Cellular networks and mobile computing coms 6998 10 spring 2013
Download
1 / 100

Cellular Networks and Mobile Computing COMS 6998-10, Spring 2013 - PowerPoint PPT Presentation


  • 103 Views
  • Uploaded on

Cellular Networks and Mobile Computing COMS 6998-10, Spring 2013. Instructor: Li Erran Li ( [email protected] ) http://www.cs.columbia.edu/~lierranli/coms6998-10Spring2013/ 2/26/2013: Introduction to Cellular Networks. Announcements. Programming assignment 2 will be due tomorrow

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Cellular Networks and Mobile Computing COMS 6998-10, Spring 2013' - shania


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Cellular networks and mobile computing coms 6998 10 spring 2013

Cellular Networks and Mobile ComputingCOMS 6998-10, Spring 2013

Instructor: Li Erran Li ([email protected])

http://www.cs.columbia.edu/~lierranli/coms6998-10Spring2013/

2/26/2013: Introduction to Cellular Networks


Announcements
Announcements

  • Programming assignment 2 will be due tomorrow

  • Programming assignment 3 will be due March 13. Please start early!

    • Two lab sessions will be scheduled

  • Please email me the presentation slides the day before!


Review of previous lecture
Review of Previous Lecture

What are the different approaches of virtualization?


Review of previous lecture1
Review of Previous Lecture

  • What are the different approaches of virtualization?

    • Bear-metal hypervisor, hosted hypervisor, container (Linux LXC, Samsung Knox)


OS

Kernel

OS

Kernel

OS

Kernel

Hypervisor / VMM

Hardware

Bare-Metal Hypervisor

poor device support / sharing

Courtesy: Jason Nieh et al.


OS

OS

OS

kernel

module

emulated

devices

Hypervisor / VMM

Hardware

Host OS Kernel

Hosted Hypervisor

poor device

performance

Courtesy: Jason Nieh et al.


Review of previous lecture cont d
Review of Previous Lecture (Cont’d)

What approach does Cell use?

What are the key design choices for Cell’s extremely low overhead?


Review of previous lecture cont d1
Review of Previous Lecture (Cont’d)

  • Device namespace

    • It is designed to be used by individual device drivers or kernel subsystems to tag data structures and to register callback functions. Callback functions are called when a device namespace changes state.

    • Each VP uses a unique device namespace for device interaction.

  • Cells leverages its foreground-background VP usage model to register callback functions that are called when the VP changes between foreground and background state.


device namespaces

VP 2

VP 1

VP 3

Linux

Kernel

GPU

Input

Power

Android...

Sensors

Audio/Video

RTC / Alarms

Framebuffer

WiFi

Cell Radio

•••

Device Namespaces

safely, correctly multiplex access to devices

•••

Courtesy: Jason Nieh et al.


Review of previous lecture cont d2
Review of Previous Lecture (Cont’d)

  • What are the most expensive flash memory operations?

    • Random read

    • Random write

    • Sequential write

    • Sequential read


Random versus sequential disparity
Random versus Sequential Disparity

Performance MB/s

Consumer-grade SD performance

For several popular apps, substantial

fraction of I/O is random writes (including web browsing!)

  • Performance for random I/O significantly worse than seq; inherent with flash storage

  • Mobile flash storage classified into speed classes based on sequential throughput

    • Random write performance is orders of magnitude worse

Courtesy: Nitin Agrawal et al.


Should os manage context
Should OS Manage Context?

Logical Location

home, office, mall

Motion State

sitting, walking, running

Interruptible

yes, no

  • export Context Data Units (CDUs) rather than raw sensor data

    • higher-level abstraction than bytes

    • apps query or subscribe to CDUs

  • each CDU is defined by a CDU Generator: a graph of processing components

    • combine Generators into composite context dataflow

    • provide a base CDU vocabulary (that is extensible)


Condos design
CondOS Design

app A

app G

app Z

User space

Kernel space

other OS services

CDU1

CDU2

CDU3

Scheduling

Memory

Management

I/O

Interruptible

yes, no

Logical Location

home, office, mall

Motion State

sitting, walking, running

Security

Energy

Management

Audio Features

Context Data

Generators

Location DB

Motion Features

context

dataflow

example

Silence Filter

Geolocation

GPS, Cell, WiFi

IMU

accel, gyro, mag

Audio


Syllabus
Syllabus

  • Mobile App Development (lecture 1,2,3)

    • Mobile operating systems: iOS and Android

    • Development environments: Xcode, Eclipse with Android SDK

    • Programming: Objective-C and android programming

  • System Support for Mobile App Optimization (lecture 4,5)

    • Mobile device power models, energy profiling and ebug debugging

    • Core OS topics: virtualization, storage and OS support for power and context management

  • Interaction with Cellular Networks (lecture 6,7,8)

    • Basics of 3G/LTE cellular networks

    • Mobile application cellular radio resource usage profiling

    • Measurement-based cellular network and traffic characterization

  • Interaction with the Cloud (lecture 9,10)

    • Mobile cloud computing platform services: push notification, iCloud and Google Cloud Messaging

    • Mobile cloud computing architecture and programming models

  • Mobile Platform Security and Privacy (lecture 11,12,13)

    • Mobile platform security: malware detection and characterization, attacks and defenses

    • Mobile data and location privacy: attacks, monitoring tools and defenses


Outline
Outline

Goal of this lecture: understand the basics of current networks and future directions

  • Current Cellular Networks

    • Introduction

    • Radio Aspects

    • Architecture

    • Power Management

    • Security

    • QoS

  • What Is Next?

