domain.

This is realised by the introduction of a new platform, the IP Multimedia Subsystem (IMS) that is added to the existing PS architecture.

CHAPTER 2

In this chapter the basic aspects of the UMTS system are introduced with special emphasis on the Packet Switched Core Network and the IP Multimedia Sub-system. Two major architectural views are presented, the network element centric perspective and the

The UMTS System

The Universal Mobile Telecommunications System (UMTS) is a third generation (3G) mobile communications system that provides a range of broadband services to the world of wireless and mobile communications. This chapter presents an overview of the UMTS architecture specified by the Third Generation Partnership Project (3GPP), focusing on the network elements relevant to the study presented here. The evolution towards an All-IP network, within the 3GPP, is occurring in several steps, known as releases [6, 7]. Earlier UMTS specifications, with a relatively strong retention of the current 2nd generation networks, were still switch centric. However, the introduction of a new IP platform, when fully specified, will provide the UMTS system with multiple wireless access options and full IP packet support. The first version of the UMTS Specification, 3GPP Release 99, defines a system which adopts much of the functionalities of the GSM/GPRS core network and introduces a new wireless access technology, namely wideband code division multiple access (WCDMA). This access technology increases the 2G systems capacity to higher data rates enabling the support of advanced services. 3GPP Release 4, further optimizes the air interface, although the major changes are targeted at the core network circuit switched domain, still present in order to maintain full coverage for second-generation services. These changes result in the separation of user data flows and their control systems into different physical entities, the Mobile-services Switching Centre (MSC) and the Media Gateway (MGW) respectively. Finally Release 5/6 provides a migration from conventional Circuit-Switched speech services served by CS domain to enhanced IP-based services using a Packet-Switched

interface-centric one. The first approach refers to the UMTS functional architecture, which defines the system in a network centric manner by allocating with them the major systemlevel management functions. The second, on the other hand, allude to the UMTS network from an interface-centric view, focusing on the system protocols.

2.2 ARCHITECTURE OVERVIEW

The UMTS system consists of a number of logical network elements connected through open interfaces or access points. Functionally these elements are grouped into the Radio Access Network (RAN, UMTS Terrestrial RAN - UTRAN) and the Core Network (CN) [8, 9]. The UTRAN handles all radio-related functionality, Radio Resource and Mobility Management (RRM and MM). Whereas, the CN is responsible for switching and routing calls and data connections to external networks at the same time as managing session and mobility information, Communication and Mobility Management (CM and MM). The system is completed by the User Equipment (UE) or 3G terminal [8], which interfaces with the user and the radio interface. The high-level architecture is shown in Figure 2.1.
UTRAN
RNS Iub Iub
RNC Node B HSS 3G MSC/VLR 3G GMSC

2.2.1 UMTS Radio Access Network

UTRAN is subdivided into individual Radio Network Systems (RNSs), where each one is controlled by a Radio Network Controller (RNC) [10]. Within a RNS, the RNC is connected to a set of NodeB elements, each of which can serve one or several cells. UTRAN is located between two new open interfaces, Uu and Iu. The Uu Interface is a WCDMA radio interface through which the UE accesses the fixed part of the system. Iu connects the UTRAN to the CN. The main task of UTRAN is to create and maintain Radio Access Bearers (RABs) for communication between User Equipment (UE) and the Core Network (CN). With RAB the CN elements are given an illusion of a fixed communication path to the UE. While in GPRS/EDGE networks the logical link is defined between UE and SGSN, soCN
CS Domain

called Radio Access Bearers (RABs) are defined between UE and the UTRAN. Hence, the locations of several functions have been shifted from the SGSN which is part of the GPRS CN to the Radio Network Controller (RNC) in UTRAN. A 3rd Generation Serving GPRS
ISDN CSPDN PSTN

Node B

Support Node (3G-SGSN) no longer comprises logical link management functions.

Iur PS Domain Gi IMS

3G GGSN

2.2.1.1

NodeB

Node B

Iub Iub
RNC

Gn
3G SGSN

NodeB is the physical unit for radio transmission/reception in cells. Depending on sectoring (omni/sectored cells), one or more cells may be served by a NodeB. NodeB connects with the UE via the WCDMA Uu radio interface and with the RNC via the Iub

UE
Node B

Radio (Uu)

Iu
Figure 2.1 - UMTS functional Architecture

asynchronous transfer mode (ATM) based interface. The main task of Node B is to perform the air interface Layer 1 processing (transfer information from transport to physical channels) although it also participates in some basic Radio Resource Management (RRM) operation. However, RNC is where the radio resources are managed.

