2G/3G Shutdown may Cost Lives as 4G/5G Voice Roaming is a Mess

You have probably heard me a complaining about the pace of VoLTE rollout, 2G/3G shutdowns, 4G Voice roaming, etc. This post highlights all these issues coming together in a dangerous way. People often ask me why is it that it's always just me highlighting the issues. The answer is that there are other people but their voice may not reach you. In this post, I am highlighting presentations by Rudolf van der Berg, Project and programme manager at Stratix Consulting.

No more voice roaming in USA! French operator Free warns customers that telephony in USA doesn't work. 2G/#3G shutdown and lack of #VoLTE standardisation and roaming are the cause. Its customers can only use Internet and SMS, but not E.164 number based voice telephony and 911! https://t.co/cbBrNZTskq

— Rudolf van der Berg (@internetthought) April 6, 2022

Let's start with Rudolf's post from LinkedIn:

Stop the shutdown of 2G and 3G networks to save lives. This is the urgent call I make today and I hope you can help me spread it! Please call on people you know in politics, regulators and emergency services to demand a stop! Call on anyone you know in the GSMA, 3GPP, handset makers (Apple, Samsung, Qualcomm, MediaTek), network builders (Ericsson, Nokia, Huawei) to re-engineer VoLTE to an interoperable standard.

Emergency calls (112, 911) should work anywhere in the world on any phone. For GSM and 3G voice calling it did. You could fly anywhere and call emergency services and in the EU we have the roaming regulation that demands calling like at home. Voice over 4G and 5G hasn't been properly standardized and isn't interoperable between networks, devices, chipsets and firmware. People need to be able to make and receive telephone calls around the world, to each other and to emergency services. Unfortunately even according to sector itself emergency services are at risk from VoLTE. A consumer today can't know whether a phone they bought will make VoLTE calls at home or abroad, nor whether it can reach emergency services. That can't be right!

So please help EENA 112 and me share this message! Thank you #eena2022 (Slide 4 contains a mistake, T-Mo USA hasn't decided on 2G shutdown yet. that is good for availability of 911, though fundamental point remains. Apologies.)

Dear foreigner, AT&T regrets you die because you can't dial 911. Try whatsapp and ask a friend in the US to call 911 for you. https://t.co/KqliBXv4ik

— Rudolf van der Berg (@internetthought) April 15, 2022

The video and slides are embedded below:

The slides contain many useful references and links, you can download directly from here.

Back in April, iBASIS hosted a VoLTE and 5G Roaming Roundtable. You can watch the video here and download the presentation and whitepaper as well. It contains talks from Kaleido Intelligence, iBASIS, KPN, Bouygues Telecom and Telus. 

The slide from Dutch MNO KPN above highlights the VoLTE Roaming issues they are observing. Other operators will face this issue sooner or later as well. 

So they are the ones who should be asked to make sure that VoLTE and VoNR is interoperable between vendors and MNOs? Because people will die if we don't fix this. See my presentation from last week https://t.co/Ju3GadO9ie

— Rudolf van der Berg (@internetthought) May 5, 2022

The Regulators, GSMA and 3GPP have to come together to fix this important issue for once and all so no lives are lost because of this. Hopefully someone is listening!

Related Posts: 

• The 3G4G Blog: Transitioning from eCall to NG-eCall and the Legacy Problem
• The 3G4G Blog: GSMA Releases Mobile Economy Report 2022
• The 3G4G Blog: When will 2G & 3G be switched off now that 5G is here?
• The 3G4G Blog: VoLTE Hacking
• The 3G4G Blog: A quick starter on 4G voice (for beginners) 

Will Wi-Fi Help 3GPP Bring Reliable Connectivity Indoors?

I have argued a few times now that it would make much more sense to be able to make access and core independent of each other. 3GPP 5G Standards already have a feature available from Release-16 onwards that enables this with 5G Core, Standalone networks.

We use our smart devices currently for voice and data communications. When we are indoor, many times the data goes over Wi-Fi. This is what tempted operators to move to WiFi for voice solution as well. Many operators are now enabling Voice of WiFi in their network to provide reliable voice coverage indoors.

While this works currently without any issues, when operators start offering new native services and applications, like XR over 5G, the current approach won't help. When our devices are connected over Wi-Fi at present, they are unable to take advantage of operator core or services. With access and core independence, this will no longer be an issue.

I gave a short (15 mins) virtual presentation at 5G Techritory this year. I argued not just for WWC but also looked at what 5G features have a potential for revolution. It's embedded below.

Related Posts:

• The 3G4G Blog: 5G and Fixed-Mobile Convergence (FMC)
• The 3G4G Blog: Introduction to 5G ATSSS - Access Traffic Steering, Switching and Splitting
• The 3G4G Blog: Three New Standards to Accelerate 5G Wireless Wireline Convergence (WWC)
• Connectivity Technology Blog: 5G Wireline Access Architecture
• Operator Watch Blog: Telefonica Plans to achieve Fixed Mobile Convergence (FMC)
• Operator Watch Blog: BT's Converged Core to Launch in 2023 

Two Types of SMS in 5G

GSMA recently published updated "5G Implementation Guidelines: SA Option 2". It explains the two types of SMS in 5G, the same way there were 2 types of SMS in LTE.

Within 5GC, SMS Function (SMSF) supports SMS over NAS (SMSoNAS) defined in 3GPP TS 23.501. Besides, SMSoIP can also be considered as IMS based SMS solution under 5G network. SMSoIP can be deployed simultaneously with voice service over IMS to provide both voice and short message service. It is recommended to use SMSoNAS solution if voice services over IMS is not supported or for a 5G data card/Machine Type Communications (MTC)/Non-IMS device without voice service. The network architecture of SMSoIP and SMSoNAS is shown in Figure.

