Tech Note UMTS PDF

UMTS Technical Note
By NetTest
ABSTRACT
UMTS (Universal Mobile Telecommunication System) or 3G represents a major leap
forward with expectations of faster communication and the capability of combining voice
and data in new ways, to facilitate multi-media and end-to-end broadband services. At
the same time, UMTS represents a major challenge to vendors and mobile operators
because of the technical complexity and the immense costs involved in the
infrastructure.
The UMTS Technical Note is the latest in the NetTest series of technical notes. Our aim
in publishing the technical notes is to provide our customers with clear and accurate
information on the most relevant technologies. At the same, this technical note is
intended to serve as quick reference guide for the many complex issues surrounding
UMTS.
Apart from serving as a quick reference guide and important tool in the day-to-day work,
the UMTS technical note also forms part of the material used in the NetTest training
programs.
Chapter 1 through 3 dives into the UMTS technology and describes in details the
structure, the network interfaces and protocols, as well as the network functionality, and
the signaling procedures.
Chapter 4 and 5 cover two key aspects in UMTS: security and Quality of Service.
Chapter 6 briefly outlines NetTests offerings within UMTS network monitoring and
optimization to aid our customers face the increasing challenges in a highly competitive
market place, allowing mobile operators troubleshoot and optimize network and service
performance.
Technical Note
TABLE OF CONTENTS
1. UMTS Network Overview................................................................................................................... 5
1.1 Introduction .......................................................................................................................................... 5
1.2 Standardization .................................................................................................................................... 7
1.3 The UMTS Releases............................................................................................................................ 7
1.4 The Services on a UMTS Network ...................................................................................................... 8
1.5 The Network Components of a UMTS Network................................................................................. 10
2. UMTS Network Interfaces and Protocols ...................................................................................... 20
2.1 Overview ............................................................................................................................................ 20
2.2 General UTRAN Interface Protocols Architecture ............................................................................. 20
2.3 The UTRAN Interfaces....................................................................................................................... 24
2.4 Core Network (CN) Protocols ............................................................................................................ 33
3. UMTS Network Functionality .......................................................................................................... 37
3.1 User Equipment (UE) and Network States ........................................................................................ 37
3.2 Elementary Procedures ..................................................................................................................... 41
3.3 Mobility Management......................................................................................................................... 48
3.4 Radio Resource Management (RRM) ............................................................................................... 53
3.5 CS Service Example: Mobile Terminating (MT) Voice Call................................................................ 59
3.6 PS Service Example: MT Data Connection (Interactive) ................................................................... 60
4. UMTS Security and Ciphering ........................................................................................................ 61
4.1 Security .............................................................................................................................................. 61
4.2 Ciphering............................................................................................................................................ 62
5. Mobile Quality of Service (QoS) ..................................................................................................... 65
5.1 Introduction ........................................................................................................................................ 65
5.2 What is Quality of Service (QoS)? ..................................................................................................... 65
5.3 Mechanisms for Delivering QoS ........................................................................................................ 66
6. UMTS Testing ................................................................................................................................... 70
6.1 Hot Spot Expert Analysis Tools .......................................................................................................... 71
6.2 End-to-End Network Monitoring......................................................................................................... 73
7. Terms and Abbreviations ................................................................................................................ 75
8. Websites ........................................................................................................................................... 81
9. References........................................................................................................................................ 82
UMTS Technical Note Page 2 of 83

TABLE OF FIGURES
Figure 1.1 The evolution of mobile telephony............................................................................................... 5
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks. ...................... 6
Figure 1.3 The 3GPP organizations. ............................................................................................................ 7
Figure 1.4 GSM/GPRS/UMTS network architecture. ................................................................................. 10
Figure 1.5 GERAN architecture...................................................................................................................11
Figure 1.6 UTRAN architecture. ................................................................................................................. 12
Figure 1.7 Serving RNC. ............................................................................................................................ 13
Figure 1.9 UMTS network architecture....................................................................................................... 14
Figure 1.10 Core network elements - CS domain. ..................................................................................... 15
Figure 1.11 The signaling gateway function. .............................................................................................. 16
Figure 1.12 Core network elements - PS domain. ..................................................................................... 16
Figure 1.13 The HSS is a superset of the HLR. ......................................................................................... 17
Figure 1.14 The IP Multimedia Subsystem................................................................................................. 18
Figure 2.1 Simplified UMTS structure showing three significant parts....................................................... 20
Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN..................................... 21
Figure 2.3 Control plane UE to PS Core Network (3G-SGSN). ................................................................. 22
Figure 2.4 Control plane UE to CS Core Network (MSC). ......................................................................... 22
Figure 2.5 Circuit and Packet Switched Mobility Management. ................................................................. 23
Figure 2.6 User plane UE to PS Core Network. ......................................................................................... 24
Figure 2.7 User plane UE to CS Core Network.......................................................................................... 24
Figure 2.8 General structure of the UTRAN interfaces. ............................................................................. 25
Figure 2.9 The Iu interface connects the UTRAN to the CN. ..................................................................... 25
Figure 2.10 The Iu-CS control plane protocol stack. .................................................................................. 26
Figure 2.11 The Iu-PS protocol stack. ........................................................................................................ 28
Figure 2.12 The Iub protocol stack. ............................................................................................................ 29
Figure 2.13 The Iur protocol stack.............................................................................................................. 30
Figure 2.14 Radio interface protocol architecture (service access points marked by circles). .................. 31
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR................................ 33
Figure 2.16 MAP services as defined in 3G TS 29.002. ............................................................................ 34
Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces. ............................................... 35
Figure 2.18 Control plane SGSN-MSC/VLR. ............................................................................................. 35
Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces. ................................................... 36
Figure 3.1 UE and CN MM states............................................................................................................... 37
Figure 3.2 UE and CN PMM states. ........................................................................................................... 38
Figure 3.3 RRC states. ............................................................................................................................... 39
Figure 3.4 UE state overview...................................................................................................................... 40
Figure 3.5 PDP states................................................................................................................................. 40
Figure 3.6 CS Paging Procedure in Iu mode.............................................................................................. 41

Figure 3.7 CS signaling connection establishment. ................................................................................... 42
Figure 3.8 Signaling connection Release................................................................................................... 43
Figure 3.9 Authentication and security procedure. ..................................................................................... 43
Figure 3.10 CS Service Request and RAB Allocation. ............................................................................... 44
Figure 3.11 PS Service Request and RAB Allocation. ............................................................................... 44
Figure 3.12 PS Service and RAB Release................................................................................................. 45
Figure 3.13 CS Service and Iu Release. .................................................................................................... 45
Figure 3.14 CS RAB Allocation................................................................................................................... 46
Figure 3.15 PS RAB Allocation................................................................................................................... 47
Figure 3.16 RAB Release procedure.......................................................................................................... 47
Figure 3.17 Combined GPRS/IMSI Attach procedure with LU................................................................... 49
Figure 3.18 UE initiated combined GPRS/IMSI Detach procedure............................................................ 50
Figure 3.19 LA containing RAs and cells within URA................................................................................. 50
Figure 3.20 UMTS LA/RAU procedure....................................................................................................... 52
Figure 3.21 URA Update. ........................................................................................................................... 53
Figure 3.22 Cell update. ............................................................................................................................. 53
Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs.54
Figure 3.24 Soft handover. ......................................................................................................................... 54
Figure 3.25 Before and after hard handover/SRNS relocation and RAU................................................... 55
Figure 3.26 Hard handover and SRNS relocation...................................................................................... 56
Figure 3.27 UMTS to GSM Handover......................................................................................................... 56
Figure 3.28 UMTS to GPRS cell relocation................................................................................................ 57
Figure 3.29 CS service: MT voice call. ....................................................................................................... 59
Figure 3.30 PS service: MT data connection (interactive).......................................................................... 60
Figure 4.1 Overview of the security architecture in Rel-4........................................................................... 61
Figure 4.2 Security between networks. ...................................................................................................... 63
Figure 5.1 QoS segments........................................................................................................................... 65
Figure 5.2 UMTS QoS architecture. ........................................................................................................... 67
Figure 5.3 QoS attributes and their usage. ................................................................................................ 67
Figure 5.4 Using traffic classes to achieve required QoS. ......................................................................... 68
Figure 5.5 UMTS QoS classes. .................................................................................................................. 69
Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics............... 70
Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools................................................ 71
Figure 6.3 The InterQuest is a powerful tool with the ability to capture large amounts of data from multiple
links in both access and core network. ................................................................................... 71
Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most
complete surveillance solution available today. MasterQuest UMTS builds on this platform. 73
Figure 6.7 MasterQuest performs network-wide correlation and monitors end-to-end service delivery
performance ............................................................................................................................ 73

1. UMTS Network Overview
1.1 Introduction
Communication has always been essential to mankind. When two people meet, they only need their voice to
communicate, but as the distance increases the need for tools arises. When Alexander Graham Bell invented the
telephone in 1876, a significant step was taken to enable two people to talk together, however far apart they may be
that is, as long as they are near a telephone set! For more than a century wire line telephony has been the solution
for voice communication over distance for most people. Radio based communication systems not depending on a
wire for network access were developed for special purposes (e.g. military, police, naval and closed car radio nets),
and eventually systems emerged allowing people to communicate via telephones with radio rather than wire line
access. They were primarily intended for people driving in cars and were known as mobile telephony systems.
During the early 1980s, the first generation (1G) of mobile telephone systems based on analog technology was
experiencing rapid growth in many European countries. Each country developed its own system, each incompatible
with the others in terms of equipment and operation. This led to a wish and a need for a common European mobile
communication system with high capacity and pan-European coverage. The latter implied that the same mobile
telephones could be used in all European countries and that incoming calls would automatically be routed to the
mobile phone independent of location (automatic roaming). In addition it was expected that one single European
market with common standards would lead to cheaper user equipment and vendor-independent network elements.
Finally, the use of modern digital technology would result in smaller hand-held devices coupled with improved
functionality and quality.
In 1982 the CEPT (Conference of European Posts and Telegraphs) formed a study group called the Groupe Spcial
Mobile (GSM) to study and develop a pan-European public land mobile system the second generation of cellular
telephony (2G). The name of the study group - GSM - was also used for the mobile system. In 1989, GSM
responsibility was transferred from CEPT to the ETSI (European Telecommunication Standards Institute).
Originally GSM was only intended for the ETSI member countries. However, many other countries have also
implemented GSM e.g. Eastern Europe, the Middle East, Asia, Africa, the Pacific Basin and North America (with
a derivative of GSM called PCS1900). The name GSM now meaning the Global System for Mobile
communication is thus very appropriate.
Figure 1.1 The evolution of mobile telephony.
GSM has been around for a decade and has turned into an overwhelming success, being very widely deployed in
most parts of the world. The system is well suited for voice communication and is also extensively used for Short
Message Service (SMS) information transfer. Circuit switched data services were also covered by the GSM
specification, as the integrated wireless access to voice and data services was one of the goals for the system.
However, the offered access speed (max. 9600 baud) has limited the use of the GSM system for data applications.
ETSI have defined several solutions to improve the data access of the mobile network often referred to as 2.5G. This
is to indicate that they represent a step forward compared to GSM, but these systems are still quite tightly connected
to GSM: HSCSD (High Speed Circuit Switched Data), GPRS (General Packet Radio System) and EDGE (Enhanced
Data rates for Global/GSM Evolution).
HSCSD is the simplest enhancement of the GSM system for data: Like GSM it is based on circuit switched
connections, but a better utilization of the available bandwidth and allocation of more than one time slot per
connection allows higher data rates theoretically up to 57.6 kbps. However, the circuit switched nature of HSCSD
makes it inefficient for data traffic, as this is packet oriented.

GPRS is designed as a packet data service with a theoretical maximum data rate of approx. 170 kbps. GPRS co-
exists with the GSM network, reusing the basic structure of the access network. GPRS is an extension of GSM
networks with data services carried on the existing radio infrastructure, while the core network is enhanced by a
packet overlay with new components and interfaces. GPRS supports combined voice and data services and enables
multimedia services.
EDGE is an enhancement of the GSM/GPRS system using a new air interface modulation technique that allows the
bit rate on the air interface to be increased considerably. EDGE will increase the theoretical maximum data rate to
384 kbps.
Figure 1.2 The relationships between GSM (2G), GPRS (2.5G) and UMTS (3G) networks.
The UMTS (Universal Mobile Telecommunication System) third generation cellular telephony (3G) is expected
to do more than merely provide better and faster mobile communication. UMTS will also enable combination of
voice and data services in a new way, for example facilitating multimedia and end-to-end broadband services. In
summary, UMTS will mean the following for operators and their customers:
UMTS for customers:

Worldwide wireless access using a single handset
A wide range of multimedia services with appropriate quality levels
The third generation mobile standard enables mobile users to harness the full power of the Internet through efficient
high-speed radio transmission, optimized for multimedia communications
UMTS will make the dream of anywhere, anytime communications a reality
UMTS for the operator:

Unification of the diverse wireless access systems we see today into a flexible radio infrastructure
Evolution from earlier "legacy" systems, ensuring global economies of scale and supply while allowing:
- Plenty of scope for product and service differentiation
- Choice of radio access methods and core networks in order to flexibly implement and evolve their systems based on
the regulatory, market or business requirements for each region or country
For operators there is a huge difference in the investment required to provide a 2.5G (GPRS) compared to a 3G
system. 2.5G requires relatively small investments for the necessary modifications of the radio access network and
add-on equipment (a packet switched core network) on top of existing GSM networks, while UMTS requires a very
large investment, as most of the network must be created from the ground up. EDGE will also require huge
investments, as a new radio access network will be needed.