  • A Clean-Slate Design: Software-Defined Cellular Networks

  • Conclusion and Future Work


Cellular networks impact our lives
Cellular Networks Impact our Lives

More Infrastructure

Deployment

More Mobile Connection

1010100100001011001

0101010101001010100

1010101010101011010

1010010101010101010

0101010101001010101

More Mobile Users

More Mobile Information Sharing


Mobile data tsunami challenges current cellular technologies
Mobile Data Tsunami Challenges Current Cellular Technologies

Source: CISCO Visual Networking Index (VNI) Global Mobil Data Traffic Forecast 2011 to 2016

  • Global growth 18 times from 2011 to 2016

  • AT&T network:

    • Over the past five years, wireless data traffic has grown 20,000%

    • At least doubling every year since 2007

  • Existing cellular technologies are inadequate

    • Fundamental redesign of cellular networks is needed


Global convergence
Global Convergence

IS-95

cdma2000

EV-DO

D-AMPS

D-AMPS

PDC

PDC

?

WiMAX

  • LTE is the major technology for future mobile broadband

    • Convergence of 3GPP and 3GPP2 technology tracks

    • Convergence of FDD and TDD into a single technology track

3GPP

GSM

WCDMA

HSPA

LTEFDD and TDD

TD-SCDMA

HSPA/TDD

3GPP2

IEEE


Lte deployments 89 commercial networks launched
LTE deployments 89 commercial networks launched

Courtesy: Zoltán Turányi


Mobile subscriptions by technology 2008 2017 estimate
Mobile subscriptions by technology 2008-2017 (estimate)

Courtesy: Zoltán Turányi


3gpp introduction
3GPP introduction

  • 3rd Generation Partnership Program

    • Established in 1998 to define UMTS

    • Today also works on LTE and access-independent IMS

    • Still maintains GSM

  • 3GPP standardizes systems

    • Architecture, protocols

  • Works in releases

    • All specifications are consistent within a release


3gpp way of working
3GPP way of working

E.g., 22-series specs

  • Stage 1

  • Requirements

  • “It shall be possible to...”

  • “It shall support…”

  • Stage 2

  • Architecture

  • Nodes, functions

  • Reference points

  • Procedures (no errors)

  • Stage 3

  • Protocols

  • Message formats

  • Error cases

E.g., 23-series specs

E.g., 29-series specs

Specification numbering example:

3GPP TS 23.401 V11.2.0

Updated after a meeting

TS=Technical Specification (normative)

TR=Technical Report (info only)

  • Release

  • Consistent set of specs per release

  • New release every 1-2 years

Spec. number

Courtesy: Zoltán Turányi


3gpp specification groups
3GPP specification groups

Protocols

3G/LTE

System

2G


Starting points on 3gpp specifications
Starting points on 3GPP specifications

  • http://www.3gpp.org/specification-numbering

    • Pointers to the series of specifications

    • Architecture documents in 23-series

  • Main architecture references

    • 23.002 – Overall architecture reference

    • 23.401 – Evolved Packet Core with LTE access, GTP-based core

    • 23.060 – 2G/3G access, and integration to Evolved Packet Core

    • 23.402 – Non-3GPP access, and PMIP-based core

Courtesy: Zoltán Turányi


Example
Example

A base stationwith 3 sectors (3 cells)

Courtesy: Zoltán Turányi


Key challenges
Key challenges

  • Large distances

    • Terminals do not see each other

    • Tight control of power and timing needed

    • Highly variable radio channel – quick adaptation needed

  • Many users in a cell

    • A UMTS cell can carry roughly 100 voice calls on 5 MHz

    • Resource sharing must be fine grained – but also flexible

  • Quality of Service with resource management

    • Voice – low delay, glitch-free handovers

    • Internet traffic – more, more, more

  • Battery consumption critical

    • Low energy states, wake-up procedures

    • Parsimonious signaling

Courtesy: Zoltán Turányi



Physical layer umts
Physical Layer: UMTS

Simultaneous meetings in different rooms (FDMA)

Simultaneous meetings in the same room at different times (TDMA)

Multiple meetings in the same room at the same time (CDMA)

Courtesy: Harish Vishwanath


Physical layer umts cont d
Physical Layer: UMTS (Cont ’d)

Code Division Multiple Access (CDMA)

  • Use of orthogonal codes to separate different transmissions

  • Each symbol or bit is transmitted as a larger number of bits using the user specific code – Spreading

  • Spread spectrum technology

    • The bandwidth occupied by the signal is much larger than the information transmission rate

    • Example: 9.6 Kbps voice is transmitted over 1.25 MHz of bandwidth, a bandwidth expansion of ~100

Courtesy: Harish Vishwanath


Physical layer umts cont d1
Physical Layer: UMTS (Cont ’d)