Two Types of SMS in 5G: SMS over NAS (SMSoNAS) & SMS over IP/IMS (SMSoIP / SMSoIMS) - https://t.co/A88ayY8F1x via @3g4gUK #Free5Gtraining #3G4G5G #GSMA #Mpirical #4G #5G #5GNetworks #5Gtechnology #SMS #5GSMS #Messaging #5GMessaging #SMSoNAS #SMSF #SMSoIP #IMS #SMSoIMS pic.twitter.com/ceI7wGEWBt

— Free 5G Training (@5Gtraining) May 31, 2021

Mpirical explains it in the video as embedded below:

You may also find "5G SMS is Very Real and Here to Stay" by William Dudley useful. It covers a lot of technical details and signalling. It's available here.

Related  posts:

• The 3G4G Blog: Mobile Voice Communications is neither Dying, nor Dead!

VoLTE Hacking

The 10th Annual HITB Security Conference took place from the 6th till the 10th of May 2019 in The Netherlands. The theme for the conference this year is 'The Hacks of Future Past'. One of the presentations was on the topic 'VoLTE Phreaking' by Ralph Moonen, Technical Director at Secura.

The talk covered variety of topics:

• A little history of telephony hacking (in NL/EU)
• The landscape now
• Intercepting communications in 2019
• Vulnerabilities discovered: some new, some old
• An app to monitor traffic on a phone

The talk provides details on how VoLTE can potentially be hacked. In a lot of instances it is some or the other misconfigurations that makes VoLTE less secure. One of the slides that caught my attention was the differences in VoLTE signaling from different operators (probably due to different vendors) as shown above.

Anyway, I am not going into more details here. The presentation is available here.

Another interesting talk from #HITB2019AMS:
"VoLTE Phreaking"https://t.co/KSMLen6Yb6 [PDF] pic.twitter.com/KakJMGCcVk

— Enno Rey (@Enno_Insinuator) May 9, 2019

The thread in the Tweet above also provided some good references on VoLTE hacking. They are as follows:

• ERNW: Security Analysis of VoLTE, Part 1
• ERNW: Denial of Service attacks on VoLTE
• ERNW: VoLTE Security Analysis, part 2
• ERNW: IMSecure – Attacking VoLTE (and other Stuff)
• ERNW White Paper: Practical Attacks on VoLTE and VoWiFi

Related Posts:

• 3G4G: Voice in 4G: CSFB, VoIP & VoLTE

A quick starter on 4G voice (for beginners)

I recently did a 4G voice presentation for beginners after realizing that even though so many years have passed after VoLTE was launched, people are still unsure how it works or how its different from CS Fallback.

There are many other posts that discuss these topics in detail on this blog (follow the label) or on 3G4G website. Anyway, here is the video:

The slides are available on 3G4G Slideshare account here. More similar training videos are available here.

VoLTE Operator Case Study from LTE Voice Summit

Phil Sheppard, Director of Network Strategy & Architecture, Three UK was the keynote speaker of LTE Voice Summit held in London this month. Its been over a year that Three launched its VoLTE service in the 800MHz band. In fact recently, it has started showing adverts with Maisie Williams (Arya Stark from Game of Thrones) fighting black spots (not spots) with 4G Super-Voice.



As I highlighted in the LTEVoice 2015 summary where China Mobile group vice-president Mr.Liu Aili admitted "VoLTE network deployment is the one of the most difficult project ever, the implementation complexity and workload is unparalleled in history", Three UK's experience wasn't very different. Quoting from ThinkSmallCell summary of the event:

It was a huge project, the scope far exceeding original expectations and affecting almost every part of their operations.  They spent 22,245 man days (excluding vendor staff time) – more than 100 man years of effort – mostly involved with running huge numbers of test cases on the network and devices.

There are some other interesting bits from the different summaries that are provided in references below but here are few things I found of interest with regards to Three UK VoLTE deployment:

• 170 million voice calls minutes have used VoLTE since the launch in Sept 2015
• Only devices that can support VoLTE and 800MHz are allowed to camp on 800MHz band. This is to avoid disappointment with CS Fallback
• There are plans to roll out VoLTE in other bands too once all niggles are ironed out in the 800MHz band.

Here is the presentation from 3 UK:

Blog posts summarizing LTEVoice 2016:

• LTE Voice Summit 2016 Event Report - David Chambers, ThinkSmallCell
• The Wi-Fi last operators, Alberto Diez
• LTE Voice Summit 2016: Going beyond VoLTE to advance network performance
• Summary of LTE Voice Summit 2016 - Tweet collection by Zahid Ghadialy

Related posts:

• Quick Summary of LTE Voice Summit 2015
• Whats up with VoLTE Roaming?
• QoS in VoWiFi
• Two VoLTE Deployment Case Studies

Whats up with VoLTE Roaming?

I have been covering the LTE Voice Summit for last couple of years (see here: 2015 & 2014) but this year I wont be around unfortunately. Anyway, I am sure there will be many interesting discussions. From my point of view, the 2 topics that have been widely discussed is roaming and VoWiFi.

One of the criticisms of VoWiFi is that it does not the QoS aspect is missing, which makes VoLTE special. In a recent post, I looked at the QoS in VoWiFi issue. If you haven't seen it, see here.

Coming back to VoLTE roaming, I came across this recent presentation by Orange.