For existing GSM operators, 2.5G technologies will be attractive as they can be implemented based on the operation
licenses operators already have, while UMTS requires new (and in several countries expensive) licenses. For users
GPRS will be a major step forward with new services, while UMTS is mainly an extension of these services. Thus
the success of GPRS and the services it offers will be an important indicator of which services will drive the success
of coming 3G UMTS networks.
1.2 Standardization
One of the driving forces behind UMTS is the desire to create a truly universal system. This is why the
standardization work has been moved from ETSI to a new organization: Third Generation Partnership Project
(3GPP) with the participation of a number of regional and national standardization organizations. Market
considerations are handled by an additional partnership the Market Representation Partners (MRP).
Figure 1.3 The 3GPP organizations.
The 3GPP creates a common standard based on the inputs from the participating organizations. The Operator
Harmonization Group (OHG) has been set up to find necessary compromises in the event that the 3GPP is unable to
reach agreement. In addition to these bodies, the Third Generation Partnership Project Number 2 (3GPP-2) ensures
that North American IS-95 radio technology based systems are taken into account.
Even though it is based on existing GSM/GPRS networks, UMTS adds several new components and interfaces to
the core network. The radio access network is also entirely new, based on a new technology, Wideband Code
Division Multiple Access (WCDMA) with better usage of the spectrum than todays GSM, resulting in support for
higher data rates, more capacity and subsequently, more subscribers. Eventually UMTS will cause a complete
rearrangement of the GSM/GPRS/UMTS core network, as all-IP technology will emerge.
1.3 The UMTS Releases

In the standardization of UMTS within the 3GPP, UMTS has been defined in a set of phases or releases. So far
three releases have been defined: UMTS Release 1999 (R99 sometimes also referred to as Release 3/Rel-3),
UMTS Release 4 (Rel-4) and UMTS Release 5 (Rel-5). The network architectures figure in section 1.5 indicates
how the releases affect the network. The UMTS releases are the three main deliverables of approved specifications
from 3GPP.
The major headlines for each release are:
R99
Defines the UMTS Universal Terrestrial Radio Access Network (UTRAN)
The Radio Network Subsystem (RNS) is added to the existing GSM/GPRS network
The Core Network (CN) is the existing GSM/GPRS network with some enhancements
Rel-4
Rel-4 introduces Media Gateway (MGW), the Mobile Switching Center (MSC) server and the Signaling Gateway (SGW).
This allows user data and signaling to be logically separated in the MSC
UTRAN enhancements that include support of even higher data rates, in local areas up to 2 Mbps

Rel-5
IP Multimedia (IM) Subsystem (IMS) is added
The Home Location Register (HLR) is replaced by/extended to a Home Subscriber Server (HSS)
UTRAN improvements to enable efficient IP-based multimedia services in UMTS
Introduction of IubFlex (allows Radio Network Controllers (RNCs) to connect to more than one set of Node Bs)
Enhancements of Location Services (LCS)
all-IP network will eventually become a reality
Rel-5 will be based on IPv6
The above releases are in the "Frozen" state, which means that revisions are allowed if a correction is needed (i.e.
new features are no longer added). A release 6 is planned and more releases are likely to follow: They may cover
areas like IMS enhancements, Wireless LAN Integration (WLANI), Internet convergence (regarding protocols and
services), Multimedia Broadcast/Multicast Service (MBMS) and evolution to the network within the Packet
Switched (PS) domain only.
This note will for the most part be based on Rel-4. Other releases will however be mentioned in some cases to
highlight major differences to Rel-4.
1.4 The Services on a UMTS Network

As the UMTS network evolves, more and more services will be supported. With UMTS Rel-5 the mobile network
will support services like those known from the Internet today, e.g. video streaming, Voice over IP (VoIP), video
conferencing and interactive services. The circuit switched part of the network will change and be put on top of a
packet-oriented technology (most likely IP), to support higher data rates and to increase flexibility in the network.
The packet switched part of the network will not change much, but a new packet domain will be added: the IP
Multimedia Subsystem (IMS).
1.4.1 General Services

The basic services provided by UMTS are similar to those known from GSM and ISDN (Integrated Services Digital
Network). Using the ITU-T definitions, telecommunication services can be divided into bearer services,
teleservices, and supplementary services. The most basic teleservice supported by UMTS is voice telephony. As
with all other communications, speech is digitally encoded and transmitted through the network as a digital stream.
A variety of data services are offered implemented as packet switched data communication. The Short Message
Service (SMS), introduced together with GSM will also be available. Supplementary services are provided on top of
teleservices e.g.:
Call Forwarding/Barring/Waiting/Hold
Three Party Service
Advice of Charge
Caller identification
Closed user groups
1.4.2 Quality of Service

One of the enhancements of 2.5G and 3G networks is the improved support of data communication. To facilitate
this, both GPRS and UMTS have introduced the concept of Quality of Service (QoS) as an integrated part of the
system. Having an effective QoS mechanism in place enables mobile operators to cost-effectively deliver high-
value, differentiated, IP-based applications and services. QoS is discussed in detail in chapter 5.
1.4.3 UMTS Service Capabilities

The way UMTS is defined separates as far as possible the part of the network that makes actual connections from
the part that maintains services. This facilitates more openness and potential in the market and allows a concept of
separate providers of contents, service and carriers. Some of these services are listed below.

1.4.3.1 Location Based Services
The geographic position of the User Equipment (UE) can be given by measuring radio signals. There are many
different possible applications for positioning information. The positioning functions may be used internally by the
UTRAN for radio system performance optimization, by value-added network services, by the UE itself or through
the network, and by "third party" services. Typical commercial services are:
Traffic information
Fleet management
Follow me
Nearest service
Emergency services
UMTS network planners can also use this information.
Location based services can also be implemented in GSM/GPRS networks where they are based on the signaling
between the network and the Mobile Station (MS the GSM/GPRS equivalent of the UE).
1.4.3.2 WAP Service

WAP (Wireless Application Protocol) is Internet access optimized for mobile telephony. It will allow the mobile
user to gain access to Internet information and services anywhere anytime, for example e-mail, flight schedules etc.
The WAP service capability provides the user with a web-browser that uses a Wireless Markup Language (WML)
instead of the HyperText Markup Language (HTML) normally used on the Internet. WML is designed for use with
mobile terminals. Gateways in the system will take care of the conversion between the WAP format and the normal
Internet format.
1.4.3.3 Multimedia Messaging Service (MMS)

The Multimedia Messaging Service (MMS) is used for delivering multimedia messages to a UE, from either another
UE, a fixed point on the Internet or a Value Added Service (VAS) provider. Value-added services could be news,
weather broadcasts, stock exchange information etc. Multimedia messages can contain all types of media in addition
to text, e.g. speech, video, audio and still images.
1.4.3.4 CAMEL
The Customized Applications for Mobile networks Enhanced Logic (CAMEL) is a common platform for a number
of services for customers. It provides the UMTS network with Intelligent Network (IN) features like:
Prepaid
Call screening
Supervision
CAMEL allows the necessary information to be exchanged between networks (IN features are normally network
specific). Traditional IN solutions create circuit switched services. CAMEL will do this and also interact with packet
switched connections.
1.4.4 Virtual Home Environment (VHE)

The VHE is a service concept within UMTS that enables the user to have the same personalized interface to the
network regardless of the network accessed. It requires that networks transfer information on user profiles, charging,
services and number portability, which considering the complexity of the networks is not a trivial task. Where the
VHE requires network-network communication, the CAMEL will be used.

1.5 The Network Components of a UMTS Network
Figure 1.4 GSM/GPRS/UMTS network architecture.
The figure above shows some of the subsystems in GSM/GPRS/UMTS networks, as they will evolve with the
UMTS releases. On the access network side there is the Base Station Subsystem (the GERAN) for GSM/GPRS and
the RNS (the UTRAN) for UMTS. The CN is based on the GSM/GPRS core network, but as indicated, UMTS Rel-
4 and Rel-5 will modify some subsystems and components and add others. This allows existing GSM/GPRS
network operators to benefit from the improved cost-efficiency of UMTS while protecting their 2G investments and
reducing the risks of implementation. There are also other entities in the network such as the location services
entities, which are used for location calculation.
The GSM/GPRS/UMTS network interfaces with other Public Land Mobile Networks (PLMNs) including pre Rel-4
networks, the PSTN and other IP-based multimedia networks.
1.5.1 Access Network Elements

Two types of access network are defined for GSM/GPRS/UMTS network; the BSS used for GSM, GPRS and
EDGE access (the GERAN), and the RNS (the UTRAN) used for WCDMA access.

1.5.2 The GSM/EDGE Radio Access Network (GERAN) Architecture
The GERAN is the access network defined for GSM, GPRS and EDGE. The GERAN is connected to the GSM
Phase 2+ CN either via two legacy interfaces (the A-interface and the Gb interface), or through the Iu interfaces.
The interface between the GERAN and the PS domain of the CN (the Iu-PS or the legacy Gb interface) is used for
packet switched data, and the interface between the GERAN and the Circuit Switched (CS) domain of the CN (Iu
CS or the legacy A interface) is used for circuit switched voice or data.
Figure 1.5 GERAN architecture.
1.5.2.1 Base Station Subsystem (BSS)

The BSS or the GERAN is the system of base station equipment (transceivers, controllers, etc.), which is
responsible for communicating with mobile stations in a certain area. The BSS is connected to the MSC through a
single A or Iu-CS interface. Similarly, in PLMNs supporting GPRS, the BSS is connected to the Serving GPRS
Support Node (SGSN) through a single Gb or Iu-PS interface.
The radio equipment of a BSS may support one or more cells. A BSS may consist of one or more base stations.
Where an Abis-interface is implemented, the BSS consists of one Base Station Controller (BSC) and one or more
Base Transceiver Station (BTS). The BTS and the BSC communicate across the Abis interface.
1.5.2.2 Base Transceiver Station (BTS)

The BTS contains the radio transmitters and receivers (transceivers TRX) covering a certain geographical area of
the GSM network (a base station area consisting of one or more radio cells). The BTS handles the radio link
protocols with the MS.
1.5.2.3 Base Station Controller (BSC)

The BSC controls a group of BTSs regarding radio channel setup, power control, frequency hopping, and handovers
- the transfer of a call in progress from one radio channel to another, typically as a result of an MS moving from one
base station area to another. The BSC is the connection between the mobile station and the MSC.

1.5.2.4 GSM Mobile Station (MS)
The GSM MS consists of the mobile equipment (the terminal) and the Subscriber Identity Module (SIM) card. The
SIM provides personal mobility, providing user access to subscribed services irrespective of a specific terminal. The
International Mobile Equipment Identity (IMEI) uniquely identifies the mobile equipment. The SIM card contains
the International Mobile Subscriber Identity (IMSI) used to identify the subscriber to the system, a secret key for
authentication, and other information. The IMEI and the IMSI are independent, thereby allowing personal mobility.
The MS communicates with the GSM network via the radio interface (Um Interface).
In relation to UMTS the MS must operate in one of the following two modes:
A mode based on A/Gb interfaces between BSS and CN e.g. for:
- pre-Release 4 terminals
- Rel-4 terminals when connected to a BSS with no Iu interface towards the CN
A mode based on Iu-CS and Iu-PS between BSS and CN for:
- Rel-4 terminals when connected to a BSS with Iu interfaces towards the CN
1.5.3 Universal Terrestrial Radio Access Network (UTRAN) Architecture

UMTS R99 saw the introduction of a new radio access network, the UTRAN. The UTRAN is based on WCDMA
technology, introduced in order to achieve a better bandwidth efficiency compared to the techniques used in
GSM/GPRS. The UTRAN is connected via the Iu to the GSM Phase 2+ CN; the interface between UTRAN and the
PS domain of the CN (IuPS) is used for packet switched data, and the interface between UTRAN and the CS
domain of the CN (IuCS) is used for circuit switched data. There is actually a third domain, the BroadCast (BC)
domain, which can used to broadcast a short message to a given geographical area (service area, being one or
more cells). The interface to the BC domain is called Iu-BC. It is not shown in the figure in section 1.5.2 and will
not be described further here.
1.5.3.1 Radio Network Subsystem (RNS)

The UTRAN consists of one or more RNSs connected to the CN via the Iu interfaces. Each RNS consists of a RNC
and one or more Node Bs. The Node Bs are connected to the RNCs via the Iub interface. The Node Bs provide radio
access (i.e. antennas) to the network. The RNCs of each RNS can be interconnected via the Iur interface
Figure 1.6 UTRAN architecture.

1.5.3.2 The Radio Network Controller (RNC)
Each RNC has responsibility for and control over the radio resources of a set of cells. The RNC is equivalent to a
GSM/GPRS BSC but is more self-controlled. A RNC may have different roles in the UTRAN network:
Controlling RNC
- Each RNC is responsible for the resources of its set of cells and the Node Bs in its RNS. In this role the RNC is called
the Controlling RNC (CRNC)
Serving RNC
- For each connected UE the RNCs may have an additional role: A Serving RNC (SRNC) providing radio resources to
the connected UE. The SRNC terminates the Iu towards the CN
Figure 1.7 Serving RNC.
Drift RNC
- In order to minimize the effect of handovers, RNCs may have a third role: A Drift RNC (DRNC). A DRNC provides
(lends) resources to a SRNC for a specific UE. The DRNC will normally also act as a SRNC (or DRNC) for other UEs
Figure 1.8 Drift RNC.

1.5.3.3 The Node B
The Node B handles the transmission and reception of signals in one or more cells, similar to GSM BTS. The Node
B is also responsible for the inner loop power control. Please refer to section 3.5 for more information on power
control.
1.5.3.4 User Equipment (UE)

The UE is equivalent to the GSM MS, i.e. it is the terminal through which the users access the network. The UE
consists of the mobile equipment (the terminal) and a Universal Service Identity Module (USIM). The mobile
equipment is uniquely identified by the IMEI. In order to allow future enhancements, the terminal equipment should
have an Application Programming Interface (API). The USIM provides personal mobility, providing the user with
access to subscribed services. Unlike the GSM SIM card, the USIM card may hold a number of profiles. Each
profile will have a specific purpose. It can be used to adjust the available services to the capabilities of the terminal
into which the USIM card is installed. Both the user and the network can adjust the profiles.
1.5.4 Core Network Elements
Figure 1.9 UMTS network architecture.
The CN is logically divided into a CS domain and a PS domain. In addition, a set of databases (Registers) is used
for storage of information needed by the system. The different entities in the domains are described below.

1.5.5 Core Network Elements Circuit Switched (CS) Domain
Figure 1.10 Core network elements - CS domain.
1.5.5.1 Mobile Switching Center/Gateway Mobile Switching Center (MSC/GMSC)

The central component of the CS domain in the CN is the MSC. The MSC is an exchange, which performs all the
switching and signaling functions for MSs located in a geographical area designated as the MSC area. The main
difference between an MSC and an exchange in a fixed network is that the MSC has to take into account the impact
of the allocation of radio resources and the mobile nature of the subscribers, which means it performs procedures
such as:
Procedures required for the location registration
Procedures required for handover
The MSC/GMSC constitutes the interface between the radio system and the fixed networks. The MSC performs all
necessary functions in order to handle the circuit switched services to and from the mobile stations. The MSC is
responsible for call control (setup, routing, control and termination of the calls), management of inter-MSC
handover and supplementary services, and for collecting charging/accounting information. The MSC is connected to
the location and equipment registers and to other MSCs in the same network.
The GMSC acts as the gateway to other mobile networks and the public-switched networks (telephone network,
ISDN and data networks).
In order to obtain radio coverage of a given geographical area, a number of base stations are normally required; i.e.
each MSC would thus have to interface several base stations. In addition several MSCs may be required to cover a
country.
1.5.5.2 Media Gateway/Mobile Switching Center (MGW/MSC) Server

To enable bearer-independent (and thus enabling all-IP based networks) CS network architecture in Rel-4, the MSC
is split into an MGW for transport of user data and an MSC server for signaling. The MSC server mainly comprises
the Call Control (CC) and mobility control parts of an MSC. The split into MGW and MSC server also results in a
more independent environment for service creation. The new CAMEL features benefit from this concept when the
service control gets independent from the switching fabric.

