UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. UMTS Signaling UMTS INTERFACES, PROTOCOLS, MESSAGE FLOWS, AND PROCEDURES ANALYZED AND EXPLAINED Ralf Kreher Tektronix, Inc., Germany Torsten Ruedebusch Tektronix, Inc., Germany PREFACE The successful trial, deployment, operation and troubleshooting of 3G or UMTS infrastructures and applications is one of the most exciting, fascinating and challenging tasks in today’s mobile communications. Interoperability, roaming or QoS awareness between multi operators and multi technology network infrastructures are just a few of the problems, which need to be met. In today’s early deployments of UMTS networks five main categories of problems can be differentiated: 1. Network Element Instability 2. Network Element Interworking 3. Multi Vendor Interworking (MVI) 4. Configuration Faults 5. Network Planning Faults To meet these challenges, it is vital to understand and analyze the message flows associated with UMTS. “UMTS Signaling” focuses on providing an overview and reference to UMTS, details of the standards, the network architecture, objectives and functions of the different interfaces and protocols. Additionally it comprehensively describes various procedures from Node B Setup to different Handover types in the UTRAN and the Core Network. The focus on wireline interfaces is unique in the market. All signaling sequences are based upon UMTS traces from various UMTS networks (trial and commercial networks) around the world. With this book the reader has access to the first universal UMTS protocol sequence reference, which allows to quickly differentiate valid from invalid call control procedures. In addition all main signaling stages are being explained, many of which had been left unclear in the standards so far and valuable tips for protocol monitoring are provided. What will you get out of “UMTS Signaling”? • A comprehensive overview on UMTS UTRAN and Core networks o Latest updates for Rel. 4, Rel. 5 and Rel. 6 features are included o Description of the real-world structure of ATM transport network on Iub and Iu interfaces o Valuable tips and tricks for practical interface monitoring • In-depth description of the tasks and functions of UMTS interfaces and Protocols • A deep protocol knowledge improvement • Potential to analyze specific protocol messages • Support to reduce time and effort to detect and analyze problems • Explanations how to locate problems in the network. • Comprehensive descriptions and documentation of UMTS reference scenarios for different UMTS procedures o UTRAN Signaling Procedures Description of RRC measurement procedures for radio network optimization Analysis and explanation of PS calls with so-called channel type switching, which is one of the most common performance problems of packet switched services in today's 3G networks SRNS Relocation scenarios - including full description of RANAP and RRC containers UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. More than 35 decoded message examples using Tektronix' protocol testers give a deep insight into control plane protocols on different layers o Core Network Signaling Procedures In-depth evaluations on mobility management, session management and call control procedures Example call flows of the CS domain including practical ideas for troubleshooting Tunnel management on Gn interfaces Mobility management using optional Gs interface Discussion on core network switch (MSC, SGSN) and database (HLR, VLR) information exchange over Mobile Application Part (MAP). Short introduction to 3G intelligent services with CAMEL Application Part (CAP) protocol Comprehensive description of Inter-MSC handover procedures for 3G 3G, 3G-GSM and GSM-3G handovers Detailed description of RANAP, BSSAP and RRC information “UMTS Signaling” readers should be rather familiar with UMTS technology at a fairly detailed level as the book is directed to UMTS experts, who need to analyze UMTS signaling procedures at the most detailed level. This is why only an introductionary overview section discusses the UMTS Network architecture, the objectives and functions of the different interfaces and the various UMTS protocols. Then the book leads right into the main part – the analysis of all main signaling processes in a UMTS networks, so called UMTS scenarios. All main procedures –from Node B Setup to Hard Handover- are described and explained comprehensively. The combination of a network of UMTS experts around the world from many different companies with Tektronix’ many years of experience in protocol analysis have resulted in this unique book, compendium and reference. I hope it will prove helpful for the successful implementation and deployment of UMTS. Alois Hauk General Manager Monitoring and Protocol Test Tektronix Inc. If you have any kind of feedback or questions feel free to send us an email to umts-signaling@tektronix.com For help with acronyms or abbreviations, refer to the glossary at the end of this book. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. ACKNOWLEDGMENTS The Tektronix Network Diagnostics Academy trained already hundreds of students in UMTS and other experience mobile technologies and in testing mobile networks. The experience from these trainings and our close customer relations pointed out, that a book on UMTS Signaling is desperately needed. We collected all the material that was available at Tektronix and that was provided by our partners at network equipment vendors and network operators to add it to this unique selection. The authors would like to acknowledge the effort and time invested by all our colleagues at Tektronix, who have contributed to this book. Special thanks go to Jens Irrgang and Christian Villwock, Tektronix MPT, Berlin for their Co-Authorship and their valuable advice and input for chapter 1.6 “UMTS Security”. Without Juergen Placht (Sanchar GmbH) this book would not exist. His unbelievable knowledge, experience and efforts in preparing the very first slide sets for UMTS scenarios laid the basis for the material you have now in front of you. Additionally, the material that Magnar Norderhus, Hummingbird, Duesseldorf, prepared for the first UMTS Training for Tektronix was the very first source that we have “blown up” for part one of this book. Many thanks go to Joerg Nestle Product Design, Munich, for doing a great job in the creation of all the basic graphics. We would like to express thanks to Othmar Kyas, Marketing Manager of Tektronix Monitor & Protocol Test for his strong believe in the Tektronix Network Diagnostics Academy, in “UMTS Signaling” and for challenging us to make this book become real. Of course we must not forget to thank Mark Hammond and the team at Wiley. Mark wanted us to do the book and kept us moving, even though it took so much time to get all the permissions aligned with Tektronix. Last but not least a special 'thank you' to our families and friends for their ongoing and infinite patience and their support throughout this project. Berlin, Germany Ralf Kreher, Torsten Ruedebusch UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. ABOUT THE AUTHORS Ralf Kreher, Manager for Customer Training, Mobile Protocol Test, Tektronix, Inc. Ralf Kreher leads the Customer Training Department for Tektronix’ Mobile Protocol Test (MPT) business. He is responsible for the world-class seminar portfolio for mobile technologies and measurement products. Before joining Tektronix, he held a trainer assignment for switching equipment at Teles AG. He holds a Communication Engineering Degree of the Technical College Deutsche Telekom Leipzig. He currently resides in Germany. Torsten Ruedebusch, Head of Knowledgeware and Training Department, Mobile Protocol Test, Tektronix, Inc. Torsten Ruedebusch is the head of the Knowledgeware and Training Department for Tektronix’ Mobile Protocol Test (MPT) business. He is responsible for providing leading edge technology and product seminars and the creation of knowledgeware products using the extensive Tektronix’ expertise. Before joining Tektronix, he held an application engineer as-signment at Siemens CTE. He holds a Communication Engineering Degree of the Technical College Deutsche Telekom Berlin. He currently resides in Germany. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. 1 UMTS BASICS UMTS is real. In several parts of the world we can walk in the stores of mobile network operators or resellers and take UMTS PC-Cards or even 3G phones home and use them instantly. Every day the number of equipment and their feature sets gets broader. The “dream” of multimedia on mobile connections, online gaming, video conferencing or even real-time video becomes reality. With rapid technical innovation the mobile telecommunication sector has continued to grow and evolve strongly. The technologies used to provide wireless voice and data services to subscribers, such as Time Division Multiple Access (TDMA), Universal Mobile Telecommunications Systems (UMTS) and Code Division Multiple Access (CDMA), continue to grow in their complexity. This complexity continues to impart a time-consuming hurdle to overcome when moving from 2G to 2.5G and to third-generation (3G) networks. GSM (Global System for Mobile Communication) is the most widely installed wireless technology in the world. Some estimates put GSM market share at up to 80%. Long dominant in Europe, GSM is now gaining a foothold in Brazil and is expanding its penetration in the North American market. One reason for this trend is the emergence of reliable, profitable 2.5G GPRS elements and services. Adding a 2.5G layer to the existing GSM foundation has been a cost-effective solution to current barriers while still bringing desired data services to market. The enhancement to EGPRS (EDGE) allows a speed of 384kbit/s. This is the maximum limit. Now EDGE goes under pressure, because High Speed Downlink Packet Access (HSDPA; see 1.2.3) and its speed of 2Mbit/s will take huge ports of the market share once it is largely available. So, the EGPRS operators will sooner or later switch to 3G UMTS (Figure 1.1) services, the latest of which is UMTS Release 6 (R6). This transition brings new opportunities and new testing challenges, both in terms of revenue potential and addressing interoperability issues to ensure QoS. With 3G mobile networks, the revolution of mobile communication has begun. 