This suggests that S8HR is a bad idea, the focus should be on LBO. For anyone who is not aware of the details of S8HR & LBO, please see my earlier blog post here. What this presentation suggests is to use LBO with no MTR (Mobile Termination Rates) but instead use TAP (Transferred Account Procedures). The presentation is embedded below:

Another approach that is not discussed too much but seems to be the norm at the moment is the use of IP eXchange (IPX). I also came across this other panel discussion on the topic

IPX is already in use for data roaming today and acts as a hub between different operators helping to solve inter-operability issues and mediating between roaming models. It can work out based on the calling and callee party what kind of quality and approach to use.

Here is the summary of the panel discussion:

Hopefully the LTE Voice Summit next week will provide some more insights. I look forward to hearing them.

Blog posts on related topics:

• VoLTE Roaming – Let’s Take Away The Confusion - iBasis
• VoLTE Roaming – Critical enabler or long term ideal? - 5G World
• VoLTE Roaming Confusion and the IPX Provider Opportunity - Ovum
• IPX providers must look internally for class-of-service customers - Ovum

QoS in VoWiFi

Came across this presentation by Eir from last year's LTE Voice Summit.

VoWLAN: Call Quality from 3G4G

As the summary of the above presentation says:

• Turning on WMM (or WME) at access point provides significant protection for voice traffic against competing wireless data traffic
• Turning on WMM at the client makes only a small difference where there are a small number of clients on the wireless LAN. This plus the “TCP Unfairness” problem means that it can be omitted.
• All Home gateways support WMM but their firmware may need to be altered to prioritise on DSCP rather than layer two

As this Wikipedia entry explains:

Wireless Multimedia Extensions (WME), also known as Wi-Fi Multimedia (WMM), is a Wi-Fi Alliance interoperability certification, based on the IEEE 802.11e standard. It provides basic Quality of service (QoS) features to IEEE 802.11 networks. WMM prioritizes traffic according to four Access Categories (AC): voice (AC_VO), video (AC_VI), best effort (AC_BE), and background (AC_BK). However, it does not provide guaranteed throughput. It is suitable for well-defined applications that require QoS, such as Voice over IP (VoIP) on Wi-Fi phones (VoWLAN).

WMM replaces the Wi-Fi DCF distributed coordination function for CSMA/CA wireless frame transmission with Enhanced Distributed Coordination Function (EDCF). EDCF, according to version 1.1 of the WMM specifications by the Wi-Fi Alliance, defines Access Categories labels AC_VO, AC_VI, AC_BE, and AC_BK for the Enhanced Distributed Channel Access (EDCA) parameters that are used by a WMM-enabled station to control how long it sets its Transmission Opportunity (TXOP), according to the information transmitted by the access point to the station. It is implemented for wireless QoS between RF media.

This blog post describes how the QoS works in case of WMM.

Finally, this slide from Cisco shows how it will all fit together.

Further reading:

• CWAP – MAC Header : QoS Control
• Mobile Traffic Engineering with Application Visibility and Control (AVC) - Cisco
• Calling VoWiFi... The Next Mobile Operator Service is here... - Cisco

Quick Summary of LTE Voice Summit 2015 (#LTEVoice)

Last year's summary of the LTE voice summit was very much appreciated so I have created one this year too.

The status of VoLTE can be very well summarised as can be seen in the image above.

‘VoLTE network deployment is the one of the most difficult project ever, the implementation complexity and workload is unparalleled in history’ - China Mobile group vice-president Mr.Liu Aili

Surprisingly, not many presentations were shared so I have gone back to the tweets and the pictures I took to compile this report. You may want to download the PDF from slideshare to be able to see the links. Hope you find it useful.

Related links:

• VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout)
• S8HR: Standardization of New VoLTE Roaming Architecture
• VoLTE Roaming: LBO, S8HR or HBO

VoLTE Roaming: LBO, S8HR or HBO

There was an interesting discussion on different roaming scenarios in the LTE Voice Summit on 29th, 30th Sep. in London. The above picture provides a brief summary of these well known options. I have blogged about LBO/RAVEL here and S8HR here. A presentation by NTT Docomo in a GSMA webinar here provides more details on these architectures (slide 29 onwards - though it is more biased towards S8HR).

Ajay Joseph, CTO, iBasis gave an interesting presentation that highlighted the problems present in both these approaches.

In case of LBO, the biggest issue is that the home operator need to do a testing with each roaming partner to make sure VoLTE roaming works smoothly. This will be time consuming and expensive.

In case of S8HR, he provided a very good example. Imagine a VoLTE subscriber from USA is visiting Singapore. He now needs to make a phone call to someone in Indonesia (which is just next to Singapore). The flow of data would be all the way from Singapore to USA to Indonesia and back. This can introduce delays and impact QoE. The obvious advantage of S8HR is that since the call setup and media go to Home PMN (Public Mobile Network), no additional testing with the Visited PMN is required. The testing time is small and rollouts are quicker.

iBasis are proposing a solution called Hub Breakout (HBO) which would offer the best of LBO and S8HR. Each VoLTE operator would need to test their interoperability only with iBasis. Emergency calls and lawful intercept that does not work with S8HR would work with the HBO solution.

While I agree that this is a good solution, I am sure that many operators would not use this solution and there may be other solutions proposed in due course as well. Reminds me of this XKCD cartoon:

Anyway, here is the iBasis presentation:

S8HR: Standardization of New VoLTE Roaming Architecture

VoLTE is a very popular topic on this blog. A basic VoLTE document from Anritsu has over 40K views and my summary from last years LTE Voice summit has over 30K views. I assume this is not just due to the complexity of this feature.

