UMTS network domains

W-CDMA based 3G mobile network technology, Universal Mobile Telecommunications System (UMTS) integrates traditional GSM voice services and newly emerged data services into a universal integrated network infrastructure. Serving different network functions, such an infrastructure

GERAN stands for GSM EDGE Radio Access Network. It is the term given to the second-generation digital cellular GSM radio access technology, including its evolutions in the form of EDGE (Enhanced Data rates for Global Evolution) and, for most purposes, the General Packet Radio Service (GPRS). GERAN enabled 3G service continuity over the GSM infrastructure by improving speed, latency and mobility experience for data applications. It also introduced a lot more new applications and improved the network efficiency. GERAN includes BTSs and BSCs.

UTRAN, short for UMTS Terrestrial Radio Access Network, is the new generation radio access network within the UMTS architecture. Samilar to GERAN, UTRAN contains the base stations, which are called Node Bs, and Radio Network Controllers (RNC). The RNC provides control functionalities for one or more Node Bs.

UMTS CN (core network) includes network elements within

• legacy GSM: MSC, VLR, HLR, EIR etc.
• GPRS/EDGE: SGSN, GGSN etc.
• IMS core: CBC, CSCF, MRCF, MGCF, SLF, HSS, AS etc.

The following figure shows a brief of the UMTS domains.

Mobile Network Evolution: GSM to UMTS

1. GSM: the 2G mobile network

Global System for Mobile communications (GSM) is the most popular standard for mobile communications in the world. Its network architecture is shown in figure 1.

Figure 1. GSM network architecture

2. GPRS: the 2.5G mobile network

General Packet Radio Servcie (GPRS) is a packet oriented mobile data service developed on the GSM infrastructure. It provides data transfer rate from 56 to 114 kbits.s. GPRS network architecture is as shown in figure 2.

Figure 2. GPRS network architecture

3. EDGE (EGPRS): the 2.75G mobile network

Enhanced data rates for GSM evolution (EDGE), enhanced GPRS (EGPRS) or IMT Signle Carrier (IMT-SC) is a packet mobile technology evolved from the GPRS infrastructure providing enhanced data transfer rate and reliability.

The network architecture for EDGE is basically the same as that for GPRS, the same network elements, the same interfaces, the same protocols and the same procedures. The only minor differences lie in the air interface improvement for supporting higher data transfer rate and reliability.

4. UMTS: the 3G mobile network

Universial Mobile Telecommunications System (UMTS) is the 3G mobile network technology evolved from the GSM-GPRS based network architecture. The overall UMTS evolution experienced different stages (also widely called stages).

4.1 Relsease 99

• 64kbits/s circuit switched bearer services
• 384 kbits/s packet switched bearer services
• location services
• call services
  

4.2 Release 4

• EDGE radio
• multimedia messaging
• MExE (mobile execution environment)
• improved locationed services
• IP multimedia services (IMS)
  

4.3 Release 5

• IP multimedia subsystem (IMS)
• IPv6, IP transport in UTRAN
• improvements in GERAN, MExE etc,
• HSDPA
  

4.4 Release 6

• WLAN integration
• multimedia broadcast and multicast
• improvements in IMS
• HSUPA

4.5 Release 7

• Fix mobile convergence
• DSL access

SS7 Mobile Application Part (MAP)

SS7 Mobile Application Part (MAP) is the core protocol used in the mobile core. In summary, what MAP does are:

• handles all non-call related signaling between different mobile network elements, such as registration, authentication, subscriber profile update/query, romaing and mobility management, supplementary service control, operation and maintenance and short message control etc.
• it is designed to govern the interactions between any two of the the following mobile core network elements: MSC, VLR/HLR, AUC, GMSC, EIR, SMS etc.
• it is a query - response type of protocol
• it contains a number of application system elements (ASE)
• Functionally, MAP can be devided into mobile management (MM) and basic service control functionality categories

