5G Network Architecture and Design Update - Jan 2017

Andy Sutton, Principal Network Architect at BT recently talked about the architecture update from the Dec 2016 3GPP meeting. The slides and the video is embedded below.

5G Network Architecture and Design from 3G4G

You can see all the presentations from IET event 'Towards 5G Mobile Technology – Vision to Reality' here.

Eiko Seidel recently also wrote an update from 3GPP 5G Adhoc regarding RAN Internal Functional Split. You can read that report here.

Related posts:

• 5G New Radio (NR), Architecture options and migration from LTE
• 5G Fronthaul: Crosshaul & XHaul
• Some more thoughts on 5G
• Verizon's 5G Standard
• 5G Network Architecture Options - Video

5G New Radio (NR), Architecture options and migration from LTE

You have probably read about the demanding requirements for 5G in many of my blog posts. To meet these demanding requirements a 'next-generation radio' or 'new radio' (NR) will be introduced in time for 5G. We dont know as of yet what air interface, modulation technology, number of antennas, etc. for this NR but this slide above from Qualcomm gives an idea of what technologies will be required for this 5G NR.

The slide above gives a list of design innovations that will be required across diverse services as envisioned by 5G proponents.

It should be mentioned that Rel-10/11/12 version of LTE is referred to as LTE-Advanced and Rel-13/14 is being referred to as LTE-A Pro. Rel-15 will probably have a new name but in various discussions its being referred to as eLTE.

When first phase of 5G arrives in Rel-15, eLTE would be used for access network and EPC will still be used for core network. 5G will use NR and eventually get a new core network, probably in time for phase 2. This is often referred to as next generation core network (NGCN).

The slides below from Deutsche Telekom show their vision of how operators should migrate from eLTE to 5G.

The slides below from AT&T show their vision of LTE to 5G migration.

Eiko Seidel posted the following in 3GPP 5G standards group (i recommend you join if you want to follow technical discussions)


Summary RAN1#86 on New Radio (5G) Gothenburg, Sweden

At this meeting RAN1 delegates presented and discussed numerous evaluation results mainly in the areas of waveforms and channel coding.

Nonetheless RAN1 was not yet prepared to take many technical decisions. Most agreements are still rather general. 

First NR terminology has been defined. For describing time structures mini-slots have been introduced: a mini-slot is the smallest possible scheduling unit and smaller than a slot or a subframe.

Discussions on waveforms favored filtered and windowed OFDM. Channel coding discussions were in favor of LDPC and Turbo codes. But no decisions have been made yet.

Not having taken many decisions at this meeting, RAN1 now is behind its schedule for New Radio.
Hopefully the lag can be made up at two additional NR specific ad hoc meetings that have been scheduled for January and June 2017.

(thanks to my colleague and friend Dr. Frank Kowalewski for writing this short summary!)

Yet another post from Eiko on 3GPP RAN 3 on related topic.

The RAN3 schedule is that in February 2017 recommendations can be made for a protocol architecture.  In the meeting arguments came up by some parties that the work plan is mainly addressing U-Plane architecture and that split of C- and U-plane is not considered sufficiently. The background is that the first step will be dual connectivity with LTE using LTE RRC as control plane and some companies would like to concentrate on this initially. It looks like that a prioritization of features might happen in November timeframe. Beside UP and CP split, also the functional split between the central RAN node and the distributed RAN node is taking place for the cloud RAN fronthaul interface. Besides this, also discussion on the fronthaul interface takes place and it will be interesting to see if RAN3 will take the initiative to standardize a CPRI like interface for 5G. Basically on each of the three interfaces controversial discussion is ongoing.

Yet another basic question is, what is actually considered as a “New 5G RAN”? Is this term limited to a 5G eNB connected to the NG core? Or can it also be also an eLTE eNB with Dual Connectivity to 5G? Must this eLTE eNB be connected to the 5G core or is it already a 5G RAN when connected to the EPC? 

Finally, a slide from Qualcomm on 5G NR standardization & launch.

Dedicated Core Networks (DCN) for different traffic types

Looking at a paper (embedded below) from NTT Docomo technical journal where they talk about Dedicated Core Network (DCN) for handling different traffic type (M2M/IoT for example). Note that this approach is different from NFV based network sliced architecture. For the latter, the network functions should have been virtualized.

There will be some signalling overhead in the core network to handle the new core and reroute the traffic according destined for the new dedicated core. I would still hope that this would be minuscule in the grand scheme of things. Anyway, let me know what you think about the paper below.

