from one engineer to other may be different, so the product might seem different. Hence IOTs are needed.

The wireless world is so different from the regular networking at Layer 2 and Layer 3. The IEEE standards and RFCs are clearly written, so the implementation is very clear. The thing to notice here is there are not many end user to it. Who would be running BGP or OSPF or MPLS? Most of the traffic in the internet is at Layer 7 and hence I feel difficulty is a bit less in internet. But I do agree at there are very complex protocols involved in the internet. But in wireless, the whole network is at the customers stake. A fake UE can bring down the back-end devices. So the equipment manufactures do implement lot of things that are outside the scope of the 3GPP specs. Just a thought.

LTE Tidbits-II

Few more things are LTE below. Find part 1 here.

UE network attach:

We all know how important IMSI is and we wouldn't want to spill it out anytime. This requirement brings in a second type of attach procedure in LTE. Usually attach request from UE contains IMSI so that network can validate the same. Once network knows the UE's IMSI, it will generate a Globally Unique Temporary Identifier (Find details here) and assign it to UE. So for further communication UE can use GUTI instead of IMSI.

Why this? The Attach Request sent to the network is not encrypted. Security procedures are done only after network receives Attach Request. This means if IMSI is sent in Attach Request its susceptible to be known to outsider. To avoid this UE may send Old GUTI to network in Attach Request(The term "Old" is used here because it is assumed that UE is moving from one MME to other MME). Once the network receives that GUTI it will map the IMSI from it. Problem solved. What if the network doesn't know the GUTI, then it will have to ask the UE to send its IMSI. Network sends out an Identity Request to UE asking for its IMSI, to which UE will respond with Identity Response with its IMSI. Note that this message is not encrypted.

GUTI is assigned by the network. Which means UE should send its IMSI to network at-least once. If UE moves from one MME to other then its responsibility of MME to get the UE's IMSI from other MME based on the GUTI which UE has sent. Identity Request (for IMSI) should be sent only if MME fails to retrieve the IMSI.

Inter Rat Handovers:

There is special section in 3GPP TS 23.401 which we tend to ignore. Appendix. :-) If we look at inter handover requirements it is quite clear that SGSN's should be upgrade with new version of GTP protocol. But this Appendix has a different information altogether. Refer to Appendix 5 in the spec. Checkout the Routing and Tracking Area update procedures. They both speak of GTPv1 rather than GTPv2. This means MME has to support GTPv1 too. This sucks. Anyway, I still have my fingers crossed about inter RAT handovers. Hope they will be seems less.

More later. Comments/Corrections are welcome.

I will NOT be at Mobile World Congress this year!

I will NOT be at MWC this year. :-) Neither was I last year nor the year before. :-D

But I am close follower of the event. Last year was all about mobile devices. HTC unveiled their new phone and so did other brands. Nokia N97 was announced just ahead of MWC. All in all last year was more of devices.

However this year I am guessing most of the attention would be towards LTE and HSPA+. Now the devices are in the market and we need speed. I want to see more of LTE demos, chipsets and handsets. Also an announcement regarding voice over LTE would be sweet.

With so much action in Barcelona its disheartening to see no 3G in India. I see an add today which says TV over Mobile phone. Cool! But dah! Network is still running GPRS. Considering a city like Bangalore in India this application makes no sense. Any way hope to see 3G soon in India.

I wish all visiting Barcelona for MWC a good luck and hope to see some live blogging from there. May be I will get a chance sometime in future to visit Barcelona :-)

LTE End to End Signaling:- Part 2

I wrote about LTE End to End Signaling some time back. Based on public demand I enhanced the call flows a bit :-). Here are two calls showing Initial Attach and UE initiated detach procedures.

LTE UE Initial Attach

This is a huge call flow and there is a lot of processing involved. I would like give a brief out line of messages.

S1 Setup: This is where eNB is attached to the network. As long the eNB is functioning the S1 setup remains.

RRC Connections: Once UE comes up a RRC connection is established for communication with the network.

NAS: After RRC is established then begins the NAS signaling. UE sends Attach request along with PDN connectivity request to network. Attach is for attaching to the network and other message message is for establishing the bearers.

HSS: This is Home Subscriber System and it understands diameter protocol. Once MME receives Attach Request, it queries HSS for authentication details. HSS sends the authentication vectors to MME in Authentication Info Answer.

Authentication/Security: Networks requests UE for Auth vectors. Once UE provides the same MME compares the same with what HSS has sent. If they match UE is authenticated. Next is security. After the security all the NAS messages are encrypted using the security algorithms that were exchanged.

Bearers: After security network creates the EPS bearers first. (GTP messages). Then the radio bearers are created and RRC connections are modified accordingly. Once the radio bearers are created eNB downlink addresses are sent to SGW in GTP messages.

LTE UE Initiated Detach

UE decides to detach from the network. Its sends a detach request message to network. Network deletes the EPS bearers then the radio bearers are torn down. Finally RRC connection is released.

I hope the messages are correct. Comments are always welcome.

SGSN and LTE

With LTE gaining more light I guess most of the network manufacturers are ready with basic attach, default and dedicated bearers, X2 and S1 handovers. But LTE as standalone will not make sense as it will deployed in just few places. Rest of the world will be still running on 2G/3G/CDMA networks. So there is a strong need for 3G/CDMA convergence with LTE which means inter RAT handovers. I think Europe will see 3G convergence with LTE while Verizon is working hard to converge their CDMA network into LTE in US. So, may be, this year will be about convergence and figuring out a proper solution for voice over LTE.

My interest here is SGSN. SGSN is a major signaling element in 3G packet core. It runs RANAP/NAS protocols towards RNC and GTPv1 towards GGSN. If 3G is to be converged into LTE then there has to be a software upgrade on SGSN as it needs to speak GTPv2 over S4 interface with LTE MME. This makes SGSN much more important and signaling intensive device. I am sure that both operators and equipment manufacturers are looking closely at the SGSN's now. The question here is how will the operators choose which 3G networks should support LTE and which shouldnt. Imagine this. I have a UE which has APN configured with a LTE PGW. While in roaming I may not find a LTE network so I will have to switch back to available 3G network. Now, that 3G network should be capable enough to support my UE's existence in the network. This means SGSN should go all the way to talk to LTE MME, pull the bearer contexts, map the QoS and serve the UE. This needs quite a lot of processing. Will existing SGSN be capable to do all this? This will probably need much powerful hardware on SGSN. I am very keen to see how things will go in this direction. I am hoping that Mobile World Congress this year will have some answers. Any thoughts?

Thank you all!

Let me start with wishing you all a very happy and peaceful new year.

I started this blog as a new year(2009) resolution to keep track of my work. This day marks first anniversary of the blog. I never thought it would be useful to anybody. The idea was to make a record of what I was learning. What I was writing did make sense to some of you and I am quite happy about it. As of now the blog has around 125 subscribers and close to 50,000 hits. This blog goes into my achievements list.

This year I would like to continue writing. I moved a bit closer to technology which means the posts would be more accurate and simplified. In the process of writing blog I did learn a lot from many of you and also made some very good contacts. I take a moment to thank you all for the support. I also request you to let me know if any changes or enhancements are required to the blog. Any suggestions or comments are greatly welcomed.

Cheers, Santosh