A list of mobile core network elements using MAP for signaling are

• EIR Equipment Identity Register - usually integrated with HLR
• GCR Group Call Register
• GGSN Gateway GPRS Support Node - for interfacing to IP or other PD networks
• GMLC Gateway Mobile Location Center - for interfacing to Location Services
• GMSC Gateway MSC - for routing calls from visited network
• gsmSCF GSM Service Control Function - IN service control element
• HLR Home Location Register - the key database
• MSC Mobile services Switching Center
• NPLR Number Portability Location Center - for locating an HLR
• SGSN Serving GPRS Support Node - the "MSC/VLR" for PS services
• SIWFS Shared Interworking Function Server - for interfacing CS data services to IP orother PD networks
• SMS GWMSC SMS Gateway MSC - for terminating SMS routing
• SMS IWMSC SMS Interworking MSC - for originating SMS routing
• USSDC USSD Center - part of gsmSCF
• VBS/VGCS Anchor MSC Voice broadcast/group call service Anchor MSC - specified/not implemented
• VBS/VGCS Relay MSC Voice broadcast/group call service relay MSC - specified/not implemented
• VLR Visitor Location Register -in practice integrated with MSC
• VMSC Visited MSC

Accordingly, the core MAP interfaces between any two of the associated network elements are shown in the following figure.

Over all above interfaces, MAP applications accomplish the designated functionalities through the common MAP services listed below:

• MAP-OPEN/MAP-CLOSE services: For establishing and clearingMAP dialogues between peer-MAP service users
• MAP-DELIMETER service: For accessing to functions below the application layer
• MAP-U-ABORT/MAP-P-ABORT services: For reporting abnormal situations
• MAP-NOTICE service: Notification from the provider, not affecting state of the dialogue

MAP services provided to the MAP applications are of the following categories

1. Location management services

• MAP_UPDATE_LOCATION
• MAP_CANCEL_LOCATION
• MAP_SEND_IDENTIFICATION
• MAP_PURGE_MS
• MAP_UPDATE_GPRS_LOCATION
• MAP-NOTE-MM-EVENT

2. Page and search services

• MAP_PAGE
• MAP_SEARCH_FOR_MS

3. Access management services

• MAP_PROCESS_ACCESS_REQUEST

4. Handover services

• MAP_PREPARE_HANDOVER
• MAP_SEND_END_SIGNAL
• MAP_PROCESS_ACCESS_SIGNALLING
• MAP_FORWARD_ACCESS_SIGNALLING
• MAP_PREPARE_SUBSEQUENT_HANDOVER
• MAP_ALLOCATE_HANDOVER_NUMBER
• MAP_SEND_HANDOVER_REPORT

5. Authentication management services

• MAP_AUTHENTICATE
• MAP_SEND_AUTHENTICATION_INFO
• MAP_AUTHENTICATION_FAILURE_REPORT

6. Security management services

• MAP_SET_CIPHERING_MODE

7. International mobile equipment identities management services

• MAP_CHECK_IMEI
• MAP_OBTAIN_IMEI

8. Subscriber management services

• MAP-INSERT-SUBSCRIBER-DATA
• MAP-DELETE-SUBSCRIBER-DATA

9. Identity management services

• MAP-PROVIDE-IMSI
• MAP-FORWARD-NEW-TMSI

10. Fault recovery services

• MAP_RESET
• MAP_FORWARD_CHECK_SS_INDICATION
• MAP_RESTORE_DATA

11. Subscriber Information services

• MAP-ANY-TIME-INTERROGATION
• MAP-PROVIDE-SUBSCRIBER-INFO
• MAP-ANY-TIME-SUBSCRIPTION-INTERROGATION
• MAP-ANY-TIME-MODIFICATION
• MAP-NOTE-SUBSCRIBER-DATA-MODIFIED