MGW is the PSTN/PLMN transport termination point and interfaces UTRAN with the CN over Iu. The MGW may
terminate bearer channels from a circuit switched network and media streams from a packet network (e.g. RTP
(Real-time Transport Protocol) streams in an IP network).
1.5.5.3 Signaling Gateway (SGW)

A SGW converts signaling (both ways) at transport level between the SS7 based transport of signaling used in pre-
Rel 4 networks, and the IP based transport of signaling possibly used in post-R99 networks (i.e. between Sigtran
SCTP/IP and SS7 MTP). The SGW does not interpret the application layer (e.g. MAP, CAP, BICC, ISUP) messages
but may have to interpret the underlying SCCP (Signaling Connection Control Part) or SCTP (Stream Control
Transmission Protocol) layer to ensure the correct routing of the signaling. The SGW will be necessary to obtain an
all-IP UMTS network.
The signaling gateway function may be implemented as a stand-alone entity or inside another entity.
Figure 1.11 The signaling gateway function.
1.5.6 Core Network (CN) Elements Packet Switched (PS) Domain
Figure 1.12 Core network elements - PS domain.

1.5.6.1 Serving GPRS Support Node (SGSN)
The SGSN acts as a packet switch and router in the PS domain of the CN. The SGSN controls the access of the MS
to the network and routes packets to the right BSC/RNC. It performs Mobility Management (MM) functions similar
to the MSC in the CS domain of the CN such as location registration, Routing Area Updates (RAUs) and paging.
The SGSN also handles security functions such as authentication and ciphering (between the MS/UE and the
SGSN).
1.5.6.2 Gateway GPRS Support Node (GGSN)

The GGSN acts as a packet router in the PS domain of the CN and is the gateway between the mobile IP packet
routing of the GPRS/UMTS network and the fixed IP routing of the Internet. It transfers packets between the IP
multimedia networks and the appropriate SGSN, which currently serves the MS/UE. If the MS changes the SGSN
during ready mode, the GGSN is used as a data packet buffer. The GGSN stores subscriber data for active MSs/UEs
and performs security functions such as firewall and screening.
1.5.7 Core Network (CN) Elements Registers

1.5.7.1 Home Location Register (HLR)
The HLR is an independent core network element up to and including Rel-4. In Rel-5 the HLR is replaced by the
HSS (Home Subscriber Server see next section), which is a superset of the HLR. The HLR contains all the
administrative information of each subscriber registered in the particular network, information on permitted
services, and the current location of the mobile. The location of the mobile is typically in the form of the signaling
address of the Visitor Location Register (VLR) associated with the MS. There is logically one HLR per network,
although it may be implemented as a distributed database.
The HLR provides functionality like:

Support to PS domain entities such as the SGSN and GGSN, through the Gr and Gc interfaces. It is needed to enable
subscriber access to the PS domain services
Support to CS domain entities such as the MSC/MSC server and GMSC/GMSC server, through the C and D interfaces. It
is needed to enable subscriber access to the CS domain services and to support roaming to legacy GSM/UMTS CS
domain networks
1.5.7.2 Home Subscriber Server (HSS)
Figure 1.13 The HSS is a superset of the HLR.
In UMTS Rel-5 the HSS replaces the HLR. The HSS is a superset of the HLR and contains all the functionality of
the HLR plus additional functionality to support the IM functionality of the IMS (please refer to section 1.5.8).
The HSS is an entity common to the PS and CS domains. The HSS is the master database for a given user and
contains the subscription related information to support the network components handling calls/sessions, for
example support to the call control servers in order to complete routing/roaming procedures by solving
authentication, authorization, naming/addressing resolution and location dependencies.
A UMTS Network may contain one or several HSSs, depending on the number of mobile subscribers, the capacity
of the equipment, and the organization of the network.

The HSS consists of the following functionalities:
IM functionality to provide support to control functions of the IMS such as the Call State Control Function (CSCF). It is
needed to enable subscriber access to the IM CN subsystem services
The subset of the HLR functionality required by the PS domain
The subset of the HLR functionality required by the CS domain, if it is desired to enable subscriber access to the CS
domain or to support roaming to legacy GSM/UMTS CS domain networks
The HSS contains the following user-related information:

User identification, numbering and addressing information
User security information
- Network access control information for authentication and authorization
User location information at inter-system level
- The HSS supports the user registration, and stores inter-system location information, etc.
User profile information (i.e. parameter settings for specific purposes)
1.5.7.3 Visitor Location Register (VLR)

The VLR contains selected administrative information from the HLR, necessary for call control and provision of the
subscribed services, for each mobile currently located in a Location Area (LA) controlled by the VLR. Each time an
MS performs roaming in a new LA, the VLR covering that LA informs the HLR about the new location of the
subscriber. The HLR subsequently informs the VLR about the services to which the subscriber has access. The VLR
also controls the assignment of TMSI.
The HLR and the VLR, together with the MSC, provide the call routing and roaming capabilities of the network. In
most implementations the VLR is integrated with the MSC, and with UMTS Rel-4 it will be a part of the MSC
server.
1.5.7.4 Authentication Center (AuC)

The AuC is a protected database that contains the individual subscriber-identification keys (also contained in SIM),
and provides the subscriber data to HLR and VLR (via HLR) used for authentication and encryption of calls.
1.5.7.5 Equipment Identity Register (EIR)

The EIR is a database that contains a list of all valid mobile equipment on the network, and in which each MS is
identified by its IMEI. An IMEI is marked as invalid if the mobile has been reported stolen or is not type approved.
1.5.8 IP Multimedia Subsystem (IMS)
Figure 1.14 The IP Multimedia Subsystem.

The IMS is the major difference between UMTS Rel-4 and Rel-5. The IMS comprises all CN elements for provision
of multimedia services. IM services are based on a session control capability defined by the Internet Engineering
Task Force (IETF). IM services, along with multimedia bearers, utilize the PS domain - possibly including an
equivalent set of services to the relevant subset of CS Services.
The IMS enables PLMN operators to offer multimedia services to their subscribers based on and built upon Internet
applications, services and protocols. 3GPP has no intention of standardizing such services within the IMS. The
intention is that these services will be developed by PLMN operators and third party suppliers, including those in
the Internet space, using the mechanisms provided by the Internet and the IMS. The IMS should enable the
convergence of, and access to, voice, video, messaging, data and web-based technologies for the wireless user, and
combine the growth of the Internet with the growth in mobile communications.
The specific functional elements of the IMS are described below.

The CSCF which can have three roles:
- Proxy-CSCF (P-CSCF) is the first contact point for the UE within the IMS. The Policy Control Function (PCF) is a
logical entity of the P-CSCF
- Interrogating-CSCF (I-CSCF) is the contact point within an operators network for all IMS connections destined to a
user of that particular network operator
- Serving-CSCF (S-CSCF) performs the session control services for the UE
The Media Gateway Control Function (MGCF) performs protocol conversion between ISUP (ISDN User Part) and the IMS
call control protocols (e.g. ISUP/SIP (Session Initiation Protocol) conversion)
The Multi Resource Function (MRF) performs multiparty call and multimedia conferencing functions
The IP Multimedia Media Gateway (IM-MGW) terminates bearer channels from a switched circuit network and media
streams from a packet network. The IM-MGW may support media conversion, bearer control and payload processing
(e.g. codec, echo canceller, conference bridge)

2. UMTS Network Interfaces and Protocols
2.1 Overview
The figure below gives a simplified view of the UMTS architecture. It splits UMTS in 3 significant parts: The UE,
the access network (UTRAN) and the CN.
Figure 2.1 Simplified UMTS structure showing three significant parts.
The information that flows through the UTRAN is logically split into two parts:
The access stratum - being information required for the interaction between the UE and the UTRAN
The Non Access Stratum (NAS) - being information transferred between the CN and the UE across the UTRAN
The reason for this split is a desire to make the information transfer between CN and UE independent of the radio
handling in the UTRAN.
2.2 General UTRAN Interface Protocols Architecture

The UTRAN interface protocols consists of 3 parallel protocol stacks:
The control plane which amongst other things conducts the signaling that enables the transport of user data
The user plane is where the user data are actually transported
The Transport Network Control Plane (TNCP)
- The transport channels in the user plane are dynamic. The TNCP makes it possible to establish and remove transport
channels on a given UTRAN interface

Figure 2.2 Three protocol stacks connecting the UE with the CN via the UTRAN.
2.2.1 Control Plane

The control plane is used for signaling between the UE and the network. The control plane includes an (upper layer)
application protocol (RANAP/RNSAP/NBAP) and a (lower layer) signaling bearer for transporting the application
protocol messages.
The application protocol is used for things like setting up bearers (i.e. Radio Access Bearer (RAB) or radio link) in
the radio network layer, controlling different transmission resources and handover). In the three-plane structure the
bearer parameters in the application protocol are not directly tied to the user plane technology; they are general
bearer parameters. The control plane protocols include a mechanism for transparent transfer of NAS messages.
The lower layer the signaling bearers - for application protocol, is a part of the transport network user plane. The
control actions required for setting up the signaling bearers are Operations & Maintenance (O&M) actions.
2.2.2 User Plane

The user plane includes the data streams and the data bearers for the data streams. The data streams are
characterized by one or more frame protocols specified for that interface. The user plane protocols implement the
radio access bearer service, i.e. carries the user data through the access stratum.
The lower layer the data bearers - in the user plane is a part of the transport network user plane. The transport
network control plane directly controls the data bearers in transport network user plane during real-time operation.
2.2.3 Transport Network Control Plane (TNCP)

Many of the bearers in the UTRAN network are dynamically created as required (in the form of an ATM virtual
circuit), and closed afterwards. The TNCP handles this.
The TNCP does not have a radio network layer. It includes the ALCAP protocols needed to set up the transport
bearers (data bearer) for the user plane and the signaling bearer for the ALCAP protocols. The TNCP allows the
application protocol in the radio network control plane to be independent of the data bearer technology in the user
plane.
When the TNCP is used, a control plane application protocol signaling transaction triggers the ALCAP protocol to
set up of the data bearer. The ALCAP protocol is specific for the user plane technology used. ALCAP is however
not used for all types of data bearers. If there is no ALCAP signaling transaction, the TNCP is not needed at all. This
is the case when pre-configured data bearers are used.

The signaling bearer for ALCAP is always set up by O&M actions and it may or may not be of the same type as the
signaling bearer for the application protocol.
2.2.4 End-to-End View of UTRAN Protocols
Figure 2.3 Control plane UE to PS Core Network (3G-SGSN).
Figure 2.4 Control plane UE to CS Core Network (MSC).

At the top of the control plane, NAS control messages are carried. These messages are used for GPRS Mobility
Management/Session Management and Mobility Management/Call Control (GMM/SM, respective MM/CC):
GMM/SM and MM/CC are described in 3GPP TS 24.008. Figure 2.5 summarizes the MM/GMM/SM/CC
functionality:
Circuit Switched Packet Switched

Mobility Management (MM) GPRS Mobility Management (GMM)
Registration Attach and Detach

IMSI detach indication P-TMSI reallocation
Location updating Authentication and ciphering
Security Identity request/ response
Authentication Routing area update
Identity GMM Status/ Information
TMSI reallocation Service Request/Accept/Reject
Connection management
CM service
Abort
Miscellaneous
MM information/status
Circuit-mode connections Call Control (CC) GPRS Session Management (SM)
Call establishment Activate Packet Data Protocol (PDP) context

Alerting Activate Secondary PDP Context
Call proceeding/confirmed Request PDP context activation
Connect/ connect acknowledge Modify PDP context request
Progress Deactivate PDP context
Setup SM Status
Call information phase
Modify
User information
Call clearing
Disconnect
Release/ release complete
Supplementary service control
Facility
Hold
Retrieve
Miscellaneous
Congestion control
Notify
DTMF handling
Status
Figure 2.5 Circuit and Packet Switched Mobility Management.
SMS supports the mobile-originated and mobile-terminated Short Message Service (SMS) as described in 3GPP TS
23.040. Information on the access stratum protocol layers is given in the description of protocols for the specific
interfaces.

Figure 2.6 User plane UE to PS Core Network.
Figure 2.7 User plane UE to CS Core Network.
2.3 The UTRAN Interfaces

For the UTRAN, four interfaces are defined: two internal (Iur and Iub) and two external (Iu and Uu). Each interface
carries both user data and signaling. This document focuses on the control plane protocols (signaling).

2.3.1 General UTRAN Interface Protocols Architecture
The protocols on each of the UTRAN interfaces have a general structure as shown below.
Figure 2.8 General structure of the UTRAN interfaces.
Each protocol stack is divided into an upper layer (the radio network layer) and a lower layer (the transport network
layer). The upper layers are used for applications and information that go beyond a particular interface, while the
lower layer ensures and conducts the transport of information on a particular interface.
2.3.2 Iu Interface
The Iu interface connects the UTRAN to the CN. The Iu interface is split up in three functional types of interfaces.
The Iu interface towards the CS domain is called Iu-CS. The Iu interface towards the PS domain is called Iu-PS.
The last core network domain is the BC domain and the interface towards that is the Iu-BC. The Iu-BC is not
covered by this document. The UTRAN is responsible for all radio-related aspects including mobility of a UE in
connected mode on cell level.
Figure 2.9 The Iu interface connects the UTRAN to the CN.

The CN is responsible for the end user service related aspects, including keeping track of the UE in idle mode on
location/routing area level.
The Iu interface supports a common set of RAB services that are offered by UTRAN to the CN nodes, regardless of
their type.
2.3.3 Iu-CS Protocol Stack
Figure 2.10 The Iu-CS control plane protocol stack.
The Iu-CS control plane protocol stack consists of a signaling bearer layer, the transport network layer, and an
application protocol on the radio network layer.
The broadband Signaling System No. 7 is used as signaling bearer for the Radio Access Network Application
Protocol (RANAP). This means that SCCP is used by RANAP. Both connectionless and connection oriented
procedures are used. Message Transfer Part 3b (MTP3b) is used by SCCP. SSCF-NNI and SSCOP and AAL5 are
interface protocols between ATM and SS7 protocols.
2.3.3.1 The Radio Access Network Application Protocol (RANAP) Layer

The RANAP encapsulates and carries higher-layer signaling, handles signaling between the 3G-SGSN and UTRAN,
and manages the GTP connections on the Iu interface.