RNC

RNC

RNC

UMTS – Universal Mobile Telecommunication System

CDMA – Code Division Multiple Access

UE – User Equipment

RNC – Radio Network Controller

  • Uses spread-spectrum to separate users

  • Common 5 MHz channels

  • Supports soft-handover

    • Multiple base stations send/receive same data to the user

    • Recombining the two paths result in better channel

    • Requires real-time network between base station and RNC


Resource control
Resource control

HSPA channel

(packet-oriented high data rate)

HSPA

Dedicated channels

(64, 128, 384 kbits/s, 2 Mbit/s)

DCH

DCH

Cost:

RNC processing power when switching between states

Cost:

More radio resources

More battery need

Common channel

(low data rate, random access)

FACH

Battery saving(connected)

URA

Battery saving(disconnected)

IDLE

Courtesy: Zoltán Turányi


HSPA

  • High Speed Packet Access

    • Packet oriented extension to WCDMA

    • Time Division Multiplexing within a common channel

  • Opportunistic scheduling

    • Users with currently good reception receive more resources

    • Higher overall capacity than equal share

  • Hybrid ARQ with soft combining

    • Only additional redundancy is transmitted on a frame error, not the full frame

  • Most radio functions moved to NodeB

  • No soft handover in downlink


Lte air interface
LTE air interface

One resource block

12 subcarriers during one slot (180 kHz × 0.5 ms)

One resource element

12 subcarriers

One OFDM symbol

One slot

frequency

Time domain structure

Frame (10 ms)

  • The key improvement in LTE radio is the use of OFDM

  • Orthogonal Frequency Division Multiplexing

    • 2D frame: frequency and time

    • Narrowband channels: equal fading in a channel

      • Allows simpler signal processing implementations

    • Sub-carriers remain orthogonal under multipath propagation

time

Slot (0.5 ms)

Subframe (1 ms)


Lte air interface downlink
LTE air interface: Downlink

  • Orthogonal Frequency Division Multiple Access (OFDM)

  • Closely spaced sub-carriers without guard band

  • Each sub-carrier undergoes (narrow band) flat fading

    - Simplified receiver processing

  • Frequency or multi-user diversity through coding or scheduling across sub-carriers

  • Dynamic power allocation across sub-carriers allows for interference mitigation across cells

  • Orthogonal multiple access

T large compared to channel delay spread

1

T

Frequency

Narrow Band (~10 Khz)

Wide Band (~ Mhz)

Sub-carriers remain orthogonal under multipath propagation

Courtesy: Harish Vishwanath


Lte air interface uplink
LTE air interface: Uplink

  • Users are carrier synchronized to the base

  • Differential delay between users’ signals at the base need to be small compared to symbol duration

User 1

W

  • Efficient use of spectrum by multiple users

  • Sub-carriers transmitted by different users are orthogonal at the receiver

  • - No intra-cell interference

  • CDMA uplink is non-orthogonal since synchronization requirement is ~ 1/W and so difficult to achieve

User 2

User 3

Courtesy: Harish Vishwanath


Lte air interface multiplexing
LTE air interface: Multiplexing

  • Each color represents a user

  • Each user is assigned a frequency-time tile which consists of pilot sub-carriers and data sub-carriers

  • Block hopping of each user’s tile for frequency diversity

Frequency

Typical pilot ratio: 4.8 % (1/21) for LTE for 1 Tx antenna and 9.5% for 2 Tx antennas

Time

  • Pilot sub-carriers

Courtesy: Harish Vishwanath


Lte vs umts 3g physical layer
LTE vs UMTS (3G): Physical Layer

  • UMTS has CELL_FACH

    • Uplink un-synchronized

      • Base station separates random access transmissions and scheduled transmissions using CDMA codes

  • LTE does not have CELL_FACH

    • Uplink needs synchronization

      • Random access transmissions will interfere with scheduled transmissions


Lte scheduling
LTE Scheduling

  • Assign each Resource Block to one of the terminals

    • LTE – channel-dependent scheduling in time and frequency domain

    • HSPA – scheduling in time-domain only

Time-frequency fading, user #2

Time-frequency fading, user #1

User #1 scheduled

User #2 scheduled

1 ms

Time

180 kHz

Frequency

Courtesy: Zoltán Turányi


Lte vs wcdma
LTE vs. WCDMA

1.4 MHz

3 MHz

5 MHz

10 MHz

15 MHz

20 MHz

6 RB (1.4 MHz)

100 RB (20 MHz)

  • No Soft handover in OFDM

    • All real-time functions can be done in the base station

    • No need for a central RNC

    • No need for a real-time network between the RNC and base station

  • Packet oriented

    • Supports bursty traffic and statistical multiplexing by default

    • No specific support for circuit switched traffic

  • Much more flexible spectrum use

Courtesy: Zoltán Turányi



Pre rel 8 architecture
Pre-rel.8 Architecture

PS Core Network

  • Why separate RAN and CN?

    • Two CNs with same RAN

    • Multiple RANs with same CN

    • Modularization

    • Independent scaling, deployment and vendor selection

  • Why two GSNs?