When I attended the LTE Voice summit last year, of the many solutions being proposed for roaming, 'Roaming Architecture for Voice over LTE with Local Breakout (RAVEL)' was being touted as the preferred solution, even though many vendors had reservations.

Since then, GSMA has endorsed a new VoLTE roaming architecture, S8HR, as a candidate for VoLTE roaming. Unlike previous architectures, S8HR does not require the deployment of an IMS platform in VPLMN. This is advantageous because it shortens time-to-market and provides services universally without having to depend on the capability of VPLMN.



Telecom Italia has a nice quick summary, reproduced below:

S8HR simplicity, however, is not only its strength but also its weakness, as it is the source of some serious technical issues that will have to be solved. The analysis of these issues is on the Rel13 3GPP agenda for the next months, but may overflow to Rel14. Let’s see what these issues are, more in detail:

Regulatory requirements - S8HR roaming architecture needs to meet all the current regulatory requirements applicable to voice roaming, specifically:

• Support of emergency calls - The issues in this context are several. For example, authenticated emergency calls rely on the existence if an IMS NNI between VPLMN and HPLMN (which S8HR does not provide); conversely, the unauthenticated emergency calls, although technically feasible in S8HR, are allowed only in some Countries subject to the local regulation of VPLMN. Also, for a non-UE-detectable IMS Emergency call, the P-CSCF in the HPLMN needs to be capable of deciding the subsequent action (e.g. translate the dialed number and progress the call or reject it with the indication to set up an emergency call instead), taking the VPLMN ID into account. A configuration of local emergency numbers per Mobile Country Code on P-CSCF may thus be needed.
• ­Support of Lawful Interception (LI) & data retention for inbound roamers in VPLMN -  S8HR offers no solution to the case where interception is required in the VPLMN for inbound roamers. 3GPP is required to define a solution that fulfill such vital regulatory requirement, as done today in circuit switched networks. Of course VPLMN and HPLMN can agree in their bilateral roaming agreement to disable confidentiality protection to support inbound roamer LI but is this practice really viable from a regulatory point of view?

Voice call continuity – The issue is that when the inbound roamers lose the LTE coverage to enter into  a 2G/3G CS area, the Single Radio Voice Call Continuity (SRVCC) should be performed involving the HPLMN in a totally different way than current specification (i.e. without any IMS NNI being deployed).
Coexistence of LBO and S8HR roaming architectures will have to be studied since an operator may need to support both LBO and S8HR VoLTE roaming architecture options for roaming with different operators, on the basis of bilateral agreement and depending on the capability.
Other issues relate to the capability of the home based S-CSCF and TAS (Telephony Application Server) to be made aware about the VPLMN identity for charging purposes and to enable the TAS to subsequently perform communication barring supplementary services. Also, where the roaming user calls a geo-local number (e.g. short code, or premium numbers), the IMS entities in HPLMN must do number resolution to correctly route the call.
From preliminary discussions held at Working Group level in SA2 (architecture) and SA3 (security) in April, it was felt useful to create a new 3GPP Technical Report to perform comprehensive technical analysis on the subject. Thus it is expected that the discussions will continue in the next months until the end of 2015 and will overheat Release 13 agenda due to their commercial and “political” nature. Stay tuned to monitor the progress of the subject or contact the authors for further information!

NTT Docomo also did some trials back in February and got some brilliant results:

In the trials, DOCOMO and KT achieved the world's first high-definition voice and video call with full end-to-end quality of service. Also, DOCOMO and Verizon achieved the world's first transoceanic high-definition VoLTE roaming calls. DOCOMO has existing commercial 3G and 4G roaming relations with Verizon Wireless and KT.

The calls were made on an IP eXchange (IPX) and network equipment to replicate commercial networks. With only two months of preparation, which also proved the technology's feasibility of speedy commercialization, the quality of VoLTE roaming calls using S8HR architecture over both short and long distances was proven to be better than that of existing 3G voice roaming services.

In fact, NTT Docomo has already said based on the survery from GSMA's Network 2020 programme that 80% of the network operators want this to be supported by the standards and 46% of the operators already have a plan to support this.

The architecture has the following technical characteristics:
(1) Bearers for IMS services are established on the S8 reference point, just as LTE data roaming.
(2) All IMS nodes are located at Home Public Land Mobile Network (HPLMN), and all signaling and media traffic for the VoLTE roaming service go through HPLMN.
(3) IMS transactions are performed directly between the terminal and P-CSCF at HPLMN. Accordingly, Visited Public Land Mobile Network (VPLMN) and interconnect networks (IPX/GRX) are not service-aware at the IMS level. The services can only be differentiated by APN or QoS levels.

These three technical features make it possible to provide all IMS services by HPLMN only and to minimize functional addition to VPLMN. As a result, S8HR shortens the time-to-market for VoLTE roaming services.

Figure 2 shows the attach procedure for S8HR VoLTE roaming. From Steps 1 to 3, there is no significant difference from the LTE data roaming attach procedure. In Step 4, HSS sends an update location answer message to MME. In order for the MME to select the PGW in HPLMN (Step 5), the MME must set the information element VPLMN Dynamic Address “Allowed,” which is included in the subscribed data, to “Not Allowed.” In Step 6, the bearer for SIP signaling is created between SGW and PGW with QCI=5. MME sends an attach accept message to the terminal with an IMS Voice over PS Session Support Indication information element, which indicates that VoLTE is supported. The information element is set on the basis of the MME’s internal configuration specifying whether there is a VoLTE roaming agreement to use S8HR. If no agreement exists between two PLMNs, the information element will not be set.