The collection of at least one logical network element of each type defines a UMTS Public Land Mobile Network (PLMN). The UMTS PLMN is a fully featured and operational network, either on its own or together with other sub-networks, that provides land mobile telecommunication services to the public. Each PLMN, typically established and operated by a single operator, is connected to other PLMNs as well as to other types of networks, such as Integrated Services Digital Network (ISDN), Public Switched Telephone Network (PSTN), Internet, and so on.

2.2.1.2

Radio Network Controller

2.2.2 UMTS Core Network

The UMTS Core Network (CN) can be seen as the basic platform for all communication services provided to the UMTS subscribers. The basic communication services include switching of circuit-switched calls and routing of packet data. In order to handle both types of user traffic as well as the related signalling, the CN is functionally further divided into two domains, circuit switched domain (CS domain) and packet switched domain (PS domain).

The Radio Network Controller (RNC) is the switching and controlling element of the UTRAN located between the Iub and Iu interface. It also has a third interface called Iur for inter-RNS connections. The RNC interfaces the CN for both Packet-Switched and Circuit-Switched service domains and also terminates the Radio Resource Control (RRC) protocol that defines the messages and procedures between the mobile and UTRAN. The whole functionality of a RNC can be grouped into two parts, UTRAN Radio Resource Management (RRM) and control functions. The RRM is a collection of algorithms used to guarantee the stability of the radio path and the QoS of radio connection by efficient sharing and managing of the radio resources. The UTRAN control functions include all of the functions related to setup, maintenance and release of Radio Bearers including the support functions for the RRM algorithms. Logical Role of RNC The RNC controlling one Node B (i.e. terminating the Iub interface towards the Node B) is indicated as the Controlling RNC (CRNC) of the Node B. The CRNC is responsible for the load and congestion control of its own cells, and also executes the admission control and code allocation for new radio links to be established in those cells. In case one mobile-UTRAN connection uses resources from more than one RNS, the RNCs involved have two separate logical or functional roles:

2.2.2.1

Circuit Switched CN

The CS domain refers to the set of all CN entities offering a CS type connection. In such connection dedicated network resources are allocated at connection establishment and released at connection release. The entities specific to the CS domain are the Mobile-services Switching Centre (MSC), the Media Gateway and the Gateway MSC (GMSC). Release 4 explains in detail its functionalities [9]; more detail is not provided as the CS domain is not the basis of the investigation presented in this thesis.

2.2.2.2

Packet-Switched CN

On the other hand, the PS domain offers "PS type connection", which transports the user information using autonomous concatenation of bits called packets. The information is split into separated but related packets before being transmitted and is reassembled at the receiving end. The CN PS domain in UMTS has two basic network elements evolved from 2.5G General Packet Radio System (GPRS), the Serving GPRS Support Node (SGSN) and the Gateway GPRS Support Node [11, 12]. The GGSN is the node that is accessed by the packet data network due to the evaluation of the PDP address. It contains routing information for PSattached users. The routing information is used to tunnel N-PDUs to the UEs current point of attachment, i.e. the SGSN. The GGSN may request location information from the HSS. As mentioned earlier, the PS CN has been extended with the IP multimedia CN sub-system (IM CN) functionality. This new platform enables PLMN operators to offer their subscribers multimedia services based on Internet applications and protocols.

Serving RNC. The SRNC is the RNC that terminates both the Iu link for the transport of user data and the corresponding RAN Application Part (RANAP) signalling to/from the core network. The SRNC also terminates the Radio Resource Control Signalling, that is the signalling protocol between the UE and UTRAN. The SRNC may also be the CRNC of some Node B used by the mobile for connection with UTRAN. One UE connected to UTRAN has only one SRNC.

Drift RNC. The DRNC is any RNC, other than SRNC, that controls cells used by the mobile. The DRNC is involved in the active connection through an inter-RNC soft-handover. Each UE may have zero, one or more DRNCs.