EE's vision of Ultra-Reliable Emergency Network

Many of my readers would be aware that UK is probably the first country to have decided to move its emergency services network from an existing TETRA network to a commercial LTE network operated by EE.

While some people have hailed this as a very bold move in the right direction, there is no shortage of critics. Around 300,000 emergency services users will share the same infrastructure used by over 30 million general users.

The following is from an article in Wireless Magazine:

Steve Whatson, deputy director Delivery, Emergency Services Mobile Communications Programme (ESMCP) – the organisation within the UK Home Office procuring ESN – assured delegates that ESN will match the existing dedicated Airwave emergency services communication network in terms of coverage for roads, outdoor hand portable devices and marine coverage. Air to ground (A2G) will extend its reach from 6,000ft to 12,000ft.

Whatson also pointed out that coverage is not one single piece, but will comprise a number of different elements, which all need to mesh into one seamless network run by the ESN Lot 3 Mobile Services (main 4G network) provider – EE.

This includes: EE’s main commercial 4G network; Extended Area Services (hard-to-reach areas of the UK where new passive sites are to be built under a separate contract and then equipped with EE base stations); air-to-ground; London Underground; Crossrail; marine coverage (to 12 nautical miles); and special coverage solutions.

EE is currently rolling out new 4G sites – it will eventually have some 19,500 sites – and is upgrading others with 800MHz spectrum, which propagates over longer distances and is better at penetrating buildings than its other 4G spectrum holdings. Crucially for ESN, it is also switching on a Voice over LTE (VoLTE) capability, starting with the UK’s main cities.
...
Mission critical networks must be always available and have levels of resilience far in excess of commercial networks. Speaking exclusively to Wireless in early May, Tom Bennett, group director Technology Services, Architecture & Devices at EE, said: ‘We already achieve a very high availability level, but what the Home Office was asking for effectively was about a 0.3% increase against our existing commercial availability levels.

‘Now for every 0.1% increase in availability there is a significant investment because you are at the extreme top end of the curve where it is harder and harder to make a noticeable difference.’

There are very specific requirements for coverage and availability of the ESN network for the UK road system. Bennett says: ‘Mobile is based on a probability of service. No more than 1% of any constabulary’s roads are allowed to be below 75% availability, and on major roads it is 96% availability. A coverage gap in this context is no more than 1km.’

The current Airwave network has approximately 4,000 sites, many with back-up generators on site with fuel for seven days of autonomous running if the main power is cut, along with a range of resilient backhaul solutions.

Bennett says that out of EE’s 18,500 sites it has about the same number of unique coverage sites (ie. no overlapping coverage) – around 4,000. ‘As part of our investment programme, those unique coverage sites will need a significant investment in the causes of unavailability – ie. resilient backhaul and back-up batteries.’

He explains that EE has undertaken a lot of analysis of what causes outages on its network, and it has combined that data with the Home Office’s data on where the natural disasters in the UK have occurred over the past 10 years.

From this, EE is able to make a reasonable assessment of which sites are likely to be out of action due to flooding or other disasters for more than three or four days. ‘For those sites – and it is less than 4,000 – you need generators too, because you may not be able to physically access the sites for some days,’ says Bennett.

For obvious reasons, the unique coverage sites are mostly in rural areas. But as Bennett points out, the majority of cases where the emergency services are involved is where people are – suburban and urban areas.

‘In these areas EE has overlapping coverage from multiple sites to meet the capacity requirements, so if a site goes down, in the majority of cases we have compensation coverage. A device can often see up to five tower sites in London, for example,’ he says.

Having adequate backhaul capacity – and resilient backhaul at that – is vital in any network. Bennett says EE is installing extra backhaul, largely microwave and fibre, but other solutions will also be used including satellite and LTE relay from base station to base station – daisy chaining. On 9 May 2016, EE announced a deal with satellite provider Avanti to provide satellite backhaul in some areas of the UK.

Additional coverage and resilience will be offered by RRVs (rapid response vehicles), which EE already has in its commercial network today, for example, to provide extra capacity in Ascot during the racing season.

‘We would use similar, although not exactly the same technology for disaster recovery and site/service recovery, but with all the backhaul solutions,’ says Bennett. ‘Let’s say we planned some maintenance or upgrade work that involved taking the base station out for a while.

‘We’d talk to the chief inspector before the work commences. If he says, there’s no chance of doing that tonight, we can put the RRV there, and provided we maintain coverage, we can carry out the work. RRVs are a very good tool for doing a lot of things.’