The complete article from the NTT Docomo technical journal is embedded

Mobile Telecoms Technology & Market Disruptions

Sometimes its good to take a step back and look at the new applications and services that are already happening or may be happening sometime soon. Some of these have a possibility to disrupt the existing industries and markets, giving rise to not only new players but a completely new order.

Embedded below is a presentation from Dean Bubley of Disruptive Analysis. While there are a few things that I look at differently, there are many interesting points that the industry should already be looking at.

A good example of disruption would be the SIM card evolution that Apple introduced in iPadAir2 and iPadMini3. While they had great expectations, it didnt work out exactly as they had hoped due to the operators not letting Apple use the feature they wanted. In fact John Legere, T-Mobile US CEO, took to twitter to explain the problem. See here.

Another example is the new MVNO model by Google (Fi) in the USA. The problem in USA compared to Europe is that the operators have monopoly in many areas (fixed and mobile) and they can also get away with charging far higher amounts.

In addition, the problem that the operators have is that they focus on areas where they don't have issues; crying wolf if required. An example is taking advantage of 'data tsunami' and using it to hoard spectrum, as be seen from the tweet below:

Verizon Wireless admits to hoarding spectrum, ends any argument about a spectrum crunch http://t.co/0aqpGxlEvm
— Kevin Ahoy (@FlightsimGeek) February 23, 2015

Anyway, here is the presentation. Let me know what you think.

Voice over WiFi (VoWiFi) technical details

VoWiFi is certainly a hot topic, thanks to the support of VoWiFi on iPhone 6. A presentation from LTE World Summit 2014 by Taqua on this topic has already crossed 13K views. In this post I intend to look at the different approaches for VoWiFi and throw in some technical details. I am by no means an expert so please feel free to add your input in the comments.

Anybody reading this post is not aware of S2a, S2b, Samog, TWAG, ePDG, etc. and what they are, please refer to our whitepaper on cellular and wi-fi integration here (section 3).

There are two approaches to VoWiFi, native client already in your device or an App that could be either downloaded from the app store or pre-installed. The UK operator '3' has an app known as ThreeInTouch. While on WiFi, this app can make and receive calls and texts. The only problem is that it does not handover an ongoing call from WiFi to cellular and and vice versa. Here are a few slides (slides 36-38) from them from a conference last year:

Quick Summary of LTE Voice Summit 2014 #LTEVoice from eXplanoTech

The other operators have a native client that can use Wi-Fi as the access network for voice calls as well as the data when the device is connected on the WLAN.

A simple architecture can be seen from the picture above. As can be seen, the device can connect to the network via a non-3GPP trusted wireless access network via the TWAG or via a non-3GPP untrusted wireless access network via ePDG. In the latter case, an IPSec tunnel would have to be established between the device and the ePDG. The SIM credentials would be used for authentication purposes so that an intruder cannot access ePDG and the core.

Now, I dont want to talk about VoLTE bearers establishment, etc. which I have already done here earlier. In order to establish S2a (trusted) and S2b (untrusted) connection, the AAA server selects an APN among those which are subscribed to in the HLR/HSS. The PDN-GW (generally referred to as PGW) dynamically assigns an IP address out of a pool of addresses which is associated with this APN. This UE IP address is used by the VoWiFi SIP UA (User Agent) as the contact information when registering to the SIP soft switch (which would typically be the operators IMS network).

If for any reason the SIP UA in the device is not able to use the SIM for authentication (needs ISIM?) then a username/password based authentication credentials can be used (SIP digest authentication).

Typically, there would be a seperate UA for VoLTE and VoWiFi. They would both be generally registering to the same IMS APN using different credentials and contact addresses. The IMS network can deal with multiple registrations from the same subscriber but from different IP addresses (see 3GPP TS 23.237 - 'IMS Service Continuity' for details).

Because of multiple UA's, a new element needs to be introduced in order to 'fork' the downstream media streams (RTP/RTCP packets) to different IP addresses over time.

3GPP has defined the Access Transfer Gateway (ATGW) which is controlled by the Access Transfer Control Function (ATCF); the ATCF interfaces to the IMS and Service Centralization and Continuity Application Server (SCC AS). All these are not shown in the picture above but is available in 3GPP TS 23.237. The IMS networks in use today as well as the one being deployed for VoLTE does not have ATGW/ATCF. As a result vendors have to come up with clever non-standardised solutions to solve the problem.

When there is a handover between 3GPP and non-3GPP networks, the UE IP address needs to be preserved. Solutions like MIP and IPSec have been used in the past but they are not flexible. The Release-12 solution of eSAMOG (see 3GPP TS 23.402) can be used but the solution requires changes in the UE. For the time being we will see proprietary solutions only but hopefully in future there would be standardised solutions available.

3GPP TS 23.234 describes more in detail the interworking of 3GPP based system and WLAN. Interested readers can refer to that for further insight.

Enhancing voice services using VoLTE

VoLTE has been a very popular topic on this blog. My overview of the LTE Voice Summit missed out narrowly from the Top 10 posts of 2014 but there were other posts related to VoLTE that made it.

In this magazine article, NTT Docomo not only talks about its own architecture and transition from 3G to 4G for voice and video, it provides some detailed insights from its own experience.

There is also discussion into technical details of the feature and examples of signalling for VoLTE registration and originating/terminating calls (control, session and user plane establishment), SMS, SRVCC, Video over LTE (ViLTE) and voice to video call switching.

The paper is embedded below and available from slideshare to download.