    • Roaming: traffic usually taken home

    • Independent scaling, deployment and vendor selection

    • User can connect to multiple PDNs

CSCN

Gi

  • First-hop router

  • GW towards external PDNs

  • VPN support over Gi

  • IP address management

  • Policy Control

GGSN

Gn/Gp

MSC

  • Manage CN procedures

  • HSS connection (authenticator)

  • Idle mode state

  • Lawful Intercept

  • Bearer management

SGSN

IuCS

IuPS

3G Radio Access Network

  • Real-time radio control

  • Radio Resource Management

  • Soft handover

  • UP Ciphering

  • Header Compression

RNC

Iub

GPRS – Generic Packet Radio Service

GGSN – Gateway GPRS Support Node

SGSN – Serving GPRS Support Node

RNC – Radio Network Controller

PDN – Packet Data Network

CN – Core Network

PS – Packet Switched

CS – Circuit Switched

MSC – Mobile Switching Center

HSS – Home Subscriber Server

NodeB

  • L1

  • HSPA scheduling


Drivers for change
Drivers for change

Overhead of separate CS core when bulk of traffic is PS

PS Core Network

CSCN

Gi

  • First-hop router

  • GW towards external PDNs

  • VPN support over Gi

  • IP address management

  • Policy Control

GGSN

Too many specialized user plane nodes

Gn/Gp

MSC

  • Manage CN procedures

  • HSS connection (authenticator)

  • Idle mode state

  • Lawful Intercept

  • Bearer management

SGSN

IuCS

IuPS

Complex, real-time RAN

3G Radio Access Network

  • Real-time radio control

  • Radio Resource Management

  • Soft handover

  • UP Ciphering

  • Header Compression

RNC

Iub

NodeB

  • L1

  • HSPA scheduling

Vendor lock-in due to proprietary Iub features

Courtesy: Zoltán Turányi


From 3g to epc lte architecture
From 3G to EPC/LTE architecture

Only two user plane nodes in the typical case.

Evolved Packet Core (EPC)

SGi

PDN GWSGW

Packet Data Network GW

Serving GW

user plane

S11

control plane

Mobility Management Entity

MME

User plane/control plane split for better scalability.

S1-UP

S1-CP

LTE Radio Access Network

eNodeB

eNodeB – Evolved Node B

RNC functions moved down to base station

PS Core Network

CSCN

Gi

GGSN

Gn/Gp

MSC

SGSN

IuCS

IuPS

PS only RAN and CN

3G Radio Access Network

RNC

Iub

NodeB

Courtesy: Zoltán Turányi


Why separate sgw and pdn gw
Why separate SGW and PDN GW?

Evolved Packet Core (EPC)

SGi

PDN GW

Packet Data Network GW

S5/S8

SGW

Serving GW

S11

  • SGW and PDN GW separate in some special cases:

  • Roaming:

    • PDN GW in home network,

    • SGW in visited network

  • Mobility to another region in a large network

  • Corporate connectivity

Mobility Management Entity

MME

S1-UP

S1-CP

LTE Radio Access Network

eNodeB

eNodeB – Evolved Node B

Courtesy: Zoltán Turányi


Debate of 2005 b1 vs b2
Debate of 2005: “B1 vs B2”

Internet/Op.nw.

Internet/Op.nw.

B1*: All accesses connected to EPC

B2*: Inter-AS MM on top of GPRS Core

GERAN

GERAN

GPRS Core

SGSN

SGSN

GGSN

UTRAN

UTRAN

Evolved Access

LTE

Evolved Packet Core

LTE

Evolved Packet Core

Inter-ASMM

Non-3GPP access

Non-3GPP access

  • Conclusion: B1.

    • Better integration between 3GPP accesses

    • Fewer user plane entities

*Note: Simplified view

Courtesy: Zoltán Turányi


Interworking with 3g
Interworking with 3G

SGi

HSS

PDN GW

S5

Gn

SGW

MME

SGSN

MSC

S11

IuCS

IuPS

RNC

S1-U

S1-CP

Iub

eNodeB

NodeB

UE

MSC – Mobile Switching Center

Courtesy: Zoltán Turányi


Interworking with non 3gpp accesses
Interworking with non-3GPP accesses

SGi

HSS

PDN GW

S5

Gn

S2

SGW

MME

SGSN

MSC

S11

IuCS

IuPS

Non-3GPP Access

(cdma2000, WiMax, WiFi)

RNC

S1-U

S1-CP

Iub

eNodeB

NodeB

UE

PMIP – Proxy Mobile IP

Courtesy: Zoltán Turányi


Debate of 2006 gtp vs pmip
Debate of 2006: GTP vs. PMIP

SGi

HSS

PDN GW

GTP

GTP?

GTP

S5

Gn

PMIP

PMIP?

