EESM 539 – Broadband

Wireless Communications
à Part III: Wireless
Applications
Vincent Lau
Dept of ECE, HKUST

1
Core Network Services

2
 Cellular Mobility Management
• Objective:
– Keep track of location of mobiles in order to receive
incoming calls.
– Distributed databases (HLR / VLR)
– HLR (Home Location Register)
• Maintain a permanent record for every MS.
• Key = IMSI
• Record = (address of last VLR visited, MSC number)
– VLR (Visiting Location Register)
• Maintains a dynamic record of mobiles under it’s location
area.
• Key = TMSI
• Record = (IMSI, address of HLR, address of MSC [MSRN],
LAI)
3
 Location Update
• MS has to update the infrastructure on it’s latest location
based on “Location Update Procedures”.
• Case 1:Location Update (Inter-LAI Movement)
– MS moves from LAI-1 to LAI-2, both belong to the same MSC.
– Step 1 (MSà MSC):
• “Location Update Request Message” [MS à MSC]
• The message includes [previous LAI, previous MSC, previous VLR,
TMSI]
• In case VLR does not have record for the mobile (e.g. first registration),
the MS will be asked to send IMSI.
– Step 2 (MSC à VLR):
• MSC forwards the message to VLR (via TCAP)
• Including [MSC address, TMSI, previous LAI, target LAI]
– Step 3:
• VLR notices that LAI-2 and LAI-1 belong to the same MSC
• Updates LAI à LAI-2 in VLR record.
• Reply ACK to MSC 4
Inter-LA Registration

5
 Cellular Mobility Management
– Case 2: Inter-MSC Movement
• In this case, the 2 LAIs belong to 2
different MSCs (connecting to the same
VLR).
• Step 1 (MS à MSCà VLR):
– “Location Update Request” {TMSI,
previous LAI, target LAI, previous
MSC/VLR}
• Step 2 (VLR processing):
– VLR notices that LAI-1 and LAI-2
belongs to 2 different MSC
– VLR updates the LAI and MSC address
fields
– Derive HLR address from IMSI (in VLR
record)
– VLR à HLR
[MAP_UPDATE_LOCATION] {IMSI,
address of new MSC, address of VLR}
• Step 3 (HLR processing):
– HLR identifies the MS’s record (from
IMSI) and updates MSC number
– Send ACK to VLR.
• Step 4:
– VLR sends “Location Update Request
ACK” to MSC.

6
 Cellular Mobility Management
• Case 3: Inter-VLR Movement
– The 2 LAIs belong to 2 different MSCs
(connecting to 2 different VLRs).
– Step 1 (MS à MSC-2 à VLR-2):
• “Location Update Request”
– Step 2 (VLR Processing)
• VLR2 does not have a record for the MS.
• VLR2 à VLR1
{MAP_SEND_IDENTIFICATION} {TMSI}
in order to obtain IMSI of the MS.
• VLR1 à VLR2
{MAP_SEND_IDENTIFICATION_ack}
containing IMSI.
• VLR2 creates a record for mobile
– Step 3 (HLR Processing)
• VLR2 sends a registration message to
HLR {MAP_LOCATION_UPDATE} {IMSI,
address of MSC-2, address of VLR-2}
• HLR updates records for the mobile
• Reply VLR2 with ACK
– Step 4 (VLR Processing)
• Generates new TMSI for mobile
• Send TMSI to mobile via MSC-2.
• Delete obsolete records in VLR1.

7
Basic Call Origination – Circuit Switched
– Step 1:
• MS à MSC (Call Origination
Request)
– Step 2:
• MSC forwards request to
VLR
(MAP_SEND_INFO_FOR_O
UTGOING_CALL)
– Step 3:
• VLR checks mobile’s profile
(via TMSI)
• Reply MSC
“MAP_SEND_INFO_FOR_O
UTGOING_CALL_ack”
– Step 4:
• MSC sets up trunks
according to standard PSTN
procedure

8
 Basic Call Termination – Circuit Switched
• Step 1:
– PSTN user dials mobile number
– The call is routed to GMSC (via PSTN
SS7 - IAM)
• Step 2:
– GMSC queries HLR
(MAP_SEND_ROUTING_INFORMATION)
{MSISDN}
• Step 3 (HLR Processing):
– HLR sends a
“MAP_PROVIDE_ROAMING_NUMBER”
{IMSI, MSC Number} to VLR to obtain
MSRN
• Step 4 (VLR Processing):
– VLR creates MSRN using the MSC
number stored in VLR record.
– MSRN is send back to GMSC via HLR.
• Step 5 (Call Processing)
– MSRN provides address of target MSC
– GMSC set up voice trunks to target MSC
(SS7 IAM)