VoLTE for Enhancing Voice Services from Zahid Ghadialy

Related links:

• DOCOMO VoLTE and Next Steps
• VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout)
• 2015 will finally be the year of Voice over LTE (VoLTE)

2015 will finally be the year of Voice over LTE (VoLTE)

On 4th Nov. 2009, the One Voice initiative was published by 12 companies including AT&T, Orange, Telefonica, TeliaSonera, Verizon, Vodafone, Alcatel-Lucent, Ericsson, Nokia Siemens Networks, Nokia, Samsung and Sony Ericsson. These all agreed that the IMS based solution, as defined by 3GPP, is the most applicable approach to meet their consumers expectations for service quality, reliability and availability when moving from existing CS based voice services to IP based LTE services.

On 15th Feb 2010, GSMA announced that it has adopted the work of the One Voice initiative to drive the global mobile industry towards a standard way of delivering voice and messaging services for LTE. The GSMA’s VoLTE initiative was supported by more than 40 organisations from across the mobile ecosystem, including many of the world’s leading mobile communication service providers, handset manufacturers and equipment vendors, all of whom support the principle of a single, IMS-based voice solution for next-generation mobile broadband networks. This announcement was also supported by 3GPP, Next Generation Mobile Networks alliance (NGMN) and the International Multimedia Teleconferencing Consortium (IMTC).

GSMA has produces various reference documents that map to the 3GPP standards documents as can be seen above.

As per GSA: 71 operators are investing in VoLTE studies, trials or deployments, including 11 that have commercially launched HD voice service. The number of HD voice launches enabled by VoLTE is forecast to reach 19 by end-2014 and then double in 2015. In July 2014 GSA confirmed 92 smartphones (including carrier and frequency variants) support VoLTE, including products by Asus, Huawei, LG, Pantech, Samsung and Sony Mobile. The newly-announced Apple iPhone 6 & 6 Plus models support VoLTE.

Things are also moving quickly with many operators who have announced VoLTE launches and are getting more confident day by day. Du, Dubai recently announced Nokia as VoLTE partner. KDDI, Japan is launching au VoLTE in December. Telstra, Australia has already been doing trials and plans to launch VoLTE network in 2015. Finally, Verizon and AT&T will have interoperable VoLTE calls in 2015.

Below is my summary from the LTE Voice Summit 2014. Let me know if you like it.

Quick Summary of LTE Voice Summit 2014 #LTEVoice from eXplanoTech

Codecs and Quality across VoLTE and OTT Networks

Codecs play an important role in our smartphones. Not only are they necessary and must for encoding/decoding the voice packets but they increase the price of our smartphones too.

A $400 smartphone can have as much as $120 in IPR fees. If you notice in the picture above its $10.60 for the H.264 codec. So its important that the new codecs that will come as part of new generation of mobile technology is free, open source or costs very little.

The new standards require a lot of codecs, some for backward compatibility but this can significantly increase the costs. Its important to make sure the new codecs selected are royalty-free or free license.

The focus of this post is a presentation by Amir Zmora from AudioCodecs in the LTE Voice Summit. The presentation below may not be self-explanatory but I have added couple of links at the bottom of the post where he has shared his thoughts. Its worth a read.

Quality Across VoLTE and non-VoLTE Networks from Amir Zmora

A good explanation of Voice enhancement tools as follows (slide 15):

Adaptive Jitter Buffer (AJB) – Almost all devices today (Smartphones, IP phones, gateways, etc.) have built in jitter buffers. Legacy networks (which were LAN focused when designed) usually have older devices with less sophisticated jitter buffers. When designed they didn’t take into account traffic coming in from networks such as Wi-Fi with its frequent retransmissions and 3G with its limited bandwidth, in which the jitter levels are higher than those in wireline networks. Jitter buffers that may have been planned for, say, dozens of msec may now have to deal with peaks of hundreds of msec. Generally, if the SBC has nothing to mediate (assume the codecs are the same and the Ptime is the same on both ends) it just forwards the packets. But the unexpected jitter coming from the wireless network as described above, requires the AJB to take action. And even if the network is well designed to handle jitter, today’s OTT applications via Smart Phones add yet another variable to the equation. There are hundreds of such devices out there, and the audio interfaces of these devices (especially those of the Android phones) create jitter that is passed into the network. For these situations, too, the AJB is necessary.

To overcome this issue, there is a need for a highly advanced Adaptive Jitter Buffer (AJB) built into the SBC that neutralizes the incoming jitter so that it is handled without problem on the other side. The AJB can handle high and variable jitter rates.

Additionally, the AJB needs to work in what is called Tandem scenarios where the incoming and outgoing codec is the same. This scenario requires an efficient solution that will minimize the added delay. AudioCodes has built and patented solutions supporting this scenario.

Transcoding – While the description above discussed the ability to bypass the need to perform transcoding in the Adaptive Jitter Buffer context, there may very well be a need for transcoding between the incoming and outgoing packet streams. Beyond being able to mediate between different codecs on the different networks on either end of the SBC, the SBC can transcode an incoming codec that is less resilient to packet loss (such as narrowband G.729 or wideband G.722) to a more resilient codec (such as Opus). By transcoding to a more resilient codec, the SBC can lower the effects of packet loss. Transcoding can also lower the bandwidth on the network. Additionally, the SBC can transcode from narrowband (8Khz) to wideband (16Khz) (and vice versa) as well as wideband transcoding, where both endpoints support wideband codecs but are not using the same ones. For example, a wireless network may be using the AMR wideband codec while the wireline network on the other side may be using Opus. Had it not been for the SBC, these two networks would have negotiated a common narrowband codec.