10

2.2.3 IP Multimedia Sub-system

The IP Multimedia CN sub-system (IMS) comprises all CN elements for provision of multimedia services. This includes the collection of signalling and bearer related network elements as defined in TS 23.002 [9] and TS 23.922 [13]. Such services are based on IETF defined session control capability, which along with multimedia bearers utilises the PS domain. In order to achieve access independence and to maintain a smooth interoperation with wireline terminals across the Internet, the IP multimedia subsystem interfaces uses an IETF defined protocol, the Session Initiation Protocol (SIP) [14]. The IM CN sub-system enables the convergence of, and access to, voice, video, messaging, data and web-based technologies for the wireless user. The IMS introduces three main logical network elements to the existing infrastructure: the Call Session Control Function (CSCF), the Media Gateway Control Function (MGCF) and the Media Gateway (MGW). The Home Subscriber Server (HSS) is also introduced providing user profile information similar to that of todays HLR.

2.2.3.1

Call Session Control Function

The Call Session Control Function (CSCF) is a SIP server that provides/controls multimedia services for packet-switched IP terminals, both mobile and fixed. The Session Control Function can take various roles as defined in 3GPP TS 23.228 [15]. It can act as Proxy CSCF (P-CSCF), Serving CSCF (S-CSCF), Interrogating CSCF (I-CSCF), Breakout Gateway CF (BGCF) or Multimedia Resource Function (MRF). 2.2.3.1.1 Proxy-CSCF

The Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IM CN subsystem thus always located in the network where the UE resides. Its address is discovered after or as a part of a successful PDP context activation. The P-CSCF forwards SIP messages from UE to the specific I-CSCF or to the SIP server (S-CSCF) acting as a SIP Proxy [14]. Furthermore, when the P-CSCF receives a SIP message containing Session Description Protocol (SDP) information it triggers the Authorize QoS Resource procedure [16]. Which will install the IP bearer level policy based on information from the SDP payloads (end-points, bandwidth requirements, and characteristics of the media exchange). 2.2.3.1.2 Serving-CSCF

IP Multimedia Networks PSTN

Mb Mb PSTN

The Serving-CSCF (S-CSCF) is always assigned in the home network. It acts as a registrar
Legacy mobile signalling Networks

making information available through the location server (HSS) and subsequently performs the session control services for the registered endpoint. It handles the session states in the

BGCF
PSTN Mk Mk

CSCF
Mm Mw Mi Cx

network for support of the services. As P-CSCF, the S-CSCF can also act as a SIP proxy server.
C, D, Gc, Gr

Mj

BGCF

2.2.3.1.3

Interrogating-CSCF

IMSMGW
Mb

MGCF
Mn Mg Mr

HSS

CSCF
Mw

The Interrogating-CSCF (I-CSCF) is mainly the contact point within an operators network for all IMS connections destined to a subscriber of that network operator, or a roaming subscriber currently located within that network operators service area. As the contact

MRFP
Mp Mb Mb Mb

MRFC

P-CSCF
Gm Go

UE

point, it accesses the HSS to resolve the SIP server addresses involved in the session (ICSCF, BGCF or S-CSCF). It obtains the S-CSCF linked with the user in the registration procedure and the S-CSCF of the terminating counterpart in the session establishment.

IM Subsystem

Figure 2.2 IM Subsystem entities

11

12

2.2.3.1.4

Breakout Gateway Control Function

2.2.3.4

Home Subscriber Server

The Breakout Gateway Control Function (BGCF) selects the network in which PSTN/CS Domain breakout is to occur forwarding the session signalling to another BGCF if it is a different one. Once in the network in which the inter-working with PSTN/CS domain is to occur, it selects a MGCF which will be responsible for such inter-working. Therefore this logical entity acts as a signalling entity for call/session control. 2.2.3.1.5 Multimedia Resource Function

The Home Subscriber Server (HSS) is the master database for 3G/UMTS Rel5/6 IP users. It contains the subscription-related information to support the network entities handling the IP session. This entity also integrates the Home Location Register (HLR) functionality for both packet and circuit domain, which is thereon considered as a HSS subset. As depicted in Figure 2.3 HSS provides heterogeneous information from core network diverse domains.

The Multimedia Resource Function (MRF) is split into Multimedia Resource Function Controller (MRFC) and Multimedia Resource Function Processor (MRFP). MRFP controls the bearer on the Mb reference point and provides media stream resources to be controlled by the MRFC.
Subscription information

HSS (HLR / UMS)

Location information

2.2.3.2

Media Gateway

Gr (MAP based )

Gc (MAP based )

Mh

Cx (IP based interface)

The Media GateWay (MGW) terminates bearer channels from a circuit switched network and media streams from a packet network.
SGSN GGSN R-SGW CSCF

2.2.3.3

Media Gateway Control Function

Figure 2.3 Basic HSS Structure

The Media Gateway Control Function (MGCF) entity controls the MGW and performs translation at the call control signalling level between ISUP signalling, used in PSTN, and SIP signalling, used in the UMTS multimedia domain.

