Voice over WiFi (VoWiFi) technical details

VoWiFi is certainly a hot topic, thanks to the support of VoWiFi on iPhone 6. A presentation from LTE World Summit 2014 by Taqua on this topic has already crossed 13K views. In this post I intend to look at the different approaches for VoWiFi and throw in some technical details. I am by no means an expert so please feel free to add your input in the comments.

Anybody reading this post is not aware of S2a, S2b, Samog, TWAG, ePDG, etc. and what they are, please refer to our whitepaper on cellular and wi-fi integration here (section 3).

There are two approaches to VoWiFi, native client already in your device or an App that could be either downloaded from the app store or pre-installed. The UK operator '3' has an app known as ThreeInTouch. While on WiFi, this app can make and receive calls and texts. The only problem is that it does not handover an ongoing call from WiFi to cellular and and vice versa. Here are a few slides (slides 36-38) from them from a conference last year:

Quick Summary of LTE Voice Summit 2014 #LTEVoice from eXplanoTech

The other operators have a native client that can use Wi-Fi as the access network for voice calls as well as the data when the device is connected on the WLAN.

A simple architecture can be seen from the picture above. As can be seen, the device can connect to the network via a non-3GPP trusted wireless access network via the TWAG or via a non-3GPP untrusted wireless access network via ePDG. In the latter case, an IPSec tunnel would have to be established between the device and the ePDG. The SIM credentials would be used for authentication purposes so that an intruder cannot access ePDG and the core.

Now, I dont want to talk about VoLTE bearers establishment, etc. which I have already done here earlier. In order to establish S2a (trusted) and S2b (untrusted) connection, the AAA server selects an APN among those which are subscribed to in the HLR/HSS. The PDN-GW (generally referred to as PGW) dynamically assigns an IP address out of a pool of addresses which is associated with this APN. This UE IP address is used by the VoWiFi SIP UA (User Agent) as the contact information when registering to the SIP soft switch (which would typically be the operators IMS network).

If for any reason the SIP UA in the device is not able to use the SIM for authentication (needs ISIM?) then a username/password based authentication credentials can be used (SIP digest authentication).

Typically, there would be a seperate UA for VoLTE and VoWiFi. They would both be generally registering to the same IMS APN using different credentials and contact addresses. The IMS network can deal with multiple registrations from the same subscriber but from different IP addresses (see 3GPP TS 23.237 - 'IMS Service Continuity' for details).

Because of multiple UA's, a new element needs to be introduced in order to 'fork' the downstream media streams (RTP/RTCP packets) to different IP addresses over time.

3GPP has defined the Access Transfer Gateway (ATGW) which is controlled by the Access Transfer Control Function (ATCF); the ATCF interfaces to the IMS and Service Centralization and Continuity Application Server (SCC AS). All these are not shown in the picture above but is available in 3GPP TS 23.237. The IMS networks in use today as well as the one being deployed for VoLTE does not have ATGW/ATCF. As a result vendors have to come up with clever non-standardised solutions to solve the problem.

When there is a handover between 3GPP and non-3GPP networks, the UE IP address needs to be preserved. Solutions like MIP and IPSec have been used in the past but they are not flexible. The Release-12 solution of eSAMOG (see 3GPP TS 23.402) can be used but the solution requires changes in the UE. For the time being we will see proprietary solutions only but hopefully in future there would be standardised solutions available.

3GPP TS 23.234 describes more in detail the interworking of 3GPP based system and WLAN. Interested readers can refer to that for further insight.

IEEE Globecom 2014 Keynote Video: 5G Wireless Goes Beyond Smartphones

Embedded below is a video from the keynote session by Dr. Wen Tong of Huawei. I do not have the latest presentation but an earlier one (6 months old) is also embedded below for reference. It will give you a good idea on the 5G research direction

5G Wireless Goes Beyond Smartphones from Zahid Ghadialy

You may also be interested in this other presentation from Huawei in IEEE Globecom 2014, 5G: From Research to Standardization (what, how, when)

Enhancing voice services using VoLTE

VoLTE has been a very popular topic on this blog. My overview of the LTE Voice Summit missed out narrowly from the Top 10 posts of 2014 but there were other posts related to VoLTE that made it.