4G and 5G networks will make the network transparent to the user’s applications. In addition to horizontal handovers (for example between Node Bs), handovers will occur vertically between applications and the terrestrial UTRAN (UMTS Terrestrial Radio Access) will be extended by a satellite-based RAN (Radio Access Network), ensuring global coverage. Figure 1 1 - Component Overview of a UMTS Network Every day the number of commercial networks in different parts of the world increases rapidly. Therefore, network operators and equipment suppliers are desperate to understand how to handle and analyze UMTS signaling procedures in order to get the network into operation, detect errors, and troubleshoot faults. Those experienced with GSM will recognize many similarities with UMTS, especially in Non-Access-Stratum or NAS-messaging. However, in the lower layers within the UTRAN and Core network, UMTS introduces a set of new protocols, which deserve close understanding and attention. The philosophy of UMTS is to separate the user plane from the control plane, the radio network from the transport network, the access network from the core network, and the access stratum from the non-access stratum. The first part of this book is a refresher on UMTS basics, the second part continues with in-depth message flow scenarios of all kinds. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. 1.1 STANDARDS ITU (the International Telecommunication Union) solicited several international organizations for descriptions of their ideas for a third generation mobile network: CWTS: China Wireless Telecommunication Standard group ARIB: Association of Radio Industries and Businesses, Japan T1: Standards Committee T1 Telecommunications, USA TTA: Telecommunications Technology Association, Korea TTC: Telecommunication Technology Committee, Japan ETSI: European Telecommunications Standards Institute ITU decided which standards would be used for “International Mobile Telecommunication at 2000 MHz.” Many different technologies were combined in IMT-2000 standards. Figure 1 2 - IMT-2000 The main advantage of IMT-2000 is that it specifies international standards and also the interworking with existing PLMN standards, such as GSM. Figure 1 3 - IMT-2000 Standards benefit users, operators, and vendors. In general the quality of transmission will be improved. The data transfer rate will increase dramatically. Transfer rates of 384 kbit/s are already available; 2Mbit/s (with HSDPA technology) is under test and almost ready to go live in certain parts of Asia. New service offerings will help UMTS to become financially successful for operator and attractive to users. The improvement for the user will be the worldwide access available with a mobile phone, and the look and feel of services will be the same wherever he or she may be. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. There is a migration path from 2G to 3G systems (Figure 1.4) that may include an intermediate step, the so- called 2.5G network. Packet switches -GGSN or SGSN in case of a GSM network- are implemented in the already existing CN while the RAN is not changed significantly. In case of a migration from GSM to UMTS a new radio access technology (W-CDMA instead of TDMA) is introduced. This means the networks will be equipped with completely new radio access networks that replace the 2G network elements in the RAN. However, EDGE (Enhanced Data Rates for GSM Evolution) opens a different way to offer high-speed IP services to GSM subscribers without introducing W-CDMA. The already existing CDMA cellular networks, which are especially popular in the Americas will undergo an evolution to become CDMA2000 networks with larger bandwidth and higher data transmission rates. Figure 1 4 – Possible migration paths from 2G to 3G UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. 1.2 NETWORK ARCHITECTURE UMTS maintains a strict separation between the radio subsystem and the network subsystem, allowing the network subsystem to be reused with other radio access technology. The core network is adopted from GSM and consists of two user traffic-dependent domains and several commonly used entities. Traffic-dependent domains correspond to the GSM or GPRS core networks and handle: • Circuit switched type traffic in the CS Domain • Packet switched type traffic in the PS Domain Both traffic-dependent domains use the functions of the remaining entities – the Home Location Register (HLR) together with the Authentication Center (AC), or the Equipment Identity Register (EIR) - for subscriber management, mobile station roaming and identification, and handling different services. Thus the HLR contains GSM, GPRS, and UMTS subscriber information. Two domains handle their traffic types at the same time for both the GSM and the UMTS access networks. The CS domain handles all circuit switched type of traffic for the GSM as well as for the UMTS access network; similarly, the PS domain takes care of all packet switched traffic in both access networks. 