Introduction to 3GPP Security in Mobile Cellular Networks

I recently did a small presentation on 3GPP Security, looking at the how the security mechanism works in mobile cellular networks; focusing mainly on signaling associated with authentication, integrity protection and ciphering / confidentiality. Its targeted towards people with basic understanding of mobile networks. Slides with embedded video below.

Intermediate: Security in Mobile Cellular Networks from 3G4G

You can also check-out all such videos / presentations at the 3G4G training section.

Top 10 posts for 2017 and some other 3G4G info

Here are the top 10 3G4G blog posts (in descending order of popularity) for 2017:

1. 5G Network Architecture and Design Update - Jan 2017
2. 5G: Architecture, QoS, gNB, Specifications - April 2017 Update
3. Self-backhauling: Integrated access and backhaul links for 5G
4. 5G Core Network, System Architecture & Registration Procedure
5. High Power / Performance User Equipment (#HPUE)
6. IMT-2020 (5G) Requirements
7. 5G – Beyond the Hype
8. Variety of 3GPP IoT technologies and Market Status - May 2017
9. 2G / 3G Switch Off: A Tale of Two Worlds
10. 5G Research Presentation on URLLC

As you can see, 7/10 were on 5G which is probably not a surprise 😉.

In other news, this year I have done a lot more activities on 3G4G sites (thanks to support and encouragement from my current employer, Parallel Wireless). You can see links to all different 3G4G channels on top of the blog. I was also interviewed by TechPlayon and TechTrained (the similarity of name is just a coincidence). I was also named a key 5G influencer for 2017.

Back in 2011, I wrote the 1000th post and asked for your feedback. Here again, I would like to ask for your feedback, either on this post or on any posts. There are check-boxes for you to give instant feedback or you can add your comments in any of the posts.

I also mentioned in 2011 that the 3G4G blog will be touching 1.5 million page view mark, now in 2017 (10 years after the start of this blog), we have crossed over 9.5 million official page views (page views for first 3 years were not counted). Here is a snapshot of the stats for this and the small cells blog.

This has all been possible because of contributions from many individuals who share their presentations, knowledge and support my activities in many different ways. Thank you!

Finally, I can make mistakes too so please feel free to correct me anytime you spot me saying something wrong. I don't mind 😊


Related posts:

• Telecoms Infrastructure Blog: Top 5 posts for 2017 
• The 3G4G Blog: Top 10 posts for 2016
• The 3G4G Blog: Top 10 posts for 2015
• The 3G4G Blog: Top 10 posts for 2014

The small detail about 5G you may have missed...

While going through the latest issue of CW Journal, I came across this article from Moray Rumney, Lead Technologist, Keysight. It highlights an interesting point that I missed out earlier that 5G also includes all LTE specifications from Release 15 onwards.

I reached out to our CW resident 3GPP standards expert Sylvia Lu to clarify and received more details.

There is a whole lot of detail available in RP-172789.zip. Here RIT stands for Radio Interface Technology and SRIT for Set of RIT.

Indeed, NB-IoT and Cat-M will also be part of the initial IMT-2020 submissions early next year.. watch the space

— Sylvia Lu (@SylviaLuUk) December 22, 2017

In fact at Sylvia clarified, NB-IoT and Cat-M will also be part of the initial IMT-2020 submissions early next year. Thanks Sylvia.

There is also this nice presentation by Huawei in ITU (here) that describes Requirements, Evaluation Criteria and Submission Templates for the development of IMT-2020. It is very helpful in understanding the process.

Coming back to the question I have often asked (see here for example),
1. What features are needed for operator to say they have deployed 5G, and
2. How many sites / coverage area needed to claim 5G rollout

With LTE Release-15 being part of 5G, I think it has just become easy for operators to claim they have 5G.

What do you think?

Control and User Plane Separation of EPC nodes (CUPS) in 3GPP Release-14

One of the items in 3GPP Rel-14 is Control and User Plane Separation of EPC nodes (CUPS). I have made a video explaining this concept that is embedded below.