At the British APCO event, Mansoor Hanif, director of Radio Access Networks at EE said it was looking at the possibility of using ‘airmasts’ to provide additional coverage. Meshed small cells, network in a box and repeater solutions are becoming available for these ‘airmasts’, which will provide coverage from balloons, or UAVs – tethered drones with power cables and optical fibre connected to them.

Mansoor Hanif, Director of RAN at EE gave a presentation on this at Critical Communications World 2016 and has also given an interview. Both are embedded below.

Ultra-Reliable Networks – A Mobile Operator Perspective from 3G4G

Feel free to let me know if you believe this will work or not and why.

History: 30 years of the mobile phone in the UK

In January 1985 the UK launched its first mobile networks. Now, thirty years on, many people and companies in the UK have been celebrating this enormous achievements and advances that have been made since then and which have seen the mobile evolve from a humble telephone into the multimedia pocket computer which has become such an essential part of modern life. It was simply not possible in 1985 to envisage a country that would be able to boast more active mobile phones than people or to have along the way clocked up several world firsts, and be now leading on the deployment of 4G and shaping the future 5G technologies.

Below is a series of talks in an event organised by University of Salford,



The following talks are part of playlist:

1. Launch of Vodafone – Nigel Linge, on behalf of Vodafone
2. Launch of Cellnet - Mike Short, O2
3. The emergence of GSM - Stephen Temple, 5GIC
4. The launch of Mercury one2one and Orange - Graham Fisher, Bathcube Telecoms
5. From voice to data - Stuart Newstead, Ellare
6. Telepoint - Professor Nigel Linge, University of Salford
7. 3G - Erol Hepsaydir, 3 UK
8. Handset evolution and usage patterns - Julian Divett, EE
9. 4G and onwards to 5G – Professor Andy Sutton, EE  and University of Salford.

For anyone interested in reading about the history of mobile phones in UK, read this book below with more facts and figures

If you have any facts to share, please feel free to add in the comments below.

Does 5G need 'Next Generation' of Internet Protocols?

I have often heard Martin Geddes mention that the Internet is broken, the protocols (TCP/IP) are wrong and if we want to continue the way our data usage is going, we need to define new protocols (see here for example). It was good to find out last week at 5G Huddle that ETSI is already working on this.

The TCP/IP protocol suite has undoubtedly enabled the evolution of connected computing and many other developments since its invention during the 1970’s. Thanks to the development and ubiquity of this protocol stack, we have managed to build an Internet on which we are dependent as a communications tool, an information storage and distribution tool, a marketing channel and a sales and distribution platform, for consumers and for businesses large and small.

However, the industry has reached a point where forward leaps in the technology of the local access networks will not deliver their full potential unless, in parallel, the underlying protocol stacks used in core and access networks evolve. The development of future 5G systems presents a unique opportunity to address this issue, as a sub-optimal protocol architecture can negate the huge performance and capacity improvements planned for the radio access network.

ETSI has created an Industry Specification Group to work on Next Generation Protocols (NGP ISG), looking at evolving communications and networking protocols to provide the scale, security, mobility and ease of deployment required for the connected society of the 21st century.

The NGP ISG will identify the requirements for next generation protocols and network architectures, from all interested user and industry groups. Topics include:

• Addressing
• Security, Identity, Location, Authorization, Accounting/Auditing and Authentication
• Mobility
• Requirements from Internet of Things
• Requirements from video and content distribution
• Requirements from ultra‐low latency use cases from different sectors (i.e. automotive)
• Requirements from network operators (e.g. challenges with E2E encrypted content)
• Requirements from eCommerce
• Requirements for increased energy efficiency within the global ICT sector.

This ISG is seen as a transitional group i.e. a vehicle for the 5G community (and others of interest) to first gather their thoughts and prepare the case for the Internet community’s engagement in a complementary and synchronised modernisation effort.

The ISG provides a forum for interested parties to contribute by sharing research and results from trials and developments in such a way that a wider audience can be informed. Other standards bodies will be involved so that parallel and concerted standardization action can take place as a further step in the most appropriate standards groups.

Andy Sutton, chair of the NGP recently gave the following presentation in 5G Huddle:

Please feel free to add your opinions in the comments.