RANAP provides UTRAN specific control/signaling including:
The overall management of the RAB such as setup, release and maintenance
Transport of NAS information between UE and CN, like MM and broadcast information
Paging requests to the UE
UE location information
Error handling
Overload handling
Iu connection management
The RANAP is specified in 3G TS 25.413.
2.3.3.2 The Signaling Bearer Layer

The signaling bearer layer consists of several protocol layers:
The SCCP provides connectionless and connection oriented services for the higher layer. Connections are made on a
mobile-by-mobile basis. SCCP is defined in ITU-T Recommendation Q.716
MTP3b provides functions like message routing, signaling link management, load sharing, changeover and changeback
between links. MTP3b is defined in ITU-T Recommendation Q.2210
Service Specific Co-ordination Function (SSCF-NNI). SSCF maps the requirements of the layer above to the
requirements of SSCOP. SSCF-NNI is defined in ITU-T Recommendation Q.2140
Service Specific Connection Oriented Protocol (SSCOP) provides mechanisms for the establishment and release of
connections and the reliable exchange of information between signaling entities. SSCOP is defined in ITU-T
Recommendation Q.2110
ATM Adaptation Layer (AAL5) adapts the upper layer protocol to the requirements of the lower ATM cells. AAL5 is
defined in ITU-T Recommendation I.363.5
Together the SSCF, the SSCOP and the AAL5 are also known as the Signaling ATM Adaptation Layer Network
Node Interface (SAAL-NNI).
The signaling bearer layers below RANAP are defined in 3G TS 25.412.
2.3.4 Iu-PS Protocol Stack

The Iu-PS protocol stack is slightly different from the Iu-CS protocol stack. The operator has two stacks to choose
from for signaling: The operator can use the same stack as for Iu-CS, or the alternative IP over ATM based stack,
using M3UA (a special MTP3 adaptation protocol for use over IP), the SCTP and IP.

Figure 2.11 The Iu-PS protocol stack.
The figures in section 2.2.4 show the relation between the Iu-PS protocol stacks and the protocol stacks on other
UMTS interfaces.
2.3.4.1 The GPRS Tunneling Protocol for the User Plane (GTP-U)
This protocol tunnels user data between UTRAN and the 3G-SGSN, and between the GPRS Support Nodes (GSNs)
in the backbone network. GTP must encapsulate all PDP Protocol Data Units (PDUs). GTP is specified in 3G TS
29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer mentioned in section
2.4.2. However, different messages defined in the recommendation are used for the control plane (GTP-C) and the
user plane (GTP-U) applications.
2.3.4.2 The User Datagram Protocol/Internet Protocol (UDP/IP)

UDP/IP are the backbone network protocols used for routing user data and control signaling.
2.3.5 Iub Interface

The Iub interface is used by the CRNCs (or DRNCs) to request the setting up, adding or deleting of radio links in
the Node Bs. It is also used by the DRNC to perform radio resource admission control and hardware resource
control.

2.3.6 Iub Protocol Stack
Figure 2.12 The Iub protocol stack.
The signaling bearer used by Node B Application Part (NBAP) comprises of SSCF-UNI on top of SCCOP and
AAL5. Together the three signaling bearer layers are called the Signaling ATM Adaptation Layer (SAAL). The
figures in section 2.2.4 show the relation between the Iub protocol stacks and the protocol stacks on other UMTS
interfaces.
2.3.6.1 The Node B Application Part (NBAP) Protocol Layer

The NBAP protocol, specified in 3G TS 25.433, is used on the Iub interface. Here it provides UTRAN specific
control/signaling e.g.:
Handling and control of the measurements, performed by the UE
Management of radio links and of common channel and resources
Synchronization
Error handling
2.3.6.2 User Plane Radio Network Layer Protocols

The user plane radio network layer on the Iub interface consists of a number of protocols. The structure reflects the
way the information is organized on the air interface, i.e. the data streams that are carried across the Uu interface.
These protocols are listed on the following page.

Detailed information on these channels is, however, outside the scope of this document:
Common Packet CHannel Framing Protocol (CPCH FP)
Uplink Shared CHannel Framing Protocol (USCH FP)
Downlink Shared CHannel Framing Protocol (DSCH FP)
Paging CHannel Framing Protocol (PCH FP)
Forward Access CHannel Framing Protocol (FACH FP)
Random Access CHannel Framing Protocol (RACH FP)
Dedicated Transport CHannel Framing Protocol (DCH FP)
2.3.7 Iur Interface

The Iur interface is used by the SRNCs to request the setting up, adding or deleting of radio links in the DRNCs. It
also supports handover and synchronization. In order to minimize the equivalent of the inter-BSC handovers known
from GSM/GPRS, the Iur is used to enable inter-RNC soft handover. This is again to hide radio network functions
from the CN and in particular to avoid ping-pong effects, for example, UEs frequently changing back and forth
between two cells, on the CN.
2.3.8 Iur Protocol Stack
Figure 2.13 The Iur protocol stack.
The transport network layer part of the control plane protocols for the Iur are the same as those for Iu-PS. Again the
operator has a choice between two stacks. The radio network layer in the Iur protocol stack consists of the Radio
Network Subsystem Application Part (RNSAP) protocol.

2.3.8.1 The Radio Network Subsystem Application Part (RNSAP) Protocol Layer
The RNSAP protocol is used on the Iur interface, where it provides UTRAN specific control/signaling e.g.:
Relocation of SRNC
Transport of NAS information between the UE and the CN, like MM and broadcast information
Paging requests to the UE
Management of transport channel resources (radio and physical links)
Soft handovers
The RNSAP is specified in 3G TS 25.423.
2.3.9 Uu Interface
Figure 2.14 Radio interface protocol architecture (service access points marked by circles).
The Uu interface is the air interface between the UE and the UMTS network. The figures in section 2.2.4 show the
relation between the Iub protocol stacks and the protocol stacks on other UMTS interfaces.

2.3.9.1 The Radio Resource Control (RRC) Protocol Layer
The RRC protocol, specified in 3G TS 25.331, is used between the UTRAN (the RNC) and the UE. It provides
functionality including:
Broadcast of information
Management of:
- RRC connection between the UE and UTRAN (establishment, release, maintenance)
- Radio Bearers (establishment, release, reconfiguration)
- RRC connection radio resources (assignment, release, reconfiguration)
Mobility functions for the RRC connection
Control of requested QoS
Handling of UE measurement reports
Outer loop power control (please refer to section 3.4.3.2)
Control of ciphering
Paging
RRC message integrity protection
Timing advance (Timing Division Duplex (TDD) mode)
2.3.9.2 The Packet Data Convergence Protocol (PDCP) Layer

The PDCP specified in 3G TS 25.323 is used in the user plane between the UTRAN (the RNC) and the UE. It
provides functionality including:
Compression and decompression of header in IP data streams (e.g. TCP/IP and RTP/UDP/IP headers for IPv4 and IPv6)
Transfer of user data between PDCP service users
2.3.9.3 The Radio Link Control (RLC) Protocol Layer

The RLC protocol is used for RLC connections between the UTRAN (the RNC) and the UE. There is one RLC
connection for each Radio Bearer (RB). The RLC protocol provides functionality including:
Segmentation and reassembly of long upper layer PDUs
Concatenation of short upper layer PDUs
Transfer of user data including error correction and flow control
In-sequence delivery of upper layer PDUs
Sequence number checking
Detection and recovery of protocol errors
Ciphering
The RLC protocol is specified in 3G TS 25.322.
2.3.9.4 The Medium Access Control (MAC) Protocol Layer

The MAC protocol is just above the physical layer. It is used between the UTRAN (the RNC) and the UE. It
provides functionality including:
Mapping between logical channels and transport channels
Selection of appropriate transport format for each transport channel depending on instantaneous source rate
Handling of priority between data flows of one UE and between UEs
Multiplexing/demultiplexing of upper layer PDUs to and from the actual physical layer transport channels
The MAC protocol is specified in 3G TS 25.321.

2.4 Core Network (CN) Protocols
This section discusses protocol stacks for all relevant interfaces in the CN, both the CS domain and the PS domain.
Again the focus will be on the control plan protocols (signaling).
2.4.1 The Mobile Application Part (MAP) Protocol
Figure 2.15 The MAP protocol stack - on the Gr interface between SGSN and HLR.
The MAP protocol (or a fraction of it) is used on a number of interfaces in the CN. TCAP, SCCP, MTP3, and MTP2
are transport protocol layers defined in Signaling System No. 7. The same protocols are used to support MAP in CS
PLMNs.
Figure 2.16 on the following page shows the services and functionality supported by the MAP protocol.

Services and Functionality Supported by the MAP Protocol
Mobility Supplementary Services Related
Location management services Register/erase/activate/deactivate/interrogate/invoke
Paging and search supplementary services
Access management services Password services
Handover services Unstructured supplementary services support
Authentication management services Register/erase CC entry service
Security management services

Short Message Service Management
International mobile equipment identities Send-routing-info-for-SMS service
management services
Forward SMS
Subscriber management services
Report SM delivery status service
Identity management
Ready for SM service
Fault recovery services
Alert service center service
Subscriber information services
Inform service center service
Call Handling Send info for SMS service
Send routing information service
Network-Requested PDP Context Activation
Provide roaming number service
Send routing info for GPRS service
Resume call handling service
Failure report service
Group call service
Note MS present for GPRS service
Provide SIWFS number
SIWFS signaling modify Location Service Management (LCS)
Set reporting state service Send routing info for LCS service
Status report service Provide subscriber location service
Remote user free service Subscriber location report service
Immediate Service Termination (IST) services
Operation and Maintenance
Subscriber tracing services
Other operation and maintenance services
Figure 2.16 MAP services as defined in 3G TS 29.002.
2.4.1.1 Interfaces using the MAP Protocol

SGSN HLR (the Gr interface):
The MAP protocol supports signaling exchange with the HLR, as defined in 3G TS 29.002, with enhancements for GPRS,
see 3G TS 23.060
SGSN EIR (the Gf interface):

The MAP protocol supports signaling between the SGSN and the EIR, as described in sub clause "Identity Check
Procedures" 3G TS 23.060
SGSN - SMS-GMSC or SMS-IWMSC (the Gd interface):

The MAP protocol supports signaling between the SGSN and SMS-GMSC or SMS-IWMSC, as described in sub clause
"Point-to-point Short Message Service" 3G TS 23.060
GGSN HLR (the Gc interface):

This optional signaling path allows a GGSN to exchange signaling information with an HLR. There are two
alternative ways of implementing this signaling path:
If an SS7 interface is installed in the GGSN, the MAP protocol can be used between the GGSN and an HLR
If an SS7 interface is not installed in the GGSN, any GSN with an SS7 interface installed in the same PLMN as the GGSN,
can be used as a GTP-to-MAP protocol converter to allow signaling between the GGSN and an HLR

2.4.2 GSN GSN Control Plane
Figure 2.17 Control plane for SGSN-GGSN and SGSN-SGSN interfaces.
GTP-C
- This protocol tunnels signaling messages between SGSNs and GGSNs (Gn), and between SGSNs in the backbone
network (Gp). GTP-C is used for location management and MM and is specified in 3G TS 29.060
UDP
- This protocol transfers signaling messages between GSNs
2.4.3 SGSN - MSC/VLR
Figure 2.18 Control plane SGSN-MSC/VLR.

Base Station System Application Part+ (BSSAP+)
- A subset of BSSAP procedures supports signaling between the SGSN and MSC/VLR, as described in 3G TS 29.018.
The requirements for the lower layers are specified in 3G TS 29.016
2.4.4 GSN GSN User Plane
Figure 2.19 User plane for SGSN-GGSN and SGSN-SGSN interfaces.
GTP-U
- This protocol tunnels user data between SGSNs and GGSNs (Gn), and between SGSNs in the backbone network (Gp).
GTP is specified in 3G TS 29.060. The GTP-U is defined by the same recommendation as the GTP-C protocol layer
mentioned in section 2.4.2. However, different messages defined in the recommendation are used for the control
plane (GTP-C) and the user plane (GTP-U) applications
UDP
- This protocol transfers user data between GSNs

3. UMTS Network Functionality
This chapter provides an overview of the basic control signaling and node interworking.
The UE, the UTRAN and the CN operate in a number of states. Each state is characterized by the activity level and
thereby the resource requirements. In UMTS the changing resource requirements are supported by dynamic
allocation of resources. This gives better utilization of resources, reduced interference and extended battery life for
mobiles. The states also define the CN behavior towards the UE, for example terminate or reject an incoming call if
the UE is turned off, idle or already active.
A set of elementary procedures controls the state changes and allocation of resources as required. Mobility
Management (MM) and Radio Resource Management (RRM) such as handovers enable the UE to move seamlessly
around in the network.
One of the characteristics of UMTS is that elementary procedures can be combined in different ways to implement a
complete service. The specifications also enable the same thing to be done in several ways.
In addition to describing the elementary procedures, MM and RRM, examples are used to explain the general
signaling procedures for a number of services. The detail level is selected to provide a functional overview.
3.1 User Equipment (UE) and Network States

When the UMTS UE is turned on, it will enter IDLE mode. It will start the cell search mechanism scanning the
UMTS band for a cell with broadcast information matching the list of allowed PLMNs. When a suitable cell is
found, the UE will camp on this cell and request initial access to the UTRAN to attach to the network and enter the
CONNECTED state. Once attached the UE will be known/registered to the network and can access the services
offered. This mode of operation is also known as Camping on UTRAN Cell.
Multimode UEs are able to operate on existing GSM/GPRS networks in addition to the UMTS network. When no
UMTS network is available, the UE may operate on a GSM/GPRS cell. This mode of operation is also known as
Camping on GSM/GPRS Cell.
The UE may also feature intersystem handovers and Location Updates (LUs).
The following state descriptions apply when the UE is camping on UTRAN cell.
3.1.1 Circuit Switched (CS) Mobility Management (MM) States

In CS mode the UE and CN operate in three states as shown below, similar to GSM behavior.
Figure 3.1 UE and CN MM states.

When the UE is turned on and performs an IMSI Attach it goes from MM-DETACHED to MM-CONNECTED and
then to MM-IDLE, when the IMSI Attach is successfully completed. In MM-IDLE state the UE is registered in the
CN by Location Area (LA) but not registered in the UTRAN.
When a call is started or when performing location updating the UE goes back to MM-CONNECTED until
completion of the call/transaction.
When the IMSI Detach is performed the state is changed to MM-DETACHED. In MM-CONNECTED state the UE
will be registered in the UTRAN by cell ID and in the CN by the Iu connection ID.
3.1.2 Packet Switched Mobility Management (PMM) States

In PS mode the UE and CN operate in three states as shown below.
Figure 3.2 UE and CN PMM states.
When the UE performs a GPRS Attach, it goes from PMM-DETACHED to PMM-CONNECTED, and then to
PMM-IDLE when the GPRS Attach is successfully completed and the signaling connection is released.
In PMM-IDLE state the UE is registered in CN by Routing Area (RA) but not registered in the UTRAN.
When a new service is requested or when performing Routing Area Updates (RAUs) it goes back to PMM-
CONNECTED until completion of the service/transaction. In PMM-CONNECTED state the UE will be registered
in the UTRAN by cell ID and in the CN by the Iu connection ID.
When the PS Detach is performed the state is changed to PMM-DETACHED.