In this magazine article, NTT Docomo not only talks about its own architecture and transition from 3G to 4G for voice and video, it provides some detailed insights from its own experience.

There is also discussion into technical details of the feature and examples of signalling for VoLTE registration and originating/terminating calls (control, session and user plane establishment), SMS, SRVCC, Video over LTE (ViLTE) and voice to video call switching.

The paper is embedded below and available from slideshare to download.

VoLTE for Enhancing Voice Services from Zahid Ghadialy

Related links:

• DOCOMO VoLTE and Next Steps
• VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout)
• 2015 will finally be the year of Voice over LTE (VoLTE)

Top 10 posts for 2014

Here are the top 10 posts of 2014 from The 3G4G Blog:

1. Different flavours of SRVCC (Single Radio Voice Call Continuity) - January 2014
   
2. MNO, MVNO, MVNA, MVNE - The different types of operators - April 2014
   
3. New LTE-A UE Category 9 and 10 in Rel-11 - August 2014
   
4. 4.5G: Integration of LTE and Wi-Fi networks - June 2014
   
5. Voice over WiFi (VoWiFi) - June 2014
   
6. Further enhanced Inter-Cell Interference Coordination (FeICIC) - May 2014
   
7. VoLTE Roaming with RAVEL (Roaming Architecture for Voice over IMS with Local Breakout) - February 2014
   
8. What is (pre-5G) 4.5G? - October 2014
   
9. LA-LTE and LAA - July 2014
   
10. Multi-SIM: The Jargon - January 2014

The SS7 flaws that allows hackers to snoop on your calls and SMS

By now I am aware that most people have heard of the flaws in SS7 networks that allow hackers to snoop, re-route calls and read text messages. For anyone who is not aware of these things, can read some excellent news articles here:

• Hackers Can Read Your Texts Thanks to Huge Security Flaw - Gizmodo
• German researchers discover a flaw that could let anyone listen to your cell calls. - Washington Post
• White hats do an NSA, figure out LIVE PHONE TRACKING via protocol vuln - The Register
• 1980s technology can be used to hack any smartphone - Beta News

Our trusted security expert, Ravi Borgaonkar, informs us that all these flaws have already been discussed back in May, as part of Positive Hack Days (PHDays).

Here are the slides on SS7 hack from PHDays, http://t.co/VwUwtFVqyc mentions all flaws reveals in 3 #31c3 talks on SS7 security.
— Ravishankar Borgaonk (@raviborgaonkar) December 28, 2014

The presentation is embedded below and can be downloaded from Slideshare:

How to Intercept a Conversation Held on the Other Side of the Planet from Positive Hack Days

xoxoxo Added this new information on the 4th Jan 2015 oxoxox

The following is this presentation and video by Tobias Engel from the 31st Chaos Communication Congress

SS7: Locate. Track. Manipulate. from 3G4G

M2M embedded UICC (eSIM) Architecture and Use Cases

Machine-to-Machine UICC, also known as M2M Form Factor (MFF) and is often referred to as embedded SIM (eSIM) is a necessity for the low data rate M2M devices that are generally small, single contained unit that is also sealed. The intention is that once this M2M device is deployed, then there is no need to remove the UICC from it. There may be a necessity to change the operator for some or the other reason. This gives rise to the need of multi-operator UICC (SIM) cards.

The GSMA has Embedded SIM specifications available for anyone interested in implementing this. There are various documents available on the GSMA page for those interested in this topic further.