9
 International Roaming
– International Roaming Scenario
• Suppose a GSM user from Taiwan (John) roams to Singapore.
– Scenario 1:
• A person in Taiwan calls John à results in a local call and an
international call.
• The caller is charged for a local GSM call, John is charged for an
international call from Taiwan to Singapore.
– Scenario 2:
• A person (say in HK) calls John à results in two international calls.
• The caller is charged (HK à Taiwan); John is charged (Taiwan à
Singapore)
– Scenario 3:
• A person in Singapore calls John à results in two international calls
even though both are in Singapore.

– Tromboning Effect
• Call termination to a roamer could result in international calls.

10
 Example of Scenario 3
• Step 1:
– Jenny dials John’s number (home = Taiwan)
– This is interpreted as IDD call and is routed to
ISC-B (in Singapore)
– ISC-B (Singapore) à ISC-C (Taiwan) through SS7
(IAM)
– ISC-C (Taiwan) à GMSC-D [from the prefix of the
called number]
• Step 2:
– GMSC-D à HLR(Taiwan) to obtain MSRN
(address of the MSC containing the mobile).
• Step 3:
– HLR-E realizes John’s status is roaming in
Singapore
– HLR-E à VLR-F (Singapore) [through GSM-MAP]
– MSRN is returned to GMSC-D.
• Step 4:
– Based on MSRN, GMSC-D uses IAM message to
set up voice trunk to MSC-G, connecting to John.
• Voice Path
– Requires 2 international trunk connections.
– Jenny is charged for the IDD call from Singapore
to Taiwan.
– John is charged for the IDD call from Taiwan to
Singapore.

11
 Reduction of Roaming Charge
• Solution 1 (Roamer Location Cache):
– RLC is co-located with the ISC in the visited system
– Location Registration
• Step 1:
– MS (John) registers to VLR (in Singapore)
• Step 2:
– VLR sends MAP_UPDATE_LOCATION to roamer’s HLR.
– Since HLR is in Taiwan, the message is routed to ISC-B.
• Step 3:
– ISC-B interprets the message (MAP), forwarding it to ISC-C (Taiwan)
– At the same time, ISC-B duplicates a message and forwards it to RLC.
– RLC creates a record (IMSI, VLR/MSC addresses)
• Step 4:
– RLC still does not have MSISDN (it only has IMSI)
– RLC request MSISDN from HLR using “MAP_RESTORE_DATA”
– MSISDN is returned from HLR to RLC through
“MAP_INSERT_SUBSCRIBER_DATA”

– Call Processing
• Step 1:
– Jenny dials John’s number as before
– The call is routed to ISC-B
• Step 2:
– ISC-B looks at the prefix of the called number à recognizes the called
party to be a potential roamer
– ISC-B searches the local RLC using the called number
– If no entry is found, the call is routed to ISC-C as usual
– If an entry for John is found, the call is routed to MSC (Singapore) {RLC
acts as a proxy HLR}
• Step 3:
– Using the MSRN in RLC, ISC-B routes the call to MSC (Singapore),
avoiding the 2 international paths.
– Advantage
• Only ISC-B needs to be modified.
– Disadvantage
• Most ISC are not equipped with GSM-MAP protocol.
• Agreement has to be made between international operator and cellular
operators. 12
 Reduction of Roaming Charge
• Solution 2 (RLC within GSM):
– Caller dials a operator-owned switch (switch-D) colocated
with the RLC.
– Location Update
• Step 1:
– MS registers with VLR as usual
• Step 2:
– VLR recognizes that the registration is from an international roamer.
– VLR sends “MAP_UPDATE_LOCATION” to RLC
– RLC creates a record for IMSI, VLR/MSC addresses
• Step 3:
– RLC relays “MAP_UPDATE_LOCATION” to HLR (Taiwan) through
international SS7.
• Step 4:
– After registration is completed, RLC obtains MSISDN as in solution 1.
– Call Processing
• Step 1:
– Jenny dials an access number (corresponding to switch-D)
– After switch-D is connected, Jenny will be asked for John’s number.
• Step 2:
– Switch-D searches the RLC for John’s entry using MS-ISDN
– If not found, the call is routed to ISC-B in the usual way.
– Else, the call is processed locally, using RLC as a HLR-proxy.
– Advantage
• Modifications are made within the cellular network only
– Disadvantage
• Extra modifications are needed at the VLR.
• Dialing process for the caller is different from regular IDD dialing.

13
 Reduction of Roaming Charge
• Solution 3 (Extractor):
– Extractor monitors (but does not
modify) the messages passing
through the signaling links of VLR.
– Take actions when a location update
message is sent to HLR in foreign
country.
– E.g. When
MAP_UPDATE_LOCATION is
delivered from VLR à ISC-B, the
extractor will also send a registration
message to the RLC, creating a
roamer record.
– RLC obtains the roamer’s MSISDN
from the HLR similar to solution 2.
– Call processing is exactly the same
as solution 2.
– Advantage
• It is transparent to VLR à no
modification of VLR is needed
– Disadvantage
• A new network element (extractor) is
introduced.

14
Wireless Internet
Access

15
 Overview
• Legacy Web servers are designed based on
HTTP protocol, which is based on TCP/IP
protocol stack.
• It is desirable for mobile clients to be able to
access all legacy web servers.
• There are two architectures to access web
servers on the internet through a mobile
client device. They are the gateway-based
approach and Direct TCP approach.
16
 Wireless Internet Access (GSM/IS95)
• GSM/IS95 offers circuit switched data bearer.
• Laptop users hook up to internet based on ISP (similar to PSTN
dialup).

17
 Wireless Internet Access (GPRS/UMTS)

• UMTS/GPRS
offers packet
switched data
bearer (always
on line).

• mobile user gets

IP address from
mobile operator.

18
 Gateway-based Approach (WAP)
• The challenges on mobile internet access are
– (A) Small size mobile client device à cannot display everything on legacy web server.
– (B) TCP performance over the air interface à TCP is designed for fixed line network.
• Problem (A),
– a tailor-made formatting language is proposed by the WAP forum to effectively display information
on small screen mobile device. It is based on WML or WML script (a variation of XML).
• Problem (B),
– internet contents are delivered to mobile device through the help of WAP-Gateway.
• The WAP specification is designed to operate over a variety of wireless bearer services
(e.g. IP-based like GPRS, CDPD, GSM, IS95, IS-136 circuit-switched wireless data or
non-IP-based like SMS).
HTTP Request
Encoded HTTP
Request
WAP Proxy Web Server
Client

Encoded HTTP
Response Encoders and
User Decoders
Agent Contents

WML contents
19
Over the Air
Over the Internet
 WAP Protocol Stack
• For IP-based wireless bearer,
UDP is adopted as the WDP
definition and no bearer
adaptation is required. WAP
could be accommodated in the
handset by including standard
WAP layers (WAE, WSP,
WTP).
• For non-IP based wireless
bearer, protocol adaptation is
required. (This may decrease
the efficiency of the bearer).
The bearer adaptation include
(1) destination port, (2) source
port, and (3) packet
segmentation and reassembly.
• Disadvantages: (i) legacy html
contents could not be displayed
directly on the mobile device.
[needs html conversation
gateway]. (ii) WAP gateway
could be security weak point.

20
WAP Security

21
 Direct TCP on Client
• Since a lot of information is present in html format in
standard (legacy) servers, it may be desirable for the client
device to be able to access the html contents directly
without the intervention of gateway. This is possible for
client device with a larger display (PDA, Pocket PC).
• For problem (B), two issues must be overcome.
– Firstly, there is a large protocol overhead (20 bytes) associated
with TCP protocol. This is a severe limitation when the
transmission speed of the air interface is slow.
– Secondly, there is a performance issue associated with TCP
over wireless. The TCP protocol was designed for fixed wire
systems where the BER of the physical link is usually very low.
However, this is not true in wireless environment. TCP packets
could get corrupted easily due to transmission errors and this
would trigger the inherit flow control mechanism in TCP. Hence,
the overall throughput could be very low.
• However, with the introduction of “2.5G or 3G wireless”
systems, the transmission speed and the transmission
reliability of the physical bearer are improved. This makes
the TCP over wireless possible. For example, one
possibility to support TCP over wireless link would be to
employ non-transparent bearer (with RLP as link layer
protocol) so that the end-to-end FER is low enough for
significant TCP throughput.
• Advantages:
– (i) No html conversation is needed;
– (ii) End-to-end security. 22