3.1.3 Radio Resource Control (RRC) Service States
Figure 3.3 RRC states.
Depending on the type of connection and the traveling speed, the UE may be in one of several different states. This
is handled by the RRC states, controlled by the RNC. In Idle mode the UE has no active connections. In Connected
mode the UE may be in one of four RRC states:
The Cell_ FACH (Forward Access CHannel) state is used for communication over common channels with limited
bandwidth, e.g. IMSI Attach and LU
The Cell_DCH (Dedicated CHannel) state is used for communication over allocated dedicated channels like voice
call and data transmission. In this state the UTRAN will perform handovers for CS QoS and Cell Update for PS
QoS
The Cell_PCH (Paging CHannel) and URA_PCH states are used when there is no data to send. The UE will only
listen to the Paging Channel thus minimizing battery load. In the Cell PCH state the UE will perform Cell
Updates whereas in the URA_PCH state the UE performs the less frequent UTRAN Registration Area (URA)
Updates. (Refer to section 3.3.3 for descriptions of locations.) The advantage of the latter is increased power
savings and the sacrifice is that paging is required. E.g. URA_PCH is preferred to Cell_PCH when the UE is
moving at high speed to minimize frequency of location updating procedures
3.1.4 UE State Overview

Figure 3.4 summarizes the UE and RRC states. The location of the UE will be known by the network in varying
resolution. Depending on the actual state the UE will be registered in different databases and with different
accuracy. Based on the state and the type of active connection either the UE or the UTRAN will select which cell to
camp on. Refer to section 3.3.3 for descriptions of locations.

UE State RRC State UE Known in UE Registered in UE Registration Cell Selected by
Accuracy
PMM-DETACHED - HLR IMSI, last LA/RA -
PMM-IDLE LA/RA CN LA/RA, UE, LA/RA Update
PMM-CONNECTED Cell_FACH Cell CN, Iu connection UE, Cell Update
UTRAN URA
Cell_DCH Cell CN, Iu connection UE, Cell Update (PS) or
UTRAN Cell UTRAN Handover (CS)
Cell_PCH Cell CN, Iu connection UE, Cell Update
UTRAN URA
URA_PCH URA UTRAN URA UE, URA Update
Figure 3.4 UE state overview.
3.1.5 Packet Data Protocol (PDP) States

A PS subscription contains the subscription of one or more PDP addresses. Each PDP address is described by one or
more PDP contexts in the UE, the SGSN, and the GGSN. Every PDP context exists independently in one of two
PDP states. The PDP state indicates whether data transfer is enabled for that PDP address or not. All PDP contexts
of a subscriber follow the same PMM state for the IMSI of that subscriber.
Figure 3.5 PDP states.
3.1.5.1 INACTIVE State

In the INACTIVE state the data service for a certain PDP address of the subscriber is not active. The PDP context
contains no routing or mapping information to process PDP data transfer related to that PDP address. No data can be
transferred. A change in location of a UE causes no update for the PDP context in INACTIVE state even if the
subscriber is PS Attached.
The UE initiates the movement from INACTIVE to ACTIVE state by initiating the service request procedure with
PDP Context Activation.

3.1.5.2 ACTIVE State
In ACTIVE state, the PDP context for the PDP address in use is activated in the UE, SGSN and GGSN. The PDP
context contains mapping and routing information for transferring PDP PDUs for that particular PDP address
between the UE and the GGSN.
An active PDP context for a UE is moved to INACTIVE state by initiating the service release procedure with PDP
Context Deactivation. All active PDP contexts for a UE are moved to INACTIVE state when the PMM state
changes to IDLE or PMM-DETACHED.
3.2 Elementary Procedures

Signaling and transport resources are established and released dynamically on request based on the required QoS for
optimal utilization of resources. In UMTS different services with different QoS will share the radio resources. Thus,
all procedures are usually wrapped in signaling connection and RAB establishment, modifications and release.
3.2.1 Paging
The paging procedure is used by the CN to indicate to the UE that it needs to terminate a transaction, e.g. an
incoming call or data.
UMTS uses two different types of paging procedures depending on whether a connection to the same CN domain
exists or not. Paging Type I is the normal way to use paging. It is used to a UE in IDLE mode to establish a
signaling connection for termination of the new transaction. It is sent to those LAs/RAs where the UE has last
reported its location. Paging Type II is used when the UE already has a connection to one CN domain and another
connection has to be established to the same CN domain. As it is sent to mobiles with an active connection only, it is
sent directly to one UE.
When a UE is both IMSI- and GPRS-attached in a network that operates in mode I, the MSC/VLR executes paging
for circuit switched services via the SGSN.
Figure 3.6 CS Paging Procedure in Iu mode.
3.2.2 Signaling Connection Establishment

To establish a signaling connection from the UE to the CN, an RRC connection needs to be established from the UE
to the UTRAN (RNC), and an Iu connection from the UTRAN to the CN. Separate signaling connections are
established from the UE to each of the CN domains as required.
The RRC connection establishment procedure is initiated by the UE creating an AAL2 link connection between the
RNC and the Node B, and then a WCDMA Physical Dedicated Channel between the Node B and the UE, and is
completed using this combined Signaling Radio Bearer (S-RB) to establish the RRC connection.

When the RRC connection has been established, the transaction reasoning procedure is performed.
The transaction reasoning procedure is used by the UE to indicate to the CN what type of transaction is requested.
The Iu connection is initiated by the UE establishing the Iu signaling bearer and the Iu control plane connection.
The signaling connection can subsequently be used for transparent NAS signaling between the UE and the CN.
Figure 3.7 CS signaling connection establishment.
3.2.3 Signaling Connection Release

When the transaction is completed and the signaling connection is no longer required, it will be released by the
RNC.
The release procedure is initiated by releasing RRC connection starting with the WCDMA Physical Dedicated
Channel and the S-RB. Then releasing the Iu control plane connection and the Iu signaling bearer completes the
release.

Figure 3.8 Signaling connection Release.
3.2.4 Authorization and Security

The authorization procedure performs authorization of the UMTS user to the CN and vice versa. The procedure
includes authorization of the USIM in the UE.
When the transaction requires encrypted communication, the CN use the security procedure to send security
parameters (selection of the ciphering algorithm and the synchronization of the start of ciphering, or both) to the
UE, which in turn acknowledges that encryption is turned on.
Figure 3.9 Authentication and security procedure.

3.2.5 Service Request
The service request is used to negotiate the QoS parameters for the requested service and allocate the
communications resources. The QoS is negotiated by the UE and the CN using the already established signaling
connection. The signaling procedure is slightly different for transactions with each of the CN domains. The
transaction setup usually includes a RAB allocation as shown in figure 3.10.
Figure 3.10 CS Service Request and RAB Allocation.
Figure 3.11 PS Service Request and RAB Allocation.

3.2.6 Service Release
The service release is used to release all resources associated with the particular service on completion, and may be
started by the CN or the UE depending on the user action.
Clearing of a particular transaction on completion of a service will include the release of the RAB and any
connections made through the DRNC. The clearing does not affect any other connections for other services. RABs
for other services as well the signaling connection will remain established.
Figure 3.12 PS Service and RAB Release.
If all services are completed at once, the transaction clearing will use the Iu release command. This will release all
radio resources and Iu user plane connections as well as the signaling connection.
Figure 3.13 CS Service and Iu Release.

3.2.7 Radio Access Bearer (RAB) Allocation
The RAB is allocated to carry speech (CS) or data (PS) between the CN and the UE. To allocate a RAB it is
required to establish an Iu user plane connection from the CN to the UTRAN and an RB from the UTRAN (RNC)
to the UE. The RAB is characterized by the parameters required by the requested QoS.
The Iu user plane connection is established by creating the Iu bearer as required by the QoS class. CS connections
require an AAL2 link between the MSC and the UTRAN, whereas PS requires a tunneled connection over ALL5
between the SGSN and the UTRAN.
The RB is established by creating an AAL2 link connection between the RNC and the Node B and then a WCDMA
Physical Dedicated Channel between the Node B and the UE.
Before establishing any bearers the RNC performs admission control. Admission control is performed as an
evaluation of whether a new call can have access without sacrificing performance of existing calls in the radio and
terrestrial sections.
The RAB can subsequently be used for transparent data transport between the UE and the CN. Allocation of an
RAB will change the state of the UE from Cell_FACH to Cell_DCH.
Figure 3.14 CS RAB Allocation.

Figure 3.15 PS RAB Allocation.
3.2.8 Radio Access Bearer (RAB) Release

RABs will be released when not in use in order to save resources, even though the transactions may not be
completed. For example, an e-mail service will remain ACTIVE even though the radio and user plane resources are
released. RABs will be re-established and released on request when there are data to send.
The RAB release for a particular transaction does not affect any other connections for other services. RABs for
other services as well the signaling connection will remain established.
Figure 3.16 RAB Release procedure.

For PS, the release procedure allows the active PDP contexts associated with the released RABs to be preserved
without modification in the CN, and the RABs can then be re-established at a later stage. Release of RAB will
change the state of the UE from Cell_DCH to Cell_PCH or URA_PCH.
3.3 Mobility Management

3.3.1 Attach Procedure
In order to access services, the UE must first be registered in the network by performing an attach. For example, the
GPRS Attach operation establishes a logical link between the UE and the SGSN, and makes the UE available for
SMS over PS, paging via SGSN, and notification of incoming PS data.
The UE is attached separately to each of the CN domains. However, the UE may perform combined or separate
GPRS or IMSI Attach procedures, depending on the capabilities of the UE and the network and the current
connection state of the UE.
The GPRS Attach procedures only register the UE in the SGSN, whereas the combined GPRS/IMSI Attach registers
the UE in the SGSN for PS service(s) as well as in the MSC for CS services.
The Attach procedure is in reality performed as a LU procedure with the type parameter set to Attach. The IMSI
Attach procedure is only used in case the UE is re-activated in the same LA (identical Location Area Indicator (LAI)
broadcasted and stored in USIM) as where it was last registered.
Note that the signaling connection establishment precedes the attach procedure in order to acquire a signaling
connection via which the Attach message can be sent.

Figure 3.17 Combined GPRS/IMSI Attach procedure with LU.
3.3.2 Detach Procedure

The Detach function is used when the UE is switched off, or when a UE informs the network that it does not want to
access the services any longer using a GPRS and/or IMSI Detach. Similarly, it enables the network to inform a UE
that it does not have to access the SGSN/MSC based services any longer.
The different types of Detach are:

IMSI Detach, marking the UE as inactive in the CS CN domain
GPRS Detach, marking the UE as inactive in the PS CN domain; and
Combined GPRS/IMSI Detach (UE-initiated only), marking the UE as inactive in the CS and PS CN domains

The Detach procedures exist in 3 different versions, based on point of origin, i.e. UE, SGSN or HLR initiated. The
figure below shows the combined GPRS/IMSI Detach procedure.
Figure 3.18 UE initiated combined GPRS/IMSI Detach procedure.
3.3.3 Location Management Procedures
Figure 3.19 LA containing RAs and cells within URA.

3.3.3.1 Location Update (LU)
The LA is defined as the cluster of cells where the UE can move without performing LUs within the CS CN domain.
A UE in MM-IDLE state performs an LA update when it enters a new LA and also performs a periodic LA update to
keep the registration of the UEs state up to date in the VLR and HLR.
An LA update is either an intra-MSC or inter-MSC LA update. For the inter-MSC LA update the MSC will inform
the HLR about the new location of the UE. For the intra-MSC LA update there is no need to inform the HLR. A
periodic LA update is always an intra-MSC LA update.
3.3.3.2 Routing Area (RA) Update Procedure

The RA is defined as the cluster of cells where the UE can move without performing routing location updates within
the PS CN domain. One or more RAs can exist within a LA, but a RA cannot exist in more than one LA.
A UE in PMM-IDLE state performs an RA update when it enters a new RA and also performs a periodic RA update
to keep the registration of the UEs state up to date in the SGSN and GGSN.
An RA update is either an intra-SGSN or inter-SGSN RA update. For the inter-SGSN RA update the SGSN will
inform the GGSNs and the HLR about the new location of the UE. For the intra-SGSN RA update there is no need
to inform the GGSNs and the HLR. A periodic RA update is always an intra-SGSN RA update.
If the network supports the Gs connection between the SGSN and the MSC, a UE that is both GPRS-attached and
IMSI-attached will perform the combined RA/LA update procedures.

Figure 3.20 UMTS LA/RAU procedure.
3.3.3.3 UMTS Registration Area (URA) Update

The URA consists of a number of cells belonging to one or more RNCs, where the UE can move without
performing URA updates. The URA is used to register the UE in the UTRAN, and is used for the MM and RRM
handled by the UTRAN.

The UE performs an URA update when it enters a new URA and also performs a periodic URA update to keep the
registration of the UEs state up to date in the UTRAN. The URA is only known within the UTRAN.
Figure 3.21 URA Update.
3.3.3.4 Cell Update

During a transaction the RNC needs to know the location of the UE with the accuracy of a cell. Due to the
discontinuous nature of a PS connection, this information may be inaccurate if the UE has moved when
transmission resumes. In this case, the cell update is performed by the UE.
The cell update is also used by the UE at the start of a new transaction, for periodic cell update, and as response to a
PS Paging Type I.
Figure 3.22 Cell update.
3.4 Radio Resource Management (RRM)

When the UE has an active connection with the UTRAN, it continuously performs measurement on the radio
connection and sends reports to the SRNC. When the UE is moving from the SRNC towards the DRNC, the SRNC
will decide to perform a handover based on the received measurement reports.
3.4.1 Soft Handovers

Soft handover is the handover of radio resources internally in the UTRAN in-between two Node Bs with the same
frequency.
This is basically a modification of the RAB using a radio link reconfiguration/setup and a radio link deletion
procedure.

Figure 3.23 Soft handover. Adding and deleting radio resources when moving between connected RNCs.
Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another
RNC. It then establishes a new RRC connection via the Iur interface to the DRNC and further to the new Node B.
During the soft handover the SRNC will transmit on just one channel but listen on several channels, either directly
controlled by the SRNC or by DRNCs. The signal will be combined in the SRNC.
When the measurement reports from the moving UE indicate that the old radio connection is no longer valid, the
SRNC then deletes the previous radio connection.
Figure 3.24 Soft handover.
3.4.1.1 Softer Handover

Softer handover is the addition or deletion of radio resources from the active set within the same Node B. The Node
B will transmit on one channel while it listens on more than one channel. The signal will be combined in the Node
B.