Further reading:

• Nokia, ARM, twisting Intel bid to reinvent the TCP/IP stack for a 5G era
• Network architecture research: TCP/IP vs RINA
• ETSI to explore next generation protocols
• ∆Q Reading List

**** Added 05/06/2016:20.00 ****
A whitepaper published by ETSI on this topic is available here and embedded below:

Possible 5G Network Architecture Evolution

Came across this interesting Network Architecture evolution Roadmap by Netmanias. Its embedded below and available to download from the Netmanias website.

End to end and top to bottom network design…

A good way to start 2016 is by a lecture delivered by Andy Sutton, EE at the IET conference 'Towards 5G Mobile Technology – Vision to Reality'. The slides and the video are both embedded below. The video also contains Q&A at the end which people may find useful.

Videos of all other presentations from the conference are available here for anyone interested.

5G, NFV and Network Slicing

5G networks have multifaceted requirements where the network needs to be optimised for data rate, delay and connection numbers. While some industry analysts suspect that these requirements cannot be met by a single network, vendors suggest that Network Slicing will allow all these requirements to be met by a single network.

Ericsson's whitepaper provides a good definition of what network slicing means:

A logical instantiation of a network is often called a network slice. Network slices are possible to create with both legacy platforms and network functions, but virtualization technologies substantially lower barriers to using the technology, for example through increased flexibility and decreased costs.

...

Another aspect of management and network slicing is setting up separate management domains for different network slices. This may allow for completely separate management of different parts of the network that are used for different purposes. Examples of use cases include mobile virtual network operators (MVNOs) and enterprise solutions. This kind of network slice would, in current Evolved Packet Core (EPC) networks, only cover the PDN gateway (PGW) and the policy control resource function (PCRF). However, for machine type communication (MTC) and machine-tomachine (M2M) solutions, it is likely that it would also cover the Mobile Management Entities (MMEs) and Serving Gateways (SGWs).

NGMN came out with the 5G whitepaper which touched on this subject too: 

Figure above illustrates an example of multiple 5G slices concurrently operated on the same infrastructure. For example, a 5G slice for typical smartphone use can be realized by setting fully-fledged functions distributed across the network. Security, reliability and latency will be critical for a 5G slice supporting automotive use case. For such a slice, all the necessary (and potentially dedicated) functions can be instantiated at the cloud edge node, including the necessary vertical application due to latency constraints. To allow on-boarding of such a vertical application on a cloud node, sufficient open interfaces should be defined. For a 5G slice supporting massive machine type devices (e.g., sensors), some basic C-plane functions can be configured, omitting e.g., any mobility functions, with contentionbased resources for the access. There could be other dedicated slices operating in parallel, as well as a generic slice providing basic best-effort connectivity, to cope with unknown use cases and traffic. Irrespective of the slices to be supported by the network, the 5G network should contain functionality that ensures controlled and secure operation of the network end-to-end and at any circumstance.

Netmanias has a detailed article on this topic which is quite interesting too, its available here.

Recently, South Korean operator SK Telecom and Ericsson concluded a successful trial of this technology, see here. Ericsson is also working with NTT Docomo on 5G including network slicing, see here.

Updates from the 3GPP RAN 5G Workshop - Part 3

Continuing with the updates from 5G RAN workshop, part 1 and part 2 here.

Dish network wants to have a satellite based 5G network. A recent article from Light Reading shows the following:

Dish states that there are misconceptions about what satellite technology can deliver for 5G networks. Essentially Dish says that satellites will be capable of delivering two-way communications to support 5G.

A hybrid ground and space 5G network would use small satellites that each use a "spot beam" to provide a dedicated area of two-way coverage on the ground. This is different than the old model of using one satellite with a single beam to provide a one-way service like a TV broadcast over a landmass.

Dish argues that newer, smaller satellites, equipped with the latest multi-antenna arrays (MIMO) would allow for "ubiquitous connectivity through hybrid satellite and terrestrial networks," the operator writes. In this model, satellites could connect areas that it would be hard to network otherwise like mountains and lakes.

The presentation from Dish is as follows:

Alcatel-Lucent provided a whitepaper along with the presentation. The paper provides an interesting view of 5G from their point of view. Its embedded below:

The presentation from Kyocera focused on TD-LTE which I think will play a prominent role in 5G. In case of wide channels, TD-LTE can help predict the channel accurately, which is a drawback for FDD at high frequencies. Their presentation is available here.

The presentation from NEC focussed on different technologies that will play a role in 5G. Their presentation is available here.