S2

SGW

MME

SGSN

MSC

PMIP

S11

IuCS

IuPS

Non-3GPP Access

(cdma2000, WiMax, WiFi)

RNC

S1-U

S1-CP

GTP

Iub

eNodeB

NodeB

UE

  • Conclusion: Specify both

Courtesy: Zoltán Turányi


Epc lte 23 401 epc 2g 3g 23 060
EPC + LTE: 23.401 EPC + 2G/3G: 23.060

SGi

HSS

PDN GW

GTP

S5

Gn

GTP

SGW

MME

SGSN

MSC

S11

IuCS

IuPS

RNC

S1-U

S1-CP

GTP

Iub

eNodeB

NodeB

UE

Courtesy: Zoltán Turányi


Epc non 3gpp 23 402
EPC + non-3GPP: 23.402

SGi

HSS

PDN GW

S5

PMIP

S2

SGW

MME

PMIP

S11

Non-3GPP Access

(cdma2000, WiMax, WiFi)

S1-U

S1-CP

GTP

eNodeB

UE

EPC – Evolved Packet Core

Courtesy: Zoltán Turányi


Access procedure
Access Procedure

Base station

UE 2

UE 1

  • Cell Search

    • Base station broadcasts synchronization signals and cell system information (similar to WiFi)

    • UE obtains physical layer information

      • UE acquires frequency and synchronizes to a cell

      • Determine the start of the downlink frame

      • Determine the cell identity

  • Random access to establish a radio link


Random access
Random Access

Client

Base station

Core network

Step 1: random access request (pick one of 64 preambles)

Step 2: random access response

Adjust uplink timing

Step 3: transmission of mobile ID

Only if UE is not known in Base station

Step 4: contention resolution msg

If ID in msg matches UE ID, succeed.

If collision, ID will not match!


Random access cont d
Random Access (Cont ’d)

Why not carrier sensing like WiFi?

  • Base station coverage is much larger than WiFi AP

    • UEs most likely cannot hear each other

  • How come base station can hear UEs’ transmissions?

    • Base station receivers are much more sensitive and expensive

Base station

UE 2

UE 1



Connected mode
Connected mode

  • Used during communication

  • Signaling connection exists between network and UE

  • Both CN and RAN keeps state about the UE

  • UE location is tracked on a cell granularity

    • Needed to deliver the data

  • Network controlled mobility

MME

SGW


Network controlled mobility
Network controlled mobility

5

5

  • Procedure

    • UE measures nearby cells

    • UE sends measurement reports to network

    • Network decides on and controls handover

    • Handover is prepared by network

    • Handover executes

3.

4.

1.

5

1.

2.

1.

5

  • Reason: To allow the network to tune handovers

    • Select proper target cell

    • Network has additional information for handover decision

    • Collect and analyze data for cell planning and troubleshooting

    • Penalize ping-ponging UEs

    • Penalize microcells for fast UEs

    • Cell breathing

MME

SGW

Courtesy: Zoltán Turányi


Handover procedure
Handover Procedure

LTE

Fast PMIPv6


Idle mode
Idle Mode

  • Used when the UE is not communicating

  • UE location is tracked on a Tracking Area (TA) granularity

    • eNodeBs advertise their TA

    • UE periodically listens to advertisements (every few seconds)

    • UE sends Tracking Area Update to MME, when TA changes

    • TAU also sent periodically (e.g., once every 2 hours)

  • No eNodeB state is kept for UE

  • When traffic arrives to the UE,

    the UE is paged


Paging
PAGING

  • UE periodically checks if data is available for it

    • Wakes up, (re)selects cell, reads broadcast and the paging channel

    • Exact timing is pseudo-random per UE

  • If packet arrives to SGW…

    • …it buffers the packet

    • …and notifies MME.

    • MME sends a Paging Request to all eNodeBs in the TA of the UE

    • eNodeBs page the UE on its paging slot locally

    • UE responds with a Service Request…

    • …eNodeB state is built up…

    • …and UE is moved to connected state.

PDN GW

SGW

MME

UE

Courtesy: Zoltán Turányi


Idle mode issues
Idle mode issues

  • Idle mode is a great power-saving feature

    • A system-wide feature

    • Also saves a lot of RAN resources

  • Balancing of TA size is needed

    • Too large: many paging messages

    • Too small: many TAU messages from UE

    • Lot of optimizations: per-UE TA, overlapping TA, etc.

  • Connected  Idle transitions are costly

    • Usually a timeout is used to go to idle

      • Not a good fit for chatty packet traffic

      • Easy to attack: an IP address range scan wakes up everyone

    • Key application design goal: reduce chattyness

      • The Phone OS also has responsibility

    • However, can be very effective when combined with DRX


Lte rrc state machine
LTE RRC State Machine

  • UE runs radio resource control (RRC) state machine

  • Two states: IDLE, CONNECTED

  • Discontinuous reception (DRX): monitor one subframe per DRX cylce; receiver sleeps in other subframes

Courtesy:Morley Mao


Umts rrc state machine
UMTS RRC State Machine

Tail Time

Delay: 1.5s

Delay: 2s

Tail Time

Courtesy: Feng Qian

State promotions have promotion delay

State demotions incur tail times


Why power consumptions of rrc states so different
Why Power Consumptions of RRC States so different?