3.4.2 Hard Handovers
A hard handover is a physical reconfiguration of the radio link. It can happen internally in UMTS, if the UE moves
from one SRNC to another via the CN, i.e. the two RNCs are not interconnected via the Iur. This also happens when
the UE moves from one Radio Access Technology (RAT) to another, for example from GSM to UMTS. There will
be no disconnection of the data or voice transfer during the hard handover.
The several types of hard handovers can be divided into intra-RAT hard handovers, and inter-RAT handovers.
3.4.2.1 Intra-RAT Hard Handovers

Intra-RAT hard handovers are handovers within one RAT, e.g. UTRAN. The difference between hard and soft
handovers is that with hard handovers there is a physical change in frequency connections or a change in mode from
TDD (Time Division Duplex) to FDD (Frequency Division Duplex) and vice versa, or a change of cell without
macro diversity support, i.e. handover from one SRNC to another.
The handover from one SRNC to another involves the CN and thus relocation of the Iu interface. This type of
handover is also known as Serving Radio Network Subsystem (SRNS) relocation, and is used to switch SRNCs.
Figure 3.25 Before and after hard handover/SRNS relocation and RAU.
The hard handover involves a reconfiguration of the physical channel as well as a relocation of the Iu connection.
Based on the measurement reports, the SRNC decides that the call is to be handed over to another cell under another
RNS. It then starts the relocation of the Iu connection to the other RNS with the CN. The new physical channel is
established, and the UE completes the reconfiguration of the physical channel and the old Iu connection and radio
link are released.

Figure 3.26 Hard handover and SRNS relocation.
3.4.2.2 Inter-RAT Handovers

Inter-RAT handovers are handovers between different types of Radio Access Networks (RANs). In the CS domain
this means GSM to UMTS and UMTS to GSM, and in the PS domain it means GPRS to UMTS and UMTS to
GPRS. In the case of the PS domain, this is called cell reselection, not handover.
3.4.2.2.1 UMTS to GSM Handover
Figure 3.27 UMTS to GSM Handover.

The UTRAN initiates the UMTS to GSM handover on the basis of measurement reports from the UE
The SRNC sends a RELOCATION REQUIRED message to the MSC
The MSC makes a HANDOVER REQUEST to the GSM BSS
The GSM BSS responds with a HANDOVER REQUEST ACKNOWLEDGE if the resources are available
The MSC sends the RELOCATION COMMAND message to the SRNC, which tells the UE to make the handover to the
GSM
The GSM BSS sends the HANDOVER DETECT message after the UE makes the handover access
When the UE reports that the handover is complete, the GSM BSS sends the HANDOVER COMPLETE message to the
MSC, which releases the Iu connection
3.4.2.2.2 UMTS to GPRS Cell Relocation
Figure 3.28 UMTS to GPRS cell relocation.
In this case it is also the UE that initiates the cell relocation:

The UE obtains system information about the neighboring cells from the UTRAN, sets up a connection to the
GSM/GPRS BSS and releases the UTRAN resources
It then makes a ROUTING AREA UPDATE REQUEST to the SGSN
The SGSN sends a SRNS CONTEXT REQUEST to get the packet information including sequence numbers for
synchronization from the SRNC
The SRNC responds with the SRNS CONTEXT RESPONSE containing the relevant information
Security mode is set up in the GSM/GPRS network, and the SGSN tells the SRNC to forward all buffered data with the
SRNS FORWARD DATA COMMAND
The SRNC forwards the data and releases the Iu connection
The SGSN completes the cell relocation procedure with the ROUTING AREA UPDATE ACCEPT and COMPLETE
messages

3.4.3 Power Control
In UMTS, all UEs transmit on the same frequency band. In FDD the UEs will even receive on the same frequency
band. To avoid a remote UE from being masked by the signal of a closer UE, the output of each UE is controlled so
that the received power at the Node B is constant from all UEs.
The following is a description of power control for FDD:
As all UEs will create a certain level of interference, only a limited number of UEs are allowed to be active
simultaneously in order to ensure that an acceptable Signal to Interference Ratio (SIR) can be maintained. SIR is
also often referred to as Carrier to Interference ratio (C/I). In order to maximize the number of UEs in a network, it
is necessary to control the SIR of each connection and even to lower output power as new UEs enter the network.
The Node B notifies all UEs in its area about the required SIR by transmitting this parameter as a part of the cell
broadcast information.
3.4.3.1 Open Loop Power Control

Before transmitting an access burst, the UE must calculate the required output power (Pout). This can be determined
from the Node B to UE path loss and the required SIR at the Node B. The Node B broadcasts information about its
Pout and SIR. The path loss can be calculated by comparing this to the received power of the downlink to the Pout at
the node B.
3.4.3.2 Outer Loop Power Control

The outer loop power control is used to adjust the SIR target value used by the inner loop power control
independently for each connection based on the QoS requirements for the connection.
3.4.3.3 Inner Loop Power Control

The inner loop power control is used to dynamically adjust the output power of the active channel in order to
maintain received SIR at a given SIR target. The Node B and the UE each measure received power and the total
received interference. Based on this, Transmit Power Control (TPC) commands are sent up and down link 1,500
times per second to account for the near-far interference as well as multi-path fading.

3.5 CS Service Example: Mobile Terminating (MT) Voice Call
In the example shown in figure 3.29, the UE is turned on, performs an IMSI Attach, and enters the MM-IDLE state.
The UE receives an incoming call and responds to the Paging by establishing a CS Signaling Connection to the
MSC.
The UE sends a CS Service Request to the MSC, which initiates the authentication and security procedures before
RAB Allocation.
After the transaction (conversation) the RAB and the CS Signaling Connection is released.
Figure 3.29 CS service: MT voice call.

3.6 PS Service Example: MT Data Connection (Interactive)
In the PS example the UE then performs a PS IMSI Attach and enters the PMM-IDLE state. The SGSN receives a
downlink PDU and sends a Paging over the existing RRC connection as a Paging Type II from the UTRAN to the
UE.
The UE performs a cell update, establishes a new PS Signaling Connection to the SGSN, sends a Service Request
with PDP Context Activation and RAB Allocation, and receives a PDP Context Activation Accept. After the data
transmission has been completed the service is released with PDP Context Deactivation and RAB Release.
The UE finally performs a PS Detach with release of the PS Signaling Connection.
Figure 3.30 PS service: MT data connection (interactive).

4. UMTS Security and Ciphering
4.1 Security
Security has always been an important issue in mobile telephony systems. Users want privacy and will not accept
anyone listening in on their communication, while operators want to prevent fraud and other actions that impact
their revenues.
This leads to precautions regarding the airborne communication in the access network part. However, as several
different parties may be involved in the service offering for a user (as in the case of location based services),
sensitive data may have to be sent between different parties/networks, giving rise to vulnerability to other security
risks.
UMTS security is based on the security mechanisms developed for 2G networks. The main security features are:
User authentication
Encryption of the air interface communication
Temporary identities
There are, however, important changes in UMTS, for example:

A sequence number ensures that the mobile can identify the network to defeat false base station attack
Longer Key enables stronger algorithms for integrity and encryption
Mechanisms are included to support security within and between networks
Security is based in the CN instead of the BSS (as in 2G). Therefore links are protected from the UE to the CN
Integrity mechanisms for the terminal identity (IMEI) have been designed in from the start IMEI was introduced rather
late in 2G networks
The work on defining UMTS security in 3GPP is ongoing and there are different views on the level of security that
should be applied. One suggestion is that ciphering must protect almost all interfaces (signaling and user data).
Another suggestion is only to cipher some critical user data (e.g. ciphering keys) when roaming between different
networks.
The figure below gives an overview of the 3G-security architecture as defined for Rel-4.
Figure 4.1 Overview of the security architecture in Rel-4.

Five security feature groups are defined. Each of these feature groups meets certain threats and accomplishes certain
security objectives:
Network access security (I): security features providing users a secure access to 3G services, and which in
particular protect against attacks on the (radio) access link. Examples of group I features are:
- Protection against listening in to get information on the IMSI number
- User and network authentication
- Cipher agreement confidentiality
Network domain security (II): security features enabling nodes in the provider domain to securely exchange
signaling data, and protect against attacks on the wireline network. An example of a group II feature is:
- Fraud information gathering
User domain security (III): security features that secure the access to UEs. An example of a group III feature is:
- User-to-USIM (e.g. PIN code) authentication
Application domain security (IV): security features enabling applications in the user and in the provider domain
to exchange information securely. An example of a group IV feature is:
- Secure messaging between the USIM and the network
Visibility and configuration of security (V): features enabling the user to find out if a security feature is in
operation and whether the use and provision of services should depend on the security feature
The registration and connection principles within UMTS with a CS service domain and a PS service domain are
equivalent to GSM/GPRS user (temporary) identification, authentication, and key agreement which take place
independently in each service domain. User plane traffic will be ciphered using the cipher key (CK) agreed for the
corresponding service domain, while control plane data will be ciphered and integrity protected using the cipher and
integrity keys from either one of the service domains.
4.2 Ciphering
4.2.1 Universal Terrestrial Radio Access Network (UTRAN
In the UTRAN, information between the UE and the RNC can be ciphered. This is done at either the MAC or the
RLC protocol layers. A CK, which is shared by the CN and the UE after authentication, is sent from the CN to the
RAN. The RNC can then enable the ciphering.
4.2.2 Core Network (CN)

In R99 only access network (UTRAN) ciphering is defined. Subsequent releases also specify ciphering in the CN.
For this two techniques are defined at present: MAPsec and IPsec. MAPsec, which is defined for Rel-4, is a protocol
used to cipher control plane information (signaling), i.e. MAP operations. IPsec, which is defined for Rel-5, is a
protocol used to cipher user plane information, i.e. IP data. In addition to the ciphering protocols, new network
elements Key Administration Centers (KAC) and Security Gateways (SEG) are needed to allow the transfer of
ciphering keys between networks (refer to figure 4.2).

Figure 4.2 Security between networks.
4.2.2.1 Ipsec
The UMTS network control plane is sectioned into security domains, which typically coincide with operator
borders. The border between the security domains is protected by SEGs. The SEGs are responsible for enforcing the
security policy of a security domain towards other SEGs in the destination security domain. The network operator
may have several SEGs in the network for redundancy or performance reasons. The UMTS network domain
security does not extend to the user plane and consequently the security domains and the associated SEGs towards
other domains do not include the user plane Gi-interface towards other IP networks.
In UMTS Network Domain Security (NDS) architecture, the key management and distribution between SEGs is
handled by the protocol Internet Key Exchange (IKE). The main purpose of IKE is to negotiate, establish and
maintain Security Associations (SA) between parties requiring secure connections. The concept of SA is central to
IPsec and IKE. The SA defines which security protocol to be used, the SA mode and the endpoints of the SA.
In UMTS NDS, the IPsec security protocol must always be Encapsulating Security Payload (ESP) and the SA mode
shall always be a tunnel mode. In NDS it is further required that integrity protection/message authentication
together with anti-replay protection is used.
The security services provided by NDS/IP are:
Data integrity
Data origin authentication
Anti-replay protection
Confidentiality (optional)
Limited protection against traffic flow analysis when confidentiality is applied
4.2.2.2 MAPsec
MAPsec provides security for the MAP protocol on the application layer. This is done by adding a security header to
MAP operations. MAPsec is independent of the network and transport protocols used.
Before protection can be applied, SA are established between the involved MAP network elements. SA define the
keys, algorithms, and protection profiles etc. to be used to protect the MAP signaling. The necessary MAP-SAs
between networks are negotiated between the respective network operators. The negotiated SA will be effective
PLMN-wide and distributed to all network elements that implement MAP application layer security within the
PLMN. However, automated key management and key distribution (to set up the SA) is not part of Rel-4. This must
therefore be carried out by other means (see 3GPP TS 33.200 Annex A).

MAPsec provides for three different protection modes:
Protection mode 0: No protection
Protection mode 1: Integrity, Authenticity
Protection mode 2: Confidentiality, Integrity and Authenticity (ciphered)

5. Mobile Quality of Service (QoS)
5.1 Introduction
The way to success for mobile IP network operators is to shift their focus from transmission speed or best
technology to creating innovative service packages and delivering them with high quality. Mobile IP offers a huge
potential for innovative services, but at the same time it is the most complex environment in which to achieve high
QoS.
To deliver IP-based applications and services, mobile network operators have to design IP-based wireless networks
using radio access technologies and packet-based core networks. The wired IP world and the mobile wireless world
are two fundamentally different networks, and they require different strategies for providing QoS. To achieve an
end-to-end QoS, policies must be in place that span between the wired and wireless worlds.
Radio access networks have limited bandwidth that must be shared between customers. Together with customer
mobility, this results in highly variable quality levels. Mobile QoS techniques must ensure fair access to limited
radio bandwidth and use mobility management to optimize the mobile IP transport. In the fixed line IP world, QoS
mechanisms deal mostly with bandwidth availability and prioritized treatment of traffic to handle random traffic
patterns with frequent data bursts.
Figure 5.1 QoS segments.
In addition, as the above figure shows, end-to-end QoS requires QoS interworking between the mobile part and the
IP-based Internet.
5.2 What is Quality of Service (QoS)?

QoS is a key parameter for the future mobile IP. QoS, however, is also subjective depending on the expectations of
individual users. So how can it be quantified? QoS parameters attempt to quantify user experience based on
measurements of the networks ability to deliver specific services as described, for instance in IETF RFC 1224,
RFC 2212 or RFC 2544 for IP. The user experience is related to the quality of the session and the response time of
the network as well as the general availability of the service and the network.

The quality of the session is quantified by:
Jitter, i.e. the delay variation in the network
Throughput, i.e. the rate at which packets can be transferred without packet loss
The response time is quantified by:

Round Trip Time (RTT), i.e. the time from sending a packet to receiving acknowledgement
Uni-directional end-to-end delay, also called latency, i.e. the time needed to send a packet across the network)
Throughput
The availability and reliability is quantified by

Ability to access network resources or (network utilization)
24/7 service level monitoring
Based on targets for these parameters, QoS can be designed into the network and during operation used as a
reference for actual network performance. In mobile networks the critical factor for all parameters will be the radio
link and customer mobility.
5.3 Mechanisms for Delivering QoS

End-to-end QoS requires guaranteed service levels at the access points and in the backbone. To provide end-to-end
QoS that bridges the wireless and terrestrial IP networks, each element along the data path must conform to a traffic
contract. As shown above in Figure 5.1 the mobile network requires three QoS mechanisms:
Mobile QoS
QoS interworking
Fixed network QoS
Of the three it is considerably more difficult to bring QoS to the mobile access network than to the high-speed core
networks. Wireless environments inherently have greater error rates, higher delays, and more limited access
resources than fixed networks. Many of the techniques (for instance encoding) used to minimize error rates within
the UTRAN increase end-to-end delay. At the same time, limitations in the available bandwidth often lead to
congestion. Wireless QoS mechanisms focus on ensuring fair access to the available resources to avoid congestion.
Bridging between mobile and IP core networks (in GPRS/UMTS the Gi interface) is also a great challenge.
Operators must map IP-based network service classes (or specific IP applications) to wireless network QoS service
classes to ensure that QoS is provided through access networks.
5.3.1 UMTS QoS Architecture

To ensure mobile QoS in UMTS, a QoS service architecture has been defined based on a hierarchy of bearer
services. A given QoS relies on bearer services with clearly defined characteristics to be set up from the source to
the destination. Traffic has to pass different bearer services of the networks on its way from the source to the
destination.
The end-to-end service used by the mobile terminal will be realized through several different bearer services as
illustrated in Figure 5.2: A Terminal Equipment (TE)/Mobile Terminal (MT) local bearer service, a UMTS bearer
service and an external bearer service, for instance the Internet. Important to note is that the end-to-end service
requires translation/mapping with external services like the Internet. Each bearer service offers its individual
performance characteristics based on the services provided by the layers below (ATM or IP for example). For
instance, the UMTS part of the network implements QoS, based on the RAB service and CN bearer services, which
again use the radio interface or IP/ATM as the lower layer services.