The final presentation we will look at this time is by the South Korean operator, KT. What is interesting to see is that in the part 1 we saw in the chairman's summary that 5G will come in two phases; Rel-15 will be phase 1 and Rel-16 will be phase 2. In the summary slide in KT's presentation, it looks like they are going to consider Rel-14 as 5G. Its not at all surprising considering that Verizon has said that they want to commercialise 5G by 2017, even though 5G will not be fully specified according to 3GPP by then. Anyway, here is the presentation by KT.

VoLTE Roaming: LBO, S8HR or HBO

There was an interesting discussion on different roaming scenarios in the LTE Voice Summit on 29th, 30th Sep. in London. The above picture provides a brief summary of these well known options. I have blogged about LBO/RAVEL here and S8HR here. A presentation by NTT Docomo in a GSMA webinar here provides more details on these architectures (slide 29 onwards - though it is more biased towards S8HR).

Ajay Joseph, CTO, iBasis gave an interesting presentation that highlighted the problems present in both these approaches.

In case of LBO, the biggest issue is that the home operator need to do a testing with each roaming partner to make sure VoLTE roaming works smoothly. This will be time consuming and expensive.

In case of S8HR, he provided a very good example. Imagine a VoLTE subscriber from USA is visiting Singapore. He now needs to make a phone call to someone in Indonesia (which is just next to Singapore). The flow of data would be all the way from Singapore to USA to Indonesia and back. This can introduce delays and impact QoE. The obvious advantage of S8HR is that since the call setup and media go to Home PMN (Public Mobile Network), no additional testing with the Visited PMN is required. The testing time is small and rollouts are quicker.

iBasis are proposing a solution called Hub Breakout (HBO) which would offer the best of LBO and S8HR. Each VoLTE operator would need to test their interoperability only with iBasis. Emergency calls and lawful intercept that does not work with S8HR would work with the HBO solution.

While I agree that this is a good solution, I am sure that many operators would not use this solution and there may be other solutions proposed in due course as well. Reminds me of this XKCD cartoon:

Anyway, here is the iBasis presentation:

Updates from the 3GPP RAN 5G Workshop - Part 2

I have finally got round to having a look at some more presentations on 5G from the recently concluded 3GPP RAN 5G Workshop. Part 1 of the series is here.

Panasonic introduced this concept of Sub-RAT's and Cradle-RAT's. I think it should be obvious from the picture above what they mean but you can refer to their presentation here for more details.

Ericsson has provided a very detailed presentation (but I assume a lot of slides are backup slides, only for reference). They have introduced what they call as "NX" (No compatibility constraints). This is in line to what other vendors have referred to as well that above 6GHz, for efficiency, new frame structures and waveforms would serve best. Their slides are here.



Nokia's proposal is that in the phase 1 of 5G, the 5G Access point (or 5G NodeB) would connect to the 4G Evolved Packet Core (EPC). In phase 2, both the LTE and the 5G (e)NodeB's would connect to the 5G core. Their presentation is available here.

Before we move on to the next one, I should mention that I am aware of some research that is underway, mostly by universities where they are exploring an architecture without a centralised core. The core network functionality would be distributed and some of the important data would be cached on the edge. There will be challenges to solve regarding handovers and roaming; also privacy and security issues in the latter case.

I quite like the presentation by GM research about 5G in connected cars. They make a very valid point that "Smartphones and Vehicles are similar but not the same. The presentation is embedded below.

Qualcomm presented a very technical presentation as always, highlighting that they are thinking about various future scenarios. The picture above, about phasing is in a way similar to the Ericsson picture. It also highlights what we saw in part 1, that mmW will arrive after WRC-19, in R16. Full presentation here.

The final presentation we are looking is by Mitsubishi. Their focus is on Massive MIMO which may become a necessity at higher frequencies. As the frequency goes higher, the coverage goes down. To increase the coverage area, beamforming can be used. The more the antennas, the more focused the beam could be. They have also proposed the use of SC-FDMA in DL. Their presentation is here and also embedded below.

Diameter Security is worse than SS7 Security?

Back in December last year, there was a flurry of news about SS7 security flaw that allowed hackers to snoop on an unsuspecting users calls and SMS. The blog readers will also be aware that SS7 is being replaced by the Diameter protocol. The main reason being to simplify roaming while at the same time being able to manage the signalling storm in the networks.


The bad news is that while is case of SS7, security issues are due to network implementation and configuration (above pic), the security issues in Diameter seem to be due to the protocol and architecture themselves (below pic)

Diameter is very important for LTE network architecture and will possibly continue in the future networks too. It is very important to identify all such issues and iron them before some hackers start exploiting the network vulnerabilities causing issues for everyone.