12. Operation and maintenance services -- Subscriber tracing services

• MAP-ACTIVATE-TRACE-MODE
• MAP-DEACTIVATE-TRACE-MODE
• MAP-TRACE-SUBSCRIBER-ACTIVITY

13. Other operation and maintenance services

• MAP-SEND-IMSI

14. Call handling services

• MAP_SEND_ROUTING_INFORMATION
• MAP_PROVIDE_ROAMING_NUMBER
• MAP_RESUME_CALL_HANDLING
• MAP_PREPARE_GROUP_CALL
• MAP_PROCESS_GROUP_CALL_SIGNALLING
• MAP_FORWARD_GROUP_CALL_SIGNALLING
• MAP_SEND_GROUP_CALL_END_SIGNAL
• MAP_SEND_GROUP_CALL_INFO
• MAP_SET_REPORTING_STATE
• MAP_STATUS_REPORT
• MAP_REMOTE_USER_FREE
• MAP_IST_ALERT
• MAP_IST_COMMAND
• MAP_RELEASE_RESOURCES

15. Supplementary services related services

• MAP_REGISTER_SS
• MAP_ERASE_SS
• MAP_ACTIVATE_SS
• MAP_DEACTIVATE_SS
• MAP_INTERROGATE_SS
• MAP_REGISTER_PASSWORD
• MAP_GET_PASSWORD
• MAP_PROCESS_UNSTRUCTURED_SS_REQUEST
• MAP_UNSTRUCTURED_SS_REQUEST
• MAP_UNSTRUCTURED_SS_NOTIFY
• MAP_SS_INVOCATION_NOTIFY
• MAP_REGISTER_CC_ENTRY
• MAP_ERASE_CC_ENTRY

16. Short message service management services

• MAP-SEND-ROUTING-INFO-FOR-SM
• MAP-MO-FORWARD-SHORT-MESSAGE
• MAP-REPORT-SM-DELIVERY-STATUS
• MAP-READY-FOR-SM
• MAP-ALERT-SERVICE-CENTRE
• MAP-INFORM-SERVICE-CENTRE
• MAP-SEND-INFO-FOR-MT-SMS
• MAP-SEND-INFO-FOR-MO-SMS
• MAP-MT-FORWARD-SHORT-MESSAGE
• MAP-MT-FORWARD-SM-FOR-VGCS

17. Network-Requested PDP Context Activation services

• MAP_SEND_ROUTING_INFO_FOR_GPRS
• MAP_FAILURE_REPORT
• MAP_NOTE_MS_PRESENT_FOR_GPRS

18. Location Service Management Services

• MAP-SEND-ROUTING-INFO-FOR-LCS
• MAP-PROVIDE-SUBSCRIBER-LOCATION
• MAP-SUBSCRIBER-LOCATION-REPORT

MAP message addressing scheme is shown in the following figure.

Mobile Network A Interface

The interface between a BSC (Base Station Controller) and an MSC (Mobile Switching Center) is called the A interface. Running on the standard connection of 64Kbits/s or 2048 Kbits/s (or 1544 Kbits/s in North America), SS7 MTP and SCCP transporation protocols are used to deliver the Base Station Application Part (BSSAP) between the BSC and MSC.

Base Station Application Part (BSSAP) can further be devided into

1. Direct Transfer Application Part (DTAP)
2. Base Station System Operation and Management Part (BSSOMAP)

The DTAP is used to transfer call control and mobility management messages between the MSC and MS. The DTAP information in these messages is not interrepted by the BSC. The majority of radio interface messages are transferred across the A interface by DTAP, except for messages belonging to the Radio Resource (RR) management protocol.

The DTAP message header is as shown in the following figure.

The protocol discriminator distinguishes the payload protocol of the messages as follows:

• 0000 Group call control
• 0001 Broadcast call control
• 0010 PDSS1
• 0011 Call control, call relate SS messages
• 0100 PDSS2
• 0101 Mobility Management messages
• 0110 Radio resource meanagement messages
• 1001 SMS messages
• 1011 Non-call related SS messages
• 1110 Extension of the PD to one octet length
• 1111 Tests procedures

The message type field defines the different messages in different protocols.

The BSSOMAP is used to convey the base station operation and management messages.

Mobile Network Abis Interface

The interface between the BSC (base station controller) and BTS (base transceiver station) is called A bis responsible for the following functions between a BSC and a BTS:

1. Voice-data traffic exchange


2. Signaling exchange between the BSC and the BTS


3. Transporting synchronization information from the BSC to the BTS

Physically, an A bis interface is a primiary rate connection of 64Kbits/s or 2048Mbits/s (or 1.5Mbits/s in North America) digital link. On these digital links, bearer of signaling traffic channels of 16 or 64 Kbits/s are established.