When a user requests a service with a specific quality, e.g. during the PDP Context Activation procedure described
in section 3.6, the application negotiates, via the CN, a RAB service with certain attributes. In that way UMTS
allows a user to negotiate bearer characteristics that are most appropriate for carrying information. In addition it is
possible to change bearer properties via a bearer re-negotiation procedure in the course of an active connection, e.g.
in handover situations it might be necessary to handle customer mobility.
Figure 5.2 UMTS QoS architecture.
The RAB service is achieved using the RB service and the lu bearer service. The RB service handles all the aspects
of the radio interface transports and decides the QoS attributes of the session as given in the following during the
PDP context activation.
QoS Attribute Usage

Maximum bit rate The bit rate delivered to/from the user allows allocation of coding schemes
Delivery order Does the application require data in the right sequence e.g. buffering required?
Maximum Service Data Unit SDU size in Octets. Used for admission control and policing
(SDU) size
SDU format information Knowledge of SDU size enables better use of bearer service
SDU error ratio Allocation of UTRAN protocols, algorithms and error correction schemes
Residual bit error ratio Allocation of radio protocols, algorithms and error correction schemes
Delivery of erroneous SDUs Decides if errored SDU will be delivered
Transfer delay Provides the delay tolerance (in ms) of the application
Guaranteed bit rate Used to allow resource allocation and admission control
Traffic handling priority Relative importance of different SDU. Can be used instead of absolute guarantee
Allocation/Retention priority Used by network elements (not the mobile terminal) to allocate resources to bearers with
high priority.
Figure 5.3 QoS attributes and their usage.

The Iu bearer service together with the physical bearer service provides the transport between UTRAN and CN. It is
the option of the operator to use IP or ATM and the related QoS capabilities of the lu bearer service. Differentiated
services defined by IETF must be used for IP-based Iu bearer services. If an operator chooses ATM-SVC as an
internal dedicated transport bearer, interoperation with IP-based networks will be based on Differentiated Services.
The operator will control the mapping from UMTS QoS classes to Diffserv codepoints.
The CN bearer service controls the backbone UMTS so that the contracted UMTS bearer service is achieved. It is
the option of the operator to decide which of the QoS capabilities in the IP layer or QoS capabilities in the ATM
layer is used. For the IP-based backbone, differentiated services defined by IETF must be used. If the operator
chooses ATM-SVC as an internal dedicated transport bearer, interoperation with IP based backbone networks will
be based on differentiated services. The operator will control the mapping from UMTS QoS classes to Diffserv
codepoints.
5.3.2 UMTS QoS Classes

To enable differentiation of traffic flows in the network, four different application-related RAB service classes have
been defined: Conversational, streaming, interactive and background. Each service class is intended to carry traffic
flows of different kinds of applications. Speech and video are examples of conversational services, uni-directional
audio- and video streaming are streaming services, web browsing is a typical interactive service while email and file
transfer are background services.
The figure below illustrates how different services use the traffic classes to achieve the QoS required.
Figure 5.4 Using traffic classes to achieve required QoS.
The main distinguishing factor between these classes is how delay-sensitive the traffic is. The conversational class is
meant for very delay-sensitive traffic, while the background class is the most delay-insensitive. The following table
provides an overview of the four classes and the QoS attributes associated with each class.

Traffic Class Conversational Class Streaming Class Interactive Class Background
Fundamental Preserve time relation Preserve time relation Request response Destination is not
characteristics (variation) between (variation) between pattern expecting the data
information entities of information entities of Preserve payload within a certain time
the stream the stream content Preserve payload
Conversational Steady & continues Transaction content
pattern (stringent and stream
low delay based on Tolerates jitter
human perception) (buffering)
Usually asymmetric
Example of the Voice Streaming video Web browsing Background download

application of emails
Traffic Class Conversational Class Streaming Class Interactive Class Background Class
1 2 12 23 23
Maximum bit rate < 2 048 < 2 048 < 2 048 overhead < 2 048 overhead
(kbps)
Delivery order Yes/No Yes/No Yes/No Yes/No

4 4 4 4
Maximum SDU size <=1 500 or 1 502 <=1 500 or 1 502 <=1 500 or 1 502 <=1 500 or 1 502
(octets)
5 5
SDU format
information
6 6 6 6
Delivery of Yes/No/- Yes/No/- Yes/No/- Yes/No/-
erroneous SDUs
-2 -2 -3 -3 -2 -2 -3 -3 -2 -2 -3 -3 -2 -2 -3 -3
Residual BER 5*10 , 10 , 5*10 , 10 , 5*10 , 10 , 5*10 , 10 , 5*10 , 10 , 5*10 , 10 , 5*10 , 10 , 5*10 , 10 ,
-4 -6 -4 -6 -4 -6 -4 -6
10 , 10 10 , 10 10 , 10 10 , 10
-2 -3 -3 -4 -2 -3 -3 -4 -2 -3 -3 -4 -2 -3 -3 -4
SDU error ratio 10 , 7*10 , 10 , 10 , 10 , 7*10 , 10 , 10 , 10 , 7*10 , 10 , 10 , 10 , 7*10 , 10 , 10 ,
-5 -5 -57 -57
10 10 10 10
Transfer delay (ms) 100 maximum value 250 maximum value
12 12
Guaranteed bit rate < 2 048 < 2 048
(kbps)
8
Traffic handling 1, 2, 3
priority
8 8 8 8
Allocation/retention 1, 2, 3 1, 2, 3 1, 2, 3 1, 2, 3
priority
Figure 5.5 UMTS QoS classes.
1
Bit rate of 2.048 kbps requires that UTRAN operates in transparent RLC protocol mode, in this case the overhead
from layer 2 protocols is negligible
2
The granularity of the bit rate attributes must be studied. Although the UMTS network has the capability to support
a large number of different bit rate values, the number of possible values must be limited in order not to
unnecessarily increase the complexity of terminals, charging and interworking functions etc. An exact list of
supported values must be defined together with S1, N1, N3 and R2
3
Impact from layer 2 protocols on maximum bit rate in non-transparent RLC protocol mode must be estimated
4
In case of PDP type = PPP, maximum SDU size is 1,502 octets. In other cases, maximum SDU size is 1,500 octets
5
Definition of possible values of exact SDU sizes, for which UTRAN can support transparent RLC protocol mode,
is the task of RAN WG3
6
If Delivery of erroneous SDUs is set to 'Yes', error indications can only be provided on the MT/TE side of the
UMTS bearer. On the CN gateway side error indications cannot be signaled outside of UMTS network in
R99
7
Values are derived from CRC lengths of 8, 16 and 24 bits on layer 1
8
The number of priority levels must be further analyzed by S1, N1 and N3

6. UMTS Testing
Test and Measurement is a critical enabler for running an efficient operation, especially for such a complex system
as UMTS. Test and Measurement is the key to optimal usage of resources. Test and Measurement is also the fast
track to detailed information on business metrics.
No one can afford to enter a highly competitive market with a non-perfect service. The winners over the next few
years are not going to be driven by the highest transmission speed or best technology. Companies that can create
innovative service packages and deliver them with high quality are going to be the winners.
Figure 6.1 Test and Measurement is the fast track to detailed information on business metrics.
In todays world, new network operators are emerging, networks are converging, and individual networks are
growing in complexity. Test equipment must empower users to diagnose problems easily, even though they may be
unfamiliar with the underlying network technology. This requires intelligent traffic analysis, and providing results in
a concise manner that is easy to understand.
The needs for testing UMTS networks can generally be divided into two phases:
Installation and provisioning
Maintenance
Installation and provisioning testing includes:

Verification of the transport layers
Verification of correct signaling between equipment in a multi-vendor network
System upgrading and integration testing
Functional testing/service presence verification
In the maintenance phase of a network, regular testing is necessary to ascertain that the quality of the network is at
the required level and at that the network has sufficient capacity to handle the traffic.
Examples of tests are:

Signaling analysis
Troubleshooting
QoS testing
Handover performance
- UEs will perform soft handovers almost constantly during voice calls in areas with small cells
Interconnect testing
NetTest offers a comprehensive set of solutions for UMTS network testing, ranging from hot spot expert analysis
testing to end-to-end network monitoring of the UMTS network.

6.1 Hot Spot Expert Analysis Tools
Figure 6.2 Test phases covered by NetTest hot spot expert analysis tools.
6.1.1 InterQuest Probe

The InterQuest Probe is a scalable, high-density data collection capture tool, capable of collecting large volumes of
network traffic for active service applications or post-analysis with expert tools in a cost-efficient manner.
The InterQuest Probe is capable of collecting data from a

large number of links over numerous E1, DS1 and OC3
interfaces simultaneously, allowing offline expert analysis
tools such as Compass and Impact to analyze many
different connections simultaneously, providing a more
accurate picture of network performance.
The more interfaces that can be monitored, the better the

information provided by Compass and Impact, allowing a
better statistical basis.
The InterQuest Probe scales to the network, allowing

Figure 6.3 The InterQuest is a powerful tool with the ability
more links to be monitored as the network grows. The to capture large amounts of data from multiple links in both
InterQuest probe can be operated remotely over LAN or access and core network.
modem as well as locally with control of multiple units
from the same workstation. Data from multiple units can be correlated. The multiple technologies supported allows
data capture in the access as well as the core network.

6.1.2 Impact
The core network signaling is the foundation for the fundamental services in UMTS. Impact offers network analysis
and performance documentation of:
Location management
Roaming
Authentication and security
Message services QoS
Figure 6.4 Impact offers network analysis and performance

documentation of roaming and SMS QoS.
6.1.3 Compass
Compass is acknowledged in the mobile market as the most advanced solution for the troubleshooting and
optimization of the access network.
From statistical network overview to subscriber details and call tracing, Compass enables significant improvements
to maintenance procedures:
Troubleshooting
Functional testing
Optimization
QoS testing
Call analysis and subscriber tracing
Figure 6.5 Compass is the most advanced solution for the optimization and
troubleshooting of the access network.

6.2 End-to-End Network Monitoring
Figure 6.6 MasterQuest is the undisputed leader in GSM and GPRS monitoring and offers the most complete surveillance solution
available today. MasterQuest UMTS builds on this platform.
6.2.1 MasterQuest
MasterQuest is NetTest's advanced network surveillance solution for next generation networks. MasterQuest is a
highly scalable system based on a distributed architecture, utilizing non-intrusive network probes. Probes are
located at the sites where the monitored links terminate, while a central server is located at the network surveillance
center. Components of the system communicate through a standard LAN/WAN structure. Probes will transmit
captured data back to the central server where it is being correlated and presented to the network operator. By virtue
of its distributed architecture, MasterQuest data
can also be assessed remotely from a field
location.
MasterQuest for UMTS is the centralized

solution for:
Troubleshooting and network operations
Planning and optimization
Interconnect management
Customer management
MasterQuest will perform network-wide

correlation and focus on monitoring of end-to-
end service delivery performance.

Figure 6.7 MasterQuest performs network-wide correlation and monitors end-
to-end service delivery performance.
Technical Note
7. Terms and Abbreviations
1G The first generation of mobile telephone systems
2.5G Enhanced second generation of mobile telephone systems
2G The second generation of mobile telephone systems
3G The third generation of mobile telephone systems
3GPP Third Generation Partnership Project
3GPP-2 Third Generation Partnership Project Number 2
AAL2 ATM Adaptation Layer 2
AAL5 ATM Adaptation Layer 5
AH Authentication Header
ALCAP Access Link Control Application Part
AN Access Network
API Application Programming Interface
APN Access Point Name
ARIB Association of Radio Industries and Business (Japan)
ATM Asynchronous Transfer Mode
AuC Authentication Center
BCF Bearer Control Function
BG Border Gateway. Logical box that connects two (or more) operators together via Inter-PLMN
backbone. BG protects operators intra-PLMN network against intruders
BICC Bearer Independent Call Control protocol
BSC Base Station Controller
BSS Base Station Subsystem
BSSAP+ Base Station System Application Part+ Protocol between SGSN and MSC/VLR
BSSGP Base Station System GPRS Protocol. Protocol between SGSN and BSS
BTS Base Transceiver Station
BVCI BSSGP Virtual Connection Identifier
CAP CAMEL Application Part
CC Call Control
CCF Call Control Function
CDMA Code Division Multiple Access
CDMA-2000 North American CDMA standard, likely to be used for UMTS in North America
CEPT Conference of European Posts and Telegraphs
CGI Cell Global Identification
C/I Carrier to Interference Ratio, equal to SIR
CK Cipher Key
CM Call Management
CN Core Network
CRNC Controlling Radio Network Controller (RNC)
CS Circuit Switched
CSCF Call State Control Function
CS-MGW Circuit Switched Media Gateway
CWTS China Wireless Telecommunications Standard Group (China)
DRNC Drift Radio Network Controller (RNC)

EDGE Enhanced Data rates for Global/GSM Evolution
EGPRS Enhanced GPRS
EIR Equipment Identity Register
ESP Encapsulating Security Payload
ETSI European Telecommunication Standard Institute
FDD Frequency Division Duplex
GEA GPRS Encryption Algorithm
GERAN GSM/EDGE Radio Access Network
GGSN Gateway GPRS Support Node
GMLC Gateway Mobile Location Center
GMM/SM GPRS Mobility Management and Session Management. Protocol stack between MS and SGSN
that handles GPRS attach/detach, PDP context activation/deactivation, etc.
GMSC Gateway MSC
GPRS General Packet Radio Service
GPRS-CSI GPRS CAMEL Subscription Information
GPRS-SSF GPRS Service Switching Function
GSIM GSM Service Identity Module
GSM Global System for Mobile communication. Original meaning: Groupe Spcial Mobile
GSM 1800 GSM system operating at 1800 MHz
GSM 1900 GSM system operating at 1900 MHz (North America)
GSM 900 GSM system operating at 900 MHz
GSM-SCF GSM Service Control Function
GSN GPRS Support Node
GTP GPRS Tunneling Protocol. Protocol between the UTRAN and the SGSN and between the SGSN
and the GGSN to encapsulate user data and to carry GPRS signaling
GTP-C GPRS Tunneling Protocol for the Control plane
GTP-U GPRS Tunneling Protocol for the User plane
HE Home Environment
HLR Home Location Register
HSCSD High Speed Circuit Switched Data
HSS Home Subscriber Server
HTML HyperText Markup Language
HTTP HyperText Transfer Protocol
IAM Initial Address Message
ICMP Internet Control Message Protocol
IESG Internet Engineering Steering Group
IETF Internet Engineering Task Force
IK Integrity Key
IKE Internet Key Exchange
IM IP Multimedia
IMEI International Mobile Equipment Identity
IM-MGW IM Media Gateway
IMS IP Multimedia (IM) Subsystem
IMSI International Mobile Subscriber Identity
IN Intelligent Network