The presentation by Cédric Bonnet, Roaming Technical Domain Manager, Orange at Signalling Focus Day of LTE World Summit 2015 is embedded below:

From SS7 to Diameter Security from Zahid Ghadialy

Some important information from this post has been removed due to a valid complaint.

S8HR: Standardization of New VoLTE Roaming Architecture

VoLTE is a very popular topic on this blog. A basic VoLTE document from Anritsu has over 40K views and my summary from last years LTE Voice summit has over 30K views. I assume this is not just due to the complexity of this feature.

When I attended the LTE Voice summit last year, of the many solutions being proposed for roaming, 'Roaming Architecture for Voice over LTE with Local Breakout (RAVEL)' was being touted as the preferred solution, even though many vendors had reservations.

Since then, GSMA has endorsed a new VoLTE roaming architecture, S8HR, as a candidate for VoLTE roaming. Unlike previous architectures, S8HR does not require the deployment of an IMS platform in VPLMN. This is advantageous because it shortens time-to-market and provides services universally without having to depend on the capability of VPLMN.



Telecom Italia has a nice quick summary, reproduced below:

S8HR simplicity, however, is not only its strength but also its weakness, as it is the source of some serious technical issues that will have to be solved. The analysis of these issues is on the Rel13 3GPP agenda for the next months, but may overflow to Rel14. Let’s see what these issues are, more in detail:

Regulatory requirements - S8HR roaming architecture needs to meet all the current regulatory requirements applicable to voice roaming, specifically:

• Support of emergency calls - The issues in this context are several. For example, authenticated emergency calls rely on the existence if an IMS NNI between VPLMN and HPLMN (which S8HR does not provide); conversely, the unauthenticated emergency calls, although technically feasible in S8HR, are allowed only in some Countries subject to the local regulation of VPLMN. Also, for a non-UE-detectable IMS Emergency call, the P-CSCF in the HPLMN needs to be capable of deciding the subsequent action (e.g. translate the dialed number and progress the call or reject it with the indication to set up an emergency call instead), taking the VPLMN ID into account. A configuration of local emergency numbers per Mobile Country Code on P-CSCF may thus be needed.
• ­Support of Lawful Interception (LI) & data retention for inbound roamers in VPLMN -  S8HR offers no solution to the case where interception is required in the VPLMN for inbound roamers. 3GPP is required to define a solution that fulfill such vital regulatory requirement, as done today in circuit switched networks. Of course VPLMN and HPLMN can agree in their bilateral roaming agreement to disable confidentiality protection to support inbound roamer LI but is this practice really viable from a regulatory point of view?

Voice call continuity – The issue is that when the inbound roamers lose the LTE coverage to enter into  a 2G/3G CS area, the Single Radio Voice Call Continuity (SRVCC) should be performed involving the HPLMN in a totally different way than current specification (i.e. without any IMS NNI being deployed).
Coexistence of LBO and S8HR roaming architectures will have to be studied since an operator may need to support both LBO and S8HR VoLTE roaming architecture options for roaming with different operators, on the basis of bilateral agreement and depending on the capability.
Other issues relate to the capability of the home based S-CSCF and TAS (Telephony Application Server) to be made aware about the VPLMN identity for charging purposes and to enable the TAS to subsequently perform communication barring supplementary services. Also, where the roaming user calls a geo-local number (e.g. short code, or premium numbers), the IMS entities in HPLMN must do number resolution to correctly route the call.
From preliminary discussions held at Working Group level in SA2 (architecture) and SA3 (security) in April, it was felt useful to create a new 3GPP Technical Report to perform comprehensive technical analysis on the subject. Thus it is expected that the discussions will continue in the next months until the end of 2015 and will overheat Release 13 agenda due to their commercial and “political” nature. Stay tuned to monitor the progress of the subject or contact the authors for further information!

NTT Docomo also did some trials back in February and got some brilliant results:

In the trials, DOCOMO and KT achieved the world's first high-definition voice and video call with full end-to-end quality of service. Also, DOCOMO and Verizon achieved the world's first transoceanic high-definition VoLTE roaming calls. DOCOMO has existing commercial 3G and 4G roaming relations with Verizon Wireless and KT.