In 3G networks (just considering PS domain), the SGSN and GGSN handles the control plane that is responsible for signalling as well as the user plane which is responsible for the user data. This is not a very efficient approach for deployment.

You can have networks that have a lot of signalling (remember signaling storm?) due to a lot of smartphone users but not necessarily consuming a lot of data (mainly due to price reasons). On the other hand you can have networks where there is not a lot of signalling but lot of data consumption. An example of this would be lots of data dongles or MiFi devices where users are also consuming a lot of data, because it’s cheap.

To cater for these different scenarios, the control plane and user plane was separated to an extent in the Evolved Packet Core (EPC). MME handles the control plane signalling while S-GW & P-GW handles the user plane

CUPS goes one step further by separating control & user plane from S-GW, P-GW & TDF. TDF is Traffic Detection Function which was introduced together with Sd reference point as means for traffic management in the Release 11. The Sd reference point is used for Deep Packet Inspections (DPI) purposes. TDF also provides the operators with the opportunity to capitalize on analytics for traffic optimization, charging and content manipulation and it works very closely with Policy and charging rules function, PCRF.

As mentioned, CUPS provides the architecture enhancements for the separation of S-GW, P-GW & TDF functionality in the EPC. This enables flexible network deployment and operation, by using either distributed or centralized deployment. It also allows independent scaling between control plane and user plane functions - while not affecting the functionality of the existing nodes subject to this split.

As the 3GPP article mentions, CUPS allows for:

• Reducing Latency on application service, e.g. by selecting User plane nodes which are closer to the RAN or more appropriate for the intended UE usage type without increasing the number of control plane nodes.
• Supporting Increase of Data Traffic, by enabling to add user plane nodes without changing the number of SGW-C, PGW-C and TDF-C in the network.
• Locating and Scaling the CP and UP resources of the EPC nodes independently.
• Independent evolution of the CP and UP functions.
• Enabling Software Defined Networking to deliver user plane data more efficiently.

The following high-level principles were also adopted for the CUPS:

• The CP function terminates the Control Plane protocols: GTP-C, Diameter (Gx, Gy, Gz).
• A CP function can interface multiple UP functions, and a UP function can be shared by multiple CP functions.
• An UE is served by a single SGW-CP but multiple SGW-UPs can be selected for different PDN connections. A user plane data packet may traverse multiple UP functions.
• The CP function controls the processing of the packets in the UP function by provisioning a set of rules in Sx sessions, i.e. Packet Detection Rules for packets inspection, Forwarding Action Rules for packets handling (e.g. forward, duplicate, buffer, drop), Qos Enforcement Rules to enforce QoS policing on the packets, Usage Reporting Rules for measuring the traffic usage.
• All the 3GPP features impacting the UP function (PCC, Charging, Lawful Interception, etc) are supported, while the UP function is designed as much as possible 3GPP agnostic. For example, the UPF is not aware of bearer concept.
• Charging and Usage Monitoring are supported by instructing the UP function to measure and report traffic usage, using Usage Reporting Rule(s). No impact is expected to OFCS, OCS and the PCRF.
• The CP or UP function is responsible for GTP-u F-TEID allocation.
• A legacy SGW, PGW and TDF can be replaced by a split node without effecting connected legacy nodes.

CUPS forms the basis of EPC architecture evolution for Service-Based Architecture for 5G Core Networks. More in another post soon.

A short video on CUPS below, slides available here.



Further reading:

• 3GPP: Control and User Plane Separation of EPC nodes (CUPS)
• ITU: 5G Network Architecture and FMC - Joe Wilke, Ericsson
• Heavy Reading: Service-Based Architecture for 5G Core Networks

5G Patents Progress

More than 23,500 patents have been declared essential to the GSM & 3G as shown in the picture above. I am assuming this includes 4G as well. Anyway, its been a while I looked into this subject. The last time I was looking, 4G patent pools were beginning to form.

For LTE, indeed there is no one-stop shop for licensing. The only company that has tried is VIA Licensing, with their patent pool, but they don’t have licenses for the big players like Ericsson, Qualcomm, Huawei, ZTE, Samsung, etc. The same will probably apply for 5G.