  • IDLE: procedures based on reception rather than transmission

    • Reception of System Information messages

    • Cell selection registration (requires RRC connection establishment)

    • Reception of paging messages with a DRX cycle (may trigger RRC connection establishment)

    • Location and routing area updates (requires RRC connection establishment)


Umts rrc state machine cont d
UMTS RRC State Machine (Cont’d)

  • CELL_FACH: need to continuously receive (search for UE identity in messages on FACH), data can be sent by RNC any time

    • Can transfer small data

    • UE and network resource required low

    • Cell re-selections when a UE moves

    • Inter-system and inter-frequency handoff possible

    • Can receive paging messages without a DRX cycle


Umts rrc state machine cont d1
UMTS RRC State Machine (Cont’d)

  • CELL_DCH: need to continuously receive, and sent whenever there is data

    • Possible to transfer large quantities of uplink and downlink data

    • UE and network resource requirement is relatively high

    • Soft handover possible for dedicated channels and Inter-system and inter-frequency handover possible

    • Paging messages without a DRX cycle are used for paging purposes



The sim card
The SIM card

  • Subscriber Identity Module

    • Usually embedded in a physical SIM card

  • Initially specified in 1990 for GSM (freeze date of TS 11.11)

  • Carries subscriber credentials

    • IMSI: International Mobile Subscriber Identity – 14-15 digits

      • MCC: Mobile Country Code – 3 digits

      • MNC: Mobile Network Code – 2 or 3 digits

      • Rest of the digits identify the subscriber

    • Keying material (essentially symmetric keys)

  • In the network HSS stores subscriber data

    • Including keying and phone number (MSISDN)

  • Enables roaming and phone replacement

    • Key features in GSM

MSISDN – Mobile Subscriber ISDN Number


Key hierarchy
KEY hierarchy

AuC

SGi

HSS

PDN GW

AKA procedure

S5

SGW

MME

S11

S1-U

S1-CP

eNodeB

Source: 33.401Security architecture

AuC – Authentication CentreAKA – Authentication and Key AgreementNH – Next Hop

UE

USIM

Courtesy: Zoltán Turányi



S1 user plane security
S1 User Plane Security

AuC

SGi

Core Network

HSS

PDN GW

Gi

  • First-hop router

  • GW towards external PDNs

  • VPN support over Gi

  • IP address management

  • Policy Control

GGSN

S5

Gn/Gp

SGW

MME

S11

  • Manage CN procedures

  • HSS connection (authenticator)

  • Idle mode state

  • Lawful Intercept

  • Bearer management

SGSN

No UP ciphering!

S1-U

S1-CP

IuPS

RAN

  • Real-time radio control

  • Radio Resource Management

  • Soft handover

  • UP Ciphering

  • Header Compression

RNC

eNodeB

Iub

UP ciphering

NodeB

  • L1

  • HSPA scheduling

UE

USIM

UE

Courtesy: Zoltán Turányi


S1 up security
S1 UP security

AuC

SGi

HSS

PDN GW

S5

SGW

MME

S11

IPsec tunnel

S1-U

S1-CP

eNodeB

UP ciphering

UE

USIM

Courtesy: Zoltán Turányi


Handover
handover

  • MME pre-calculates NH keys

    • From KASME and NCC

    • NCC: NH Chaining Counter

  • 3: Source eNodeB sends {NH, NCC} to target eNodeB

  • Target eNB uses NH for KeNB

  • UE also calculates new KeNB

  • 12: MME sends next {NH, NCC} to target eNB



Qos matters in cellular
QoS MATTERS IN CELLULAR

  • Overprovisioning is difficult

    • Resources are scarce (few 10s of MHzs)

    • Equipment and spectrum expensive

    • You need to use well what you have

  • Everything is more complicated

    • Due to the wide-area radio delays are higher

    • Primary application is delay sensitive

  • Money

    • People are (somewhat more) willing to pay

    • There is an infrastructure to charge

    • Service and price differentiation happens


Bearers
Bearers

SGi

HSS

PDN-GW

  • A bearer is a L2 packet transmission channel

    • …to a specific external Packet Data Network,

    • …using a specific IP address/prefix,

    • …carrying a specific set of IP flows (maybe all)

    • …providing a specific QoS.

  • In 2G/3G also known as “PDP Context”

  • Bearer setup is explicitly signaled

    • In LTE one bearer is always set up at attachment

S5

SGW

MME

S11

S1-CP

S1-U

eNodeB

UE

See more in: 23.107QoS concept and architecture

Courtesy: Zoltán Turányi


Bearers1

Traffic to the same external network

Bearers

Traffic with thesame IP addressor IPv6 prefix

All traffic of a UE

A set ofIP microflowswith the same QoS

A set ofIP microflows

Terminal traffic

IP microflows

APN traffic

PDNconnection

Service Data Flow

default

bearer

Service Data Flow

External networks

Service Data Flow

dedicated

bearer

PDN 1

PDN 2

Service Data Flow

APN1

APN2

SGi

SGi

PDN GW

PDN GW

Dedicated bearer: bearer with special QoSDefault bearer: rest of traffic with default QoS

SGW

MME

eNodeB

Two default bearersto different APNs

PDN – Packet Data Network

APN – Access Point Name

UE

Courtesy: Zoltán Turányi


Why then no qos apart from voice
Why then no QoS? (Apart from voice)

  • Terminal apps do not use QoS

    • Original IP socket API has minimal QoS features

      • No widespread QoS mechanism in fixed networks

      • Usually IP app developers do not care about network QoS

    • A number of QoS API failures

  • Conceptual difficulties

    • QoS must be authorized and charged

      • QoS can only be effectively decided in the face of its price

    • Complex QoS descriptors

      • Determining QoS parameters is challenging

        • E.g., 10-3 or 10-4 bit error rate?

