Exploiting Possible 5G Vulnerabilities

The standards can try their best to ensure that the next generation of protocols is more secure than the previous one but there is always some way in which the protocols can be exploited. This is where researchers play an important role in finding such vulnerabilities before they can be exploited by hackers. Frankly I am quite sure that only a handful of these vulnerabilities are found and hackers always have something that may never be found.

In the recent HITBSecConf or the Hack In The Box Security Conference Altaf Shaik presented "4G to 5G: New Attacks". He along with Ravishankar Borgaonkar has been working to find out issues with security in cellular networks. In fact in the GSMA Mobile Security Hall of Fame, they both appear twice, individually.

From the talk narrative:

5G raises the security bar a level above 4G. Although IMSI exposure is prevented in 5G, we found new vulnerabilities to attack devices and subscribers. In this talk we expose a set of vulnerabilities in the 5G/4G protocols that are found in network operators equipment and also consumer devices such as phones, routers, latest IoT sensors, and even car modems. Our vulnerabilities affect several commercial applications and use cases that are active in 4G networks and are expected to take off in 5G networks. We developed automated tools to exploit the exposed cellular information and share some of our research traces and data sets to the community. We demonstrate a new class of hijacking, bidding down and battery draining attacks using low cost hardware and software tools. We did a rigorous testing worldwide to estimate the number of affected base stations and are surprised by the results. Finally our interactions with various vendors and standard bodies and easy fixes to prevent our attacks are discussed.

Slides and Video is embedded below

4G to 5G: New Attacks from 3G4G

Slides and Whitepaper can be downloaded from here.

Further Reading:

• Ravishankar Borgaonkar: New vulnerabilities in 5G Security Architecture & Countermeasures (Part 1)
• 3G4G: Security in Mobile Cellular Networks - Tutorial
• Dr. Anand R. Prasad: Evolution of Security from 4G to 5G
• GSMA Mobile Security Hall of Fame
• 4G LTE Man In The Middle Attacks With A Hacked Small Cells
• Presentations from ETSI Security Week 2019

5G Core Architecture Webinar from Apis

Apis Training has a new webinar on 5G Core. It's embedded below. It covers lots of ground from Network Architecture options to Slicing concepts, Virtualization, etc.

For people with only basic understanding of 5G, you may want to first start with the following, before jumping on to this webinar:

• Updated 5G Terminology Presentation
• Service Based Architecture (SBA) for 5G Core (5GC)

Related Posts:

• When does your 5G NSA Device Show 5G Icon?
• NTT Docomo: Bringing 5G to the Rugby World Cup
• 5G and Fixed-Mobile Convergence (FMC)
• How the Addition of 5G Radio Resources Increases the Complexity of LTE Signaling Procedures
• Opinion: What is "Real 5G" or "True 5G"
• The Politics of Standalone vs Non-Standalone 5G & 4G Speeds

When does your 5G NSA Device Show 5G Icon?

After I wrote about the 5G Icon Display back in February, I received lots of other useful and related materials, mostly from 3GPP standards delegates. Based on this updated information, I created a presentation and video called 'The 5G Icon Story'. Only recently did I realize that I didn't add it to the blog. So here it is.

And for people who are impatient and directly want to jump to the main point, it's UpperLayerIndication in SIB 2 as can be seen above.

The slides and video is embedded below.

Intermediate: The 5G Icon Story from 3G4G

Related Posts:

• Updated 5G Terminology Presentation (Feb 2019)
• Prof. Andy Sutton: 5G Radio Access Network Architecture Evolution - Jan 2019
• An Introduction to Non-Terrestrial Networks (NTN)
• 5G and Fixed-Mobile Convergence (FMC)

5G and Fixed-Mobile Convergence (FMC)

We recently made a new video looking at how 5G architecture caters for Trusted and Untrusted Wireless Access as well as Wireline Access. The presentation discusses:

• Untrusted non-3GPP access networks;
• Trusted non-3GPP access networks (TNAN);
• Wireline access networks;
• Non-5G-Capable over WLAN (N5CW);
• Access Traffic Steering, Switching and Splitting (ATSSS)

Slides and video embedded below.

Advanced: True Fixed-Mobile Convergence (FMC) with 5G from 3G4G

Related Posts:

• Exploring Network Convergence of Mobile, Broadband and Wi-Fi
• Introduction to 5G ATSSS - Access Traffic Steering, Switching and Splitting
• Operator Watch Blog: BT's Converged Core to Launch in 2023
• Tutorial: Service Based Architecture (SBA) for 5G Core (5GC)
• Updated 5G Terminology Presentation (Feb 2019)
• An Introduction to Non-Terrestrial Networks (NTN)
• 3G4G: 3GPP 5G Specifications
• 3G4G: 5G (IMT-2020) Wireless
• Opinion: What is "Real 5G" or "True 5G"
• The Politics of Standalone vs Non-Standalone 5G & 4G Speeds
• New 3GPP Release-17 Study Item on NR-Lite
• 5G SpeedTests and Theoretical Max Speeds Calculations

How the Addition of 5G Radio Resources Increases the Complexity of LTE Signaling Procedures

While everybody is excited about the growing number of 5G deployments and speed test results it is easy to forget that a highly reliable LTE core and radio access network is the prerequisite for 5G non-standalone (NSA) data transmission.

Indeed, the 5G radio resources are just added to the ongoing LTE connection to provide higher bandwidth that enables in turn higher throughput. In other words: the current 5G deployments are designed for and limited to the needs of enhanced Mobile Broadband (eMBB) traffic.

To boost the user experience a 4G and a 5G base station cooperate and bundle there joint resources in one radio connection. The whole scenario is known as E-UTRA-NR Dual Connectivity (EN-DC) and as a matter of fact this dual connectivity increases the complexity of the RAN signaling tremendously.

The figure below shows the two base stations involved in the radio connection. On the left side is the Master eNodeB (MeNB) that controls the entire signaling connection. On the right side sits the en-gNB, also called Secondary gNodeB (SgNB). The inconsistency of acronyms originates from 3GPP specs. 3GPP 37.340 "E-UTRA and NR Multi-connectivity" can be seen as an umbrella document that originally coined "MeNB" and "SgNB". However, when standarizing more details these acronyms have been replaced with Master Node (MN) and Secondary Node (SN) and the latter is named "en-gNB" when used in EN-DC scenarios. (Sure this spec has a lot more terms to offer an is a must-read for every acroynm enthusiast.)

However, these naming conventions defined in 3GPP 37.340 have not made it into the protocol specs, especially not into 3GPP 36.423 "X2 Application Part" that names its message set for enabling EN-DC consequently "SgNB ...." - as also shown in the figure.

By the way the SgNB should also not be imagined as a single network element. On the 5G side often a virtual RAN architecture is already deployed. In such a VRAN a gNB central unit (CU) controls several gNB distributed units (DUs) and multiple remote radio heads (RRHs) including the 5G antennas can be connected to each DU.

5G Radio Resource Addition in EN-DC Mode

Before 5G radio resources can be added to the connection a LTE RRC connection and at least a default bearer for the user plane including its GTP/IP-Tunnel between S-GW and eNB must have been successfully established.

The trigger for adding 5G resources to this call is mostly an inter-RAT measurement event B1 (not shown in the figure). However, also blind addition of a 5G cells have been observed in some cases where the 5G cell coverage is expected to overlap exactly the footprint of the LTE master cell. 

All in all, there can be a 1:1 mappig between 4G and 5G cells when antennas are mounted very close to each other and pointing into the same direction. However, it is also possible that several 5G small cells (especially when using FR2 frequency bands) are deployed to cover the footprint of a 4G macro cell. 

The end-to-end signaling that adds 5G resources to the connection starts with the X2AP SgNB Addition Request message (1). It contains information about the active E-RABs of the connection, UE NR capabilities and often the singal strenght of the 5G cell as measured before is included as well. The message triggers allocation of 5G radio resources in the SgNB.

Similar to a X2 handover procedure the X2AP SgNB Addition Request Acknowledge message (2) is used to transport a NR RRC CG-Config message (3) back to the MeNB where it is "translated" into NR RRC Connection Reconfiguration and NR RRC Radio Bearer Config messages that are sent to the UE enclosed in a LTE RRC Connection Reconfiguration message. In these messages beside the Cell Group ID the 5G PCI and the absolute SSB frequency (a synonym for NR ARFCN) are found. Both, 5G PCI and SSB frequency in combination represent the identity of a 5G cell "visible" for the UE on the physical 5G radio interface. 

To keep the figure more simple I have spared the "translation" process in MeNB and show instead as next step the combined LTE/NR RRC Connection Reconfiguration Complete (4) that is send by the UE back to the MeNB to confim activation of the 5G radio link. 

After this the UE and the SgNB are ready to the 5G resources for radio transmission. However, one important component is still missing: a new GTP/IP-Tunnel for transporting the payload from the core network's serving gateway (S-GW) to the SgNB. 

The gNB downlink transport layer address (gNB DL TLA) and its appropriate GTP Tunnel Endpoint Identifier (TEID) have been already to the MeNB in step (2). Indeed, there are some more TLAs and TEIDs found in this X2AP message, especially for data forwarding across the X2 user plane interface (not shown in figure).

The MeNB forwards the gNB DL TLA/TEID to the MME (6) where it is forwarded to the S-GW using GTP-C signaling in case the two core network elements are connected over S11 reference point. The uplink TLA/TEID on the S-GW side remain the same as assigned before during establishement of the E-RAB (not shown in figure). So the new tunnel is now ready to be used (7) and transmission of payload packet starts immediately. 

In step (8) the MME confirms the successful tunnel establishment to the MeNB.

To total duration of the entire procedure from step (1) to (8) sums up to slightly more than 100 ms under lab conditions and typically around 300 ms in the live network. 

This delay does not have a direct impact on user plane latency in the initial 5G setup phase. However, the subscriber experience might be different when it comes to inter-MeNB handover, because there is no direct handover between 5G neighbor cells. 

Changing the MeNB due to subscriber mobility means: release all 5G resources on the source (M)eNB side, perform intra-LTE handover to the target (M)eNB and add new 5G resources after handover is successfully completed. 

Opinion: What is "Real 5G" or "True 5G"

I made another opinion piece couple of weeks back. While it was shared already as part of some channels, here is it on the blog with serves as a permanent link. Video and slides below.

Opinion: What is “Real 5G”? (and “Real 4G”?) from 3G4G

As always, I welcome your opinions, comments & suggestions below.


Related Posts:

• Operator Watch Blog - Three UK: Bringing A True 5G Experience
• The 3G4G Blog - The Politics of Standalone vs Non-Standalone 5G & 4G Speeds
• Operator Watch Blog - UK MNO Mobile Spectrum Holdings
• The 3G4G Blog - 5G SpeedTests and Theoretical Max Speeds Calculations
• Operator Watch Blog - The Global Reach of Hutchison / '3' Group Mobile Telecom Companies
• The 3G4G Blog - Mobile Network Cell Tower Site Construction

LTE / 5G Broadcast Evolution

It's been a while since I last wrote about eMBMS. A report by GSA last month identified:
- 41 operators known to have been investing in eMBMS
- 5 operators have now deployed eMBMS or launched some sort of commercial service using eMBMS
- GSA identified 69 chipsets supporting eMBMS, and at least 59 devices that support eMBMS

#eMBMS
- 41 operators known to have been investing in eMBMS
- 5 operators have now deployed eMBMS or launched some sort of commercial service using eMBMS
- GSA identified 69 chipsets supporting eMBMS, and at least 59 devices that support eMBMShttps://t.co/EjjOH1tQxy pic.twitter.com/Gcc35BFC8H

— GSA (@gsacom) August 6, 2019

BBC R&D are testing the use of 4G/5G broadcast technology to deliver live radio services to members of the public as part of 5G RuralFirst - one of 6 projects funded under the UK Government’s 5G Phase 1 testbeds and trials programme (link).

A press release by Samsung Electronics back in May announced that it has signed an expansion contract with KT Corporation (KT) to provide public safety (PS-LTE) network solutions based on 3GPP standard Release 13 for 10 major metropolitan regions in South Korea including Seoul by 2020. One of the features of PS-LTE that the PR listed was LTE Broadcast (eMBMS): A feature which allows real time feeds to hundreds of devices simultaneously. It enables thousands of devices to be connected at once to transfer video, images and voice simultaneously using multicast technology

Dr. Belkacem Mouhouche – Samsung Electronics Chief Standards Engineer  and Technical Manager of 5G projects: 5G-Xcast and 5G-Tours Presented an excellent overview on this topic at IEEE 5G Summit Istanbul, June 2019. His presentation is embedded below.

Recent advances in Broadcasting standards and research from 3G4G

5G-Xcast is a 5GPPP Phase II project focused on Broadcast and Multicast Communication Enablers For the Fifth Generation of Wireless Systems.

They have a YouTube channel here and this video below is an introduction to project and the problems it looks to address.




Further Reading:

• GSA Report: LTE Broadcast (eMBMS) Market Update – July 2019
• GSA Snapshot: LTE Broadcast – eMBMS – Snapshot July 2019

Related posts:

• The 3G4G Blog: Multicast Operation on Demand (MooD) and Service Continuity for eMBMS
• Operator Watch Blog: Telstra's LTE-B Push
• Operator Watch Blog: Reliance Jio getting ready for LTE-Broadcast (eMBMS) rollout
• The 3G4G Blog: Mission Critical Services update from 3GPP - June 2017

The Politics of Standalone vs Non-Standalone 5G & 4G Speeds

A short video (and slides) discussing the operator dilemma of standalone (SA) vs non-standalone (NSA) 5G deployment, frequency refarming and why 4G speeds will start reducing once SA 5G starts to be deployed.

Video




Slides

Opinion: The Politics of SA vs NSA 5G & 4G Speeds from 3G4G

Related Posts:

• 5G SpeedTests and Theoretical Max Speeds Calculations
• New Tutorial on 5G Spectrum
• Updated 5G Terminology Presentation (Feb 2019)
• 3GPP 5G Standardization Update post RAN#84 (July 2019)

New 3GPP Release-17 Study Item on NR-Lite (a.k.a. NR-Light)

3GPP TSG RAN#84 was held from June 3 – 6, 2019 at Newport Beach, California. Along with a lot of other interesting topics for discussion, one of the new ones for Release-17 was called NR-Lite (not 5G-lite). Here are some of the things that was being discussed for the Study item.

In RP-190831, Nokia proposed:

• NR-Lite should address new use cases with IoT-type of requirements that cannot be met by eMTC and NB-IoT:
• Higher data rate & reliability and lower latency than eMTC & NB-IoT
• Lower cost/complexity and longer battery life than NR eMBB
• Wider coverage than URLLC
• Requirements and use cases –
• Data rates up to 100 Mbps to support e.g. live video feed, visual production control, process automation
• Latency of around [10-30] ms to support e.g. remote drone operation, cooperative farm machinery, time-critical sensing and feedback, remote vehicle operation
• Module cost comparable to LTE
• Coverage enhancement of [10-15]dB compared to URLLC
• Battery life [2-4X] longer than eMBB
• Enable single network to serve all uses in industrial environment
• URLLC, MBB & positioning

The spider chart on the right shows the requirements for different categories of devices like NB-IoT, eMTC (LTE-M), NR-LITE, URLLC and eMBB.

The understanding in the industry is that over the next 5 years, a lot of 4G spectrum, in addition to 2G/3G spectrum, would have been re-farmed for 5G. By introducing NR-Lite, there would be no requirement to maintain multiple RATs. Also, NR-Lite can take advantage of 5G system architecture and features such as slicing, flow-based QoS, etc.

Qualcomm's views in RP-190844 were very similar to those of Nokia's. In their presentation, the existing 5G devices are billed as 'Premium 5G UEs' while NR-Lite devices are described as 'Low tier 5G UEs'. This category is sub-divided into Industrial sensors/video monitoring, Low-end wearables and Relaxed IoT.

The presentation provides more details on PDCCH Design, Co-existence of premium and Low Tier UEs, Peak Power and Battery Life Optimizations, Contention-Based UL for Small Data Transmission, Relaying for Wearable and Mesh for Relaxed IoT

Ericsson's presentation described NR-Lite for Industrial Sensors and Wearables in RP-191047. RP-191048 was submitted as New SID (Study Item Description) on NR-Lite for Industrial Sensors and Wearables. The SID provides the following details:

The usage scenarios that have been identified for 5G are enhanced mobile broadband (eMBB), massive machine-type communication (mMTC), and time critical machine-type communication (cMTC). In particular, mMTC and cMTC are associated with novel IoT use cases that are targeted in vertical industries. 

In the 3GPP study on “self-evaluation towards IMT-2020 submission” it was confirmed that NB IoT and LTE M fulfill the IMT-2020 requirements for mMTC and can be certified as 5G technologies. For cMTC support, URLLC was introduced in Release 15 for both LTE and NR, and NR URLLC is further enhanced in Release 16 within the enhanced URLLC (eURLLC) and Industrial IoT work items.

One important objective of 5G is to enable connected industries. 5G connectivity can serve as catalyst for next wave of industrial transformation and digitalization, which improve flexibility, enhance productivity and efficiency, and improve operational safety. The transformed, digitalized, and connected industry is often referred to as Industry 4.0. Industrial sensors and actuators are prevalently used in many industries, already today. Vast varieties of sensors and actuators are also used in automotive, transport, power grid, logistics, and manufacturing industries. They are deployed for analytics, diagnostics, monitoring, asset tracking, process control, regulatory control, supervisory control, safety control, etc. It is desirable to connect these sensors and actuators to 5G networks. 

The massive industrial wireless sensor network (IWSN) use cases and requirements described in TR 22.804, TS 22.104 and TS 22.261 do include not only cMTC services with very high requirements, but also relatively low-end services with the requirement of small device form factors, and/or being completely wireless with a battery life of several years. 

The most low-end services could already be met by NB-IoT and LTE-M but there are, excluding URLLC, more high-end services that would be challenging. In summary, many industrial sensor requirements fall in-between the well-defined performance objectives which have driven the design of eMBB, URLLC, and mMTC. Thus, many of the industrial sensors have connectivity requirements that are not yet best served by the existing 3GPP NR technology components. Some of the aforementioned requirements of IWSN use cases are also applicable to other wide-area use cases, such as wearables. For example, smart watches or heath-monitoring wearables require small device form factors and wireless operation with weeks, months, or years of battery life, while not requiring the most demanding latency or data rates. 

IWSN and wearable use cases therefore can motivate the introduction of an NR-based solution. Moreover, there are other reasons why it is motivated to introduce a native NR solution for this use case: 

• It is desired to have a unified NR based solution.
• An NR solution could provide better coexistence with NR URLLC, e.g., allowing TDD configurations with better URLLC performance than LTE.
• An NR solution could provide more efficient coexistence with NR URLLC since the same numerology (e.g., SCS) can be adopted for the mMTC part and the URLLC part.
• An NR solution addresses all IMT-2020 5G frequency bands, including higher bands and TDD bands (in FR1 and FR2).

The intention with this study item is to study a UE feature and parameter list with lower end capabilities, relative to Release 15 eMBB or URLLC NR, and identify the requirements which shall be fulfilled. E.g., requirements on UE battery life, latency, reliability, connection density, data rate, UE complexity and form factor, etc.  If not available, new potential NR features for meeting these requirements should further be studied.

There were other description of the SID from Samsung, ZTE, etc. but I am not detailing them here. The main idea is to provide an insight for people who may be curious about this feature.


Related Posts:

• 3G4G Training: Introduction to NR-Light a.k.a. NR-Lite
• The 3G4G Blog - 3GPP 5G Standardization Update post RAN#84 (July 2019)
• The 3G4G Blog - Ultra Reliability: 5x9s (99.999%) in 3GPP Release-15 vs 6x9s (99.9999%) in 3GPP Release-16
• The 3G4G Blog - 5G SpeedTests and Theoretical Max Speeds Calculations
• The 3G4G Blog - Updated 5G Terminology Presentation (Feb 2019)

An Introduction to Non-Terrestrial Networks (NTN)

I made a short introductory tutorial explaining what is meant by Non-Terrestrial Networks. There is is lot of work on this that is planned for Release-17. Slides and video below.

Beginners: Non Terrestrial Networks (NTN) from 3G4G

Related Posts:

• Connectivity Technology Blog: TIP has launched 'Non-Terrestrial Connectivity Solutions' Group
• The 3G4G Blog: Connectivity on Planes
• The 3G4G Blog: Satellites & Non-terrestrial networks (NTN) in 5G
• 3G4G Small Cells Blog: Flying Small Cells are here...

6G: Above 100 GHz and Terahertz (THz) Frequencies

A new research paper  "Wireless Communications and Applications Above 100 GHz: Opportunities and Challenges for 6G and Beyond" by T. S. Rappaport et al. is available on IEEE website here.

With 5G, we are still solving the challenges of millimeter waves (mmWaves) so it is surprising for most people to hear that there is a research going on beyond 100 GHz and in THz frequencies. Quoting from the abstract of the paper:

The paper describes many of the technical challenges and opportunities for wireless communication and sensing applications above 100 GHz, and presents a number of promising discoveries, novel approaches, and recent results that will aid in the development and implementation of the sixth generation (6G) of wireless networks, and beyond. It also shows recent regulatory and standard body rulings that are anticipating wireless products and services above 100 GHz and illustrates the viability of wireless cognition, hyper-accurate position location, sensing, and imaging. The paper also presents approaches and results that show how long distance mobile communications will be supported to above 800 GHz since the antenna gains are able to overcome air-induced attenuation, and present methods that reduce the computational complexity and simplify the signal processing used in adaptive antenna arrays, by exploiting the Special Theory of Relativity to create a cone of silence in over-sampled antenna arrays that improve performance for digital phased array antennas. Also, new results that give insights into power efcient beam steering algorithms, and new propagation and partition loss models above 100 GHz are given, and promising imaging, array processing, and position location results are presented. The implementation of spatial consistency at THz frequencies, an important component of channel modeling that considers minute changes and correlations over space, is also discussed. This paper offers the first in-depth look at the vast applications of THz wireless products and applications and provides approaches for how to reduce power and increase performance across several problem domains, giving early evidence that THz techniques are compelling and available for future wireless communications.


At Brooklyn 5G Summit 2019, NYU Wireless founder and director, Dr. Ted Rappaport, presented a keynote on his vision beyond 5G, looking at both electronics and photonics, considering applications over 100GHz, channel models, and said that he expects brain-comparative data rate transmission wirelessly over the air in future networks. The keynote is embedded as video above.

Another keynote by Gerhard Fettweis from TU Dresden, talks about terahertz starting off with a look back at the history of mobile network generations up to 5G and looking ahead to 6G. Anticipating the tactile internet revolution to come, he considers the technicalities such as spectrum, channels, efficiency and adaptability needed to achieve the expected level of computing. That keynote can be viewed here.

Related Posts and articles:

• Terahertz and Beyond 100 GHz progress
• New Tutorial on 5G Spectrum
• Keynote: Gerhard Fettweis - Terahertz Communication - B5GS 2019
• After 5G, where do we go? - Steve Taranovich, Planet Analog

5G SpeedTests and Theoretical Max Speeds Calculations

Right now, Speed Tests are being described as 5G killer apps.

SpeedTests are the 5G killer app right now 😂. Thread 👇 https://t.co/jjyk0PheT6

— 3G4G (@3g4gUK) July 2, 2019

A good point by Benedict Evans

What was the killer app for 3G? The internet. What’s the killer app for 5G? More internet, mostly.

— Benedict Evans (@benedictevans) January 18, 2019

Everyone is excited and want to see how fast 5G networks can go. If you use Twitter, you will notice loads and loads of speed tests being done on 5G. An example can be seen above.

I recently heard Phil Sheppard, Director of Strategy & Architecture, '3 UK' speak about their 5G launch that is coming up soon. Phil clearly mentioned that because they have a lot more spectrum (see Operator Watch blog post here and here) in Capacity Layer, their 5G network would be faster than the other UK operators. He also provided rough real world Peak Speeds for Three and other operators as can be seen above. Of course the real world speeds greatly depend on what else is going on in the network and in the cell so this is just a guideline rather than actual advertised speeds.

I have explained multiple times that all 5G networks being rolled out today are Non-Stand Alone (NSA) 5G networks. If you don't know what SA and NSA 5G networks are, check this out. As you can see, the 5G NSA networks are actually 4G Carrier Aggregated Networks + 5G Carrier Aggregated Networks. Not all 4G spectrum will be usable in 5G networks but let's assume it is.

To calculate the theoretical maximum speed of 5G NSA networks, we can calculate the theoretical maximum 4G Network speeds + theoretical maximum 5G Network speeds.

I have looked at theoretical calculation of max LTE Carrier Aggregated Speeds here. Won't do calculation here but assuming 3CA for any network is quite possible.

I also looked at theoretical calculation of 5G FDD New Radio here but then found a website that helps with 5G NR calculation here.

If we calculate just the 5G part, looking at the picture from Three, we can see that they list BT/EE & O2 speeds as 0.61 Gbps or 610 Mbps, just for the 5G part.

Looking at the calculation, if we Input Theoretical max values in this equation:

Calculating just for DL

J - number of aggregated component carriers,
maximum number (3GPP 38.802): 16
input value: 1

v(j)Layers - maximum number of MIMO layers ,
3GPP 38.802: maximum 8 in DL, maximum 4 in UL
input value: 8

Q(j)m modulation order (3GPP 38.804)
For UL and DL Q(j)m is same (QPSK-2, 16QAM-4, 64QAM-6, 256QAM-8)
input value: 8 (256QAM)

f(j) Scaling factor (3GPP 38.306)
input value: 1

FR(j) Frequency Range 3GPP 38.104:
FR1 (450 MHz – 6000 MHz) и FR2 (24250 MHz – 52600 MHz)
input value: FR1

µ(j) -value of carrier configuration (3GPP 38.211)
For DL and UL µ(j) is same (µ(0)=15kHz, µ(1)=30kHz, µ(2)=60kHz, µ(3)=120kHz)
input value: 0 (15kHz)

BW(j)- band Bandwidth, MHz (3GPP 38.104),
should be selected with Frequency Range and µ(i) configuration:
input value: BW:40MHz FR1 µ:15kHz:

Enter a PRB value (if other)
default: 0

Rmax (if you don't know what is it, don't change)
Value depends on the type of coding from 3GPP 38.212
(For LDPC code maximum number is 948/1024 = 0.92578125)
default: 0.92578125

*** Only for TDD ***
Part of the Slots allocated for DL in TDD mode,
where 1 = 100% of Slots (3GPP 38.213, taking into account Flexible slots).
Calculated as: the number of time Slots for DL divided by 14
default value: 0.857142

Part of the Slots allocated for UL in TDD mode,
where 1 = 100% of Slots (3GPP 38.213, taking into account Flexible slots).
Calculated as: 1 minus number of Slots for DL
default value: 0.14285800000000004

Calculated 5G NR Throughput, Mbps: 1584


As you may have noticed, BTE/EE has 40 MHz spectrum while Vodafone in UK have 50 MHz of spectrum.

Changing
BW(j)- band Bandwidth, MHz (3GPP 38.104),
should be selected with Frequency Range and µ(i) configuration:
input value: BW:50MHz FR1 µ:15kHz:

Calculated 5G NR Throughput, Mbps: 1982

Now Three UK has 100 MHz, immediately available for use. So changing

µ(j) -value of carrier configuration (3GPP 38.211)
For DL and UL µ(j) is same (µ(0)=15kHz, µ(1)=30kHz, µ(2)=60kHz, µ(3)=120kHz)
input value: 1 (30kHz)

BW(j)- band Bandwidth, MHz (3GPP 38.104),
should be selected with Frequency Range and µ(i) configuration:
BW:100MHz FR1 µ:30kHz:


Calculated 5G NR Throughput, Mbps: 4006

In theory, a lot of speed is possible with the 100 MHz bandwidth that Three will be able to use. We will have to wait and see who can do a theoretical max SpeedTest. In the meantime remember that a 1Gbps speed test will use over 1 GB of data.



Related Posts:

• Tutorial on 5G Spectrum
• Theoretical Throughput Calculation of FDD 5G New Radio (NR)
• Theoretical calculation of EE's announcement for 429Mbps throughput

5G and Electromagnetic energy (EME)

Every time a new generation of mobile technology is being rolled out, there are scare stories about the radiation, cancer, etc. I last wrote a post on this topic back in 2011 and also in 2009. The main thing that has changed since is that 5G is being rolled out today as 4G was being rolled out then.

The Australian operator Telstra recently completed extensive testing of their 5G network infrastructure in real-world settings using commercially available 5G devices, and their data confirms two things. Firstly, the 5G technology produces electromagnetic energy (EME) levels at around 1000 times below the safety limits in many cases. Secondly, all the testing has found 5G EME levels to be similar to 3G, 4G and Wi-Fi. You can read the details and complete report here.

Last month I went to a seminar titled 'Update on Current Knowledge of RF Safety', organised by CW Radio Technology Group and National Register of RF Workers. Richard Hargrave from BT explained the challenge with compliance when a 5G carrier is added.

The implications as he said are:

• Some sites in urban areas become increasingly difficult to provide required capacity while maintaining compliance using standard designs
• Significant time and cost can be associated with works necessary to ensure compliance – new planning permissions, physical structures, new site acquisition etc
• As 5G is deployed further, particularly as additional spectrum is auctioned in 700MHz and 3.6-3.8GHz bands these problems will be exacerbated

His presentation is available here. Another presentation from Moray Rumney, asking some tough question on 5G safety is available here. Simon Rockman has written a summary of this seminar on Forbes, here.

I heard the Swiss operator Sunrise mentioning in a presentation at 5G World 2019 that the EMF limit in Switzerland is 10 times stricter than the rest of the world. This implies that 5G in Switzerland is extremely safe. The slide from the presentation can be seen in the pic above.

We also have couple of related videos on this topic, maybe of interest:

• Non millimeter Wave (mmWave) 5G
• 5G Spectrum - Short Version
• 5G Spectrum - Long Version

Further Reading:

• Electromagnetic energy (EME) - Telstra Consumer Advice
• 5 surveys of 5G show EME levels well below safety limits - Telstra
• Is 5G Dangerous? - Simon Rockman, Forbes
• 5G Dangers: Myth or Science? - Apis Training
• 5G health risks: What's the evidence? - BBC

3GPP 5G Standardization Update post RAN#84 (July 2019)

3GPP recently conducted a webinar with Balazs Bertenyi, Chairman of 3GPP RAN in which he goes through some of the key features for 5G Phase 2. The webinar also goes through the details of 5G Release-15 completion, status of Release-16 and a preview of some of Release-17 features.

Slides & video embedded below. Slides can be downloaded from 3GPP website here.

3GPP Webinar: 5G Standardization update from 3G4G

Related Posts:

• The 3G4G Blog - New 3GPP Release-17 Study Item on NR-Lite
• 3GPP Release-16, Release-17 & Beyond...
• Non-public networks (NPN) - Private Networks by another name
• Evolution of Security from 4G to 5G
• Update from 3GPP on LTE & 5G Mission Critical Communications
• Updated 5G Terminology Presentation (Feb 2019)

Presentations from ETSI Security Week 2019 (#ETSISecurityWeek)

ETSI held their annual Security Week Seminar 17-21 June at their HQ in Sophia Antipolis, France. All the presentations are available here. Here are some I think the audience of this blog will like:

• ETSI Explainer: Overview of Quantum-Safe VPN Techniques
• ETSI Explainer: OneM2M security and Access Control (Rel.3)
• Toward a Safe Quantum Future - Michele Mosca, University of Waterloo
• Cybersecurity Challenges to Europe: Research, Policy and Standardization Effort - Fabio Di Franco, ETSI Cyber Security Landscape
• GSMA: Mobile Telecommunications Security Threat Landscape
• Hacked by Crypto - Bret Jordan, Symantec (Some good details regarding TLS, DNS, ESNI, QUIC, etc.)
• The Automotive Cyber-Threat: What the Future Will Bring Us? - Alain Baritault, iotaBEAM
• What is the Cyber Territory of a Country? - Silke Holtmanns, Nokia Bell Labs
• EU Cybersecurity Act - Martin Schaffer, SGS
• The Impact of ePrivacy Regulation to Cyber-Intelligence: Options to Consider - Ilias Chantzos, Symantec
• Applying AI to Protect 5G Control Traffic - Antonio Pastor, Telefonica I+D
• Applying AI to Detect and Hunt Advanced Attackers - Matt Walmsley, Vectra
• “Real World Adoption of AI in the Field” - Patrick Donegan, HardenStance
• 5G Providing the Secure Platform for Digitalization of Enterprises and Society - Mats Nilsson, Ericsson
• 3GPP 5G Security Vendor’s View - Marcus Wong, Futurewei Technologies (Huawei)
• 5G Security Challenges for Verticals - a Standards View - Ali Rezaki & Anja Jerichow, Nokia Bell Labs
• 5G and other stories: evolving security in an evolving world
• Challenges in Securing the IoT in a Post-Quantum World - Louis Parks, SecureRF
• SIMs, eSIMs and Secure Elements - Remy Cricco, SIMalliance
• Integrated SIMs: The next after Embedded SIM - Dr. Stephan Spitz, IAR Systems
• Deception for Continued Technical Assurance, Alex Tarter, Thales 

New abbreviation for private 5G networks - Non-Public Network (NPN) and security benefits to connected industries and automation cc @3g4gUK #EtsiSecurityWeek pic.twitter.com/Zias9e4XQ6

— Ravishankar Borgaonk (@raviborgaonkar) June 20, 2019

Looks like all presentations were not shared but the ones shared have lots of useful information.


Related Posts:

• Non-public networks (NPN) - Private Networks by another name
• 5G and IoT Security Update from ETSI Security Week 2018
• 5G Security Updates - July 2017
• Telcos: Security Is Not In Your DNA - Patrick Donegan, Principal Analyst, HardenStance

Finland: A country with only Unlimited Data Plans

I was listening to Elisa couple of weeks back, at 5G World Summit. One of the things that surprised me was that Elisa offered unlimited data plans but the price varied based on the maximum speeds possible. The same approach was going to continue with 5G. When 5G data speeds would improve, new packages will be added with the improved speeds.

"There's no revenue upside with unlimited mobile data", say operators with bucket plans. Funny then that the all-unlimited Finnish MNOs @ElisaOyj @teliafinland @DNA_fi all had increasing ARPU in 2018 - in contrast to almost all mature market operators solely offering buckets.

— tefficient 🚥 (@tefficient) March 4, 2019

Tefficient has pointed out multiple times that even though all operators in Finland offer unlimited data plans, their ARPU has increased in 2018. This is in contrast to the other mature markets, even though they may not be offering unlimited data plans.

"Finnish operators that executed ‘unlimited everything’ strategies were the undisputed champions of the 4G era" #Rewheel https://t.co/APZXMXj7EH

— Pal Zarandy (@PZarandy) May 23, 2019

Same thing was pointed out by Rewheel research that highlighted in their May 2019 report that, "Finnish operators that executed ‘unlimited everything’ strategies were the undisputed champions of the 4G era"

A mashable article pointed out that "5G will be crazy fast, but it'll be worthless without unlimited data". This is very true.

When people talk about 8K video over 5G, most of them don't realise that it would consume roughly 7-10 GB data per hour on 8K video.

This article from @howtogeek - https://t.co/xSxvaMwKY4 shows some good calculations of up to 4K video pic.twitter.com/anJhNfUMtV

— Zahid Ghadialy (@zahidtg) June 15, 2019

Mobile operators should start thinking about how they can offer unlimited data plans, especially if they keep touting applications that are going to use loads of data. As you can see from the tweet above, a 1 hour 8K video streaming would roughly use between 7 - 10 GB of data.

Let me know your thoughts.

3GPP Release-16, Release-17 & Beyond...

6G Summit featured quite a few talks from people looking at evolution beyond Release-16. The future releases will still be 5G, maybe become 5.5G, like 3GPP Release-13 which was known as LTE-Advanced Pro officially was unofficially known as 4.5G.

Back at the 6G Summit in Finland, Dr. Peiying Zhu from Huawei looked at the topics being discussed for Release-17 and beyond.

Thanks to Mika Klemettinen for sharing the pictures on Twitter, as the presentation was not shared.

3GPP is working towards defining Release-16. TS 21.916 - Release description; Release 16 is still not yet available on the 3GPP reflector. Once that is available, we will know for sure about all the Rel-16 changes. Release-17 is long way away. Having said that, there is no shortage of discussions as some of these Rel-17 features were discussed in the recent RAN Plenary.

Jungwon Lee, VP, Samsung also shared a summary of 3GPP Release-16 and Rel-17 features at IEEE 5G Summit in San Diego recently. Quite a few interesting features in all the pictures above that we will no doubt look at in the future posts.

3GPP also shared a presentation recently (embedded below), looking at not only Release-15 & 16 but also looking at focus areas for Release-17

5G Standards: 3GPP Release 15, 16, and beyond from 3G4G

Related Posts and Articles:

• The 3G4G Blog - Ultra Reliability: 5x9s (99.999%) in 3GPP Release-15 vs 6x9s (99.9999%) in 3GPP Release-16
• The 3G4G Blog - Update from 3GPP on LTE & 5G Mission Critical Communications
• 3GPP - Release 16
• Light Reading - 5G Standards Group Struggles to Balance Tech With Politics
• Eiko Seidel - 5G Mission Critical Networks (Proximity Services in Rel.17)
• The 3G4G Blog - Slides and Videos from the 1st 6G Wireless Summit - March 2019
• The 3G4G Blog - Couple of talks by NTT Docomo on 5G and Beyond (pre-6G)
• The 3G4G Blog - China Telecom: An examination of the current industrial trends and an outlook of 6G
• Mission Critical Communications: Mission-Critical Features for Release 17 Discussed at Latest 3GPP Meetings

New Tutorial on 5G Spectrum

We made a new tutorial on 5G spectrum. It's in 2 different formats. Short version (~13 mins) or Long version (~31 mins). Instead of embedding the slides/videos here, I am providing links to the 5G section on 3G4G page below.

Short Version (~13 mins) - click here

Long Version (~31 mins) - click here


Related posts:

• Examples of 5G Use Cases & Applications
• Bandwidth Part (BWP) in 5G New Radio (NR)
• When will 2G & 3G be switched off now that 5G is here?
• Couple of talks by NTT Docomo on 5G and Beyond (pre-6G)
• Slides and Videos from the 1st 6G Wireless Summit - March 2019
• Slides from Parallel Wireless Webinar: 5G at #MWC19

Couple of talks by NTT Docomo on 5G and Beyond (pre-6G)

The Japanese operator, NTT Docomo is a very bold MNO. Not only do they do interesting research but they are very open about what they have been doing and share it publicly. For example, last month they announced development of a safe, blade-free drone propelled by Ultrasonic Vibrations (tweet). This was just amazing as it has a potential to use drones in many new areas where the conventional drones are deemed too dangerous. This is why I was very pleased to see couple of talks by Docomo available online.

The first one is by Takehiro Nakamura, SVP and General Manager of the 5G Laboratories in NTT DOCOMO, Inc. at the 6G Summit in Finland. Slides available here. Video embedded below




The next one is by Seizo Onoe, Chief Technology Architect, NTT DOCOMO, INC. and President, DOCOMO Technology, Inc. from Brooklyn 5G Summit. Unfortunately the slides are not shared but the video is worth a watch below.

3G4G Small Cells Blog: NTT Docomo's Underground LTE Small Cells with possibility to deploy 5G in future - https://t.co/9Ud6FyqcFz #SmallCells pic.twitter.com/GOlpih2RmY

— Zahid Ghadialy (@zahidtg) April 14, 2018

Related Posts:

• NTT Docomo's Green Base Stations
• Nice short articles on 5G in 25th Anniversary Special NTT Docomo Technical Journal
• Terahertz and Beyond 100 GHz progress
• 100 Gbps wireless transmission using Orbital Angular Momentum (OAM) multiplexing
• Examples of 5G Use Cases & Applications
• Telus says 5G is just another 'G' (#5GJAG)
• Sprint Keynote from #B5GS 2019 - Power of Massive MIMO and Band 41 5G NR
• China Telecom: An examination of the current industrial trends and an outlook of 6G

Bandwidth Part (BWP) in 5G New Radio (NR)

I made a short tutorial explaining the concept of Bandwidth Part in 5G a while back. Slides and video embedded below.

Intermediate: Bandwidth Parts (BWP) from 3G4G

Further Reading:

• Understanding 5G New Radio Bandwidth Parts - Keysight
• 5G/NR - Carrier Bandwidth Part - ShareTechNote
• 5G NR Bandwidth Part (BWP) - TechPlayOn