This old picture and article from Telecom TV (link) is an interesting read on this topic.

This official WIPO list shows ZTE, Huawei, and Qualcomm at the top of the list for international patent filers worldwide in 2016 [PDF].

Back in 2015, NGMN alliance was also looking for creation of some kind of patent pool but it probably didn't go anywhere (link)

(Can't recall the source for this one) In March, Ericsson announced plans to license 5G for $5 per device and possibly as low as $2.50 in emerging markets. In November, Qualcomm announced plans to license 5G IP at the same rates established by the NDRC for 4G/LTE phones sold into China: 2.275% for single mode essential patents / 4.0% for the entire portfolio or 3.25% for multimode essential patents / 5.0% for the entire portfolio. All rates are based on the wholesale price of the phone.

Qualcomm also announced that the previously undisclosed $500 price cap will apply to all phones. Qualcomm also announce a rate of less than $5 for 5G for automotive applications and $0.50 for NB-IoT based IoT applications.

Ericsson has filed patent application for its end-to- end 5G technology. Ericsson has incorporated its numerous 5G and related inventions into a complete architecture for the 5G network standard. The patent application filed by the leading telecom vendor combines the work of 130 Ericsson inventors.

Dr. Stefan Parkvall, Principal Researcher at Ericsson, said, “The patent application contains Ericsson’s complementary suite of 5G inventions.” Stefan added, “It contains everything you need to build a complete 5G network. From devices, the overall network architecture, the nodes in the network, methods and algorithms, but also shows how to connect all this together into one fully functioning network. The inventions in this application will have a huge impact on industry and society: they will provide low latency with high performance and capacity.

This will enable new use cases like the Internet of Things, connected factories and self-driving cars.” Ericsson is involved with leading mobile operators across the world for 5G and Pre-5G research and trials. The patent application is likely to further strengthen its position in the 5G race.

More details on E/// 5G patents on their official website here.

Mobile world live has some good details on Qualcomm 5G NR royalty terms.

Smartphone vendors will have to pay as much as $16.25 per device to use Qualcomm’s 5G New Radio (NR) technology under new royalty guidelines released by the company.

Qualcomm said it will implement a royalty rate of 2.275 per cent of the selling price for single-mode 5G handsets and a higher rate of 3.25 per cent for multi-mode smartphones with 3G, 4G and 5G capabilities.

So for a $200 multi-mode device, for instance, Qualcomm noted a vendor would have to pay $6.50 in royalties per device. Royalties are capped at a $500 device value, meaning the maximum amount a smartphone vendor would have to pay would be $16.25 per handset.

The company added it will also offer access to its portfolio of both cellular standard essential patents and non-essential patents at a rate of 4 per cent of the selling price for single-mode devices and 5 per cent for multi-mode devices.

Qualcomm’s rates are notably higher than those announced by Ericsson in March. The Swedish company said it would charge a flat royalty fee of $5 per 5G NR multimode handset, but noted its fee could go as low as $2.50 per device for handsets with low average selling prices.

The official Qualcomm 5G royalty terms [PDF] are available here.

Further reading:

• Ericsson Tries to Avoid Patent War by Publishing Rates for 5G - Bloomberg
• Qualcomm to charge up to $16.25 in royalties for every 5G phone, more than Ericsson’s $5/phone - Fierce Wireless

Thanks to Mike Saji for providing inputs on 4G patent landscape. Thanks to Keith Dyer for interesting tweets on this topic.

Connectivity on Planes

I recently made a video explaining how connectivity works on planes and how its about to change. The video and slides are embedded below.

Beginners: Connectivity in Planes from 3G4G

Related posts:

• In-flight broadband connectivity service with speeds up to 75Mbps
• Deutsche Telekom: Media kit European Aviation Network
• European Aviation Network (EAN) Explained with Ground Based Mast Example
• An Introduction to Non-Terrestrial Networks (NTN)

Summary of 3GPP Release-14 Work Items

With all focus on 5G (Release-15), looks like Rel-14 has been feeling a bit neglected. There are some important updates though as it lays foundation for other services.