1.2.1 GSM The second generation of PLMN is represented by a GSM network consisting of Network Switching Subsystem (NSS) and a Base Station Subsystem (BSS).The first evolution step (2.5G) is a GPRS PLMN connected to a GSM PLMN for packet-oriented transmission. Figure 1 5 - GSM Network Architecture The main element in the NSS is the Mobile Switching Center (MSC), which contains the Visitor Location Register (VLR). The MSC represents the edge towards the BSS and on the other side as Gateway MSC (GMSC), the connection point to all external networks, such as the Public Switched Telephone Network or ISDN. GSM is a circuit switched network, which means that there are two different types of physical links to transport control UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. information (signaling) and traffic data (circuit). The signaling links are connected to Signaling Transfer Points (STP) for centralized routing whereas circuits are connected to special switching equipment. HLR Home Location Register SGSN Serving GPRS Support Node with Location Register Function GGSN Gateway GPRS Support Node AuC Authentication Center SCP Service Control Point SMSC Short Message Service Center CSE CAMEL Service Entity (Customized Application for Mobile network Enhanced Logic) The most important entity in BSS is the Base Station Controller, which, along with the Packet Control Unit (PCU), serves as the interface with the GPRS PLMN. Several Base Stations (BTS) can be connected to the BSC. 1.2.2 UMTS Release 99 Figure 1 6 - UMTS Rel. 99 Network Architecture [...]... data but without a guaranteed data rate Figure 1 26 - UMTS Bearer / QoS Classes Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling 1.6 UMTS SECURITY After experiencing GSM, the 3GPP creators wanted to improve the security aspects for UMTS For example, UMTS addresses the “Man-in-the-Middle” Fake BTS problem by introducing a signaling integrity function Figure 1 27 - Ciphering... passed to the lower layer By that, UMTS sets up a connection through its own layer architecture fulfilling the requested QoS Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling Figure 1 25 - UMTS Bearer / QoS Architecture Problems are foreseen in the External Bearer Services because they are outside of UMTS and the responsibility of the UMTS network operator QoS Classes with... confidential UMTS Signaling 1.5.4 UMTS User Equipment & USIM Figure 1 21 - UMTS User Equipment In UMTS the mobile station is called User Equipment (UE) and is constructed in a very modular way It consists of following parts: Mobile Termination (MT) Represents the termination of the radio interface and, by that, the termination of an IMT-2000 family-specific unit There are different MT messages for UMTS in.. .UMTS Signaling The figure above shows the basic structure of a UMTS Rel 99 network It consist of the two different radio access parts BSS and UTRAN and the core network parts for circuit switched (e.g voice) and packet switched (e.g email download) applications To implement UMTS means to set up a UMTS Terrestrial Radio Access Network (UTRAN), which... Lawful interception integration Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling 1.3 UMTS INTERFACES Figure 1.15 shows a basic overview of the different interfaces in an UMTS Rel 99 network A detailed description of objectives and functions follows in this chapter Figure 1 15 - UMTS Interface Overview 1.3.1 Iu Interface The Iu interface is located between the RNC and MSC... measurement objects Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling 1.4 UMTS DOMAIN ARCHITECTURE UMTS tried from its beginning to be very modular in its structure This is the base of becoming an international standard even though certain modules will be national specific Figure 1 16 - UMTS Domain Architecture The two important big modules are the Access Stratum (Mobile... mobile network is the UMTS network UMTS actively combats prior mentioned threats offering the following security procedures: • • Ciphering of control information and user data Authentication of the user towards the network Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling • • • Authentication of the network towards the user Integrity protection Anonymity The UMTS security procedures... Gateway (MGW) Signaling between MGW and MGCF follows H.248 protocol standard and handles signaling and session management The Media Resource function (MRF) provides specific functions (e.g conferencing or multiparty calls), including bearer and service validation New in Release 6 UMTS/ WLAN Interworking (Figure 1.14) • WLAN could be used at hotspots as access network for IMS instead of the UMTS PS Domain... Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling Note: It is not expected to have 3.84 TDD and 1.28 TDD cells in the same network, but operators in same area are expected to work with different TDD versions So, 3-band-Node Bs are not necessary 1.5.3 Area Concept The areas of 2G will be continuously used in UMTS UMTS will add a new group of locations specifying the UTRAN Registration... for user-specific signaling management Transfer of NAS signaling messages between UE and CN Location services by transferring requests from the CN to UTRAN, and location information from UTRAN to CN Simultaneous access to multiple CN domains for a single UE Mechanisms for resource reservation for packet data streams Copyright © Tektronix Berlin GmbH & Co KG Company confidential UMTS Signaling 1.3.2 . UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. UMTS Signaling. information UMTS Signaling readers should be rather familiar with UMTS technology at a fairly detailed level as the book is directed to UMTS experts, who need to analyze UMTS signaling procedures. control UMTS Signaling Copyright © Tektronix Berlin GmbH & Co KG. Company confidential. information (signaling) and traffic data (circuit). The signaling links are connected to Signaling