The data link layer (layer 2) protocol running over the A bis interface is LAPD. Running on top of the LAPD is the layer 3 BTS management (BTSM) protocol, which include 3 major functions:

1. Traffic management (radio resource control and connection control) function over the Radio Signaling Link (RSL) (SAPI=0)


2. Operation and maintenance function over the operation and maintenance link (OML) (SAPI=62)


3. Layer 2 management message function over the layer 2 management link (L2ML) (SAPI=63)

Amongst these 3 functions, traffic management function is the most important one. In details, this functional block includes

1. Radio link layer management procedures controlling the establish, modify and release of LAPDm connections over the air interface (Um)


2. Dedicated channel management procedures controlling the ciphering, channel measurement transportation, transmitter power control, handover detection and dedicated channel modification etc.


3. Common channel management procedures for transferring channel requests from MSs, paging MSs, CCCH traffic load measurements, BCCH broadcast information modification, channel assignment and cell broadcast short message transmission etc.


4. TRX management procedures for free traffic channel measurements or flow control.

Over all, A bis layer 3 procedures are

1. RLM Radio Link Layer Management.


2. DCM Dedicated Channel Management.


3. CCM Common Channel Management.


4. TRX Transceiver Management.


5. O&M Operating and Maintenance.

Radio Link layer Management messages includes

1. (01) DATA-REQ: Data request.


2. (02) DATA-IND: Data indication.


3. (03) ERROR-IND: Error indication.


4. (04) IS-REQ: Establish request.


5. (05) IS-CONF: Establish confirm.


6. (06) IS-IND: Establish indication.


7. (07) REL-REQ: Release request.


8. (08) REL-CONF: Release confirm.


9. (09) REL-IND: Release indication.


10. (0a) UNIT-DT-REQ: Unit data request.


11. (0b) UNIT-DT-IND: Unit data indication.

Dedicated Channel Management messages

1. (30) BS-POWER-CTRL: Base Station power control.


2. (21) CHAN-ACT: Channel activation.


3. (22) CHAN-ACT-ACK: Channel activation acknowledge.


4. (23) CHAN-ACT-NACK: Channel activation negative acknowledge.


5. (24) CONN-FAILURE: Connection failure.


6. (25) DEACTIV-SACCH: Deactivate SACCH.


7. (26) ENCRYPT-COMM: Encryption command.


8. (27) HANDOVER-DET: Handover detection.


9. (28) MEASURE-RES: Measurement result.


10. (2a) MODE-MOD-ACK: Mode modify acknowledge.


11. (2b) MODE-MOD-NACK: Mode modify negative acknowledge.


12. (29) MODE-MOD-REQ: Mode modify request.


13. (2f) MS-POWER-CTRL: Mobile System power control.


14. (2d) PHYS-CON-CONF: Physical context confirm.


15. (2c) PHYS-CON-REQ: Physical context request.


16. (32) PREP-MEAS-RES: Preprocessed measurement result.


17. (31) PREPROC-CONF: Pre-processing configuration.


18. (33) RF-CH-REL-ACK: RF channels release acknowledge.


19. (2e) RF-CHANN-REL: Radio Frequency channel release.

Common Channel Management messages

1. (11) BCCH-INFO: BCCH information.


2. (12) CCCH-LOAD-IND: CCCH load indication.


3. (13) CHANNEL-RQD: Channel required.


4. (14) DELETE-IND: Delete indication.


5. (16) IMM-ASS-COM: Immediate assign command.


6. (15) PAGING-CMD: Paging command.


7. (17) SMS-BC-REQ: SMS broadcast request.

TRX Management messages

1. (19) RF-RES-IND: Radio frequency resource indication.


2. (1A) SACCH-FILL: SACCH filling.


3. (1B) OVERLOAD: Overload.


4. (1C) ERR-REP: Error report.