The calls were made on an IP eXchange (IPX) and network equipment to replicate commercial networks. With only two months of preparation, which also proved the technology's feasibility of speedy commercialization, the quality of VoLTE roaming calls using S8HR architecture over both short and long distances was proven to be better than that of existing 3G voice roaming services.

In fact, NTT Docomo has already said based on the survery from GSMA's Network 2020 programme that 80% of the network operators want this to be supported by the standards and 46% of the operators already have a plan to support this.

The architecture has the following technical characteristics:
(1) Bearers for IMS services are established on the S8 reference point, just as LTE data roaming.
(2) All IMS nodes are located at Home Public Land Mobile Network (HPLMN), and all signaling and media traffic for the VoLTE roaming service go through HPLMN.
(3) IMS transactions are performed directly between the terminal and P-CSCF at HPLMN. Accordingly, Visited Public Land Mobile Network (VPLMN) and interconnect networks (IPX/GRX) are not service-aware at the IMS level. The services can only be differentiated by APN or QoS levels.

These three technical features make it possible to provide all IMS services by HPLMN only and to minimize functional addition to VPLMN. As a result, S8HR shortens the time-to-market for VoLTE roaming services.

Figure 2 shows the attach procedure for S8HR VoLTE roaming. From Steps 1 to 3, there is no significant difference from the LTE data roaming attach procedure. In Step 4, HSS sends an update location answer message to MME. In order for the MME to select the PGW in HPLMN (Step 5), the MME must set the information element VPLMN Dynamic Address “Allowed,” which is included in the subscribed data, to “Not Allowed.” In Step 6, the bearer for SIP signaling is created between SGW and PGW with QCI=5. MME sends an attach accept message to the terminal with an IMS Voice over PS Session Support Indication information element, which indicates that VoLTE is supported. The information element is set on the basis of the MME’s internal configuration specifying whether there is a VoLTE roaming agreement to use S8HR. If no agreement exists between two PLMNs, the information element will not be set.

The complete article from the NTT Docomo technical journal is embedded

Voice over WiFi (VoWiFi) technical details

VoWiFi is certainly a hot topic, thanks to the support of VoWiFi on iPhone 6. A presentation from LTE World Summit 2014 by Taqua on this topic has already crossed 13K views. In this post I intend to look at the different approaches for VoWiFi and throw in some technical details. I am by no means an expert so please feel free to add your input in the comments.

Anybody reading this post is not aware of S2a, S2b, Samog, TWAG, ePDG, etc. and what they are, please refer to our whitepaper on cellular and wi-fi integration here (section 3).

There are two approaches to VoWiFi, native client already in your device or an App that could be either downloaded from the app store or pre-installed. The UK operator '3' has an app known as ThreeInTouch. While on WiFi, this app can make and receive calls and texts. The only problem is that it does not handover an ongoing call from WiFi to cellular and and vice versa. Here are a few slides (slides 36-38) from them from a conference last year:

Quick Summary of LTE Voice Summit 2014 #LTEVoice from eXplanoTech

The other operators have a native client that can use Wi-Fi as the access network for voice calls as well as the data when the device is connected on the WLAN.

A simple architecture can be seen from the picture above. As can be seen, the device can connect to the network via a non-3GPP trusted wireless access network via the TWAG or via a non-3GPP untrusted wireless access network via ePDG. In the latter case, an IPSec tunnel would have to be established between the device and the ePDG. The SIM credentials would be used for authentication purposes so that an intruder cannot access ePDG and the core.

Now, I dont want to talk about VoLTE bearers establishment, etc. which I have already done here earlier. In order to establish S2a (trusted) and S2b (untrusted) connection, the AAA server selects an APN among those which are subscribed to in the HLR/HSS. The PDN-GW (generally referred to as PGW) dynamically assigns an IP address out of a pool of addresses which is associated with this APN. This UE IP address is used by the VoWiFi SIP UA (User Agent) as the contact information when registering to the SIP soft switch (which would typically be the operators IMS network).

If for any reason the SIP UA in the device is not able to use the SIM for authentication (needs ISIM?) then a username/password based authentication credentials can be used (SIP digest authentication).

Typically, there would be a seperate UA for VoLTE and VoWiFi. They would both be generally registering to the same IMS APN using different credentials and contact addresses. The IMS network can deal with multiple registrations from the same subscriber but from different IP addresses (see 3GPP TS 23.237 - 'IMS Service Continuity' for details).

Because of multiple UA's, a new element needs to be introduced in order to 'fork' the downstream media streams (RTP/RTCP packets) to different IP addresses over time.