Flexible RTP Redundancy – The SBC can also use RTP redundancy in which voice packets are sent several times to ensure they are received. Redundancy is used to balance networks which are characterized by high packet loss burst. While reducing the effect of packet loss, Redundancy increases the bandwidth (and delay). There are ways to get around this bandwidth issue that are supported by the SBC. One way is by sending only partial packet information (not fully redundant packets). The decoder on the receiving side will know how to handle the partial information. This process is called Forward Error Correction (FEC).

Transrating – Transrating is the process of having more voice payload ‘packed’ into a single RTP packet by increasing the packet intervals, thus changing the Packetization Time or Ptime. Ptime is the time represented by the compression of the voice signals into packets, generally at 20 msec intervals. In combining the payloads of two or more packets into one, the Transrating process causes a reduction in the overhead of the IP headers, lowering the bandwidth and reducing the stress on the CPU resources, however, it increases delay. It thus can be used not only to mediate between two end devices using different Ptimes, but also as a means of balancing the network by reducing bandwidth and reducing CPU pressure during traffic peaks.

Quality-based Routing – Another tool used by the SBC is Quality-based routing. The SBC, which is monitoring all the calls on the network all the time, can decide (based on pre-defined thresholds and parameters) to reroute calls over different links that have better quality.

Further reading:

• 3 Things Required for Managing Cross Network Voice Quality
• The Brain behind Voice Quality
• HD Voice - Next step in the evolution of voice communication
• Patent insanity: Royalty fees could reach $120 on a $400 smartphone

Voice over WiFi (VoWiFi)

One of the changes that I have noticed in the last year is that some of the operators who have been opposed to WiFi in the past have not only embraced it but are now trying to monopolise the same WiFi spectrum they billed as interference prone. Personally, I think the future of Wi-Fi is not just offloading but also working together with LTE. We are billing this as 4.5G and have recently produced a whitepaper, available here.

There has been a flurry of activity on Voice over Wi-Fi in the last few months. Recently the UK operators '3' and EE announced that they are both allowing WiFi calling and SMS. While '3' customers will have to use an OTT app for the time being, EE customers will experience this seamlessly.

I heard Taqua in the recent LTE World Summit talking about their solution and have offered to share their slides (embedded below). It was interesting to find out while having a discussion with them that their solution supports 'hand-in' and 'hand-out'. This takes away a major advantage that Small Cells offered, seamless roaming. Anyway, feel free to let me know of you have any opinion on this topic

Cellular Services over WiFi from 3G4G

VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout)

Voice over LTE or VoLTE has many problems to solve. One of the issues that did not have a clear solution initially was Roaming. iBasis has a whitepaper on this topic here, from which the above picture is taken. The following is what is said above:

The routing of international calls has always been a problem for mobile operators. All too often the answer—particularly in the case of ‘tromboning’ calls all the way back to the home network—has been inelegant and costly. LTE data sessions can be broken out locally, negating the need for convoluted routing solutions. But in a VoIMS environment all of the intelligence that decides how to route the call resides in the home network, meaning that the call still has to be routed back.

The industry’s solution to this issue is Roaming Architecture for Voice over LTE with Local Breakout (RAVEL). Currently in the midst of standardisation at 3GPP, RAVEL is intended to enable the home network to decide, where appropriate, for the VoIMS call to be broken out locally. 

Three quarters of respondents to the survey said they support an industry-wide move to RAVEL for VoLTE roaming. This is emphatic in its enthusiasm but 25 per cent remains a significant share of respondents still to be convinced. Just over half of respondents said they plan to support VoIMS for LTE roaming using the RAVEL architecture, while 12.3 per cent said they would support it, but not using RAVEL.

Until RAVEL is available, 27.4 per cent of respondents said they plan to use home-routing for all VoLTE traffic, while just under one fifth said they would use a non-standard VoLTE roaming solution.

Well, the solution was standardised in 3GPP Release-11. NTT Docomo has an excellent whitepaper (embedded below) explaining the issue and the proposed solution.

In 3GPP Release 11, the VoLTE roaming and interconnection architecture was standardized in cooperation with the GSMA Association. The new architecture is able to implement voice call charging in the same way as circuit-switched voice roaming and interconnection models by routing both C-Plane messages and voice data on the same path. This was not possible with the earlier VoLTE roaming and interconnection architecture.

Anyway, here is the complete whitepaper

NTT Docomo: VoLTE Roaming and Interconnection Standard Technology from Zahid Ghadialy

Different flavours of SRVCC (Single Radio Voice Call Continuity)

Single Radio Voice Call Continuity (SRVCC) has been quietly evolving with the different 3GPP releases. Here is a quick summary of these different flavors

In its simplest form, SRVCC comes into picture when an IMS based VoLTE call is handed over to the existing 2G/3G network as a normal CS call. SRVCC is particularly important when LTE is rolled out in small islands and the operator decided to provide VoLTE based call when in LTE. An alternative (used widely in practice) is to use CS Fallback (CSFB) as the voice option until LTE is rolled out in a wider area. The main problem with CSFB is that the data rates would drop to the 2G/3G rates when the UE falls back to the 2G/3G network during the voice call.

The book "LTE-Advanced: A Practical Systems Approach to Understanding 3GPP LTE Releases 10 and 11 Radio Access Technologies" by Sassan Ahmadi has some detailed information on SRVCC, the following is an edited version from the book:

SRVCC is built on the IMS centralized services (ICS) framework for delivering voice and messaging services to the users regardless of the type of network to which they are attached, and for maintaining service continuity for moving terminals.