3GPP used to maintain Release Descriptions here for all different releases but have stopped doing that since 2014. For Release-14, a new document "3GPP TR 21.914: Release 14 Description; Summary of Rel-14 Work Items" is now available here.

An executive summary from the document:

Release 14 focusses on the following items:

• Improving the Mission Critical aspects, in particular with the introduction of Video and Data services
• Introducing the Vehicle-to-Everything (V2X) aspects, in particular the Vehicle-to-Vehicle (V2)
• Improving the Cellular Internet of Things (CIoT) aspects, with 2G, 3G and 4G support of Machine-Type of Communications (MTC)
• Improving the radio interface, in particular by enhancing the aspects related to coordination with WLAN and unlicensed spectrum
• A set of uncorrelated improvements, e.g. on Voice over LTE (VoLTE), IMS, Location reporting.

The continuation of this document provides an exhaustive view of all the items specified by 3GPP in Release 14.

I have blogged about the Mission Critical Communications here. 3GPP has also done a webinar on this topic which can be viewed here. I like this slide below that summarizes features in different releases.

Then there are quite a few new features and enhancements for V2X. I have blogged about sidelink and its proposed extensions here.

From the document:

The Work Item on “Architecture enhancements for LTE support of V2X services (V2XARC)”, driven by SA WG2, specifies the V2X architectures, functional entities involved for V2X communication, interfaces, provisioned parameters and procedures in TS 23.285.

Figure above depicts an overall architecture for V2X communication. V2X Control Function is the logical function defined for network related actions required for V2X and performs authorization and provisioning of necessary parameters for V2X communication to the UE via V3 interface.

A UE can send V2X messages over PC5 interface by using network scheduled operation mode (i.e. centralized scheduling) and UE autonomous resources selection mode (i.e. distributed scheduling) when the UE is "served by E-UTRAN" while a UE can send V2X messages over PC5 interface only by using UE autonomous resources selection mode when the UE is "not served by E-UTRAN". 

Both IP based and non-IP based V2X messages over PC5 are supported. For IP based V2X messages over PC5, only IPv6 is used. PPPP (ProSe Per-Packet Priority) reflecting priority and latency for V2X message is applied to schedule the transmission of V2X message over PC5.

A UE can send V2X messages over LTE-Uu interface destined to a locally relevant V2X Application Server, and the V2X Application Server delivers the V2X messages to the UE(s) in a target area using unicast delivery and/or MBMS (Multimedia Broadcast/Multicast Service) delivery.

Both IP based and non-IP based V2X messages are supported for V2X communication over LTE-Uu. In order to transmit non-IP based V2X messages over LTE-Uu, the UE encapsulates the V2X messages in IP packets.

For latency improvements for MBMS, localized MBMS can be considered for localized routing of V2X messages destined to UEs.

For V2X communication over LTE-Uu interface, the V2X messages can be delivered via Non-GBR bearer (i.e. an IP transmission path with no reserved bitrate resources) as well as GBR bearer (i.e. an IP transmission path with reserved (guaranteed) bitrate resources). In order to meet the latency requirement for V2X message delivery, the following standardized QCI (QoS Class Identifier) values defined in TS 23.203 can be used:

• QCI 3 (GBR bearer) and QCI 79 (Non-GBR bearer) can be used for the unicast delivery of V2X messages.
• QCI 75 (GBR bearer) is only used for the delivery of V2X messages over MBMS bearers. 

There are updates to cellular IoT (CIot) which I have blogged about here.

There are some other interesting topic that are enhanced as part of Release14. Here are some of them:

S8 Home Routing Architecture for VoLTE

• Robust Call Setup for VoLTE subscriber in LTE
• Enhancements to Domain Selection between VoLTE and CDMA CS
• MBMS improvements
• eMBMS enhancements for LTE
• IMS related items
• Evolution to and Interworking with eCall in IMS
• Password-based service activation for IMS Multimedia Telephony service
• Multimedia Priority Service Modifications
• Enhancements to Multi-stream Multiparty Conferencing Media Handling
• Enhancement for TV service
• Improved Streaming QoE Reporting in 3GPP (IQoE)
• Quality of Experience (QoE) Measurement Collection for streaming services in UTRAN
• Development of super-wideband and fullband P.835
• Enhancements to User Location Reporting Support
• Enhancing Location Capabilities for Indoor and Outdoor Emergency Communications
• Further Indoor Positioning Enhancements for UTRA and LTE
• Improvements of awareness of user location change
• Terminating Access Domain Selection (T-ADS) supporting WLAN Access
• Enhanced LTE-WLAN Aggregation (LWA)
• Enhanced LTE WLAN Radio Level Integration with IPsec Tunnel (eLWIP)
• Positioning Enhancements for GERAN
• New GPRS algorithms for EASE
• RRC optimization for UMTS
• Multi-Carrier Enhancements for UMTS
• DTX/DRX enhancements in CELL_FACH
• LTE radio improvements
• Enhancements on Full-Dimension (FD) MIMO for LTE
• Downlink Multiuser Superposition Transmission for LTE
• Performance enhancements for high speed scenario in LTE
• Control and User Plane Separation (CUPS) of EPC nodes
• Paging Policy Enhancements and Procedure
• Shared Subscription Data Update
• Service Domain Centralization
• Control of Applications when Third party Servers encounter difficulties
• PS Data Off Services
• Enhancement to Flexible Mobile Service Steering 
• Sponsored data connectivity improvements
• Group based enhancements in the network capability exposure functions
• Improved operator control using new UE configuration parameters
• Charging and OAM stand alone improvements
• Rel-14 Charging
• ...

Further Reading:

• 3GPP Release 14 - Techplayon
• Enhanced Television Services over 3GPP eMBMS
• RAN Evolution of LTE in Release 14
• 3GPP announces RAN work programme for R14
• LTE System Information According to Release 14 (3GPP TS 36.300 V14.3.0 )

SMS is 25 years old today

SMS is 25 years old. The first SMS, "Merry Christmas" was sent on 3rd December 1992 from PC to the Orbitel 901 handset (picture above), which was only able to receive SMS but not send it. Sky news has an interview with Neil Papworth - the man who sent the very first one back in 1992 here.

While SMS use has been declining over some time, thanks to messaging apps on smartphones like WhatsApp, Viber, Facebook messenger, etc., it is still thought to be used for sending 20 billion messages per day.

While I dont have the latest figures, according to analyst Benedict Evans, WhatsApp and WeChat combined are now at over 100bn messages per day.

The global SMS system peaked at maybe 20bn messages a day. WhatsApp and WeChat combined are now at over 100bn

— Benedict Evans (@BenedictEvans) November 12, 2017

According to Daily Mirror, by the end of 2017, researchers expect 32 trillion messages to be sent annually over apps compared to only 7.89 trillion text messages.

You DO understand that everybody in the light blue part can be reached by SMS?
And the green line is all who can be reached by the internet.
FB is far less than green line.
Apps far less than FB.
Whatsapp far less than apps
RT @gassee pic.twitter.com/2ZCZR6ynjI

— Tomi Ahonen (@tomiahonen) November 28, 2017

Tomi Ahonen makes an interesting in the tweet above, all cellular phone users have SMS capability by default while only smartphone users who have downloaded the messaging apps can be reached by a particular messaging app. The reach of SMS will always be more than any competing apps.

That is the reason why GSMA is still betting on RCS, an evolution of SMS to compete with the messaging apps. My old post on RCS will provide some basic info here. A very recent RCS case studies document from GSMA here also provides some good info.

RCS will have a lot of hurdles and challenges to overcome to succeed. There is a small chance it can succeed but this will require change of mindset by operators, especially billing models for it to succeed.

Dean Bubley from Disruptive Analysis is a far bigger skeptic of RCS and has written various posts on why it will fail. One such post that makes interesting reading is here.

Anyway, love it or hate it, SMS is here to stay!

See Also:

• Lost in Time – The Fathers of SMS

Macrocells, Small Cells & Hetnets Tutorial

I blogged about it on the Small Cells blog but cross posting here, just in case you missed it. I am making some videos sharing basic information about mobile technology. Its on YouTube here.

Recently I made some videos looking at all kinds of cellular infrastructure; playlist is embedded below. If you need slides, get it from 3G4G slideshare channel here.

5G and CBRS Hype?

The dissenting voices on 5G and CBRS are getting louder. While there are many analysts & operators who have been cautioning against 5G, its still moving ahead with a rapid pace. In the recent Huawei Mobile Broadband forum for example, BT's boss admitted that making case for 5G is hard. Bruno Jacobfeuerborn, CTO of Deutsche Telekom on the other hand is sitting on the fence. Dean Bubley's LinkedIn post is interesting too.

Vodafone CTO asked yesterday: "Will 5G be like 2G and 4G, or like 3G?". Now, it's like 3G, designing use cases and apps that nobody knows if they will be successful (e.g. 3G video calling).
2G and 4G were all about letting users/developers create their own. #HWMBBF

— Dimitris Mavrakis (@dmavrakis) November 16, 2017

. @BJacobfeuerborn says the forthcoming glut of sporting events in Asia (three Olympics, winter and summer, in next five years) will give them a 5G headstart. "If you want to do massive infrastructure investment, you need events." #HWMBBF

— Mobile Europe (@mobileeurope) November 16, 2017

Anyway, we have storified most of the tweets from Huawei Mobile Broadband Forum here.

Signals Research Group recently published their Signals Flash report, which is different from the more detailed Signals Ahead reports looking at 5G and CBRS, in addition to other topics. I have embedded the report below (with permission - thanks Mike) but you can download your own copy from here.

The summary from their website will give a good idea of what that is about:

CBRS – Much Ado About Not Very Much.  The FCC is heading in the right direction with how it might regulate the spectrum. However, unless you are a WISP or a private entity looking to deploy a localized BWA service, we don’t see too many reasons to get excited.

Handicapping the 5G Race.  Millimeter wave networks will be geographically challenged, 600 MHz won’t scale or differentiate from LTE, Band 41 may be the most promising, but this isn’t saying much. Can network virtualization make a winner?

It makes no Cents! Contrary to widespread belief,  5G won’t be a new revenue opportunity for operators – at least in the near term. The vertical markets need to get on board while URLLC will lag eMBB and prove far more difficult to deploy.

This Fierce Wireless article summarises the issues with CBRS well.

“While (some) issues are being addressed, the FCC can’t solve how to carve up 150 MHz of spectrum between everyone that wants a piece of the pie, while also ensuring that everyone gets a sufficient amount of spectrum,” the market research firm said in a report. “The 150 MHz is already carved up into 7- MHz for PAL (Priority Access License) and 80 MHz for GAA (General Authorized Access). The pecking order for the spectrum is incumbents, followed by PAL, and then by GAA…. 40 MHz sounds like a lot of spectrum, but when it comes to 5G and eMBB, it is only somewhat interesting, in our opinion. Further, if there are multiple bidders going after the PAL licenses then even achieving 40 MHz could be challenging.”

Signals said that device compatibility will also be a significant speed bump for those looking to leverage CBRS. Manufacturers won’t invest heavily to build CBRS-compatible phones until operators deploy infrastructure “in a meaningful way,” but those operators will need handsets that support the spectrum for those network investments to pay dividends. So while CBRS should prove valuable for network operators, it may not hold as much value for those who don’t own wireless infrastructure.

“The device ecosystem will develop but it is likely the initial CBRS deployments will target the more mundane applications, like fixed wireless access and industrial IoT applications,” the firm said. “We believe infrastructure and devices will be able to span the entire range of frequencies—CBRS and C-Band—and the total amount of available spectrum, combined with the global interest in the C-Band for 5G services, will make CBRS more interesting and value to operators. Operators will just have to act now, and then wait patiently for everything to fall into place.”

While many parts of the world are focusing on using frequencies around and above 3.5GHz for 5G, USA would be the only country using it for 4G. I suspect that many popular devices may not support CBRS but could be good for Fixed Wireless Access (FWA). It remains to be seen if economy of scale would be achieved.

Signals Flash Nov 2017: 5G in Americas | Signals Research Group from 3G4G