While the complete article is embedded below, here is an extract of the basic working from the document:

A eUICC is a SIM card with a Remote Provisioning function, and is designed not to be removed or changed. It is able to store multiple communication profiles, one of which is enabled (recognized by the device and used for communication). The network of the MNO in the enabled profile is used for communication. Profiles other than the enabled profile are disabled (not recognized by the device). With conventional SIM cards, the ICCID is used as the unique key to identify the SIM card, but with eUICC, the ICCID is the key used to identify profiles, and a new ID is defined, called the eUICCID, which is used as the unique key for the eSIM

GSMA defines two main types of profile.
1) Provisioning Profile: This is the communication profile initially stored in the eUICC when it is shipped. It is a limited-application communication profile used only for downloading and switching Operational Profiles, described next.
2) Operational Profile: This is a communication profile for connecting to enterprise servers or the Internet. It can also perform the roles provided by a Provisioning profile

An eSIM does not perform profile switching as a simple IC card function, but rather switches profiles based on instructions from equipment called a Subscription Manager. A Subscription Manager is maintained and managed by an MNO. The overall eSIM architecture, centering on the Subscription Manager, is shown in Figure 3, using the example of switching profiles within the eUICC.

An eUICC must have at least one profile stored in it to enable OTA functionality, and one of the stored profiles must be enabled. The enabled profile uses the network of MNO A for communication. When the user switches profiles, a switch instruction is sent to the Subscription Manager. At that time, if the profile to switch to is not stored in the eUICC, the profile is first downloaded. When it receives a switch instruction, the eUICC performs a switch of the enabled profile as an internal process.

After the switch is completed, it uses the network of MNO B to send notification that the switch has completed to the Subscription Manager, completing the process. The same procedure is used to switch back to the original MNO A, or to some other MNO C.

Anyway, here is the complete paper on NTT Docomo website.

5G Spectrum and challenges

I was looking at the proposed spectrum for 5G last week. Anyone who follows me on Twitter would have seen the tweets from last weekend already. I think there is more to discuss then just tweet them so here it is.

Metis has the most comprehensive list of all the bands identified from 6GHz, all the way to 86GHz. I am not exactly sure but the slide also identifies who/what is currently occupying these bands in different parts of the world.

The FCC in the USA has opened a Notice of Inquiry (NoI) for using the bands above 24GHz for mobile broadband. The frequency bands above have a potential as there is a big contiguous chunk of spectrum available in each band.

Finally, the slides from ETRI, South Korea show that they want to have 500MHz bandwidth in frequencies above 6GHz.

As I am sure we all know, the higher the frequency, the lower the cell size and penetration indoors. The advantage on the other hand is smaller cell sizes, leading to higher data rates. The antennas also become smaller at higher frequencies thereby making it easier to have higher order MIMO (and massive MIMO). The only way to reliably be able to do mobile broadband is to use beamforming. The tricky part with that is the beam has to track the mobile user which may be an issue at higher speeds.

The ITU working party 5D, recently released a draft report on 'The technical feasibility of IMT in the bands above 6 GHz'. The document is embedded below.

ITU Working Party 5D: The technical feasibility of IMT in the bands above 6 GHz from Zahid Ghadialy

xoxoxo Added Later (13/12/2014) xoxoxo
Here are some links on the related topic:

• IEEE ComSoc: 5G Wireless Demos Use High Frequencies
• HUAWEI, TELE2 disagree on role of spectrum for 5G

xoxoxo Added Later (18/12/2014) xoxoxo
Moray Rumney from Keysight (Agilent) gave a presentation on this topic in the Cambridge Wireless Mobile Broadband SIG event yesterday, his presentation is embedded below.

Bringing Network Function Virtualization (NFV) to LTE

SDN and NFV have gained immense popularity recently. Not only are they considered important for reducing the Capex and Opex but are being touted as an important cog in the 4.5G/5G network. See here for instance.

I introduced NFV to the blog nearly a year back here. ETSI had just published their first specs around then. When I talked about SDN/NFV back in May, these ETSI standards were evolving into a significant reference documents. This is a reason 4G Americas recently published this whitepaper (embedded below), for the operators to start migrating to NFV architecture to reap long term benefits. The following is from the whitepaper:

The strategies and solutions explored in the 4G Americas report on NFV aim to address these issues and others by leveraging IT virtualization technology to consolidate many network equipment types onto industry standard high volume servers, networking and storage. NFV is about separating network functions from proprietary hardware and then consolidating and running those functions as virtualized applications on a commodity server. Broadly speaking, NFV will enable carriers to virtualize network functions and run them as software applications within their networks. NFV focuses on virtualizing network functions such as firewalls, Wide-Area Network (WAN) acceleration, network routers, border controllers (used in Voice over IP (VoIP) networks), Content Delivery Networks (CDNs) and other specialized network applications. NFV is applicable to a wide variety of networking functions in both fixed and mobile networks.