IP Internet Protocol
IPsec IP security
IPv4 Internet Protocol version 4
IPv6 Internet Protocol version 6
IPX Internet Packet eXchange
IS-95 North American cellular telephony system
ISDN Integrated Services Digital Network
ISP Internet Service Provider
ISUP ISDN User Part
ITU-T International Telecommunication Union, Telecommunication Standardization Sector
Iu Interface between CMS/SGSN and the RNC
Iub Interface between RNC and the Node B
Iur Interface between two RNCs
IWU Inter Working Unit
KAC Key Administration Center
KSI Key Set Identifier

L2TP Layer-2 Tunneling Protocol
LA Location Area
LAI Location Area Indicator

LAN Local Area Network
LLC LLC Logical Link Control. Protocol layer between MS and SGSN
LMU Location Measurement Unit
LU Location Update
M3UA MTP3 User Adaptation Layer
MAC Medium Access Control. Protocol in the radio level that is used to allocated the radio channel
MAP Mobile Application Part
MAPsec MAP security
MBMS Multimedia Broadcast/Multicast Service
ME Mobile Equipment
MEGACO MEdia GAteway COntrol protocol
MGC Media Gateway Controller, same functions as MSC-Server
MGCF Media Gateway Control Function
MGW Media Gateway
MIP Mobile IP
MM Mobility Management
MMS Multimedia Messaging Service
MMSE Multimedia Messaging Service Environment
MRFC Multimedia Resource Function Controller
MRFP Multimedia Resource Function Processor
MS Mobile Station (GSM/GPRS) equal to UE in UMTS
MSC Mobile Switching Center
MSC-S MSC Server, Same functions as MGC
MT Mobile Terminal, the MT together with the TE and the USIM forms the UE
MTP2 Message Transfer Part layer 2

MTP3 Message Transfer Part layer 3
MTP3b Message Transfer Part 3b
NAS Non Access Stratum
NBAP Node B Application Part
NDS Network Domain Security
NDS/IP NDS for IP based protocols
NNI Network-Network interface
Node B The BTS of the UMTS network
NS Network Service. Protocol layer between BSS and SGSN
NSAPI Network layer Service Access Point Identifier. Identifier that specifies the PDP context in MS and in
SGSN
NSS Network SubSystem. Network part of the network (in GPRS it means SGSN and GGSN)
OHG Operator Harmonization Group
PCF Policy Control Function
PCS1900 Personal Communication system another name for the North American version of the GSM
system (GSM 1900)
P-CSCF Proxy CSCF
PCU Packet Control Unit
PDA Personal Digital Assistants
PDCH Packet Data Channel
PDCP Packet Data Convergence Protocol
PDN Packet Data Network
PDP Packet Data Protocol (e.g. IP and X.25)
PDU Protocol Data Unit
PLMN Public Land Mobile Network
PMM Packet Mobility Management
PPF Paging Proceed Flag
PPP Point-to-Point Protocol
PS Packet Switched
P-TMSI Packet Temporary Mobile Subscriber Identity
PTP Point To Point
PVC Permanent Virtual Circuit
R99 UMTS Release 1999
RA Routing Area. A set of cells that belongs to one group. RA is always a subset of a LA (location
Area)
RAB Radio Access Bearer
RAC Routing Area Code
RAI Routing Area Identity
RAN Radio Access Network
RANAP Radio Access Network Application Part
RAT Radio Access Technology
RAU Routing Area Update
RB Radio Bearer
Rel-4 UMTS Release 4

Rel-5 UMTS Release 5
RLC Radio Link Control. A protocol between MS and BSS to handled retransmission and other radio
related issues
RNC Radio Network Controller
RNS Radio Network Subsystem
RNSAP Radio Network Subsystem Application Part
RNTI Radio Network Temporary Identity
RRC Radio Resource Control
RRM Radio Resource Management. Algorithms and procedures for establishing and maintaining radio
path quality between the UE and the RNC
RTP Real-time Transport Protocol
SA Security Associations
SCCP Signaling Connection Control Part
SCTP Stream Control Transmission Protocol
SEG SEcurity Gateway
SGSN Serving GPRS Support Node
SGW Signaling Gateway
SIM Subscriber Identity Module
SIP Session Initiation Protocol
SIR Signal to Interference Ratio, equal to C/I
SM Short Message
SMS Short Message Service
SM-SC Short Message service Service Center
SMS-GMSC Short Message Service Gateway MSC
SMS-IWMSC Short Message Service Interworking MSC
SN Serving Network
SNDC SubNetwork Dependent Convergence
SNDCP SubNetwork Dependent Convergence Protocol
SN-PDU SNDCP PDU
SPI Security Parameter Index
S-RB Signaling Radio Bearer
SRD Software Requirements Document
SRNC Serving Radio Network Controller (RNC)
SRNC Serving Radio Network Subsystem (RNS)
SS7 Signaling System No. 7
SSCF-NNI Service Specific Co-ordination Function - Network Node Interface
SSCF-UNI Service Specific Co-ordination Function - User Network Interface
SSCOP Service Specific Connection Oriented Protocol
STP Signaling Transfer Point
T1 North American primary rate (1.5 Mbps) specified by Standardization Committee T1
Telecommunications (USA)
TCAP Transaction Capabilities Application Part
TCP Transmission Control Protocol
TCP/IP Transmission Control Protocol/Internet Protocol
TDD Time Division Duplex
TDMA Time Division Multiple Access

TE Terminal Equipment, the TE together with the MT and the USIM forms the UE
TEID Tunnel Endpoint Identifier
TFT Traffic Flow Template
TLLI TLLI Temporary Logical Link Identity. Identifier of the mobile used between MS and SGSN
TMSI Temporary Mobile Subscriber Identity
TNCP Transport Network Control Plane
TOS Type of Service
TRAU Transcoder and Rate Adaptor Unit
TTA Telecommunications Technology Association (Korea)
TTC Telecommunications Technology Committee (Japan)
UDP User Datagram Protocol
UE User Equipment (i.e. the UMTS wireless terminal)
UEA UMTS Encryption Algorithm
UIA UMTS Integrity Algorithm
UMTS Universal Mobile Telecommunications System
URA UTRAN Registration Area
USIM Universal Service Identity Module
USSD Unstructured Supplementary Service Data
UTRAN Universal Terrestrial Radio Access Network
UUS User-to-User signaling
VAS Value Added Service
VHE Virtual Home Environment
VLR Visitor Location Register
WAP Wireless Application Protocol
WCDMA Wideband Code Division Multiple Access
WML Wireless Markup Language
For more terms, refer to 3GPP TR 21.905: "3G Vocabulary" (http://www.3gpp.org)

8. Websites
3GPP Third Generation Partnership Project http://www.3gpp.org/

3GPP-2 Third Generation Partnership Project Number 2 http://www.3gpp2.org/
3G.IP http://www.3gip.org/
ARIB Association of Radio Industries and Business http://www.arib.or.jp/
CWTS China Wireless Telecommunications Standard http://www.cwts.org/
Group
ETSI European Telecommunication Standard Institute http://www.etsi.org/
GSA Global mobile Suppliers Association http://www.gsacom.com/
GSM Association http://www.gsmworld.com/
IETF The Internet Engineering Task Force http://www.ietf.org/
IPV6 Forum http://www.ipv6forum.com/
MWIF Mobile Wireless Internet Forum http://www.mwif.org/
T1 Standardisation Committee T1 Telecommunications http://www.t1.org/
TTA Telecommunications Technology Association http://www.tta.or.kr/
TTC Telecommunications Technology Committee http://www.ttc.or.jp/
UMTS Forum http://www.umts-forum.org/
UWCC Universal Wireless Communications Consortium http://www.uwcc.org/
WMF Wireless Multimedia Forum http://www.wmmforum.com/

9. References
Digital cellular telecommunications system (Phase 2+) (GSM); Universal Mobile Telecommunications System (UMTS);
Network architecture (3GPP TS 23.002 Release 5)
Service Requirements for the IP Multimedia Core Network Subsystem (Stage 1), (3GPP TS 22.228)
IP Multimedia (IM) Subsystem Stage 2 (Release 5), (3GPP TS 23.228)
Multimedia Messaging Service (MMS); Functional description; Stage 2, (3GPP TS 23.140)
Universal Mobile Telecommunications System (UMTS); UTRAN Overall Description (3GPP TS 25.401)
UTRAN Iu Interface: General Aspects and Principles (3GPP TS 25.410)
UTRAN Iu interface signaling transport (3GPP TS 25.412)
Universal Mobile Telecommunications System (UMTS); UTRAN Iu Interface RANAP Signaling (3GPP TS 25.413)
UTRAN Iur Interface: General Aspects and Principles (3GPP TS 25.420)
Universal Mobile Telecommunications System (UMTS); UTRAN Iur Interface RNSAP Signaling (3GPP TS 25.423)
UTRAN Iub Interface: General Aspects and Principles (3GPP TS 25.430)
Universal Mobile Telecommunications System (UMTS); UTRAN Iub Interface NBAP Signaling (3GPP TS 25.433)
Radio Interface Protocol Architecture (3GPP TS 25.301)
Radio Resource Control (RRC) protocol specification (3GPP TS 25.331)
Medium Access Control (MAC) protocol specification (3GPP TS 25.321)
Radio Link Control (RLC) protocol specification (3GPP TS 25.322)
Packet Data Convergence Protocol (PDCP) specification (3GPP TS 25.323)
Technical realization of Short Message Service (SMS) (3G TS 23.040)
B-ISDN ATM layer specification (I.361)
B-ISDN ATM Adaptation Layer specification: Type 2 AAL (I.363.2)
Type 5 AAL (I.363.5)
General Packet Radio Service (GPRS); GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface
(3GPP TS 29.060)
Mobile Application Part (MAP) specification (3GPP TS 29.002)
General Packet Radio Service (GPRS) Service description (3GPP TS 23.060)
Serving GPRS Support Node SGSN - Visitors Location Register (VLR); Gs Interface Network Service Specification
(3GPP TS 29.016)
General Packet Radio Service (GPRS); Serving GPRS Support Node (SGSN) - Visitors Location Register (VLR); Gs
interface layer 3 specification (3GPP TS 29.018)
Control protocol for multimedia communication (H.245)
Gateway control protocol (H.248)
3G Security; Security Architecture (3GPP TS 33.102)
3G Security; Network Domain Security; MAP application layer security (3GPP TS 33.200)
3G Security; Network Domain Security; IP network layer security (3GPP TS 33.210)

3G Security; A Guide to 3rd Generation Security (3GPP TR 33.900)

ISO 9000 certified. SUMTS-TN02-0304-A4. 2002 NetTest. All Rigts Reserved. Specifications subject to change without notice. E&EO.
NetTest A/S NetTest Sales Offices

Kirkebjerg All 90 Brazil +55 11 5505 6688 Italy +39 02 95 12 621 NetTest is a leading industry specialist devoted to providing test and
DK-2605 Brndby China +86 10 6467 9888 Singapore +65 6220 9575 measurement instruments and network management solutions designed to
empower global telecommunication leaders in optimizing their business
Denmark France +33 1 49 80 47 48 Spain +1 91 372 92 27 performance. NetTest's solutions enable customers to gain vital insights
Tel: +45 72 11 22 00 Germany +49 89 99 89 01-0 USA +1 315 797 4449 into the function and performance of their networks, allowing them to make
Fax: +45 72 11 22 10 informed decisions that drive profitability by enhancing quality and
minimizing infrastructure investments. NetTest is focused on servicing two
E-mail: com@nettest.com
areas of the telecommunications network, namely Installation and
web: www.nettest.com Maintenance and Network Monitoring and Optimization.

Tech Note UMTS PDF

Uploaded by

Copyright:

Available Formats

You might also like

Tech Note UMTS PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Tech Note UMTS PDF

Uploaded by

Copyright:

Available Formats

UMTS Technical Note

UMTS Technical Note Page 2 of 83

UMTS Technical Note Page 3 of 83

UMTS Technical Note Page 4 of 83

Figure 1.1 The evolution of mobile telephony.

UMTS Technical Note Page 5 of 83

UMTS for customers:

UMTS for the operator:

UMTS Technical Note Page 6 of 83

Figure 1.3 The 3GPP organizations.

1.3 The UMTS Releases

The major headlines for each release are:

UMTS Technical Note Page 7 of 83

1.4 The Services on a UMTS Network

1.4.1 General Services

1.4.2 Quality of Service

1.4.3 UMTS Service Capabilities

UMTS Technical Note Page 8 of 83

UMTS network planners can also use this information.

1.4.3.2 WAP Service

1.4.3.3 Multimedia Messaging Service (MMS)

1.4.4 Virtual Home Environment (VHE)

UMTS Technical Note Page 9 of 83

Figure 1.4 GSM/GPRS/UMTS network architecture.

1.5.1 Access Network Elements

UMTS Technical Note Page 10 of 83

Figure 1.5 GERAN architecture.

1.5.2.1 Base Station Subsystem (BSS)

1.5.2.2 Base Transceiver Station (BTS)

1.5.2.3 Base Station Controller (BSC)

UMTS Technical Note Page 11 of 83

1.5.3 Universal Terrestrial Radio Access Network (UTRAN) Architecture

1.5.3.1 Radio Network Subsystem (RNS)

Figure 1.6 UTRAN architecture.

UMTS Technical Note Page 12 of 83

Figure 1.7 Serving RNC.

Figure 1.8 Drift RNC.

UMTS Technical Note Page 13 of 83

1.5.3.4 User Equipment (UE)

1.5.4 Core Network Elements

Figure 1.9 UMTS network architecture.

UMTS Technical Note Page 14 of 83

Figure 1.10 Core network elements - CS domain.

1.5.5.1 Mobile Switching Center/Gateway Mobile Switching Center (MSC/GMSC)

1.5.5.2 Media Gateway/Mobile Switching Center (MGW/MSC) Server

UMTS Technical Note Page 15 of 83

1.5.5.3 Signaling Gateway (SGW)

Figure 1.11 The signaling gateway function.

1.5.6 Core Network (CN) Elements Packet Switched (PS) Domain

Figure 1.12 Core network elements - PS domain.

UMTS Technical Note Page 16 of 83

1.5.6.2 Gateway GPRS Support Node (GGSN)

1.5.7 Core Network (CN) Elements Registers

The HLR provides functionality like:

1.5.7.2 Home Subscriber Server (HSS)

Figure 1.13 The HSS is a superset of the HLR.

UMTS Technical Note Page 17 of 83

The HSS contains the following user-related information: