Bug hunting in 5G Networks and Devices

Pentests or Penetration testing is ethical hacking that is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system. They are performed to identify weaknesses or vulnerabilities, including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed.

Sébastien Dudek, Founder and Security Engineer at PentHertz did a presentation at No Hat conference 2021. The outline of his talk says:

Expected to be released in 2021, we only see the early stage of 5G-NR connectivity in rare places around the world and we cannot talk yet about "real 5G" as current installations are put on the Non-Standalone mode (NSA) using 4G infrastructures. But in the meantime, it is important to get prepared for this upcoming technology and ways we can practically simulate real-world attacks in the future, with Standalone (SA) mode-capable devices and networks. In this presentation, we will see how to conduct practical security assignments on future 5G SA devices and networks, and how to investigate the protocol stack. To begin the presentation, we briefly present the differences with 2G-5G in terms of security applied to security assessment contexts, i.e. the limit we are left with, and how to circumvent them. Then we see how a 5G-NR security testbed looks like, and discuss what type of bugs are interesting to spot. Third, we make more sense about some attacks on devices by showing attacks that could be performed on the core side from the outside. Finally, we briefly introduce how we could move forward by looking at the 5G protocol stack and the state of the current mean.

Slides are available here and the video is embedded below:

A post on their website also looks at penetration of standalone 5G core. The post contains a video as well which can also be directly accessed here.

A new white paper from 5G Americas provides nearly annual updates around the topic of security in wireless cellular networks. The current edition addresses emerging challenges and opportunities, making recommendations for securing 5G networks in the context of the evolution to cloud-based and distributed networks. 

New whitepaper from 5G Americas, 'Security for 5G' provides a good overview of security in 3GPP Rel-15 & 16 - https://t.co/z0SxZUTWRK#Free5Gtraining #5GAmericas #5G #5GTechnology #5GSecurity #5GCore #SBA #Security #OpenRAN #SuuplyChain #Transportation #ZTN #APIs pic.twitter.com/fnWCIArTFv

— Free 5G Training (@5Gtraining) December 13, 2021

Additionally, the white paper provides insight into securing 5G in private, public, and hybrid cloud deployment models. Topics such as orchestration, automation, cloud-native security, and application programming interface (API) security are addressed. The transition from perimeter-based security to a zero-trust architecture to protect assets and data from external and internal threats is also discussed.

Related Posts: 

• 3G4G: 5G Security Overview by Mpirical
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Impact of 5G on Lawful Interception and Law Enforcement
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• 3G4G: Security in 2G, 3G, 4G & 5G Mobile Networks
• Free 6G Training: 6G Security Considerations 

3GPP Release-18 Work Moves Into Focus as Release-17 Reaches Maturity

In early December 2021, 3GPP reached a consensus on the scope of 5G NR Release-18. With the 3GPP Rel-17 functional freeze set for March 2022, Release-18 work is moving into focus. This is being billed as a significant milestone marking the beginning of 5G Advanced — the second wave of wireless innovations that will fulfil the 5G vision. Release 18 is expected to build on the solid foundation set by 3GPP Releases 15, 16, and 17, and it sets the longer-term evolution direction of 5G and beyond.

(click on the image to enlarge - PDF here)

The 3GPP Release-18 page has a concise summary of all that you need to know, including the timeline. For anyone interested in going through features one-by-one, start navigating from here, select Rel-18 from the top.

New white paper from Nokia, "5G-Advanced: Expanding 5G for the connected world" - https://t.co/7HADpzHhAS #Free5Gtraining #3G4G5G #3GPP #Release18 #5G #5GAdvanced #5GTechnology #5GNetworks #5Gexperience #5Gextension #5Gexpansion #OperationalExcellence #XR #WWC #NetworkSlicing pic.twitter.com/6CYyKPp1Ff

— Free 5G Training (@5Gtraining) January 21, 2022

For others who may be more interested in summary rather than a lot of details, here are some good links to navigate:

• Nokia whitepaper - 5G-Advanced: Expanding 5G for the connected world (link)
• Paper by Ericsson researcher, Xingqin Lin, 'An Overview of 5G Advanced Evolution in 3GPP Release 18' (link)
• Marcin Dryjański, Rimedo Labs - 3GPP Rel-18: 5G-Advanced RAN Features (link)
• Bevin Fletcher, FierceWireless: Next 3GPP standard tees up 5G Advanced (link)

As always, Qualcomm has a fantastic summary of 5G evolution and features in 3GPP Release-18 on their page here. The image above nicely shows the evolution of 5G from Release-15 all the way to Release-18. The image below shows a summary of 3GPP Release-18, 5G-Advanced features.

They also hosted a webinar with RCR wireless. The webinar is embedded below.

The slides can be downloaded from GSA website (account required, free to register) here.

Related Posts: 

• The 3G4G Blog: Will Wi-Fi Help 3GPP Bring Reliable Connectivity Indoors?
• The 3G4G Blog: 3GPP Presentations from CEATEC Japan 2021
• The 3G4G Blog: 5G-Advanced Flagship Features
• The 3G4G Blog: An Early View of 3GPP Release-18 5G-Advanced Topics
• The 3G4G Blog: 3GPP's 5G-Advanced Workshop Summary
• The 3G4G Blog: 3GPP's 5G-Advanced Technology Evolution from a Network Perspective Whitepaper
• The 3G4G Blog: '5G RAN Release 18 for Industry Verticals' Webinar Highlights
• The 3G4G Blog: 3GPP RAN Plenary Update and Evolution towards 5G-Advanced
• The 3G4G Blog: Initiative to Remove Non-inclusive terms from 3GPP Specifications
• The 3G4G Blog: 3GPP Release 16 Description and Summary of Work Items
• The 3G4G Blog: 3GPP Standards on Edge Computing
• The 3G4G Blog: Artificial Intelligence (AI) / Machine Learning (ML) in 5G Challenge by ITU
• The 3G4G Blog: ITU Standardization Bureau on Machine Learning for 5G
• The 3G4G Blog: Introduction to 5G Reduced Capability (RedCap) Devices
• The 3G4G Blog: 5G eXtended Reality (5G-XR) in 5G System (5GS)
• The 3G4G Blog: Energy Consumption in Mobile Networks and RAN Power Saving Schemes 

3GPP 5G Non Terrestrial Networks (NTN) Standardization Update

We have looked at 5G Non Terrestrial Networks (NTN) in many different posts in our blogs. If you are new to this topic then this tutorial with a video is a good place to start or just follow this IEEE Comsoc article or this short update from R&S here.

Nicolas Chuberre is the rapporteur of the NR_NTN_solutions work item (TSG RAN) and of the FS-5GET study item (WG SA1) from Thales Alenia Space. In the October 2021 issue of 3GPP Highlights newsletter, he along with Munira Jaffar, Lead delegate representing EchoStar and Hughes Standards in ESOA (EMEA Satellite Operators Association) Standards Working Group, wrote a summary of 'Status of NTN & Satellite in 3GPP Releases 17 & 18'.

Quoting from the article:

The approval of normative activities on Non-Terrestrial Networks (NTN) in Rel-17 has generated growing interest in the topic. The Rel-17 NTN work items are supported by a wide range of vendors (terminal, chipset, network), as well as service providers from both the mobile and space industries and vertical user groups including ESOA.

The Rel-17 NTN and satellite work items in Technical Specification Group (TSG) RAN and TSG SA have been progressing towards the goal of satellite inclusion in 3GPP technical specifications. The focus is on transparent payload architecture with FDD systems where all UEs are assumed to have GNSS capabilities. The normative phase includes adaptation to the physical & access layer aspects, radio access network and system architecture, radio resource management, and RF requirements for targeted satellite networks operating at LEO, MEO or GEO orbits.

With an expected completion date of March 2022, the 3GPP Rel-17 specifications will support New Radio (NR) based satellite access deployed in FR1 bands serving handheld devices for global service continuity. Equally exciting, the 3GPP Rel-17 specification will support NB-IoT and eMTC based satellite access to address massive Internet of Things (IoT) use cases in areas such as agriculture, transport, logistics and many more. 

This joint effort between mobile and satellite industries will enable the full integration of satellite in the 3GPP ecosystem and define a global standard for future satellite networks. This will address the challenges of reachability and service continuity in unserved/underserved areas, enhance reliability through connectivity between various access technologies, and improve network resilience and dependability in responding to natural and manmade disasters.

Upon completion of Rel-17 the long-awaited standard for satellite networks serving handheld devices should be in place by 2022, with commercial product availability expected sometime in 2024. Including satellite as part of the 3GPP specifications will support the promise of worldwide access to 5G services and drive explosive growth in the satellite industry. 

Looking ahead, ESOA members and other NTN stakeholders have started discussions during the 3GPP Rel-18 June workshop and are continuing to work on a further list of enhancements for both NR-NTN and IoT-NTN to be considered in Rel-18. Plans are also underway to further define the enablers for NR based satellite access in bands above 10 GHz to serve fixed and moving platforms (e.g., aircraft, vessels, UAVs) as well as building- mounted devices (e.g., businesses and premises). The goal of these efforts is to further optimize satellite access performance, address new bands with their specific regulatory requirements, and support new capabilities and services as the evolution of 5G continues.

At Mobile Korea 2021, Nicolas Chuberre gave a talk on '3GPP NTN standardization: past, current and future'. The talk nicely summarizes Release-17 progress and the features planned for 3GPP Release-18. His talk is embedded below:

Related Posts:

• Free 6G Training: Huawei explains Perspectives and Challenges of 6G-NTN
• Connectivity Technology Blog: OneWeb presents their Vision for LEO Satellites and 6G Connectivity
• Connectivity Technology Blog: SoftBank to Promote Non-Terrestrial Network (NTN) Solutions
• Connectivity Technology Blog: 5G Ready' OneWeb Megaconstellation is Getting Ready for Commercial Launch
• Connectivity Technology Blog: ITU Satellite Webinars 2020
• Connectivity Technology Blog: OneWeb has Global Connectivity Ambitions
• Connectivity Technology Blog: R&S Technical Explainer on 3GPP 5G Non Terrestrial Networks (NTN)
• IEEE Comsoc: Connectivity From Top to Bottom
• The 3G4G Blog: An Introduction to Non-Terrestrial Networks (NTN) 

An Introduction to Minimization of Drive Testing (MDT)

Over the last few years, Ralf Kreher has done some fantastic posts on Minimization of Drive Testing (MDT) on this blog (links at the bottom of this post). To complement that, here is a basic introductory tutorial looking at what exactly is meant by MDT and how it's done. 

Video embedded below:

The slides from the presentation are available here.

Please check out our 3GPP SON Series videos here.

Related Posts:

• The 3G4G Blog: 3GPP MDT - How it works and what is new in Rel. 16
• The 3G4G Blog: 3GPP Minimization of Drive Test (MDT) Signaling at a Glance
• The 3G4G Blog: LTE Physical Layer Measurements of RSRP and RSRQ
• The 3G4G Blog: RRC Signalling in Rel-10 for MDT
• 3G4G: 3GPP SON Series
• 3G4G: Self-Organizing Networks / Self-Optimizing Networks (SON) 

What is RF Front-End (RFFE) and why is it so Important?

As more technologies, frequency bands, antennas, etc., are crammed in our smartphones and tablets, it becomes essential for these devices to keep performing despite what technologies and spectrum are in use at any instant of time. This requires specialist design of the RF front end in our devices. Wikipedia explains it as:

In a radio receiver circuit, the RF front end, short for radio frequency front end, is a generic term for all the circuitry between a receiver's antenna input up to and including the mixer stage. It consists of all the components in the receiver that process the signal at the original incoming radio frequency (RF), before it is converted to a lower intermediate frequency (IF). In microwave and satellite receivers it is often called the low-noise block downconverter (LNB) and is often located at the antenna, so that the signal from the antenna can be transferred to the rest of the receiver at the more easily handled intermediate frequency.

🔸RFFE revenues should also grow at a rapid clip with proliferation of 5G & 5G mmWave in coming years
🔸 The RF Semi $ content per device will rise and drive the RFFE segment.
🔸 Will be interesting to see if Qualcomm can get more design wins at Apple over next two yr window. pic.twitter.com/9hKrQYpwI4

— Neil Shah (@neiltwitz) July 29, 2021

Qualcomm is very active in this area as can be seen from the chart in the Tweet above. Back in October, Qualcomm announced ultraBAW, their new generation of micro acoustic filter technology that expands their RF front-end (RFFE) portfolio and opens up new 5G services and applications. They have a short intro video explaining RFFE:

Apple bought ~$14 billion worth of baseband, RF front-end (RFFE) and connectivity chips from Broadcom, Qorvo, Qualcomm and Skyworks in 2021.

That means ~$55 worth of baseband + RFFE + connectivity content per iPhone.$AVGO $QCOM $QRVO $SWKS

— Sravan Kundojjala (@SKundojjala) December 18, 2021

It is also interesting to see from the Tweet above that on an average baseband + RFFE + connectivity chips cost Apple nearly $55 per device.

The analyst firm CCS Insight have also done some good work explaining RFFE and their analyst Wayne Lam has written a few detailed articles on this topic. Here are the links if you want to read further:

• Advances in RF Front-Ends Made 5G Phones Possible (link)
• Advances in 5G RF Front-Ends Lead to Longer Battery Life (link)

Their RFFE videos playlist is embedded below.

Also worth noting that a good modem and RF front-end, especially with 5G, can make a lot of difference in what speeds and coverage you can get

Sometimes I forget the value of having a good modem and RF front-end having an S21 Ultra and then I compare my mid-band coverage on @TMobile to people next to me with an iPhone 13 and Pixel 5 and they don't get remotely the same speeds or coverage.

— Anshel Sag (@anshelsag) December 26, 2021

Related Posts:

• Telecoms Infrastructure Blog: Open RAN (O-RAN) RRU (O-RU) and DU (O-DU) Design
• The 3G4G Blog - Radio Design Webinar: Optimising Your 700 MHz Deployments
• The 3G4G Blog: Envelope Tracking for improving PA efficiency of mobile devices 

Impact of 5G on Lawful Interception and Law Enforcement.

At Telecoms Europe 5G 2021 event, David Anstiss, Senior Solutions Architect, SS8 Networks gave a talk on Impact of 5G on lawful interception and law enforcement. The talk provided an insight in​to how 5G is impacting lawful interception, and the challenges faced by intelligences agencies as they work with communication service providers to gather information, to safeguard society.

The talk, followed by Q&A is embedded below:

You may also find this blog post titled, 'Five Challenges of Gathering Digital Evidence in a 5G World' by David Anstiss, interesting.

Related Posts:

• The 3G4G Blog: Lawful Intercept in 5G Networks
• The 3G4G Blog: Everything you need to know about 5G Security
• The 3G4G Blog: Key Technology Aspects of 5G Security by Rohde & Schwarz
• The 3G4G Blog: 5G Roaming with SEPP (Security Edge Protection Proxy)
• The 3G4G Blog: Exploiting Possible 5G Vulnerabilities
• The 3G4G Blog: Presentations from ETSI Security Week 2019 (#ETSISecurityWeek)
• The 3G4G Blog: VoLTE Hacking
• The 3G4G Blog: Evolution of Security from 4G to 5G 

5G & AI Powered Smart Hospitals

5G Telehealth has been one of the main driving use cases for upgrading the infrastructure. While some use cases definitely make sense, some others like remote surgery will most likely never happen, at least the way it's depicted today.

At the GSMA Mobile 360 APAC - 5G Industry Community Summit, Michael Fung, Chief Information Officer from CHUK Medical Centre presented a nice talk detailing how they see 5G & AI powered hospitals of the future. The video of his talk is embedded at the bottom of this post.

There have also been some other discussions on 5G & healthcare recently. Here are the links if you want to explore this topic further:

• Video: UK5G Presents Health & Social Care Panel Session
• Video: Telecoms Europe 5G 2021 - What can 5G do for healthcare?
• Video: Ericsson - 5G Connected Ambulance
• Video: 5G Healthcare Application for Smart Hospital - Tseung Kwan O Hospital
• Article: Vodafone Germany launches real-time network in the first 5G hospital 

Service Level Agreements for 5G and Beyond: Overview, Challenges and Enablers of 5G-Healthcare Systems - https://t.co/axJ05r2VqX via U.S. FDA (@US_FDA)#Free5Gtraining #5G #5GTechnology #5GUseCases #5GHealthcare #Healthcare #SLA #Cybersecurity #5Gsecurity pic.twitter.com/O9c0GEemt4

— Free 5G Training (@5Gtraining) December 6, 2021

The US FDA recently published a one pager looking at how Service level agreements (SLAs) can enable 5G-enabled medical device use cases by documenting how a medical device communication requirement is met by the unique characteristics of 5G networks and the roles and responsibilities of the stakeholders involved in offering safe and effective 5G-enabled healthcare to patients.

IEEE Access has a detailed paper on this topic by the same authors. Quoting from the abstract:

Service level agreements (SLAs) can enable 5G-enabled medical device use cases by documenting how a medical device communication requirements are met by the unique characteristics of 5G networks and the roles and responsibilities of the stakeholders involved in offering safe and effective 5G-enabled healthcare to patients. However, there are gaps in this space that should be addressed to facilitate the efficient implementation of 5G technology in healthcare. Current literature is scarce regarding SLAs for 5G and is absent regarding SLAs for 5G-enabled medical devices. This paper aims to bridge these gaps by identifying key challenges, providing insight, and describing open research questions related to SLAs in 5G and specifically 5G-healthcare systems. This is helpful to network service providers, users, and regulatory authorities in developing, managing, monitoring, and evaluating SLAs in 5G-enabled medical systems.

Here is the video from GSMA 5G Industry Community Summit Part 2:

Related Posts:

• The 3G4G Blog: 5G Remote Surgery and Telehealth Solutions
• The 3G4G Blog: Banana and Egg gets 5G Telesurgery
• Operator Watch Blog: Vodafone Deutschland (Germany) Continues 5G Use Cases Innovation
• Operator Watch Blog - China Mobile on The Next Phase of 5G: Progress, Challenges, and Opportunities 

What will 5G Standalone deliver?

Surely you have heard me talk about the benefits of 5G Standalone and why is it needed. At Telecoms Europe 5G 2021, Dr. Kim K Larsen, CTIO, T-Mobile Netherlands, presented a talk on what exactly will 5G Standalone deliver. The video of his talk and slides are embedded below.

5G Standalone Will Deliver! - But What? from Dr. Kim (Kyllesbech Larsen)

If mobile economics is an area of interest, you may want to check out his old blog posts which are quite detailed. Here.

Related Posts:

• The 3G4G Blog: When can we Stop the 5G NSA Experiment?
• The 3G4G Blog: Will Wi-Fi Help 3GPP Bring Reliable Connectivity Indoors?
• The 3G4G Blog: 5G Network Architecture Options 
• The 3G4G Blog: The Politics of Standalone vs Non-Standalone 5G & 4G Speeds
• The 3G4G Blog - Tutorial: Service Based Architecture (SBA) for 5G Core (5GC)
• The 3G4G Blog: When does your 5G NSA Device Show 5G Icon?
• The 3G4G Blog: Would 5G NSA undergo Sunset? When? 

Will Wi-Fi Help 3GPP Bring Reliable Connectivity Indoors?

I have argued a few times now that it would make much more sense to be able to make access and core independent of each other. 3GPP 5G Standards already have a feature available from Release-16 onwards that enables this with 5G Core, Standalone networks.

We use our smart devices currently for voice and data communications. When we are indoor, many times the data goes over Wi-Fi. This is what tempted operators to move to WiFi for voice solution as well. Many operators are now enabling Voice of WiFi in their network to provide reliable voice coverage indoors.

While this works currently without any issues, when operators start offering new native services and applications, like XR over 5G, the current approach won't help. When our devices are connected over Wi-Fi at present, they are unable to take advantage of operator core or services. With access and core independence, this will no longer be an issue.

I gave a short (15 mins) virtual presentation at 5G Techritory this year. I argued not just for WWC but also looked at what 5G features have a potential for revolution. It's embedded below.

Related Posts:

• The 3G4G Blog: 5G and Fixed-Mobile Convergence (FMC)
• The 3G4G Blog: Introduction to 5G ATSSS - Access Traffic Steering, Switching and Splitting
• The 3G4G Blog: Three New Standards to Accelerate 5G Wireless Wireline Convergence (WWC)
• Connectivity Technology Blog: 5G Wireline Access Architecture
• Operator Watch Blog: Telefonica Plans to achieve Fixed Mobile Convergence (FMC)
• Operator Watch Blog: BT's Converged Core to Launch in 2023 

3GPP Presentations from CEATEC Japan 2021

3GPP and its Japanese Organizational Partners TTC (Telecommunication Technology Committee) and ARIB (Association of Radio Industries and Businesses) hosted a “3GPP Summit” online workshop at CEATEC 2021, back in October. The event was co-located with the Japanese Ministry of Internal Affairs and Communications (MIC) and 5G Mobile Communications Promotion Forum (5GMF) 5G day at the event. Here is a summary of the event from 3GPP news:

The “3GPP Summit” featured all three Technical Specification Group (TSG) Chairs and one Japanese leader from each group. After the presentations, they exchanged their views and expectations for 3GPP work – as the industry starts to look at research beyond 5G. The event attracted almost 700 people, keen to understand what is going on in 3GPP.

The first session covered Release 17 and 18 evolution, with each TSG Chair and a domestic leader jointly presenting. Wanshi Chen introduced the latest schedule of each release and potential projects for Release 18 with the result of 3GPP Release 18 workshop held in June. Then, Hiroki Takeda presented some key features on Release 17 such as Redcap, RAN slicing and evolution of duplex.

TSG SA Chair, Georg Mayer introduced the group’s latest activities alongside Satoshi Nagata, covering key Release 17 features, such as enhanced support on Non-public Networks, Industrial IoT and Edge computing.

Next up was the TSG CT Chair, Lionel Morand, presenting the latest activities and roadmap for Core Network evolution from Release 15 to 17. Hiroshi Ishikawa also presented, covering 5G core protocol enhancements and some activities driven by operators.

The second part of the session focused more on activities ‘Beyond 5G’. First, Takaharu Nakamura introduced the latest activities on the topic in Japan. A panel discussion followed, with Satoshi Nagata joining the other 3GPP speakers, to give feedback on 5G developments and future use.

You can download the PPT of presentations from 3GPP site here or get the PDF from 3G4G page here.

Please feel free to add your thoughts as comments below.

Related Posts: 

• The 3G4G Blog: 5G-Advanced Flagship Features
• The 3G4G Blog: An Early View of 3GPP Release-18 5G-Advanced Topics
• The 3G4G Blog: 3GPP's 5G-Advanced Workshop Summary
• The 3G4G Blog: 3GPP's 5G-Advanced Technology Evolution from a Network Perspective Whitepaper
• The 3G4G Blog: '5G RAN Release 18 for Industry Verticals' Webinar Highlights
• The 3G4G Blog: 3GPP RAN Plenary Update and Evolution towards 5G-Advanced
• The 3G4G Blog: Initiative to Remove Non-inclusive terms from 3GPP Specifications
• The 3G4G Blog: 3GPP Release 16 Description and Summary of Work Items
• The 3G4G Blog: 3GPP Standards on Edge Computing
• The 3G4G Blog: Artificial Intelligence (AI) / Machine Learning (ML) in 5G Challenge by ITU
• The 3G4G Blog: ITU Standardization Bureau on Machine Learning for 5G
• The 3G4G Blog: Introduction to 5G Reduced Capability (RedCap) Devices
• The 3G4G Blog: 5G eXtended Reality (5G-XR) in 5G System (5GS)
• The 3G4G Blog: Energy Consumption in Mobile Networks and RAN Power Saving Schemes 

5G-Advanced Flagship Features

I am starting to get a feeling that people may be becoming overwhelmed with all the new 5G features and standards update. That is why this presentation by Mikael Höök, Director Radio Research at Ericsson, at Brooklyn 6G Summit (B6GS) caught my attention. 

The talk discusses the network infrastructure progress made in the previous two years to better illustrate the advanced 5G timeline to discovering 6G requirements. At the end of the talk, there was a quick summary of the four flagship features that are shown in the picture above. The talk is embedded below, courtesy of IEEE TV

In addition to this talk, October 2021 issue of Ericsson Technology Review covers the topic "5G evolution toward 5G advanced: An overview of 3GPP releases 17 and 18". You can get the PDF here.

I have covered the basics of these flagship features in the following posts:

• AI/ML (link)
• RedCap (link)
• XR (link)
• Network Energy Efficiency (link)

Please feel free to add your thoughts as comments below.

Related Posts: 

• The 3G4G Blog: An Early View of 3GPP Release-18 5G-Advanced Topics
• The 3G4G Blog: 3GPP's 5G-Advanced Workshop Summary
• The 3G4G Blog: 3GPP's 5G-Advanced Technology Evolution from a Network Perspective Whitepaper
• The 3G4G Blog: '5G RAN Release 18 for Industry Verticals' Webinar Highlights
• The 3G4G Blog: 3GPP RAN Plenary Update and Evolution towards 5G-Advanced
• The 3G4G Blog: Initiative to Remove Non-inclusive terms from 3GPP Specifications
• The 3G4G Blog: 3GPP Release 16 Description and Summary of Work Items
• The 3G4G Blog: 3GPP Standards on Edge Computing
• The 3G4G Blog: Artificial Intelligence (AI) / Machine Learning (ML) in 5G Challenge by ITU
• The 3G4G Blog: ITU Standardization Bureau on Machine Learning for 5G
• The 3G4G Blog: Introduction to 5G Reduced Capability (RedCap) Devices
• The 3G4G Blog: 5G eXtended Reality (5G-XR) in 5G System (5GS)
• The 3G4G Blog: Energy Consumption in Mobile Networks and RAN Power Saving Schemes 

Network Slicing using User Equipment Route Selection Policy (URSP)

Google announced that its latest smartphone OS will include support for 5G network slicing. Last week Telecom TV brought this news to my attention. The article explains:

It's a move designed to leverage its expertise in devices in order to give it the edge over its rival hyperscalers.

It comes in two flavours. The first is for enterprise-owned handsets, and routes all data sent and received by a device over the network slices provided by that company's mobile operator. Android 12 gives operators the ability to manage slices using a new dynamic policy control mechanism called User Equipment Route Selection Policy (URSP). URSP enables devices to automatically switch between different network slices according to which application they are using. For example, someone working for a financial institution might require a highly-secure network slice for sending and receiving sensitive corporate data, but will then require a reliable, high-throughput, low-latency slice so they can participate in a video meeting.

The second flavour is implemented in the work profile. For years, enterprises have had the option of creating work profiles on Android devices – irrespective of whether they are owned by the organisation or the individual – to use as a separate repository for enterprise apps and data. When Android 12 comes out next year, enterprises will be able to route data to and from that repository over a network slice.

Google said it has already carried out network slicing tests with both Ericsson and Nokia using test versions of its recently released Pixel 6 smartphone running on the as-yet-unreleased Android 12 OS.

It's a replacement for enterprise APNs for now. So not earth-shattering, but a start nonetheless.

Perhaps indicates that enterprise privacy/security/policy might be the major use-case for slicing for the foreseeable future?

A type of mobile VPN, in other words.

— Gabriel Brown (@Gabeuk) November 7, 2021

Last week Taiwanese operator Far EasTone (FET) and Ericsson announced they have completed the world’s first proof of concept (PoC) for simultaneously connecting multiple network slices per device running on Android 12 commercial release. The press release said:

The trial, carried out on FET’s 5G standalone (SA) infrastructure built on Ericsson’s radio access network and cloud-native Core network, successfully demonstrated the 5G user equipment slicing policy feature (User Equipment Route Selection Policy, or URSP) on multiple Android devices. This marks a breakthrough in network slicing capabilities on a 5G standalone network and paves the way for further ecosystem development in this important area.

With more 5G networks evolving to standalone architecture around the globe, end-to-end network slicing, which includes Ericsson RAN Slicing to secure Quality of Service (QoS) differentiation, plays a key role in enabling new services for end users, with which multiple virtual 5G networks are created on top of one physical network. The 5G trial, in collaboration with FET, Ericsson and Android, went even further in network slicing capabilities by introducing and demonstrating 5G user equipment (UE) slicing policy (URSP) features that allow devices to simultaneously operate on dynamic policy control and selection between multiple 5G network slices. This enables the steering of applications and services with specific requirements to defined slices without switching devices.

Multiple slices allow devices to have multiple profiles to secure different levels of experience, security, and privacy requirements, based on the needs of the different applications and in correspondence with the user profile.  For instance, a device can have a personal profile with private data from apps or off-work entertainment, and a work profile with enterprises productivity apps. With URSP features, employers can customize the work profile with increased security and enable better use of RAN Slicing with QoS so that enterprise-related apps can work even during network congestion.

Some security-sensitive apps, such as mobile banking, can also benefit from different routing mechanisms of the traffic enabled by URSP. For instance, the banking app would not need to send its traffic to the internet and then to the app server as it does today. Instead, it could go straight to the app server and avoid the routing through internet. With the shortest route by connecting to a defined slice, users could reduce the risk of being attacked by hackers.

In their technical whitepaper on Network Slicing, Samsung explains: 

Along with the concept of network slicing and features in the RAN and Core network, UE Route Selection Policy (URSP) is introduced as a way to manage network slice information for the UE. URSP is a network slice feature enabled by the PCF which informs the network slice status to the UE via the AMF. In 4G network systems, it was near impossible to install new services in the network for a UE. But through the URSP feature, 5G network operators can easily configure new service for a UE. Figure 12 (top of this blog post) shows the difference in network slice selection in 4G and 5G Network. In 5G network, slice selection policy can be configured dynamically through URSP, while slice selection policy is pre-defined and cannot be changed dynamically in 4G network.

URSP contains OSId, AppId, IP descriptors to define the application and Single-Network Slice Selection Assistance Information (S-NSSAI), Data Network Name (DNN), Session and Service Continuity (SSC) mode information for the application and network slice mapping.

The S-NSSAI identifies each network slice service and provides information to properly assign network slice/functions. An S-NSSAI is comprised of:

• A Slice/Service type (SST), which refers to the expected network slice behavior in terms of features and services;
• A Slice Differentiator (SD), which is an optional information that complements the Slice/Service type(s) to differentiate amongst multiple network slices of the same Slice/Service type.

3GPP allows the use of the Slice Differentiator (SD) field that can build customized network slices. The SD field can be used to describe services, customer information and priority.

Here is a short video from Mpirical explaining 5G UE Route Selection.

It it worth reminding here that this feature, like many of the other 5G features, is dependent on 5G Core. We hope that the transition to 5G Standalone Networks happens as soon as possible.

Related Posts:

• The 3G4G Blog: Network Slicing Tutorials and Other Resources
• The 3G4G Blog: 5G Slicing Templates
• The 3G4G Blog: End-to-end Network Slicing in 5G
• The 3G4G Blog: Network Slicing in NG RAN
• The 3G4G Blog: How to Identify Network Slices in NG RAN
• The 3G4G Blog: The Status of 5G Standalone (5G SA) Networks - March 2021
• The 3G4G Blog: The Politics of Standalone vs Non-Standalone 5G & 4G Speeds
• The 3G4G Blog: When can we Stop the 5G NSA Experiment? 

Voice over New Radio (VoNR) Establishment and Release between NG RAN and 5G Core

In this video I explain how QoS Flows for VoNR are established and released especially on N2 reference point between 5G Core and NG RAN.

The pervious video about generic aspects of "QoS Flow Establishments in 5G Standalone RAN and Core" you will find in the first link of the Related Posts listed below:

Related Posts: 

• The 3G4G Blog: QoS Flow Establishments in 5G Standalone RAN and Core
• The 3G4G Blog: Anomaly Detection and other AI Algorithms in RAN Optimization
• The 3G4G Blog: How to Identify Network Slices in NG RAN
• The 3G4G Blog: Network Slicing in NG RAN
• The 3G4G Blog: Network Slicing Tutorials and Other Resources
• The 3G4G Blog: Artificial Intelligence (AI) / Machine Learning (ML) in 5G Challenge by ITU
• The 3G4G Blog: Conditional Handover (Rel. 16) Explained
• The 3G4G Blog: UE Radio Capability Signaling Optimization (RACS) in Rel. 16 

Energy Consumption in Mobile Networks and RAN Power Saving Schemes

We just made a tutorial on this topic looking at where most of the power consumption in the mobile network occurs and some of the ways this power consumption can be reduced. 

Nice chart from Huawei presentation (no link) that shows 89% of a network spend is Opex vs 11% Capex. Also, energy costs are roughly 5.5-6 % of the total network opex which translates into many millions, if not billions.#Free5Gtraining #5G #4G #GreenFuture #Green5G #TechForGood pic.twitter.com/9hTqMapjKM

— Free 5G Training (@5Gtraining) August 13, 2020

The chart in the Tweet above (also in the presentation) clearly shows that the energy costs for operators run in many millions. Small power saving schemes can still have a big impact on the total energy reduction, thereby saving huge amounts of energy and costs.

ZTE Communications Magazine back in March discussed Energy Consumption Challenges and Prospects on B5G Communication Systems - https://t.co/vfAynT4eGZ#Free5Gtraining #ZTE #5G #5GNR #NGRAN #5GRAN #5GNetwork #5GTechnology #EnergyEfficiency #GreenEnergy #SON #AIML #5GSignaling pic.twitter.com/kLgdPuko6I

— Free 5G Training (@5Gtraining) October 31, 2021

The March issue of ZTE Communications Magazine contains some good articles looking at how to tackle the energy challenges in the network going forward. This recent article by Ericsson is also a good source of information on this topic.

Anyway, the slides and the video of the tutorial is embedded below:

Beginners: Energy Consumption in Mobile Networks - RAN Power Saving Schemes from 3G4G

Related Posts:

• The 3G4G Blog: Reducing 5G Device Power Consumption Using Connected-mode Discontinuous Reception (C-DRX)
• The 3G4G Blog: Huawei's Power Digitalization 2025 Summit
• Free 6G Training: Will 6G Just a better 5G? 

An Early View of 3GPP Release-18 5G-Advanced Topics

5G is hot at the moment. While the operators are busy rolling out the networks based on Release-15/16 features, 3GPP is working on finalising Release-17 specifications and laying the foundations for Rel-18.

The latest issue of 3GPP Highlights magazine (I prefer the PDF) contains a lot of valuable technical content, in addition to many other articles. The technical content includes:

• An early view of the RAN Topics for 5G-Advanced
• 5G Advanced in the Making – The TSG SA approach to Release 18
• Application Enablement Standards in 3GPP – Maximizing the potential of 5G!
• RAN3 flourishing in this time of change
• Enhanced support of Industrial IoT in the 5G System (Rel-17)
• Autonomous Network standardization in WG SA5
• Rel-17 Edge Computing and Network Slicing charging (WG SA 5)
• Media Production over 5G NPN

While I am not going into too much detail here, I want to highlight the 5G-Advanced topics that will be under discussion over the next couple of months. The final list will be approved by 3GPP TSGs SA, RAN and CT in December 2021.

Dr. Wanshi Chen, 3GPP TSG RAN Chair provided an early view of the RAN topics for 5G-Advanced. 

Topics Under Discussion

As well as taking a tentative decision on an 18-month duration for Release 18, the RAN workshop endorsed a list of topics for subsequent email discussions. Some of the topics in the following list also have a set of example areas, serving as a starting point for further refinement:

• Evolution for downlink MIMO, with the following example areas:
• Further enhancements for CSI (e.g., mobility, overhead, etc.)
• Evolved handling of multi-TRP (Transmission Reception Points) and multi-beam
• CPE (customer premises equipment) -specific considerations
• Uplink enhancements, with the following example areas:
• >4 Tx operation
• Enhanced multi-panel/multi-TRP uplink operation
• Frequency-selective precoding
• Further coverage enhancements
• Mobility enhancements, with the following example areas:
• Layer 1/layer 2 based inter cell mobility
• DAPS (Dual Active Protocol Stack)/CHO (Conditional HandOver) related improvements
• FR2 (frequency range 2)-specific enhancements
• Additional topological improvements (IAB and smart repeaters), with the following example areas:
• Mobile IAB (Integrated Access Backhaul)/Vehicle mounted relay (VMR)
• Smart repeater with side control information
• Enhancements for XR (eXtended Reality), with the following example areas:
• KPIs/QoS, application awareness operation, and aspects related to power consumption, coverage, capacity, and mobility
• Note: only power consumption/coverage/mobility aspects specific to XR
• Sidelink enhancements (excluding positioning), with the following example areas:
• SL enhancements (e.g., unlicensed, power saving enhancements, efficiency enhancements, etc.)
• SL relay enhancements
• Co-existence of LTE V2X & NR V2X
• RedCap evolution (excluding positioning), with the following example areas:
• New use cases and new UE bandwidths (5MHz?)
• Power saving enhancements
• NTN (Non-Terrestrial Networks) evolution
• Including both NR & IoT (Internet of Things) aspects
• Evolution for broadcast and multicast services
• Including both LTE based 5G broadcast and NR MBS (Multicast Broadcast Services)
• Expanded and improved Positioning, with the following example areas:
• Sidelink positioning/ranging
• Improved accuracy, integrity, and power efficiency
• RedCap positioning
• Evolution of duplex operation, with the following example areas:
• Deployment scenarios, including duplex mode (TDD only?)
• Interference management
• AI (Artificial Intelligence)/ML (Machine Learning), with the following example areas:
• Air interface (e.g., Use cases to focus, KPIs and Evaluation methodology, network and UE involvement, etc.)
• NG-RAN
• Network energy savings, with the following example areas:
• KPIs and evaluation methodology, focus areas and potential solutions
• Additional RAN1/2/3 candidate topics, Set 1:
• UE power savings
• Enhancing and extending the support beyond 52.6GHz
• CA (Carrier Aggregation)/DC (Dual-Connectivity) enhancements (e.g., MR-MC (Multi-Radio/Multi-Connectivity), etc.)
• Flexible spectrum integration
• RIS (Reconfigurable Intelligent Surfaces)
• Others (RAN1-led)
• Additional RAN1/2/3 candidate topics, Set 2:
• UAV (Unmanned Aerial Vehicle)
• IIoT (Industrial Internet of Things)/URLLC (Ultra-Reliable Low-Latency Communication)
• <5MHz in dedicated spectrum
• Other IoT enhancements/types
• HAPS (High Altitude Platform System)
• Network coding
• Additional RAN1/2/3 candidate topics, Set 3:
• Inter-gNB coordination, with the following example areas:
• Inter-gNB/gNB-DU multi-carrier operation
• Inter-gNB/gNB-DU multi-TRP operation
• Enhancement for resiliency of gNB-CU
• Network slicing enhancements
• MUSIM (Multiple Universal Subscriber Identity Modules)
• UE aggregation
• Security enhancements
• SON (Self-Organizing Networks)/MDT (Minimization of Drive Test)
• Others (RAN2/3-led)
• Potential RAN4 enhancements

Dr. Georg Mayer, 3GPP TSG SA Chair provides the TSG SA approach to 3GPP Release-18

The candidate items for Rel-18 include:

• Immersive Media and Virtual/Artificial/Extended Reality (XR) Media support in Working Group (WG) SA4 and WG SA2.
• New work areas for Internet of Things (e.g. passive IoT (WG SA2) and application capability exposure for IoT platforms (WG SA6)).
• Proposals to for Artificial Intelligence and Machine Learning Services Transport and Management (WGs SA2, SA5).
• Concepts for integration and migration of existing vertical infrastructure, e.g. for railway networks (WG SA6).
• Examples for proposed enhancements to existing 3GPP services and functionalities include:
• Network Slicing (WGs SA2, SA5)
• Edge Computing (WGs SA2, SA5, SA6)
• Autonomous Networks (WG SA5)
• Service Based Architecture (WGs SA2, SA5)
• Northbound APIs (WG SA6)
• Non-Public Networks (WG SA2)
• Satellite 5G Networks (WG SA2)
• Drone support (WG SA2)
• 5G Multicast and Broadcast (WG SA2)
• Location Services (WG SA2, SA6)
• Management Data Analytics (WG SA5)
• Mission Critical Services (WG SA6)

None of these features are final but we will know in the next few months what will be included as part of Rel-18 and what won't. In the meantime, do check out the latest issue of 3GPP Highlights here.

Related Posts: 

• The 3G4G Blog: 3GPP's 5G-Advanced Workshop Summary
• The 3G4G Blog: 3GPP's 5G-Advanced Technology Evolution from a Network Perspective Whitepaper
• The 3G4G Blog: '5G RAN Release 18 for Industry Verticals' Webinar Highlights
• The 3G4G Blog: 3GPP RAN Plenary Update and Evolution towards 5G-Advanced
• The 3G4G Blog: Initiative to Remove Non-inclusive terms from 3GPP Specifications
• The 3G4G Blog: 3GPP Release 16 Description and Summary of Work Items
• The 3G4G Blog: 3GPP Standards on Edge Computing 

5G NR-Unlicensed (NR-U)

I have been talking about unlicensed LTE since 2013. With all the debate around LTE-U and LAA now non-existent, the technology has evolved with every new release. As can be seen from this picture by Ericsson above, 5G NR-U in Release-16 supports:

• License-exempt Downlink (DL)
• License-exempt scheduled Uplink (UL)
• License-exempt autonomous UK
• Standalone license-exempt operation

5G New Radio Unlicensed (NR-U): Challenges and Evaluation - https://t.co/RFyhHHddzh #Free5Gtraining #3G4G5G #5G #5GNR #NRU #NRunlicensed #UnlicensedSpectrum #5GNetworks #5GTechnology #Release16 pic.twitter.com/aiTg2RCECR

— Free 5G Training (@5Gtraining) October 17, 2021

The Release-16 work item summary details the following deployment scenarios for NR-based access to unlicensed spectrum:

• Scenario A: Carrier aggregation between NR in licensed spectrum (PCell) and NR in shared spectrum (SCell);
• A.1: SCell is not configured with UL (DL only); 
• A.2: SCell is configured with UL (DL+UL). 
• Scenario B: Dual connectivity between LTE in licensed spectrum and NR in shared spectrum (PSCell);
• Scenario C: NR in shared spectrum (PCell);
• Scenario D: NR cell in shared spectrum and uplink in licensed spectrum;
• Scenario E: Dual connectivity between NR in licensed spectrum (PCell) and NR in shared spectrum (PSCell)

5G New Radio Unlicensed: Challenges and Evaluation, available on arXiv here provides a lot of useful information on different kind of operations within the unlicensed band and the challenges of co-existence with Wi-Fi

Finally, Qualcomm has quite a few resources on this topic. Last year, they hosted a webinar on the topic, "How does unlicensed spectrum with NR-U transform what 5G can do for you?". The slides from that are available here and a video of that is available here. RCR Wireless also has this short article from one of the webinar presenters here.

Related Posts: 

• The 3G4G Blog: 3GPP Release 16 Description and Summary of Work Items
• The 3G4G Blog: Introduction to 5G Reduced Capability (RedCap) Devices
• The 3G4G Blog: Positioning in 5G networks
• The 3G4G Blog: Qualcomm Explains 5G Millimeter Wave (mmWave) Future & Integrated Access and Backhaul (IAB)
• The 3G4G Blog: '5G RAN Release 18 for Industry Verticals' Webinar Highlights
• The 3G4G Blog: Qualcomm Demoes Sub-band Half Duplex (SBHD)
• The 3G4G Blog: Reducing 5G Device Power Consumption Using Connected-mode Discontinuous Reception (C-DRX)
• The 3G4G Blog: Positioning Techniques for 5G NR in 3GPP Release-16
• The 3G4G Blog: 5G Enhanced URLLC (eURLLC)