“NFV is making great progress throughout the world as operators work with their vendor partners to address the opportunities of increasing efficiency within their network infrastructure elements,” stated Chris Pearson, President of 4G Americas. “There is a great deal of collaborative innovation and cooperation between wireless carriers, IT vendors, networking companies and wireless infrastructure vendors making NFV for LTE possible.”

Global communication service providers, along with many leading vendors, are participating in the European Telecommunications Standards Institute’s (ETSI) Industry Specification Group for Network Functions Virtualization (NFV ISG) to address challenges such as:

• An increasing variety of proprietary hardware appliances like routers, firewalls and switches
• Space and power to accommodate these appliances
• Capital investment challenges
• Short lifespan
• A long procure-design-integrate-deploy lifecycle
• Increasing complexity and diversity of network traffic
• Network capacity limitations

Three main benefits of NFV outlined in the 4G Americas paper include:

• Improved capital efficiency: Provisioning capacity for all functions versus each individual function, providing more granular capacity, exploiting the larger economies of scale associated with Commercial Off-the-Shelf (COTS) hardware, centralizing Virtual Network Functions (VNFs) in data centers where latency requirements allow, and separately and dynamically scaling VNFs residing in the user (or data or forwarding) plane designed for execution in the cloud, control and user-plane functions as needed.
• Operational efficiencies: Deploying VNFs as software using cloud management techniques which enables scalable automation at the click of an operator’s (or customer’s) mouse or in response to stimulus from network analytics. The ability to automate onboarding, provisioning and in-service activation of new virtualized network functions can yield significant savings. 
• Service agility, innovation and differentiation: In deploying these new VNFs, time-to-market for new network services can be significantly reduced, increasing the operator’s ability to capture market share and develop market-differentiating services.

In particular, mobile operators can take advantage of NFV as new services are introduced. Evolved Packet Core (EPC), Voice over LTE (VoLTE), IP Multimedia System (IMS) and enhanced messaging services, among others, are examples of opportunities to use virtualized solutions. Some operators started deploying elements of NFV in 2013 with an expectation that many service areas could be mostly virtualized in the next decade.

The whitepaper as follows:

4G Americas: Bringing Network Function Virtualization to LTE from Zahid Ghadialy

In-flight broadband connectivity service with speeds up to 75Mbps

Came across the following Inmarsat press release:

The new network represents two world-beating achievements for Inmarsat and its partners. It will be the world’s first truly hybrid aviation network, consisting of an S-band satellite (Europasat), constructed by Thales Alenia Space, and a Europe-wide S-band ground network. Over the integrated network, based on state-of-the-art LTE technology and access to sufficient spectrum resources, Inmarsat will be offering airlines the world’s fastest in-flight broadband connectivity service with speeds up to 75Mbps, far in excess of the limited capabilities of North American ATG systems.

Alcatel-Lucent and Inmarsat will work together to develop the ground infrastructure component of the new Europe-wide network. Alcatel-Lucent has proven expertise in the development of 4G LTE-based air-to-ground technology and was the world’s first company to field trial this technology in 2011. The initial contract awarded to Alcatel-Lucent will see the global telecommunications equipment company adapting their existing 4G LTE technology to support the S-band spectrum.

Recently Christophe WILHELM, Senior VP Strategy & Innovation, Thales Alenia Space gave a presentation in the Digiworld Summit 2014.

His presentation is above and the video is as follows. Please forward to 1:36:00 to watch his part

SON Update from 3GPP SA5

Below is a presentation from Christian Toche, 3GPP SA5 chairman in the SON Conference last month. I also blogged about his presentation last year which is available here.

Oct 2014: Update on 3GPP SA5 from 3G4G