3GPP has defined the Access Transfer Gateway (ATGW) which is controlled by the Access Transfer Control Function (ATCF); the ATCF interfaces to the IMS and Service Centralization and Continuity Application Server (SCC AS). All these are not shown in the picture above but is available in 3GPP TS 23.237. The IMS networks in use today as well as the one being deployed for VoLTE does not have ATGW/ATCF. As a result vendors have to come up with clever non-standardised solutions to solve the problem.

When there is a handover between 3GPP and non-3GPP networks, the UE IP address needs to be preserved. Solutions like MIP and IPSec have been used in the past but they are not flexible. The Release-12 solution of eSAMOG (see 3GPP TS 23.402) can be used but the solution requires changes in the UE. For the time being we will see proprietary solutions only but hopefully in future there would be standardised solutions available.

3GPP TS 23.234 describes more in detail the interworking of 3GPP based system and WLAN. Interested readers can refer to that for further insight.

Enhancing voice services using VoLTE

VoLTE has been a very popular topic on this blog. My overview of the LTE Voice Summit missed out narrowly from the Top 10 posts of 2014 but there were other posts related to VoLTE that made it.

In this magazine article, NTT Docomo not only talks about its own architecture and transition from 3G to 4G for voice and video, it provides some detailed insights from its own experience.

There is also discussion into technical details of the feature and examples of signalling for VoLTE registration and originating/terminating calls (control, session and user plane establishment), SMS, SRVCC, Video over LTE (ViLTE) and voice to video call switching.

The paper is embedded below and available from slideshare to download.

VoLTE for Enhancing Voice Services from Zahid Ghadialy

Related links:

• DOCOMO VoLTE and Next Steps
• VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout)
• 2015 will finally be the year of Voice over LTE (VoLTE)

The SS7 flaws that allows hackers to snoop on your calls and SMS

By now I am aware that most people have heard of the flaws in SS7 networks that allow hackers to snoop, re-route calls and read text messages. For anyone who is not aware of these things, can read some excellent news articles here:

• Hackers Can Read Your Texts Thanks to Huge Security Flaw - Gizmodo
• German researchers discover a flaw that could let anyone listen to your cell calls. - Washington Post
• White hats do an NSA, figure out LIVE PHONE TRACKING via protocol vuln - The Register
• 1980s technology can be used to hack any smartphone - Beta News

Our trusted security expert, Ravi Borgaonkar, informs us that all these flaws have already been discussed back in May, as part of Positive Hack Days (PHDays).

Here are the slides on SS7 hack from PHDays, http://t.co/VwUwtFVqyc mentions all flaws reveals in 3 #31c3 talks on SS7 security.
— Ravishankar Borgaonk (@raviborgaonkar) December 28, 2014

The presentation is embedded below and can be downloaded from Slideshare:

How to Intercept a Conversation Held on the Other Side of the Planet from Positive Hack Days

xoxoxo Added this new information on the 4th Jan 2015 oxoxox

The following is this presentation and video by Tobias Engel from the 31st Chaos Communication Congress

SS7: Locate. Track. Manipulate. from 3G4G

4G Security and EPC Threats for LTE

This one is from the LTE World Summit 2014. Even though I was not there for this, I think this has some useful information about the 4G/LTE Security. Presentation as follows:

4G Security - Fortinet from Zahid Ghadialy

Observed Time Difference Of Arrival (OTDOA) Positioning in LTE

Its been a while I wrote anything on Positioning. The network architecture for the positioning entities can be seen from my old blog post here. 

Qualcomm has recently released a whitepaper on the OTDOA (Observed Time Difference Of Arrival) positioning. Its quite a detailed paper with lots of technical insights.

There is also signalling and example of how reference signals are used for OTDOA calculation. Have a look at the whitepaper for detail, embedded below.

Observed Time Difference Of Arrival (OTDOA) Positioning in 3GPP LTE from Zahid Ghadialy

4.5G: Integration of LTE and Wi-Fi networks

With LTE-A getting ready to meet the IMT-Advanced requirements and fulfilling the role of promised '4G', we believe the next phase of evolution before 5G will be successful interworking of LTE and Wi-Fi networks.

This whitepaper (embedded below) explores this feature, we call 4.5G, in detail.



We are very thankful to Anritsu for kindly sponsoring this whitepaper. They have their own whitepaper on this topic which is also worth a read, available here.

4.5G: Integration of LTE and Wi-Fi networks from eXplanoTech

Let us know what you think about this.