To support GSM and UMTS, some modifications in the MSC server are required. When the E-UTRAN selects a target cell for SRVCC handover, it needs to indicate to the MME that this handover procedure requires SRVCC. Upon receiving the handover request, the MME triggers the SRVCC procedure with the MSC server. The MSC then initiates the session transfer procedure to IMS and coordinates it with the circuit-switched handover procedure to the target cell.

Handling of any non-voice packet-switched bearer is by the packet-switched bearer splitting function in the MME. The handover of non-voice packet-switched bearers, if performed, is according to a regular inter-RAT packet-switched handover procedure.

When SRVCC is enacted, the downlink flow of voice packets is switched toward the target circuit-switched network. The call is moved from the packet-switched to the circuit-switched domain, and the UE switches from VoIP to circuit-switched voice.

3GPP Rel-10 architecture has been recommended by GSMA for SRVCC because it reduces both voice interruption time during handover and the dropped call rate compared to earlier configurations. The network controls and moves the UE from E-UTRAN to UTRAN/GERAN as the user moves out of the LTE network coverage area. The SRVCC handover mechanism is entirely network-controlled and calls remain under the control of the IMS core network, which maintains access to subscribed services implemented in the IMS service engine throughout the handover process. 3GPP Rel-10 configuration includes all components needed to manage the time-critical signaling between the user’s device and the network, and between network elements within the serving network, including visited networks during roaming. As a result, signaling follows the shortest possible path and is as robust as possible, minimizing voice interruption time caused by switching from the packet-switched core network to the circuit-switched core network, whether the UE is in its home network or roaming. With the industry aligned around the 3GPP standard and GSMA recommendations, SRVCC-enabled user devices and networks will be interoperable, ensuring that solutions work in many scenarios of interest.

Along with the introduction of the LTE radio access network, 3GPP also standardized SRVCC in Rel-8 specifications to provide seamless service continuity when a UE performs a handover from the E-UTRAN to UTRAN/GERAN. With SRVCC, calls are anchored in the IMS network while the UE is capable of transmitting/ receiving on only one of those access networks at a given time, where a call anchored in the IMS core can continue in UMTS/GSM networks and outside of the LTE coverage area. Since its introduction in Rel-8, the SRVCC has evolved with each new release, a brief summary of SRVCC capability and enhancements are noted below

3GPP Rel-8: Introduces SRVCC for voice calls that are anchored in the IMS core network from E-UTRAN to CDMA2000 and from E-UTRAN/UTRAN (HSPA) to UTRAN/GERAN circuit-switched. To support this functionality, 3GPP introduced new protocol interface and procedures between MME and MSC for SRVCC from E-UTRAN to UTRAN/GERAN, between SGSN and MSC for SRVCC from UTRAN (HSPA) to UTRAN/GERAN, and between the MME and a 3GPP2-defined interworking function for SRVCC from E-UTRAN to CDMA 2000.

• 3GPP Rel-9: Introduces the SRVCC support for emergency calls that are anchored in the IMS core network. IMS emergency calls, placed via LTE access, need to continue when SRVCC handover occurs from the LTE network to GSM/UMTS/CDMA2000 networks. This evolution resolves a key regulatory exception. This enhancement supports IMS emergency call continuity from E-UTRAN to CDMA2000 and from E-UTRAN/UTRAN (HSPA) to UTRAN/ GERAN circuit-switched network. Functional and interface evolution of EPS entities were needed to support IMS emergency calls with SRVCC.

• 3GPP Rel-10: Introduces procedures of enhanced SRVCC including support of mid-call feature during SRVCC handover (eSRVCC); support of SRVCC packet-switched to circuit-switched transfer of a call in alerting phase (aSRVCC); MSC server-assisted mid-call feature enables packet-switched/ circuit-switched access transfer for the UEs not using IMS centralized service capabilities, while preserving the provision of mid-call services (inactive sessions or sessions using the conference service). The SRVCC in alerting phase feature adds the ability to perform access transfer of media of an instant message session in packet-switched to circuit-switched direction in alerting phase for access transfers.

• 3GPP Rel-11: Introduces two new capabilities: single radio video call continuity for 3G-circuit-switched network (vSRVCC); and SRVCC from UTRAN/GERAN to E-UTRAN/HSPA (rSRVCC). The vSRVCC feature provides support of video call handover from E-UTRAN to UTRAN-circuitswitched network for service continuity when the video call is anchored in IMS and the UE is capable of transmitting/receiving on only one of those access networks at a given time. Service continuity from UTRAN/GERAN circuitswitched access to E-UTRAN/HSPA was not specified in 3GPP Rel-8/9/10. To overcome this drawback, 3GPP Rel-11 provided support of voice call continuity from UTRAN/GERAN to E-UTRAN/HSPA. To enable video call transfer from E-UTRAN to UTRAN-circuit-switched network, IMS/EPC is evolved to pass relevant information to the EPC side and S5/S11/Sv/Gx/Gxx interfaces are enhanced for video bearer-related information transfer. To support SRVCC from GERAN to E-UTRAN/HSPA, GERAN specifications are evolved to enable a mobile station and base station sub-system to support seamless service continuity when a mobile station hands over from GERAN circuit-switched access to EUTRAN/ HSPA for a voice call. To support SRVCC from UTRAN to EUTRAN/ HSPA, UTRAN specifications are evolved to enable the RNC to perform rSRVCC handover and to provide relative UE capability information to the RNC.

NTT Docomo has a presentation on SRVCC and eSRVCC which is embedded below:

Improvement of VoLTE Domain HO with Operators Vision from Zahid Ghadialy