    • Yet not flexible enough to cater for e.g., VBR video


Pre rel 8 qos descriptor
Pre-rel.8 QoS descriptor

Maximum bit rate (octets 8-9)

0 0 0 0 0 0 0 1 The maximum bit rate is binary coded in 8 bits, using a granularity of 1 kbps0 0 1 1 1 1 1 1 giving a range of values from 1 kbps to 63 kbps in 1 kbps increments.

0 1 0 0 0 0 0 0 The maximum bit rate is 64 kbps + ((the binary coded value in 8 bits –01000000) * 8 kbps)0 1 1 1 1 1 1 1 giving a range of values from 64 kbps to 568 kbps in 8 kbps increments.

1 0 0 0 0 0 0 0 The maximum bit rate is 576 kbps + ((the binary coded value in 8 bits –10000000) * 64 kbps)

1 1 1 1 1 1 1 0 giving a range of values from 576 kbps to 8640 kbps in 64 kbps increments.

1 1 1 1 1 1 1 1 0kbpsIf the sending entity wants to indicate a Maximum bit rate for uplink higher than 8640 kbps, it shall set octet 8 to ”11111110”, i.e. 8640 kbps, and shall encode the value for the Maximum bit rate in octet 17.

Source: 24.008Core network protocols; Stage 3


1 simple parameters
#1: Simple parameters

  • QCI: QoS Class Indicator

    • Scalar value encompassing all packet treatment aspects

    • 9 mandatory, operators can define new

  • MBR: Max bitrate

  • GBR: Guaranteed bitrate

    • If nonzero, admission control is performed

  • ARP: Allocation and Retention Priority

    • priority (scalar): Governs priority at establishment and handover

    • pre-emption capability (flag): can this bearer pre-empt another?

    • pre-emption vulnerability (flag): can another bearer pre-empt this one?

  • AMBR: Aggregated Maximum bitrate

    • Both a per-terminal and per-APN value

Source: 23.401, 23.203GPRS Enhancements for E-UTRAN

Policy and Charging Control Architecture


2 network initiated bearers
#2: Network initiated bearers

  • Allow a network application request QoS

    • Terminal app can remain QoS un-aware

    • Network can fully control QoS provided & payment charged

  • First specified in Release 7 for 3G

    • Not all terminals support it

  • Mandatory mode in LTE

UE

Network

1. Session setup

App

App

No QoS API

LTE

LTE + EPC

2. Request QoS

3. Bearersetup

Courtesy: Zoltán Turányi


Policy and charging
Policy and Charging

App

  • Flow descriptor (5-tuple)

  • Bandwidth

  • Application (voice/video/etc.)

  • Policy and Charging Rules Function

    • Decides on QoS and Charging

    • Controls gating

    • Service Policy Based on

      • Request

      • Subscription data

    • Makes no resource decisions

Rx

SGi

PCRF

PDN GW

Gx

S5

  • Flow descriptor (5-tuple)

  • QoS descriptor

  • Charging rules

  • Gating (on/off)

SGW

MME

S11

S1-U

S1-MME

eNodeB

UE

Courtesy: Zoltán Turányi


Debate of 2007 on path vs off path for qos policy in 23 402

GTP signalling on user plane path to set up “bearers”

Packets are marked to belong to one of the bearers

No “bearer” with PMIP

Filters on SGW to classify into bearers on S1

Motivation:

Alignment with other non-3GPP accesses

Be different from GTP, experiment

Debate of 2007: On-path vs. off-path for QoS/policy in 23.402

23.402

23.401

S9

PCRF

hPCRF

vPCRF

Gx

Gxc

Gx

S1-GTP

S1-GTP

S8-GTP

S8-PMIP

Serving GW

PDN GW

Serving GW

PDN GW

Filters

Filters

Filters

Filters

Filters

GTP signalling

GTP signalling



Lte evolution
LTE Evolution

  • LTE-A – meeting and exceeding IMT-Advanced requirements

    • Carrier aggregation

    • Enhanced multi-antenna support

    • Relaying

    • Enhancements for heterogeneous deployments

LTE-C

Rel-14

Rel-13

LTE-B

Rel-12

LTE-A

Rel-11

LTE

Rel-10

Rel-9

Rel-8


Lte evolution1
LTE Evolution

  • LTE-B

    • Work starting fall 2012

  • Topics (speculative)

    • Device-to-device communication

    • Enhancements for machine-to-machinecommunication

    • Green networking: reduce energy use

    • And more…

LTE-C

Rel-14

Rel-13

LTE-B

Rel-12

LTE-A

Rel-11

LTE

Rel-10

Rel-9

Rel-8



Lte data plane is too centralized
LTE Data Plane is too Centralized

  • UE: user equipment

  • eNodeB: base station

  • S-GW: serving gateway

  • P-GW: packet data network gateway

eNodeB 1

Cellular Core Network

Scalability challenges at P-GW on charging and policy enforcement!

eNodeB 2

S-GW 1

UE 1

P-GW

Internet and

Other IP Networks

eNodeB 3

S-GW 2

UE 2

GTP Tunnels

  • Data plane is too centralized


Lte control plane is too distributed
LTE Control Plane is too Distributed

Home Subscriber Server (HSS)

  • Problem with Inter-technology (e.g. 3G to LTE) handoff

  • Problem of inefficient radio resource allocation

Control Plane

Data Plane

Mobility Management Entity (MME)

Policy Control and Charging Rules Function (PCRF)

Packet Data

Network Gateway

(P-GW)

Serving

Station (eNodeB)

Base

Gateway (S-GW)

User Equipment (UE)

  • No clear separation of control plane and data plane


Advantages of sdn for cellular networks
Advantages of SDN for Cellular Networks

  • Advantage of logically centralized control plane

    • Flexible support of middleboxes

    • Better inter-cell interference management

    • Scalable distributed enforcement of QoS and firewall policies in data plane

    • Flexible support of virtual operators by partitioning flow space

  • Advantage of common control protocol

    • Seamless subscriber mobility across technologies

  • Advantage of SDN switch

    • Traffic counters enable easy monitoring for network control and billing


Flexible middlebox support
Flexible Middlebox Support

eNodeB 1

  • Easy to control flow to middleboxes for content adaptation, echo cancellation, etc

  • Reduce traffic to middleboxes

Middlebox

eNodeB 2

UE 1

SDN Switch

Internet and

Other IP Networks

eNodeB 3

UE 2

Path setup for UE

by SDN controller

SDN provides fine grained packet classification and flexible routing


Flexible middlebox support cont d
Flexible Middlebox Support (Cont ’d)

eNodeB 1

  • Easy to satisfy policy for traffic not leaving cellular network

  • Reduce the need for extra devices

eNodeB 2

UE 1

SDN Switch

Internet and

Other IP Networks

eNodeB 3

UE 2

Path setup for UE

by SDN controller

  • SDN switch can support some middlebox functionality


Monitoring for network c ontrol b illing
Monitoring for Network Control &Billing

Rule

Action

Stats

Packet + byte counters

  • Forward packet to port(s)

  • Encapsulate and forward to controller

  • Drop packet

  • Send to normal processing pipeline

Switch

Port

MAC

src

MAC

dst

Eth

type

VLAN

ID

IP

Src

IP

Dst

IP

Prot

TCP

sport

TCP

dport

  • Packet handling rules in SDN switches can efficiently monitor traffic at different level of granularity

    • Enable real time control and billing

+ mask


Seamless subscriber mobility
Seamless Subscriber Mobility

SDN Control Plane

  • SDN provides a common control protocol works across different cellular technologies

  • Forwarding rules can be pushed to switches in parallel

eNodeB 1

X+1-Gen Cellular Network

eNodeB 2

X-Gen Cellular Network

UE 1

Internet and

Other IP Networks

eNodeB 3

SDN Switch

UE 2

Path setup for UE

by SDN controller


Distributed qos and acl enforcement
Distributed QoS and ACL Enforcement

eNodeB 1

  • LTE’s PCEF is centralized at P-GW which is inflexible

Access policy checked

In SDN switches distributedly

eNodeB 2

UE 1

SDN Switch

Internet and

Other IP Networks

eNodeB 3

UE 2

Path setup for UE

by SDN controller


Virtual operators
Virtual Operators

eNodeB 1

Virtual Operator(VO)

(Slice 1)

Virtual Operator

(Slice N)

  • Virtual operators may want to innovate in mobility, billing, charging, radio access

Slicing Layer: CellVisor

eNodeB 2

VO1

UE 1

VO2

SDN Switch

Internet and

Other IP Networks

eNodeB 3

UE 2

Flexible network virtualization by slicing flow space


Inter cell interference management
Inter-Cell Interference Management

  • Global view and more computing power

eNodeB 1

Radio Resource Manager

  • LTE distributed interference management is suboptimal

Network Operating System: CellOS

eNodeB 2

UE 1

SDN Switch

Internet and

Other IP Networks

eNodeB 3

UE 2

Central base station control: better interference management


Cellsdn architecture
CellSDN Architecture

  • CellSDN provides scalable, fine-grain real time control with extensions:

    • Controller: fine-grain policies on subscriber attributes

    • Switch software: local control agents to improve control plane scalability

    • Switch hardware: fine-grain packet processing to support DPI

    • Base stations: remote control and virtualization to enable flexible real time radio resource management


Cellsdn architecture cont d
CellSDN Architecture (Cont ’d)

Mobility Manager

Subscriber Information Base

Policy and Charging Rule Function

Infra-structure Routing

Radio Resource Manager

Translates policies on subscriber attributes to rules on packet header

SCTP instead of TCP to

avoid head of line blocking

Network Operating System: CellOS

Offloading controller actions, e.g. change priority if counter exceed threshold

Cell Agent

Cell Agent

Cell Agent

Central control of radio resource allocation

DPI to packet classification based on application

Packet Forwarding Hardware

Packet Forwarding Hardware

Radio Hardware


Cellsdn virtualization
CellSDN Virtualization

Network OS

(Slice 1)

Network OS

(Slice 2)

Network OS

(Slice N)

Slicing Layer: CellVisor

Slice semantic space, e.g. all roaming subscribers, all iPhone users

Cell Agent

Cell Agent

Cell Agent

Packet Forwarding Hardware

Packet Forwarding Hardware

Radio Hardware


Conclusion and future work
Conclusion and Future Work

  • LTE promises hundreds of Mbps and 10s msec latency

  • There are key architecture problems need to be solved

    • Software-defined networking can help!


ad