13

14

2.3 UMTS PROTOCOL STRUCTURE

The UMTS protocols are used to control the execution of network functions in a coordinated manner between the different UMTS domains. The general UMTS protocol model is structured, as depicted in Figure 2.4, into horizontal layers and vertical planes, which are logically independent.
UE Node B RNC USER PLANE CONTROL PLANE SGSN GGSN

2.3.1 Transport Network Layer

The transport network layer is the lowest of the UMTS protocol architecture thus providing facilities to transport and route both control and user traffic across all UMTS network interfaces. The transport layer is subdivided into two protocols layers the physical layer (L1) and the data link layer (L2). The specified protocols can be grouped depending on the UMTS interfaces they refer to, UMTS radio interface or UMTS terrestrial interface. Figure 2.5 illustrates the UMTS transport protocols (coloured blue).
Radio Interface Uu
RRC/ PDCP

System Network Layer

USER PLANE CONTROL PLANE

Terrestrial Interfaces Iub

RRC/ RANAP/ PDCP Iu FP

Iu
RANAP/ Iu FP

Radio Network Layer

USER PLANE CONTROL PLANE

Transport Network Layer

Layer 2

RLC

RLC

MAC

MAC FP FP
Transport Transport Layers Transport Layers

Figure 2.4 - UMTS protocol internetworking architecture

The horizontal decomposition separates (generic) transport aspects from (UMTS-specific) mobile networking aspects by dividing the UMTS protocol into three layers. The lower layer, named Transport network layer, is responsible for providing the general-purpose transport service for all UMTS network elements across the interfaces. Whereas, the Radio network and the System network layer, which are by definition UMTS system-specific protocols, divide UMTS system functionality among the network elements. Within all three layers it is then possible to distinguish between control aspects and user data transfer aspects, which creates the vertical structuring to the UMTS protocol model. While the control plane protocols ensure system-wide control of communication resources and services, the user plane protocols are used to transparently transmit user data. The next section will give a detailed overview of the UMTS protocols as defined by 3GPP. The different UMTS layers are analysed separately and if the data and user protocols domains differ, detailed information is given.

Layer 1
WCDMA WCDMA

Transport

L1 UE

L1 Node B SRNC CN

Figure 2.5 - UMTS Transport network protocols

2.3.1.1

WCDMA Physical Layer

The physical layer of the UMTS radio interface is based on the WCDMA radio technology [17], whereas terrestrial interfaces are typically based on digital transmission technology, such as ATM, although they are open to operator definition. In UTRAN the data generated at higher layers is carried over the air with transport channels, which are mapped to different physical channels in the physical layer. Transport channels are always unidirectional and either common (i.e., shared among several users) or dedicated (i.e., allocated to a specific user). The following transport channels are defined in WCDMA [18]:

15

16

Broadcast Channel (BCH) Downlink common transport channel used to broadcast specific system and cell information.

2.3.1.2

Transport Network Protocols over terrestrial Interfaces

Unlike in the radio interface the L2 transport network protocol for the UMTS terrestrial interfaces use two major existing protocols suites, the ATM protocol and the TCP/UDP/IP protocol family. Those non-specific UMTS protocols are introduced in the stack in combination with some adaptation protocols, such AAL(n) for ATM and a GPRS tunneling protocol (GTP) in the IP case. The IP-based transport is widely applied only within the CN PS domain backbone network and at the Iu interface for PS domain user plane traffic whereas the ATM transport protocol is dominating on the UTRAN side.

Forward Access Channel (FACH) Downlink common transport channel used to carry control information and short user packets to a UE, the location cell of which is known to the system.

Paging Channel (PCH) Downlink common transport channel that carries control information to a UE, the location cell of which is not known by the system. When the network initiate communication with the terminal, i.e. paging procedures, uses the PCH.

Random Access Channel (RACH) Uplink common transport channel intended to be used to carry control information such as requests to set up a connection and short user packets from the terminal.

2.3.2 Radio Network Layer

The radio network protocols compose the next layer (L3) on top of the generic transport network protocols discussed above. The radio network extends from UE across the access network (UTRAN) and terminates at the edge nodes of the CN. Layer 3 protocols are defined to perform UTRANspecific signalling and control.

Dedicated Channel (DCH) Downlink or uplink dedicated channel used to carry user data or control information intended for a given user.

Within UTRAN, the SRNC is responsible for the radio interface related activities for UE on the WCDMA transport channel level and the Node Bs actually only maintain the WCDMA physical channels as depicted in Figure 2.5.

2.2.2.1

Radio Network Control Plane

The control plane protocols in the radio network layer execute all control needed for management of radio access bearers (RABs). UTRAN-specific control protocols exist in each of the four interfaces as depicted in the Figure 2.6.
Uu
RRC NBAP

2.3.1.2

Transport Network Protocols in Uu Interface

Over the Uu interface the L2 is defined with two specific UMTS link protocols, the Medium Access Control protocol (MAC) [19] and the Radio Link Control protocol (RLC) [20]. MAC is responsible for mapping logical channels, characterized by the type of data transported, onto the appropriate transport channels. On the other hand, RLC provides segmentation/reassembly of variable-length higher layer Protocol Data Units (PDUs) into smaller RLC Payload Units (PUs) and it also provides error correction through packet retransmission. These transport layers are present in both user and control plane but offering different services to the upper-layers. On the control plane the RLC services, known as Signalling Radio Bearers, are used by the RRC network layer; whereas on the
UE Node B DRNC SRNC CN

Iub
NBAP RNSAP

Iur
RNSAP RRC RANAP

Iu
RANAP

user plane are used by the service-specific protocol layers such Packet Data Convergence
Figure 2.6 - Control Plane Radio Network Protocols

Protocol (PDCP) on the PS domain.

17

18

The Radio Resource Control (RRC) protocol [21, 17] operates between the UE and the RNC. The main function of the RRC protocol is to control the radio bearers for user plane traffic (RRM) using the signalling radio bearers established in the RRC connection procedure. RRC also handles all higher-layer signalling belonging to the non-access stratum protocols (MM, CM, CM, etc.) and the mobility of user equipment in the connected mode (cell update, UTRAN registration area URA - update and active set update). The Radio Access Network Application Part (RANAP) [22] allows the CN domain to access the services provided by the UTRAN. It handles the control of the resources between the RNC and the core network. It is located on top of the Iu signalling transport layers (SS7 in the CS case or IP protocol stacks over ATM in the IP case). The remaining Application Parts protocols, NodeB AP (NBAP) [23] and RNS AP (RNSAP) [24], maintain control plane signalling across the UTRAN Iub and Iur interfaces

2.3.3 System Network Layer

Once the radio network protocols have facilitated the communication across the UTRAN sub-network by maintaining the communication path to the mobile terminals, it is the system network protocols, which create the communication service to the users of those terminals. The system protocols operate on top of the radio network transparently through the radio access (non-access stratum) and within the UMTS CN itself. The non-access stratum refers to the group of control plane protocols, which controls the communication between UEs and CN [26]. The protocols in this group belong to two sub-layers of the system network as shown in Figure 2.7.
Uu
SS SMS SM Session

Iu
SS SMS SM

providing means for the two AP peers to communicate.

2.2.2.2

Radio Network User Plane

GPRS MM

MM Context

GPRS MM

The user-plane protocols are used to transfer user data along the radio access bearers established by the control plane. The UTRAN frame protocols (FP) carry the UMTS data across the UTRAN interfaces (Iu, Iur & Iub) using the specific transport network. In addition, on the WCDMA radio interface, the Packet Data Convergence Protocol (PDCP) is required in order to get better spectral efficiency for services requiring IP packets (PS domain). The PDCP, as defined in 3GPP 25.323 [25], makes the UMTS radio interface applicable to carry Internet Protocol (IP) data packets providing compression of redundant protocol control information, transfer of user data and multiplexing radio bearers into one RLC entity.
UE

Signalling Connection

RNC

SGSN

Figure 2.7 - Control Plane System Layer Protocols

The lower Mobility Management (MM) sub-layers operates over the signalling connection provided by the radio network. On top of the MM sub-layer, the service specific Communication Management (CM) protocols operate providing Session Management (SM), Supplementary service (SS) and GPRS Short Message Service (GSMS) for the PS CN domain.

On top of the above-mentioned UMTS network layer, for the data plane, reside the application and transport layers, with IP defined protocols, necessary for the provision of the end-to-end communication. However, as they are not UMTS signalling specific, their operation analysis will be presented in the next chapter.

19

20