Operating & Maintenance messages

1. (80) O&M Message: Operation and maintenance messages.


2. (40) MMI Transfer: Man/machine interface transfer.


3. (20) TRAU O&M: Transcoder/transfer rate adapter unit.

Mobile Network Air Interface – logical channels and protocols

Mobile network air interface is the interface between mobile stations (MSs) and the Base Transceiver Stations (BTSs). The fundamentals of this interface are a set of protocols running over a set of logical channels.

1. Logical channels

Air interface layer 1 defines a series of logical channels which are made available in either an unassigned random access mode to all users or a dedicated mode assigned to a specific user.
In general, the logical channels are of two major categories, the traffic channels (TCHs) and the signaling channels respectively.

Traffic channels (TCHs) are for user payload data only. Using an ISDN term, they are called the mobile B channels (Bms). Bms can be used in half rate and are then called the lower rate mobile channels (Lms). TCHs possess the following characteristics in terms of functionalities and usages.

a) no Layer 3 control information is carried
b) can be used in either a circuit based mode or a packet based mode,
c) in the circuit based mode, they provide transparent data connection or a specially treated connection according to the carried service
d) in the packet based mode, the carry the OSI layer 2/3 user data (X.25 or other protocols)
e) a TCH can be used as a full-rate Bm or split into two half-rate Lms used by different subscribers
f) one Bm capacity: 13 kbits/s digital voice or 12/6/3.6 kbits/s data stream
g) one Lm capacity: half-rate digital voice or 6/3.6 kbits/s data stream

Signaling channels are for passing signaling and control messages, similar to the ISDN D channel, they are also called the mobile D channels (Dms).

A Dm can be one of the following types

a) Broadcast channel (BCH): a BSS to MS unidirectional broadcast channel, can be further divided into:
a.1) Broadcast control channel (BCCH): carries information about the radio network: radio channel configuration, synchronization information, registration identifier, structural organization of CCCH
a.2) Frequency correction channel (FCCH): layer 1 only,
a.3) Synchronization channel (SCH): broadcast information to identify a BTS, data and frame synchronization. Layer 1 only.

b) Common control channel (CCCH): a BSS to MS unidirectional broadcast channel, deal with access management functions: dedicated channel assignment, MS paging etc. CCCH includes
b.1) Random access channel (RACH): uplink portion of CCCH, slotted Aloha, for MS to ask for a dedicated signaling channel (SDCCH)
b.2) Access grant channel (AGCH): the downlink portion of CCCH, used to assign an SDCCH or a TCH to an MS.
b.3) Paging channel (PCH): part of the downlink of the CCCH, used to page the MS.

c) Dedicated/Associate Control channel (DCCH/ACCH):
c.1) DCCH: bidirectional point-to-point signaling channel
c.1.1) Standalone dedicated control channel (SDCCH): for location update or connection setup etc.
c.2) ACCH: dedicated control channel assigned in connection with a TCH or a standalone dedicated control channel (SDCCH)
c.2.1) Slow associated control channel (SACCH): assigned and used with a TCH or an SDCCH, carries information for optimal radio operation, e.g. synchronization commands, Tx power control, report on channel measurements etc.
c.2.2) Fast associated control channel (FACCH): portion of TCH used for signaling.

d) Cell broadcast channel (CBCH) : broadcast short messages, share the same physical channel with SDCCH.

Figure 1 shows the logical channel classification.

Figure 1 GSM air interface logical channels

2. Protocols

Protocols running over the air interface are mainly for the following purposes:
a) Mobile LAPD (LAPDm), the data link protocol running over the layer 1.
b) Radio resource control (RR), deals with the allocation, de-allocation, and parameter control of the radio channel. RR is running in between of MS and BTS or MS and BSC.
c) Mobility management (MM), deals with location administration and handoff control.
d) Circuit mode connection/call management (CM), manages the setup and termination of calls.

Figure 2 shows the air link protocols and layering.

Figure 2 GSM air interface protocols and layering

Figure 3 shows the incoming call protocol interactions over the logical channels.

Figure 3 Protocol interactions over the air interface logical channels (incoming call case)